Exploit Collector
WordPress Uleak Security Dashboard 1.2.3 Cross Site Scripting

https://3.bp.blogspot.com/-_lYy5AwzHPI/WWlvAVk_lrI/AAAAAAAAIKU/HsTDdKCabVkkHkFsXQw08U72hOmjap5rACLcBGAs/s1600/h121.png
WordPress Uleak Security Dashboard plugin version 1.2.3 suffers from a cross site scripting vulnerability.

MD5 | a6144e85c938898117f92da552acffa1

Download
# Exploit Title: WordPress Plugin uleak-security-dashboard 1.2.3 - Stored Cross-Site Scripting (Authenticated)
# Date: 31-03-2022
# Exploit Author: Hassan Khan Yusufzai - Splint3r7
# Vendor Homepage: https://wordpress.org/plugins/uleak-security-dashboard/ <https:
# Version: 1.2.3
# Tested on: Firefox
# Contact me: h [at] spidersilk.com

# Vulnerable Code:

```
ULeak API Key*:

value="'.$user['apikey'].'">(Insert your ULeak
API Key. Find your Credentials in your profil settings
href="https://uleak.de/profil">here)
```

# POC

1) Install uleak-security-dashboard WordPress Plugin
2) Naviagete to http://localhost/wp-admin/tools.php?page=uleak
3) Inject payload ```">```
in *ULeak API Key*: *filed.
4) XSS will trigger.

# POC Image

https://prnt.sc/D7sq6IlNtNaf

Source:packetstormsecurity.com

Black Hat Ethical Hacking
Offensive Security Tool: Boomerang

Offensive Security Tool: BoomerangPost Views: 7 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png Reading Time: 2 Minutes

Offensive Security Tool: Boomerang GitHub Link BoomerangWho said cloud servers are secure? A cloud server is only as secure as the company using it. It’s all about how they are set up, like regular servers. When performing assessments such as Bug Bounty or Penetration testing and you have in your scope cloud servers, there are various techniques to perform strong recon and attacks. Exposing the internal servers using tunneling, proxychains which uses the Tor Network, and once done you can perform Pivoting, which is a technique that from one machine you get to expand and take over all the machines on that network.
Boomerang by paranoidninja is a tool to expose multiple internal servers to web/cloud using HTTP+TCP Tunneling. The Server will expose 2 ports on the Cloud. One will be where tools like proxychains can connect over socks, another will be for the agent to connect. The agent can be executed on any internal host. The agent will connect to the server and listen for any connection that can be forwarded to internal machine like a socks server. A more detailed information can be found in the image below. Features like authentication are in pipeline and will be added soon. Agent and Server are pretty stable and can be used in Red Team for Multiple levels of Pivoting and exposing services to external/other networks.
See Also: Recon Tool: PSRecon
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Boomerang_v0.1-1024x415.png
Boomerang Agent and Server support Windows, Linux and Arm architecture
Features in Progress: Proxy Authentication (Use IP Whitelisting for C2s till then)
See Also: Lizard Squad – the infamous hacking group that brought Xbox and PlayStation networks to their knees. https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/unknown-90x90.png Recon Tool: PSRecon18 hours ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/SysWhispers3-90x90.png Offensive Security Tool: SysWhispers31 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/SwaggerHole-90x90.png Recon Tool: SwaggerHole1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/uncover-90x90.png Recon Tool: Uncover2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Fibratus_-90x90.png Offensive Security Tool: Fibratus3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/animation-scapy-themes-demo-90x90.gif Offensive Security Tool: Scapy4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Red-Teaming-Tactics-and-Techniques-90x90.png Offensive Security Tools Collection: Red Teaming Tactics and Techniques1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/metagoofil-90x90.png Recon Tool: Metagoofil1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/swaks-1-90x90.png Offensive Security Tool: Swaks – Swiss Army Knife for SMTP1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Odin-90x90.png OSINT & Recon Tool: Odin1 month ago
The post Offensive Security Tool: Boomerang first appeared on Black Hat Ethical Hacking.

Dark Reading: Attacks/Breaches
More Than Ever, Security Matters

Public policy proposals must consider technical, practical, and real-world security effects, and make sure we avoid unintended consequences.

Hacking on Medium
DC-4 — VulnHub

https://cdn-images-1.medium.com/max/700/0*2Vgjh3U_25aLxA5j.jpg
Introduction:

Continue reading on System Weakness »

Hacking on Medium
Hacker: você saber definir o que é?

https://cdn-images-1.medium.com/max/960/0*EewX-6xqp9u01bk_.jpg
Muito se fala em hacker, esta é uma daquelas palavras que ficam borbulhando na nossa mente, temos uma noção, mas na hora de explicar para…

Continue reading on Medium »

Hacking on Medium
BUIDLING OUR WEB3 FUTURE

https://cdn-images-1.medium.com/max/1000/1*QLDwFSc4Ge5nVL3_FdFIoQ.jpeg
An engineer turned VC’s perspective on the state of development in the Ethereum ecosystem

Continue reading on Medium »

Hacking on Medium
Jerry — HackTheBox

https://cdn-images-1.medium.com/max/600/1*SVHPCqulD0LgFM0xwa-CIA.png
Introduction:

Continue reading on System Weakness »

Hacking on Medium
How I cleared CEH Practical in my first attempt. How you can too!

https://cdn-images-1.medium.com/max/600/1*AACYGebMqJXYj3jyHaDP7g.png
All about CEH Practical

Continue reading on Medium »

Hacking on Medium
Lockbit, lo que necesitas saber del ransomware que imprime sus extorsiones

https://cdn-images-1.medium.com/max/1764/0*m4tpHL10oVEBhQTo
PUBLICADO EN 1 ABRIL, 2022POR EHACKING

Continue reading on Medium »

Hacking on Medium
The Safety Net Underneath Blockchain Bridges: DeFi Insurance

https://cdn-images-1.medium.com/max/2600/1*ucXPj22F_AuUtwY-zq5AhA.png
Blockchain bridges are widely used by thousands of crypto users every day. They are metaphorical bridges that allow the transfer of tokens…

Continue reading on Uno Re »

Hacking on Medium
Do we need Hackers?

https://cdn-images-1.medium.com/max/600/1*R6_rNmudT48Me9miajU5LA.jpeg
What is the use of Hackers, Do we need them?

Continue reading on Medium »

hacking: security in practice
Using Web Cookies to Manipulate Twitter

Hi gang,

I don't hack so take it easy one me, I'm more of a data guy, so I came to ask you guys instead of trying to research it. It seems like it would be a fun question anyway. Is it possible to create a cookie that would manipulate Twitter feeds, searches, maybe even suppress the "range" of the Tweet, meaning how many users see it or keep it confined to your followers or something?

submitted by /u/Avery_Shine
[link] [comments]

Community-Owned Bug Bounties
https://hatsfinance.medium.com/community-owned-bug-bounties-e2ae85c757ac?source=rss------bug_bounty-5

Hacks have become the new norm in crypto; from Twitter jokes about getting rugged, to sad posts about people losing their most prized…Continue reading on Medium » (https://hatsfinance.medium.com/community-owned-bug-bounties-e2ae85c757ac?source=rss------bug_bounty-5)

LayerZero Security Update — April 2022

If this past week has shown us anything, it’s that there is nothing more critical in this space than an absolute commitment to…Continue reading on LayerZero Official »
Read more...

Auto-Elevate - Escalate From A Low-Integrity Administrator Account To NT AUTHORITY\SYSTEM Without An LPE Exploit By Combining A COM UAC Bypass And Token Impersonation
http://www.kitploit.com/2022/04/auto-elevate-escalate-from-low.html

This tool demonstrates the power of UAC bypasses and built-in features of Windows. This utility auto-locates winlogon.exe, steals and impersonates it's process TOKEN, and spawns a new SYSTEM-level process with the stolen token. Combined with UAC bypass method #41 (ICMLuaUtil UAC bypass) from hfiref0x's UACME (https://www.kitploit.com/search/label/UACME) utility, this utility can auto-elevate a low privileged Administrative account to NT AUTHORITY\SYSTEM.
The following image demonstrates using UACME combined with Auto-Elevate to go from a low-privileged Administrator account to NT AUTHORITY\SYSTEM on Windows 10 (https://www.kitploit.com/search/label/Windows%2010) 21H1.