Hackers Chronicle - Online Cyber Security News: DNN

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjEOlAHxQVzBG9xgDW6ao9teTPGEjyUjZOEu7gCwSUV3tUHS0Tnz_P_oX5dq5k766LqaifOZlsH0mQlie96lntu-D7qQXQ0hxEN8moSiB_o7X9hSNjTjDVuhLks8BFIEzneTh4PPFHyMhI/s1600/dotnetnuke-large.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="87" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjEOlAHxQVzBG9xgDW6ao9teTPGEjyUjZOEu7gCwSUV3tUHS0Tnz_P_oX5dq5k766LqaifOZlsH0mQlie96lntu-D7qQXQ0hxEN8moSiB_o7X9hSNjTjDVuhLks8BFIEzneTh4PPFHyMhI/s1600/dotnetnuke-large.gif" width="320" /></a></div>
 
<div class="post-body entry-content">
Using google DORK try to find the vulnerable website. 
 
inurl:"/portals/0" 
 
You can also modify this google dork according to your need & requirement.I have found these 2 website vulnerable to this attack: 
 
<a href="http://www.wittur.se/">http://www.wittur.se/</a> 
<a href="http://www.bsd405.org/">http://www.bsd405.org/</a> 
 
n00bs can also try both of these websites for testing purpose.Open the home page and check any image which is located in /portals/0/Check the location of the image. It should be located in /portals/0/ 
 
For e.g. in case of <a href="http://www.wittur.se/">http://www.wittur.se</a> ..the image is located at location- <a href="http://www.wittur.se/Portals/0/SHM.jpg">http://www.wittur.se/Portals/0/SHM.jpg</a> 
 
Waaooo it means this website is vulnerable and we can change the front page pic. Now the current image name is SHM.jpg. Rename the new image as SHM.jpg which you want to upload as a proof of you owned the system. 
 
Now here is the exploit 
 
Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx 
 
HOW TO RUN ? 
Simply copy paste it as shown below: 
 
<a href="http://www.site.com/Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx">www.site.com/Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx</a> 
 
You will see the portal where it will ask you to upload. Select the third option File ( A File On Your Site 
 
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgyivlTA96p8SVSh0zoTMd77LtT77BUAVLq2WRfM3gLrGG8LeNbGDLfOYY4nBSQSP73TYVbvt8Q2PjlxEF6FPgMbCxjIRYt0x3iQ_hfPwCLp5R8xI9ofa9op1Vg75buViwO3f1Wf2GVhMA/s1600/1.JPG" style="color: #3778cd; text-decoration: none;"><img alt="" border="0" id="BLOGGER_PHOTO_ID_5498613501494723714" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgyivlTA96p8SVSh0zoTMd77LtT77BUAVLq2WRfM3gLrGG8LeNbGDLfOYY4nBSQSP73TYVbvt8Q2PjlxEF6FPgMbCxjIRYt0x3iQ_hfPwCLp5R8xI9ofa9op1Vg75buViwO3f1Wf2GVhMA/s400/1.JPG" style="background-color: transparent; border: 1px solid transparent; display: block; height: 273px; margin: 0px auto 10px; padding: 8px; position: relative; text-align: center; width: 400px;" /></a> 
After selecting the third option, replace the URL bar with below script 
javascript:__doPostBack('ctlURL$cmdUpload','') 
 
After running this JAVA script, you will see the option for Upload Selected File. Now select you image file which you have renamed as SHM.jpg & upload here. Go to main page and refresh...BINGGOOOOOOOOOOOO you have hacked the website. 
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiXdSc71TaPWUymCeu8Rvx67VaKbViBjbaTgM0ZcWbHk7bX3MoiiLOdjFI_ek2x_X1xgAADyoS-CtU4hqMUED8Dv3QQiIvBvwz81iKB8PWFgFgQQNPpkeFAM7y2CF6066zR_tPU_D5rrWU/s1600/2.JPG" style="color: #3778cd; text-decoration: none;"><img alt="" border="0" id="BLOGGER_PHOTO_ID_5498613494553959698" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiXdSc71TaPWUymCeu8Rvx67VaKbViBjbaTgM0ZcWbHk7bX3MoiiLOdjFI_ek2x_X1xgAADyoS-CtU4hqMUED8Dv3QQiIvBvwz81iKB8PWFgFgQQNPpkeFAM7y2CF6066zR_tPU_D5rrWU/s400/2.JPG" style="background-color: transparent; border: 1px solid transparent; cursor: pointer; display: block; height: 286px; margin: 0px auto 10px; padding: 8px; position: relative; text-align: center; width: 400px;" /></a> 
 
</div>
</div>

Using google DORK try to find the vulnerable website. inurl:"/portals/0" You can also modify this google dork according t...

Hack Website Using DNN [Dot Net Nuke] Exploit

Popular

Comments

Archive