& ext:xml & -github -sourceforgeinurl:filters.xml & ext:xml & -github -sourceforgeinurl:layout.xml & ext:xml & -github -sourceforgeinurl:queue.xml & ext:xml & -github -sourceforgeinurl:"\FileZilla\" & inurl:(sitemanager.xml | recentservers.xml | filezilla.xml | filters.xml | bookmarks.xml | layout.xml | queue.xml) ext:xml -github -sourceforge--dork 'YOU_DORK'- Setting: --dork '"\FileZilla\" ext:xml'SET FILE OUTPUT:- Setting: -s filezilla.txtSET TIPE VALIDATION: - Setting: -t 2 2 The second type tries to valid the error defined by: -a 'VALUE_INSIDE_THE _TARGET' It also establishes connection with the exploit through the get method.SET STRING VALIDATION:Specify the string that will be used on the search script: Example: -a {string} Usage: -a '<title>hello world</title>' If specific value is found in the target he is considered vulnerable.- Setting: -a '<FileZilla3>'All filezilla file there is a primary tag called <FileZilla3>. It is trough this that we will validate.Ex:Full command - using search engines:php inurlbr.php --dork '"\FileZilla\" ext:xml' -s filezilla.txt -t 2 -a '<FileZilla3>'OR SCANNER DORKING-FILE:php inurlbr.php --dork-file dorks.txt -s filezilla.txt -t 2 -a '<FileZilla3>'OUTPUT PRINT:Using FileZilla the safe wayFileZilla is a great FTP client and I use it myself. But since it doesnt protect your FTP credentials, you should protect them yourselves. Here is what you can do:1. Dont use the Normal logon type. There are the Ask for password and the Interactive types that wont save your passwords on disk. So malware simply wont be able to get enough information from FileZilla configuration files to hack your sites.ProsMalware cannot steal your FTP credential from configuration files.ConsYoull have to enter your password every time you connect to your site.It wont save you from more sophisticated spyware such as keyloggers and traffic sniffers. But I hope this sort of trojans can be better detected by you antivirus tools since they need to hook known system functions. To protect yourself from traffic sniffers, always use SFTP instead of FTP (if possible).2. Hosts trick. If you manage multiple web sites, interactive logon types may be really inconvenient. There is a trick that can let you use the Normal logon type in a more secure manner. You should create aliases of your sites addresses in the hosts file (on Windows, you can find it in C:\WINDOWS\system32\drivers\etc\).For example you have a site example.com with an IP-address "208.xxx.188.166".To create an alias you need to add the following line into the hosts file:208.xxx.188.166 my_example"my_example" will work the same way as example.com when you use it on your computer.However, on other computers it wont make any sense. Now use this alias in FTP connection settings instead of example.com. If hackers manage to steal your FTP credentials, all theyll have will be: (host: my_example, user: unmask, password: parasites) the username/password pair is valid, but the host name doesnt make any sense to them. Its like having a key and not knowing where the door is.ProsOnce you have added new aliases to the hosts file and to FileZilla Site Manager, you can enjoy the ease of one-click connections.ConsThis trick will only work as long as malware steals FTP credentials from configuration files verbatim (and I have proofs that at least some malware steal the data verbatim). If they only add a