▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑2020 updated Reverse Tunneling made easy for pentesters, by pentesters

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1️⃣cd go env GOPATH/src

2️⃣git clone https://github.com/sysdream/ligolo

3️⃣cd ligolo

4️⃣make dep

5️⃣Generate self-signed TLS certificates (will be placed in the certs folder)
make certs TLS_HOST=example.com

NOTE: You can also use your own certificates by using the TLS_CERT make option when calling build. Example: make build-all TLS_CERT=certs/mycert.pem.

6️⃣Build

make build-all

> 3.2. (or) For the current architecture
make build

✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑A fast, modern, zero-conf load balancing HTTP(S) router for deploying microservices:

🦑FEATURES :

>Access Logging - customizable access logs

>Access Control - route specific access control

>Certificate Stores - dynamic certificate stores like file system, HTTP server, Consul and Vault

>Compression - GZIP compression for HTTP responses

>Docker Support - Official Docker image, Registrator and Docker Compose example

>Dynamic Reloading - hot reloading of the routing table without downtime

>Graceful Shutdown - wait until requests have completed before shutting down

>HTTP Header Support - inject some HTTP headers into upstream requests

>HTTPS Upstreams - forward requests to HTTPS upstream servers

>Metrics Support - support for Graphite, StatsD/DataDog and Circonus

>PROXY Protocol Support - support for HA Proxy PROXY protocol for inbound requests (use for Amazon ELB)

>Path Stripping - strip prefix paths from incoming requests

>Server-Sent Events/SSE - support for Server-Sent Events/SSE

>TCP Proxy Support - raw TCP proxy support

>TCP-SNI Proxy Support - forward TLS connections based on hostname without re-encryption

>Traffic Shaping - forward N% of traffic upstream without knowing the number of instances

>Web UI - web ui to examine the current routing table

>Websocket Support - websocket support

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

Install from source, binary, Docker or Homebrew.

# go 1.9 or higher is required

1️⃣get github.com/fabiolb/fabio (>= go1.9)

2️⃣brew install fabio (OSX/macOS stable)

brew install --devel fabio (OSX/macOS devel)

3️⃣docker pull fabiolb/fabio (Docker)

https://github.com/fabiolb/fabio/releases (pre-built binaries)

4️⃣Register your service in consul.

5️⃣Make sure that each instance registers with a unique ServiceID and a service name without spaces.

6️⃣Register a health check in consul as described here.

7️⃣By default fabio only watches services which have a passing health check, unless overriden with registry.consul.service.status.

8️⃣Register one urlprefix- tag per host/path prefix it serves, e.g.:

#HTTP/S examples
urlprefix-/css # path route
urlprefix-i.com/static # host specific path route
urlprefix-mysite.com/ # host specific catch all route
urlprefix-/foo/bar strip=/foo # path stripping (forward '/bar' to upstream)
urlprefix-/foo/bar proto=https # HTTPS upstream
urlprefix-/foo/bar proto=https tlsskipverify=true # HTTPS upstream and self-signed cert

#TCP examples
urlprefix-:3306 proto=tcp # route external port 3306
Make sure the prefix for HTTP routes contains at least one slash (/).

9️⃣See the full list of options in the Documentation.

🔟Start fabio without a config file (assuming a running consul agent on localhost:8500) Watch the log output how fabio picks up the route to your service. Try starting/stopping your service to see how the routing table changes instantly.

> Send all your HTTP traffic to fabio on port 9999. For TCP proxying see TCP proxy.


Done
✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

#Support & Share :

T.me/UndercodeTesting

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑WIFI HACKING TOOLS 2020 POPULLAR

🦑 Hak5's Wi-Fi Pineapple

Fully-integrated Wi-Fi man-in-the-middle platform and rogue access point.

[Site](https://www.wifipineapple.com/)
Wiki

🦑 Aircrack-ng

Complete suite of tools to monitor, capture, export, attack and crack wireless
networks.

[Site](https://www.aircrack-ng.org/)

🦑 Airsnort

Site

🦑 Kismet

Useful for troubleshooting Wi-Fi networks. Detects hidden networks.

[Site](https://www.kismetwireless.net/)

🦑Kismac-ng

Network stumbling tool that works on Mac OS X and features support for built-in
WLAN NICs on some Macs.

Site

🦑Fern WiFi Cracker

Automated cracking and nice monitoring capabilities. Very easy to use.

[Site](http://www.fern-pro.com/)

🦑Cowpatty

Features offline dictionary cracking for WPA networks.

Site

🦑 Ghost Phisher

Tool designed around sniffing passwords with an AP emulator, DHCP/DNS/HTTP
server and logging to a built-in database.

[Site](https://github.com/savio-code/ghost-phisher)

# Online Wireless Resources

🦑Wigle.net

Consolidated location and information of wireless networks world-wide in a
centralized database--queried and updated via web app, native clients and
mobile applications.

Site

@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Additional Notes for wireless pentest adapter
> which one should you choose :


1️⃣ Atheros (AR5XXX, AR9XXX)
Atheros chipsets have been used by many pen testers in the industry because the ability to perform well with many different systems and because it is open source. The main challenge with these drivers is that many laptops have migrated from PCMCIA bus and support for external Atheros-based cards is pretty limited.

2️⃣ Realtek (RTL8187)
The RTL8187 driver is used in many Alfa adapters (USB adapters). The RTL8187 driver is supported by the Linux kernel for years and has been the choice for many pen testers out there. The main challenge with this driver is the lack of 802.11 a, n, and ac support. It can be used for injecting packets into the wireless network and it works with MAC OS X.

3️⃣ Intel Pro Wireless (iwlwifi)
Many vendors out there use Intel 802.11 chipsets in their laptops and desktop systems in the PCIe bus.

Note: Latest versions of the Intel chipsets are supported by the iwlwifi or the iwlagn Linux drivers and supported by recent kernels.

4️⃣ The Alfa External Wireless Adapters
The Alfa adapters have been used by many pen testers in the industry for years.

5️⃣ The original Alfa AWUS306H
This is the legacy model and basically obsolete.

6️⃣ The Alfa AWUS036NEH
Is the newer version of the AWUS306H and provides support for 802.11n and it is smaller than its predecessor. One of the main challenges out there is that it is not supported by MAC OS X with KisMAC. However, many people use them in laptops or desktop machines using Kali Linux.

7️⃣ The Alfa Atheros AR9271 AWUS036NHA
Compatible with 802.11b, 802.11g or 802.11n using 2.4 GHZ wavelength.

8️⃣ The Alfa AWUS051NH
It's basically the same as the AWUS036NEH, but it adds support for 5 GHz. It is also not supported by MAC OS X.

9️⃣ Panda PAU05
The Panda PAU05 is a 2.4 GHz wireless N adapter that uses the Ralink RT3070 Chipset.

🔟 TP-Link TL-WN722N (100mW)
Very cheap and compatible with Kali Linux. It is not perfect for packet injection.

> TP-Link N150 Wireless High Gain USB Adapter (TL-WN722N)
The TP-LINK TL-WN722N uses the Atheros AR9271 Chipset and is a wireless N adapter. Newer versions may not use the same chipset and you may run into problems with Kali Linux.

✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑#ZigBee Resources

Good explanation and introduction to Zigbee: http://resources.infosecinstitute.com/hacking-zigbee-networks/

KillerBee Presentation: http://www.willhackforsushi.com/presentations/toorcon11-wright.pdf

KillerBee Framework: https://github.com/riverloopsec/killerbee

The KillerBee framework is being expanded to support multiple devices. Currently there is support for the River Loop ApiMote, Atmel RZ RAVEN USB Stick, MoteIV Tmote Sky, TelosB mote, and Sewino Sniffer.

Open source hardware: https://github.com/riverloopsec/apimote

Attify ZigBee Framework GitHub Repo: https://github.com/attify/Attify-Zigbee-Framework

✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑2020 companion container for nginx-proxy


🦑FEATURES :

>Automated creation/renewal of Let's Encrypt (or other ACME CAs) certificates using simple.

>Let's Encrypt / ACME domain validation through http-01 challenge only.

>Automated update and reload of nginx config on certificate creation/renewal.

> Support creation of Multi-Domain (SAN) Certificates.

>Creation of a Strong Diffie-Hellman Group at startup.

>Work with all versions of docker.

🦑REQUIREMENTS :

> Your host must be publicly reachable on both port 80 and 443.

> Check your firewall rules and do not attempt to block port 80 as that will prevent http-01 challenges from completing.

> For the same reason, you can't use nginx-proxy's HTTPSMETHOD=nohttp.

>The (sub)domains you want to issue certificates for must correctly resolve to the host.

> Your DNS provider must answer correctly to CAA record requests.

> If your (sub)domains have AAAA records set, the host must be publicly reachable over IPv6 on port 80 and 443.

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

🦑Basic usage (with the nginx-proxy container)

/etc/nginx/certs to store certificates, private keys and ACME account keys (readonly for the nginx-proxy container).
/etc/nginx/vhost.d to change the configuration of vhosts (required so the CA may access http-01 challenge files).
/usr/share/nginx/html to write http-01 challenge files.
Example of use:

1️⃣ nginx-proxy
Start nginx-proxy with the three additional volumes declared:

$ docker run --detach \
--name nginx-proxy \
--publish 80:80 \
--publish 443:443 \
--volume /etc/nginx/certs \
--volume /etc/nginx/vhost.d \
--volume /usr/share/nginx/html \
--volume /var/run/docker.sock:/tmp/docker.sock:ro \
jwilder/nginx-proxy
Binding the host docker socket (/var/run/docker.sock) inside the container to /tmp/docker.sock is a requirement of nginx-proxy.

2️⃣- letsencrypt-nginx-proxy-companion
Start the letsencrypt-nginx-proxy-companion container, getting the volumes from nginx-proxy with --volumes-from:

$ docker run --detach \
--name nginx-proxy-letsencrypt \
--volumes-from nginx-proxy \
--volume /var/run/docker.sock:/var/run/docker.sock:ro \
--env "DEFAULTEMAIL=mail@yourdomain.tld" \
jrcs/letsencrypt-nginx-proxy-companion
The host docker socket has to be bound inside this container too, this time to /var/run/docker.sock.

*3️⃣ -* proxied container(s)
Once both nginx-proxy and letsencrypt-nginx-proxy-companion containers are up and running, start any container you want proxied with environment variables VIRTUALHOST and LETSENCRYPTHOST both set to the domain(s) your proxied container is going to use.

VIRTUALHOST control proxying by nginx-proxy and LETSENCRYPTHOST control certificate creation and SSL enabling by letsencrypt-nginx-proxy-companion.

Certificates will only be issued for containers that have both VIRTUALHOST and LETSENCRYPTHOST variables set to domain(s) that correctly resolve to the host, provided the host is publicly reachable.

$ docker run --detach \
--name your-proxied-app \
--env "VIRTUALHOST=subdomain.yourdomain.tld" \
--env "LETSENCRYPTHOST=subdomain.yourdomain.tld" \
nginx

>The containers being proxied must expose the port to be proxied, either by using the EXPOSE directive in their Dockerfile or by using the --expose flag to docker run or docker create.

If the proxied container listen on and expose another port than the default 80, you can force nginx-proxy to use this port with the VIRTUALPORT environment variable.

Example using Grafana (expose and listen on port 3000):

$ docker run --detach \
--name grafana \
--env "VIRTUALHOST=othersubdomain.yourdomain.tld" \
--env "VIRTUALPORT=3000" \
--env "LETSENCRYPTHOST=othersubdomain.yourdomain.tld" \
--env "LETSENCRYPTEMAIL=mail@yourdomain.tld" \
grafana/grafana
Repeat Step 3 for any other container you want to proxy.

✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

#Container Security dockers 2020 :

- Anchor Cloud- Hosted version of Anchor Engine by @Anchoranchore

- Anchor Engine - Analyze images for CVE vulnerabilities and against custom security policies by @Anchoranchore

- Aqua Security- Securing container-based applications from Dev to Production on any platform

- bane - AppArmor profile generator for Docker containers by @genuinetoolsgenuinetools

- CIS Docker Benchmark - This InSpecinspec compliance profile implement the CIS Docker 1.12.0 Benchmark in an automated way to provide security best-practice tests around Docker daemon and containers in a production environment. By @dev-sec

- Clair - Clair is an open source project for the static analysis of vulnerabilities in appc and docker containers. By @coreosCoreOS

- Dagda - Dagda is a tool to perform static analysis of known vulnerabilities, trojans, viruses, malware & other malicious threats in docker images/containers and to monitor the docker daemon and running docker containers for detecting anomalous activities. By @eliasgranderubio

- docker-bench-security - script that checks for dozens of common best-practices around deploying Docker containers in production. By @dockerdocker

- notary - a server and a client for running and interacting with trusted collections. By @TUF

- oscap-docker - OpenSCAP provides oscap-docker tool which is used to scan Docker containers and images. By RedHat

- Sysdig Falco - Sysdig Falco is an open source container security monitor. It can monitor application, container, host, and network activity and alert on unauthorized activity.

- Sysdig Secure - Sysdig Secure addresses run-time security through behavioral monitoring and defense, and provides deep forensics based on open source Sysdig for incident response.

- Twistlock - Twistlock Security Suite detects vulnerabilities, hardens container images, and enforces security policies across the lifecycle of applications.

✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑2020 Wifi hacking tips :

#Using Kernel Modules to Simulate Wireless Adapters to Practice Pen Testing

You can use mac80211_hwsim is a software simulator of 802.11 radio(s) for mac80211 in Kali Linux and other penetration testing distributions like Parrot.

[mac80211_hwsim](https://wireless.wiki.kernel.org/en/users/drivers/mac80211_hwsim) kernel module has a parameter 'radios' that can be used to select how many radios are simulated (default 2). This allows configuration of both very simply setups (e.g., just a single access point and a station) or large scale tests (multiple access points with hundreds of stations).

The following site provides a description:
- https://wireless.wiki.kernel.org/en/users/drivers/mac80211_hwsim

#Starting the Kernel Module in Kali

In my Kali Linux box, I have only one active interface (eth0).

root@kali:~# ip -brie a
lo               UNKNOWN        127.0.0.1/8 ::1/128
eth0             UP             172.16.217.170/24 fe80::20c:29ff:fe3c:82b0/64

I am starting the simulator kernel module with the modprobe mac80211_hwsim command:

root@kali:~# modprobe mac80211_hwsim

After starting the module, the wireless interfaces are shown:

root@kali:~# ip -brie a
lo               UNKNOWN        127.0.0.1/8 ::1/128
eth0             UP             172.16.217.170/24 fe80::20c:29ff:fe3c:82b0/64
wlan0            DOWN
wlan1            DOWN
hwsim0           DOWN

You can then install hostapd to create a wireless access point and then use aircrack-ng to perform wireless assessments.


#Install and Configure hostapd

You can then install hostapd, as shown below:

root@kali:~# sudo apt install hostapd
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
  hostapd
0 upgraded, 1 newly installed, 0 to remove and 1748 not upgraded.
Need to get 608 kB of archives.
After this operation, 1,549 kB of additional disk space will be used.
Get:1 http://archive.linux.duke.edu/kalilinux/kali kali-rolling/main amd64 hostapd amd64 2:2.6-18 [608 kB]
Fetched 608 kB in 2s (301 kB/s)
Selecting previously unselected package hostapd.
(Reading database ... 353210 files and directories currently installed.)
Preparing to unpack .../hostapd_2%3a2.6-18_amd64.deb ...
Unpacking hostapd (2:2.6-18) ...
Setting up hostapd (2:2.6-18) ...
Created symlink /etc/systemd/system/hostapd.service → /dev/null.
update-rc.d: We have no instructions for the hostapd init script.
update-rc.d: It looks like a network service, we disable it.
Processing triggers for systemd (238-4) ...
Processing triggers for man-db (2.8.2-1) ...
Scanning processes...
Scanning candidates...
Scanning processor microcode...
Scanning linux images...

Running kernel seems to be up-to-date.

No services need to be restarted.

No containers need to be restarted.

User sessions running outdated binaries:
 root @ session #3: bash[1599]
root@kali:~# hostapd
hostapd v2.6
User space daemon for IEEE 802.11 AP management,
IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator
Copyright (c) 2002-2016, Jouni Malinen <j@w1.fi> and contributors

usage: hostapd [-hdBKtv] [-P <PID file>] [-e <entropy file>] \
         [-g <global ctrl_iface>] [-G <group>]\
         [-i <comma-separated list of interface names>]\
         <configuration file(s)>

options:
   -h   show this usage
   -d   show more debug messages (-dd for even more)
   -B   run daemon in the background
   -e   entropy file
   -g   global control interface path
   -G   group for control interfaces
   -P   PID file
   -K   include key data in debug messages
   -f   log output to debug file instead of stdout
   -T = record to Linux tracing in addition to logging
        (records all messages regardless of debug verbosity)
   -i   list of interface names to use
   -S   start all the interfaces synchronously
   -t   include timestamps in some debug messages
   -v   show hostapd version
root@kali:~#

Note: You can obtain the example of my hostapd.conf file [here](https://github.com/The-Art-of-Hacking/h4cker/blob/master/wireless_resources/hostapd.conf).

In my case, I ran into the following problem:

root@kali:# hostapd /etc/hostapd/hostapd.conf
Configuration file: /etc/hostapd/hostapd.conf
nl80211: Could not configure driver mode
nl80211: deinit ifname=wlan0 disabled_11b_rates=0
nl80211 driver initialization failed.
wlan0: interface state UNINITIALIZED->DISABLED
wlan0: AP-DISABLED
hostapd_free_hapd_data: Interface wlan0 wasn't started

I fixed it as follows:

root@kali:# sudo nmcli radio wifi off
root@kali:# sudo rfkill unblock wlan
root@kali:# sudo ifconfig wlan0 10.15.0.1/24 up
root@kali:# hostapd /etc/hostapd/hostapd.conf
Configuration file: /etc/hostapd/hostapd.conf
Using interface wlan0 with hwaddr 26:6f:2b:e1:48:d1 and ssid "corp-net"
wlan0: interface state UNINITIALIZED->ENABLED
wlan0: AP-ENABLED

## Running aircrack-ng

If you are not familiar with aircrack-ng, you can watch the video course at: https://h4cker.org/wireless

Let's start airmon-ng and then launch airodump-ng just to test our configuration:

root@kali:~# airmon-ng start wlan1

Found 3 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to run 'airmon-ng check kill'

  PID Name
  544 NetworkManager
  576 dhclient
  723 wpa_supplicant

PHY  Interface  Driver    Chipset

phy0  wlan0    mac80211_hwsim  Software simulator of 802.11 radio(s) for mac80211
phy1  wlan1    mac80211_hwsim  Software simulator of 802.11 radio(s) for mac80211

    (mac80211 monitor mode vif enabled for [phy1]wlan1 on [phy1]wlan1mon)
    (mac80211 station mode vif disabled for [phy1]wlan1)

root@kali:~#

Now, let's run airodump-ng:

root@kali:~# airodump-ng wlan1mon

You should see the corp-net SSID that is configured in the hostapd.conf file.

 CH 12 ][ Elapsed: 6 s ][ 2018-11-27 23:02

 BSSID              PWR  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSID

 26:6F:2B:E1:48:D1  -29        5        0    0  11  54   WPA  TKIP   MGT  corp-net

 BSSID              STATION            PWR   Rate    Lost    Frames  Probe

## Installing DHCP server

Dnsmasq is going to act as our DNS and DHCP server, it can be installed with apt-get install dnsmasq. This is another super simple service with an easy to understand config file. Below is what I used, it defines a DHCP range, sets the router and DNS servers as 10.0.0.1 (options 3 and 6) and sets our upstream DNS server to one of OpenDNS's public DNS servers (server=208.67.222.222).

interface=wlan0
dhcp-range=10.0.0.10,10.0.0.100,8h
dhcp-option=3,10.0.0.1
dhcp-option=6,10.0.0.1
server=208.67.222.222
log-queries
log-dhcp

✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

Create Your Own BotNet/Malware Practical

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Proxy Service-Intranet and Internet IP forwarding settings

set We have a computer with two network cards, eth0 connected to the external network, ip is 1.2.3.4 ;eth1 is connected to the internal network, the ip is 192.168.0.1. Now you need to forward the ip packet sent to port 81 of address 1.2.3.4 to port 8180 of ip address 192.168.0.2, set as follows:

1️⃣iptables -t nat -A PREROUTING -d 1.2.3.4 -p tcp -m tcp --dport 81 -j DNAT 192.168.0.2:8180

2️⃣ iptables -t nat -A POSTROUTING -d 192.168.0.2 -p tcp -m tcp --dport 8180 -j SNAT The
actual transmission process of 192.168.0.1 is as follows:


3️⃣Suppose that a client's ip address is 6.7.8.9, it uses the machine's 1080 port to connect to port 81 of 1.2.3.4, and the source address of the outgoing ip packet is 6.7.8.9, the source The port is 1080, the destination address is 1.2.3.4, and the destination port is 81.

4️⃣After the host 1.2.3.4 receives this packet, according to the first rule of the nat table, the destination address of the ip packet should be changed to 192.168.0.2, the destination port should be 8180, and an entry should be created in the connection tracking table. (It can be seen from the /proc/net/ip_conntrack file), and then sent to the routing module, by checking the routing table, it is determined that the ip packet should be sent to the eth1 interface.

5️⃣ Before sending the ip packet to the eth1 interface, according to the nat table the second rule, the more the source address of the packet ip 192.168.0.1 (the case whether it is more appropriate entry in the connection table tracking unacknowledged, who clearly requested guidance), and then sent to the interface eth1.
and The ip packet sent back from 192.168.0.2, the destination address is 192.168.0.1, the destination port is 1080, and the TCP/IP stack of the host 1.2.3.4 receives the ip packet, and the core looks for a match in the connection tracking table, and then Change the destination address of the ip packet from 192.168.0.1 to the original client's ip address 6.7.8.9,

6️⃣keeping the port number 1080 unchanged. In this way, the server's return packet can correctly return the client that initiated the connection, and the communication is like this Start.

written by undercode
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

BIN Disney+

650159xxxxxxxxxx

CVV/Fecha: RND (Random)

IP : USA

Postal: 10080/10001

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Termux topic 2020
> Fast subdomains enumeration tool for penetration testers :

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1️⃣git clone https://github.com/aboul3la/Sublist3r.git

2️⃣cd Sublist3r

3️⃣Installation on Windows:
c:\python27\python.exe -m pip install -r requirements.txt

🦑Installation on Linux

> sudo pip install -r requirements.txt

Requests Module (http://docs.python-requests.org/en/latest/)

🦑Install for Windows:

> c:\python27\python.exe -m pip install requests

🦑Install for Ubuntu/Debian:

> sudo apt-get install python-requests

🦑Install for Centos/Redhat:

> sudo yum install python-requests

> Install using pip on Linux:
sudo pip install requests

🦑REQUIREMENT 2 :

dnspython Module (http://www.dnspython.org/)

1️⃣Install for Windows:
c:\python27\python.exe -m pip install dnspython

2️⃣Install for Ubuntu/Debian:
sudo apt-get install python-dnspython

> Install using pip:
sudo pip install dnspython
argparse Module

3️⃣Install for Ubuntu/Debian:
sudo apt-get install python-argparse

4️⃣Install for Centos/Redhat:
sudo yum install python-argparse
>Install using pip:
sudo pip install argparse
for coloring in windows install the following libraries

c:\python27\python.exe -m pip install win_unicode_console colorama

🦑HOW TO USE ?

Examples
1) To list all the basic options and switches use -h switch:
python sublist3r.py -h

2) To enumerate subdomains of specific domain:
python sublist3r.py -d example.com

3) To enumerate subdomains of specific domain and show only subdomains which have open ports 80 and 443 :
python sublist3r.py -d example.com -p 80,443

4) To enumerate subdomains of specific domain and show the results in realtime:
python sublist3r.py -v -d example.com

5) To enumerate subdomains and enable the bruteforce module:
python sublist3r.py -b -d example.com

6) To enumerate subdomains and use specific engines such Google, Yahoo and Virustotal engines
python sublist3r.py -e google,yahoo,virustotal -d example.com

✅Git 2020 sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑These courses serve as comprehensive guide for any network and security professional who is starting a career in ethical hacking and penetration testing. It also can help individuals :

1) preparing for the [Offensive Security Certified Professional (OSCP)](https://www.offensive-security.com/information-security-certifications/), the [Certified Ethical Hacker (CEH)]

2) (https://www.eccouncil.org/programs/certified-ethical-hacker-ceh/), [CompTIA PenTest+](https://certification.comptia.org/certifications/pentest) and any other ethical hacking certification.

3) This course helps any cyber security professional that want to learn the skills required to becoming a professional ethical hacker or that want to learn more about general hacking methodologies and concepts.

4) These video courses are published by Pearson, but this GitHub repository is maintained and supported by the lead author of the series [Omar Santos](https://omarsantos.io/).

@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑cvs service-ViewCVS installation

Preface

ViewCVS is a software written in Python to view all data in the CVS code base. It has been used by many configuration management systems, and it is also a CVS auxiliary tool that can be selected like cvsweb in open source products.
Preparation before installation The

following software should already be installed on your system:

1) Python 1.5 or later, this can be installed without installation, because the ports will determine whether it is installed when compiling, if not, it will automatically compile and Installed.

2) cvs, cvs has been built in FreeBSD, so don't worry.

3) mysql 3.22 and above, if you need viewcvs to save data to mysql, then you should install the software in advance. Note that this software is not necessary for the operation of viewcvs.

🦑Installing ViewCVS

under FreeBSD Installing ViewCVS under FreeBSD is very simple, just install via ports:

root@~$cd /usr/ports/devel/viewcvs/
root@/usr/ports/devel/viewcvs$make install;make Clean


so that ViewCVS is installed in the viewcvs-version directory in /usr/local (current version is 0.9.2).
Configure basic ViewCVS

Copy viewcvs.conf.dist in viewcvs to a copy called viewcvs.conf. This file is the main configuration file used by viewcvs. In this file, at least the following parameters must be set:
# cvs_roots
# default_root
# rcs_path
# mime_types_file
cvs_roots settings

The original settings of cvs_roots in viewcvs.conf are:

cvs_roots =
Development: /home/


cvsroot Add to the list one by one, the format is [CVSROOT name] :[CVSROOT path], the following is an example of my settings:

cvs_roots =
maven: /home/
cvsd /cvs/maven, hdsite: /home/cvsd/cvs/hdsite,
bsdhowto: /home/cvsd/cvs/bsdhowto


Here I set up three CVSRoot to let viewcvs can see, their names are maven, hdsite, bsdhowto. It should be noted that the settings between each CVSRoot are separated by a comma.
default_root The

default_root is used to set the cvsroot item displayed by default on the ViewCVS homepage.
rcs_path

The original setting of rcs_path in viewcvs.conf is not there:

#rcs_path = /usr/bin/


We can see that it has been commented, if your rcs command is not in the /usr/bin directory, why not remove the comment , Change to the path where rcs is located. Under FreeBSD, the default rcs is under /usr/bin, so this setting can be left unchanged.
mime_types_file

has no mime_types_file setting in viewcvs.conf:

#mime_types_file = /usr/local/apache/conf/mime.types


We can point it to the mime setting of apache, or we can write a new setting ourselves, I feel It is not used by the web server, it should be a configuration item used when running independently.
Other configurations of ViewCVS

In addition to the basic settings, there are some other settings that are also useful. Here we will explain some useful settings one by one.
Other settings in [general]

address are used to set the email

address of the management contacts on the page address = HD


[vhosts] Virtual host support

If you have multiple virtual hosts to use the same cgi, you will find each host Different viewcvs.conf settings may be required, so vhost settings are possible in viewcvs.conf. This is the original description of

viewcvs.conf : # vhost1 = glob1, glob2
# vhost2 = glob3, glob4

# [vhost1-section]
# option = value
# [vhost1-othersection]
# option = value
# [vhost2-section]
# option = value


can basically be understood at a glance, use a name for a virtual host, and explain the virtual host Corresponding url. Each virtual host can set all section attributes. The name of the section plus the name of the virtual host is sufficient. This is an example I set:

mavencn = maven.huangdong.com
bsd = bsd.huangdong.com

[mavencn-general]
default_root = maven

[bsd-general]
default_root = bsdhowto