Acessando banco de dados PHPMyAdmin sem validação

Acessando PHPMyAdmin sem validação

Resumo:

phpMyAdmin é um aplicativo web desenvolvido em PHP para administração do MySQL pela Internet. A partir deste sistema é possível criar e remover bases de dados, criar, remover e alterar tabelas, inserir, remover e editar campos, executar códigos SQL e manipular campos chaves. O phpMyAdmin é muito utilizado por programadores web que muitas vezes necessitam manipular bases de dados. Normalmente, o phpMyAdmin é tratado como uma ferramenta obrigatória em quase todas as hospedagens da web, além de pacotes off-line, como o WAMPServer, XAMPP, EasyPHP e PHP Triad.

 DORK's DE ACESSO:
 -------------------------------------------------------------------------------------------------------------------------------

inurl:"server_variables.php?token="
inurl:"/index.php?target=server_variables.php"
inurl:"server_processlist.php?" intext:" SHOW PROCESSLIST " & intitle:"phpMyAdmin"
inurl:"server_engines.php?token="
inurl:"server_sql.php?token="
inurl:"server_import.php?token="
inurl:"server_export.php?token="
inurl:"db_structure.php?db="
inurl:"main.php?token=" phpMyAdmin
inurl:"server_collations.php?token="

-------------------------------------------------------------------------------------------------------------------------------

Exemplo de acesso acesso:

As dorks elaboradas foram baseadas nas urls de acesso, para alguns não deve aprecer pois o painel usa um esquema com iframes com os seguintes menus-url's.

<li><a class="tab" href="server_databases.php?token=4f30b5467a4061773e1fe072ac833377" ><img class="icon" src="./themes/original/img/s_db.png" width="16" height="16" alt="Databases" />Databases</a></li>
<li><a class="tab" href="server_sql.php?token=4f30b5467a4061773e1fe072ac833377" ><img class="icon" src="./themes/original/img/b_sql.png" width="16" height="16" alt="SQL" />SQL</a></li>
<li><a class="tab" href="server_status.php?token=4f30b5467a4061773e1fe072ac833377" ><img class="icon" src="./themes/original/img/s_status.png" width="16" height="16" alt="Status" />Status</a></li>
<li><a class="tab" href="server_variables.php?token=4f30b5467a4061773e1fe072ac833377" ><img class="icon" src="./themes/original/img/s_vars.png" width="16" height="16" alt="Variables" />Variables</a></li>
<li><a class="tab" href="server_collations.php?token=4f30b5467a4061773e1fe072ac833377" ><img class="icon" src="./themes/original/img/s_asci.png" width="16" height="16" alt="Charsets" />Charsets</a></li>
<li><a class="tab" href="server_engines.php?token=4f30b5467a4061773e1fe072ac833377" ><img class="icon" src="./themes/original/img/b_engine.png" width="16" height="16" alt="Engines" />Engines</a></li>
<li><a class="tabactive" href="server_processlist.php?token=4f30b5467a4061773e1fe072ac833377" ><img class="icon" src="./themes/original/img/s_process.png" width="16" height="16" alt="Processes" />Processes</a></li> <li><a class="tab" href="server_export.php?token=4f30b5467a4061773e1fe072ac833377" ><img class="icon" src="./themes/original/img/b_export.png" width="16" height="16" alt="Export" />Export</a></li>
<li><a class="tab" href="server_import.php?token=4f30b5467a4061773e1fe072ac833377" ><img class="icon" src="./themes/original/img/b_import.png" width="16" height="16" alt="Import" />Import</a></li> </ul>

OBS: Algums serves não te daram acesso de imediato as tabelas, para isso use o executor de sql.
Usando SCANNER INURL para facilitar a busca.

Exemplo de comando:
php botConsole.php --host='www.google.com.br' --dork='inurl:"server_processlist.php?" intext:" SHOW PROCESSLIST " & intitle:"phpMyAdmin" -assembla' --arquivo='MYSQL.txt' --tipoerro='2' --exploit='' --achar='phpMyAdmin'

DEBUG:
----------------------------------------------------------------------------------------------------------------------------
0xHOST GOOGLE........: www.google.com.br
0xDORK...............: inurl:"server_processlist.php?" intext:" SHOW PROCESSLIST " & intitle:"phpMyAdmin" -assembla
0xEXPLOIT............:
0xARQUIVO............: MYSQL.txt
0xTIPO DE ERRO.......: 2
0xPROCURAR NO ALVO...: phpMyAdmin
0xIP PROXY...........:
0xPORTA..............:
----------------------------------------------------------------------------------------------------------------------------
0xCARREGANDO CONFIGURAÇÕES...
DEBUG:

Array
(
    [0] => Array
        (
        )

    [host] => www.google.com.br
    [dork] => inurl%3A%22server_processlist.php%3F%22+intext%3A%22+SHOW+PROCESSLIST+%22+%26+intitle%3A%22phpMyAdmin%22+-assembla
    [arquivo] => MYSQL.txt
    [tipoerro] => 2
    [exploit] =>
    [achar] => phpMyAdmin
    [ipProxy] =>
    [porta] =>
    [url] => /search?q=inurl%3A%22server_processlist.php%3F%22+intext%3A%22+SHOW+PROCESSLIST+%22+%26+intitle%3A%22phpMyAdmin%22+-assembla&num=1900&btnG=Search
    [port] => 80
)

[ BAIXAR: http://pastebin.com/TzijC99y  ] 

REF:
http://pt.wikipedia.org/wiki/PhpMyAdmin
http://www.phpmyadmin.net/


Resultados da pesquisa:

http://mech.sharif.ir/~web/phpmyadmin/server_processlist.php
http://www.zumrutcim.com/phpMyAdmin/index.php?server=1&target=server_processlist.php&token=5ee6b4ef3eec67db200cffb4ca96bd97
www.zumrutcim.com/phpMyAdmin/index.php?server=1&target=server_processlist.php&token=5ee6b4ef3eec67db200cffb4ca96bd97
http://www.nautilus.com.br/clientes/phpmyadmin_barcessat/index.php?server=1&target=server_processlist.php&lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=f4e23698e63cb037f9ceb9eae1bd66da
http://www.settimanasudoku.it/mysqladmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=0717590837c536a6b2fdf71b3e3dfb69&full=1&phpMyAdmin=qSVwBZtc8J68bUpNrdmHohiwvO6
http://www.settimanasudoku.it/mysqladmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=629550b445dd53557edc873fea8256a7&full=1&phpMyAdmin=upcVaWZRbIqzaA7ZIn2NC7tcVXa
http://www.settimanasudoku.it/mysqladmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=7850d21f77f5ff41c6a30d1468df949e&full=1&phpMyAdmin=5IeY%2C8tUFuMK6QBK-QvQoDVhkI0
http://contemar.com/phpMyAdmin/index.php?server=1&target=server_processlist.php&lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_general_ci&token=25a89618f06d460b726bb902f261dc48
http://contemar.com/phpmyadmin/index.php?server=1&target=server_processlist.php&lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_general_ci&token=c0c6689d5bfd46016dfce6ad2e7dfc49
http://kalifaalmisnad.com/phpMyAdmin/index.php?server=1&target=server_processlist.php&lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=d8f0843a76df17a88f489880a8a0fe86
http://webservice.jmasjuarez.gob.mx:8888/phpmyadmin/server_processlist.php?token=3b348ec6ff1b099c465f8ca203656538&full=1
https://www.der-insolvenzberater.de/phpMyAdmin/server_processlist.php?lang=en-utf-8&server=1&collation_connection=utf8_general_ci&kill=209505387
https://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=01395f779fcfe1160c96f9eb839860af&kill=15710
https://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=3d4354e7a691623453b29361ea95be24&kill=17812
http://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=61a9ec4af824fbf24b368f29ba2f36d3&kill=116759
https://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=ce58de690a926679d6b10589bb1b25a1&kill=15076
https://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=ae7332a9388dd4763b0f9195b67ce197&kill=148286
https://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=1d847c6be291d8428d8c828af4fde151&kill=113261
https://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=be9a026238ab69f456c53337318599a3&kill=22662
https://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=161b1d193b0032814d65f117af4074cb&kill=12862
http://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=3ba1c5db1b7c429310ca466d8a3a4f9a&kill=108535
https://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=1de9baadfb04138dcc81eb84d4b45421&kill=11170
http://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=1bd8be911d5ea86940f12a7e7bd314c7&kill=15121
http://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=6b7d94bc8ead69989a5029f85594ac28&kill=11628
http://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=615dee42fa4bb4f27dadb0fc5443a126&kill=14768
http://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=79d1803b895548651c481a7358109955&kill=171800
http://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=dde1ce380bf8aef5e540b98d03c71f82&kill=49081
https://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=5e5761963c4f8e162ef84d9c1314426b&kill=28424
https://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=fe769b489d3faa1af424d7f494a2fd7b&kill=5552
https://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=81809c221f69540df71746d8a4974216&kill=115784
https://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=7bd07acd4c06d737d445184c2daa9934&kill=154635
http://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=3023cf534d907c3096a907c26f2b31df&kill=17227
http://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=28b024572f0f02fa5540619532cc448c&kill=12683
http://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=61415fd5a6703bff296bd9a95b186a9c&kill=30052
http://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=87ad999dfd8e1e831ee4d8a7a4fdc6be&kill=4724
http://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=a5c70b6418a08d53b441f85aba7ab469&kill=16152
https://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=08c87f19ccbea81587423b4c7658a17e&kill=14637
https://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=b17527ee7093814acd79faef0ca0642a&kill=17173
http://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=15c68c757f728a341a8e670a6dec1f74&kill=12618
http://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=d4b87d5771681e2677becd9cfa8cc42b&kill=730
http://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=d52749f3c3fa8de4f3cb4c692ee27bc1&kill=15447
http://69019.eof.afpa.fr/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=9c4973ed00c81fea82949e86074767da&kill=10851
http://royaltouchny.com/phpMyAdmin/index.php?server=1&target=server_processlist.php&lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=b64ac0249e08905103b6c694b46d209b
http://www.elektro-denker.com/phpMyAdmin-elebwbvm/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=6788654e634886ee9ca4ca18818a7f99&full=1
www.elektro-denker.com
www.elektro-denker.com/
http://202.137.230.154/phpmyadmin/index.php?server=1&target=server_processlist.php&lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=04f7d18dd41feabf6f193ce98845d0e7
http://apse.com.tw/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_general_ci&token=ef4ce41cc7bb19fa4216a8d1fd89b2a5&kill=84848
http://apse.com.tw/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_general_ci&token=28e762b909008475fa0df0b505d9594d&kill=90009
http://apse.com.tw/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_general_ci&token=d54040fd24f287358e5c83e51d41005a&kill=82080
http://apse.com.tw/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_general_ci&token=dbff09ac97b69ce0b6647a1aed5b9424&kill=82182
http://apse.com.tw/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_general_ci&token=03aa0d1eb55f9506a963c6b3f7222362&kill=88181
http://apse.com.tw/phpmyadmin/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_general_ci&token=b83e7763a2d3035eadf0a3f6c5c20827&kill=80865
http://cetl.gtu.ge/myadmin/server_processlist.php?lang=en-iso-8859-1&server=1&kill=16599770
http://cetl.gtu.ge/myadmin/server_processlist.php?lang=en-iso-8859-1&server=1&kill=3127566
http://cetl.gtu.ge/myadmin/server_processlist.php?lang=en-iso-8859-1&server=1&kill=2344240
http://cetl.gtu.ge/myadmin/server_processlist.php?lang=en-iso-8859-1&server=1&kill=17134474
http://118.97.147.162/phpmyadmin/server_processlist.php?token=914db90734e2ffdf1ae593444fac693a
http://www.rocketys.net/server_processlist.php?token=6fe896b38b75bc846cefc533fa18b8b9
www.rocketys.net
www.rocketys.net/
http://made-in-dk.eu/phpMyAdmin-knoktfdu4/server_processlist.php?lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=5a55615d2a73c3ee8e79741f1c27c637&kill=35563628
http://maxxyz.de/server_processlist.php?token=a863cfb68b631c080e3e289b75dfee9c
http://www.self.org.uk/server_processlist.php?token=5bfb8e5316455b364516652ae3fd34cb
www.self.org.uk
www.self.org.uk/
http://itarget.fr/phpmyadmin/index.php?server=1&target=server_processlist.php&lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=1a8151db903b7e9cf2a0ee3ea2815bd4
http://xellnaga.free.fr/phpMyAdmin/index.php?server=1&target=server_processlist.php&lang=en-utf-8&convcharset=iso-8859-1&collation_connection=utf8_unicode_ci&token=61023193d1a9303ab9c0a9fa397ef1cd
http://www.inrx.cn/shopinrxadmin/server_processlist.php?lang=zh-utf-8&server=1&collation_connection=utf8_general_ci&kill=2711119
http://www.inrx.cn/shopinrxadmin/server_processlist.php?lang=zh-utf-8&server=1&collation_connection=utf8_general_ci&kill=80890
http://www.inrx.cn/shopinrxadmin/server_processlist.php?lang=zh-utf-8&server=1&collation_connection=utf8_general_ci&kill=500730
http://210.14.6.59/phpmyadmin/server_processlist.php?lang=zh-utf-8&server=1&collation_connection=utf8_general_ci&kill=3333&phpMyAdmin=73684aa4546609bf75358e6b1a9e6e91
http://210.14.6.59/phpmyadmin/server_processlist.php?lang=zh-utf-8&server=1&collation_connection=utf8_general_ci&kill=14037&phpMyAdmin=73684aa4546609bf75358e6b1a9e6e91

Procurando site com Simple PHP Blog usando scanner inurl

Simple PHP Blog <= 0.4.0 - Multiple Remote Exploits, 
Vamos usar o scanner inurl para buscar site que possuem o CMS Simple PHP Blog

[ SCANNER INURLBR 1.0 / CONSOLE ]

----------------------------------------------------------------------------------------------------------------------------
0xHOST GOOGLE........: www.google.com.br
0xDORK...............: intext:"Powered by Simple PHP Blog" & inurl:"/blog/" ext:php
0xEXPLOIT............:
0xARQUIVO............: resultado.txt
0xTIPO DE ERRO.......: 2
0xPROCURAR NO ALVO...: Simple PHP Blog
0xIP PROXY...........:
0xPORTA..............:
----------------------------------------------------------------------------------------------------------------------------
0xCARREGANDO CONFIGURAÇÕES...
DEBUG:

Array
(
    [0] => Array
        (
        )

    [host] => www.google.com.br
    [dork] => intext%3A%22Powered+by+Simple+PHP+Blog%22+%26+inurl%3A%22%2Fblog%2F%22+ext%3Aphp
    [arquivo] => resultado.txt
    [tipoerro] => 2
    [exploit] =>
    [achar] => Simple PHP Blog
    [ipProxy] =>
    [porta] =>
    [url] => /search?q=intext%3A%22Powered+by+Simple+PHP+Blog%22+%26+inurl%3A%22%2Fblog%2F%22+ext%3Aphp&num=1900&btnG=Search
    [port] => 80
)

Comando usado no scanner inurl:
php botConsole.php --host='www.google.com.br' --dork='intext:"Powered by Simple PHP Blog" & inurl:"/blog/" ext:php' --arquivo='resultado.txt' --tipoerro='2' --exploit='' --achar='Simple PHP Blog'

ou --achar='Powered by Simple PHP Blog'


Exploit: http://www.exploit-db.com/exploits/1191/

Scanner INURL: http://pastebin.com/TzijC99y

RESULTADO SCANNER POSSÍVEIS VULNERÁVEIS :
TOTAL DE URL's: 179
EXPLOIT USADO:
DORK: intext%3A%22Powered+by+Simple+PHP+Blog%22+%26+inurl%3A%22%2Fblog%2F%22+ext%3Aphp
TOTAL DE POSSÍVEIS VULL: 106
ARQUIVO COM RESULTADO:resultado.txt
LISTA:

http://www.mutualdata.com/blog/index.php
http://www.ashrealms.com/blog/index.php
http://www.gdaa.org.uk/Blog/index.php
http://www.damanicorp.com/blog/index.php?m=10&y=13&entry=entry131012-001437
http://www.damanicorp.com/blog/index.php?m=04&y=07
http://www.traffordbankguesthouse.co.uk/blog/index.php
http://ps.ewi.utwente.nl/Blog/index.php
http://www.aerobiology.ca/blog/index.php
www.aerobiology.ca/blog/index.php
http://www.lofiminds.com/blog/static.php?page=xwung
http://fourseasonsroofingandsiding.com/Roofing-Blog/index.php?category=13
http://www.homesurvey.eu/Blog/index.php
http://www.omegamoon.com/blog/index.php
www.omegamoon.com/blog/index.php
http://www.omegamoon.com/blog/index.php?entry=entry140317-173710
http://boeglin.org/blog/index.php?entry=Flashing-a-BenQ-Z-series-for-free
http://humblecomics.com/blog/index.php
http://www.northernkentuckydancestudio.com/blog/index.php
http://www.ablekidspress.com/blog/index.php
www.ablekidspress.com/blog/index.php
http://courtjones.com/blog/index.php
http://geneyang.com/blog/index.php?entry=entry100524-195255
http://blog.frapu.de/index.php?m=09&y=13&d=&entry=entry130901-200909
http://www.lfpl.org/readers/blog/index.php
www.lfpl.org/readers/blog/index.php
http://shalinsiriwardana.asia/blog/comments.php?y=14&m=01&entry=entry140126-160857
http://www.z80.eu/blog/index.php?entry=entry140316-002012
http://www.rimrockpress.com/blog/index.php?entry=entry110914-115350
www.rimrockpress.com/blog/index.php?entry=entry110914-115350
http://blog.curti.eti.br/stats.php
http://www.donaldsteel.com/blog/index.php
http://www.bbheits.com/blog/index.php
http://www.lautechaee-edu.com/blog/index.php
http://www.bedfordlodge.co.uk/blog.php
www.bedfordlodge.co.uk/
http://www.bignightout.net.nz/blog/index.php?m=11&y=11&entry=entry111120-182043
http://www.createdimage.com.au/blog/index.php?m=01&y=14
http://www.bonniwellmusicmachine.com/blog/static.php?page=MusicMachineVideoBiography
www.bonniwellmusicmachine.com/blog/static.php?page=MusicMachineVideoBiography
http://www.invernessfestivals.com/winter08/blog/index.php?entry=entry131215-100334
www.invernessfestivals.com/winter08/blog/index.php?entry=entry131215-100334
http://www.pluhma.com/blog/index.php?entry=entry000101-205059
http://pdos.csail.mit.edu/scigen/blog/index.php?m=02&y=06
http://www.custom-designbuild.com/blog/index.php?m=02&y=14&entry=entry140215-082241
http://www.masetti.net/blog/archives.php?y=09&m=06
http://www.eliteenglishcentre.es/blog/static.php?page=Welcome
http://blog.hakwerk.com/static.php?page=crazy_it_party
http://www.wetieit.com/blog/index.php?category=1
www.wetieit.com/blog/index.php?category=1
http://theheatersonline.com/blog/index.php
http://fortknox.csc.ncsu.edu/blog/index.php?m=04&y=07&entry=entry070412-140344
http://blog.shuva.in/static.php?page=static070901-005017_about_me
http://www.belgianfamily.com/blog/index.php
http://www.wd5aii.com/blog/index.php?y=13&m=12
http://www.maintsmart.com/Blog/index.php
http://karrkrafts.com/blog/index.php
http://www.pinecountyhistorymuseum.org/blog/index.php
http://william.famille-blum.org/blog/index.php?entry=entry080612-040012
http://www.xandrinho.com/blog/index.php?entry=entry100528-155648
http://www.sbcofficecenter.com/blog/index.php
http://www.soundbysinger.com/audio-blog/index.php
www.soundbysinger.com/audio-blog/index.php
http://www.statetheatreconcerts.com/blog/static.php?page=static100613-122412
www.statetheatreconcerts.com/blog/static.php?page=static100613-122412
http://www.tapestry.co.nz/blog/index.php?entry=entry140123-215640
http://www.serpentbox.com/blog/index.php
http://www.cam-dex.com/blog/index.php
www.cam-dex.com/blog/index.php
http://www.ocsunsetmarina.com/blog/index.php?entry=entry070904-151350
http://www.arrowpipeline.com/blog/index.php?m=12&y=08&entry=entry081221-162738
http://www.africatamed.co.za/blog/comments.php?y=07&m=07&entry=entry070719-153213
http://www.thevacationcalendar.com/Blog/index.php?entry=entry090727-205943
http://www.judocoach.com/blog/index.php?entry=entry130829-103325
www.judocoach.com/blog/index.php?entry=entry130829-103325
http://www.ghostsniper.com/blog/index.php?entry=entry060828-222950
http://www.terraformthemoon.com/blog/index.php?entry=entry110412-005014
http://www.freshstartkz.com/blog/archives.php?y=14&m=03
http://www.freshstartkz.com/blog/archives.php?y=13&m=08
http://www.chrome-lagos.com/blog/index.php?m=10&y=11&entry=entry111010-192213
http://wsanders.net/blog/static.php?page=static070527-095119
http://www.zealsoft.com/blog/index.php?entry=entry051124-083423
http://wiels.nl/blog/index.php
http://www.patopowerparts.com/blog/index.php
http://www.milfordsnowtrekkers.com/blog/index.php
http://www.anglecomm.com/blog/index.php?entry=entry070510-172648
http://www.balishevilla.com/blog/index.php
http://www.asa-houston.org/Projects/Blog-CE/index.php
http://patrickbrennan.net/blog/index.php
http://millerfit.com/blog/index.php
http://www.redkid.net/blog/index.php?entry=entry101111-142242
http://www.och.cc/blog/stats.php
http://mammoth395.com/blog/index.php?entry=entry140213-130501
http://www.kellysheridan.ca/blog/index.php?m=01&y=10
http://www.parkburnguesthouse.co.uk/blog/index.php
http://www.bestpracticesfhc.com/blog/index.php
http://www.emillustration.co.uk/blog/index.php?m=03&y=13&entry=entry130308-180819
http://blog.chinookhelicopters.com/index.php?entry=entry140130-100830
http://www.waltzinghorsefarm.com/blog/index.php
http://www.colonsaybrewery.co.uk/blog/index.php?PHPSESSID=c8cd4e5ca92b1e8b479778772898556f
www.colonsaybrewery.co.uk/blog/index.php?PHPSESSID=c8cd4e5ca92b1e8b479778772898556f
http://www.djdingo.com/blog/contact.php
http://playchesster.com/blog/index.php?entry=entry110914-231540
http://www.nautikites.net/blog/index.php?entry=entry140118-112029
http://berman.nu/blog/index.php?entry=entry080428-235550
http://www.bazayev.com/blog/index.php?entry=entry120327-124716
http://www.bootcampbeach.co.uk/blog/static.php?page=static090501-130242

Procurando warning de erro usando scanner inurl.

Procurar avisos warning mysql dentro de sites .br excluindo resultados não interessantes como forum's  e tutoriais.

DORK: site:br intext:"warning: mysql_fetch_array();" -forum -vivaolinux -tutorial -Fórum

- Usando o scanner INURL -

php botConsole.php --host='www.google.com.br' --dork='site:br intext:"warning: mysql_fetch_array();" -forum -vivaolinux -tutorial -Fórum' --arquivo='resultado.txt' --tipoerro='2' --exploit='' --achar='Warning'


--host='define por qual host do google vai sair a busca, no caso é o .com.br, mas pode ser qualquer outro.
Para ver a lista de host do google digite 'php botConsole.php hosts'.'

--dork='define a dork que vai efetuar sua busca'

--arquivo='define o arquivo de saída onda vai ser salvo seu resultado'

--tipoerro=' 2 define o tipo de busca, tipo dois sanguifica que o script vai validar se é vull ou não, caso ele achar a string passada no comando --achar, se tal informação for encontrada dentro do alvo o site é possivelmente vul'

--exploit='define o que vai ser concatenado a cada url para o script ser executado, Ex: se você deseja executar um sql-exploit no final de cada url, e o script procurar por determinado erro ou msg ,nesse exemplo está vazio pois não tinha necessidade de exploitar os alvos, pois os mesmos já carregavam o erros sql.'

--achar='define o que procurar dentro de cada alvo, ou seja código fonte.
neste exemplo estavamos procurando avisos de do mysql Warning que em html ficaria Warning'

Mais informações digite php botConsole.php ajuda

[ BAIXAR: http://pastebin.com/TzijC99y  ] 

RESULTADO:

SCANNER INURLBR 1.0 - [ blog.inurl.com.br ] /DATA:09/05/2014 10:14:52 
/DORK: site%3Abr+intext%3A%22warning%3A+mysql_fetch_array%28%29%3B%22+-forum+-vivaolinux+-tutorial+-F%C3%B3rum  /EXPLOIT:  TOTAL VULL:116
 
http://www.cbt.esp.br/modulos/ssl/index.php?indice=128
www.cbt.esp.br/modulos/ssl/index.php?indice=128
www.cbt.esp.br/modulos/ssl/index.php?indice=128
http://www.itdata.com.br/products/index.php?location=product_view&product_area=featured&product_id=4
www.itdata.com.br/products/index.php?location...view...
http://www.epengenharia.com.br/texto-a22-mapa_do_site.html
www.epengenharia.com.br/texto-a22-mapa_do_site.html
http://www.ingesp.com.br/empreendimentos/unifamiliar-em-pinhalzinho-sc/43
www.ingesp.com.br/empreendimentos/unifamiliar-em...sc/43
http://www.dapo.com.br/obra.php?obr
www.dapo.com.br/obra.php?obr
http://www.marcosparente.net.br/?pg=gremio
www.marcosparente.net.br/?pg=gremio
http://www.faa.edu.br/vetmatriz.php
www.faa.edu.br/vetmatriz.php
http://www.softbest.com.br/pwn3ed/spotlights/artspotlight/detalhes-post/9/
www.softbest.com.br/pwn3ed/spotlights/artspotlight/detalhes.../9/
http://www.marciaimoveisrs.com.br/imovel.php?id=7
www.marciaimoveisrs.com.br/imovel.php?id=7
http://www.softbest.com.br/pwn3ed/404/
www.softbest.com.br/pwn3ed/404/
http://www.altogarcas.mt.gov.br/contaspublicas.php?tipo=7
www.altogarcas.mt.gov.br/contaspublicas.php?tipo=7
www.altogarcas.mt.gov.br/contaspublicas.php?tipo=7
www.acainews.com.br/.../b-ecirc-bada-eacute-presa-ap-oacute-s-fazer-sexo-
http://www.cpadnews.com.br/institucional/secao.php?s=3
www.cpadnews.com.br/institucional/secao.php?s=site%3Abr+intext%3A%22warning%3A+mysql_fetch_array%28%29%3B%22+-forum+-vivaolinux+-tutorial+-F%C3%B3rum  3
http://www.frcsolucoes.com.br/minidir/
www.frcsolucoes.com.br/minidir/
http://www.tuttydecoracoes.com.br/categoria-produtos.php?cat=2..
www.tuttydecoracoes.com.br/categoria-produtos.php?cat=2..
http://www.agricenterseberi.com.br/site/localizacao.php
www.agricenterseberi.com.br/site/localizacao.php
http://clinicacri.com.br/estrutura/enquetes/enquetes.php
http://www.autocentroimoveis.com.br/scherer/imovel.php?id=6051
www.autocentroimoveis.com.br/scherer/imovel.php?id=6051
www.ipm.org.br/ipmb_pagina.php?mpg=2.03.00.00.00...
http://www.eduardoimoveisrs.com.br/imovel.php?id=
www.eduardoimoveisrs.com.br/imovel.php?id=
http://www.cidadefmnavirai.com.br/template_3.php?id=rbatsifxx
www.cidadefmnavirai.com.br/template_3.php?id=rbatsifxx
http://www.cta.br/noticias/noticias.php
www.cta.br/noticias/noticias.php
http://www.makakomotorsports.com.br/?pagina=detalhes&cod=2
www.makakomotorsports.com.br/?pagina=detalhes
http://intranet.clicknet.net.br/modulos/administrativo/local_cobranca/16/index.php
http://www.podiumveiculos.com.br/fire/2014/veiculos-novos.php
www.podiumveiculos.com.br/fire/2014/veiculos-novos.php
http://www.exer.com.br/minidir/
www.exer.com.br/minidir/
http://www.imojel.com.br/include/ler_usina.php
www.imojel.com.br/include/ler_usina.php
http://www.imojel.com.br/include/ler_galeria-montanha.php
www.imojel.com.br/include/ler_galeria-montanha.php
http://www.imobestrela.com.br/imovel.php?id=
www.imobestrela.com.br/imovel.php?id=
http://www.ciadacasaimoveis.com.br/imovel.php?id=14223
www.ciadacasaimoveis.com.br/imovel.php?id=14223
www.saopedrodoparana.pr.gov.br/padrao.php?uid=MjU...
http://www.fiatviaverdi.com.br/semi-novo/fiat-500/42
www.fiatviaverdi.com.br/semi-novo/fiat-500/42
http://www.folhadearaputanga.com.br/index3.php?pg=evento&id=434
www.folhadearaputanga.com.br/index3.php?pg=evento
http://www.feierimoveis.com.br/imovel.php?id=7537
www.feierimoveis.com.br/imovel.php?id=7537
http://www.macrooffice.com.br/novo/animatopo_xml.php
www.macrooffice.com.br/novo/animatopo_xml.php
http://www.marcaprovada.com.br/site/consumidores/codigo.php
www.marcaprovada.com.br/site/consumidores/codigo.php
http://www.ogerente.com.br/novo/canais_colunas_all.php?es=c&canal=9&canallocal=30
http://www.guiadonoroeste.com.br/anuncie.php
www.guiadonoroeste.com.br/anuncie.php
http://marketlist.com.br/minidir/terceiro.php
http://www.bitfarma.com.br/minidir/
www.bitfarma.com.br/minidir/
http://www.tribunavgp.com.br/home/
www.tribunavgp.com.br/home/
http://www.crescer.inf.br/site/?ir=contato
www.crescer.inf.br/site/?ir=contato
http://www.banet.com.br/site/cadastro.php
www.banet.com.br/site/cadastro.php
http://www.praiagrandesp.com.br/exibe.php?id=182
www.praiagrandesp.com.br/exibe.php?id=182
http://www.pampulhamallshopping.com.br/?pg=lojas
www.pampulhamallshopping.com.br/?pg=lojas
www.pampulhamallshopping.com.br/?pg=lojas
http://www.birakimoveis.com.br/links_uteis.php
www.birakimoveis.com.br/links_uteis.php
http://www.autofuria.com.br/paginas/veiculo_info.php?veiculo=1
www.autofuria.com.br/paginas/veiculo_info.php?veiculo=1
http://www.astaritabazacas.com.br/?link=maquinas&produto=7
http://www.grupoacaoimoveis.com.br/index.php
www.grupoacaoimoveis.com.br/index.php
http://www.lincetoyota.com.br/acessorios/?carro_acessorio=%3Cbr%20/%3E%3Cb%3EWarning%3C/b%3E:%20%20mysql_fetch_array
www.lincetoyota.com.br/acessorios/?carro_acessorio...
http://www.negocieimoveisrs.com.br/loja.php?id=711
www.negocieimoveisrs.com.br/loja.php?id=711
www.negocieimoveisrs.com.br/loja.php?id=711
http://www.portalubirata.com.br/guia/Floricultura/66664-Decorart_Floricultura.html
www.portalubirata.com.br/guia/.../66664-Decorart_Floricultura.html
http://www.tudoparasuaempresa.com.br/orcamento.php?codigo=63&
www.tudoparasuaempresa.com.br/orcamento.php?codigo=63
http://www.camarapotim.sp.gov.br/sessoes/indice-ordinarias.php
http://www.mcsmecanica.com.br/index.php
www.mcsmecanica.com.br/index.php
http://imobiliariagaleao.com.br/pesq_refinada/indexformpesqrefinada.php
http://fluirpilates.com.br/equipePessoa.php?id=4
http://imoveissponline.com.br/parceiros.php
http://intranet.vcnet.com.br/modulos/administrativo/local_cobranca/38/index.php
http://www.perfininvestimentos.com.br/fundos/perfin-ls-plus-fic-fim.htm
www.perfininvestimentos.com.br/fundos/perfin-ls-plus-fic-fim.htm
www.tripliceeventos.com.br/tclass/index.php?opt=in
http://www.quibusca.com.br/produto.php?idprod=
www.quibusca.com.br/produto.php?idprod=
http://www.delamarveiculos.com.br/motos_usadas.php
www.delamarveiculos.com.br/motos_usadas.php

Vamos falar de HEARBLEED S2

S2 HEARBLEED S2

Heartbleed é um bug de segurança na biblioteca OpenSSL criptografia de código aberto,
que é amplamente utilizado para implementar o Internet Transport Layer Security (TLS) protocolo.
Resultados Heartbleed de validação de entrada imprópria ( devido a uma limites ausentes cheque)
na implementação do Transport Layer Security (TLS) extensão batimentos cardíacos, o coração estar por trás do nome do bug. Esta vulnerabilidade é classificada como um buffer over-read.

"Esta falha permite que um atacante remoto recupere memória privada de um aplicativo que usa a biblioteca OpenSSL vulnerável em pedaços de 64k de cada vez."

A versão fixa do OpenSSL foi lançado em 07 de abril de 2014 , ao mesmo tempo que Heartbleed foi divulgada publicamente . Naquela época, cerca de 17 por cento ( cerca de meio milhão ) de servidores Web seguros da Internet certificados por autoridades confiáveis ​​, acreditava-se ser vulnerável ao ataque , permitindo o roubo de " chaves privadas e dos usuários dos servidores de cookies de sessão e senhas.

Um dos principais objetivos dos atacantes, é obter logins e senhas de acesso a contas de e-mail, mas, não para por ai. O SSL/TLS é também responsável pela comunicação segura de e-mail, mensagem instantânea e as VPNs (Virtual Private Networks).’

A falha Heartbleed não encontra-se no protocolo SSL/TSL, mas sim na biblioteca OpenSSL.

Quais versões do OpenSSL são afetados?

Estatuto dos diferentes versões:

OpenSSL 1.0.1   através 1.0.1f (inclusive) são vulneráveis 
OpenSSL 1.0.1g não é vulnerável 
OpenSSL 1.0.0   ramo não é vulnerável 
OpenSSL 0.9.8   ramo não é vulnerável

OpenSSL 1.0.1g foi liberado para resolver esta vulnerabilidade. Quaisquer chaves geradas com uma versão vulnerável do OpenSSL deve ser considerada comprometida e regenerado e implantado após o patch foi aplicado.

Sistemas operacionais? 

Algumas distribuições de sistemas operacionais já fornecidos com a versão OpenSSL são potencialmente vulnerável: 

Debian Wheezy (estável), OpenSSL 1.0.1e-2 + deb7u4 
Ubuntu 12.04.4 LTS, OpenSSL 1.0.1-4ubuntu5.11 
CentOS 6.5, OpenSSL 1.0.1e-15 
Fedora 18, OpenSSL 1.0.1e-4 
OpenBSD 5.3 (OpenSSL 1.0.1c 10 de maio de 2012) e 5,4 (OpenSSL 1.0.1c 10 de maio de 2012) 
FreeBSD 10.0 - 1.0.1e OpenSSL 11 fev 2013 
NetBSD 5.0.2 (OpenSSL 1.0.1e) 
OpenSUSE 12.2 (OpenSSL 1.0.1c) 

Distribuição do sistema operacional com as versões que não são vulneráveis​​: 

Debian Squeeze (oldstable), OpenSSL 0.9.8o-4squeeze14 
SUSE Linux Enterprise Server 
FreeBSD 8.4 - 0.9.8y OpenSSL 05 de fevereiro de 2013 
FreeBSD 9.2 - 0.9.8y OpenSSL 05 de fevereiro de 2013 
FreeBSD 10.0p1 - 1.0.1g OpenSSL (Na 08 abril 2014 18:27:46 UTC) 
FreeBSD - 1.0.1g OpenSSL (Pelo 7 abr 2014 21:46:40 UTC)

Entenda:



SCAN + EXPLOIT Heartbleed OpenSSL
http://pastebin.com/nfr3ivGk


SOURCE EXPLOIT - Heartbleed
http://pastebin.com/vznDZDS0


REF:
http://unknownsec.wordpress.com/2014/04/09/passo-a-passo-openssl-tls-heartbeat-extension-memory-disclosure/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160
https://en.wikipedia.org/wiki/Heartbleed
https://www.us-cert.gov/ncas/alerts/TA14-098A
https://www.openssl.org/news/secadv_20140407.txt
http://heartbleed.com/