More details about the new intel bug/Vulnerability

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑FREE SPYWARES POPULAR 2020 :

- Spyeye - Script To Generate Win32 .Exe File To Take Screenshots

- Words Scraper - Selenium Based Web Scraper To Generate Passwords List

- JSshell - A JavaScript Reverse Shell For Exploiting XSS Remotely Or Finding Blind XSS, Working With Both Unix And Windows OS

- Astsu - A Network Scanner Tool

- Git-Scanner - A Tool For Bug Hunting Or Pentesting For Targeting Websites That Have Open .git Repositories Available In Public

- Recox - Master Script For Web Reconnaissance

- Jshole - A JavaScript Components Vulnrability Scanner, Based On RetireJS

- GitMonitor - A Github Scanning System To Look For Leaked Sensitive Information Based On Rules

- Eviloffice - Inject Macro And DDE Code Into Excel And Word Documents (Reverse Shell)

- Ligolo - Reverse Tunneling Made Easy For Pentesters, By Pentesters

- Inshackle - Instagram Hacks: Track Unfollowers, Increase Your Followers, Download Stories, Etc

- GhostShell - Malware Indetectable, With AV Bypass Techniques, Anti-Disassembly, And More

- Forerunner - Fast And Extensible Network Scanning Library Featuring Multithreading, Ping Probing, And Scan Fetchers

- Enumy - Linux Post Exploitation Privilege Escalation Enumeration

- Bing-Ip2Hosts - Bingip2Hosts Is A Bing.com Web Scraper That Discovers Websites By IP Address

- Vault - A Tool For Secrets Management, Encryption As A Service, And Privileged Access Management

- ADCollector - A Lightweight Tool To Quickly Extract Valuable Information From The Active Directory Environment For Both Attacking And Defending

- ANDRAX v5R NH-Killer - Penetration Testing on Android

- DroidFiles - Get Files From Android Directories

- Purify - All-in-one Tool For Managing Vulnerability Reports From AppSec
Pipelines



✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁


🦑Collects information from an email and shows results in a nice visual interface.

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :


1️⃣git clone https://gitlab.com/kennbroorg/iKy.git

2️⃣cd $IKY_CLONE/install/iKyEasyInstall

3️⃣./iKyEasyInstall.sh # At some point the script will request credentials for sudo


✅Verified on :

-kali
-ubuntu

🦑Kali - ubuntu video tutorial

> https://gitlab.com/kennbroorg/iKy/-/wikis/Videos/Installations


@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑X404 NORDVPN PREMIUM✅✅

pastebin.com/KvcpshGX

not cracked by undercode-Testing

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑2020 Hijack services that relies on QR Code Authentication :


🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1️⃣git clone https://github.com/thelinuxchoice/ohmyqr

2️⃣cd ohmyqr

3️⃣bash ohmyqr.sh

🦑How it Works ?

QRLJacking or Quick Response Code Login Jacking is a simple social engineering attack vector capable of session hijacking affecting all applications that rely on the “Login with QR code” feature as a secure way to login into accounts. In a nutshell, the victim scans the attacker’s QR code which results in session hijacking.

✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Network configuration-Prevent users from browsing using external proxies by Undercode :

Some background knowledge:

1️⃣ HTTP/1.0 protocol defines web server and When the client uses a proxy, in the
HTTP request and response headers, use Via: to identify the proxy server used to prevent the
server loop;

2️⃣ snort is an open source IDS (intrusion detection system) that can be used Host or network IDS. With many IDS
rules, it can perform pattern recognition and matching on the captured (ip, tcp, udp, icmp) packets, and can generate corresponding records.

3️⃣ libnet is open source software that can be used as a network protocol/packet generator.

4️⃣ The TCP/IP network is a packet-switched network.

5️⃣ Snort also has the function of generating IP packets using the libnet library. You can interrupt the TCP connection by issuing a TCP_RESET packet.

🦑 Prerequisites:

1️⃣Snort runs on the route (linux) or through the port mirror function of the switch, runs on the same
network segment of the route

🦑 Implementation:

1️⃣ compile snort with flexresp(flex response) feature

2️⃣ Define snort rules:
alert tcp $HOME_NET any <> $EXTER_NET 80 (msg:"block proxy"; uricontent:"Via:"; resp: rst_all;)

🦑 Effect:

> Internal network users can browse external websites normally.

> If the internal user’s browser is configured with an external proxy, the
HTTP REQUEST and RESPONSE headers will include Via: ... characters, and snort rules will capture this connection, and then

> Send RST packets to client and server sockets. In this way, the TCP connection is terminated.

Written by Undercode
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑2020 updated Reverse Tunneling made easy for pentesters, by pentesters

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1️⃣cd go env GOPATH/src

2️⃣git clone https://github.com/sysdream/ligolo

3️⃣cd ligolo

4️⃣make dep

5️⃣Generate self-signed TLS certificates (will be placed in the certs folder)
make certs TLS_HOST=example.com

NOTE: You can also use your own certificates by using the TLS_CERT make option when calling build. Example: make build-all TLS_CERT=certs/mycert.pem.

6️⃣Build

make build-all

> 3.2. (or) For the current architecture
make build

✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑A fast, modern, zero-conf load balancing HTTP(S) router for deploying microservices:

🦑FEATURES :

>Access Logging - customizable access logs

>Access Control - route specific access control

>Certificate Stores - dynamic certificate stores like file system, HTTP server, Consul and Vault

>Compression - GZIP compression for HTTP responses

>Docker Support - Official Docker image, Registrator and Docker Compose example

>Dynamic Reloading - hot reloading of the routing table without downtime

>Graceful Shutdown - wait until requests have completed before shutting down

>HTTP Header Support - inject some HTTP headers into upstream requests

>HTTPS Upstreams - forward requests to HTTPS upstream servers

>Metrics Support - support for Graphite, StatsD/DataDog and Circonus

>PROXY Protocol Support - support for HA Proxy PROXY protocol for inbound requests (use for Amazon ELB)

>Path Stripping - strip prefix paths from incoming requests

>Server-Sent Events/SSE - support for Server-Sent Events/SSE

>TCP Proxy Support - raw TCP proxy support

>TCP-SNI Proxy Support - forward TLS connections based on hostname without re-encryption

>Traffic Shaping - forward N% of traffic upstream without knowing the number of instances

>Web UI - web ui to examine the current routing table

>Websocket Support - websocket support

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

Install from source, binary, Docker or Homebrew.

# go 1.9 or higher is required

1️⃣get github.com/fabiolb/fabio (>= go1.9)

2️⃣brew install fabio (OSX/macOS stable)

brew install --devel fabio (OSX/macOS devel)

3️⃣docker pull fabiolb/fabio (Docker)

https://github.com/fabiolb/fabio/releases (pre-built binaries)

4️⃣Register your service in consul.

5️⃣Make sure that each instance registers with a unique ServiceID and a service name without spaces.

6️⃣Register a health check in consul as described here.

7️⃣By default fabio only watches services which have a passing health check, unless overriden with registry.consul.service.status.

8️⃣Register one urlprefix- tag per host/path prefix it serves, e.g.:

#HTTP/S examples
urlprefix-/css # path route
urlprefix-i.com/static # host specific path route
urlprefix-mysite.com/ # host specific catch all route
urlprefix-/foo/bar strip=/foo # path stripping (forward '/bar' to upstream)
urlprefix-/foo/bar proto=https # HTTPS upstream
urlprefix-/foo/bar proto=https tlsskipverify=true # HTTPS upstream and self-signed cert

#TCP examples
urlprefix-:3306 proto=tcp # route external port 3306
Make sure the prefix for HTTP routes contains at least one slash (/).

9️⃣See the full list of options in the Documentation.

🔟Start fabio without a config file (assuming a running consul agent on localhost:8500) Watch the log output how fabio picks up the route to your service. Try starting/stopping your service to see how the routing table changes instantly.

> Send all your HTTP traffic to fabio on port 9999. For TCP proxying see TCP proxy.


Done
✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

#Support & Share :

T.me/UndercodeTesting

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑WIFI HACKING TOOLS 2020 POPULLAR

🦑 Hak5's Wi-Fi Pineapple

Fully-integrated Wi-Fi man-in-the-middle platform and rogue access point.

[Site](https://www.wifipineapple.com/)
Wiki

🦑 Aircrack-ng

Complete suite of tools to monitor, capture, export, attack and crack wireless
networks.

[Site](https://www.aircrack-ng.org/)

🦑 Airsnort

Site

🦑 Kismet

Useful for troubleshooting Wi-Fi networks. Detects hidden networks.

[Site](https://www.kismetwireless.net/)

🦑Kismac-ng

Network stumbling tool that works on Mac OS X and features support for built-in
WLAN NICs on some Macs.

Site

🦑Fern WiFi Cracker

Automated cracking and nice monitoring capabilities. Very easy to use.

[Site](http://www.fern-pro.com/)

🦑Cowpatty

Features offline dictionary cracking for WPA networks.

Site

🦑 Ghost Phisher

Tool designed around sniffing passwords with an AP emulator, DHCP/DNS/HTTP
server and logging to a built-in database.

[Site](https://github.com/savio-code/ghost-phisher)

# Online Wireless Resources

🦑Wigle.net

Consolidated location and information of wireless networks world-wide in a
centralized database--queried and updated via web app, native clients and
mobile applications.

Site

@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Additional Notes for wireless pentest adapter
> which one should you choose :


1️⃣ Atheros (AR5XXX, AR9XXX)
Atheros chipsets have been used by many pen testers in the industry because the ability to perform well with many different systems and because it is open source. The main challenge with these drivers is that many laptops have migrated from PCMCIA bus and support for external Atheros-based cards is pretty limited.

2️⃣ Realtek (RTL8187)
The RTL8187 driver is used in many Alfa adapters (USB adapters). The RTL8187 driver is supported by the Linux kernel for years and has been the choice for many pen testers out there. The main challenge with this driver is the lack of 802.11 a, n, and ac support. It can be used for injecting packets into the wireless network and it works with MAC OS X.

3️⃣ Intel Pro Wireless (iwlwifi)
Many vendors out there use Intel 802.11 chipsets in their laptops and desktop systems in the PCIe bus.

Note: Latest versions of the Intel chipsets are supported by the iwlwifi or the iwlagn Linux drivers and supported by recent kernels.

4️⃣ The Alfa External Wireless Adapters
The Alfa adapters have been used by many pen testers in the industry for years.

5️⃣ The original Alfa AWUS306H
This is the legacy model and basically obsolete.

6️⃣ The Alfa AWUS036NEH
Is the newer version of the AWUS306H and provides support for 802.11n and it is smaller than its predecessor. One of the main challenges out there is that it is not supported by MAC OS X with KisMAC. However, many people use them in laptops or desktop machines using Kali Linux.

7️⃣ The Alfa Atheros AR9271 AWUS036NHA
Compatible with 802.11b, 802.11g or 802.11n using 2.4 GHZ wavelength.

8️⃣ The Alfa AWUS051NH
It's basically the same as the AWUS036NEH, but it adds support for 5 GHz. It is also not supported by MAC OS X.

9️⃣ Panda PAU05
The Panda PAU05 is a 2.4 GHz wireless N adapter that uses the Ralink RT3070 Chipset.

🔟 TP-Link TL-WN722N (100mW)
Very cheap and compatible with Kali Linux. It is not perfect for packet injection.

> TP-Link N150 Wireless High Gain USB Adapter (TL-WN722N)
The TP-LINK TL-WN722N uses the Atheros AR9271 Chipset and is a wireless N adapter. Newer versions may not use the same chipset and you may run into problems with Kali Linux.

✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑#ZigBee Resources

Good explanation and introduction to Zigbee: http://resources.infosecinstitute.com/hacking-zigbee-networks/

KillerBee Presentation: http://www.willhackforsushi.com/presentations/toorcon11-wright.pdf

KillerBee Framework: https://github.com/riverloopsec/killerbee

The KillerBee framework is being expanded to support multiple devices. Currently there is support for the River Loop ApiMote, Atmel RZ RAVEN USB Stick, MoteIV Tmote Sky, TelosB mote, and Sewino Sniffer.

Open source hardware: https://github.com/riverloopsec/apimote

Attify ZigBee Framework GitHub Repo: https://github.com/attify/Attify-Zigbee-Framework

✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑2020 companion container for nginx-proxy


🦑FEATURES :

>Automated creation/renewal of Let's Encrypt (or other ACME CAs) certificates using simple.

>Let's Encrypt / ACME domain validation through http-01 challenge only.

>Automated update and reload of nginx config on certificate creation/renewal.

> Support creation of Multi-Domain (SAN) Certificates.

>Creation of a Strong Diffie-Hellman Group at startup.

>Work with all versions of docker.

🦑REQUIREMENTS :

> Your host must be publicly reachable on both port 80 and 443.

> Check your firewall rules and do not attempt to block port 80 as that will prevent http-01 challenges from completing.

> For the same reason, you can't use nginx-proxy's HTTPSMETHOD=nohttp.

>The (sub)domains you want to issue certificates for must correctly resolve to the host.

> Your DNS provider must answer correctly to CAA record requests.

> If your (sub)domains have AAAA records set, the host must be publicly reachable over IPv6 on port 80 and 443.

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

🦑Basic usage (with the nginx-proxy container)

/etc/nginx/certs to store certificates, private keys and ACME account keys (readonly for the nginx-proxy container).
/etc/nginx/vhost.d to change the configuration of vhosts (required so the CA may access http-01 challenge files).
/usr/share/nginx/html to write http-01 challenge files.
Example of use:

1️⃣ nginx-proxy
Start nginx-proxy with the three additional volumes declared:

$ docker run --detach \
--name nginx-proxy \
--publish 80:80 \
--publish 443:443 \
--volume /etc/nginx/certs \
--volume /etc/nginx/vhost.d \
--volume /usr/share/nginx/html \
--volume /var/run/docker.sock:/tmp/docker.sock:ro \
jwilder/nginx-proxy
Binding the host docker socket (/var/run/docker.sock) inside the container to /tmp/docker.sock is a requirement of nginx-proxy.

2️⃣- letsencrypt-nginx-proxy-companion
Start the letsencrypt-nginx-proxy-companion container, getting the volumes from nginx-proxy with --volumes-from:

$ docker run --detach \
--name nginx-proxy-letsencrypt \
--volumes-from nginx-proxy \
--volume /var/run/docker.sock:/var/run/docker.sock:ro \
--env "DEFAULTEMAIL=mail@yourdomain.tld" \
jrcs/letsencrypt-nginx-proxy-companion
The host docker socket has to be bound inside this container too, this time to /var/run/docker.sock.

*3️⃣ -* proxied container(s)
Once both nginx-proxy and letsencrypt-nginx-proxy-companion containers are up and running, start any container you want proxied with environment variables VIRTUALHOST and LETSENCRYPTHOST both set to the domain(s) your proxied container is going to use.

VIRTUALHOST control proxying by nginx-proxy and LETSENCRYPTHOST control certificate creation and SSL enabling by letsencrypt-nginx-proxy-companion.

Certificates will only be issued for containers that have both VIRTUALHOST and LETSENCRYPTHOST variables set to domain(s) that correctly resolve to the host, provided the host is publicly reachable.

$ docker run --detach \
--name your-proxied-app \
--env "VIRTUALHOST=subdomain.yourdomain.tld" \
--env "LETSENCRYPTHOST=subdomain.yourdomain.tld" \
nginx

>The containers being proxied must expose the port to be proxied, either by using the EXPOSE directive in their Dockerfile or by using the --expose flag to docker run or docker create.

If the proxied container listen on and expose another port than the default 80, you can force nginx-proxy to use this port with the VIRTUALPORT environment variable.

Example using Grafana (expose and listen on port 3000):

$ docker run --detach \
--name grafana \
--env "VIRTUALHOST=othersubdomain.yourdomain.tld" \
--env "VIRTUALPORT=3000" \
--env "LETSENCRYPTHOST=othersubdomain.yourdomain.tld" \
--env "LETSENCRYPTEMAIL=mail@yourdomain.tld" \
grafana/grafana
Repeat Step 3 for any other container you want to proxy.

✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

#Container Security dockers 2020 :

- Anchor Cloud- Hosted version of Anchor Engine by @Anchoranchore

- Anchor Engine - Analyze images for CVE vulnerabilities and against custom security policies by @Anchoranchore

- Aqua Security- Securing container-based applications from Dev to Production on any platform

- bane - AppArmor profile generator for Docker containers by @genuinetoolsgenuinetools

- CIS Docker Benchmark - This InSpecinspec compliance profile implement the CIS Docker 1.12.0 Benchmark in an automated way to provide security best-practice tests around Docker daemon and containers in a production environment. By @dev-sec

- Clair - Clair is an open source project for the static analysis of vulnerabilities in appc and docker containers. By @coreosCoreOS

- Dagda - Dagda is a tool to perform static analysis of known vulnerabilities, trojans, viruses, malware & other malicious threats in docker images/containers and to monitor the docker daemon and running docker containers for detecting anomalous activities. By @eliasgranderubio

- docker-bench-security - script that checks for dozens of common best-practices around deploying Docker containers in production. By @dockerdocker

- notary - a server and a client for running and interacting with trusted collections. By @TUF

- oscap-docker - OpenSCAP provides oscap-docker tool which is used to scan Docker containers and images. By RedHat

- Sysdig Falco - Sysdig Falco is an open source container security monitor. It can monitor application, container, host, and network activity and alert on unauthorized activity.

- Sysdig Secure - Sysdig Secure addresses run-time security through behavioral monitoring and defense, and provides deep forensics based on open source Sysdig for incident response.

- Twistlock - Twistlock Security Suite detects vulnerabilities, hardens container images, and enforces security policies across the lifecycle of applications.

✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑2020 Wifi hacking tips :

#Using Kernel Modules to Simulate Wireless Adapters to Practice Pen Testing

You can use mac80211_hwsim is a software simulator of 802.11 radio(s) for mac80211 in Kali Linux and other penetration testing distributions like Parrot.

[mac80211_hwsim](https://wireless.wiki.kernel.org/en/users/drivers/mac80211_hwsim) kernel module has a parameter 'radios' that can be used to select how many radios are simulated (default 2). This allows configuration of both very simply setups (e.g., just a single access point and a station) or large scale tests (multiple access points with hundreds of stations).

The following site provides a description:
- https://wireless.wiki.kernel.org/en/users/drivers/mac80211_hwsim

#Starting the Kernel Module in Kali

In my Kali Linux box, I have only one active interface (eth0).

root@kali:~# ip -brie a
lo               UNKNOWN        127.0.0.1/8 ::1/128
eth0             UP             172.16.217.170/24 fe80::20c:29ff:fe3c:82b0/64

I am starting the simulator kernel module with the modprobe mac80211_hwsim command:

root@kali:~# modprobe mac80211_hwsim

After starting the module, the wireless interfaces are shown:

root@kali:~# ip -brie a
lo               UNKNOWN        127.0.0.1/8 ::1/128
eth0             UP             172.16.217.170/24 fe80::20c:29ff:fe3c:82b0/64
wlan0            DOWN
wlan1            DOWN
hwsim0           DOWN

You can then install hostapd to create a wireless access point and then use aircrack-ng to perform wireless assessments.


#Install and Configure hostapd

You can then install hostapd, as shown below:

root@kali:~# sudo apt install hostapd
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
  hostapd
0 upgraded, 1 newly installed, 0 to remove and 1748 not upgraded.
Need to get 608 kB of archives.
After this operation, 1,549 kB of additional disk space will be used.
Get:1 http://archive.linux.duke.edu/kalilinux/kali kali-rolling/main amd64 hostapd amd64 2:2.6-18 [608 kB]
Fetched 608 kB in 2s (301 kB/s)
Selecting previously unselected package hostapd.
(Reading database ... 353210 files and directories currently installed.)
Preparing to unpack .../hostapd_2%3a2.6-18_amd64.deb ...
Unpacking hostapd (2:2.6-18) ...
Setting up hostapd (2:2.6-18) ...
Created symlink /etc/systemd/system/hostapd.service → /dev/null.
update-rc.d: We have no instructions for the hostapd init script.
update-rc.d: It looks like a network service, we disable it.
Processing triggers for systemd (238-4) ...
Processing triggers for man-db (2.8.2-1) ...
Scanning processes...
Scanning candidates...
Scanning processor microcode...
Scanning linux images...

Running kernel seems to be up-to-date.

No services need to be restarted.

No containers need to be restarted.

User sessions running outdated binaries:
 root @ session #3: bash[1599]
root@kali:~# hostapd
hostapd v2.6
User space daemon for IEEE 802.11 AP management,
IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator
Copyright (c) 2002-2016, Jouni Malinen <j@w1.fi> and contributors

usage: hostapd [-hdBKtv] [-P <PID file>] [-e <entropy file>] \
         [-g <global ctrl_iface>] [-G <group>]\
         [-i <comma-separated list of interface names>]\
         <configuration file(s)>

options:
   -h   show this usage
   -d   show more debug messages (-dd for even more)
   -B   run daemon in the background
   -e   entropy file
   -g   global control interface path
   -G   group for control interfaces
   -P   PID file
   -K   include key data in debug messages
   -f   log output to debug file instead of stdout
   -T = record to Linux tracing in addition to logging
        (records all messages regardless of debug verbosity)
   -i   list of interface names to use
   -S   start all the interfaces synchronously
   -t   include timestamps in some debug messages
   -v   show hostapd version
root@kali:~#

Note: You can obtain the example of my hostapd.conf file [here](https://github.com/The-Art-of-Hacking/h4cker/blob/master/wireless_resources/hostapd.conf).

In my case, I ran into the following problem:

root@kali:# hostapd /etc/hostapd/hostapd.conf
Configuration file: /etc/hostapd/hostapd.conf
nl80211: Could not configure driver mode
nl80211: deinit ifname=wlan0 disabled_11b_rates=0
nl80211 driver initialization failed.
wlan0: interface state UNINITIALIZED->DISABLED
wlan0: AP-DISABLED
hostapd_free_hapd_data: Interface wlan0 wasn't started

I fixed it as follows:

root@kali:# sudo nmcli radio wifi off
root@kali:# sudo rfkill unblock wlan
root@kali:# sudo ifconfig wlan0 10.15.0.1/24 up
root@kali:# hostapd /etc/hostapd/hostapd.conf
Configuration file: /etc/hostapd/hostapd.conf
Using interface wlan0 with hwaddr 26:6f:2b:e1:48:d1 and ssid "corp-net"
wlan0: interface state UNINITIALIZED->ENABLED
wlan0: AP-ENABLED

## Running aircrack-ng

If you are not familiar with aircrack-ng, you can watch the video course at: https://h4cker.org/wireless

Let's start airmon-ng and then launch airodump-ng just to test our configuration:

root@kali:~# airmon-ng start wlan1

Found 3 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to run 'airmon-ng check kill'

  PID Name
  544 NetworkManager
  576 dhclient
  723 wpa_supplicant

PHY  Interface  Driver    Chipset

phy0  wlan0    mac80211_hwsim  Software simulator of 802.11 radio(s) for mac80211
phy1  wlan1    mac80211_hwsim  Software simulator of 802.11 radio(s) for mac80211

    (mac80211 monitor mode vif enabled for [phy1]wlan1 on [phy1]wlan1mon)
    (mac80211 station mode vif disabled for [phy1]wlan1)

root@kali:~#

Now, let's run airodump-ng:

root@kali:~# airodump-ng wlan1mon

You should see the corp-net SSID that is configured in the hostapd.conf file.

 CH 12 ][ Elapsed: 6 s ][ 2018-11-27 23:02

 BSSID              PWR  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSID

 26:6F:2B:E1:48:D1  -29        5        0    0  11  54   WPA  TKIP   MGT  corp-net

 BSSID              STATION            PWR   Rate    Lost    Frames  Probe

## Installing DHCP server

Dnsmasq is going to act as our DNS and DHCP server, it can be installed with apt-get install dnsmasq. This is another super simple service with an easy to understand config file. Below is what I used, it defines a DHCP range, sets the router and DNS servers as 10.0.0.1 (options 3 and 6) and sets our upstream DNS server to one of OpenDNS's public DNS servers (server=208.67.222.222).

interface=wlan0
dhcp-range=10.0.0.10,10.0.0.100,8h
dhcp-option=3,10.0.0.1
dhcp-option=6,10.0.0.1
server=208.67.222.222
log-queries
log-dhcp

✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁