UNDERCODE COMMUNITY
2.68K subscribers
1.23K photos
31 videos
2.65K files
80.1K links
πŸ¦‘ Undercode Cyber World!
@UndercodeCommunity


1️⃣ World first platform which Collect & Analyzes every New hacking method.
+ AI Pratice
@Undercode_Testing

2️⃣ Cyber & Tech NEWS:
@Undercode_News

3️⃣ CVE @Daily_CVE

✨ Web & Services:
β†’ Undercode.help
Download Telegram
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘Does your phone have ROOT? Mobile phone vulnerabilities after ROOT cannot be prevented :

1) Maybe your phone ROOT is just to install a game and install a tool. To us ordinary people, ROOT represents convenience and freedom. In fact, what you don't know is that it also brings convenience and freedom for hackers to violate your privacy. See how the mobile phone after ROOT opens the door for loopholes.

2) Even when all the information is disclosed, Android Root application developers still have an unknown side.

πŸ¦‘ROOT also opens the door for vulnerability exploitation

The latest research found that by promoting powerful root applications, the few app distributors are putting millions of Android users in a very dangerous situation. Root programs can easily be reverse engineered, allowing malware to use exploit tools to bypass important security checks on Android.

1) On Thursday, researchers from the University of California, Riverside, published a report entitled " Android Root and its suppliers: a double-edged sword " at the ACM Computer and Communication Security Conference . They spent a month of free time reverse engineering A Root tool contains 167 vulnerabilities. In the end, the researchers concluded that by providing a large variety of highly customized vulnerabilities, root vendors can easily lead to reverse engineering and are difficult to detect, which raises the security risk for all Android users.

2) ROOT: a double-edged sword

Researchers from the University of California, Riverside put forward in the paper:

"We found that they are not only working hard to integrate and integrate known exploits, but also to develop new exploits in order to remain competitive. However, these exquisite exploits are not well protected. Once they fall into the wrong hands, they will Cause extremely dangerous effects."

@UndercodeTesting
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘πŸŒ How to block .git in Apache, Nginx and Cloudflare?

A) Nginx
If you are using Nginx you can add the following location directive in nginx.conf file

location ~ /\.git {
deny all;
}

Alternatively, you can return a 404 error if you don't want an attacker to assume that you have .git on your server.
location ~ /\.git {
return 404;
}
In this case, the server will return an HTTP 404 status code.
Whatever you choose, remember to restart Nginx after changing the configuration.

> service nginx restart

B) Apache HTTP
Let's see how to block access to .git on Apache web server.

You can use RedirectMatch or DirectoryMatch for this.

Using RedirectMatch is probably the easiest.

You just need to add the following to your httpd.conf or .htaccess file.

RedirectMatch 404 /\.git
The above setting will give 404 when someone accesses .git and the following will show 403.

RedirectMatch 403 /\.git
Then let's try using the DirectoryMatch rule by adding the following to the httpd.conf file.
<DirectoryMatch "^/.*/\.git/">
Deny from all
</Directorymatch>
Restart Apache and try to access the url including .git; it will show the server a 403 Forbidden error.

C) Cloudflare
But as you can guess, this will only work if your site is running over the Cloudflare network.

Sign in to Cloudflare
Go to Firewall >> Firewall Rules >> Create a Firewall rule tab.
Name the rule - GIT
Select field –- URI
Operator - contains
Value - .git
Choose an action - Block and save
It will take approximately 1 minute to propagate the rule to all Cloudflare datacenters.
After that, Cloudflare will do the rest.

@UndercodeTesting
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘Anonymously Hiding Tools

- Anonmously Surf

- Multitor

πŸ¦‘Information gathering tools

- Network Map (nmap)

- Dracnmap

- Port scanning

- Host to IP

- Xerosploit

- RED HAWK (All In One Scanning)

- ReconSpider(For All Scaning)

- IsItDown (Check Website Down/Up)

- Infoga - Email OSINT

- ReconDog

- Striker

- SecretFinder (like API & etc)

- Find Info Using Shodan

@UndercodeTesting
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘50+ encryptions/encodings Topic 2020 tool for any linux/windows

F E A T U R E S :

50
+ encryptions/encodings supported such as binary, Morse code and Base64. Classical ciphers like the Caesar cipher, Affine cipher and the Vigenere cipher. Along with modern encryption like repeating-key XOR and more. For the full list, click here

Custom Built Artificial Intelligence with Augmented Search (AuSearch) for answering the question "what encryption was used?" Resulting in decryptions taking less than 3 seconds.

Custom built natural language processing module Ciphey can determine whether something is plaintext or not. Whether that plaintext is JSON, a CTF flag, or English, Ciphey can get it in a couple of milliseconds.

Multi Language Support at present, only German & English (with AU, UK, CAN, USA variants).

Supports encryptions and hashes Which the alternatives such as CyberChef Magic do not.
C++ core Blazingly fast.

πŸ„ΈπŸ„½πŸ…‚πŸ…ƒπŸ„°πŸ„»πŸ„»πŸ„ΈπŸ…‚πŸ„°πŸ…ƒπŸ„ΈπŸ„ΎπŸ„½ & πŸ…πŸ…„πŸ„½ :

1) git clone https://github.com/Ciphey/Ciphey.git

2) cd Ciphey

3) python3 -m pip install ciphey --upgrade

4) File Input ciphey -f encrypted.txt

5) Unqualified input ciphey -- "Encrypted input"

6) Normal way ciphey -t "Encrypted input"

@UndercodeTesting
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘Currently CoreDNS is able to:

Serve zone data from a file; both DNSSEC (NSEC only) and DNS are supported (file and auto).

Retrieve zone data from primaries, i.e., act as a secondary server (AXFR only) (secondary).

Sign zone data on-the-fly (dnssec).

Load balancing of responses (loadbalance).

Allow for zone transfers, i.e., act as a primary server (file +
transfer).

Automatically load zone files from disk (auto).

Caching of DNS responses (cache).

Use etcd as a backend (replacing SkyDNS) (etcd).

Use k8s (kubernetes) as a backend (kubernetes).

Serve as a proxy to forward queries to some other (recursive)
nameserver (forward).

Provide metrics (by using Prometheus) (prometheus).

Provide query (log) and error (errors) logging.

Integrate with cloud providers (route53).

Support the CH class: version.bind and friends (chaos).

Support the RFC 5001 DNS name server identifier (NSID) option
(nsid).

Profiling support (pprof).

Rewrite queries (qtype, qclass and qname) (rewrite and
template).

Block ANY queries (any).

Provide DNS64 IPv6 Translation (dns64).

πŸ„ΈπŸ„½πŸ…‚πŸ…ƒπŸ„°πŸ„»πŸ„»πŸ„ΈπŸ…‚πŸ„°πŸ…ƒπŸ„ΈπŸ„ΎπŸ„½ & πŸ…πŸ…„πŸ„½ :

1) $ git clone https://github.com/coredns/coredns

2) $ cd coredns

3) $ make

CoreDNS
requires Go to compile. However, if you already have docker installed and prefer not to setup a Go environment, you could build CoreDNS easily:

$ docker run --rm -i -t -v $PWD:/v -w /v golang:1.14 make
The above command alone will have coredns binary generated.

πŸ¦‘Examples
When starting CoreDNS without any configuration, it loads the whoami and log plugins and starts listening on port 53 (override with -dns.port), it should show the following:

.:53
CoreDNS-1.6.6
linux/amd64, go1.13.5, aa8c32
The following could be used to query the CoreDNS server that is running now:

dig @127.0.0.1 -p 53 www.example.com

βœ…git 2020
@UndercodeTesting
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘Encryption algorithm :
YOU SHOULD KNOW FOR ANY PROJECTβ€” :

1) This project builds an efficient certificateless encryption scheme. Compared with the general example, it transforms the identity-based encryption and signature scheme into a combined certificateless protocol, and uses a certificateless encryption verification mechanism to extend the traditional signature encryption method. Based on the technology of identity authentication, pairing is used to verify the related public key. As long as the amortized cost of this verification is low, the result will be as efficient as basic encryption.

2) It not only maintains the advantages of identity-based public key cryptosystems that do not require the use of public key certificates, but also better solves its inherent key escrow problem. Signcryption combines public key encryption and digital signatures At the same time, the two functions of public key encryption and digital signature can be completed in a reasonable logical step, and the calculation amount and communication cost are lower than the traditional "sign before encryption" mode.

3) Use certificateless signature encryption algorithm based on bilinear pairing to use in wireless sensor network. Construct an efficient certificateless encryption scheme. Compared with the general paradigm, the identity-based encryption and signature scheme is transformed into a combined certificateless protocol, and the certificateless encryption verification mechanism is used to extend the traditional signature encryption method. According to the basic identity-based authentication Technology, pairing is used to verify the related public key. As long as the amortized cost of this verification is low, the result will be as efficient as basic encryption.

4) The PBC encryption algorithm is implanted in wireless sensors with limited memory and processing speed (wireless sensors use 51 cores). The ROM is only 4K and has to deal with the sensor's own information transmission, sensor signal detection and peripherals The state of the device is supervised, so it is extremely challenging to use in wireless sensor networks.

@UndercodeTesting
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘Python crawler uses dynamic switching ip to prevent blocking ?

1) The biggest difference between a forward proxy and a reverse proxy is that the domain name of the reverse proxy is often fixed, while the forward proxy is accessed at will through an http proxy port, but the http protocol will be modified on the proxy side to help you access

2) If it is python, in fact, it is enough to simply call socket bind to bind a certain ip, but what is the concept of title rotation? It is to maintain different socket bind objects, and then you can take turns! I have talked to some people who specialize in crawlers in the industry, and they basically use this technology.


# -*- coding=utf-8 -*-
import socket
import urllib2
import re
true_socket = socket.socket

ipbind='xx.xx.xxx.xx'

def bound_socket(*a, **k):
sock = true_socket(* a, **k)
sock.bind((ipbind, 0))
return sock

socket.socket = bound_socket

response = urllib2.urlopen('http://www. Testsite .com')
html = response.read()
ip= re.search(r'code.(.*?)..code',html)
print ip.group(1)

πŸ¦‘I found some ideas for solutions given by foreigners, It is the export ip address constructed with the help of urllib2's HTTPHandler.

import functools
import httplib
import urllib2

class BoundHTTPHandler(urllib2.HTTPHandler):

def init(self, source_address=None, debuglevel=0):
urllib2.HTTPHandler.init(self, debuglevel)
self.http_class = functools.partial(httplib.HTTPConnection,
source_address=source_address)

def http_open(self, req):
return self.do_open(self.http_class, req)

handler = BoundHTTPHandler(source_address=("192.168.1.10", 0))
opener = urllib2.build_opener(handler)
urllib2.install_opener(opener)


import functools
import httplib
import urllib2

class BoundHTTPHandler(urllib2.HTTPHandler):

def init(self, source_address=None, debuglevel=0):
urllib2.HTTPHandler.init(self, debuglevel)
self.http_class = functools.partial(httplib.HTTPConnection,
source_address=source_address)

def http_open(self, req):
return self.do_open(self.http_class, req)

handler = BoundHTTPHandler(source_address=("192.168.1.10", 0))
opener = urllib2.build_opener(handler)
urllib2.install_opener (opener)
Then there is a ready-made module netifaces. In fact, the netifaces module is the function package of the socket binding ip just above.
Address: https://github.com/raphdg/netifaces

import netifaces
netifaces.interfaces()
netifaces.ifaddresses('lo0')
netifaces.AF_LINK
addrs = netifaces.ifaddresses('lo0')
addrs[netifaces.AF_INET]
[{'peer': '127.0.0.1','netmask': '255.0.0.0','addr': '127.0.0.1'}]

import netifaces
netifaces.interfaces()
netifaces.ifaddresses('lo0')
netifaces.AF_LINK
addrs = netifaces.ifaddresses('lo0')
addrs[netifaces.AF_INET]
[{'peer': '127.0.0.1','netmask': '255.0.0.0','addr': '127.0.0.1'}]
Thanks for reading, I hope it can help everyone, thank you for your support to this site!

@UndercodeTesting
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
TODAY TOPICS :

Immediate Results!
New Revolutionary CPA Solutions
https://t.me/UnderCodeTesting/11707

Some courses:
https://t.me/UnderCodeTesting/11708

Web hack and more2020 topic
https://t.me/UnderCodeTesting/11709

Sql injection/web hack pdf
https://t.me/UnderCodeTesting/11710

botnet tutorial pdf
https://t.me/UnderCodeTesting/11711

Ip cctv methode pdf
https://t.me/UnderCodeTesting/11712

A simple way for others to prompt for an empty number when they call your phone
https://t.me/UnderCodeTesting/11713

This really a good debugger for windows 64/32
https://t.me/UnderCodeTesting/11714

Does your phone have ROOT? Mobile phone vulnerabilities after ROOT cannot be prevented
https://t.me/UnderCodeTesting/11716

Build application Custom Views and Common Use Cases [1.53 Gb]
https://t.me/UnderCodeTesting/11717

How to block .git in Apache, Nginx and Cloudflare?
https://t.me/UnderCodeTesting/11718

AWESOME FREE API FOR TRACKING (Topic 2020)
https://t.me/UnderCodeTesting/11719

Anonymously Hiding Tools #list / Information gathering tools
https://t.me/UnderCodeTesting/11720

if you are looking for good & helpful tools you should try
https://t.me/UnderCodeTesting/11721

DETAILED PROXIES LIST
https://t.me/UnderCodeTesting/11722

5 ways to ban grabbing (pdf guide)
https://t.me/UnderCodeTesting/11723

50+ encryptions/encodings Topic 2020 tool for any linux/windows
https://t.me/UnderCodeTesting/11725

Strong free coredns
https://t.me/UnderCodeTesting/11726

Encryption algorithm
https://t.me/UnderCodeTesting/11727

Python crawler uses dynamic switching ip to prevent blocking ?
https://t.me/UnderCodeTesting/11728
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘2020 insta hack
#requested
INSTA
is a bash based script which is officially made to test password strength of instagram account from termux with bruteforce attack and. This tool works on both rooted Android device and Non-rooted Android device.

πŸ„ΈπŸ„½πŸ…‚πŸ…ƒπŸ„°πŸ„»πŸ„»πŸ„ΈπŸ…‚πŸ„°πŸ…ƒπŸ„ΈπŸ„ΎπŸ„½ & πŸ…πŸ…„πŸ„½ :

1) $ apt-get update -y

2) $ apt-get upgrade -y

3) $ pkg install python -y

4) $ pkg install python2 -y

5) $ pkg install git -y

6) $ pip install lolcat

7) $ git clone https://github.com/evildevill/instahack

8) $ ls

9) $ cd instahack

10) $ ls

11) $ bash setup

12) $ bash instahack.sh

Now you need internet connection to continue further process...

13) You can select any option by clicking on your keyboard

Note:- Don't delete any of the scripts included in core files

14) Open new session and start TOR (tor) before starting the attack

@UndercodeTesting
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁