β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦Analysis of IP Fragmentation by UndercOde :
instagram.com/UndercOdeTestingCompany
π¦ ππΌππ πππΈβπ
1) in TCP / IP layering, the data link layer uses MTU (Maximum Transmission Unit) to limit the size of the data packets that can be transmitted.
2) MTU refers to the maximum length of data transmitted at one time, excluding data at the data link layer The frame header, such as the MTU of Ethernet, is 1500 bytes.
3) In fact, the maximum length of a data frame is 1512 bytes, of which the frame header of an Ethernet data frame is 12 bytes.
4) When the size of the sent IP datagram exceeds the MTU, the IP layer needs to fragment the data, otherwise the data will not be sent successfully.
π¦Analysis of IP Fragmentation by UndercOde :
instagram.com/UndercOdeTestingCompany
π¦ ππΌππ πππΈβπ
1) in TCP / IP layering, the data link layer uses MTU (Maximum Transmission Unit) to limit the size of the data packets that can be transmitted.
2) MTU refers to the maximum length of data transmitted at one time, excluding data at the data link layer The frame header, such as the MTU of Ethernet, is 1500 bytes.
3) In fact, the maximum length of a data frame is 1512 bytes, of which the frame header of an Ethernet data frame is 12 bytes.
4) When the size of the sent IP datagram exceeds the MTU, the IP layer needs to fragment the data, otherwise the data will not be sent successfully.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β ββ β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Implementation of IP fragmentation
t.me/UndercOdeTesting
π¦ ππΌππ πππΈβπ
1) IP fragmentation occurs at the IP layer.
>Not only the source host will fragment, but intermediate routers may also fragment, because the MTU of different networks is different. If the MTU is small, the router may fragment the IP datagram again.
2) The reassembly of fragmented data can only occur at the IP layer of the destination.
3) There are 4 bytes in the IP header for fragmentation
> . The first 16 bits are the ID of the IP datagram.
4) The IDs of the fragments of the same datagram are the same.
5) The destination will determine whether the IP fragments belong to the same IP datagram based on this ID. The middle 3 bits are flag bits, of which 1 bit is used to indicate whether there are more fragments. If it is the last fragment, the flag bit is 0, otherwise it is 1.
6) The last 13 bits indicate the offset of the fragment in the original data. The original data here is the TCP or UDP data transmitted by the IP layer, and does not include the IP header.
π¦ Flag field: 16 bits. Used to uniquely identify each datagram sent by the host. Normally, every time a message is sent, its value is increased by 1.
> This is
the meaning of the three flag bits of IPID:
1) R: reserved unused;
2) DF: Don't Fragment, "No Fragment" bit. If this bit is set to 1, the IP layer will not fragment the datagram; instead, the data will be fragmented. discarding a packet and sends an ICMP error packet discarding and the source host causes
3) MF: more Fragment, "more on-chip", except the last one, the other piece of each constituent datagram should set the bit. 1;
4) Fragment Offset : The slice is offset from the beginning of the original packet. The number of bytes offset is the value multiplied by 8.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Implementation of IP fragmentation
t.me/UndercOdeTesting
π¦ ππΌππ πππΈβπ
1) IP fragmentation occurs at the IP layer.
>Not only the source host will fragment, but intermediate routers may also fragment, because the MTU of different networks is different. If the MTU is small, the router may fragment the IP datagram again.
2) The reassembly of fragmented data can only occur at the IP layer of the destination.
3) There are 4 bytes in the IP header for fragmentation
> . The first 16 bits are the ID of the IP datagram.
4) The IDs of the fragments of the same datagram are the same.
5) The destination will determine whether the IP fragments belong to the same IP datagram based on this ID. The middle 3 bits are flag bits, of which 1 bit is used to indicate whether there are more fragments. If it is the last fragment, the flag bit is 0, otherwise it is 1.
6) The last 13 bits indicate the offset of the fragment in the original data. The original data here is the TCP or UDP data transmitted by the IP layer, and does not include the IP header.
π¦ Flag field: 16 bits. Used to uniquely identify each datagram sent by the host. Normally, every time a message is sent, its value is increased by 1.
> This is
the meaning of the three flag bits of IPID:
1) R: reserved unused;
2) DF: Don't Fragment, "No Fragment" bit. If this bit is set to 1, the IP layer will not fragment the datagram; instead, the data will be fragmented. discarding a packet and sends an ICMP error packet discarding and the source host causes
3) MF: more Fragment, "more on-chip", except the last one, the other piece of each constituent datagram should set the bit. 1;
4) Fragment Offset : The slice is offset from the beginning of the original packet. The number of bytes offset is the value multiplied by 8.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦How to Avoid IP Fragmentation
t.me/UndercOdeTesting
π¦ ππΌππ πππΈβπ
> In network programming, we need to avoid IP fragmentation, so why should we avoid it?
1) The reason is that the IP layer does not have a timeout retransmission mechanism.
2) If the IP layer fragments a packet, as long as one fragment is lost, it can only rely on the transport layer to retransmit.
3) It's a bit expensive to retransmit. It can be seen that IP fragmentation will greatly reduce the success rate of data transmission at the transport layer, so we must avoid IP fragmentation.
4) For UDP packets, we need to limit the size of each packet at the application layer, and generally do not exceed 1472 bytes, that is, Ethernet MTU (1500)-UDP header (8)-IP header (20).
5) For TCP data, the application layer does not need to consider this issue, because the transport layer has already done it for us.
6) During the three-way handshake of establishing a connection, both parties of the connection will notify each other of the MSS (Maximum Segment Size).
7) The MSS is generally MTUβIP header (20) βTCP header (20). The data does not exceed the minimum value of MSS on both sides, so it is guaranteed that the IP datagram does not exceed the MTU, and IP fragmentation is avoided.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦How to Avoid IP Fragmentation
t.me/UndercOdeTesting
π¦ ππΌππ πππΈβπ
> In network programming, we need to avoid IP fragmentation, so why should we avoid it?
1) The reason is that the IP layer does not have a timeout retransmission mechanism.
2) If the IP layer fragments a packet, as long as one fragment is lost, it can only rely on the transport layer to retransmit.
3) It's a bit expensive to retransmit. It can be seen that IP fragmentation will greatly reduce the success rate of data transmission at the transport layer, so we must avoid IP fragmentation.
4) For UDP packets, we need to limit the size of each packet at the application layer, and generally do not exceed 1472 bytes, that is, Ethernet MTU (1500)-UDP header (8)-IP header (20).
5) For TCP data, the application layer does not need to consider this issue, because the transport layer has already done it for us.
6) During the three-way handshake of establishing a connection, both parties of the connection will notify each other of the MSS (Maximum Segment Size).
7) The MSS is generally MTUβIP header (20) βTCP header (20). The data does not exceed the minimum value of MSS on both sides, so it is guaranteed that the IP datagram does not exceed the MTU, and IP fragmentation is avoided.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ IP fragmentation example by UndercOde Support
UDP
1) Send 3,000 bytes of UDP data from 10.224.142.166 to 10.137.133.101. The result of packet capture is shown below.
2) , this UDP data packet is divided into 3 IP fragments.
3) From the offset of each fragment, it can be seen that the size of the UDP data contained in the 3 fragments is 1480, 1480, 48 (plus the UDP header 8). Bytes), the size of each fragment plus the IP header is 1500, 1500, and 68 respectively, and the total UDP data size transmitted is 3008. It can also be seen that only one fragment contains the UDP header.
UDP
1) Send 3,000 bytes of UDP data from 10.224.142.166 to 10.137.133.101. The result of packet capture is shown below.
2) , this UDP data packet is divided into 3 IP fragments.
3) From the offset of each fragment, it can be seen that the size of the UDP data contained in the 3 fragments is 1480, 1480, 48 (plus the UDP header 8). Bytes), the size of each fragment plus the IP header is 1500, 1500, and 68 respectively, and the total UDP data size transmitted is 3008. It can also be seen that only one fragment contains the UDP header.
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ What About TCP ?
t.me/UndercOdeTesting
π¦ Send 2000 bytes of TCP data from 10.224.142.166 to 10.137.133.101. The result of packet capture is shown in Next Pi by UndercOde Support
> It can be seen from the figure that the TCP data is divided into 2 IP fragments, and the data sizes are 1448 and 552 respectively.
> From the three-way handshake, it can be seen that the MSS announced by both parties is 1460 bytes, which is exactly MTU (1500)-IP. Header (20)-TCP header (20), but in fact why the first fragment only sent 1448 bytes,
<> personally think it should be the TCP header and some options occupy 12 bytes. Please also know the master explain.
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ What About TCP ?
t.me/UndercOdeTesting
π¦ Send 2000 bytes of TCP data from 10.224.142.166 to 10.137.133.101. The result of packet capture is shown in Next Pi by UndercOde Support
> It can be seen from the figure that the TCP data is divided into 2 IP fragments, and the data sizes are 1448 and 552 respectively.
> From the three-way handshake, it can be seen that the MSS announced by both parties is 1460 bytes, which is exactly MTU (1500)-IP. Header (20)-TCP header (20), but in fact why the first fragment only sent 1448 bytes,
<> personally think it should be the TCP header and some options occupy 12 bytes. Please also know the master explain.
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Big hacker: how to use microchips to penetrate American companies
twitter.com/UndercOdeTC
1) To assist in due diligence, AWS, which is overseeing the acquisition, hired a third-party company to review Elemental's security, according to a person familiar with the process.
2) The first pass uncovered disturbing issues that prompted AWS to gain a deeper understanding of Elemental's main product: a customer's expensive server installed in its network to handle video compression. The server consists of Super Micro Computer Inc. to Elemental assembly . The San Jose-based company (commonly known as Supermicro) is also one of the world's largest suppliers of server motherboards. It is a fiberglass-installed cluster of chips and capacitors that act as neurons in large and small data centers, Elemental staff boxed several servers and sent them to Ontario, Canada for testing by third-party security companies.
3) Nested on the server's motherboard, testers found a tiny microchip that was no larger than a grain of rice, which was not part of the original design of the circuit board. Amazon reported the discovery to US authorities and shuddered the intelligence community. Elemental's servers can be found in DoD data centers, CIA drone operations, and naval warships' airborne networks. Elemental is just one of hundreds of Supermicro customers.
4) During a top-secret investigation that was still open three years later, investigators determined that the chips allowed attackers to create an invisible door in any network containing changed machines. People familiar with the matter said investigators found the chips had been inserted into factories made by Chinese manufacturing subcontractors.
5) This attack is more serious than the software-based incidents that the world is accustomed to. Hardware attacks are more difficult to implement and can be more disruptive, promising spy agencies willing to invest millions of dollars and years of long-term stealth access.
6) "Having a perfect, nation-level hardware implant surface is like witnessing a unicorn jumping over a rainbow"
7) Spy has two ways to change the internal organs of computer equipment. One of these is called blocking, and involves manipulating the device because they are on the way from the manufacturer to the customer. This method is favored by US spy agencies, according to documents leaked by former National Security Agency contractor Edward Snowden. Another method is to seed the change from the beginning.
8) One country in particular has an advantage in performing such attacks: China, which is estimated to have 75% of mobile phones and 90% of PCs. In reality, implementing a seed attack means gaining a deep understanding of the design of the product, manipulating components at the factory, and ensuring that the tampered device reaches the desired location through the global logistics chain-it's like throwing a stick on the upper reaches of the Yangtze River in Shanghai, ensuring that it is in Seattle ashore. "Having a comprehensive, state-level hardware nation witnessed the implant surface is like a unicorn skip rainbow," Joe Grand, he said he is a hardware hacker and Grand Idea Studio Inc. founder . "Hardware is far from radar, it's almost considered black magic."
9) But this is exactly what U.S. investigators found: Two officials said that chips had been inserted during the manufacturing process, said a member of a People's Liberation Army unit. At Supermicro, Chinese spies seem to have found a perfect channel, and US officials now call it the most important supply chain attack on US companies.
π¦ Big hacker: how to use microchips to penetrate American companies
twitter.com/UndercOdeTC
1) To assist in due diligence, AWS, which is overseeing the acquisition, hired a third-party company to review Elemental's security, according to a person familiar with the process.
2) The first pass uncovered disturbing issues that prompted AWS to gain a deeper understanding of Elemental's main product: a customer's expensive server installed in its network to handle video compression. The server consists of Super Micro Computer Inc. to Elemental assembly . The San Jose-based company (commonly known as Supermicro) is also one of the world's largest suppliers of server motherboards. It is a fiberglass-installed cluster of chips and capacitors that act as neurons in large and small data centers, Elemental staff boxed several servers and sent them to Ontario, Canada for testing by third-party security companies.
3) Nested on the server's motherboard, testers found a tiny microchip that was no larger than a grain of rice, which was not part of the original design of the circuit board. Amazon reported the discovery to US authorities and shuddered the intelligence community. Elemental's servers can be found in DoD data centers, CIA drone operations, and naval warships' airborne networks. Elemental is just one of hundreds of Supermicro customers.
4) During a top-secret investigation that was still open three years later, investigators determined that the chips allowed attackers to create an invisible door in any network containing changed machines. People familiar with the matter said investigators found the chips had been inserted into factories made by Chinese manufacturing subcontractors.
5) This attack is more serious than the software-based incidents that the world is accustomed to. Hardware attacks are more difficult to implement and can be more disruptive, promising spy agencies willing to invest millions of dollars and years of long-term stealth access.
6) "Having a perfect, nation-level hardware implant surface is like witnessing a unicorn jumping over a rainbow"
7) Spy has two ways to change the internal organs of computer equipment. One of these is called blocking, and involves manipulating the device because they are on the way from the manufacturer to the customer. This method is favored by US spy agencies, according to documents leaked by former National Security Agency contractor Edward Snowden. Another method is to seed the change from the beginning.
8) One country in particular has an advantage in performing such attacks: China, which is estimated to have 75% of mobile phones and 90% of PCs. In reality, implementing a seed attack means gaining a deep understanding of the design of the product, manipulating components at the factory, and ensuring that the tampered device reaches the desired location through the global logistics chain-it's like throwing a stick on the upper reaches of the Yangtze River in Shanghai, ensuring that it is in Seattle ashore. "Having a comprehensive, state-level hardware nation witnessed the implant surface is like a unicorn skip rainbow," Joe Grand, he said he is a hardware hacker and Grand Idea Studio Inc. founder . "Hardware is far from radar, it's almost considered black magic."
9) But this is exactly what U.S. investigators found: Two officials said that chips had been inserted during the manufacturing process, said a member of a People's Liberation Army unit. At Supermicro, Chinese spies seem to have found a perfect channel, and US officials now call it the most important supply chain attack on US companies.
10) An official said investigators found that it eventually affected nearly 30 companies, including a large bank, government contractor, and the world's most valuable company, Apple Inc. Apple is a significant customer for Supermicro and plans to order more than 30,000 in both companies A new global data center network of servers. Three senior Apple insiders said that in the summer of 2015, it also found malicious chips on Supermicro motherboards. Apple cut its ties with Supermicro the following year because it described unrelated reasons.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦Firewall and proxy server HOW TO FULL BY UndercOde ?
pinterest.com/UndercOdeOfficial
π¦ What is a firewall
1) A firewall is a part of the name of the car.
2) In the car, use a firewall separating the engine and passenger to
it once ignited car engine, the firewall will not only protect the safety of passengers, while at the same time also allow the driver to continue to control the
engine. In the computer, a firewall is a device that can separate from a common web portion (the entire Internet network
impact path). Thereafter, the text will be referred to as a computer firewall "firewall", which can be protected while connecting
both ends of the network and the Internet. But the Internet can not be protected to the Internet, the Internet can not be
connected to a protected network. If you want to protect the internal network to the Internet, you
have to telnet to the firewall, then the firewall from United Internet. The
3) simplest firewall is dual
homed system (system with two network connections). If you can believe that all your users, then you just
installed a Linux (setting the IP forwarding / gatewaying set to OFF), and let each person set up
an account. They can then log in to this system, using telnet, FTP, e-mail and read all
4) any other service you provide. Under this setup, the only computer in the network can contact with the outside world will
be the firewall. Other computers on this network don't even need a public path. Needed again
notes: For the above firewall to play a role, we must believe that all users! However, I can not build such a
meeting.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦Firewall and proxy server HOW TO FULL BY UndercOde ?
pinterest.com/UndercOdeOfficial
π¦ What is a firewall
1) A firewall is a part of the name of the car.
2) In the car, use a firewall separating the engine and passenger to
it once ignited car engine, the firewall will not only protect the safety of passengers, while at the same time also allow the driver to continue to control the
engine. In the computer, a firewall is a device that can separate from a common web portion (the entire Internet network
impact path). Thereafter, the text will be referred to as a computer firewall "firewall", which can be protected while connecting
both ends of the network and the Internet. But the Internet can not be protected to the Internet, the Internet can not be
connected to a protected network. If you want to protect the internal network to the Internet, you
have to telnet to the firewall, then the firewall from United Internet. The
3) simplest firewall is dual
homed system (system with two network connections). If you can believe that all your users, then you just
installed a Linux (setting the IP forwarding / gatewaying set to OFF), and let each person set up
an account. They can then log in to this system, using telnet, FTP, e-mail and read all
4) any other service you provide. Under this setup, the only computer in the network can contact with the outside world will
be the firewall. Other computers on this network don't even need a public path. Needed again
notes: For the above firewall to play a role, we must believe that all users! However, I can not build such a
meeting.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Firewall flaw-Problems :
t.me/iOsDeveloppers
1) problem for filtering purposes of this firewall is a firewall to prevent Internet access to your network.
2) Only pass
through the firewall to filter access function. With a proxy server, users can log in to the firewall
and enter any system within the private network.
3) In addition, there almost every day new client and server
market.
4) Therefore, it is necessary to have a new method to access the network to invoke these functions.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Firewall flaw-Problems :
t.me/iOsDeveloppers
1) problem for filtering purposes of this firewall is a firewall to prevent Internet access to your network.
2) Only pass
through the firewall to filter access function. With a proxy server, users can log in to the firewall
and enter any system within the private network.
3) In addition, there almost every day new client and server
market.
4) Therefore, it is necessary to have a new method to access the network to invoke these functions.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
Telegram
iUNDERCODE IOS JAILBREAK SUPPORT & HELP
WELCOME TO iUNDERCODE BY UNDERCODE TESTING FOR IOS JAILBREAK & TWEAKS GROUP RULES @UNDERCODERULES
ππΎππππ±π ΄
Youtube.com/c/Undercode
π ΅π°π ²π ΄π±πΎπΎπ Ί
@UndercOdeTesting
@iUNDERCODE
π Έπ ½πππ°π Άππ°π Ό
@UndercOdeTestinG
@iUNDERCODE
πππ Έπππ ΄π
@iUNDERCODE
@UNDERCODENEWS
ππΎππππ±π ΄
Youtube.com/c/Undercode
π ΅π°π ²π ΄π±πΎπΎπ Ί
@UndercOdeTesting
@iUNDERCODE
π Έπ ½πππ°π Άππ°π Ό
@UndercOdeTestinG
@iUNDERCODE
πππ Έπππ ΄π
@iUNDERCODE
@UNDERCODENEWS
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Firewall kind of
> firewall in two ways.
1) IP Filtering Firewall-Blocks all networking functions except some network functions.
2) Proxy Server-Network connection for you.
π¦ ππΌππ πππΈβπ
1) IP filtering firewall
IP filtering firewall works at the packet level. It contains based on origin, destination, and port number of each data packet in
a data packet type information flow control packets. This kind of firewall is very secure, but it lacks useful logins.
Record. It blocks people entering the individual networks, but do not tell you who you are entering the public system, or what
people from the interior into the Internet. The filtering firewall is an absolute filtering system. Even if you have to let the outside world a
few people into your private server, you can not let everyone into the server. Linux from version 1.3.x to open
contains the packet filtering software in the kernel start.
2) Proxy
Proxy allows directly into the Internet through the firewall. The best example is to telnet system, then
the system again another telnet therefrom. In systems with proxy servers, this task is completely automatic
. After using the client software to connect to the proxy server, the proxy server starts its client software (agent)
and then returns data. Because the proxy server repeats all communications, it is able to log all the work in progress
. As long as the configuration is correct, the proxy server is absolutely secure, which is the most desirable. It barrier anyone enter
into, since no direct IP access.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Firewall kind of
> firewall in two ways.
1) IP Filtering Firewall-Blocks all networking functions except some network functions.
2) Proxy Server-Network connection for you.
π¦ ππΌππ πππΈβπ
1) IP filtering firewall
IP filtering firewall works at the packet level. It contains based on origin, destination, and port number of each data packet in
a data packet type information flow control packets. This kind of firewall is very secure, but it lacks useful logins.
Record. It blocks people entering the individual networks, but do not tell you who you are entering the public system, or what
people from the interior into the Internet. The filtering firewall is an absolute filtering system. Even if you have to let the outside world a
few people into your private server, you can not let everyone into the server. Linux from version 1.3.x to open
contains the packet filtering software in the kernel start.
2) Proxy
Proxy allows directly into the Internet through the firewall. The best example is to telnet system, then
the system again another telnet therefrom. In systems with proxy servers, this task is completely automatic
. After using the client software to connect to the proxy server, the proxy server starts its client software (agent)
and then returns data. Because the proxy server repeats all communications, it is able to log all the work in progress
. As long as the configuration is correct, the proxy server is absolutely secure, which is the most desirable. It barrier anyone enter
into, since no direct IP access.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Set up a firewall
1) hardware requirements
in β‘ embodiment, the computer configuration used was a 486-DX66 chip, 16M and 500M Linux memory division. System
within the system also installed two network cards, connect to a private network, another received a called a "demilitarized zone"
networks (Annotation: refers to a public network), and in the non-military on the web area, there is a Wang received Wangji
Road router (router).
2) This configuration is very common, and even with a network card and a modem
<> via PPP to the Internet, but the key point is to have two IP numbers on the firewall.
3) In many people's homes
All have small networks that connect two or three computers together.
4) Try all the modems are connected to run the Linux
computer (old 386 machine), then use the load balanced way the machines are connected to Internet data.
5) Advantage
using such a device, if the data to be transmitted, two modems simultaneously, the transmission speed can be doubled.
6) Set the firewall software
> existing software packages
if just set a filtering firewall, Linux, and that as long as the basic network software is enough. A set of software
may not be the version you are using Linux, called IP Firewall Administration tool.
7)( IPFWADM) Available from http://www.xos.nl/linux/ipfwadm/. If you want to set up a proxy servo
SERVER, you need a software package such.
SOCKS 1.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Set up a firewall
1) hardware requirements
in β‘ embodiment, the computer configuration used was a 486-DX66 chip, 16M and 500M Linux memory division. System
within the system also installed two network cards, connect to a private network, another received a called a "demilitarized zone"
networks (Annotation: refers to a public network), and in the non-military on the web area, there is a Wang received Wangji
Road router (router).
2) This configuration is very common, and even with a network card and a modem
<> via PPP to the Internet, but the key point is to have two IP numbers on the firewall.
3) In many people's homes
All have small networks that connect two or three computers together.
4) Try all the modems are connected to run the Linux
computer (old 386 machine), then use the load balanced way the machines are connected to Internet data.
5) Advantage
using such a device, if the data to be transmitted, two modems simultaneously, the transmission speed can be doubled.
6) Set the firewall software
> existing software packages
if just set a filtering firewall, Linux, and that as long as the basic network software is enough. A set of software
may not be the version you are using Linux, called IP Firewall Administration tool.
7)( IPFWADM) Available from http://www.xos.nl/linux/ipfwadm/. If you want to set up a proxy servo
SERVER, you need a software package such.
SOCKS 1.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ After This Tutorial
Are able to -take some ideas about firewalls and configurations ..
E N J O Y B Y U N D E R C O D E
Are able to -take some ideas about firewalls and configurations ..
E N J O Y B Y U N D E R C O D E
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ 2020 Network and Web Pentest Automation Framework
twitter.com/UndercOdeTC
> Features
π¦Pentest Toolbox management
1) Selection of Tools: Compilation of 50+ open-source tools & scripts, from various sources.
2) Docker-based: Application packaged in a Docker image running Kali OS, available on Docker Hub.
3) Ready-to-use: All tools and dependencies installed, just pull the Docker image and run a fresh container.
4) Updates made easy: Easily keep the whole toolbox up-to-date by running only one command.
5) Easy Customization: Easily add/remove tools from a simple configuration file.
6) Network Infrastructure Security Assessment
Many supported Services: Target most common TCP/UDP services (HTTP, FTP, SSH, SMB, Oracle, MS-SQL, MySQL, PostgreSQL, VNC, etc.).
Combine Power of Tools: Each security check is performed by a tool from the toolbox. Attacks are performed by chaining security checks.
7) Context Awareness: Security checks to run are selected and adapted according to the context of the target (i.e. detected technologies, credentials, vulnerabilities, etc.).
8) Reconnaissance: Automatic fingerprinting (product detection) of targeted services is performed.
9) CVE Lookup: When product names and their versions are detected, a vulnerability lookup is performed on online CVE databases (using Vulners & CVE Details).
10) Vulnerability Scanning: Automatically check for common vulnerabilities and attempt to perform some exploitations (auto-pwn).
11) Brute-force Attack: Automatically check for default/common credentials on the service and perform dictionnary attack if necessary.
12) Wordlists are optimized according to the targeted services.
Post-authentication Testing: Automatically perform some post-exploitation checks when valid credentials have been found.
Web Security Assessment
13) Large Focus on HTTP: More than 60 different security checks targeting HTTP supported for now.
14) Web Technologies Detection: Fingerprinting engine based on Wappalyzer is run prior to security checks, allowing to detect: Programming language, Framework, JS library, CMS, Web & Application Server.
15) Server Exploitation: Automatically scan and/or exploit most critical vulnerabilities (e.g. RCE) on web and application servers (e.g. JBoss, Tomcat, Weblogic, Websphere, Jenkins, etc.).
16) CMS Vulnerability Scanning: Automatically run vulnerability scanners on most common CMS (Wordpress, Drupal, Joomla, etc.).
π¦ πβπππΈπππππΈπππβ & βπβ:
1) Pull Jok3r Docker Image:
> sudo docker pull koutto/jok3r
2) Run fresh Docker container:
> sudo docker run -i -t --name jok3r-container -w /root/jok3r -e DISPLAY=$DISPLAY -v /tmp/.X11-unix:/tmp/.X11-unix --shm-size 2g --net=host koutto/jok3r
3) To re-run a stopped container:
> sudo docker start -i jok3r-container
4) To open multiple shells inside the container:
> sudo docker exec -it jok3r-container bash
5) To re-run a stopped container:
>sudo docker start -i jok3r-container
6) To open multiple shells inside the container:
> sudo docker exec -it jok3r-container bash
7)Show all the tools in the toolbox:
> python3 jok3r.py toolbox --show-all
8) Install all the tools in the toolbox (already done in Docker container):
> python3 jok3r.py toolbox --install-all --auto
9) Update all the tools in the toolbox and prompt each time to check update:
> python3 jok3r.py toolbox --update-all
10) Update all the tools in the toolbox without any prompt:
> python3 jok3r.py toolbox --update-all --auto
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ 2020 Network and Web Pentest Automation Framework
twitter.com/UndercOdeTC
> Features
π¦Pentest Toolbox management
1) Selection of Tools: Compilation of 50+ open-source tools & scripts, from various sources.
2) Docker-based: Application packaged in a Docker image running Kali OS, available on Docker Hub.
3) Ready-to-use: All tools and dependencies installed, just pull the Docker image and run a fresh container.
4) Updates made easy: Easily keep the whole toolbox up-to-date by running only one command.
5) Easy Customization: Easily add/remove tools from a simple configuration file.
6) Network Infrastructure Security Assessment
Many supported Services: Target most common TCP/UDP services (HTTP, FTP, SSH, SMB, Oracle, MS-SQL, MySQL, PostgreSQL, VNC, etc.).
Combine Power of Tools: Each security check is performed by a tool from the toolbox. Attacks are performed by chaining security checks.
7) Context Awareness: Security checks to run are selected and adapted according to the context of the target (i.e. detected technologies, credentials, vulnerabilities, etc.).
8) Reconnaissance: Automatic fingerprinting (product detection) of targeted services is performed.
9) CVE Lookup: When product names and their versions are detected, a vulnerability lookup is performed on online CVE databases (using Vulners & CVE Details).
10) Vulnerability Scanning: Automatically check for common vulnerabilities and attempt to perform some exploitations (auto-pwn).
11) Brute-force Attack: Automatically check for default/common credentials on the service and perform dictionnary attack if necessary.
12) Wordlists are optimized according to the targeted services.
Post-authentication Testing: Automatically perform some post-exploitation checks when valid credentials have been found.
Web Security Assessment
13) Large Focus on HTTP: More than 60 different security checks targeting HTTP supported for now.
14) Web Technologies Detection: Fingerprinting engine based on Wappalyzer is run prior to security checks, allowing to detect: Programming language, Framework, JS library, CMS, Web & Application Server.
15) Server Exploitation: Automatically scan and/or exploit most critical vulnerabilities (e.g. RCE) on web and application servers (e.g. JBoss, Tomcat, Weblogic, Websphere, Jenkins, etc.).
16) CMS Vulnerability Scanning: Automatically run vulnerability scanners on most common CMS (Wordpress, Drupal, Joomla, etc.).
π¦ πβπππΈπππππΈπππβ & βπβ:
1) Pull Jok3r Docker Image:
> sudo docker pull koutto/jok3r
2) Run fresh Docker container:
> sudo docker run -i -t --name jok3r-container -w /root/jok3r -e DISPLAY=$DISPLAY -v /tmp/.X11-unix:/tmp/.X11-unix --shm-size 2g --net=host koutto/jok3r
3) To re-run a stopped container:
> sudo docker start -i jok3r-container
4) To open multiple shells inside the container:
> sudo docker exec -it jok3r-container bash
5) To re-run a stopped container:
>sudo docker start -i jok3r-container
6) To open multiple shells inside the container:
> sudo docker exec -it jok3r-container bash
7)Show all the tools in the toolbox:
> python3 jok3r.py toolbox --show-all
8) Install all the tools in the toolbox (already done in Docker container):
> python3 jok3r.py toolbox --install-all --auto
9) Update all the tools in the toolbox and prompt each time to check update:
> python3 jok3r.py toolbox --update-all
10) Update all the tools in the toolbox without any prompt:
> python3 jok3r.py toolbox --update-all --auto
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ TIS Firewall Toolkit (FWTK)
the difference between the 4.2 TIS Firewall Toolkit and SOCKS by UndercOde :
twitter.com/UndercOdeTC
π¦ ππΌππ πππΈβπ
1) job of installing a firewall. These software are basically the same as SOCKS software, but the design strategy is different
> SOCKS using a set of Internet-related software performs all work, and TIS for each wish to use
a firewall utility provides a software. To illustrate the difference between the two, take world wide
web and Telnet as examples! In SOCKS, set a configuration file and a
2) After a daemon, both telnet and WWW can start to work, and other functions that have not been closed can also work
3) However, in TIS, you must set up separate configuration files and daemons for both WWW and telnet. After this
is set, the other functions are still unable to use the internet, unless you also make the relevant settings for these functions.
4) If a function (eg talk) no daemon, though there are "" plug-in "" daemon is available, but it is not
as flexible as other tools, but also easy to set. This may seem trivial, but it makes a big difference. Provided
comparison can be freely set when the SOCKS. If you set the SOCKS server is not perfect, from the internal network can be called up
with the original it does not intend to provide the internet functionality.
5) Such as the use of TIS, it can only be called from within the network system management
functions provided to you. SOCKS is easy to set up, easy to edit, and flexible. To ensure control by the
user within the protected network, the TIS higher security. But Both provide absolute protection, no outside
law to enter.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ TIS Firewall Toolkit (FWTK)
the difference between the 4.2 TIS Firewall Toolkit and SOCKS by UndercOde :
twitter.com/UndercOdeTC
π¦ ππΌππ πππΈβπ
1) job of installing a firewall. These software are basically the same as SOCKS software, but the design strategy is different
> SOCKS using a set of Internet-related software performs all work, and TIS for each wish to use
a firewall utility provides a software. To illustrate the difference between the two, take world wide
web and Telnet as examples! In SOCKS, set a configuration file and a
2) After a daemon, both telnet and WWW can start to work, and other functions that have not been closed can also work
3) However, in TIS, you must set up separate configuration files and daemons for both WWW and telnet. After this
is set, the other functions are still unable to use the internet, unless you also make the relevant settings for these functions.
4) If a function (eg talk) no daemon, though there are "" plug-in "" daemon is available, but it is not
as flexible as other tools, but also easy to set. This may seem trivial, but it makes a big difference. Provided
comparison can be freely set when the SOCKS. If you set the SOCKS server is not perfect, from the internal network can be called up
with the original it does not intend to provide the internet functionality.
5) Such as the use of TIS, it can only be called from within the network system management
functions provided to you. SOCKS is easy to set up, easy to edit, and flexible. To ensure control by the
user within the protected network, the TIS higher security. But Both provide absolute protection, no outside
law to enter.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦How to create a fake AP and sniff data With Kali-Parrot-updated 2019 ?
Pinterest.com/UndercOdeOfficial
π¦features:
SSLstrip2
Driftnet
Tshark
Full featured access point, with configurable speed limit
mitmproxy
Wireshark
DNS Spoofing
π¦ πβπππΈπππππΈπππβ & βπβ:
1) git clone https://github.com/xdavidhu/mitmAP
2) cd mitmAP
3) python3 mitmAP.py
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦How to create a fake AP and sniff data With Kali-Parrot-updated 2019 ?
Pinterest.com/UndercOdeOfficial
π¦features:
SSLstrip2
Driftnet
Tshark
Full featured access point, with configurable speed limit
mitmproxy
Wireshark
DNS Spoofing
π¦ πβπππΈπππππΈπππβ & βπβ:
1) git clone https://github.com/xdavidhu/mitmAP
2) cd mitmAP
3) python3 mitmAP.py
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ kernel editor- full Tutorial by Underc0de
π¦ ππΌππ πππΈβπ
1) Firstly Linux version to reinstall the Linux system (I used RedHat 3.0.3, after which are examples of this
version will prevail). The fewer the system software installed, the less problems and vulnerabilities, because these problems and vulnerability
problems on the system will be safe, so long as the minimum amount sufficient to install the software can be.
2) Selection of a stable
set of core. My system uses the Linux 2.0.14 kernel. So this file is set up with this kernel
3) As the basis. Re-edit the kernel based on the appropriate options. If you have not read
too Kernel HOWTO, Ethernet HOWTO and NET-
π¦ HOWTO, this time may wish to use this opportunity to read a
reading these HOWTO. Following are the network related settings in 'make config'.
> In General setup
Set Networking Support to ON
<> In Networking Options
1) Set Network firewalls to ON
Set TCP / IP Networking to ON
2) Set IP forwarding / gatewaying to OFF (unless you want to use IP filtering )
3) Set IP Firewalling to ON
4) Set IP firewall packet loggin to ON (not required, it is better to set it)
5) Set IP: masquerading to OFF (outside the scope of this article)
6) Set IP: accounting to ON
7) Set IP: tunneling to OFF
8) Set IP: aliasing to OFF.
9) Set IP: PC / TCP compatibility mode to OFF
10) Set IP: Reverse ARP to OFF
11) Set Drop source routed frames to ON
π¦ Network device support under item
1) Network device support is provided to the ON
2) Dummy net driver support is provided to the ON
3) disposed Ethernet (10 or 100Mbit) to the ON
4) Select the network card
is now re-edited and re-install the kernel, Restart. The network card should be displayed in the startup prompt. If you
Written by Underc0de
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ kernel editor- full Tutorial by Underc0de
π¦ ππΌππ πππΈβπ
1) Firstly Linux version to reinstall the Linux system (I used RedHat 3.0.3, after which are examples of this
version will prevail). The fewer the system software installed, the less problems and vulnerabilities, because these problems and vulnerability
problems on the system will be safe, so long as the minimum amount sufficient to install the software can be.
2) Selection of a stable
set of core. My system uses the Linux 2.0.14 kernel. So this file is set up with this kernel
3) As the basis. Re-edit the kernel based on the appropriate options. If you have not read
too Kernel HOWTO, Ethernet HOWTO and NET-
π¦ HOWTO, this time may wish to use this opportunity to read a
reading these HOWTO. Following are the network related settings in 'make config'.
> In General setup
Set Networking Support to ON
<> In Networking Options
1) Set Network firewalls to ON
Set TCP / IP Networking to ON
2) Set IP forwarding / gatewaying to OFF (unless you want to use IP filtering )
3) Set IP Firewalling to ON
4) Set IP firewall packet loggin to ON (not required, it is better to set it)
5) Set IP: masquerading to OFF (outside the scope of this article)
6) Set IP: accounting to ON
7) Set IP: tunneling to OFF
8) Set IP: aliasing to OFF.
9) Set IP: PC / TCP compatibility mode to OFF
10) Set IP: Reverse ARP to OFF
11) Set Drop source routed frames to ON
π¦ Network device support under item
1) Network device support is provided to the ON
2) Dummy net driver support is provided to the ON
3) disposed Ethernet (10 or 100Mbit) to the ON
4) Select the network card
is now re-edited and re-install the kernel, Restart. The network card should be displayed in the startup prompt. If you
Written by Underc0de
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦How To set two network cards, and network adress via firewalls ?
T.me/UndercOdeTesting
π¦ ππΌππ πππΈβπ
> PC if two network cards, most likely need to add a line in /etc/lilo.conf profile, indicating two
IRQ and address of the network card. In my machine, the added line of lilo.conf file is as follows:
append = "" ether = 12,0x300, eth0 ether = 15,0x340, eth1 ""
> Setting Network Addresses
1) Since the Internet is not going to let any of its own into the network of
any part, so the network does not require the actual URL. Stay in the Internet in a number of network addresses allows
free to use, because somehow need to address its own network, and these can not enter Internet addresses, stir
muddy globally. So you might choose these addresses. In these addresses, 192.168.2.XXX is retained in the
address, and therefore to use these addresses for illustration.
2) Because the proxy server is on two networks at the same time, it can send data from both sides in the middle.
199.1.2.10 ______ 192.168.2.1
_ _ | | / _____________
| / / | | | / | |
Internet ------------- | Firewall | -------- ----------- | Workstation |
_ / _ / _ / _ / | _____ | | __________ |
3) If you want to set a filtering firewall, you can still use these URLs, but you must use IP masquerading. After this
type of setting, the firewall will transfer the data packet, and attach the actual IP address sent to the Internet. In the network card
Internet end (outer end) of the first set the real IP address of the Ethernet card in the end provided
is 192.168.2.1.
4) This is the IP address of the proxy / gateway for this computer. Protected within all other network
computers can be selected in any 192.168.2.xxx as the address (from 192.168.2.2
to 192.168.2.254). In RedHat Linux,
an ifcfg-eth1 file must be added to the / etc / sysconfig / network-scripts directory, so that the
network and routing table can be set through this file during startup . The parameters of ifcfg-eth1 can be set as follows:
#! / bin / sh
# >>> Device type: ethernet
# >>> Variable declarations:
DEVICE = eth1
IPADDR = 192.168.2.1
NETMASK = 255.255.255.0
NETWORK = 192.168.2.0
BROADCAST = 192.168.2.255
GATEWAY = 199.1.2.10
ONBOOT = yes
# >>> End variable declarations You
5) can try these parameters to make the modem and ISP automatically connect. May wish to look at the ipup-ppp file. The data unit and
connected to the Internet, ISP assigns the IP address when connecting the outer end.
Written by Underc0de
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦How To set two network cards, and network adress via firewalls ?
T.me/UndercOdeTesting
π¦ ππΌππ πππΈβπ
> PC if two network cards, most likely need to add a line in /etc/lilo.conf profile, indicating two
IRQ and address of the network card. In my machine, the added line of lilo.conf file is as follows:
append = "" ether = 12,0x300, eth0 ether = 15,0x340, eth1 ""
> Setting Network Addresses
1) Since the Internet is not going to let any of its own into the network of
any part, so the network does not require the actual URL. Stay in the Internet in a number of network addresses allows
free to use, because somehow need to address its own network, and these can not enter Internet addresses, stir
muddy globally. So you might choose these addresses. In these addresses, 192.168.2.XXX is retained in the
address, and therefore to use these addresses for illustration.
2) Because the proxy server is on two networks at the same time, it can send data from both sides in the middle.
199.1.2.10 ______ 192.168.2.1
_ _ | | / _____________
| / / | | | / | |
Internet ------------- | Firewall | -------- ----------- | Workstation |
_ / _ / _ / _ / | _____ | | __________ |
3) If you want to set a filtering firewall, you can still use these URLs, but you must use IP masquerading. After this
type of setting, the firewall will transfer the data packet, and attach the actual IP address sent to the Internet. In the network card
Internet end (outer end) of the first set the real IP address of the Ethernet card in the end provided
is 192.168.2.1.
4) This is the IP address of the proxy / gateway for this computer. Protected within all other network
computers can be selected in any 192.168.2.xxx as the address (from 192.168.2.2
to 192.168.2.254). In RedHat Linux,
an ifcfg-eth1 file must be added to the / etc / sysconfig / network-scripts directory, so that the
network and routing table can be set through this file during startup . The parameters of ifcfg-eth1 can be set as follows:
#! / bin / sh
# >>> Device type: ethernet
# >>> Variable declarations:
DEVICE = eth1
IPADDR = 192.168.2.1
NETMASK = 255.255.255.0
NETWORK = 192.168.2.0
BROADCAST = 192.168.2.255
GATEWAY = 199.1.2.10
ONBOOT = yes
# >>> End variable declarations You
5) can try these parameters to make the modem and ISP automatically connect. May wish to look at the ipup-ppp file. The data unit and
connected to the Internet, ISP assigns the IP address when connecting the outer end.
Written by Underc0de
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Information gathering:
> Parrot-Kali Linux operating system provides some tools that can help users organize and organize the data of the target host, so that users get better late reconnaissance
twitter.com/UndercOdeTC
π¦ tools as follows:
Enumeration service
Test network range;
Identify active hosts and view open ports;
System fingerprint identification;
Service fingerprint identification;
Other means of information collection;
Use Maltego to collect information;
Draw a network diagram.
π¦so lets start Those Tutorials on Underc0de
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Information gathering:
> Parrot-Kali Linux operating system provides some tools that can help users organize and organize the data of the target host, so that users get better late reconnaissance
twitter.com/UndercOdeTC
π¦ tools as follows:
Enumeration service
Test network range;
Identify active hosts and view open ports;
System fingerprint identification;
Service fingerprint identification;
Other means of information collection;
Use Maltego to collect information;
Draw a network diagram.
π¦so lets start Those Tutorials on Underc0de
β β β ο½ππ»βΊπ«Δπ¬πβ β β β