Jul 28, 2011 05:04 AM
(This post was last modified: Jul 28, 2011 05:05 AM by Inso.)
In this tutorial I hope to teach you how to exploit vulnerabilities in websites using DotNetNuke. It is advised you use the Mozilla Firefox web browser for this as Internet Explorer deletes some of the code if you copy and paste it.
Finding your target.
Obviously, before you can hack a site, you need to find a site vulnerable to what you want to do, in this case, a DNN Exploit. We can do this using a search engine, I recommend google. What we want to search is:
What you should see as a list of results is many websites using "DotNetNuke".
Is my target vulnerable?
To find this out, we need to navigate to another part of the site. This will be the same part of the site where we will be able to upload our shell. Change the URL to the following:
When you go to our new link you should be able to see an upload box, similar to this:
http://pastehtml.com/view/b1ycazud0.html
If you don't see anything similar to that then your site isn't vulnerable.
The exploit.
If your site is vulnerable, we can now get around to exploiting it. On your vulnerable page, there are 3 radio buttons:
For this, we are going to want to click on "File ( A File On Your Site ). Once you click on it, you will notice our first problem. It only shows files already on the site! To get around this, we can use some very simple javascript. Paste the following into your URL/Address Bar:
We should now be able to upload files directly from our harddrive now! Usually it only allows you to upload certain file types, so to upload your shell or an html page, we have to change the ending. Example:
Both of those endings will be enough to allow you to upload your file. To find your file upload another file that isn't allowed, such as an .HTML or .EXE file. When you attempt to upload it, you will get an error message and within this error message will be the path to where you files are saved. Now navigate to your file, and have some fun!
I hope you understood and learnt something from my tutorial. Any questions? PM me!
Other tutorials by me:
Basic XSS Tutorial and SQLi
Finding your target.
Obviously, before you can hack a site, you need to find a site vulnerable to what you want to do, in this case, a DNN Exploit. We can do this using a search engine, I recommend google. What we want to search is:
Code
:inurl:"portals/0/"What you should see as a list of results is many websites using "DotNetNuke".
Is my target vulnerable?
To find this out, we need to navigate to another part of the site. This will be the same part of the site where we will be able to upload our shell. Change the URL to the following:
Code
(TheSitesURL)/Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspxWhen you go to our new link you should be able to see an upload box, similar to this:
http://pastehtml.com/view/b1ycazud0.html
If you don't see anything similar to that then your site isn't vulnerable.
The exploit.
If your site is vulnerable, we can now get around to exploiting it. On your vulnerable page, there are 3 radio buttons:
- URL ( A Link To An External Resource )
- Page ( A Page On Your Site )
- File ( A File On Your Site )
For this, we are going to want to click on "File ( A File On Your Site ). Once you click on it, you will notice our first problem. It only shows files already on the site! To get around this, we can use some very simple javascript. Paste the following into your URL/Address Bar:
Code
javascript:__doPostBack('ctlURL$cmdUpload','')We should now be able to upload files directly from our harddrive now! Usually it only allows you to upload certain file types, so to upload your shell or an html page, we have to change the ending. Example:
Code
c99shell.php;me.jpg
myHTMLpage.html;me.jpgBoth of those endings will be enough to allow you to upload your file. To find your file upload another file that isn't allowed, such as an .HTML or .EXE file. When you attempt to upload it, you will get an error message and within this error message will be the path to where you files are saved. Now navigate to your file, and have some fun!
I hope you understood and learnt something from my tutorial. Any questions? PM me!
Other tutorials by me:
Basic XSS Tutorial and SQLi
