Hacking Articles Tips Tricks Videos Tutorials

WordPress Contact Form 1.7.14 Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 18:33

Exploit Collector
FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 Cross Site Request Forgery

https://4.bp.blogspot.com/-khon6dqGLkI/WWlvkVAr7qI/AAAAAAAAIQw/JwPgE9u6PkcV9AqklLFI3rOjfEX9YXC4QCLcBGAs/s1600/h96.png
The application interface FatPipe Networks WARP/IPVPN/MPVPN version 10.2.2 allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.

MD5 | ebc740be2b0dc7aea958ed27ca4a91bf

Download

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 Cross Site Request Forgery

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 18:33

4 views18:33

Exploit Collector
WordPress Popup 1.10.4 Cross Site Scripting

https://3.bp.blogspot.com/-Ct9xsH2cBRo/WWlviFueiJI/AAAAAAAAIQc/IuoXrqbibrUTnkZ-3FJLKgVXuEB0NPH5wCLcBGAs/s1600/h92.png
WordPress Popup plugin version 1.10.4 suffers from a cross site scripting vulnerability.

MD5 | 34a0b77cf58a9d881b2693bb8571e695

Download

# Exploit Title: WordPress Plugin Popup 1.10.4 - Reflected Cross-Site Scripting (XSS)
# Date: 3/28/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/popup-by-supsystic/
# Version: 1.10.4
# Tested on: Windows 10
# CVE: CVE-2021-24275

1. Description:
The plugin did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue

2. Proof of Concept:
/wp-admin/admin.php?page=popup-wp-supsystic&tab="+style=animation-name:rotation+onanimationstart=alert(/XSS/)//

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

WordPress Popup 1.10.4 Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 18:33

5 views18:33

5 views18:33

Exploit Collector
FatPipe Networks WARP 10.2.2 Authorization Bypass

https://2.bp.blogspot.com/-LETyKySuDgQ/WWlvb4o-z5I/AAAAAAAAIPU/5gCHtKhwhLoet_fHEL-XnPuLlDk7q9atQCLcBGAs/s1600/h76.png
FatPipe Networks WARP version 10.2.2 suffers from an authorization bypass vulnerability.

MD5 | 6ccac54a795446dd5b9905280e95e65d

Download


FatPipe Networks WARP 10.2.2 Authorization Bypass
Vendor: FatPipe Networks Inc.
Product web page: https://www.fatpipeinc.com
Affected version: WARP
10.2.2r38
10.2.2r25
10.2.2r10
10.1.2r60p82
10.1.2r60p71
10.1.2r60p65
10.1.2r60p58s1
10.1.2r60p58
10.1.2r60p55
10.1.2r60p45
10.1.2r60p35
10.1.2r60p32
10.1.2r60p13
10.1.2r60p10
9.1.2r185
9.1.2r180p2
9.1.2r165
9.1.2r164p5
9.1.2r164p4
9.1.2r164
9.1.2r161p26
9.1.2r161p20
9.1.2r161p17
9.1.2r161p16
9.1.2r161p12
9.1.2r161p3
9.1.2r161p2
9.1.2r156
9.1.2r150
9.1.2r144
9.1.2r129
7.1.2r39
6.1.2r70p75-m
6.1.2r70p45-m
6.1.2r70p26
5.2.0r34

Summary: FatPipe Networks invented the concept of router-clustering,
which provides the highest level of reliability, redundancy, and speed
of Internet traffic for Business Continuity and communications. FatPipe
WARP achieves fault tolerance for companies by creating an easy method
of combining two or more Internet connections of any kind over multiple
ISPs. FatPipe utilizes all paths when the lines are up and running,
dynamically balancing traffic over the multiple lines, and intelligently
failing over inbound and outbound IP traffic when ISP services and/or
components fail.

Desc: Improper access control occurs when the application provides direct
access to objects based on user-supplied input. As a result of this vulnerability
attackers can bypass authorization and access resources behind protected
pages.

Tested on: Apache-Coyote/1.1
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5682
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5682.php
30.05.2016
25.07.2021

--
$ curl -vk "https://10.0.0.9/fpui/jsp/index.jsp"

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

FatPipe Networks WARP 10.2.2 Authorization Bypass

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 18:33

4 views18:33

Exploit Collector
FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 Configuration Disclosure

___________________________
@hacking_Attack
@Hacking_Video

FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 Configuration Disclosure

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 18:33

4 views18:33

4 views18:33

4 views18:34

Exploit Collector
WordPress Ultimate Maps 1.2.4 Cross Site Scripting

https://2.bp.blogspot.com/-8IZk1MGzGDs/WWlvRc2I8KI/AAAAAAAAINM/SaF41lFV3n4aBJrQBjJ2SaVGr7WaiJo3gCLcBGAs/s1600/h34.png
WordPress Ultimate Maps plugin version 1.2.4 suffers from a cross site scripting vulnerability.

MD5 | a15131838592d920ab537cfb27e37ab4

Download

# Exploit Title: WordPress Plugin Ultimate Maps 1.2.4 - Reflected Cross-Site Scripting (XSS)
# Date: 3/28/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/ultimate-maps-by-supsystic/
# Version: 1.2.4
# Tested on: Windows 10
# CVE: CVE-2021-24274

1. Description:
The plugin did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue

2. Proof of Concept:
/wp-admin/admin.php?page=ultimate-maps-supsystic&tab="+style=animation-name:rotation+onanimationstart=alert(/XSS/)//

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

WordPress Ultimate Maps 1.2.4 Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 18:34

Exploit Collector
Apache James Server 2.3.2 Remote Command Execution

___________________________
@hacking_Attack
@Hacking_Video

Apache James Server 2.3.2 Remote Command Execution

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 18:34

Exploit Collector
FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 Privilege Escalation

___________________________
@hacking_Attack
@Hacking_Video

FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 Privilege Escalation

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 18:34

Exploit Collector
FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 Backdoor Account

___________________________
@hacking_Attack
@Hacking_Video

FatPipe Networks WARP/IPVPN/MPVPN 10.2.2 Backdoor Account

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 18:34

5 views18:49

Spectra HacktheBox Walkthrough - Hacking Articles

Hacking Articles
Spectra HacktheBox Walkthrough

Today we are going to accept the boot2root challenge of Spectra –Hack the box lab. Through this lab, we are going to check our skills in WordPress Exploitation and basic privilege escalation. Table Of Content Reconnaissance Nmap Enumeration WordPress enumeration Exploitation WordPress Metasploit Privilege Escalation Abusing Sudo rights Reconnaissance Let’s

The post Spectra HacktheBox Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles

Today we are going to accept the boot2root challenge of Spectra –Hack the box lab. Through this lab, we are going to check our skills

7 viewsedited 18:49

The boring side of testing people should be talking about more!

The boring side of testing people should be talking about more!
https://thexssrat.medium.com/the-boring-side-of-testing-people-should-be-talking-about-more-98907b26e78a?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

Hacking ethically means we usually have to adhere to much more paperwork than our black hat counterparts. Not only is this to protect them from you but also to protect you from them in case anything…

7 viewsedited 19:23