robertdevore

Possible site takeover through stolen API credentials in combination with SQLi

Source: https://snicco.io/vulnerability-disclosure/malcare/site-takeover-through-stolen-api-credentials-in-combination-with-sqli-malcare-5-09

Running the PoC

bash poc.sh

robertdevore

Remove blank lines from txt file

This script reads in the input file line by line and writes the encoded lines to the output file. It skips any empty lines in the input file.

You can use this script by replacing input.txt with the name of your input file and output.txt with the name of the output file you want to create.

Useful for when you have a password or vuln list that has blank lines you need to clean up before running them through your scanners.

robertdevore

<?php
/**
 * Get array of post ID's with specific meta key and value
 * 
 * @param string $meta_key   - The meta key you are checking for
 * @param string $meta_value - The meta value for the meta key you're checking for
 * @param string $post_type  - The post type to use with get_posts()  - default: post
 * 
 * @return array
 */

robertdevore

<?php
/**
 * Example cipher function
 * 
 * @param string $quote        - the quote used for the cipher base
 * @param string $secret       - the secret message
 * @param bool   $with_symbols - add random symbols to the string
 * @param bool   $lowercase    - should the quote have all lowercase lettering?
 * 
 * @return string

robertdevore

<?php
/**
 * Age Verification - Redirect on fail
 * 
 * @param string $url - The full URL to redirect to (include https://)
 * 
 * @return string
 */
function acme_redirect_on_fail_link( $url ) {
  $url = 'YOUR_NEW_URL_HERE';

robertdevore

<?php
/**
 * Remove "Delivery" from driver dashboard order details page.
 */
add_filter( 'ddwc_driver_dashboard_delivery_total', '__return_false' );

robertdevore

<?php
/**
 * Remove "Total" from driver dashboard assigned orders table head.
 */
function acme_driver_dashboard_assigned_orders_order_table_thead( $thead ) {
	unset( $thead[3] );
	return $thead;
}
add_filter( 'ddwc_driver_dashboard_assigned_orders_order_table_thead', 'acme_driver_dashboard_assigned_orders_order_table_thead', 10, 1 );

robertdevore

<?php
/**
 * Delivery Times for WooCommerce checkout select default text
 *
 * Change the default text that gets displayed in the delivery times checkout select field
 * 
 * @param string $text - the default text
 * 
 * @return string
 */

robertdevore

var waitForEl = function(selector, callback) {
  if (jQuery(selector).length) {
    callback();
  } else {
    setTimeout(function() {
      waitForEl(selector, callback);
    }, 100);
  }
};

robertdevore

<?php
/**
 * Filter the order statuses used in the Unclaimed Orders table
 * 
 * @url https://www.deviodigital.com/product/delivery-drivers-for-woocommerce-pro/
 * @param  $statuses array
 * @return array
 */
function acme_unclaimed_orders_status_array( $statuses ) {
  $statuses = array( 'processing', 'another', 'example' );