Post Top Ad
How to get rid of all ads in MIUI 11
Xiaomi MIUI overlay has greatly improved over the recent years and I start to like it.What I like less is the increased amount of ads that sneaked in every corner of it
Obviously Xiaomi fail their promise to cut down on ads in MIUI 11.
Thankfully there's always a switch hidden in the most remote part of a menu to turn them off.
Cracking open the iPazzPort KP-62 remote
The iPazzPort KP-62 is an RF remote I bought some time ago thinking it could be better than the H1 or even the unmatched TZ-P3.
I never considered publishing a review for it because of its inherent show-killer feature: the useless and continuous beeping when using the keyboard side.
There's a simple DIY solution to it.
Is your IP Camera (still) vulnerable to XSS?
Often, an input field just intended to collect a server address or user name will also accept entries of a different nature that will be interpreted by the system.
Low-cost IP Cameras, but also more professional ones, have been exposed to XSS for many years, a good reminder that such network devices should not be directly exposed to the Internet!
Hopefully that vulnerability is now well known and many manufacturers eventually "patched" their devices or reduced the attack surface by removing telnet and ftp altogether.
If your IP camera has a HTTP-based user interface, here's a working example of command injection (for learning purpose). This works great on old generation Veskys and Digoo BB-M2 (the pictures below comes from that model), and does not with the Wanscam models I tested.
First check if the admin interface of your camera as an FTP server settings page like this:
Then instead of FTP Server address, copy this command:
put $(killall telnetd)
That first command killed the running telnet daemon.
The second will now launch the Busybox shell without a user/pass prompt. In the username field, copy this:
$(telnetd -l /bin/sh)
Click the Set up button to save the entries, and click the "Test" button to send them.
After that, use any telnet emulator, like Putty, and connect to the camera on port 23
As the owner of the camera, this trick allows you to gain full control on your camera.
 |
| "hslwificam" |
Source: https://nm-projects.de/2017/01/hacking-ip-camera-digoo-bb-m2-part-3-getting-root-access/
More reading:
https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2010/february/busybox-command-injection/
Digoo DG-K2: I've seen this face before...
The Digoo DG-K2 is another camera compatible with Smart Life.This one has a particularly nice design, which also reminds me a bit of a certain character from South Park , but maybe it's just me...
2GB.jpg)
