Jsoftware

Sunday, February 5, 2012

TinKode-SourceForge LFI

9:12 PM Admin No comments

SourceForge LFI

Posted by isrtinkode on February 18, 2010

 ____                            __
/ ___|  ___  _   _ _ __ ___ ___ / _| ___  _ __ __ _  ___
\___ \ / _ \| | | | '__/ __/ _ \ |_ / _ \| '__/ _` |/ _ \
 ___) | (_) | |_| | | | (_|  __/  _| (_) | | | (_| |  __/
|____/ \___/ \__,_|_|  \___\___|_|  \___/|_|  \__, |\___|
                                              |___/

Link: Sourceforge.net
Yeah, it’s vulnerable to LFI (Local File Inclusion).

http://in-dtsc.sourceforge.net/index.php?content=**********
http://in-dtsc.sourceforge.net/index.php?content=*******/conf/htt***.conf

For more informations read a tutorial about LFI.

TinKode-APPLE Vulnerable to Blind SQLi

9:06 PM Admin No comments

APPLE Vulnerable to Blind SQLi

Posted by isrtinkode on February 18, 2010

          _____  _____  _      ______
    /\   |  __ \|  __ \| |    |  ____|
   /  \  | |__) | |__) | |    | |__
  / /\ \ |  ___/|  ___/| |    |  __|
 / ____ \| |    | |    | |____| |____
/_/    \_\_|    |_|    |______|______|
  #BlindSQLi by TinKode

@Apple
Apple is an American multinational corporation that designs and manufactures consumer electronics and computer software products.
The company’s best-known hardware products include Macintosh computers, the iPod, and the iPhone.
Apple software includes the Mac OS X operating system, the iTunes media browser, the iLife suite of multimedia and creativity software, the iWork suite of productivity software, Final Cut Studio, a suite of professional audio and film-industry software products, and Logic Studio, a suite of audio tools.
The company operates more than 250 retail stores in nine countries, and an online store where hardware and software products are sold.

Yeah, so it’s a huge company, but have a low security. Sad.
This parameter can be found by anyone in only 5 min with google.

Testing:

Now let’s see the version

#Version: 5 #Databases: locator_asia, test

#Tables from “locator_asia” database

[0]: reseller_city_utf8 [1]: reseller_district_utf8 [2]: reseller_provice_utf8 [3]: resellers_cn_utf8 [4]: resellers_company_utf8 [5]: resellers_emaillog [6]: resellers_hk [7]: resellers_hk_area [8]: resellers_hk_district [9]: resellers_id [10]: resellers_id_area [11]: resellers_id_district [12]: resellers_kr [13]: resellers_kr_area [14]: resellers_kr_district [15]: resellers_mo [16]: resellers_mo_area [17]: resellers_mo_district [18]: resellers_my [19]: resellers_my_area [20]: resellers_my_district [21]: resellers_ph [22]: resellers_ph_area [23]: resellers_ph_district [24]: resellers_sg [25]: resellers_sg_area [26]: resellers_sg_company [27]: resellers_th [28]: resellers_th_area [29]: resellers_th_district [30]: resellers_tw [31]: resellers_tw_area [32]: resellers_tw_district [33]: resellers_type [34]: resellers_vn [35]: resellers_vn_area [36]: resellers_vn_district [37]: sms_black_list [38]: sms_log [39]: sms_user_action_log

#Tables from “test” database

[0]: StoreRedir [1]: downloadqueue [2]: iwork [3]: qtcomp

Columns from “reseller_city_utf8” table

[0]: id [1]: provice_id [2]: city [3]: city_spell [4]: municipality_flag [5]: near1 [6]: near2 [7]: near3 [8]: near4

A good thing is that there is nothing important to extract…
Great, good bye, TinKode

TinKode-Yahoo Blind SQL Injection

9:04 PM Admin No comments

Yahoo Blind SQL Injection

Posted by isrtinkode on February 18, 2010

__     __   _                   ____  _ _           _    _____  ____  _      _
\ \   / /  | |                 |  _ \| (_)         | |  / ____|/ __ \| |    (_)
 \ \_/ /_ _| |__   ___   ___   | |_) | |_ _ __   __| | | (___ | |  | | |     _
  \   / _` | '_ \ / _ \ / _ \  |  _ <| | | '_ \ / _` |  \___ \| |  | | |    | |
   | | (_| | | | | (_) | (_) | | |_) | | | | | | (_| |  ____) | |__| | |____| |
   |_|\__,_|_| |_|\___/ \___/  |____/|_|_|_| |_|\__,_| |_____/ \___\_\______|_|

                                            #By c0de.breaker@Romania

Yahoo! Inc. is an American public corporation headquartered in Sunnyvale, California, (in Silicon Valley), that provides Internet services worldwide. The company is perhaps best known for its web portal, search engine (Yahoo! Search), Yahoo! Directory, Yahoo! Mail, Yahoo! News, advertising, online mapping (Yahoo! Maps), video sharing (Yahoo! Video), and social media websites and services.
According to Web traffic analysis companies (including Compete.com, comScore, Alexa Internet, Netcraft, and Nielsen Ratings), the domain yahoo.com attracted at least 1.575 billion visitors annually by 2008. The global network of Yahoo! websites receives 3.4 billion page views per day on average as of October 2007. It is the second most visited website in the world in May 2009.

Vulnerable website: http://hk.adspecs.yahoo.com

Testing…