Hi everyone,In this article, I will not dwell on what Kubernetes is and what it is not. I assume you know these. Today, I would like to share with you the steps that I actively follow in Kubernetes Pentest processes. […]
Tag: security
What is Pineapple Device?
Hi everyone, today I will talk about the Pineapple device and its installation as much as I can. I’m thinking of writing about this topic in parts. Today, I will be talking about what this device does and how to […]
October CMS v3.4.4 – Stored Cross-Site Scripting (XSS) (Authenticated)
#Exploit Title: October CMS v3.4.4 – Stored Cross-Site Scripting (XSS) (Authenticated) #Date: 29 June 2023 #Exploit Author: Okan Kurtulus #Vendor Homepage: https://octobercms.com #Version: v3.4.4 #Tested on: Ubuntu 22.04 #CVE: 2023-37692 #Proof of Concept: 1-) Install the system through the website […]
Piwigo v13.7.0 – Stored Cross-Site Scripting (XSS) (Authenticated)
#Exploit Title: Piwigo v13.7.0 – Stored Cross-Site Scripting (XSS) (Authenticated) #Date: 4 July 2023 #Exploit Author: Okan Kurtulus #Vendor Homepage: https://piwigo.org #Version: 13.7.0 #Tested on: Ubuntu 22.04 #CVE: N/A #Proof of Concept: 1-) Install the system through the website and […]
CMS Made Simple v2.2.17 – Stored Cross-Site Scripting (XSS) (Authenticated)
#Exploit Title: CMS Made Simple v2.2.17 – Stored Cross-Site Scripting (XSS) (Authenticated) #Date: 25 June 2023 #Exploit Author: Okan Kurtulus #Vendor Homepage: https://www.cmsmadesimple.org #Version: 2.2.17 #Tested on: Ubuntu 18.04 #CVE: 2023-36970 #Proof of Concept: 1-) Install the system through the […]
CMS Made Simple v2.2.17 – File Upload Remote Code Execution (RCE) (Authenticated)
#Exploit Title: CMS Made Simple v2.2.17 – File Upload Remote Code Execution (Authenticated) #Date: 25 June 2023 #Exploit Author: Okan Kurtulus #Vendor Homepage: https://www.cmsmadesimple.org/ #Version: 2.2.17 #Tested on: Ubuntu 18.0.4 #CVE: 2023-36969 #Proof of Concept: 1-) Install the system through […]
Food Ordering System v1.0 – Authenticated SQL Injection
#Exploit Title: Food Ordering System v1.0 – Authenticated SQL Injection #Date: 19 June 2023 #Exploit Author: Okan Kurtulus #Vendor Homepage: https://github.com/haxxorsid/food-ordering-system #Version: 1.0 #Tested on: Windows 11 #CVE: 2023-36968 #Affected Parameter: id #Proof of Concept: 1-) Install Food Ordering System […]
ReQlogic v11.3 – Unauthenticated Reflected Cross-Site Scripting (XSS)
#Exploit Title: ReQlogic v11.3 – Unauthenticated Reflected Cross-Site Scripting (XSS)#Date: 9 October 2022#Exploit Author: Okan Kurtulus#Vendor Homepage: https://reqlogic.com#Version: 11.3#Tested on: Linux#CVE : 2022-41441 # Proof of Concept:1– Install ReQlogic v11.32– Go to https://localhost:81/ProcessWait.aspx?POBatch=test&WaitDuration=33– XSS is triggered when you send the […]
PHP Type Juggling Zafiyeti
Merhaba arkadaşlar, bugün sizlere elimden geldiğince PHP Type Juggling özelliğinden ve bu özelliğin saldırganlar tarafından nasıl kötüye kullanılabileceğini anlatacağım. PHP, hepimizin bildiği gibi esnek bir programlama dilidir. Bu esneklik, bir değişkene herhangi bir tür tanımlama yapmamamıza olanak tanır. Yani C, […]
OSWE Sınav Yolculuğu
Selamlar, bugün sizlere Offensive Security Web Expert (OSWE) sınavı hakkında birkaç şey yazmak istiyorum. 12 Mayıs Perşembe günü OSWE sınavına girdim ve süreci başarı ile tamamladım. Sektördeki arkadaşlardan ve yazılım ile uğraşan arkadaşlardan süreç ile ilgili sıkça soru aldığımdan böyle […]