Chirag Artani
Chirag Artani
  • 80
  • 2 109 764
7,025 Vulnerable Instance Used By Multinational Companies | CVE-2024-4879 - Jelly Template Injection
CVE-2024-4879 - Jelly Template Injection Vulnerability in ServiceNow
ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform.
Template - github.com/Brut-Security/CVE-2024-4879
I am not responsible for any kind of your bad /threat activity, this is just for education purposes.
Thank You!
zhlédnutí: 140

Video

Magento XXE (CVE-2024-34102) - RCE in Adobe Magento | Live Recon POC
zhlédnutí 226Před 21 dnem
Big companies are using this CMS, I found Microsoft and reported them as well. Magento is one of the most popular e-commerce solutions in use on the internet. It's estimated that there are over 140,000 instances of Magento running as of late 2023. Adobe's most recent advisory for Adobe Commerce / Magento, published on June 11th, 2024 highlighted a critical, pre-authentication XML entity injecti...
PHP CGI RCE | CVE-2024-4577 - XAMPP 0day | POC Live Recon
zhlédnutí 3,2KPřed měsícem
Hello, today let's exploit CVE-2024-4577 which is PHP-CGI Argument Injection. I always upload trending CVE's first ever before anybody else. Note: I am not responsible for your bad activity. Please use it in legitimate way. Description - CVE-2024-4577 is a critical vulnerability in PHP affecting CGI configurations, allowing attackers to execute arbitrary commands via crafted URL parameters. Cre...
Check Point R81, R80, R77, R75 - Arbitrary File Read | Live Recon Using Netlas - CVE-2024-24919 POC
zhlédnutí 1,5KPřed měsícem
I am using Netlas, this is the query for search - nt.ls/MqxNV (visiting and you will see). In the netlas you get 2500 queries monthly for free and you can find lot of potential issues using Netlas. Can you use it for bug bounty or research purposes. CVE-2024-24919 is an information disclosure vulnerability that can allow an attacker to access certain information on internet-connected Gateways w...
CVE-2024-3400 PAN-OS Working POC - Proof Of Concept Palo Alto VPN | Latest Exploit CMD Injection
zhlédnutí 3,2KPřed 3 měsíci
A command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the firewall. CVE-2024-3400 Proof Of Concept - I am writing a file as root so I can't execute or see in the frontend but it will show me 403 b...
Hacking A Scamming Network With The Help Of FBI | Defacing Scam Portal FBI Helped Me
zhlédnutí 91Před 3 měsíci
Hi, I hacked this scamming network which scams people in the name of stock market, they shutdown this server and created a new one but again I Defaced their new server as well. I showed that FBI is helping me in this , so they should scare running such scams and loot innocent people. Thank You For Watching
Stock Market Scam | SS-Equitrade, Viking Trading, Kotakses scam alert - 420 crore करोड़ रुपए की ठगी
zhlédnutí 1,1KPřed 3 měsíci
Hello, today I am going to expose a very tricky scam which is stock market scam, please watch the video till the end. ss-equitrade, kotak plc, viking trading, apalxs. These are the scam names & all of them have absolutly similar interface, There's more but these mentioned are the main applications or sites which scams thousands of people. Now it all happens through whatsapp, they add you in a g...
Exposed: The $56 Million Stock Market Scam - Inside the Biggest Rip-Off of the Decade| 420 Crore INR
zhlédnutí 907Před 4 měsíci
Shocking $56 million or 420 crore rupees stock market scam that left innocent investors devastated. Join us as we uncover the truth behind this massive fraud and its impact on those affected. I am Chirag Artani a penetration tester, who hunts scammers and yeah I do white hat hacking. Scamming tactics & story in short - Note- ss-equitrade/SS-Equitrade is still active and scamming people This sca...
POC Sitecore Remote Code Execution CVE-2023-35813 | Live Recon
zhlédnutí 1,2KPřed 9 měsíci
Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3. reference: - support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1002979 - code-white.com/blog/exploiting-asp.net-templateparser-part-1/ - nvd.nist.gov/vuln/detail/CVE-2023-35813 Nuclei Template - templates.nuclei.sh/public/CVE-2023-35813.y...
CVE-2023-35078 Exploit POC - MobileIron | Ivanti - Live Recon
zhlédnutí 924Před 11 měsíci
CVE-2023-35078 Exploit POC - MobileIron | Ivanti - Live Recon
Khandwa MP, Ram Navmi 2023 | खंडवा मध्य प्रदेश | राम नवमी जुलूस 2023
zhlédnutí 4,5KPřed rokem
Khandwa MP, Ram Navmi 2023 | खंडवा मध्य प्रदेश | राम नवमी जुलूस 2023
Digestive system, Organs and Internal vessels Hindi | Naturopathy By Sachin Patil Burhanpur/Khandwa
zhlédnutí 203Před rokem
Digestive system, Organs and Internal vessels Hindi | Naturopathy By Sachin Patil Burhanpur/Khandwa
Navratri Visarjan Khandwa MP | नवरात्रि विसर्जन खंडवा, मध्य प्रदेश 2022
zhlédnutí 3,3KPřed rokem
Navratri Visarjan Khandwa MP | नवरात्रि विसर्जन खंडवा, मध्य प्रदेश 2022
Siya Ram Chowk Kakad Aarti | Maa Kaali Bhavya Aarti | खंडवा MP - Live #navratrispecial
zhlédnutí 686Před rokem
Siya Ram Chowk Kakad Aarti | Maa Kaali Bhavya Aarti | खंडवा MP - Live #navratrispecial
GANESH VISARJAN | KHANDWA MP | गणेश विसर्जन, खंडवा
zhlédnutí 2,1KPřed rokem
GANESH VISARJAN | KHANDWA MP | गणेश विसर्जन, खंडवा
जन्माष्टमी | Janmashtami - Khandwa. Shani Mandir Square | मटकी तोड़, खंडवा MP | 2022
zhlédnutí 1KPřed rokem
जन्माष्टमी | Janmashtami - Khandwa. Shani Mandir Square | मटकी तोड़, खंडवा MP | 2022
दादाजी धूनीवाले महा आरती | Guru Poornima 2022 | Dadaji Dhuni wale Complete Maha Aarti LIVE
zhlédnutí 3,8KPřed 2 lety
दादाजी धूनीवाले महा आरती | Guru Poornima 2022 | Dadaji Dhuni wale Complete Maha Aarti LIVE
Guru Poornima Dadaji Dhuni Wale Live 2022 After Maha Aarti Khandwa MP, गुरु पूर्णिमा दादा दरबार.
zhlédnutí 749Před 2 lety
Guru Poornima Dadaji Dhuni Wale Live 2022 After Maha Aarti Khandwa MP, गुरु पूर्णिमा दादा दरबार.
Guru Poornima गुरु पूनम | 2022 Khandwa MP, Dadaji Temple Live
zhlédnutí 9KPřed 2 lety
Guru Poornima गुरु पूनम | 2022 Khandwa MP, Dadaji Temple Live
Hacking 6.5+ million websites CVE-2022-29455 (Elementor) | DOM XSS Proof Of Concept
zhlédnutí 2,4KPřed 2 lety
Hacking 6.5 million websites CVE-2022-29455 (Elementor) | DOM XSS Proof Of Concept
Spring Boot Remote Code Execution Proof Of Concept | spring-cloud-function | Latest 0day
zhlédnutí 2,7KPřed 2 lety
Spring Boot Remote Code Execution Proof Of Concept | spring-cloud-function | Latest 0day
भोले की बारात, महाशिवरात्रि महादेवगढ़ खंडवा मध्य प्रदेश. MahaShivaRatri MP
zhlédnutí 2,5KPřed 2 lety
भोले की बारात, महाशिवरात्रि महादेवगढ़ खंडवा मध्य प्रदेश. MahaShivaRatri MP
Shivratri Mahadevgad 2022 | Khandwa, MP
zhlédnutí 3,1KPřed 2 lety
Shivratri Mahadevgad 2022 | Khandwa, MP
Scanning 9000 Webserver IP's Under 2 Minutes | Live Recon | Bug Bounty
zhlédnutí 1KPřed 2 lety
Scanning 9000 Webserver IP's Under 2 Minutes | Live Recon | Bug Bounty
Ganpati Visarjan 2021 | Khandwa Ke Vighnaharta | Beautiful Memory.
zhlédnutí 1,3KPřed 2 lety
Ganpati Visarjan 2021 | Khandwa Ke Vighnaharta | Beautiful Memory.
Jira Confluence Unauth Remote Code Execution POC | 2021
zhlédnutí 707Před 2 lety
Jira Confluence Unauth Remote Code Execution POC | 2021
How Use CHMOD 600 in Windows For SSH Key Or Other
zhlédnutí 6KPřed 2 lety
How Use CHMOD 600 in Windows For SSH Key Or Other
WordPress Woocommerce Unauthorized SQL Injection 2021 Proof Of Concept | Critical Vulnerability.
zhlédnutí 13KPřed 3 lety
WordPress Woocommerce Unauthorized SQL Injection 2021 Proof Of Concept | Critical Vulnerability.
Mehfil Mein Baar Baar Kisi Par Nazar Gayi | Golden Voice | Performed By Osman Mir | 2014
zhlédnutí 497KPřed 3 lety
Mehfil Mein Baar Baar Kisi Par Nazar Gayi | Golden Voice | Performed By Osman Mir | 2014
Cisco ASA | Cisco VPN XSS 2021| /+CSCOE+/
zhlédnutí 2,6KPřed 3 lety
Cisco ASA | Cisco VPN XSS 2021| / CSCOE /

Komentáře

  • @user-ki3rz3xo8h
    @user-ki3rz3xo8h Před 13 hodinami

    can you do exploit in facebook accounts i will pay for that

  • @SatishChaubey-pt8tf

    THE BEAST OF BHAJAN AND SOUNGS THANKS😂😂😂😂😂😢😢😢😢😢😢😢😅😅😅😅😅😮😮😮😮🎉🎉🎉🎉🎉🎉🎉🎉

  • @NandKishor-ie4zm
    @NandKishor-ie4zm Před 3 dny

    Duniya kisi ke pyar me jannat se kam nahi ... Ek dil ruba hai dil me huron se kam nahi......?

  • @bhurosyrajkumar6760

    super cool .

  • @user-ph9et4in3k
    @user-ph9et4in3k Před 7 dny

    मीर भाई अल्लाह ताला ने आपको गाने की नियामत बख्शी है जिसकी तारीफ में मेरे पास शब्द नहीं है । बस आपको सुनता रहूं 🎉अस्सलाम वालेकुम

  • @Jay_khodalma_00
    @Jay_khodalma_00 Před 8 dny

    czcams.com/video/c_UNxmCfrYI/video.htmlsi=vdtKSsD1F4VQEA8t

  • @FoujiSurajPahadi
    @FoujiSurajPahadi Před 9 dny

    Lajavab

  • @user-bt8fb5bi3w
    @user-bt8fb5bi3w Před 13 dny

    Mir saheb how many rupees will you earn because I have been looking that there are many people or oriented given prizes in which of the note of Gaddis because you have learned art music thank you , I prey to God we need as well as you.

  • @amitgautam9619
    @amitgautam9619 Před 18 dny

    No comparison

  • @TheSmileMakers1
    @TheSmileMakers1 Před 22 dny

    how can upload shell bro?

    • @chiragartani
      @chiragartani Před 22 dny

      @@TheSmileMakers1 Just learn PHP. Put the code like I did that's it. Or use curl/f_get_content in PHP.

  • @nooranitejani
    @nooranitejani Před 22 dny

    Fantastic rendition..kucch alag style mein present kiya hein is kalakar ne..maza aa gaya...log paise throw karte hein?❤❤❤❤❤

  • @CyberXSpyware
    @CyberXSpyware Před 24 dny

    how to find sites vulnerable? any dorks ?

  • @shrikantdongarwar4111

    लाजवाब गायकी बहुत पसंद आयी

  • @hexormc5164
    @hexormc5164 Před 25 dny

    Can rce be achieved with this?

    • @chiragartani
      @chiragartani Před 25 dny

      @@hexormc5164 yes gain admin access reading app.php, crack JWT through that and then look for existing post auth RCE. Or just leverage XXE to upload files remotely and execute shell.

    • @hexormc5164
      @hexormc5164 Před 25 dny

      Do u know how to leverage for rce?

  • @NarayanmohanSoni-do7bz
    @NarayanmohanSoni-do7bz Před měsícem

    Maa choddi ghazal ki😢

  • @RajkumarTiwari-z6n
    @RajkumarTiwari-z6n Před měsícem

    Rohit, bhartiy, chitekoot, see

  • @nocopyrightdoggy4628
    @nocopyrightdoggy4628 Před měsícem

    hey man, I dont have that "authenticated users" group on security, do I need to have it?

  • @mastergaming5543
    @mastergaming5543 Před měsícem

    संगीत समझने वालों को प्रेम सुधा से कम नहीं।

  • @mahendrasing569
    @mahendrasing569 Před měsícem

    If you listen full song it means your music teast is good

  • @BiekubhaiJoshi
    @BiekubhaiJoshi Před měsícem

    Hsmari jannat ye duniya hi he Vaha huroka bhala ksya kam he vafa to dilruba karati he Varana huro mr kaha dam he

  • @hinglajcharan9365
    @hinglajcharan9365 Před měsícem

    वाह मीर ❤

  • @hemantpatil4312
    @hemantpatil4312 Před měsícem

    पहली बार सून रहा हू आपको.. बहुत ही अच्छी सुरीली आवाज है.. आपको सॅल्यूट 🌹🌹🌹

  • @MouatasemMsria
    @MouatasemMsria Před měsícem

    Is this vulnerable only for localhost?

  • @user-xy6gb9us9z
    @user-xy6gb9us9z Před měsícem

    great video thanks , plz could you tell us how to find the vulnerable websites?

  • @vtdvtd2513
    @vtdvtd2513 Před měsícem

    hi bro, im reproducing that cve but it's not work to me. plz help me T_T

    • @Official_Baba_yaga
      @Official_Baba_yaga Před 23 dny

      1) Needs to be a server running on windows 2) Vulnerable php version 3) php needs to be in "CGI MODE" 0:48 See that server api entry ? your lab has to read the same

  • @mdnuralisarket7218
    @mdnuralisarket7218 Před měsícem

    Modhu,,! Modhu!❤❤❤❤❤❤❤❤

  • @YoMananChill
    @YoMananChill Před měsícem

    Great work though!! Was trying to find these in wild since an hour.

    • @chiragartani
      @chiragartani Před měsícem

      i found in 20 sites yet

    • @medi4884
      @medi4884 Před měsícem

      @@chiragartani Only chineese ?

    • @medi4884
      @medi4884 Před měsícem

      @@chiragartani Can you leak 1 site for test cve ?

    • @chiragartani
      @chiragartani Před měsícem

      ​@@medi4884 I can't. That's the one I have shown In the video.

    • @Official_Baba_yaga
      @Official_Baba_yaga Před 23 dny

      @@medi4884 If you read up on the vulnerability , you find sources stating the windows must be in either locales Traditional Chinese (Code Page 950) Simplified Chinese (Code Page 936) Japanese Your best bet is to go after chinese and japanese targets!

  • @YoMananChill
    @YoMananChill Před měsícem

    How to find vulnerable Targets though?! Any shodan search query you would like to give?!

    • @chiragartani
      @chiragartani Před měsícem

      use netlas

    • @itguy1
      @itguy1 Před měsícem

      Following PHP branches are vulnerable to this CVE: 8.1.* 8.2.* 8.3.* Example shodan search for 8.2.* branch: server: php 8.2.* (search for everything below 8.2.20)

  • @himadrishekhar1667
    @himadrishekhar1667 Před měsícem

    समझ में नहीं आता है कि ऐ बापू के आश्रम की कोठा है ,,, पैसा फेंकने कि कला कया कोठे से सिख कर आया है बापू के भक्त लोगों?????

  • @darkmix4192
    @darkmix4192 Před měsícem

    How to find that url domain? And how to report?

    • @chiragartani
      @chiragartani Před měsícem

      Using Netlas. You can use that for free

  • @Helloword-ob2gm
    @Helloword-ob2gm Před měsícem

    how we find the url and how we understood this is vulnerable?

  • @ReplitKing-vw9po
    @ReplitKing-vw9po Před měsícem

    how do you stay updated about this kind of new cves?

    • @chiragartani
      @chiragartani Před měsícem

      Twitter/X, main and real source where all these stuffs are primarily posted.

  • @user-pe1og1vs5x
    @user-pe1og1vs5x Před měsícem

    http.body:"Check Point SS Network Exteder" host_type:domain i am to this command but not working can you explain me ?

  • @22Jan.
    @22Jan. Před měsícem

    Nostalgia ❤

  • @vs-gs8xo
    @vs-gs8xo Před 2 měsíci

    @chiragartani i invested 2 lac rs. Within 2-3 days i got suspicious something fishy going on. So I asked them to withdraw my money. While the money did get transferred back tp me in 3 installments , but affter a few days I got a message that my bank account was frozen. So even if someone gets the money back the bank account gets frozen. While I managed to get the account unfrozen after the Bank did a complete KYC and Due Diligence of my account. However the bank did put a hold on 1.75 lac. So looks like these scammers are transferring money from one victim to another. Also I would like to know the details of the case that is going on andi in which court.?

  • @sudhamishra5091
    @sudhamishra5091 Před 2 měsíci

    Bahut meethi aawaz mn krta h sunte hi rho,aapko sunna bahut accha lgta h

  • @inyourdreamsgaming4630
    @inyourdreamsgaming4630 Před 2 měsíci

    Hello brother can you please help me too? I lost my money too over here please help me recover my money

  • @insuranceindustry9101
    @insuranceindustry9101 Před 2 měsíci

    Bhai meri helf kar do please

  • @insuranceindustry9101
    @insuranceindustry9101 Před 2 měsíci

    Bhai mera 52000rs block kar rakha he

    • @chiragartani
      @chiragartani Před 2 měsíci

      That's fake application, stop investing more else you will lost more. so do not fall in that trap. Thanks.

  • @gondaliyajanak5134
    @gondaliyajanak5134 Před 2 měsíci

    कोन कोन 2024 मे सुन रहा है?

  • @user-ts1oj9nf4c
    @user-ts1oj9nf4c Před 2 měsíci

    Goosebumps

  • @2488241
    @2488241 Před 2 měsíci

    I have loss 2.3L

  • @WebWonders1
    @WebWonders1 Před 2 měsíci

    hey can you help me this is giving this error: <client-ip>3rag</client_ip> <client-ipv6>watchTowr</client_ipv6> <md5-sum></md5-sum> <report> length 0</report> <error>Missing or invalid required input parameters</error> </response>

    • @chiragartani
      @chiragartani Před 2 měsíci

      Hi, check the set-cookie if that's sessid , not phpsessid then that's vulnerable. else not also, just visit the URL,. If you see 403 while opening the file instead of 404. You got vulnerability. Or if you are still seeing 404 mean there's no vulnerability in the target.

    • @WebWonders1
      @WebWonders1 Před 2 měsíci

      @@chiragartani yes its sessid but at the place of login POST request that I am trying don't know why this error is : <error>Missing or invalid required input parameters</error> coming. Also these are the version : { "date": "2024-04-14", "versions": [ "10.2.9-h1", "11.0.4-h1", "11.1.2-h3" ], "precision": "exact", "resource": "global-protect/portal/images/bg.png" I have the both ip and domain of the portal and don't know which parameter is missing : user=3rag&portal=3rag&authcookie=2a50b3a2-aa4d-4429b3a4d6dc&domain=3rag&computer=3rag&client-ip=3rag&client-ipv6=watchTowr&md5-sum=3rag&gwHipReportCheck=3rag

  • @user-bp7lv5sn5g
    @user-bp7lv5sn5g Před 2 měsíci

    Gurujee.aapky.charno.me.samarpit.hamari.naal.kee.kala.hamko.kab.asirbad.dngy

  • @rakshitagarwal8017
    @rakshitagarwal8017 Před 2 měsíci

    I need help brother my sister ke sath bhi fraud hua h 156000 amount uska freeze kr diya h....please help.

    • @chiragartani
      @chiragartani Před 2 měsíci

      tell her to contact me on instagram - chirag99artani, thanks

  • @dilipraithatha1722
    @dilipraithatha1722 Před 2 měsíci

    Superb

  • @jatinbudhwar5661
    @jatinbudhwar5661 Před 3 měsíci

    I found one on a bug bounty program, I did exactly same explained here and everything is working but when I check the file its still returning 404

    • @chiragartani
      @chiragartani Před 3 měsíci

      Hi, use curl -i "target" See the HTTP response header value if you are seeing set-cookie: sessid Then that's vulnerable if you see set-cookie: phpsessid that's not vulnerable. Most of the PAN VPN aren't vulnerable but still it depends on the luck.

    • @jatinbudhwar5661
      @jatinbudhwar5661 Před 3 měsíci

      @@chiragartani yes it's set-cookie: sessid

    • @jatinbudhwar5661
      @jatinbudhwar5661 Před 3 měsíci

      That means it's vulnerable?

    • @chiragartani
      @chiragartani Před 3 měsíci

      @@jatinbudhwar5661 yeah most probably

    • @jatinbudhwar5661
      @jatinbudhwar5661 Před 3 měsíci

      @@chiragartani the server is not responding now.

  • @ShahidKhan-nu7nt
    @ShahidKhan-nu7nt Před 3 měsíci

    ❤❤❤❤❤a

  • @TranquiX89
    @TranquiX89 Před 3 měsíci

    hi sir, how to know if my firewall has sent out data to the attacker?

    • @chiragartani
      @chiragartani Před 3 měsíci

      If you see status code 200 on the logs, Data exposed. If you see 403 in the status code of logs - WAF worked.

    • @emersonvan
      @emersonvan Před 3 měsíci

      The following command can be used from the PAN-OS CLI to help identify if there was an attempted exploit activity on the device: grep pattern "failed to unmarshal session(.\+.\/" mp-log gpsvc.log* If the value between "session(" and ")" does not look like a GUID, but instead contains a file system path or embedded shell commands, this could be related to an attempted exploitation of CVE-2024-3400, which will warrant further investigation to correlate with other indicators of compromise. Grep output indicating an attempted exploit may look like the following entry: failed to unmarshal session(../../some/path) Grep output indicating normal behavior will typically appear like the following entry: failed to unmarshal session(01234567-89ab-cdef-1234-567890abcdef)

    • @TranquiX89
      @TranquiX89 Před 3 měsíci

      @@emersonvan we have the output with path but PA TAC team told it is just failed attempts. Also they told No exploit. I am confused.🥴

  • @praisong7475
    @praisong7475 Před 3 měsíci

    Hey, could you please help me with a vulnerable docker image for this so that I can test this CVE in my local environment?

    • @emersonvan
      @emersonvan Před 3 měsíci

      you can do that with OVA, EVE-NG, GNS3, but you will need to setup firewall