Labels

Badstore Vulnerabilities

Badstore: 1.2.3

Welcome to Badstore.net
Badstore.net is dedicated to helping you understand how hackers prey on Web application vulnerabilities, and to showing you how to reduce your exposure. Our Badstore demonstration software is designed to show you common hacking techniques.

 
Download  Link:

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
Requirements:

  1. VMware
  2. Badstore ISO
  3. Kali Linux 

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
Setting up BadStore on VM:

  1. Download VMware Workstation and install it.
  2. Now open the VMware Workstation, Click on Create a New Virtual Machine.
  3. Select -> Typical
  4. Select -> Installer Disk Image File -> Browse Badstore.Iso location on your Hard disk.
  5. Next -> Operating System : Linux :: Version : Debian 8.x 64bit, Next.
  6. Choose the VM location (optional) use default.
  7. Maximum Disk Space: 2GB, Select Store Virtual Disk as a Single File,Next.
  8. Finish. Power on the Virtual Machine.

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
Step's for changing NAT to Bridge Network

  1. In VMware go the Tool Bar and select VM -> Settings (Shortcut Key: Ctrl+D)
  2. Check the Network Adapter [NAT]
  3. And change it as [Bridged] check Replicate physical network connection status

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

+---------------------------+
  Vulnerabilities Found
+---------------------------+

  1. Robots.txt
  2. Blind SQL Injection on login form
  3. Cross-Site Scripting (XSS) in Guestbook
  4. Cross-Site Scripting (XSS) in Search Enginee
  5. Gain Admin access
  6. Session Cookies
  7. Admin account password reset without security questions
  8. “Secret” Admin access
  9. Password Hash (MD5 Decoding)
  10. Cart id cookie
  11. Credit Card information are not encrepted
  12. Login Bruteforce
  13. SQL Injection on Supplier Portal
  14. Supplier accounts on base64 password
  15. Clickjacking
  16. Online web scanners vuln Report
  17. login by MySQL Default Credentials Name,Pass
  18. Heap base Buffer over flow can be done

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
Let's start Testing:

First we need to Find your local IP address of the badstore vm go to badstore vm and
press Enter to activate the console now use the command "ifconfig" (Without Quotes).
Now open the Terminal and type "Nmap" (Without Quotes)
Let's Start with Nmap Scanning tool

Command line:
nmap -A -O -Pn <Your Local IP> (Refer the below image to understand well)
Scanning starts, it takes some minisBasic Inforobots-txt file

unregistered user
logged in without login credentials

my account

New test user created

Burp Intercept
Cookie id of test2 in cookies manager addonsSecret Admin Menu

no admin access

Got Admin Access

Admin portal details

xss in Gust book

XSS img

XSS Cookie

XSS on Search Engine

Some Default and my test acc password can cracked by MD5 decoded or John the Ripper password cracker

By Hash Cracking became a Master Admin

CC is not encrypted easily shows the given credentials

Supplier accounts on base64 password

Nessus scanner report

login by MySQL Default Credentials Name,Pass

Acunetix Web Vuln Scan

All Vuln by automated Scan

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<




Labels:

Comments

  1. Anonymous16 July 2020 at 00:39

    email: visacreditcardsolution@gmail.comGET YOUR BLANK ATM CREDIT CARD AT AFFORDABLE PRICE*
    **We sell these cards to all our customers and interested buyers
    worldwide,the card has a daily withdrawal limit of $5000 and up to $50,000
    spending limit in stores and unlimited on POS.**

    **WHAT WE OFFER**

    *1)WESTERN UNION TRANSFERS/MONEY GRAM TRANSFER*
    *2)BANKS LOGINS*
    *3)BANKS TRANSFERS*
    *4)CRYPTO CURRENCY MINNING*
    *5)BUYING OF GIFT CARDS*
    *6)LOADING OF ACCOUNTS*
    *7)WALMART TRANSFERS*
    *8)BITCOIN INVESTMENTS*
    *9)REMOVING OF NAME FROM DEBIT RECORD AND CRIMINAL RECORD*
    *10)BANK HACKING*

    ReplyDelete
  2. Anonymous30 July 2020 at 23:29

    email: visacreditcardsolution@gmail.comGET YOUR BLANK ATM CREDIT CARD AT AFFORDABLE PRICE*
    **We sell these cards to all our customers and interested buyers
    worldwide,the card has a daily withdrawal limit of $5000 and up to $50,000
    spending limit in stores and unlimited on POS.**

    **WHAT WE OFFER**

    *1)WESTERN UNION TRANSFERS/MONEY GRAM TRANSFER*
    *2)BANKS LOGINS*
    *3)BANKS TRANSFERS*
    *4)CRYPTO CURRENCY MINNING*
    *5)BUYING OF GIFT CARDS*
    *6)LOADING OF ACCOUNTS*
    *7)WALMART TRANSFERS*
    *8)BITCOIN INVESTMENTS*
    *9)REMOVING OF NAME FROM DEBIT RECORD AND CRIMINAL RECORD*
    *10)BANK HACKING*

    ReplyDelete
  3. BENITO FAUSTO3 August 2020 at 09:19

    INSTEAD OF GETTING A LOAN, CHECK OUT THE BLANK ATM CARD IN LESS THAN 24hours {oscarwhitehackersworld@gmail.com}


    I want to testify about OSCAR WHITE blank ATM cards which can withdraw money from any ATM machines around the world. I was very poor before and have no hope then I saw so many testimony about how OSCAR WHITE send them the blank ATM card and i use it to collect money in any ATM machine and become rich. I also email him and he sent me the blank card. I have use it to get $100,000 dollars. withdraw the maximum of $5,000 daily.OSCAR WHITE is giving out the card just to help the poor. Hack and take money directly from any ATM Machine Vault with the use of ATM Programmed Card which runs in automatic mode. email Him on how to get it now via: oscarwhitehackersworld@gmail.com or whats-app +1(323)-362-2310

    ReplyDelete
  4. Relish30 November 2025 at 07:53

    Knowing the truth brings peace and that peace sticks for a while, we all need to know the truth at every stage and in every area of our lives, brillianthackers800@gmail.com provided the truth I needed when I was lost and that truth brought the way I was looking for and the way lead me to light, I was told to message on WhatsApp on +14106350697 in order to get the truth I needed from my spouse and I got the truth without my spouse knowing, only for me to display what I found which left me happy and free. Getting the truth is up to you.

    ReplyDelete
  5. miller m18 February 2026 at 08:52

    I just have to introduce this hacker that I have been working with him on getting my credit score been boosted across the Equifax, TransUnion and Experian report. He made a lot of good changes on my credit report by erasing all the past eviction, bad collections and DUI off my credit report history and also increased my FICO score above 876 across my three credit bureaus report he also helped me with my recover my cryptocurrency that i invested in a scam cryptocurrency company you can contact him for all kind of hacks . Email him here via EMAIL ETHICALHACKERS009 @ gmail com or whatsapp +1 4 1 0 6 3 5 0 6 9 7

    ReplyDelete
  6. Monalisa25 March 2026 at 01:46


    Hello People, I am Monalisa from Washington, USA. I highly recommend the service of JHADDIX ETHICAL HACKER'S Recovery to everyone who wishes to recover lost money either bitcoin or other cryptocurrencies, wallet hackers, or if you ever sent bitcoins to the wrong wallet address. I was able to recover my lost bitcoins from online swindlers in less than 24 hours after contacting JHADDIX ETHICAL HACKER'S recovery. They are the best professional team of prolific experts, each with their own unique skill set and a shared passion for unravelling the mysteries of lost crypto. They're not just JHADDIX ETHICAL HACKER'S ; they're blockchain detectives, forensic analysts, and digital strategists, all rolled into one. I’m truly thankful for their help in recovering all I lost. I have encountered numerous challenges and triumphs in my life. However, one of the most daunting experiences I faced was the loss of my hard-earned bitcoins to online swindlers. It was a distressing situation that left me feeling helpless and vulnerable. Fortunately, my encounter with JHADDIX ETHICAL HACKER'S Recovery proved to be a game-changer, as they swiftly and efficiently assisted me in recovering my lost funds. Their exceptional service and professionalism have left an indelible impression on me, prompting me to share my experience and recommend their services to anyone facing similar predicaments. JHADDIX ETHICAL HACKER'S Recovery is a distinguished service that specializes in the recovery of lost cryptocurrencies, addressing wallet hackers, and resolving issues related to incorrect wallet addresses. My personal encounter with this remarkable team of experts was nothing short of impressive. Within or less than 24 hours of reaching out to JHADDIX ETHICAL HACKER'S


    Email : jhaddixethicalhacker@gmail.com
    WHATSAPP :+1 (672) 2173274
    WEBSITE: jhaddixethicalhacker@gmail.com

    ReplyDelete

Post a Comment

Popular Posts