Wisdomsk.sk exposed passwords in plaintext

December 21st, 2009 igigi

Wisdomsk.sk is pretty small eshop. But I do not make differences between small and big site. It’s all about the same: vulnerabilities.

Enjoy your Christmas gift wisdomsk staff

databases
========
information_schema
wisdomsksk

[database] wisdomsksk
========
wc_adm_linky
wc_autorizacia
wc_config
wc_kategorie
wc_kategorie_del
wc_linky
wc_nakupny_kosik
wc_objednavky_hlavicka
wc_objednavky_obsah
wc_oblast
wc_post_bal
wc_produkty
wc_produkty_del
wc_stavy_objednavky
wc_uzivatelia

[columns] wc_autorizacia
========
aid
sess
cas
user_meno
user_info

[columns] wc_uzivatelia
========
uid
name
pwd
meno
priezvisko

[data] wc_uzivatelia
========
1, tester, tes*****, Peter, Arvay
2, horvath, horv*****,, Vladimr, Horvth
3, adamko, ada*****,, Peter, Adamko

Posted in Uncategorized | No Comments »

Orange.sk hacked

December 19th, 2009 igigi

It’s the Christmas time and many companies were really good this year, so i can now give them my gifts. Merry Christmas, dear Orange staff.

On their site is a lot of tables, so you need to scroll down a little. And they don’t know how to securely setup mysql, that’s why i got an access to mysq.user as you can see.

mysql.user
==========
%:root:*899F3CC66F1F2F871E8D2C26512EF3F2FC5012A7
213.226.225.68:root:*899F3CC66F1F2F871E8D2C26512EF3F2FC5012A7
%:deploy:*C1FCBC2F22E1F149FB0F687AF81C34DC855F7638
%:kalosi:*A3B70FEA2A7EBCC5629F9A41A16D3946A4CEF7C4
localhost:kalosi:*A3B70FEA2A7EBCC5629F9A41A16D3946A4CEF7C4
localhost:deploy:*C1FCBC2F22E1F149FB0F687AF81C34DC855F7638

There is also pretty nice list of users. I removed their phone numbers and sanitized hashes, which were hashed with basic sha1.

id,name,pass,firstname,lastname,mail
===============================
2|Steen|9f395a3e39b74422725*******************************|Michal|Kristín|miso.steen@centrum.sk
8|Cali|f248eecbf674eec2a8e*******************************|Mojmír|Čaloud|grasshoppercz@gmail.com
9|mslavik|db22fd7b56e3f5cf7aa*******************************|Michal|Slavík|michal.slavik@mobilbonus.cz
10|pecko|1bdd2ed7ae14be72f39*******************************|pecko|pecko|peter.javorsky@mb-e.sk
11|tomas|78948078b964957c3e0*******************************|Tomas|Zeman|tomas.zeman@mb-e.sk
12|edems123|0835d1b414bf1857085*******************************|Adam|Margetíny|edems123@azet.sk
13|Christin5266|de524c77bccbd480aef*******************************|Kristina|Vargová|christina0001@centrum.sk
14|chico_nina|7ae9335c18e5f57ab5f*******************************|Nina|Hronkovičová|chico.nina@gmail.com
15|andrea16|cf60119a3039a70899e*******************************|Adriana|Halkova|andrea16@centrum.sk
16|mirbo7|505f7123b441bec5f9a*******************************|michal|urbanek|mirbo7@gmail.com
17|mimmi103|82fa7dcc62b90bc3bf1*******************************|Miriama|Tirpakova|miriamatirpakova@gmail.com
18|m.cmuk|d2728f4b52fcec77f36*******************************|Mária|Lányiová|m.cmuk@azet.sk
19|misko|e5916e153527b783d5f*******************************|michal|istok|zistok1@centrum.sk
20|reneruso|f7c3bc1d808e04732ad*******************************|mato|vrbica|reneruso@pobox.sk
21|o škole|f353bcda85c5ca19cdd*******************************|Ondrej|Mravik|Ondrej_Mravik@pobox.sk
22|Lusyk|b9a02e9f5091ebe2109*******************************|Lucia|Veselská|Loove@pobox.sk
23|kamcoolča|4b99556727d7aa67e58*******************************|Kamilka|Lukáčková|kamciq.lk@gmail.com
24|alena|985cd5c303b01cc4f80*******************************|alena|trajdova|a.trajdova@zoznam.sk
25|SiSa2559|1e4713a7fc885d8a5aa*******************************|Simona |………….|sisa2559@azet.sk

[databases]

anketa_novinarom
=========
hlasovanie
pozvany_pouzivatelia
ucastnici_ankety

esportsonline
=========
mb_livesport_id
mb_reklama
mb_soutez
mb_tretina
mb_tymovy_text
online_akce
online_forum
online_hrac
online_seznam
online_zapas
sms_zpravy
tablename
tabulka

esportsonline_fotbal
=========
mb_livesport_id
mb_reklama
mb_soutez
mb_tretina
mb_tymovy_text
online_akce
online_forum
online_hrac
online_seznam
online_zapas
sms_zpravy
tablename
tabulka
tabulka1

esportsonline_svk_fotbal
=========
mb_livesport_id
mb_reklama
mb_soutez
mb_tretina
mb_tymovy_text
online_akce
online_forum
online_hrac
online_seznam
online_zapas
sms_zpravy
tablename
tabulka

esportsonline_svk_hokej
=========
mb_livesport_id
mb_reklama
mb_soutez
mb_tretina
mb_tymovy_text
online_akce
online_forum
online_hrac
online_seznam
online_zapas
sms_zpravy
tablename
tabulka

flirtuj
=========
kraje
mesta
mwu_user_billing
mwu_user_login
smiles
tera_wurfl_cache
tera_wurfl_devices
tera_wurfl_hybrid
tera_wurfl_patch

futbalportal
=========
msstats_asistencie
msstats_brankari
msstats_goly
msstats_hraci
msstats_muzstva
msstats_zapasy
msstats_zapasy_brankari
msstats_zapasy_hraci

hokej_ms2008
=========
billing_tmp
dph
rs
rs_bleskovky
rs_chat
rs_diskuze
rs_foto
rs_gal
rs_log
rs_odkazy
rs_tipy
rs_type
rs_video
today
web_categories
web_device
web_device_brand
web_item
web_lang
web_settings

hokej_ms2008_wap
=========
bill
bill_categs
billing_tmp
categories
check_stk
favourites
log
logep
oh_athletes
oh_plan
oh_sports
pricelist
remap_categories
services

management_user
=========
user_additional_ohudbe
user_additional_orange
user_additional_orange_interests
user_additional_oskole
user_additional_oskole_colour
user_additional_oskole_hair
user_additional_oskole_subjects
user_additional_osporte
user_login
user_personal
user_session
user_sign-in

orangesk_blackberry
=========
attrib
bb_applications
cross
foto_inc
login
phone
rs

orangesk_browsers
=========
blacklist
blacklist_selector
browsers
user_agent_selector

orangesk_cenzor
=========
cenzors
cenzors_rules
log
params
portals

orangesk_creator
=========
form_val
foto
profiles
rating
styles
vulgarizmy

orangesk_creator_private
=========
form_val
foto
profiles
rating
styles
vulgarizmy

orangesk_diskusia
=========
diskusia
rating
vulgarizmy
zobrazeni

orangesk_downloads
=========
dph
mono_categories
mono_items
rs
rs_ceny
rs_hp
rs_melody
rs_odporuc
rs_promo_wap
rs_tipy
vstream
web_categories
web_category_map
web_device
web_device_brand
web_device_group
web_item
web_lang
web_rating
web_settings
web_type
web_type_sort

orangesk_downloads_wap
=========
bill
bill_categs
billing_tmp
categories
favourites
log
logep
pricelist
promo
remap_categories
services
top

orangesk_edu
=========
abstracts
anketa_odpovedali
anketa_odpovede
anketa_otazky
ano_nie
calendar_events
categories
ciselnik_jazyk
ciselnik_kraje
ciselnik_mesta
ciselnik_okresy
ciselnik_skoly
ciselnik_typy
ciselnik_zriadovatel
classes
contest_assoc
contests
cp_categories
cp_device
cp_device_brand
cp_dph
cp_item
cp_lang
cp_settings
cp_type
detske_otazky
doucovania
form_DVD_code
form_objednavka
form_objednavka_nie_skola
gen_time
insertion
kurzy
log
log_actions
mapy
mt_foto
mt_odkazy
mt_rozvrh_hodin
mt_rozvrh_hodin_poznamky
mt_sutaz_rating
mt_triedy
mt_users_data
mt_zabavne_texty
obrazky_info
oly_answers
oly_answers_bkp
oly_questions
oly_questions_bkp
oly_tests
oly_tests_bkp
oly_users
oly_users_bkp
poradna_offline
poradna_online
poradna_temy
raters
regions
rs
rs_categories
rs_diskuze
rs_diskuze_burza
rs_diskuze_temy
rs_foto
rs_user_groups
rs_users
rs_video
rs_video_old
rs_vulgarizmy
skoly
skoly_test
stipendia
subjects
teachingItems
test_questions
test_rs_rel
tests
tests_uspesnost
ugc
ugc_log
ugc_nahlas
ugc_order
ugc_rating
ugc_tag
ugc_tag_map
ugc_type
users
video_data
video_kody

orangesk_edu_kubo
=========
abstracts
anketa_odpovedali
anketa_odpovede
anketa_otazky
ano_nie
calendar_events
categories
ciselnik_jazyk
ciselnik_kraje
ciselnik_mesta
ciselnik_okresy
ciselnik_skoly
ciselnik_typy
ciselnik_zriadovatel
classes
contest_assoc
contests
cp_categories
cp_device
cp_device_brand
cp_dph
cp_item
cp_lang
cp_settings
cp_type
detske_otazky
doucovania
form_DVD_code
form_objednavka
form_objednavka_nie_skola
gen_time
insertion
kurzy
log
log_actions
mapy
mt_foto
mt_odkazy
mt_rozvrh_hodin
mt_rozvrh_hodin_poznamky
mt_sutaz_rating
mt_triedy
mt_users_data
mt_zabavne_texty
obrazky_info
oly_answers
oly_answers_bkp
oly_questions
oly_tests
oly_users
oly_users_bkp
poradna_offline
poradna_online
poradna_temy
raters
regions
rs
rs_categories
rs_diskuze
rs_diskuze_burza
rs_diskuze_temy
rs_foto
rs_user_groups
rs_users
rs_video
rs_video_old
rs_vulgarizmy
skoly
skoly_test
stipendia
subjects
teachingItems
test_questions
test_rs_rel
tests
tests_uspesnost
ugc
ugc_log
ugc_nahlas
ugc_order
ugc_rating
ugc_tag
ugc_tag_map
ugc_type
users
video_data
video_kody

orangesk_edu_wap
=========
categories
log
remap_categories
services

orangesk_hudba
=========
dph
flash_game
flash_game_mail
gen_time
misha_mp3
mp3_predna
naseptavac_cliplist
promo_cp_roh
rs
rs_categories
rs_chat
rs_crbt
rs_diskuze
rs_eshop
rs_foto
rs_genre_map
rs_lyrics
rs_rating
rs_rebricky
rs_redakce_log
rs_special
rs_stream
rs_tag
rs_tag_map
rs_title
rs_ugc_hp
rs_video
rs_vstupenky
rs_vulgarizmy
soutez_slavik
top_ten_rating
ugc
ugc_categories
ugc_category_type
ugc_diskuze
ugc_friends
ugc_genres
ugc_genres_more
ugc_mms_soutez
ugc_nahlas
ugc_order
ugc_playlists
ugc_pm
ugc_pokus
ugc_profiles
ugc_profiles_data
ugc_rating
ugc_soutez_hlasy
ugc_soutez_odpoved
ugc_soutez_otazky
ugc_tag
ugc_tag_map
ugc_type
user_rating
valentin_categories
valentin_content_map
valentin_item
valentin_sms
web_categories
web_device
web_device_brand
web_item
web_item_ext
web_lang
web_settings
web_type

orangesk_hudba_kalendar
=========
bad_meetings
base_locality
meetings
meetings_lock
meetings_logged
project

orangesk_hudba_test
=========
dph
flash_game
flash_game_mail
gen_time
misha_mp3
mp3_predna
naseptavac_cliplist
promo_cp_roh
rs
rs_categories
rs_chat
rs_crbt
rs_diskuze
rs_eshop
rs_foto
rs_genre_map
rs_lyrics
rs_rating
rs_rebricky
rs_redakce_log
rs_special
rs_stream
rs_tag
rs_tag_map
rs_title
rs_video
rs_vstupenky
rs_vulgarizmy
soutez_slavik
top_ten_rating
ugc
ugc_categories
ugc_category_type
ugc_diskuze
ugc_friends
ugc_genres
ugc_genres_more
ugc_nahlas
ugc_order
ugc_playlists
ugc_pm
ugc_pokus
ugc_profiles
ugc_profiles_data
ugc_rating
ugc_tag
ugc_tag_map
ugc_type
user_rating
valentin_categories
valentin_content_map
valentin_item
valentin_sms
web_categories
web_device
web_device_brand
web_item
web_lang
web_settings
web_type

orangesk_hudba_wap
=========
bill
bill_categs
billing_tmp
favourites
log
remap_categories
services

orangesk_l10n
=========
texts

orangesk_lenny
=========
album
dph
lyrics
rs
rs_bleskovky
rs_diskuze
rs_foto
rs_type
rs_video
video
web_categories
web_device
web_device_brand
web_item
web_lang
web_settings
web_type

orangesk_lenny_wap
=========
bill
bill_categs
billing_tmp
categories
favourites
log
logep
pricelist
remap_categories
services

orangesk_login
=========
oskole_video_codes
oskole_video_codes_validity
user_data
user_data_hudba
user_data_other
user_data_skola
user_data_sms_code
user_data_sport
user_logged
user_not_authorized

orangesk_login2
=========
user_data
user_data_hudba
user_data_other
user_data_skola
user_data_sport
user_logged
user_not_authorized

orangesk_mcbox_smschat
=========
sms_chat

orangesk_nadacia
=========
rs
rs_aktuality
rs_categories
rs_diskusia
rs_emotikony
rs_foto
rs_video
rs_vulgarizmy

orangesk_nadacia_test
=========
rs
rs_aktuality
rs_categories
rs_diskusia
rs_emotikony
rs_foto
rs_video
rs_vulgarizmy

orangesk_obf
=========
obf

orangesk_oms
=========
album
artist
dph
gen_time
rs
rs_diskuze
rs_foto
rs_portal
rs_program
rs_type
rs_video
rs_video_tmp
web_categories
web_device
web_device_brand
web_item
web_lang
web_settings
web_type

orangesk_oms2
=========
album
artist
dph
gen_time
rs
rs_diskuze
rs_foto
rs_portal
rs_program
rs_type
rs_video
rs_video_tmp
web_categories
web_device
web_device_brand
web_item
web_lang
web_settings
web_type

orangesk_oms2_wap
=========
bill
bill_categs
billing_tmp
categories
favourites
log
logep
pricelist
remap_categories
services

orangesk_oms_wap
=========
bill
bill_categs
billing_tmp
categories
favourites
log
logep
pricelist
remap_categories
services

orangesk_script_stat
=========
script_run_time

orangesk_tag_clouds
=========
significant_tag
tag_searched

portal
=========
billing_tmp
dph
euro_cards
euro_matches
euro_players
euro_tables
euro_teams
hudba_video
oh_athletes
oh_disciplines
oh_plan
oh_sports
oh_sports_gen_form
oh_sports_results
oh_sports_results_tables
rs
rs_bleskovky
rs_chat
rs_diskuze
rs_foto
rs_gal
rs_log
rs_odkazy
rs_tipy
rs_type
rs_video
test_counter
today
web_categories
web_device
web_device_brand
web_item
web_lang
web_settings

portal_test
=========
anketa_odpovedali
anketa_odpovede
anketa_otazky
billing_tmp
blog_bloggers
countries
dph
euro_cards
euro_matches
euro_players
euro_tables
euro_teams
hashes
hist_hraci
hist_hraci_posty
hist_stat_brankari
hist_stat_hraci
hist_sutaz
hokej_hraci
hokej_hraci_posty
hokej_stat_brankari
hokej_stat_hraci
hokej_sutaz
hudba_video
ms2009_hokej
ms2009_rozpis
ms2009_skupiny
ms2009_skupiny_mapa
ms2009_tabulky
ms2009_timy
ms2009_udaje
ms2009_vysledky
ms20_hokej
ms20_skupiny
ms20_skupiny_mapa
ms20_tabulky
ms20_timy
ms20_udaje
ms20_vysledky
oh_athletes
oh_disciplines
oh_plan
oh_sports
oh_sports_gen_form
oh_sports_results
oh_sports_results_tables
omt_rozpis
omt_skupiny
omt_skupiny_mapa
omt_tabulky
omt_timy
omt_vysledky
pokus
rs
rs_adverts
rs_audio
rs_autor
rs_av_subcats
rs_banner
rs_bleskovky
rs_categories
rs_chat
rs_disciplines
rs_diskuze
rs_emotikony
rs_foto
rs_gal
rs_gal_diskusia
rs_homepage
rs_hraci
rs_kalendar
rs_log
rs_loga_ciselnik
rs_odkazy
rs_onlajny_ciselnik
rs_pGallery
rs_redakce
rs_redakce_log
rs_results_basket
rs_results_tenis
rs_right_box
rs_sportrelax_ciselnik
rs_sports
rs_sports_gen_form
rs_sports_results
rs_sports_results_tables
rs_tabulky
rs_tag
rs_tag_map
rs_timy
rs_tipy
rs_title
rs_type
rs_video
rs_video_old
rs_video_top10
rs_video_types
rs_voters
rs_vulgarizmy
rs_zal
stats_keepers
stats_players
stats_teams
sutaz1_kody
sutaz1_user
sutaz1_video
sutaz_otazky_web
sutaz_tampa
sutaz_tampa_old
sutaz_tokens_web
sutaz_user
sutaz_users_web
test_counter
today
ugc
ugc_log
ugc_nahlas
ugc_order
ugc_rating
ugc_soutez_hlasy
ugc_soutez_log
ugc_soutez_odpoved
ugc_soutez_otazky
ugc_tag
ugc_tag_map
ugc_type
web_categories
web_device
web_device_brand
web_item
web_lang
web_settings

portal_test_kubo
=========
billing_tmp
dph
euro_cards
euro_matches
euro_players
euro_tables
euro_teams
hudba_video
oh_athletes
oh_disciplines
oh_plan
oh_sports
oh_sports_gen_form
oh_sports_results
oh_sports_results_tables
rs
rs_bleskovky
rs_categories
rs_categories_backup_2008-11-20
rs_chat
rs_disciplines
rs_diskuze
rs_foto
rs_gal
rs_homepage
rs_hraci
rs_kalendar
rs_log
rs_loga_ciselnik
rs_odkazy
rs_onlajny_ciselnik
rs_pGallery
rs_redakce
rs_redakce_log
rs_results_basket
rs_results_tenis
rs_sportrelax_ciselnik
rs_sports
rs_sports_gen_form
rs_sports_results
rs_sports_results_tables
rs_timy
rs_tipy
rs_title
rs_type
rs_video
rs_video_old
rs_vulgarizmy
rs_zal
sportrelax_league
sportrelax_match_event
sportrelax_match_event_type
sportrelax_match_status
sportrelax_matches
sportrelax_season
sportrelax_team
sutaz1_kody
sutaz1_user
sutaz1_video
sutaz_tampa
sutaz_tampa_old
sutaz_user
test_counter
today
ugc
ugc_categories
ugc_log
ugc_nahlas
ugc_order
ugc_rating
ugc_tag
ugc_tag_map
ugc_type
web_categories
web_device
web_device_brand
web_item
web_lang
web_settings

portal_test_test
=========
billing_tmp
dph
euro_cards
euro_matches
euro_players
euro_tables
euro_teams
hudba_video
ms20_hokej
ms20_skupiny
ms20_skupiny_mapa
ms20_tabulky
ms20_timy
ms20_udaje
ms20_vysledky
oh_athletes
oh_disciplines
oh_plan
oh_sports
oh_sports_gen_form
oh_sports_results
oh_sports_results_tables
pokus
rs
rs_audio
rs_autor
rs_banner
rs_bleskovky
rs_categories
rs_chat
rs_disciplines
rs_diskuze
rs_foto
rs_gal
rs_homepage
rs_hraci
rs_kalendar
rs_log
rs_loga_ciselnik
rs_odkazy
rs_onlajny_ciselnik
rs_pGallery
rs_redakce
rs_redakce_log
rs_results_basket
rs_results_tenis
rs_sportrelax_ciselnik
rs_sports
rs_sports_gen_form
rs_sports_results
rs_sports_results_tables
rs_tabulky
rs_tag
rs_tag_map
rs_timy
rs_tipy
rs_title
rs_type
rs_video
rs_video_old
rs_video_top10
rs_voters
rs_vulgarizmy
rs_zal
stats_keepers
stats_players
stats_teams
sutaz1_kody
sutaz1_user
sutaz1_video
sutaz_tampa
sutaz_tampa_old
sutaz_user
test_counter
today
ugc
ugc_categories
ugc_log
ugc_nahlas
ugc_order
ugc_rating
ugc_tag
ugc_tag_map
ugc_type
web_categories
web_device
web_device_brand
web_item
web_lang
web_settings

portal_wap
=========
categories
log
remap_categories
services

show_flirtuj
=========
category
category_group
category_key
category_properties
chat_fuck_list
chat_loged_user
chat_message
chat_msg_style
chat_ops
chat_room_project
chat_room_properties
chat_rooms
inquiry
inquiry_row
inquiry_votes
ls_acquaint
ls_acquaint_section
ls_folder
ls_group
ls_group_properties
ls_group_users
ls_lock
ls_meetings
ls_meetings_lock
ls_meetings_logged
ls_photo
ls_rating
ls_rating_alb
ls_seek
ls_visits
ls_vote
message
msg_com
msg_folders
msg_group
msg_in_folder
msg_news
msg_news_group
project
session
user
user_project
user_properties
user_search_cach

show_flirtuj_old
=========
mesta
users

show_flirtus
=========
category
category_group
category_key
category_properties
chat_active_room
chat_count_loged
chat_fuck_list
chat_loged_user
chat_message
chat_msg_style
chat_ops
chat_room_project
chat_room_properties
chat_rooms
inquiry
inquiry_row
inquiry_votes
ls_acquaint
ls_acquaint_section
ls_acquaint_top
ls_folder
ls_group
ls_group_properties
ls_group_users
ls_lock
ls_meetings
ls_meetings_lock
ls_meetings_logged
ls_photo
ls_rating
ls_seek
ls_visits
ls_vote
message
message_f
message_r
msg_folders
msg_in_folder
project
session
sis_session
sis_session_group
user
user_project
user_properties
user_search
view_user

show_meeting
=========
base_locality
meetings
meetings_lock
meetings_logged
project

sportrelax
=========
bill
bill_categs
bill_chat
bill_rounds
categories
check_stk
favourites
futbolmania_bill
futbolmania_bill_categs
futbolmania_categories
futbolmania_remap_categories
futbolmania_services
futbolmania_subscription
log

tera_wurfl
=========
tera_wurfl_cache
tera_wurfl_devices
tera_wurfl_hybrid
tera_wurfl_patch

tera_wurfl_bkp
=========
tera_wurfl_cache
tera_wurfl_devices
tera_wurfl_hybrid
tera_wurfl_patch

Posted in Uncategorized | 48 Comments »

Rockyou.com exposed more than 32 millions of passwords in plaintext

December 15th, 2009 igigi

So i was reading this shit about how some lol company Imperva found a SQLi on Rockyou.com. Yea, right, you’re the best. Too late guys, too late. I’ve got every account downloaded from this shitty site. You were too slow, but what can i expect from you?

There is 32 603 388 customers. Pretty nice list with plain text passwords. It’s so lame, and I’m sure that more than half does work for myspace and other sites.

Don’t lie to your customers, or i will publish everything

Database codedb
===============
OnCallUsers
ReleaseFiles
ReleaseLog
ReleaseSerialize
ReleaseUser
ReleaseWhiteList
UserProjects
files
incomplete_files
srv_file_data
svn_commit_log
svn_push_log
www_servers

Columns www_servers
================
server_name

Data www_servers [115]
================
www200
www202
www203
www204
www205
www206
www207
www208
www209
www210
www211
www212
www213
www214
www215
www216
www217
www218
www219
www220
www221
www222
www223
www224
www225
www226
www227
www228
www229
www230
www231
www232
www233
www234
www235
www236
www237
www241
www242
www243
www244
www245
www246
www247
www248
www249
www250
www251
www252
www253
www254
www255
www256
www257
www258
www259
www260
www261
www262
www263
www264
www265
www266
www267
www268
www269
www270
www271
www272
www273
www274
www275
www278
www279
www280
www281
www282
www283
www284
www285
www286
www287
www288
www289
www290
www291
www294
www295
www296
www297
www298
www299
www300
www301
www302
www303
www304
www305
www306
www307
www308
www309
www310
www311
www312
www313
www314
www315
www316
www317
www318
www319
www320
www321
www322

Columns ReleaseUser
================
userid
name
ldap_user
password
email
superuser

Data ReleaseUser [52]
================
1|Ryo|eng-ryo|roc***|ryo@rockyou.com|1
2|Jia|eng-jia|DuF***|jia@rockyou.com|1
3|Kazu|dev-kazu|nlj***|kazu@rockyou.com|0
4|Lance|eng-lance|frU***|lance@rockyou.com|1
5|Raymond|eng-raymond|h45***|raymond@rockyou.com|1
6|James|eng-james|te9***|james@rockyou.com|1
7|Ernest|ads-ernest|7RQ***|ernest@rockyou.com|1
8|Dathan|eng-dathan|yoy***|dathan@rockyou.com|1
9|David Ma|art-david|4Pa***|david@rockyou.com|0
10|Vinay|pm-vinay|xa3***|vinay@rockyou.com|0
11|Jennifer|pm-jen|KA9***|jennifer@rockyou.com|0
12|Kenneth|dev-kenneth|Xa8***|kenneth@rockyou.com|0
13|Jeremy Tan|dev-jeremyt|HLH***|jeremyt@rockyou.com|0
14|John Hwang|pm-johnh|raG***|johnh@rockyou.com|0
15|Tim|pm-tim|gen***e|tim@rockyou.com|0
16|Arthur Chen|pm-arthur|art***c|authurc@rockyou.com|0
17|Eric|pm-eric|67E***|eric@rockyou.com|0
18|Andrew|pm-andrew|SQN***|andrew@rockyou.com|0
22|John Gentilin|ads-john|sp8***|john@rockyou.com|0
21|Shamik|ads-shamik| Es***|shamik@rockyou.com|0
26|Chuck|eng-chuck|bRe***|chuck@rockyou.com|0
19|Sandy|pm-sandy|stE***|sandy@rockyou.com|0
23|Alex Grichuk|eng-alexander|5uw***|alexander@rockyou.com|1
24|Ibrahim|eng-ibrahim|AF$***|ibrahim@rockyou.com|1
25|Len|eng-len|&Ab***|len@rockyou.com|1

Database partners
===============
Partner
PostSections

Columns Partner
================
partnerid
createddate
modifieddate
state
partnername
username
password
test_authtoken
test_username
test_password
post_url
iframe_url
home_url
directons
import_type
publish_type

Data Partner [139]
================
1|ryonations|aho*****|ryo ishizuka
9|mekatek@gmail.com|460*****|jia
12|albert_magnuson@yahoo.com|num*****|Friendster
13|ro@rockyou.com|460*****|altamerc
14|admin@bstar.com|461*****|bStar
18|ododo@dodood.com|461*****|dddee
19|rsiu@tickleinc.com|jka*****|ringo
20|ajmagnu@gmail.com|461*****|AJ's Site
21|jia@rockyou.com|mek*****|rockstar
22|peter@rockyou.com|461*****|peter
23|eugene.j.park@gmail.com|461*****|eugenejpark
24|eugene@flixster.com|pas*****|Flixster
25|nemwmin@aol.com|462*****|Adam
26|aj@rockyou.com|xan*****|Xanga
27|greg@asw.com|464*****|asw
28|gareth@asw.com|464*****|asmallworld
29|grendler@socialconcepts.com|fre*****|fubar
30|kenny@amikoo.com|464*****|Amikoo
31|support@piczotube.co.uk|465*****|PiczoTube
32|joelovesfishing246@hotmail.com|465*****|Media Dump
33|adam@urtab.com|suz*****|UrTab
34|bodenpat@iclltd.com|bad*****|Badongo
35|business@zorpia.com|465*****|Zorpia
36|lycan@groovenet.ph|465*****|GrooveNet
37|w.steward@fileden.com|466*****|FileDen

Database phpmyfaq
===============
faqadminlog
faqcaptcha
faqcategories
faqcategory_group
faqcategory_user
faqcategoryrelations
faqchanges
faqcomments
faqconfig
faqdata
faqdata_group
faqdata_revisions
faqdata_tags
faqdata_user
faqglossary
faqgroup
faqgroup_right
faqlinkverifyrules
faqnews
faqquestions
faqright
faqsessions
faqtags
faquser
faquser_group
faquser_right
faquserdata
faquserlogin
faqvisits
faqvoting

Database rockmyspace
===============
App
CoRegistration
CoRegistrationService
Comment
ContactList
CountDown
CountDownPublished
Email_list
Email_list_final
FXTextPublished
Favorite
GamesRating
Genre
GizmozPublished
GmailUserInfo
HoroscopePublished
Instance
LayoutCategory
Likeness
MochiAdsGames
MySpaceFoo
MySpaceLikenessContactComment
MySpaceUserInfo
MySpace_Foo
MySpace_List
ObamaSupporters
ObamaSupportersSlideshow
PageFlashPublished
PersonalBoard
PersonalBoardObjects
Pets
PetsBattleLog
PhotoFX
PhotoFXDetail
PhotoFXObjects
PhotoFXPublished
PicInstance_10
PicInstance_11
PicInstance_12
PicInstance_13
PicInstance_14
PicInstance_15
PicInstance_16
PicInstance_17
PicInstance_18
PicInstance_19
PicInstance_5
ProUser
Razz
ScratchInstance
ScratchInstancePublished
SlideshowPublished
SlideshowUnsuitable
Song
SongChoice
SongGenre
SpamReport
TextPixPublished
TopShows
Unsubscription
User
UserAccount
UserDatranUnsub
UserDetail
UserMessage
UserMessageBlockList
UserPoints
UserPointsEvents
UserPointsTransactions
UserReferer
UserScrape
Video2Categories
Video2Tags
VideoCategories
VideoTags
Videos
Voicemail

Columns UserAccount
================
userid
username
password
type
allowmail

Data UserAccount [32603388]
================
1|jennaplanerunner@hotmail.com|mek*****|myspace|0|bebo.com
2|phdlance@gmail.com|mek*****|myspace|1|
3|jennaplanerunner@gmail.com|mek*****|myspace|0|
5|teamsmackage@gmail.com|pro*****|myspace|1|
6|ayul@email.com|kha*****|myspace|1|tagged.com
7|guera_n_negro@yahoo.com|emi*****|myspace|0|
8|beyootifulgirl@aol.com|hol*****|myspace|1|
9|keh2oo8@yahoo.com|cai*****|myspace|1|
10|mawabiru@yahoo.com|pur*****|myspace|1|
11|jodygold@gmail.com|att*****|myspace|1|
12|aryan_dedboy@yahoo.com|iri*****|myspace|0|
13|moe_joe_25@yahoo.com|725*****|myspace|1|
14|xxxnothingbutme@aol.com|1th*****|myspace|0|
15|meandcj069@yahoo.com|too*****|myspace|0|
16|stacey_chim@hotmail.com|cxn*****|myspace|1|
17|barne1en@cmich.edu|ilo*****|myspace|1|
18|reo154@hotmail.com|ecu*****|myspace|1|
19|natapappaslie@yahoo.com|tor*****|myspace|0|
20|ypiogirl@aol.com|tob*****|myspace|1|
21|brittanyleigh864@hotmail.com|bet*****|myspace|1|myspace.com
22|topenga68@aol.com|che*****|myspace|0|
23|marie603412@yahoo.com|cat*****|myspace|0|
24|mellowchick41@aol.com|chu*****|myspace|0|
25|baiko0o@aol.com|may*****|myspace|0|
26|indahamzah84@hotpop.com|lov*****|myspace|0|

Database rockyou
===============
Cat_10_Date_Cache_12070719B
Cat_10_Rank_Cache_12070719B
Cat_10_Views_Cache_12070719B
Cat_11_Date_Cache_12070719B
Cat_11_Rank_Cache_12070719B
Cat_11_Views_Cache_12070719B
Cat_12_Date_Cache_12070719B
Cat_12_Rank_Cache_12070719B
Cat_12_Views_Cache_12070719B
Cat_13_Date_Cache_12070719B
Cat_13_Rank_Cache_12070719B
Cat_13_Views_Cache_12070719B
Cat_1_Date_Cache_09110222B
Cat_1_Rank_Cache_09110222B
Cat_1_Views_Cache_09110222B
Cat_2_Date_Cache_09110222B
Cat_2_Rank_Cache_09110222B
Cat_2_Views_Cache_09110222B
Cat_3_Date_Cache_09110222B
Cat_3_Rank_Cache_09110222B
Cat_3_Views_Cache_09110222B
Cat_4_Date_Cache_12070719B
Cat_4_Rank_Cache_12070719B
Cat_4_Views_Cache_12070719B
Cat_5_Date_Cache_12070719B
Cat_5_Rank_Cache_12070719B
Cat_5_Views_Cache_12070719B
Cat_6_Date_Cache_12070719B
Cat_6_Rank_Cache_12070719B
Cat_6_Views_Cache_12070719B
Cat_7_Date_Cache_12070719B
Cat_7_Rank_Cache_12070719B
Cat_7_Views_Cache_12070719B
Cat_8_Date_Cache_12070719B
Cat_8_Rank_Cache_12070719B
Cat_8_Views_Cache_12070719B
Cat_9_Date_Cache_12070719B
Cat_9_Rank_Cache_12070719B
Cat_9_Views_Cache_12070719B
Category
CategoryMap
CategoryMapStage
CategoryMapTmp
Country
Fans
Friends
PeopleMap
PeopleMapStage
PeopleUserMap
PhotoInstance
Rating
RatingSummary
SlideshowPublished
Src_Cat_10_Date
Src_Cat_10_Rank
Src_Cat_10_Views
Src_Cat_11_Date
Src_Cat_11_Rank
Src_Cat_11_Views
Src_Cat_12_Date
Src_Cat_12_Rank
Src_Cat_12_Views
Src_Cat_13_Date
Src_Cat_13_Rank
Src_Cat_13_Views
Src_Cat_1_Date
Src_Cat_1_Rank
Src_Cat_1_Views
Src_Cat_2_Date
Src_Cat_2_Rank
Src_Cat_2_Views
Src_Cat_3_Date
Src_Cat_3_Rank
Src_Cat_3_Views
Src_Cat_4_Date
Src_Cat_4_Rank
Src_Cat_4_Views
Src_Cat_5_Date
Src_Cat_5_Rank
Src_Cat_5_Views
Src_Cat_6_Date
Src_Cat_6_Rank
Src_Cat_6_Views
Src_Cat_7_Date
Src_Cat_7_Rank
Src_Cat_7_Views
Src_Cat_8_Date
Src_Cat_8_Rank
Src_Cat_8_Views
Src_Cat_9_Date
Src_Cat_9_Rank
Src_Cat_9_Views
Subscription
Tag
TagMap
TagMapStage
WidgetViewTime
contest
instance_daily_hits
instance_hits
instance_hits_read
instance_hits_write

Database wikispace
===============
archive
bbcategory
bbforums
bbposts
bbtopics
categorylinks
email_log
externallinks
filearchive
hitcounter
image
imagelinks
interwiki
ipblocks
job
langlinks
logging
math
objectcache
oldimage
page
page_restrictions
pagelinks
pm
querycache
querycache_info
querycachetwo
recentchanges
redirect
review
revision
search
searchindex
site_stats
templatelinks
text
text_test
trackbacks
transcache
user
user_groups
user_newtalk
watchlist

Posted in Uncategorized | 56 Comments »

Rozzlobenimuzi.com hacked

December 9th, 2009 igigi

Do you like this site? I do a lot, so it was pretty big fun to hack it, so simple, so stupid. Anyway, there was also nothing interesting, just few accounts (oh yea, more than 320 000 and i have all of them).

It was more fun, because after few days, when i finished downloading all of data, somebody defaced their website. I was laughing like a crazy.

Here are few information
===============
Database: rmcom
User: rmcom@77-93-219-70.static.masterinter.net
Version: 5.0.32-Debian_7etch11-log

Tables for database ‘rmcom’
===============
akce1_data
booking
card_id
config
lnk_advert
lnk_affils
lnk_affils_section
lnk_auditorium
lnk_auditorium_item
lnk_babe_comments
lnk_babe_dir
lnk_babe_pic
lnk_babe_votes
lnk_banned
lnk_cache
lnk_category
lnk_category_sub
lnk_chat
lnk_comment
lnk_crossroad
lnk_daily_news
lnk_eshop_orders
lnk_favorites
lnk_friendlist
lnk_info
lnk_linkdump
lnk_links
lnk_links_notworking
lnk_newsletter_data
lnk_pic_comment
lnk_pic_votes
lnk_point
lnk_pornstars_book
lnk_private_msg
lnk_reklama_stats
lnk_shoutbox
lnk_special
lnk_topbar
lnk_users
lnk_users_backup
lnk_users_info
lnk_users_photo
lnk_users_visits
lnk_votes
lnk_word_blacklist
soutez10_data
soutez11_data
soutez12_data
soutez13_data
soutez14_data
soutez15_data
soutez16_data
soutez17_data
soutez18_data
soutez19_data
soutez1_data
soutez20_data
soutez21_data
soutez2_data
soutez3_data
soutez4_data
soutez5_data
soutez6_data
soutez7_data
soutez8_data
soutez9_data
stats_access
stats_referer
stats_sekce
user

Columns for table ‘user’
===============
id_user,firstname,lastname,rc,live,info,role,login,password,email,active,created

Data
===============
1|L.|Fiala|head|fikus|53615884e509759e9391092241cea311|L.Fiala@sh.cvut.cz|1
2|B.|Vít|head|bedrich.vit@uinvest.cz|a1d67bc62000845ad6fbcedaf16348b8|bedrich.vit@uinvest.cz|1
3|P.|Porada|head|pavel.porada@uinvest.cz|10c1c52b579ead0d42233c91d9b9baf4|pavel.porada@uinvest.cz|1
4|O.|Porada|head|ondrej.porada@novavize.cz|a5e44ed69ebbef16abab0bea3eb40584|ondrej.porada@novavize.cz|1
5|P.|Ježek|head|pavel.jezek@novavize.cz|811922df7359bbb4f1a9af5e2b6a3bbc|pavel.jezek@novavize.cz|1
6|L.|Jahoda|head|ladislav.jahoda@novavize.cz|0c486608f3875ff7e43bcea53d9b943e|ladislav.jahoda@novavize.cz|1
9|D.|Gelnarová|head|dana.gelnarova@novavize.cz|79f2c36c814930545b4416fba86ace39|dana.gelnarova@novavize.cz|1
10|E.|Zapletalová|head|eva.zapletalova@novavize.cz|a5c7b622aa4a595525dd1333603ad69e|eva.zapletalova@novavize.cz|1
11|P.|Parašínová|head|petra.parasinova@novavize.cz|eb26cab350d90cebf1febe1d5b30c1f4|petra.parasinova@novavize.cz|1
12|F.|Janota|head|frantisek.janota@3-S.cz|1fdc01082a7a808159e2bec66072dd56|frantisek.janota@3-S.cz|1
13|T.|Křeček|head|krecek@aba.cz|197950cc588d7f58ab16a013c1d141c6|krecek@aba.cz|1
14|K.|Mrázková|head|katka.mrazkova@post.cz|4c4071ff0ac5debab20a001c60556fd8|katka.mrazkova@post.cz|1
15|T.|Čech|head|tomas.cech@novavize.cz|e7a83d3f0214d439a285b5ed5a1f21c5|tomas.cech@novavize.cz|1
16|Z.|Honek|head|z.honek@creditinfosolution.com|4ab0dd08d9e7eddbddfefb1e88073be2|z.honek@creditinfosolution.com|1
17|None|Hnídková|head|hnidkova@3-s.cz|1fa30b29604e6eff6f12b139e163f7e9|hnidkova@3-s.cz|1
18|None|Lojdová|head|lojdova@3-s.cz|241d7d2fc9ff82fa112c70c155811740|lojdova@3-s.cz|1
19|None|Krausová|head|krausova@3-s.cz|400798c4d2814dfaa0d0db81ac6b6535|krausova@3-s.cz|1
20|P.|Vincík|head|pavel.v@seznam.cz|1ec5e1ec18ff14790849954687acd51b|pavel.v@seznam.cz|1
21|None|Dandová|head|dandova|83679ce98e26ea2153b4b5b039a7b624|pavel.v@seznam.cz|1
24|None|Janota|head|janota@3-s.cz|238273e822b24dcba3f51cf2ec8e6fe5|janota@3-s.cz|1
22|None|Bartůšek|head|bartusek@3-s.cz|a2ad35ac30db5c055493c484940175ec|bartusek@3-s.cz|1
23|None|Rosler|head|rosler@3-s.cz|93c608edb1a40bd276450bd3cfd88f8a|rosler@3-s.cz|1
25|P.|Coufalová|head|petra@zhodnotit.com|69ed24c7059442c415b305cf798ee1ed|petra@zhodnotit.com|1

Columns for table ‘lnk_users’
===============
ID,USERNAME,SAFENAME,PASSWORD,LEVEL,LASTLOGIP,LASTLOGDATE,OPTIONS1,EMAIL,POSTS,AVATAR,AVATARBG,
LD_DATE,LD_COUNT,POST_DATE,POST_COUNT,DATE,CSS,CSS_WIDTH,PERSONALLINK,PERSONALTAG,PERSONALICON,
NEWSLETTER,NEWSLETTER_SENT

Data (329900 accounts)
===============
1|PumliCZ|PumliCZ|a705c0f42f0c8184017b53307595be94|255|pumlicz@seznam.cz
2|Rene_Zavadil|Rene__Zavadil|54bb7529f213760c514ca409858503ec|255|rene.zavadil@post.cz
3|Gorthaur|Gorthaur|a095dc82acd3bc377a7c9a8100056179|255|gorthaur@email.cz
6|Inferno|Inferno|45e49568839b9b78a51207b9cf82e194|255|cerjirka@seznam.cz
8|Administrator|Administrator|a705c0f42f0c8184017b53307595be94|240
9|AdmiS|AdmiS|c57213d2c445240c3788d3f06fa7d3da|255|admis@centrum.cz
10|admis|admis|d92cfbec99647f3d69ec13da2ef1924b|1
11|rene_zavadil|rene__zavadil|e10adc3949ba59abbe56e057f20f883e|1
14|bulva|bulva|97edfa43843271c6a4146d888ba9696f|1
15|dwi|dwi|28dfaedf97d26e8a76a82f09b0be26c7|1|dwickie@necum.net
16|Koblizek|Koblizek|7fda0954f2b750d61e8fcaa70c66d5db|1
1350|thess|thess|a384b6463fc216a5f8ecb6670f86456a|1|tadeash@centrum.cz
32|Remington|Remington|fea2f233d65f0bd3a62059c63b324cde|1|MartinSilvestr@seznam.cz
33|idaho|idaho|01bff56f05555750b378241ea3ea3a7b|1|idahos@gmail.com
34|Porsche|Porsche|827ccb0eea8a706c4c34a16891f84e7b|1|Porsche924@centrum.cz
1349|ysquanir|ysquanir|edb8e6dd9fc353a3f8b0ea7a9febe8d1|1|ysquanir2@centrum.cz
37|jirdaar|jirdaar|821d5941b9c871407d4a71e88e5ee219|1|jirdo666@yahoo.co.uk
1348|Komplexacek|Komplexacek|955db0b81ef1989b4a4dfeae8061a9a6|1|kamilrazim@seznam.cz
39|SureThing|SureThing|2904fd1a3cade2007280ae5d844a7464|1|peter.zahradnik@gmail.com
41|danio77|danio77|fb87582825f9d28a8d42c5e5e5e8b23d|1|danio77@zoznam.sk
42|joghurt|joghurt|6547436690a26a399603a7096e876a2d|1|joghurt.war@gmail.com
43|mcgrady|mcgrady|4ac27f873d4e52c826aa0424023b3920|1|Mcgrady@seznam.cz
1345|tomas-sk|tomas-sk|1c8491a30d62d3d30f1a8c10ea34b30c|1|tomaskuc@gmail.com
1344|mudrr|mudrr|2eeecd72c567401e6988624b179d0b14|1|mudrr@seznam.cz
1343|EdemS|EdemS|e2bc629d17c4c86f0b871328b7210184|1|edems…@seznam.cz
49|fopboy|fopboy|0f4137ed1502b5045d6083aa258b5c42|1|fopboy@libimseti.cz
50|jarousek2|jarousek2|78ce67ef0afedbd79aad455d3262c259|1|balas.jar@centrum.cz
1341|jeff2s|jeff2s|ce88609377101830cc1f37be182a7c22|1|jeff2s@seznam.cz
1340|Teiger|Teiger|69338065474e3792e95518dbe440d52e|1|teiger@centrum.cz
1339|uk|uk|5de96cb8020a1c64732bc7453dc4cbb7|1|uk@atlas.cz
56|Predo|Predo|b80a35450a25d7fd55f9dda376ecd128|1|predo@seznam.cz
59|sober|sober|0cb1eb413b8f7cee17701a37a1d74dc3|1|kasparecm@centrum.cz
60|ing.notor|ing.notor|13dbc4a17b115d488be8b2da4ae6b953|1|ing.notor@email.cz
1347|Nando|Nando|575dd64a874ae16bf22b158701fa6487|1|rot30@post.sk
64|carcass|carcass|68ea4a1fc0abab8ba25dc452a8a09599|1|jakub88888888@centrum.cz
66|jobe|jobe|d1ff59b362301890874beb55c0cf5987|1|jobe@centrum.cz
1333|skWor|skWor|14c76999e504f00923452f792bb68ca1|1|Mira.Tomandl@seznam.cz
1332|Deton|Deton|64ae4d070dc1ae2ab230e0887dc86d6c|1|tomas.velcovsky@centrum.cz
69|Manas|Manas|c7c8b59beed437db6da9c078f2b16b15|1|pan.o@centrum.cz
71|alesmatusek|alesmatusek|1fc17f6dfe769cb307145a2361e0ea44|1|alesmatusek@seznam.cz
72|Lord|Lord|785bb1e5e77a14325fd31ebeae836fff|1|lord.d@centrum.cz
73|magnetm|magnetm|eb1b12b9fe6fa667cf3ebe573e2f47c9|1|magnetm@seznam.cz
74|b33|b33|7a5e53ed4bda52b28ca673510e54ad5a|1|ch_r@centrum.cz
75|kamidus|kamidus|722988975d54f0185d2009802c2f4708|1|lahcimkamidus@seznam.cz
76|frankkk|frankkk|5562ff45544b33b1e9e9941a68f0d211|1|frankk@seznam.cz
77|markooo|markooo|a4920c4e8487f38813120cd0ddfd4a3e|1|markooom@gmail.com
78|Snickers|Snickers|1c8491a30d62d3d30f1a8c10ea34b30c|1|Milan.THC@email.cz
1331|směnmistr|směnmistr|827ccb0eea8a706c4c34a16891f84e7b|1|laco.petr@volny.cz
1329|vlastik|vlastik|9b1b9c145f2ebff640472fd6e5f09ceb|1|chromel.ova@atlas.cz
23995|danbery|danbery|45f4e70b44279009acdf7fd9a3d4ce47|1|dan.beranek@seznam.cz
83|komat77|komat77|68e6123f9c41e7239065f139f885082d|1|komat77@atlas.cz
1327|enzo|enzo|700d1c749fd43d2a4a05e809ddaee6d7|1|sempro@centrum.cz
86|mirahel|mirahel|fbfe9809a461414b51d13e5cbe31fdd5|1|trailers@tiscali.cz
1325|vafliik|vafliik|31141ad98216c8b886196b25674f2e2c|1|pribyl.pavel@seznam.cz
89|kyler|kyler|6d55e02f385f45605879fbeb1bb42fb9|1|kusic@seti.cz

Posted in Uncategorized | 4 Comments »

Shoptet.cz expose passwords in plaintext

December 8th, 2009 igigi

I don’t know if you’re familiar with this website www.shoptet.cz. It’s just stupid eShop generator for kids and yea, it’s not for free. They have like 2000 customers and yes, they’re storing their passwords in DB as simple plain text. Hacking this site was really pleasure, because to be honest, i not need to hack anything. They gave me everything for free.

Here is a delicious tasting of them

id|username|password|email|name|shop_name
=======================================================
1|Eleanora|bil******|tomas.krejci@quax.cz|Tomáš Krejčí|Fitness-eshop.cz
3|alfasport|del******|alfa-sport@alfa-sport.cz|Helena Ducháčková|Tenis-eshop.cz
5|Redmoto|red******|redmoto@redmoto.cz|Jan Vlček|Alfa-sport.cz
7|Martin|cor******|info@etennis.cz|Martin Jaroš|Body-shop.cz
9|perfectfloor|per******|michal.vojna@centrum.cz|Michal Vojna|Delor.cz
10|rafo|ale******|prochazka@rafo.cz|Tomáš Procházka|Ekoinstop.cz
11|demo|dem******|info@cybergenics.cz|Demo přístup|Eshop-kralik.cz
12|Parfemy|par******|info@parfemy-obleceni.cz|Michal Červinka|eTennis.cz
13|Pradlo|pra******|info@pradlo-sexy.cz|Michal Červinka|Fanaticstudio.cz
15|tropic|te5******|info@tropicliberec.cz|Miroslav Křížek|Parfemy-obleceni.cz
17|Martin|cor******|info@qtennis.cz|Martin Jaroš|Pneu-alu.cz
18|delor|dor******|delor@delor.cz|Jan Vančura|Pradlo-sexy.cz
19|ekoinstop|ter******|info@ekoinstop.cz|Jaroslav Šimůnek|qSki.cz
20|saudio|sau******|info@s-audio.cz|Václav Suchý|qTenis.cz
21|titaniumpro|t1t******|titanium@anopack.cz|Martin Hroneš|qTramp.cz
22|fanatic|fan******|petra.fanatic@volny.cz|Petra Chrenková|Rafoshop.cz
23|kralik|bud******|landrejkovic@gmail.com|Luboš Andrejkovič|Redmoto.cz
24|Pneu|Nel******|info@pneu-alu.cz|Michal Červinka|S-audio.cz
35|stromek|554******|rzrthhgartzetzd|Martin Stromek|Valmonttrading.cz
36|t01|tro******|hrtgrqwrwetz|T01 T01|Lovproliberec.cz
88|Extradoplnky|fra******|reyden@email.cz|Miroslav Uďan|None
89|Extrakosmetika|fra******|reyden@email.cz|Extrakosmetika|None
90|lucijanka|luc******|lucijankad@email.cz|Lucie Dohnalová|None
91|jindriska|231******|rtertertertert|Jindiřška Křížková|Propresent.shoptet.cz
92|stanis|123******|MechuraS@seznam.cz|Stanislav Měchura|Rumburak.shoptet.cz
93|petr|pet******|vedouci@rafo.cz|Petr Mach|Drobneelektro.cz
94|mac|pet******|vedouci@rafo.cz|Petr Mach|Mobily-pocitace.cz
96|valmont|val******|lukas.roztocil@valmonttrading.cz|Lukáš Roztočil|X-hokej.cz
97|mjares|pl4******|info@planet-outdoor.cz|Michal Jareš|Kupujonline.cz
98|bonusmobil|ahi******|shop@bonusmobil.cz|Bonusmobil|Wifi.shoptet.cz
100|david|dav******|papirnictvi@rafo.cz|David|None
104|mila|mil******|rafo|Míla|Spravnehracky.shoptet.cz
111|cip|cip******|info@klubyvpraze.cz|Klubyvpraze.cz|None
112|hezkesperky|123******|miky.cervinka@tiscali.cz|Michal Červinka|Spodnipradlo-obleceni.cz
113|krasnehodinky|123******|miky.cervinka@tiscali.cz|Michal Červinka|None
114|robert|mon******|robert@kallibra.com|Robert Hrdlička|None
117|deluxe|del******|obchod@deluxejunior.cz|Pavla Janků|Security.shoptet.cz
118|tropic|te5******|info@tropicliberec.cz|Miroslav Křížek|Lio.shoptet.cz
119|Parfemy|par******|info@parfemy-obleceni.cz|Michal Červinka|Obuv.shoptet.cz
120|Martin|cor******|info@etennis.cz|Martin Jaroš|None
121|Martin|cor******|info@etennis.cz|Martin Jaroš|Zaminutu.cz
122|rafo|ale******|prochazka@rafo.cz|Tomáš Procházka|Fatboyshop.cz
123|Martin|cor******|info@etennis.cz|Martin Jaroš|None
124|t01|tro******|sdfghtrfhd|T01|Sklenenydum.cz
125|jindriska|231******|fdjztdatzrdzster|Křížková Jindřiška|None
126|stromek|554******|xvsdgfgsdgfsdgdh|Martin Stromek|Christy.cz
127|dedek|md3******|swswswswwww|Milan Dědek|None
128|dedek|md3******|sdsdsdsdsdsdsd|Milan Dědek|Nakupniulice.cz
141|etennissk|ete******|info@etennis.sk|Marek Belák|None
142|qtenissk|qte******|info@etennis.sk|Marek Belák|Obasport.cz
143|Martin|cor******|info@etennis.cz|Martin Jaroš|Bonsainebari.eu
145|ricopoint|ric******|info@ricopoint.eu|Ricopoint|Profisekacky.eu
146|Kosmetika|123******|info@top-kosmetika.cz|Michal Červinka|Topbox.shoptet.cz
148|optimum|123******|info@cybergenics.cz|Jiří Kuntoš|None
163|Martin|cor******|info@etennis.cz|Martin|Chirurgickaocel.shoptet.cz
165|Kartonie|oba******|informx@volny.cz|Petr Pešava|None
166|tomanekjuva|123******|tjuva@seznam.cz|Tománek Jůva|Sport.shoptet.cz
167|drobneelektro|JK6******|info@shoptet.cz|Jiří Kuntoš|None
168|martinmail|sho******|cmunt@elektropocitace.cz|Martin Cmunt|Pp-pneu.shoptet.cz
170|Martin|cor******|info@etennis.cz|Martin|None
171|dvsole|wha******|daniel.visnak@hchk.cz|Daniel Visnak|None
172|Iruscha|ive******|irena@hajektrans.cz|Irena Hájková|Dumpi.cz
173|eshop|130******|petr.kocis@eshopobchod.cz|Petr Kocis|None
174|lukas|luk******|lukas.stetina@valmonttrading.cz|Lukáš Štětina|Stribropracny.cz
177|ucetni|ska******|info@valmonttrading.cz|”Účetní |))”|None
178|janšta|cen******|csc-vb@seznam.cz|Marcel Janšta|None
179|Ericeqh|dfd******|egner.goldcenter@gmail.com |Erik Égner|None
180|bob|yxc******|lukas.borek@seznam.cz|Lukáš Bořek|Prirodaleci.cz
181|mikulka|mIk******|hanamikulicova@seznam.cz|Hana Mikulicova|None
182|vakservis|vak******|vymetalik@vaksevis.cz|Radim Vymětalík|None
183|lisakus|hug******|jasem@seznam.cz|Vladimír Liška|None
184|minar|789******|info@akvaria.info|Jiří Minář|None
188|joseftvrdik|jet******|jtvrdik@iol.cz|Josef Tvrdík|None
192|lenkamatusova|len******|MATUSOVA.L@SEZNAM.CZ|Lenka Matúšová|I-sportcentrum.shoptet.cz
193|zbynek|k6b******|info@zbynekprokop.eu|Zbyněk Prokop|Mab99.shoptet.cz
194|mallman|123******|mallman@centrum.cz|Erick Mallman|Mindsoft.shoptet.cz
195|karel77|nik******|karel5bo@seznam.cz|Karel Moucha|Modni-doplnky.shoptet.cz
197|blackthorne|380******|simonflemr@gmail.com|Simon Flemr|Sporto.shoptet.cz
198|gmtechnic|pou******|info@levne-pc.cz|Michal Pišan|Janickacz.shoptet.cz
200|workoholik|dre******|ing.pospisil.k@centrum.cz|Karel Pospisíi Ing|Hodinkyalex.shoptet.cz

and few tables

DROP TABLE IF EXISTS `admin_mapa`;
CREATE TABLE `admin_mapa` (
`id` smallint(5) unsigned NOT NULL auto_increment,
`parent` smallint(5) unsigned NOT NULL default ‘0′,
`title` varchar(100) collate utf8_czech_ci default NULL,
`index_name` varchar(250) collate utf8_czech_ci NOT NULL default ”,
`action_script` varchar(255) collate utf8_czech_ci NOT NULL,
`priority` smallint(5) unsigned NOT NULL default ‘0′,
`classification` varchar(8) collate utf8_czech_ci NOT NULL default ’standard’,
`envelope_template` varchar(64) collate utf8_czech_ci NOT NULL,
`content_template` varchar(64) collate utf8_czech_ci NOT NULL,
`module` varchar(64) collate utf8_czech_ci NOT NULL default ”,
`user_group` varchar(16) collate utf8_czech_ci NOT NULL default ‘user’,
`in_menu` varchar(3) collate utf8_czech_ci NOT NULL default ‘ano’,
`editable_rights` tinyint(1) unsigned default NULL,
`admin` tinyint(1) unsigned default NULL,
`project_admin` tinyint(1) unsigned default NULL,
`user` tinyint(1) unsigned default NULL,
`father_for_rights` smallint(5) unsigned default NULL,
`trashed` int(10) unsigned default NULL,
PRIMARY KEY (`id`),
KEY `index_name` (`index_name`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8 COLLATE=utf8_czech_ci;

DROP TABLE IF EXISTS `mod_emails`;
CREATE TABLE `mod_emails` (
`id` tinyint(3) unsigned NOT NULL auto_increment,
`name` varchar(128) collate utf8_czech_ci NOT NULL,
`action` varchar(32) collate utf8_czech_ci NOT NULL,
`from` varchar(128) collate utf8_czech_ci NOT NULL,
`from_name` varchar(128) collate utf8_czech_ci default NULL,
`subject` varchar(255) collate utf8_czech_ci NOT NULL,
`format` enum(’text/plain’,'text/html’) collate utf8_czech_ci default ‘text/html’,
`content_template` varchar(255) collate utf8_czech_ci NOT NULL,
`envelope_template` varchar(255) collate utf8_czech_ci default NULL,
`altbody` varchar(255) collate utf8_czech_ci default NULL,
PRIMARY KEY (`id`),
KEY `action` (`action`)
) ENGINE=MyISAM AUTO_INCREMENT=5 DEFAULT CHARSET=utf8 COLLATE=utf8_czech_ci;

LOCK TABLES `mod_emails` WRITE;
INSERT INTO `mod_emails` VALUES (’1′, ‘Oznámení o objednávce pro e-shop’, ‘objednavka’, ‘{$objednavka->email}’, ‘{$objednavka->jmeno} {$objednavka->prijmeni}’, ‘Objednávka {$objednavka->kod_objednavky} z {$smarty.const.WEBSITE_NAME} [{$objednavka->cena->s_dph->celkem|price:false}]‘, ‘text/html’, ‘email_objednavka_shop.tpl’, ‘layout_email.tpl’, ‘email_objednavka_shop_plain.tpl’);
INSERT INTO `mod_emails` VALUES (’2′, ‘Oznámení o objednávce pro zákazníka’, ‘objednavka’, ‘{$smarty.const.EMAIL_WEBU}’, ‘{$smarty.const.WEBSITE_NAME}’, ‘Objednávka na {$smarty.const.WEBSITE_NAME}’, ‘text/html’, ‘email_objednavka_zakaznik.tpl’, ‘layout_email.tpl’, ‘email_objednavka_zakaznik_plain.tpl’);
INSERT INTO `mod_emails` VALUES (’3′, ‘Potvrzení registrace pro zákazníka’, ‘registrace’, ‘{$smarty.const.EMAIL_WEBU}’, ‘{$smarty.const.WEBSITE_NAME}’, ‘Registrace na {$smarty.const.WEBSITE_NAME}’, ‘text/html’, ‘email_registrace_zakaznik.tpl’, ‘layout_email.tpl’, ‘email_registrace_zakaznik_plain.tpl’);
INSERT INTO `mod_emails` VALUES (’4′, ‘Oznámení o registraci pro e-shop’, ‘registrace-shop’, ‘{$user->email}’, ‘{$user->jmeno} {$user->prijmeni}’, ‘Registrace na {$smarty.const.WEBSITE_NAME}’, ‘text/html’, ‘email_registrace_shop.tpl’, ‘layout_email.tpl’, ‘email_registrace_shop_plain.tpl’);
UNLOCK TABLES;

DROP TABLE IF EXISTS `mod_files`;
CREATE TABLE `mod_files` (
`id` mediumint(8) unsigned NOT NULL auto_increment,
`id_father` mediumint(8) unsigned NOT NULL default ‘0′,
`name` varchar(32) collate utf8_czech_ci NOT NULL default ”,
`datum` int(10) unsigned NOT NULL default ‘0′,
`trashed` int(10) unsigned default NULL,
PRIMARY KEY (`id`),
KEY `id_product` (`id_father`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8 COLLATE=utf8_czech_ci PACK_KEYS=0;

Posted in Uncategorized | 3 Comments »

Racany.sk expose passwords in plaintext

December 8th, 2009 igigi

Racany.sk is pretty shitty web. Developed by NEW MEDIA Group, which doesn’t know how to create a secure web application. They store passwords in plain text, so it was piece of cake to get direct access to the admin.

All others projects looks very similar, so it’s pretty cruel for their customers to use so buggy CMS.

racany.sk

Database
==========
information_schema
racany_sk

Tables ‘racany_sk’
==========
vwb_access_obrazky_folders
vwb_accessmoduly
vwb_accessmodulyinstance
vwb_accesspages
vwb_accesssablony
vwb_admins
vwb_countries
vwb_kraje
vwb_module_aktuality
vwb_module_aktuality_kategorie
vwb_module_aktuality_shop_items
vwb_module_aukce
vwb_module_aukce_kategorie
vwb_module_aukce_prihozy
vwb_module_banners
vwb_module_banners_click
vwb_module_catalogue
vwb_module_catalogue_admins
vwb_module_catalogue_changelog
vwb_module_catalogue_kategorie
vwb_module_catalogue_kategorie_items
vwb_module_catalogue_kategorie_templates
vwb_module_catalogue_objednavky
vwb_module_catalogue_objednavky_admins
vwb_module_catalogue_objednavky_items
vwb_module_catalogue_objednavky_platby
vwb_module_catalogue_objednavky_platby_predpis
vwb_module_catalogue_objednavky_splatkove_kalendare
vwb_module_catalogue_poptavky
vwb_module_catalogue_properties
vwb_module_catalogue_properties_possib
vwb_module_catalogue_templates
vwb_module_catalogue_templates_items
vwb_module_catalogue_values
vwb_module_diskuze
vwb_module_diskuze_emotikon
vwb_module_dotaznik
vwb_module_dotaznik_answers
vwb_module_dotaznik_infomail
vwb_module_dotaznik_questions
vwb_module_dotaznik_results
vwb_module_dotaznik_results_details
vwb_module_download
vwb_module_download_aktuality_items
vwb_module_download_kategorie
vwb_module_download_shop_items
vwb_module_forum
vwb_module_fotogalerie
vwb_module_fotogalerie_akce
vwb_module_fotogalerie_aktuality_items
vwb_module_fotogalerie_kategorie
vwb_module_fotogalerie_shop_items
vwb_module_inzerce
vwb_module_inzerce_kategorie
vwb_module_inzerce_odpovedi
vwb_module_inzerce_userprofiles
vwb_module_links
vwb_module_links_kategorie
vwb_module_shop
vwb_module_shop_dph
vwb_module_shop_kategorie
vwb_module_shop_kategorie_items
vwb_module_shop_kategorie_templates
vwb_module_shop_kosik
vwb_module_shop_objednavky
vwb_module_shop_objednavky_items
vwb_module_shop_objednavky_mails
vwb_module_shop_properties
vwb_module_shop_properties_possib
vwb_module_shop_settings
vwb_module_shop_sklad_prijemka
vwb_module_shop_sklad_prijemka_polozky
vwb_module_shop_sklad_vydejka
vwb_module_shop_sklad_vydejka_polozky
vwb_module_shop_templates
vwb_module_shop_templates_items
vwb_module_shop_uhrady_typy
vwb_module_shop_values
vwb_module_survey
vwb_module_survey_possib
vwb_module_survey_results
vwb_module_ucto
vwb_module_ucto_banka
vwb_module_ucto_banka_polozky
vwb_module_ucto_faktura
vwb_module_ucto_faktura_polozky
vwb_module_ucto_firma
vwb_module_ucto_ks
vwb_module_ucto_pokladna
vwb_module_ucto_pokladna_polozky
vwb_module_ucto_typyplateb
vwb_module_ucto_vyzva
vwb_module_ucto_vyzva_polozky
vwb_module_vyzkum
vwb_module_vyzkum_odpovedi
vwb_module_vyzkum_odpovedi_detail
vwb_module_vyzkum_otazky
vwb_module_vyzkum_otazky_checkbox
vwb_module_vyzkum_otazky_radio
vwb_module_vzkazy
vwb_modules_instance
vwb_modules_list
vwb_modules_properties
vwb_modules_properties_values
vwb_pages
vwb_pages_schema
vwb_pages_schema_template
vwb_pages_template
vwb_project
vwb_project_default_schema_template
vwb_project_rewrite
vwb_templates
vwb_users
vwb_users_groups
vwb_users_groups_members
vwb_users_kredit_pohyby
vwb_users_lekarny
vwb_users_login
vwb_users_obory

Columns ‘vwb_admins’
==========
id
fullName
loginName
loginPass
email
accessType
accessModuly
accessObrazky
accessSoubory
accessSablony
accessStranky
accessAdmins
accessUsers
accessProject
rezimEditace

select id, loginname, loginpass,email,fullname from vwb_admins
1, admin, te****, , Admin
8, katarina, ma****, katarina.polacek@gmail.com, Katarina Polackova
9, chrenko, vo****, chrenko@grafobalgroup.sk, Martin Chrenko
10, komornik, ko****, komornik@grafobalgroup.sk, Pavel Komornik

Posted in Uncategorized | 1 Comment »

CSFD.cz hacked

December 6th, 2009 igigi

Did you receive an email on 5th Dec 2009 from the owner of CSFD.cz (Martin Pomothy, pomo@csfd.cz) about changing the database?

Mily uzivateli.

Prevod archivace hesel do nového systemu, kterym CSFD definitvne opouątí struktury zastarale mysql databaze,
nebyl lizani medu a bude trvat jeste nekolik dni. Soucasna situace je nasledujici – ti z vas, kterym uz bylo zaslano nove heslo, jste
“za vodou” a ti z vas, kteri jste ho z technickych duvodu neobdrzeli, si ho muzete vygenerovat ZDE
(bude vám zaslano na e-mail, ktery mate evidovan ve svem CSFD profilu).

Vam, kdo jste prosli traumatem z dvoudenni nemoznosti prihlasit se do CSFD, se osobne hluboce omlouvam a pokud by u vas
nedejboze tento problem pretrvaval i po pouziti zminene utilitky, okamzite mi napiste na pomo@csfd.cz.

Jsme jedna rodina. CSFD forever.

Martin Pomothy

So if you did receive it, then you should know that it’s bullshit. They are not changing anything, they have just been hacked by me.

Nothing interesting there, just user accounts, which i downloaded almost all of them [from 187152 I've got first 147901]

They detected my attacks after i don’t know, let say for weeks non-stop downloading? Nice try to persuade user, that they did something technical, so they need to reset all of passwords. BTW they’re not using MySQL, but PostgreSQL.

Here is dump of their tables

database: public
==============
pw_uzivatele_posledni
anketa_pH
ycupy_archiv
pw_log_counter
pw_log_videa
pw_uzivatele_udalosti
pw_forum_dalsi
pw_uzivatele_profil
pw_forum_dalsi_pristupy
pw_filmy_pristupy
pw_tvurci_foto
pw_tvurci_foto_poradi
pw_tvurci_fanweb
pw_filmy_herci
pw_uzivatele_pristupy
pw_filmy_herci_zmeny
pw_filmy_reziseri_zmeny
pw_filmy_reziseri
pw_tvurci_search
pw_posta
pw_posta_hromadna
pw_tvurci
pw_akce_csfd
anketa_odpoved
anketa_hlasovani
pw_aukro_aukce
pw_uzivatele
pw_tvurci_pristupy
pw_sd_stg_uzivatele_aktivni
pw_sd_stg_hodnoceni_serialy_1
pw_sd_nej
pw_aukro_kategorie
pw_sd_stg_hodnoceni_serialy_2
pw_sd_stg_uzivatele_hodnoceni
pw_aukro_uzivatele
pw_sd_filmy
pw_sd_stg_hodnoceni_filmy
pw_sd_stg_hodnoceni_serialy
pw_filmy_zanry
pw_filmy_puvod
pw_filmy_prodej_parovani
pw_uzivatele_pristupy_archiv

and few of theirs accounts

SELECT id, login, password, email, pwd_code FROM pw_uzivatele ORDER BY id DESC
========
1
pomo
7bcdd0d294759143990128f478639692
pomo@csfd.cz

2
palto
a6dea79321cf5aa894fc4ed68ba2f4df
palto@palto.sk
90xrx3
3
quint
28a63655167285737baef8ae1ae9dc53
zilkamarek@seznam.cz

4
douglas
9c4a454c1e776c73eb3f8ed3a333e679
douglas@seznam.cz
9ub2cp
5
kevspa
7f01ffc92b8398860821ff9a17b420be
kpapstova@seznam.cz

7
ywo
e1ec74a3cae561bcfdcaa8892c51208b
vario@centrum.sk
b99243
9
Redmany
48d0429f32fd76867c6ded7bb8f54739
grafika@red-point.sk

10
ap2001
b4a34df68cc2d19e191bd6875ae9a609
jan.homola@centrum.cz

11
baldachyn
5f4713a1ec78ef50a337e2dafe9fab7d
tomas@baldachyn.cz

12
Ferguss
4881ba77a934f5508be818f21c5db044
herales@volny.cz

14
imf
503633197d7ef7275709c92b9cbdc2fd
rybar@moviezone.cz
pbzgpl
15
Frazer
3144422466465bf7d1de2f39b2ca1c28
arturfrazer@seznam.cz

16
bwian
7eb36f8bb2f539119289324ff20082cc
bwian@volny.cz

17
S_M_Lomoz
b8e83a3a06714295381c2acd43bb09bc
nemamemail@csfd.cz
t5×3dt
18
cobe
0cd9baddd5797b887d4a3e341c59bc51
cobe@seznam.cz

19
omikron
af264a0fdb994b8d7145217cdf27eefa
omikron@smejdil.cz

20
dadel
04fef8555e6cd948705d484c22a1dba7

PS: CSFD guys, you should really check your whole site, because I still have two or three holes.

Posted in Uncategorized | 11 Comments »