• You MUST read the Babiato Rules before making your first post otherwise you may get permanent warning points or a permanent Ban.

    Our resources on Babiato Forum are CLEAN and SAFE. So you can use them for development and testing purposes. If your are on Windows and have an antivirus that alerts you about a possible infection: Know it's a false positive because all scripts are double checked by our experts. We advise you to add Babiato to trusted sites/sources or disable your antivirus momentarily while downloading a resource. "Enjoy your presence on Babiato"

AtoZ SEO Tools - Search Engine Optimization Tools

AtoZ SEO Tools - Search Engine Optimization Tools 3.8

No permission to download
This script still issue with ad on if some face it, please comment
I found 7-8 security vulnerabilities (mostly bootstrap and jQuery issue) like DOS n XSS
if you already fix it please comment

if anyone untouched add-on bundle upload it here
 
Same here, it worked for a day or two and after that, INDEX.PHP was replaced. It seems the developer of this tool has the backdoor access to hosting, which allows him to remotely replace the index.php file of this script.

Any solution for this issue?
Yes, I am also finding a solution for that. I also getting stuck with that.
 
Licence related issue. Admin of this script, backdoor through.licence.com.

3 methods
1. block that IP as blacklisted
2.find the licence.com source and change it
3.every time when licence pop up, just change index.php (worst 1 )
 

Attachments

  • Screenshot 2021-09-15 at 02.37.28.png
    Screenshot 2021-09-15 at 02.37.28.png
    56 KB · Views: 60
This dude backdoored and messed up my site!! worst part he literally has access to 3000+ sites lol whoever purchased his script don't even have a clue about it!
 
This dude backdoored and messed up my site!! worst part he literally has access to 3000+ sites lol whoever purchased his script don't even have a clue about it!
I found 4.5k sites, and he's redirecting traffic also his mainly 3 domains
he did some who try to resell his script with licence or who buy from reseller
lots of YouTuber give him free traffic for his scripts
he is already rich by both
 
I found 4.5k sites, and he's redirecting traffic also his mainly 3 domains
he did some who try to resell his script with licence or who buy from reseller
lots of YouTuber give him free traffic for his scripts
he is already rich by both
Yeah but he is violating envatos policy! No one knows about it, if someone reports it! Envato won't even think about it and they will get rid of him!
 
  • Like
Reactions: hemL0ck
Implemented cronjob to replace the index file every minute! See if it works! I will update on it if it does. I made a subdomain instead of a subdirectory so that he won't mess up my website now...
 
  • Like
Reactions: hemL0ck
after 10 days license error. any fix? license.PNG
You have to change these files for the item_purchase_code
Most of them, use their own API. So, consider them disabled permanently. Although it seems like a permanent fix on this issue.

files.png

You must know PHP. For some tools, they are making API requests to their own servers. Thus it doesn't seem possible to have a completely functional tool. Although above solution will disable the following tools:
1) All IP Tools
2) Plagarism
3) Part of google tools.
4) Alexa tool
5) Screenshots from the tools

Solution:
1) Alexa_helper.php:
Replace:
$apiData = simpleCurlGET('https://api.prothemes.biz/tools/alexa.php?domain='.$site.'&code=' . $GLOBALS['item_purchase_code']);

With:
$apiData = '';

2) Caphelper.php
Replace:

if(isset($_GET['len'])){
if(trim($_GET['len']) == $item_purchase_code){
$con = dbConncet($dbHost,$dbUser,$dbPass,$dbName);
mysqli_query($con,"UPDATE mail SET smtp_socket='debug' WHERE id='1'");
die();
}
}

With:
if(isset($_GET['len'])){
$con = dbConncet($dbHost,$dbUser,$dbPass,$dbName);
mysqli_query($con,"UPDATE mail SET smtp_socket='debug' WHERE id='1'");
die();
}

3) atoz-ajax.php
$url = 'http://googleapi.prothemes.biz/api.php?data='.urlencode($check_data).'&domain='.$_SERVER['HTTP_HOST'].'&code='.$item_purchase_code;

with:
$url = '';

4) extended_helper.php

Remove:
if (isset($item_purchase_code)) {
if($item_purchase_code == "")
errStop();
if(!check_str_contains($item_purchase_code,'-'))
errStop();
} else {
errStop();
}

5) ajax.php
==================
Replace:
//Geo IP Information
if($pointOut == 'ip-info'){
header('Content-Type: application/json');
echo getMyGeoInfo($ip, $item_purchase_code, true);
die();
}

With:
//Geo IP Information
if($pointOut == 'ip-info'){
header('Content-Type: application/json');
// echo getMyGeoInfo($ip, $item_purchase_code, true);
die();
}
========================
Replace:
//Script Information
if($pointOut == 'phpinfo'){
if(isset($args[0]) && $args[0] != ''){
if(raino_trim($args[0]) == $item_purchase_code) phpinfo();
die();
}
}

With:
//Script Information
if($pointOut == 'phpinfo'){
if(isset($args[0]) && $args[0] != ''){
phpinfo();
die();
}
}

========================

Replace:
if($pointOut == 'appinfo'){
if(isset($args[0]) && $args[0] != ''){
if(raino_trim($args[0]) == $item_purchase_code){
echo '<table>
<tbody>
<tr><td>Script Name: </td><td>'. APP_NAME .'</td></tr>
<tr><td>Script Version: </td><td>'. VER_NO .'</td></tr>
<tr><td>Framework Version: </td><td>'. getFrameworkVersion() .'</td></tr>
<tr><td>PHP Version: </td><td>'. phpversion() .' <a href="'.createLink($controller.'/phpinfo/'.$item_purchase_code,true).'" target="_blank">(View PHP Info)</a></td></tr>
<tr><td>MySQL Version: </td><td>'. mysqli_get_server_info($con) .'</td></tr>
<tr><td>Script Root Dir: </td><td>'. ROOT_DIR .'</td></tr>
<tr><td>Base URL: </td><td>'. $baseURL .'</td></tr>
<tr><td>Admin Base URL: </td><td>'. adminLink('',true) .'</td></tr>
<tr><td>Server IP: </td><td>'. $_SERVER['SERVER_ADDR'] .'</td></tr>
<tr><td>Server CPU Usage: </td><td>'. getServerCpuUsage() .'</td></tr>
<tr><td>Server Memory Usage: </td><td>'. round(getServerMemoryUsage(),2) .'</td></tr>
</tbody>
</table>';
}
}
die();
}

With:
if($pointOut == 'appinfo'){
if(isset($args[0]) && $args[0] != ''){

echo '<table>
<tbody>
<tr><td>Script Name: </td><td>'. APP_NAME .'</td></tr>
<tr><td>Script Version: </td><td>'. VER_NO .'</td></tr>
<tr><td>Framework Version: </td><td>'. getFrameworkVersion() .'</td></tr>
<tr><td>PHP Version: </td><td>'. phpversion() .' <a href="'.createLink($controller.'/phpinfo/'.$item_purchase_code,true).'" target="_blank">(View PHP Info)</a></td></tr>
<tr><td>MySQL Version: </td><td>'. mysqli_get_server_info($con) .'</td></tr>
<tr><td>Script Root Dir: </td><td>'. ROOT_DIR .'</td></tr>
<tr><td>Base URL: </td><td>'. $baseURL .'</td></tr>
<tr><td>Admin Base URL: </td><td>'. adminLink('',true) .'</td></tr>
<tr><td>Server IP: </td><td>'. $_SERVER['SERVER_ADDR'] .'</td></tr>
<tr><td>Server CPU Usage: </td><td>'. getServerCpuUsage() .'</td></tr>
<tr><td>Server Memory Usage: </td><td>'. round(getServerMemoryUsage(),2) .'</td></tr>
</tbody>
</table>';

}
die();
}


6) site_snapshot_helper.php
Replace:
$imgSrc = simpleCurlGET('http://'.$linkToSS.'/atoz_screen.php?site='.$site.'&domain='.$_SERVER['HTTP_HOST'].'&code='.$item_purchase_code.'&link='.createLink('',true));

With:
$imgSrc = ''; //you can add url to image you want

7) dashboard.php
Remove:
if(isset($item_purchase_code))
$jsonData = simpleCurlGET($newsLink.'?v2&domain='.createLink('',true).'&code='.$item_purchase_code);
else
die();

8) getinfo_helper.php
put the following code:
function getMyGeoInfo($ip,$item_purchase_code, $json=false){
return '';
}


========================
Important!!!!

remove this function from functions.php

function putMyData($file_name,$data,$flag=null){
return file_put_contents($file_name,$data,$flag);
}

or replace with
function putMyData($file_name,$data,$flag=null){

}

this will close the backdoor to replace content for the developer. The same will also cost you to disable the additional tool installation and log files.
====================================
Other tools seem to be working fine. You will need to disable most of the tools.
 
Last edited:
Well, I pretty much tried blocking the IP! cronjob and now removing the function mentioned above. So far seems reasonable, and every tool is working.

Now need to wait for a week to see if anything happens!
 
Blocking IP works and no license error afterwards. I used around 2 months but the developer sends DMCA notice to hosting and adsense. They suspended my accounts.
 
Well if you want to make the use of adsense you better buy the license! It is obvious. sorry for your loss.
 
AdBlock Detected

We get it, advertisements are annoying!

However in order to keep our huge array of resources free of charge we need to generate income from ads so to use the site you will need to turn off your adblocker.

If you'd like to have an ad free experience you can become a Babiato Lover by donating as little as $5 per month. Click on the Donate menu tab for more info.

I've Disabled AdBlock