🔍Top 10 Shodan Dorks

🔖#infosec #cybersecurity #hacking #pentesting #security

⚡ 6000+ Private Nuclei Templates ⚡

CVE-2024-8073: Command Injection in Hillstone Networks Firewalls, 9.8 rating 🔥

The freshest vulnerability in Hillstone WAFs allows an attacker to perform RCE due to incorrect input validation.

Search at Netlas.io:
👉 Link: https://nt.ls/YZWqU
👉 Dork: http.noscript:"Hillstone Networks"

Vendor's advisory: https://www.hillstonenet.com.cn/security-notification/2024/08/21/mlzrld-2/

CVE-2024-6386: RCE in WPML WordPress Plugin, 9.9 rating 🔥

Due to the lack of input validation, an attacker can execute code on the affected server.

Search at Netlas.io:
👉 Link: https://nt.ls/caxUk
👉 Dork: http.body:"plugins/wpml"

Read more: https://sec.stealthcopter.com/wpml-rce-via-twig-ssti/

Useful Google Dorks that bug bounty hunters can leverage to find sensitive information: 👇🏻

1. Discovering Exposed Files:
   - innoscript:"index of" "site:target.com"
   - filetype:log inurl:log site:target.com
   - filetype:sql inurl:sql site:target.com
   - filetype:env inurl:.env site:target.com

2. Finding Sensitive Directories:
   - inurl:/phpinfo.php site:target.com
   - inurl:/admin site:target.com
   - inurl:/backup site:target.com
   - inurl:wp- site:target.com

3. Exposed Configuration Files:
   - filetype:config inurl:config site:target.com
   - filetype:ini inurl:wp-config.php site:target.com
   - filetype:json inurl:credentials site:target.com

4. Discovering Usernames and Passwords:
   - intext:"password" filetype:log site:target.com
   - intext:"username" filetype:log site:target.com
   - filetype:sql "password" site:target.com

5. Finding Database Files:
   - filetype:sql inurl:db site:target.com
   - filetype:sql inurl:dump site:target.com
   - filetype:bak inurl:db site:target.com

6. Exposed Git Repositories:
   - inurl:".git" site:target.com
   - inurl:"/.git/config" site:target.com
   - innoscript:"index of" ".git" site:target.com

7. Finding Publicly Exposed Emails:
   - intext:"email" site:target.com
   - inurl:"contact" intext:"@target.com" -www.target.com
   - filetype:xls inurl:"email" site:target.com

8. Discovering Vulnerable Web Servers:
   - innoscript:"Apache2 Ubuntu Default Page: It works" site:target.com
   - innoscript:"Index of /" "Apache Server" site:target.com
   - innoscript:"Welcome to nginx" site:target.com

9. Finding API Keys:
   - filetype:env "DB_PASSWORD" site:target.com
   - intext:"api_key" filetype:env site:target.com
   - intext:"AWS_ACCESS_KEY_ID" filetype:env site:target.com

10. Exposed Backup Files:
    - filetype:bak inurl:backup site:target.com
    - filetype:bak inurl:backup site:target.com
    - filetype:zip inurl:backup site:target.com
    - filetype:tgz inurl:backup site:target.com

Replace target.com with the domain or target you are focusing on.

#GoogleDorks
#BugHunting
#OSINT

CVE-2024-43425: RCE in Moodle, PoC is available 🔥🔥🔥

Due to incomplete sanitization in the “calculated questions” feature, attackers can transmit and execute arbitrary code, which can be used to disclose students’ confidential information or disrupt the entire learning process.

Search at Netlas.io:
👉 Link: https://nt.ls/6WaFx
👉 Dork: http.headers.set_cookie:"MoodleSession"

Read more: https://blog.redteam-pentesting.de/2024/moodle-rce/

Deobfuscation and analysis
of client-side JavaScript code
to detect DOM-based XSS.