- Hacker Uses XSS and Google Street View Data to Determine Physical Location
- CAnCAn te iubim, CA CA tine nu gasim. Superfete.cancan.ro e de rahat
- Deface (?!?) pe Cotidianul.ro
- Virusi in clipuri video [how to]
- Cyber-Bullying – palma parinteasca a noului mileniu
- Christopher “moot” Poole: The case for anonymity online
- Wtf Avira?
- Some old story about tagged.com
- Pwning cam girls for fun
- Tabloshit
- Yahoo! again - XSS in Uncategorized (357 Visits)
- Yahoo! again - bad settings? in Uncategorized (252 Visits)
- Fanii nostri in Uncategorized (183 Visits)
- Frustrant in Uncategorized (146 Visits)
- La multi ani România, la multi ani românilor in Uncategorized (137 Visits)
- Weblog.ro - Shell via Local File Inclusion in Uncategorized (119 Visits)
- Yahoo! epic fail - permanent xss unleashed in Uncategorized (50 Visits)
- ... in Uncategorized (38 Visits)
- XSS Ownage - hi5 vs. Yahoo! + video in Uncategorized (2 Visits)
- Ce nu se invata la scoala - Tipuri si tehnici spam/Hi5 (4) in Uncategorized (2 Visits)
- Hackersblog.org is now blog.rstcenter.com in (1770 Visits)
- O mica dar importanta precizare in (1371 Visits)
- Twitter in (805 Visits)
- This is the end in (777 Visits)
- Ce servicii de mail folositi? in (773 Visits)
- Un nou membru in (730 Visits)
- La multi ani România, la multi ani românilor in (718 Visits)
- Inca o pierdere de timp in (675 Visits)
- De reţinut in (634 Visits)
- Azi este ziua userilor hackersblog.org in (610 Visits)
- SMS scam (1) in (564 Visits)
- Dezinformare sau proasta informare? in (563 Visits)
- Hi5.com coders read this in (553 Visits)
- Phishing Raiffeisen cu atasament html in (516 Visits)
- Phishing Bancpost in (486 Visits)
- Si tentativele de phishing pot fi amuzante in (422 Visits)
- Ce nu se invata la scoala - Tipuri si tehnici spam/mail (2) in (2707 Visits)
- Ce nu se invata la scoala - Tipuri si tehnici spam/Hi5 (4) in (2601 Visits)
- Despre CSRF, hi5.com, cum sa trisezi la concursuri s.a.m.d. in (1143 Visits)
- [Utilitare] Suna gratis de pe internet sau de pe iPhone in (1107 Visits)
- Ce nu se invata la scoala - (D)DOS (5) in (950 Visits)
- Virusi in clipuri video [how to] in (838 Visits)
- Ce nu se invata la scoala - Tipuri si tehnici spam (1) in (725 Visits)
- Yahoo! redirects - a big issue (with video) in (570 Visits)
- Internet vs. privacy (1) in (469 Visits)
- Ca musca in... in (435 Visits)
- RedTube.com ... The Free Sex Video Community in (12973 Visits)
- usa.kaspersky.com hacked ... full database acces , sql injection in (4921 Visits)
- libertatea.ro vulnerabil la (blind) sql injection in (2950 Visits)
- Pwning cam girls for fun in (2586 Visits)
- Telegraph.co.uk hacked, sql injection in (2547 Visits)
- Facebook hacked - sql injection in (2425 Visits)
- Simpatie.ro, matrimoniale3x.ro, apetisant.ro, deliciu.ro , etc Sql injection in (2406 Visits)
- F-Secure.com - SQL Injection + Cross Site Scripting in (1775 Visits)
- [Hacked]Bitdefender (Portugal) exposes sensitive customer data in (1744 Visits)
- Wtf Avira? in (1723 Visits)
- Christopher "moot" Poole: The case for anonymity online in (1495 Visits)
- Digital Photocopiers Loaded With Secrets in (1458 Visits)
- Wannabe Hackers [2] - cum sa faci un virus by sppy_hacker in (592 Visits)
- Wannabe Hackers [1] - Cum sa hack-uiesti RapidShare-ul in (590 Visits)
- Hope 2603 – Kevin Mitnick - Life a Computer Hacker – Revealed in (463 Visits)
- PRIVACY IS DEAD - GET OVER IT, Pt 01-34 (Recommended by Hackersblog ) in (396 Visits)
- Oldies but goodies - Freedom Downtime - The Story of Kevin Mitnick in (379 Visits)
- [Video] The History Of Hacking in (373 Visits)
- Email Security - Why You Should Encrypt Your Email - Part One in (368 Visits)
- The Story of DEFCON in (343 Visits)
- Deface - tuttoaffari.lastampa.it si citymusiclab.city.corriere.it in (3493 Visits)
- RNS vs. RAI - citizenreport.rai.it hacked. in (3300 Visits)
- Hi5 email finder si sfarsitul a tot ceea ce inseamna privacy in social networking in (2996 Visits)
- Se poate sparge parola de Yahoo? in (2572 Visits)
- Free SMS time, TrimiteSMS.ro in (2492 Visits)
- Planete-plus-intelligente.lemonde.fr defaced by R.N.S. in (2464 Visits)
- Gmail uber hacking in (2256 Visits)
- Camera de supraveghere a universitatii Alexandru Ioan Cuza din Iasi in (2255 Visits)
- Cancan.ro spart pentru a doua oara intr-o zi in (2252 Visits)
- Stiri cu antena3 in (2208 Visits)
Posted on February 21st, 2009
“Finde mit StayFriends – der Freunde-Suchmaschine – ehemalige Klassenkameraden, Kollegen, Absolventen, alte Liebschaften und verschollene Freunde wieder !”
A very popular website in Germany with branches throughout Europe and over the Ocean in countries like Sweden, France, Austria, USA and Canada.
This is a site with some 7.540.881 registered users. (Die Nr. 1 in Deutschland mit 7.540.881 Mitgliedern) (No 1 in Germany with 7.540.881 members)
It is a meeting place for graduates, classmates, and friends. Unfortunately this site is guilty of the same sin as the others we’ve been dealing with in the recent past. Take one of the paramters, modify it, and you gain access to a behemoth database.
Lets see the usernames and passwords for mysql.user:
As a proof of the large number of registered users in the Person data base i made a screenshot with the name, email and password of the 6.000.000th user.
In the database you can also find some data about CC (credit card):
As well as the name, address, email and social security number (SSN) of those users:
RO version:
“Finde mit StayFriends – der Freunde-Suchmaschine – ehemalige Klassenkameraden, Kollegen, Absolventen, alte Liebschaften und verschollene Freunde wieder !”
Un site foarte popular in Germania cu sectiuni in Suedia, Franta, Austria, USA si Canada. Un site care are 7.540.881 de useri inregistrati. (Die Nr. 1 in Deutschland mit 7.540.881 Mitgliedern )
Un site de intalniri pentru absolventi, fosti colegi de clasa, prieteni. Un site care din cauza unui parametru prost sanitizat permite full acces la o baza de date imensa.
Sa vedem username si parolele pentru mysql.user:
Drept dovada pentru numarul mare de inregistrati din baza de date Person (persoane) am facut un print screen cu numele, emailul si parola userului cu numarul de inregistrare 6.000.000
In baza de date se mai gasesc si niste date partiale de card:
Cat si numele, adresa , emailul si socialsecuritynumber (ssn)-ul persoanelor respective:
Mi-am permis sa nu blurez sintaxa sqli din poze deoarece vulnerabilitatea a fost rezolvata si parametrul este securizat.
February 21st, 2009 at 4:27 pm
What is the significance of ox3a, may I ask?
February 21st, 2009 at 6:24 pm
hex character for “:” put there to delimit the fields.
February 21st, 2009 at 6:30 pm
foarte tare…..un site cu 7,5 mil utilizatori….sa aiba vulnerabilitatea asta……sunt curios la siteurile romanesti…la fel de prost sunt facute? din punct de vedere al securitatii.
February 21st, 2009 at 6:45 pm
Aha, thanks.
February 21st, 2009 at 11:38 pm
CC CC CC
February 22nd, 2009 at 9:53 pm
Fratilor nu trebuia sa scriu aici dar nu am vazut un email de contact..
Va rog si eu ceva:
Nu puteti sa faceti si voi un SQL INJECTION pe joci.ro pt. ca fac prea multe abuzuri si sterg conturile aiurea.. As vrea sa iau contul cuiva de acolo daca s-ar putea !
Multumesc
February 23rd, 2009 at 1:18 pm
[...] einem Eintrag im Hackerblog lagen bei der Online-Plattform Stayfriends bestimmte Nutzerdaten offen. Über eine SQL-Injektion [...]
February 23rd, 2009 at 3:47 pm
@v1rushel
Depinde contul cui cocos. Ca aici e ca la piata.
Negociem, care da mai mult, primeste contul!
Asa ca, ce dai?
Eu spre exemplu ti-as da niste minte, sa te ajute sa procesezi mai bine inainte sa scri.
February 23rd, 2009 at 6:42 pm
@ John
Am intrebat daca se poate da cred ca asta e raspunsul neputintei
February 24th, 2009 at 5:19 am
Desigur v1rushel
Asta care?
Raspunsul cui?
Fii specific cocosel.
Citez: “As vrea sa iau contul cuiva de acolo daca s-ar putea !”
Eu zic ca se poate. Ia-l!
Nu te opreste nimeni.
February 24th, 2009 at 9:44 pm
@ John mi se pare mie sau tu esti gay ?
cocosel =))
March 26th, 2009 at 11:59 am
cu cine pot vb si io serios?