β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦AMAZON NEW CARDING METHOD WORKS 100%How to Card Amazon :
π¦ππΌπ' π πππΈβπ
π¦ Method 1
Things you will need:
Quality CC/CVV to an address, full name, phone number, zip code, city, and
state (donβt get junk cards pay good money for good cards)
Socks 4/5 to the state and if you can the city since that would be perfect. This
sock must have never been used before so donβt be cheap and get a quality
sock. Socks are just as important as quality cards!
You will need programs to cleanup cookies and other flagging shit. Get
CCleaner- get the free version it has everything you need. Get the flash cookie
cleaner- it is free as well
Antidetect 7 or Fraudfox VM: These are not needed but they really increase
your carding success to almost 100% if used correctly and setup properly which
both are not very hard to do.
A drop address or if youβre carding digital items you donβt need that.
OK now letβs card
-------------------------X---------------------------------
You just need a Diners Club international cc, Indian NON-VBV
or AMEX, Some Amex are still working
Iβm listing some bins here which will work on Amazon.
542034542034 IN MASTERCARD CREDIT BANK OF INDIA
542086 IN MASTERCARD CREDIT ANDHRA BANK
376900 IN AMEX CREDIT AMERICAN EXPRESS
376901 IN AMEX CREDIT AMERICAN EXPRESS
376902 IN AMEX CREDIT AMERI EXPRESS
376903 IN AMEX CREDIT AMERI EXPRESS
#All are Non-VBV
π¦ First Method (Most successful)
Restart the computer and make sure you have used ccleaner and flash cookie
cleaner and they are running. Used disk cleanup in windows as well.
Create a new account on Amazon using a fresh good socks. Modern protection
against carding tracks the user's behavior on the site. Therefore, you must act as
a typical buyer, not jump directly to your product. Use the search, see different
knick-knacks, add them to the cart, but do not buy. It should be quite different
items, not those that you want to card.
After the virtual shopping logout from Amazon, leave the computer, and stop
the activity on it. Put it to sleep. After 5 or more hours, go back to Amazon and
clean your cart. Now letβs card.
Now find the items falling into the limit of your card somewhere between $30
and $150. Using a credit card, pay for the goods that you selected. You may need
to wait for amazon to approve your order or not. Sometimes itβs random I swear.
Now the order should have been accepted and shipped. If not, then you either
have a shitty card worth less than what you trying to card or you threw a flag. Go
back and check your setup. This is pretty full proof way to card amazon. If
everything is in place and you have your bases covered, you should be in and
out. Make sure you check to see if you IP leaking cause that would throw a flag
as well: https://www.dnsleaktest.com
Now we can also speed up this order if itβs in processing just so it doesnβt get
charged back and flagged before it gets shipped. Send amazon an email from
the email that you created for this account. Gmail is preferred email for this setup
as it is much more trustworthy do to its security signed up measures. Use an
excuse to make them speed it up. There is excuse kind of tie into what you are
buying. So letβs say you want a 800 dollar cannon camera then tell them that you
need it for β day for your college project or you will fail the class etc. Donβt forgetitβs real person on the other end so make your excuse real and donβt go too in
depth.
Now they may ask to call you on the phone number associated with the CC
account. This happens maybe 30% of the time. Just say OK and hope no one
picks up the phone on the other end and luck I on your side. If they send you
another email saying they tried to contact, you but no answer then simply say- βI
am so sorry I changed my number and I havenβt update it with my CC company
yetβ then give them a burner number where you can actually answer.
Now if all goes smooth then you have carded your first real item on Amazon.
Now that you have done that your account is trusted and you can place an order
π¦AMAZON NEW CARDING METHOD WORKS 100%How to Card Amazon :
π¦ππΌπ' π πππΈβπ
π¦ Method 1
Things you will need:
Quality CC/CVV to an address, full name, phone number, zip code, city, and
state (donβt get junk cards pay good money for good cards)
Socks 4/5 to the state and if you can the city since that would be perfect. This
sock must have never been used before so donβt be cheap and get a quality
sock. Socks are just as important as quality cards!
You will need programs to cleanup cookies and other flagging shit. Get
CCleaner- get the free version it has everything you need. Get the flash cookie
cleaner- it is free as well
Antidetect 7 or Fraudfox VM: These are not needed but they really increase
your carding success to almost 100% if used correctly and setup properly which
both are not very hard to do.
A drop address or if youβre carding digital items you donβt need that.
OK now letβs card
-------------------------X---------------------------------
You just need a Diners Club international cc, Indian NON-VBV
or AMEX, Some Amex are still working
Iβm listing some bins here which will work on Amazon.
542034542034 IN MASTERCARD CREDIT BANK OF INDIA
542086 IN MASTERCARD CREDIT ANDHRA BANK
376900 IN AMEX CREDIT AMERICAN EXPRESS
376901 IN AMEX CREDIT AMERICAN EXPRESS
376902 IN AMEX CREDIT AMERI EXPRESS
376903 IN AMEX CREDIT AMERI EXPRESS
#All are Non-VBV
π¦ First Method (Most successful)
Restart the computer and make sure you have used ccleaner and flash cookie
cleaner and they are running. Used disk cleanup in windows as well.
Create a new account on Amazon using a fresh good socks. Modern protection
against carding tracks the user's behavior on the site. Therefore, you must act as
a typical buyer, not jump directly to your product. Use the search, see different
knick-knacks, add them to the cart, but do not buy. It should be quite different
items, not those that you want to card.
After the virtual shopping logout from Amazon, leave the computer, and stop
the activity on it. Put it to sleep. After 5 or more hours, go back to Amazon and
clean your cart. Now letβs card.
Now find the items falling into the limit of your card somewhere between $30
and $150. Using a credit card, pay for the goods that you selected. You may need
to wait for amazon to approve your order or not. Sometimes itβs random I swear.
Now the order should have been accepted and shipped. If not, then you either
have a shitty card worth less than what you trying to card or you threw a flag. Go
back and check your setup. This is pretty full proof way to card amazon. If
everything is in place and you have your bases covered, you should be in and
out. Make sure you check to see if you IP leaking cause that would throw a flag
as well: https://www.dnsleaktest.com
Now we can also speed up this order if itβs in processing just so it doesnβt get
charged back and flagged before it gets shipped. Send amazon an email from
the email that you created for this account. Gmail is preferred email for this setup
as it is much more trustworthy do to its security signed up measures. Use an
excuse to make them speed it up. There is excuse kind of tie into what you are
buying. So letβs say you want a 800 dollar cannon camera then tell them that you
need it for β day for your college project or you will fail the class etc. Donβt forgetitβs real person on the other end so make your excuse real and donβt go too in
depth.
Now they may ask to call you on the phone number associated with the CC
account. This happens maybe 30% of the time. Just say OK and hope no one
picks up the phone on the other end and luck I on your side. If they send you
another email saying they tried to contact, you but no answer then simply say- βI
am so sorry I changed my number and I havenβt update it with my CC company
yetβ then give them a burner number where you can actually answer.
Now if all goes smooth then you have carded your first real item on Amazon.
Now that you have done that your account is trusted and you can place an order
between $500-$800 or until the card is maxed out. Stay below $2000 per order.
π¦ Max the card out as quick as you can but be inconspicuous and act like a real
buyer. The security for the most part are bots and the formulas they use are really
intense so when I say act like a real buyer I mean that or you will get limited and
blocked.
Just understand that these methods work 90% of the time and the majority of the
success of carding I on the carder himself and the setup he has. With Antidetect
or Fraudfox the carding success is closer to 95%. Amazon, eBay, and PayPal are
getting harder and harder to card and fraud every day and pretty soon it wonβt
be possible so understand that you need to have everything in tip top setup and
stay ahead of bots.
@UndercodeOfficial
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
buyer. The security for the most part are bots and the formulas they use are really
intense so when I say act like a real buyer I mean that or you will get limited and
blocked.
Just understand that these methods work 90% of the time and the majority of the
success of carding I on the carder himself and the setup he has. With Antidetect
or Fraudfox the carding success is closer to 95%. Amazon, eBay, and PayPal are
getting harder and harder to card and fraud every day and pretty soon it wonβt
be possible so understand that you need to have everything in tip top setup and
stay ahead of bots.
@UndercodeOfficial
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦FRESH PREMIUM PROXIES LAST LIST :
103.252.117.230 3128 1 hour ago
2410 ms 20% (55) in India - Tiruchi Elite -
3.22.47.81 8080 1 hour ago
4567 ms 5% (67) us United States - Columbus Elite -
68.183.208.248 80 1 hour ago
571 ms 23% (58) de Germany - Frankfurt am Main Elite -
80.241.222.138 80 1 hour ago
722 ms 100% (43) de Germany - Munich Elite -
79.115.245.227 8080 1 hour ago
3621 ms 17% (65) ro Romania - Oradea Elite -
180.252.181.3 80 1 hour ago
1167 ms 100% (45) id Indonesia - Samarinda Elite -
178.62.246.180 3128 1 hour ago
2963 ms 13% (58) nl Netherlands - Amsterdam Elite -
192.34.62.163 3128 1 hour ago
3034 ms 12% (61) us United States - North Bergen Elite -
188.40.183.187 1080 1 hour ago
1996 ms 77% (42) de Germany Elite -
109.172.43.35 3129 1 hour ago
4269 ms 39% (49) ru Russia - Lipetsk Elite -
144.217.101.242 3129 1 hour ago
754 ms 82% (38) ca Canada Elite -
173.192.128.238 25 1 hour ago
146 ms 100% (42) us United States - Seattle Elite -
36.91.58.207 8080 1 hour ago
4193 ms 8% (63) id Indonesia Elite -
60.205.132.71 80 1 hour ago
1576 ms 18% (57) cn China - Hangzhou Elite -
80.241.222.137 80 1 hour ago
763 ms 95% (37) de Germany - Munich Elite -
85.10.219.98 1080 1 hour ago
3843 ms 43% (64) de Germany Elite -
78.41.174.198 8081 1 hour ago
3689 ms 10% (63) sk Slovakia - Dunajska Luzna Elite -
88.99.10.248 1080 1 hour ago
1245 ms 61% (38) de Germany Elite -
148.251.153.6 1080 1 hour ago
1012 ms 63% (53) de Germany Elite -
159.8.114.37 8123 1 hour ago
334 ms 98% (35) fr France - Clichy Elite -
47.90.54.45 8080 1 hour ago
2077 ms 43% (56) hk Hong Kong Elite -
35.200.179.207 8118 1 hour ago
1025 ms 2% (73) us United States Elite -
39.137.69.10 8080 1 hour ago
2843 ms 20% (57) cn China Elite -
@UNDERCODETESTING
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦FRESH PREMIUM PROXIES LAST LIST :
103.252.117.230 3128 1 hour ago
2410 ms 20% (55) in India - Tiruchi Elite -
3.22.47.81 8080 1 hour ago
4567 ms 5% (67) us United States - Columbus Elite -
68.183.208.248 80 1 hour ago
571 ms 23% (58) de Germany - Frankfurt am Main Elite -
80.241.222.138 80 1 hour ago
722 ms 100% (43) de Germany - Munich Elite -
79.115.245.227 8080 1 hour ago
3621 ms 17% (65) ro Romania - Oradea Elite -
180.252.181.3 80 1 hour ago
1167 ms 100% (45) id Indonesia - Samarinda Elite -
178.62.246.180 3128 1 hour ago
2963 ms 13% (58) nl Netherlands - Amsterdam Elite -
192.34.62.163 3128 1 hour ago
3034 ms 12% (61) us United States - North Bergen Elite -
188.40.183.187 1080 1 hour ago
1996 ms 77% (42) de Germany Elite -
109.172.43.35 3129 1 hour ago
4269 ms 39% (49) ru Russia - Lipetsk Elite -
144.217.101.242 3129 1 hour ago
754 ms 82% (38) ca Canada Elite -
173.192.128.238 25 1 hour ago
146 ms 100% (42) us United States - Seattle Elite -
36.91.58.207 8080 1 hour ago
4193 ms 8% (63) id Indonesia Elite -
60.205.132.71 80 1 hour ago
1576 ms 18% (57) cn China - Hangzhou Elite -
80.241.222.137 80 1 hour ago
763 ms 95% (37) de Germany - Munich Elite -
85.10.219.98 1080 1 hour ago
3843 ms 43% (64) de Germany Elite -
78.41.174.198 8081 1 hour ago
3689 ms 10% (63) sk Slovakia - Dunajska Luzna Elite -
88.99.10.248 1080 1 hour ago
1245 ms 61% (38) de Germany Elite -
148.251.153.6 1080 1 hour ago
1012 ms 63% (53) de Germany Elite -
159.8.114.37 8123 1 hour ago
334 ms 98% (35) fr France - Clichy Elite -
47.90.54.45 8080 1 hour ago
2077 ms 43% (56) hk Hong Kong Elite -
35.200.179.207 8118 1 hour ago
1025 ms 2% (73) us United States Elite -
39.137.69.10 8080 1 hour ago
2843 ms 20% (57) cn China Elite -
@UNDERCODETESTING
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Proxy Anonymity Levels Explained :
> ) A more detailed explanation about the specifics can be found proxy levels explained page, but the basic behavior of each proxy level goes like this:
1) Transparent - target server knows your IP address and it knows that you are connecting via a proxy server.
2) Anonymous - target server does not know your IP address, but it knows that you're using a proxy.
3) Elite - target server does not know your IP address, or that the request is relayed through a proxy server.
π¦ How to use Proxy Servers?
1) Almost any application, such as your own web-browser, can be configured to route your connections through a proxy server for reasons of anonimity or performance.
2) Configuring your browser to use a proxy server is quick and easy, and the instructions for doing that are described in our articles section.
3) However, the recommended alternative to doing all those steps anytime you wish to use a different proxy, is to use our homemade proxy switcher that can simplify the whole process to just a few mouse clicks.
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Proxy Anonymity Levels Explained :
> ) A more detailed explanation about the specifics can be found proxy levels explained page, but the basic behavior of each proxy level goes like this:
1) Transparent - target server knows your IP address and it knows that you are connecting via a proxy server.
2) Anonymous - target server does not know your IP address, but it knows that you're using a proxy.
3) Elite - target server does not know your IP address, or that the request is relayed through a proxy server.
π¦ How to use Proxy Servers?
1) Almost any application, such as your own web-browser, can be configured to route your connections through a proxy server for reasons of anonimity or performance.
2) Configuring your browser to use a proxy server is quick and easy, and the instructions for doing that are described in our articles section.
3) However, the recommended alternative to doing all those steps anytime you wish to use a different proxy, is to use our homemade proxy switcher that can simplify the whole process to just a few mouse clicks.
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Introduction of commonly used Linux network security tools
1) γγAlthough various versions of Linux distribution comes with a lot of free open-source software, but there are still a large number of useful tools are not default.
γ
2) γIncluded in their installation CDs, there are in particular toolkits that can enhance Linux network security, and most of them are also open source free software.
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Introduction of commonly used Linux network security tools
1) γγAlthough various versions of Linux distribution comes with a lot of free open-source software, but there are still a large number of useful tools are not default.
γ
2) γIncluded in their installation CDs, there are in particular toolkits that can enhance Linux network security, and most of them are also open source free software.
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦γsecurity tips :
instagram.com/undercodeTesting
1) Execute #rpm -ivh sudo * to install, then edit / etc / sudoers file with / usr / sbin / visudo.
2) If the system prompts that you cannot find / usr / bin / vi but you actually have the vi program in the directory / bin, you need
ln -sf / bin / vi / usr / bin / vi creates symbolic links under / usr / bin for vi. (Note: I met on Redhat 6.1, there is no problem on Redhat 5.x)
γγ
3) Also, if some other error occurs, you may also need #chmod 700 / var / run / sudo
Here is my / etc / sudoers File example:
[root @ sh-proxy / etc] # more sudoers
Host_Alias ββSERVER = sh-proxy
# User alias specification
User_Alias ββADMIN = jephe, tome
# Cmnd alias specification
Cmnd_Alias ββSHUTDOWN = / etc / halt, / etc / shutdown, / etc / reboot
π¦ADMIN SERVER = SHUTDOWN
jephe SERVER = / usr / bin / tail -f / var / log / maillog
jephe SERVER = / usr / bin / tail -f / var / log / messages
# User privilege specification
root ALL = (ALL) ALL
-----------
π¦ γSince I often need to log in to the server remotely to observe the changes in the email log file / var / log / maillog, so I added this line to / etc / sudoers, so that I do nβt need to log in frequently as root to complete my daily work, improved safety.
written by undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦γsecurity tips :
instagram.com/undercodeTesting
1) Execute #rpm -ivh sudo * to install, then edit / etc / sudoers file with / usr / sbin / visudo.
2) If the system prompts that you cannot find / usr / bin / vi but you actually have the vi program in the directory / bin, you need
ln -sf / bin / vi / usr / bin / vi creates symbolic links under / usr / bin for vi. (Note: I met on Redhat 6.1, there is no problem on Redhat 5.x)
γγ
3) Also, if some other error occurs, you may also need #chmod 700 / var / run / sudo
Here is my / etc / sudoers File example:
[root @ sh-proxy / etc] # more sudoers
Host_Alias ββSERVER = sh-proxy
# User alias specification
User_Alias ββADMIN = jephe, tome
# Cmnd alias specification
Cmnd_Alias ββSHUTDOWN = / etc / halt, / etc / shutdown, / etc / reboot
π¦ADMIN SERVER = SHUTDOWN
jephe SERVER = / usr / bin / tail -f / var / log / maillog
jephe SERVER = / usr / bin / tail -f / var / log / messages
# User privilege specification
root ALL = (ALL) ALL
-----------
π¦ γSince I often need to log in to the server remotely to observe the changes in the email log file / var / log / maillog, so I added this line to / etc / sudoers, so that I do nβt need to log in frequently as root to complete my daily work, improved safety.
written by undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Sniffit :
1) sniffit is a well-known network port detector, you can configure it to run in the background to detect which Tcp / ip port user input / output information.
2) The most commonly used function is that an attacker can use it to detect the data transmission on your 23 (telnet) and 110 (pop3) ports to easily get your login password and mail account password. Sniffit is basically used by vandals.
3) Tools, but since you want to know how to enhance the security of your site, first of all you should know the various tools used by intruders.
4) The homepage of sniffit can be downloaded from git , the installation is very easy, just run #tar xvfz sniff * solution in the root directory Open all files to the corresponding directory.
5) You can run sniffit -i to view all input / output information on the specified network interface in an interactive graphical interface.
π¦For example: in order to get the pop3 account and password entered by all users when they receive mail through a certain interface abcd, you can run
#sniffit -p 110 -t abcd &
#sniffit -p 110 -s abcd &
record files in the directory / usr / doc / sniffit * below:
6) The log file is named according to the visitor's IP address, random high-end port number, and the network interface IP address and detection port used for detection. It takes advantage of the inherent weakness of the tcp / ip protocol, because the user name and password information transmitted by ordinary telnet and pop3 are plain text, without any encryption.
7) So for telnet / ftp. You can use ssh / scp instead. The ssh / scp information detected by sniffit is basically a bunch of garbled characters, so you do nβt need to worry about the username and password information sent by ssh being stolen by a third party.
written by undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Sniffit :
1) sniffit is a well-known network port detector, you can configure it to run in the background to detect which Tcp / ip port user input / output information.
2) The most commonly used function is that an attacker can use it to detect the data transmission on your 23 (telnet) and 110 (pop3) ports to easily get your login password and mail account password. Sniffit is basically used by vandals.
3) Tools, but since you want to know how to enhance the security of your site, first of all you should know the various tools used by intruders.
4) The homepage of sniffit can be downloaded from git , the installation is very easy, just run #tar xvfz sniff * solution in the root directory Open all files to the corresponding directory.
5) You can run sniffit -i to view all input / output information on the specified network interface in an interactive graphical interface.
π¦For example: in order to get the pop3 account and password entered by all users when they receive mail through a certain interface abcd, you can run
#sniffit -p 110 -t abcd &
#sniffit -p 110 -s abcd &
record files in the directory / usr / doc / sniffit * below:
6) The log file is named according to the visitor's IP address, random high-end port number, and the network interface IP address and detection port used for detection. It takes advantage of the inherent weakness of the tcp / ip protocol, because the user name and password information transmitted by ordinary telnet and pop3 are plain text, without any encryption.
7) So for telnet / ftp. You can use ssh / scp instead. The ssh / scp information detected by sniffit is basically a bunch of garbled characters, so you do nβt need to worry about the username and password information sent by ssh being stolen by a third party.
written by undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦Most oldest and most powerfull tools till nowdays :
fb.com/undercodeTesting
π¦ππΌπ' π πππΈβπ :
A ) ttysnoop (s)
1) ttysnoop is a program that redirects all input / output of one terminal number to another terminal. At present, the website I know of is http://uscan.cjb.net , but it ca nβt be connected. From other sources, I got ttysnoop-0.12c-5 at https://linux.die.net/man/8/ttysnoop This version does not seem to support shadow password, after installation you need to manually create the directory / var / spool / ttysnoop to test this program is interesting, the following Related instructions:
2) Change the default login login procedure of in.telnetd in /etc/inetd.conf to / sbin / ttysnoops, like this:
[root @ jephe / etc] # more inetd.conf | grep in.telnetd
telnet stream tcp nowait root / usr / sbin / tcpd in.telnetd -L / sbin / ttysnoops
3) After the change, be sure to run killall -HUP inetd to make it effective, make sure not to use shadow passwords, use #pwunconv to prohibit shadow passwords.
4) Then edit the file / etc / snooptab default configuration.
[root @ jephe / etc] # more snooptab
ttyS1 / dev / tty7 login / bin / login
ttyS2 / dev / tty8 login / bin / login
* socket login / bin / login
------
5) finally, if in a terminal Someone logged in (you can use the w command to see which terminal it is on), if the terminal device is ttyp0, then you can log in to the server and type in # / bin / ttysnoop ttyp0 (prompt for the root password, again, the above mentioned This version does not support shadow passwords) to monitor the user's login window.
B) nmap
1) nmap is a tool for port scanning on a relatively large network. It can detect which tcp / ip ports are currently open on the server. You can run it to ensure that unsafe port numbers that should not be opened have been banned.
2) The nmap homepage provides a simple example below at https://nmap.org/
:
[root @ sh-proxy / etc] # / usr / local / bin / nmap public.sta.net .cn
Starting nmap V. 2.12 by Fyodor ( fyodor@dhp.com, www.insecure.org/nmap/)
Interesting ports on public.sta.net.cn (202.96.199.97):
Port State Protocol Service
21 open tcp ftp
23 open tcp telnet
25 open tcp smtp
109 open tcp pop-2
110 open tcp pop-3
143 open tcp imap2
513 open tcp login
514 open tcp shell
7000 open tcp afs3-fileserver
Nmap run completed-1 IP address (1 host up) scanned in 15 seconds
C) John the ripper
1) in Linux, the password is hash The format is stored, you cannot reversely analyze the password from the hash data table, but you can compare it with a group of words hash, if the same, then guess the password. Therefore, it is very critical to create a password that is difficult to guess. In general, you can never use a word in a dictionary as a password, it is quite easy to guess. In addition, some common regular alphanumeric arrangements cannot be used as passwords, such as 123abc.
2) John the ripper is an efficient and easy-to-use password guessing program whose homepage is athttp://www.openwall.com/john/
download the tar.gz format for UNIX program, and then use tar xvfz john * .tar.gz to unzip to any directory. Enter the src directory, enter make linux-x86-any-elf (I use redhat 6.1) will generate several execution files in the run directory, including the main program john. Now if you want the Crack password, just run ./john / etc / passwd.
3) John can also crack the password generated by htpasswd to verify the apache user. If you create a user user with htpasswd -c apachepasswd user and generate a password, you can also use john apachepasswd to guess. John outputs it on the terminal when guessing the password, and stores the guessed password in the john.pot file.
written by undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦Most oldest and most powerfull tools till nowdays :
fb.com/undercodeTesting
π¦ππΌπ' π πππΈβπ :
A ) ttysnoop (s)
1) ttysnoop is a program that redirects all input / output of one terminal number to another terminal. At present, the website I know of is http://uscan.cjb.net , but it ca nβt be connected. From other sources, I got ttysnoop-0.12c-5 at https://linux.die.net/man/8/ttysnoop This version does not seem to support shadow password, after installation you need to manually create the directory / var / spool / ttysnoop to test this program is interesting, the following Related instructions:
2) Change the default login login procedure of in.telnetd in /etc/inetd.conf to / sbin / ttysnoops, like this:
[root @ jephe / etc] # more inetd.conf | grep in.telnetd
telnet stream tcp nowait root / usr / sbin / tcpd in.telnetd -L / sbin / ttysnoops
3) After the change, be sure to run killall -HUP inetd to make it effective, make sure not to use shadow passwords, use #pwunconv to prohibit shadow passwords.
4) Then edit the file / etc / snooptab default configuration.
[root @ jephe / etc] # more snooptab
ttyS1 / dev / tty7 login / bin / login
ttyS2 / dev / tty8 login / bin / login
* socket login / bin / login
------
5) finally, if in a terminal Someone logged in (you can use the w command to see which terminal it is on), if the terminal device is ttyp0, then you can log in to the server and type in # / bin / ttysnoop ttyp0 (prompt for the root password, again, the above mentioned This version does not support shadow passwords) to monitor the user's login window.
B) nmap
1) nmap is a tool for port scanning on a relatively large network. It can detect which tcp / ip ports are currently open on the server. You can run it to ensure that unsafe port numbers that should not be opened have been banned.
2) The nmap homepage provides a simple example below at https://nmap.org/
:
[root @ sh-proxy / etc] # / usr / local / bin / nmap public.sta.net .cn
Starting nmap V. 2.12 by Fyodor ( fyodor@dhp.com, www.insecure.org/nmap/)
Interesting ports on public.sta.net.cn (202.96.199.97):
Port State Protocol Service
21 open tcp ftp
23 open tcp telnet
25 open tcp smtp
109 open tcp pop-2
110 open tcp pop-3
143 open tcp imap2
513 open tcp login
514 open tcp shell
7000 open tcp afs3-fileserver
Nmap run completed-1 IP address (1 host up) scanned in 15 seconds
C) John the ripper
1) in Linux, the password is hash The format is stored, you cannot reversely analyze the password from the hash data table, but you can compare it with a group of words hash, if the same, then guess the password. Therefore, it is very critical to create a password that is difficult to guess. In general, you can never use a word in a dictionary as a password, it is quite easy to guess. In addition, some common regular alphanumeric arrangements cannot be used as passwords, such as 123abc.
2) John the ripper is an efficient and easy-to-use password guessing program whose homepage is athttp://www.openwall.com/john/
download the tar.gz format for UNIX program, and then use tar xvfz john * .tar.gz to unzip to any directory. Enter the src directory, enter make linux-x86-any-elf (I use redhat 6.1) will generate several execution files in the run directory, including the main program john. Now if you want the Crack password, just run ./john / etc / passwd.
3) John can also crack the password generated by htpasswd to verify the apache user. If you create a user user with htpasswd -c apachepasswd user and generate a password, you can also use john apachepasswd to guess. John outputs it on the terminal when guessing the password, and stores the guessed password in the john.pot file.
written by undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
Facebook
Log in or sign up to view
See posts, photos and more on Facebook.
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ what is
> Logcheck ?
1) Logcheck is used to automatically check the system security intrusion events and abnormal activity records A tool that analyzes various Linux log files,
2) such as / var / log / messages, / var / log / secure, / var / log / maillog, etc., and then generates a problem report that may have security problems and automatically sends email to the administrator . You can set it to run automatically on an hourly or daily basis with crond.
3) The homepage of the logcheck tool is at http://logcheck.org/After downloading, use tar xvfz logcheck *
> to unzip to a temporary directory such as / tmp, and then use ./make linux to automatically generate the corresponding files to / usr / local / etc, / usr / local / bin / etc., you may Change settings such as who can send notifications to the mail account, which is sent to root by default, you can set root's mail alias account to a group of people, change the settings to ignore certain types of messages such as plug-gw in your mail log file Because plug-gw does reverse IP lookup,
4) if it can't find it, it records a warning message to / var / log / maillog, logcheck logs all these warnings to you by default, you can ignore them by setting.
5) Use the logcheck tool to analyze all your logfiles, avoiding you from manually checking them every day, saving time and improving efficiency.
written by undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β ββ β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ what is
> Logcheck ?
1) Logcheck is used to automatically check the system security intrusion events and abnormal activity records A tool that analyzes various Linux log files,
2) such as / var / log / messages, / var / log / secure, / var / log / maillog, etc., and then generates a problem report that may have security problems and automatically sends email to the administrator . You can set it to run automatically on an hourly or daily basis with crond.
3) The homepage of the logcheck tool is at http://logcheck.org/After downloading, use tar xvfz logcheck *
> to unzip to a temporary directory such as / tmp, and then use ./make linux to automatically generate the corresponding files to / usr / local / etc, / usr / local / bin / etc., you may Change settings such as who can send notifications to the mail account, which is sent to root by default, you can set root's mail alias account to a group of people, change the settings to ignore certain types of messages such as plug-gw in your mail log file Because plug-gw does reverse IP lookup,
4) if it can't find it, it records a warning message to / var / log / maillog, logcheck logs all these warnings to you by default, you can ignore them by setting.
5) Use the logcheck tool to analyze all your logfiles, avoiding you from manually checking them every day, saving time and improving efficiency.
written by undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ what is
> Logcheck ?
1) Logcheck is used to automatically check the system security intrusion events and abnormal activity records A tool that analyzes various Linux log files,
2) such as / var / log / messages, / var / log / secure, / var / log / maillog, etc., and then generates a problem report that may have security problems and automatically sends email to the administrator . You can set it to run automatically on an hourly or daily basis with crond.
3) The homepage of the logcheck tool is at http://logcheck.org/After downloading, use tar xvfz logcheck *
> to unzip to a temporary directory such as / tmp, and then use ./make linux to automatically generate the corresponding files to / usr / local / etc, / usr / local / bin / etc., you may Change settings such as who can send notifications to the mail account, which is sent to root by default, you can set root's mail alias account to a group of people, change the settings to ignore certain types of messages such as plug-gw in your mail log file Because plug-gw does reverse IP lookup,
4) if it can't find it, it records a warning message to / var / log / maillog, logcheck logs all these warnings to you by default, you can ignore them by setting.
5) Use the logcheck tool to analyze all your logfiles, avoiding you from manually checking them every day, saving time and improving efficiency.
written by undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β ββ β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ what is
> Logcheck ?
1) Logcheck is used to automatically check the system security intrusion events and abnormal activity records A tool that analyzes various Linux log files,
2) such as / var / log / messages, / var / log / secure, / var / log / maillog, etc., and then generates a problem report that may have security problems and automatically sends email to the administrator . You can set it to run automatically on an hourly or daily basis with crond.
3) The homepage of the logcheck tool is at http://logcheck.org/After downloading, use tar xvfz logcheck *
> to unzip to a temporary directory such as / tmp, and then use ./make linux to automatically generate the corresponding files to / usr / local / etc, / usr / local / bin / etc., you may Change settings such as who can send notifications to the mail account, which is sent to root by default, you can set root's mail alias account to a group of people, change the settings to ignore certain types of messages such as plug-gw in your mail log file Because plug-gw does reverse IP lookup,
4) if it can't find it, it records a warning message to / var / log / maillog, logcheck logs all these warnings to you by default, you can ignore them by setting.
5) Use the logcheck tool to analyze all your logfiles, avoiding you from manually checking them every day, saving time and improving efficiency.
written by undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Enhance network security with SYN packet features full by undercode :
1) Consider the following situation: the
internal network is 198.199.1.0, using linux as a router and firewall to connect to the Internet. On the firewall, eth0 connects to the external network and eth1 connects to the internal network.
2) For the security of the www service, set the following set of ipchains rules:
> ipchains -A input -p tcp -s 198.199.1.0/24: 1024 -d 0.0.0.0/0 www -i eth1 -j ACCEPT
> ipchains -A input -p tcp -s 0.0.0.0/0 www -d 198.199.1.0/24 1024: -i eth0 -j ACCEPT
> In the above settings, only internal users are allowed to access www hosts on the Internet through ports above 1024 (undefined port) ; In other words, allow ports greater than 1024 on the intranet host to connect to port 80 on the Internet. Imagine that this will allow hosts on the Internet to use port 80 to connect to a port on your intranet host that is greater than 1024. From this, we see that there is a security risk in the system because there are many service ports that are greater than 1024. So, how to overcome this hidden danger, we can use the characteristics of the SYN package to eliminate this hidden danger.
3) Let us first take a look at the flag bit of the TCP data segment header. There are six flag bits in TCP, namely: URG, ACK, PSH, RST, SYN and FIN. Let's focus on the ACK, SYN and FIN flags.
4) ACK: indicates whether the confirmation number is legal, 1 means legal, and 0 means the confirmation number is invalid. The acknowledgment number refers to the next byte you want to receive instead of the bytes that have been received previously. It can be seen that the ACK of the packet that initiated the connection establishment request (that is, the first packet) is always set to 0, and the subsequent packets are always set to 1.
5) SYN: used to establish a connection. In the connection request, SYN = 1, in the connection request confirmation, SYN = 1. Therefore, SYN stands for CONNECTION REQUEST and CONNECTION ACCEPTED. In subsequent TCP packets, SYN is always set to 0.
FIN: used to cancel the connection.
6) The above can be summarized with the following table:
ACK flag bit SYN flag bit The meaning of the TCP packet
0 1 connection request
1 1 connection request confirmation (accept connection request)
1 0 confirmation connection request confirmation
1 0 data packet
... ...
our so-called SYN packet is a connection request packet. As shown above, the SYN packet has the following characteristics: SYN = 1, ACK = 0, FIN = 0. Therefore, in order to filter connection request packets, it is sufficient to filter out SYN packets.
In ipchains, we can specify the SYN package like this:
-p tcp -s xxxx / x -y
7) If you can define all SYN packages from 192.168.1.0 like this:
-p tcp -s 192.168.1.0/24 -y
we can also Precede -y to define all non-SYN packets:
-P tcp -s xxxx / x! -Y
8) So, in the above example, we can enhance the security of the network like this:
ipchains -A input -p tcp -s 198.199.1.0/24: 1024 -d 0.0.0.0/0 www -i eth1 -j ACCEPT
ipchains -A input -p tcp -y -s 0.0.0.0/0 www -d 198.199.1.0/24 1024:! -i eth0 -j ACCEPT
π¦ This will prohibit the use of hosts on the Internet 80 port to connect to your internal network host A port greater than 1024, so as to achieve the purpose of enhancing network security.
Reference materials:
1. IPCHANIS-HOWTO
2. Internet firewall domain network security
3. Computer network
written by undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
1) Consider the following situation: the
internal network is 198.199.1.0, using linux as a router and firewall to connect to the Internet. On the firewall, eth0 connects to the external network and eth1 connects to the internal network.
2) For the security of the www service, set the following set of ipchains rules:
> ipchains -A input -p tcp -s 198.199.1.0/24: 1024 -d 0.0.0.0/0 www -i eth1 -j ACCEPT
> ipchains -A input -p tcp -s 0.0.0.0/0 www -d 198.199.1.0/24 1024: -i eth0 -j ACCEPT
> In the above settings, only internal users are allowed to access www hosts on the Internet through ports above 1024 (undefined port) ; In other words, allow ports greater than 1024 on the intranet host to connect to port 80 on the Internet. Imagine that this will allow hosts on the Internet to use port 80 to connect to a port on your intranet host that is greater than 1024. From this, we see that there is a security risk in the system because there are many service ports that are greater than 1024. So, how to overcome this hidden danger, we can use the characteristics of the SYN package to eliminate this hidden danger.
3) Let us first take a look at the flag bit of the TCP data segment header. There are six flag bits in TCP, namely: URG, ACK, PSH, RST, SYN and FIN. Let's focus on the ACK, SYN and FIN flags.
4) ACK: indicates whether the confirmation number is legal, 1 means legal, and 0 means the confirmation number is invalid. The acknowledgment number refers to the next byte you want to receive instead of the bytes that have been received previously. It can be seen that the ACK of the packet that initiated the connection establishment request (that is, the first packet) is always set to 0, and the subsequent packets are always set to 1.
5) SYN: used to establish a connection. In the connection request, SYN = 1, in the connection request confirmation, SYN = 1. Therefore, SYN stands for CONNECTION REQUEST and CONNECTION ACCEPTED. In subsequent TCP packets, SYN is always set to 0.
FIN: used to cancel the connection.
6) The above can be summarized with the following table:
ACK flag bit SYN flag bit The meaning of the TCP packet
0 1 connection request
1 1 connection request confirmation (accept connection request)
1 0 confirmation connection request confirmation
1 0 data packet
... ...
our so-called SYN packet is a connection request packet. As shown above, the SYN packet has the following characteristics: SYN = 1, ACK = 0, FIN = 0. Therefore, in order to filter connection request packets, it is sufficient to filter out SYN packets.
In ipchains, we can specify the SYN package like this:
-p tcp -s xxxx / x -y
7) If you can define all SYN packages from 192.168.1.0 like this:
-p tcp -s 192.168.1.0/24 -y
we can also Precede -y to define all non-SYN packets:
-P tcp -s xxxx / x! -Y
8) So, in the above example, we can enhance the security of the network like this:
ipchains -A input -p tcp -s 198.199.1.0/24: 1024 -d 0.0.0.0/0 www -i eth1 -j ACCEPT
ipchains -A input -p tcp -y -s 0.0.0.0/0 www -d 198.199.1.0/24 1024:! -i eth0 -j ACCEPT
π¦ This will prohibit the use of hosts on the Internet 80 port to connect to your internal network host A port greater than 1024, so as to achieve the purpose of enhancing network security.
Reference materials:
1. IPCHANIS-HOWTO
2. Internet firewall domain network security
3. Computer network
written by undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β β