+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: http://www.cfpciowa.org/ HAKCED (/showthread.php?tid=3457947)
* - FixAllthis - May 5, 2013
Site is vulnerable to blind SQL interjection.
Database: cfpciowa
Username: cjadmin
Password: cjmaster
Username: eccadmin
Password:child497
Username:Anne
Password:child497
Username:Vivian
Password:eccadmin
Username:Sheila
Password:ecc123
Username:Alex
Password:ecc123
Username:slashx24
Password:killer12
They have a cpanel connected through to port 2082 that can be accessed through CSRF EXPLOIT that the OP can't access. So go ahead if you know how to accomplished the exploit fix the site from there then contact (515-280-9027) too help them further.
* - pashabiceps - May 5, 2013
lulwut
http://cfpciowa.org/page.php?id=10031
* - xhflhkeuhwguu34 - May 5, 2013
This site has become a HF playground! This should be fun.
This site was developed by http://www.captainjack.com.
There could be other vulns in their sites.
* - FixAllthis - May 5, 2013
The site itself is full of blind sql vulns as I said above. With that exploit you're able to get full login details of everything you need. No need to dig further into it. The thing is why it hasn't been fully defaced by another user yet?
* - ๖ۣۜAlexander - May 5, 2013
(May 5, 2013 07:33 AM)FixAllthis Wrote: The site itself is full of blind sql vulns as I said above. With that exploit you're able to get full login details of everything you need. No need to dig further into it. The thing is why it hasn't been fully defaced by another user yet?
Because defacing a site that helps children is pure evil.
* - FixAllthis - May 5, 2013
There is also a XSS vuln within the contact.php. Seems no one has caught onto that one.
You can use Iframe if set input state in contact details set to 1 from defined definition such as example #" onmouseover=prompt(940621) // for script it can cause a javascript prompt to pop up.
example that you can transform for javascript:
address=3137%20Laguna%20Street&city=San%20Francisco&comments=1&email=sample%40email.tst&fax=317-317-3137&first_name=wrulssrp&last_name=wrulssrp&org=1&phone=555-666-0606&state=%22%20onmouseover%3dprompt%28901001%29%20bad%3d%22&submit=Send&userstring=wrulssrp&zip=94102
modify to defined definition for own use of XSS exploit.
(May 5, 2013 07:47 AM)AnonGenReleases Wrote: Because defacing a site that helps children is pure evil.
I understand that. If you read my first post on this thread you will see I gave full details too access the site with admin rights and reclaim the site to give back to original owner.
* - devilking55 - May 5, 2013
I just type http://cfpciowa.org/admin
and log in....
I change it to the hackforums.... It's now said hacked by hackforums...
* - xhflhkeuhwguu34 - May 5, 2013
(May 5, 2013 07:52 AM)devilking55 Wrote: I just type http://cfpciowa.org/admin
and log in....
I change it to the hackforums.... It's now said hacked by hackforums...
Not allowed to do that, you're not supposed to link back here.
* - devilking55 - May 5, 2013
(May 5, 2013 07:55 AM)iancarroll Wrote: Not allowed to do that, you're not supposed to link back here.
oops... Too late...
I didn't know that... I put someone name on the admin page... name blaze...
* - xhflhkeuhwguu34 - May 5, 2013
BTW, why are there 2 login prompts? Only one works with the creds published.
* - ๖ۣۜAlexander - May 5, 2013
Alright, somebody deleted all the adminaccounts. No fun for me..
* - FixAllthis - May 5, 2013
I am taking it over and giving it back to the original owners. This is enough. For the children.
* - devilking55 - May 5, 2013
I made a admin account...
And the owner think you will hack it
* - ๖ۣۜAlexander - May 5, 2013
The only Admin User there is at the moment is FixThisSite.
* - devilking55 - May 5, 2013
Someone kill the site =(
It's all gone! no one survived!