(Sep 28, 2014 11:28 PM)Canterbury Bulldogs Wrote:  Depends on what kind of version of WP you're using.

(Sep 27, 2014 08:43 PM)mObil3_xT Wrote:  

WordPress Slider Revolution Vulnerability Exploit:
Slider Revolution Premium WordPress Plugin that allows a remote attacker to download any file from the server.

In my previous thread I help explain how easy it was to hack multiple WordPress websites through some vulnerable themes.
As you may already know the database password rarely matched the WordPress admin's password. =/

[TUTORIAL:]>_ HACK WORDPRESS WEBSITES_[/NO Experience Required!]

Here's a simple .php script Coded By AMir dZ 52 and Modified & Hosted by me help you exploit it even more. 🎉


Here's how it works:

First Click on "Exploit Dorks" tab and choose a dork to search on Google.

EXAMPLE:


Next click "Exploiter" tab and copy/paste multiple URL's from google and click on "Exploit" to scan for vulnerable WordPress sites. If infected it will display:

PHP Code


<?php 
DB_Name:
DB_User:
DB_Pass:
DB_Host: 


Now that you have the MySQL database information click on "Find DB Panel" and you can try to locate the login panel.


Currently scans:

PHP Code


<?php 
$list = array(

'/phpMyAdmin/',

'/phpmyadmin/',

'/PMA/',

'/pma/',

'/admin/',

'/wp-login.php',

'/dbadmin/',

'/DB_ADMIN/',

'/db_admin/',

'/DBA/',

'/SQLI/',

'/dba/',

'/sqli/',

'/mysql/',

'/myadmin/',

'/phpmyadmin2/',

'/phpMyAdmin2/',

'/phpMyAdmin-2/',

'/php-my-admin/',

'/phpMyAdmin-2.2.3/',

'/phpMyAdmin-2.2.6/',

'/phpMyAdmin-2.5.1/',

'/phpMyAdmin-2.5.4/',

'/phpMyAdmin-2.5.5-rc1/',

'/phpMyAdmin-2.5.5-rc2/',

'/phpMyAdmin-2.5.5/',

'/phpMyAdmin-2.5.5-pl1/',

'/phpMyAdmin-2.5.6-rc1/',

'/phpMyAdmin-2.5.6-rc2/',

'/phpMyAdmin-2.5.6/',

'/phpMyAdmin-2.5.7/',

'/phpMyAdmin-2.5.7-pl1/',

'/phpMyAdmin-2.6.0-alpha/',

'/phpMyAdmin-2.6.0-alpha2/',

'/phpMyAdmin-2.6.0-beta1/',

'/phpMyAdmin-2.6.0-beta2/',

'/phpMyAdmin-2.6.0-rc1/',

'/phpMyAdmin-2.6.0-rc2/',

'/phpMyAdmin-2.6.0-rc3/',

'/phpMyAdmin-2.6.0/',

'/phpMyAdmin-2.6.0-pl1/',

'/phpMyAdmin-2.6.0-pl2/',

'/phpMyAdmin-2.6.0-pl3/',

'/phpMyAdmin-2.6.1-rc1/',

'/phpMyAdmin-2.6.1-rc2/',

'/phpMyAdmin-2.6.1/',

'/phpMyAdmin-2.6.1-pl1/',

'/phpMyAdmin-2.6.1-pl2/',

'/phpMyAdmin-2.6.1-pl3/',

'/phpMyAdmin-2.6.2-rc1/',

'/phpMyAdmin-2.6.2-beta1/',

'/phpMyAdmin-2.6.2-rc1/',

'/phpMyAdmin-2.6.2/',

'/phpMyAdmin-2.6.2-pl1/',

'/phpMyAdmin-2.6.3/',

'/phpMyAdmin-2.6.3-rc1/',

'/phpMyAdmin-2.6.3/',

'/phpMyAdmin-2.6.3-pl1/',

'/phpMyAdmin-2.6.4-rc1/',

'/phpMyAdmin-2.6.4-pl1/',

'/phpMyAdmin-2.6.4-pl2/',

'/phpMyAdmin-2.6.4-pl3/',

'/phpMyAdmin-2.6.4-pl4/',

'/phpMyAdmin-2.6.4/',

'/phpMyAdmin-2.7.0-beta1/',

'/phpMyAdmin-2.7.0-rc1/',

'/phpMyAdmin-2.7.0-pl1/',

'/phpMyAdmin-2.7.0-pl2/',

'/phpMyAdmin-2.7.0/',

'/phpMyAdmin-2.8.0-beta1/',

'/phpMyAdmin-2.8.0-rc1/',

'/phpMyAdmin-2.8.0-rc2/',

'/phpMyAdmin-2.8.0/',

'/phpMyAdmin-2.8.0.1/',

'/phpMyAdmin-2.8.0.2/',

'/phpMyAdmin-2.8.0.3/',

'/phpMyAdmin-2.8.0.4/',

'/phpMyAdmin-2.8.1-rc1/',

'/phpMyAdmin-2.8.1/',

'/phpMyAdmin-2.8.2/',

'/sqlmanager/',

'/mysqlmanager/',

'/p/m/a/',

'/PMA2005/',

'/pma2005/',

'/dev/',

'/phpmanager/',

'/php-myadmin/',

'/phpmy-admin/',

'/webadmin/',

'/sqlweb/',

'/websql/',

'/webdb/',

'/mysqladmin/',

'/mysql-admin/',

'/mya/',

'/PhpMyAdmin/',

'/phpmyadmin/',

'/myadmin/',

'/mysql/',

'/sql/',

'/server/',

'/db/',

'/database/',

'/databases/',

'/adm/',

'/configuration/',

'/configure/',

'/administrator/',

'/login/',

'/moderator/',

'/controlpanel/',

'/adminpanel/',

'/admincontrol/',

'/fileadmin/',

'/data/',

'/postgresql/',

'/oracle/',

'/msssql/',

'/msaccess/',

'/sysadmin/',

'/serverdata/',

'/webadmin/',

'/admins/',

'/Database_Administration/',

'/WebAdmin/',

'/useradmin/',

'/sysadmins/',

'/admin1/',

'/system-administration/',

'/administrators/',

'/pgadmin/',

'/directadmin/',

'/staradmin/',

'/ServerAdministrator/',

'/SysAdmin/',

'/administer/',

'/LiveUser_Admin/',

'/sys-admin/',

'/typo3/',

'/panel/',

'/xlogin/',

'/smblogin/',

'/phpldapadmin/',

'/server_admin/',

'/database_administration/',

'/system_administration/',

'/ss_vms_admin_sm/',

'/adminarea/',

'/MySQL/',

'/mysql_admin/',

'/server_data/',

'/DB/',

'/DB1/',

'/DB2/',

'/DB3/',

'/DB4/',

'/DB5/',

'/DB6/',

'/DB7/',

'/DB8/',

'/DB9/',

'/DB0/',

'/db1/',

'/db2/',

'/db3/',

'/db4/',

'/db5/',

'/db6/',

'/db7/',

'/db8/',

'/db9/',

'/db0/',

'/mysql5/',

'/mysql4/',

'/root/',

'/apache/',

'/php/',

'/Apache/',

'/Php/',

'/apach/',

'/apachepanel/',

'/WEBSERVERS/',

'/DATABASE1/',

'/DATABASE2/',

'/DATABASE3/',

'/DATABASE4/',

'/DATABASE5/',

'/DATABASE6/',

'/DATABASE7/',

'/DATABASE8/',

'/DATABASE9/',

'/WEBDATA/',

'/WEB_DATA/',

'/webservers/',

'/database1/',

'/database2/',

'/database3/',

'/database4/',

'/database5/',

'/database6/',

'/database7/',

'/database8/',

'/database9/',

'/webdata/',

'/web_data/',

); 


Some other added features to help you along.






►Hosted Link:

Good Luck and Thanks for viewing my thread. 🤝

(Sep 28, 2014 10:07 PM)DotTXT Wrote:  Download the config
Find the pma and boom db access.