Upload and Download your favorite Porn Videos…

Could not be any more straightforward. Yet, you can get more form this website then just its videos.

There is parameter that is vulnerable to blind mysql injection that creates a security breach in the system allowing one to download the entire data base And by that we mean site admins, clients, users, etc

Here you have the DB:

available databases [4]:

[*] bigtube
[*] information_schema
[*] intern
[*] test

In the “internal” data base you can find among other things, the admins login details:

Database: intern
Table: user
+——-+————-+—
| admin | user_name | user_pass |
+——-+————-+—
| 2 | stefan | 4861+steve |
| 2 | Michael | albertina6 |
| 2 | chavdar | marinov |
| 2 | Widholm | 1forme4you |
| 2 | morgothsrs | evitaerc |
| 2 | admin | wanchai |
| 0 | Billiani | starbase |
| 0 | assistantlp | 2ab58dce1e |
| 0 | assistantaw | andrewern |
| 0 | boring | hnv35m802f597gh4 |
+——-+————-+—–

And, it seems this is an international fashion nowadays, they keep more then one website on the same mysql server. Bigtube is identincal in many ways to Redtube, with the difrence being that on Bigtube premium users can donwload entire movies.

Lets see the passwords for the first 10 in a very long list.. :

Database: bigtube
Table: user
|————————+——
| pass | user_name |
|————————+—–
| 3489tnj3894tvm3489t | Videohub |
| alisonangel.common6 | AlisonAngel |
| ideepthroat.common6 | IDeepThroat |

Versiunea in limba romana:

Upload and Download your favorite Porn Videos… nu e mare lucru de tradus. Doar ca, in afara acelor clipuri, din cauza unui parametru vulnerabil la blind sql injection, se poate “descarca” si toata baza de date. Cu datele de logare a adminilor, clientilor, etc.
Sa vedem prima data bazele de date:

available databases [4]:
[*] bigtube
[*] information_schema
[*] intern
[*] test

In baza de date “intern” gasim printre altele si datele de logare a adminilor:

Database: intern
Table: user
+——-+————-+—
| admin | user_name | user_pass |
+——-+————-+—
| 2 | stefan | 4861+steve |
| 2 | Michael | albertina6 |
| 2 | chavdar | marinov |
| 2 | Widholm | 1forme4you |
| 2 | morgothsrs | evitaerc |
| 2 | admin | wanchai |
| 0 | Billiani | starbase |
| 0 | assistantlp | 2ab58dce1e |
| 0 | assistantaw | andrewern |
| 0 | boring | hnv35m802f597gh4 |
+——-+————-+—–

Si upsss, surpriza! Se pare ca nu doar in Romania e la moda ca pe acelasi server mysql sa se tina bazele de date ale altor site-uri. Bigtube este un site identic ca si redtube , diferenta e ca de pe bigtube se pot descrca filme intregi, nu doar secvente, desigur pentru membrii premium.

Sa vedem parolele pentru primii 10 membrii, dintr-o lista lunga:

Database: bigtube
Table: user
|————————+——
| pass | user_name |
|————————+—–
| 3489tnj3894tvm3489t | Videohub |
| alisonangel.common6 | AlisonAngel |
| ideepthroat.common6 | IDeepThroat |
| virtuagirl2.common6 | VirtuaGirlHD |
| nubiles.netmon6 | Nubiles |
| seventeenvideo.common6 | ClubSeventeen |
| twistys.com.coopmon6 | Twistys |
| littlelupe.common6 | LittleLupe |
| accmon6 | ACC |
| h5349vnt9384mht93mj | Focus |
+————————+-

Related Posts

• February 18, 2009 -- [emea].symantec.com – blind sql injection
• February 11, 2009 -- F-Secure.com – SQL Injection + Cross Site Scripting
• February 10, 2009 -- Yahoo! epic fail – permanent xss unleashed
• February 9, 2009 -- [Hacked]Bitdefender (Portugal) exposes sensitive customer data
• February 8, 2009 -- Response for theregister.co.uk