▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Intel processor reveals two new SGX vulnerabilities attackers can easily extract sensitive data :

1) While Intel is working to eliminate the negative effects of multiple processor vulnerabilities, security researchers at the three universities once again relentlessly exposed two other flaws in the SGX software protection extension instructions.

2) For attackers, this allows them to extract sensitive data fairly easily. Fortunately, new issues can be fixed through active remedies, and there is currently no evidence that new vulnerabilities have been exploited in the wild.

3) Researchers from three universities in Michigan, Amsterdam, Netherlands, and Adelaide, Australia disclosed that attackers can use the multi-core architecture to work to gain access to sensitive data on infected systems.

4) It has developed corresponding attack methods for the two vulnerabilities, and gave proofs of concept for SGAxe and CrossTalk.

5) The former appears to be an advanced version of the CacheOut attack exposed earlier this year, and hackers can extract content from the CPU's L1 cache.

6) The researchers explained that SGAxe is a failed attempt by Intel to mitigate the bypass attack against the software protection extension (SGX). As a dedicated area on the CPU, SGX originally intended to ensure the integrity and confidentiality of the code and data being processed.

7) With the help of a transient execution attack, a hacker can essentially recover the encryption key stored in the SGX area and use it to decrypt the long storage area to obtain the machine's EPID key. The latter is used to ensure the security of transactions, such as financial transactions and DRM-protected content.

8) As for the second CrossTalk vulnerability, which is a derivative of Microarchitecture Data Sampling (MDS), it can attack data processed by the Line Fill Buffer (LBF) of the CPU.

9) t originally wanted to provide a "staging buffer" for CPU core access, but hackers were able to use specially-made software running on a separate core to destroy the software code and data private key that protected it.

10) It is reported that the new vulnerability affects many Intel processors released from 2015 to 2019, including some Xeon E3 SKUs (E5 and E7 series have been proven to be resistant to this new type of attack).

11) Intel said in a June security bulletin that only a very small number of people can launch these attacks in a laboratory environment, and there are currently no reports of exploits in the wild.

12) Even so, the company will still release microcode updates as soon as possible, while invalidating previously issued certification keys.

@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Practice Your Skills :

> WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons.

> This program is a demonstration of common server-side application flaws. The exercises are intended to be used by people to learn about application security and penetration testing techniques.

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1️⃣ git clone https://github.com/WebGoat/WebGoat.git

2️⃣-run-using-docker

> docker run -p 8080:8080 -p 9090:9090 -e TZ=Europe/Amsterdam webgoat/goatandwolf

3️⃣WebGoat will be located at: http://127.0.0.1:8080/WebGoat WebWolf will be located at: http://127.0.0.1:9090/WebWolf

Important:
> Choose the correct timezone, so that the docker container and your host are in the same timezone. As it important for the validity of JWT tokens used in certain exercises.

4️⃣Using docker stack deploy

> Another way to deply WebGoat and WebWolf in a more advanced way is to use a compose-file in a docker stack deploy. You can define which containers should run in which combinations and define all of this in a yaml file. An example of such a file is: goat-with-reverseproxy.yaml

5️⃣This sets up an nginx webserver as reverse proxy to WebGoat and WebWolf. You can change the timezone by adjusting the value in the yaml file.

6️⃣docker stack init

> docker stack deploy --compose-file goat-with-reverseproxy.yaml webgoatdemo

7️⃣Add the following entries in your local hosts file:

127.0.0.1 www.webgoat.local www.webwolf.localhost
You can use the overall start page: http://www.webgoat.local or:

8️⃣WebGoat will be located at: http://www.webgoat.local/WebGoat

WebWolf will be located at: http://www.webwolf.local/WebWolf

Important:
> the current directory on your host will be mapped into the container for keeping state.

🦑Another way :

Standalone
1️⃣Download the latest WebGoat and WebWolf release from https://github.com/WebGoat/WebGoat/releases

java -jar webgoat-server-8.1.0.jar [--server.port=8080] [--server.address=localhost]
java -jar webwolf-8.1.0.jar [--server.port=9090] [--server.address=localhost]
The latest version of WebGoat needs Java 11 or above. By default WebGoat and WebWolf start on port 8080 and 9090 with --server.port you can specify a different port. With server.address you can bind it to a different address (default localhost)

🦑Or

> Run from the sources

1️⃣Prerequisites:

-Java 11
-Maven > 3.2.1
-Your favorite IDE
-Git, or Git support in your IDE

2️⃣Open a command shell/window:

git clone git@github.com:WebGoat/WebGoat.git

Now let's start by compiling the project.

3️⃣cd WebGoat

4️⃣git checkout <<branch_name>>
mvn clean install

5️⃣Now we are ready to run the project. WebGoat 8.x is using Spring-Boot.

mvn -pl webgoat-server spring-boot:run
... you should be running webgoat on localhost:8080/WebGoat momentarily

6️⃣To change IP address add the following variable to WebGoat/webgoat-container/src/main/resources/application.properties file

>server.address=x.x.x.x

@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

More details about the new intel bug/Vulnerability

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑FREE SPYWARES POPULAR 2020 :

- Spyeye - Script To Generate Win32 .Exe File To Take Screenshots

- Words Scraper - Selenium Based Web Scraper To Generate Passwords List

- JSshell - A JavaScript Reverse Shell For Exploiting XSS Remotely Or Finding Blind XSS, Working With Both Unix And Windows OS

- Astsu - A Network Scanner Tool

- Git-Scanner - A Tool For Bug Hunting Or Pentesting For Targeting Websites That Have Open .git Repositories Available In Public

- Recox - Master Script For Web Reconnaissance

- Jshole - A JavaScript Components Vulnrability Scanner, Based On RetireJS

- GitMonitor - A Github Scanning System To Look For Leaked Sensitive Information Based On Rules

- Eviloffice - Inject Macro And DDE Code Into Excel And Word Documents (Reverse Shell)

- Ligolo - Reverse Tunneling Made Easy For Pentesters, By Pentesters

- Inshackle - Instagram Hacks: Track Unfollowers, Increase Your Followers, Download Stories, Etc

- GhostShell - Malware Indetectable, With AV Bypass Techniques, Anti-Disassembly, And More

- Forerunner - Fast And Extensible Network Scanning Library Featuring Multithreading, Ping Probing, And Scan Fetchers

- Enumy - Linux Post Exploitation Privilege Escalation Enumeration

- Bing-Ip2Hosts - Bingip2Hosts Is A Bing.com Web Scraper That Discovers Websites By IP Address

- Vault - A Tool For Secrets Management, Encryption As A Service, And Privileged Access Management

- ADCollector - A Lightweight Tool To Quickly Extract Valuable Information From The Active Directory Environment For Both Attacking And Defending

- ANDRAX v5R NH-Killer - Penetration Testing on Android

- DroidFiles - Get Files From Android Directories

- Purify - All-in-one Tool For Managing Vulnerability Reports From AppSec
Pipelines



✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁


🦑Collects information from an email and shows results in a nice visual interface.

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :


1️⃣git clone https://gitlab.com/kennbroorg/iKy.git

2️⃣cd $IKY_CLONE/install/iKyEasyInstall

3️⃣./iKyEasyInstall.sh # At some point the script will request credentials for sudo


✅Verified on :

-kali
-ubuntu

🦑Kali - ubuntu video tutorial

> https://gitlab.com/kennbroorg/iKy/-/wikis/Videos/Installations


@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑X404 NORDVPN PREMIUM✅✅

pastebin.com/KvcpshGX

not cracked by undercode-Testing

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑2020 Hijack services that relies on QR Code Authentication :


🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1️⃣git clone https://github.com/thelinuxchoice/ohmyqr

2️⃣cd ohmyqr

3️⃣bash ohmyqr.sh

🦑How it Works ?

QRLJacking or Quick Response Code Login Jacking is a simple social engineering attack vector capable of session hijacking affecting all applications that rely on the “Login with QR code” feature as a secure way to login into accounts. In a nutshell, the victim scans the attacker’s QR code which results in session hijacking.

✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Network configuration-Prevent users from browsing using external proxies by Undercode :

Some background knowledge:

1️⃣ HTTP/1.0 protocol defines web server and When the client uses a proxy, in the
HTTP request and response headers, use Via: to identify the proxy server used to prevent the
server loop;

2️⃣ snort is an open source IDS (intrusion detection system) that can be used Host or network IDS. With many IDS
rules, it can perform pattern recognition and matching on the captured (ip, tcp, udp, icmp) packets, and can generate corresponding records.

3️⃣ libnet is open source software that can be used as a network protocol/packet generator.

4️⃣ The TCP/IP network is a packet-switched network.

5️⃣ Snort also has the function of generating IP packets using the libnet library. You can interrupt the TCP connection by issuing a TCP_RESET packet.

🦑 Prerequisites:

1️⃣Snort runs on the route (linux) or through the port mirror function of the switch, runs on the same
network segment of the route

🦑 Implementation:

1️⃣ compile snort with flexresp(flex response) feature

2️⃣ Define snort rules:
alert tcp $HOME_NET any <> $EXTER_NET 80 (msg:"block proxy"; uricontent:"Via:"; resp: rst_all;)

🦑 Effect:

> Internal network users can browse external websites normally.

> If the internal user’s browser is configured with an external proxy, the
HTTP REQUEST and RESPONSE headers will include Via: ... characters, and snort rules will capture this connection, and then

> Send RST packets to client and server sockets. In this way, the TCP connection is terminated.

Written by Undercode
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑2020 updated Reverse Tunneling made easy for pentesters, by pentesters

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1️⃣cd go env GOPATH/src

2️⃣git clone https://github.com/sysdream/ligolo

3️⃣cd ligolo

4️⃣make dep

5️⃣Generate self-signed TLS certificates (will be placed in the certs folder)
make certs TLS_HOST=example.com

NOTE: You can also use your own certificates by using the TLS_CERT make option when calling build. Example: make build-all TLS_CERT=certs/mycert.pem.

6️⃣Build

make build-all

> 3.2. (or) For the current architecture
make build

✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑A fast, modern, zero-conf load balancing HTTP(S) router for deploying microservices:

🦑FEATURES :

>Access Logging - customizable access logs

>Access Control - route specific access control

>Certificate Stores - dynamic certificate stores like file system, HTTP server, Consul and Vault

>Compression - GZIP compression for HTTP responses

>Docker Support - Official Docker image, Registrator and Docker Compose example

>Dynamic Reloading - hot reloading of the routing table without downtime

>Graceful Shutdown - wait until requests have completed before shutting down

>HTTP Header Support - inject some HTTP headers into upstream requests

>HTTPS Upstreams - forward requests to HTTPS upstream servers

>Metrics Support - support for Graphite, StatsD/DataDog and Circonus

>PROXY Protocol Support - support for HA Proxy PROXY protocol for inbound requests (use for Amazon ELB)

>Path Stripping - strip prefix paths from incoming requests

>Server-Sent Events/SSE - support for Server-Sent Events/SSE

>TCP Proxy Support - raw TCP proxy support

>TCP-SNI Proxy Support - forward TLS connections based on hostname without re-encryption

>Traffic Shaping - forward N% of traffic upstream without knowing the number of instances

>Web UI - web ui to examine the current routing table

>Websocket Support - websocket support

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

Install from source, binary, Docker or Homebrew.

# go 1.9 or higher is required

1️⃣get github.com/fabiolb/fabio (>= go1.9)

2️⃣brew install fabio (OSX/macOS stable)

brew install --devel fabio (OSX/macOS devel)

3️⃣docker pull fabiolb/fabio (Docker)

https://github.com/fabiolb/fabio/releases (pre-built binaries)

4️⃣Register your service in consul.

5️⃣Make sure that each instance registers with a unique ServiceID and a service name without spaces.

6️⃣Register a health check in consul as described here.

7️⃣By default fabio only watches services which have a passing health check, unless overriden with registry.consul.service.status.

8️⃣Register one urlprefix- tag per host/path prefix it serves, e.g.:

#HTTP/S examples
urlprefix-/css # path route
urlprefix-i.com/static # host specific path route
urlprefix-mysite.com/ # host specific catch all route
urlprefix-/foo/bar strip=/foo # path stripping (forward '/bar' to upstream)
urlprefix-/foo/bar proto=https # HTTPS upstream
urlprefix-/foo/bar proto=https tlsskipverify=true # HTTPS upstream and self-signed cert

#TCP examples
urlprefix-:3306 proto=tcp # route external port 3306
Make sure the prefix for HTTP routes contains at least one slash (/).

9️⃣See the full list of options in the Documentation.

🔟Start fabio without a config file (assuming a running consul agent on localhost:8500) Watch the log output how fabio picks up the route to your service. Try starting/stopping your service to see how the routing table changes instantly.

> Send all your HTTP traffic to fabio on port 9999. For TCP proxying see TCP proxy.


Done
✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

#Support & Share :

T.me/UndercodeTesting

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑WIFI HACKING TOOLS 2020 POPULLAR

🦑 Hak5's Wi-Fi Pineapple

Fully-integrated Wi-Fi man-in-the-middle platform and rogue access point.

[Site](https://www.wifipineapple.com/)
Wiki

🦑 Aircrack-ng

Complete suite of tools to monitor, capture, export, attack and crack wireless
networks.

[Site](https://www.aircrack-ng.org/)

🦑 Airsnort

Site

🦑 Kismet

Useful for troubleshooting Wi-Fi networks. Detects hidden networks.

[Site](https://www.kismetwireless.net/)

🦑Kismac-ng

Network stumbling tool that works on Mac OS X and features support for built-in
WLAN NICs on some Macs.

Site

🦑Fern WiFi Cracker

Automated cracking and nice monitoring capabilities. Very easy to use.

[Site](http://www.fern-pro.com/)

🦑Cowpatty

Features offline dictionary cracking for WPA networks.

Site

🦑 Ghost Phisher

Tool designed around sniffing passwords with an AP emulator, DHCP/DNS/HTTP
server and logging to a built-in database.

[Site](https://github.com/savio-code/ghost-phisher)

# Online Wireless Resources

🦑Wigle.net

Consolidated location and information of wireless networks world-wide in a
centralized database--queried and updated via web app, native clients and
mobile applications.

Site

@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Additional Notes for wireless pentest adapter
> which one should you choose :


1️⃣ Atheros (AR5XXX, AR9XXX)
Atheros chipsets have been used by many pen testers in the industry because the ability to perform well with many different systems and because it is open source. The main challenge with these drivers is that many laptops have migrated from PCMCIA bus and support for external Atheros-based cards is pretty limited.

2️⃣ Realtek (RTL8187)
The RTL8187 driver is used in many Alfa adapters (USB adapters). The RTL8187 driver is supported by the Linux kernel for years and has been the choice for many pen testers out there. The main challenge with this driver is the lack of 802.11 a, n, and ac support. It can be used for injecting packets into the wireless network and it works with MAC OS X.

3️⃣ Intel Pro Wireless (iwlwifi)
Many vendors out there use Intel 802.11 chipsets in their laptops and desktop systems in the PCIe bus.

Note: Latest versions of the Intel chipsets are supported by the iwlwifi or the iwlagn Linux drivers and supported by recent kernels.

4️⃣ The Alfa External Wireless Adapters
The Alfa adapters have been used by many pen testers in the industry for years.

5️⃣ The original Alfa AWUS306H
This is the legacy model and basically obsolete.

6️⃣ The Alfa AWUS036NEH
Is the newer version of the AWUS306H and provides support for 802.11n and it is smaller than its predecessor. One of the main challenges out there is that it is not supported by MAC OS X with KisMAC. However, many people use them in laptops or desktop machines using Kali Linux.

7️⃣ The Alfa Atheros AR9271 AWUS036NHA
Compatible with 802.11b, 802.11g or 802.11n using 2.4 GHZ wavelength.

8️⃣ The Alfa AWUS051NH
It's basically the same as the AWUS036NEH, but it adds support for 5 GHz. It is also not supported by MAC OS X.

9️⃣ Panda PAU05
The Panda PAU05 is a 2.4 GHz wireless N adapter that uses the Ralink RT3070 Chipset.

🔟 TP-Link TL-WN722N (100mW)
Very cheap and compatible with Kali Linux. It is not perfect for packet injection.

> TP-Link N150 Wireless High Gain USB Adapter (TL-WN722N)
The TP-LINK TL-WN722N uses the Atheros AR9271 Chipset and is a wireless N adapter. Newer versions may not use the same chipset and you may run into problems with Kali Linux.

✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑#ZigBee Resources

Good explanation and introduction to Zigbee: http://resources.infosecinstitute.com/hacking-zigbee-networks/

KillerBee Presentation: http://www.willhackforsushi.com/presentations/toorcon11-wright.pdf

KillerBee Framework: https://github.com/riverloopsec/killerbee

The KillerBee framework is being expanded to support multiple devices. Currently there is support for the River Loop ApiMote, Atmel RZ RAVEN USB Stick, MoteIV Tmote Sky, TelosB mote, and Sewino Sniffer.

Open source hardware: https://github.com/riverloopsec/apimote

Attify ZigBee Framework GitHub Repo: https://github.com/attify/Attify-Zigbee-Framework

✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑2020 companion container for nginx-proxy


🦑FEATURES :

>Automated creation/renewal of Let's Encrypt (or other ACME CAs) certificates using simple.

>Let's Encrypt / ACME domain validation through http-01 challenge only.

>Automated update and reload of nginx config on certificate creation/renewal.

> Support creation of Multi-Domain (SAN) Certificates.

>Creation of a Strong Diffie-Hellman Group at startup.

>Work with all versions of docker.

🦑REQUIREMENTS :

> Your host must be publicly reachable on both port 80 and 443.

> Check your firewall rules and do not attempt to block port 80 as that will prevent http-01 challenges from completing.

> For the same reason, you can't use nginx-proxy's HTTPSMETHOD=nohttp.

>The (sub)domains you want to issue certificates for must correctly resolve to the host.

> Your DNS provider must answer correctly to CAA record requests.

> If your (sub)domains have AAAA records set, the host must be publicly reachable over IPv6 on port 80 and 443.

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

🦑Basic usage (with the nginx-proxy container)

/etc/nginx/certs to store certificates, private keys and ACME account keys (readonly for the nginx-proxy container).
/etc/nginx/vhost.d to change the configuration of vhosts (required so the CA may access http-01 challenge files).
/usr/share/nginx/html to write http-01 challenge files.
Example of use:

1️⃣ nginx-proxy
Start nginx-proxy with the three additional volumes declared:

$ docker run --detach \
--name nginx-proxy \
--publish 80:80 \
--publish 443:443 \
--volume /etc/nginx/certs \
--volume /etc/nginx/vhost.d \
--volume /usr/share/nginx/html \
--volume /var/run/docker.sock:/tmp/docker.sock:ro \
jwilder/nginx-proxy
Binding the host docker socket (/var/run/docker.sock) inside the container to /tmp/docker.sock is a requirement of nginx-proxy.

2️⃣- letsencrypt-nginx-proxy-companion
Start the letsencrypt-nginx-proxy-companion container, getting the volumes from nginx-proxy with --volumes-from:

$ docker run --detach \
--name nginx-proxy-letsencrypt \
--volumes-from nginx-proxy \
--volume /var/run/docker.sock:/var/run/docker.sock:ro \
--env "DEFAULTEMAIL=mail@yourdomain.tld" \
jrcs/letsencrypt-nginx-proxy-companion
The host docker socket has to be bound inside this container too, this time to /var/run/docker.sock.

*3️⃣ -* proxied container(s)
Once both nginx-proxy and letsencrypt-nginx-proxy-companion containers are up and running, start any container you want proxied with environment variables VIRTUALHOST and LETSENCRYPTHOST both set to the domain(s) your proxied container is going to use.

VIRTUALHOST control proxying by nginx-proxy and LETSENCRYPTHOST control certificate creation and SSL enabling by letsencrypt-nginx-proxy-companion.

Certificates will only be issued for containers that have both VIRTUALHOST and LETSENCRYPTHOST variables set to domain(s) that correctly resolve to the host, provided the host is publicly reachable.

$ docker run --detach \
--name your-proxied-app \
--env "VIRTUALHOST=subdomain.yourdomain.tld" \
--env "LETSENCRYPTHOST=subdomain.yourdomain.tld" \
nginx

>The containers being proxied must expose the port to be proxied, either by using the EXPOSE directive in their Dockerfile or by using the --expose flag to docker run or docker create.

If the proxied container listen on and expose another port than the default 80, you can force nginx-proxy to use this port with the VIRTUALPORT environment variable.

Example using Grafana (expose and listen on port 3000):

$ docker run --detach \
--name grafana \
--env "VIRTUALHOST=othersubdomain.yourdomain.tld" \
--env "VIRTUALPORT=3000" \
--env "LETSENCRYPTHOST=othersubdomain.yourdomain.tld" \
--env "LETSENCRYPTEMAIL=mail@yourdomain.tld" \
grafana/grafana
Repeat Step 3 for any other container you want to proxy.

✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁