Waraxe IT Security Portal

somemonster · Beginner

Dear all,

ive tried this php-fusion blind sql injection from milw0rm (http://milw0rm.com/exploits/5470) at my localhost, but what ive got wasnt the password also it isnt the hash either, so what wrong with it, somebody has a same problem or working exploit ?

temp # ./fusion.py localhost /fusion/ 2 password 1

#=================================================================#
# PHP-Fusion v6.00.307 #
# And Probably All Other Versions #
# Blind Sql Injection Vulnerability #
# Benchmark Method #
# #
# Discovered By The:Paradox #
# #
# Usage: #
# ./fusiown [Target] [Path] [ValidId] [ValidPass] [TargetUserid] #
# #
# Example: #
# ./fusiown localhost /phpfusion/ 40 s3cr3t 1 #
# ./fusiown www.host.org / 791 myp4ssw0rd 1 #
#=================================================================#

[.]Exploit Starting.
[.]Blind Sql Injection Starts.

Hash:
00000052001012000000122000080c00

thx, any help would appreciate Smile

lenny · Valuable expert

Some exploits have anti-script-kiddie devices to stop people script kiddying... generally it is an obvious fault to stop idiot using the script, but allow true hackers to use/learn from it - maybe you just overlooked somthing?

Check through the script thoroughly, even I sometimes have trouble finding them!

Lenny