▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑LIST OF VULNERABLES HOSTING AGAINST CARDERS :

3nt.com
NovoGara.com
abusehosting.ru
admintek.net
agava.ru
asiapacific-it.com
asiapacifichosting.com
avk-com.ru
beotel.net
berihoster.ru
borneo.kg
cinipac.com
cloud.volia.com
comsats.net.pk
dedicado.com.uy
deltahost.com
dis.telecom.kz
doclerweb.com
ecatel.co.uk
en.datasource.ch
en.hostsolutions.ro
en.ukrtelecom.ua
en.uplink.hu
eng.deninet.net
freehost.com.ua
hc.ru
hosting.nic.ru
hosting.tel.ru
hosting.tongacable.net
hosting.turk.net
hosting.ua
hostparatuvida.com
infiumhost.com
innovahosting.net
insacom.cl
iprosrv.com
ironservers.cl
ispcompania.com
ispserver.com
itools.mn
ixam-hosting.com
knownsrv.com
kras.host
laceibanetsociety.com
latinoserver.com
lfait.com
libertyvps.net
libyanspider.com
magicnet.md
melbicom.net
mycloud.by
natro.com
netassist.ua
netbrella.net
netengi.com
netplace.ru
networksdelmanana.com
nexlinx.net.pk
nexus.pk
online.tm
ouriran.com
planetahost.ru
privatelayer.com
pro-managed.com
ptclcloud.com.pk
pttrs.net
pw-service.com
radore.com
renter.ru
rx-name.ua
semele.com.tr
seohosting.com.tr
shinjiru.com
space.kz
swedehost.net
swedendedicated.com
tchile.com
tehnodom.com

!!!
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Bug Letsencrypt CAA :

According to Let's Encrypt's announcement, when a certificate request contains N domain names that required a CAA revalidation, Boulder (CA software) would pick one domain name and validate it N times.

In practice, this means that if a subscriber verified a domain name during X, and the CAA records for that domain during X allowed Let's Encrypt to be issued, that subscriber could issue a certificate containing that domain name up to X + 30 days, even if anyone I later set up CAA records for this domain name that prohibit issuing Let's Encrypt.

This bug was confirmed by the Let Encrypt team on February 29, 2020.

1) Let's take a look at how to check if a website domain is affected by the Letsencrypt CAA Rechecking vulnerability.

🦑How to check if your domain is not affected by the CAA LetsEncrypt revalidation error
To check if your domain is affected by the CAA revalidation error on any Unix-like systems, run:

$ curl -XPOST -d 'fqdn = www.example.com' https://unboundtest.com/caaproblem/checkhost

2) Replace www.example.com with your domain name.

If you see output as shown below, it means your domain is not affected!

3) The certificate currently available on www.example.com is OK. It is not one of the certificates affected by the Let's Encrypt CAA rechecking problem. Its serial number is 0fd078dd48f1a2bd4d0f2ba96b6038fe0000
If your domain is affected, the message will look like this:
The certificate currently available on www.example.com needs renewal because it is affected by the Let's Encrypt CAA rechecking problem. Its serial number is 0fd078dd48f1a2bd4d0f2ba96b6038fe0000. See your ACME client documentation for instructions on how to renew a certificate.
Alternatively, you can use the following online tool to check if your domain is affected by this threat.
https://checkhost.unboundtest.com/

@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑mobile apps security

1) Make sure your application is free of vulnerabilities.
The most dangerous threat to an application is its own vulnerabilities and flaws.

Make sure there are no known vulnerabilities in your application.

It can be as a web application, mobile application, or desktop application, and the vulnerability remediation will help prevent threats.

2) Consider testing the security of your application before shipping it to production.
To eliminate the vulnerability, you can conduct security testing of your applications.

Security testing doesn't slow down the development process.

Security testing helps you find and fix vulnerabilities in your application, as well as make your applications more efficient.

Therefore, consider checking the security of your applications before going into production.

3) Bug Bounty program
Many large companies such as Mozilla, Facebook, Yahoo!, Google, Reddit, Square, and Microsoft are organizing Bug Bounty programs to identify vulnerabilities in their applications.

This program enables your organization to find and fix bugs before they become known to the public or known hackers.

This way you can prevent incidents.


4) Train your organization on application security best practices.
You can also protect your apps by educating your employees about their security.

Knowledge of cybersecurity can help your organization counter the threats of your applications.

5) Use an automatic scanner to keep the application secure.
Scanning your entire application is also a good security measure.

Consider using an automated scanner to scan that will run tests daily.

You can also use vulnerability scanning tools that are automated.

Vulnerability scanning tools will search your applications for vulnerabilities such as cross-site scripting, SQL injection, command injection, path traversal, etc.

6) Think Before Using Open Source In Your Application
open source can be vulnerable.

Thus, using open source code in your application can leave your applications vulnerable to cyber attacks.

So think twice before using open source in your application.

Riskemy.com says, "Just one line of tainted code can destroy an entire site."

7) Consider encrypting your application source code.
Source code encryption ensures that an attacker cannot gain access to the source code of your applications.

8) Penetration testing also helps protect your applications
Penetration testing is also a pentest.

Penetration testing is useful for protecting cybercriminal applications.

Penetration testing is the practice of discovering vulnerabilities in a computer system, network, or web application that an attacker could exploit.

@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑let's take a look at some of the popular bug bounty platforms.

1) Hackerone
Among boug bounty programs, Hackerone is a leader when it comes to accessing hackers, creating your reward programs, disseminating information and evaluating contributions.
You can use Hackerone in two ways: use the platform to collect vulnerability reports and write them yourself, or let Hackerone do the hard work (sorting).
Triaging is the process of reporting vulnerabilities, testing them, and communicating with hackers.

2) Bugcrowd
Bugcrowd offers several security assessment solutions, one of which is Bug Bounty.

It provides a SaaS solution that seamlessly integrates into your existing software lifecycle and makes it easy to run a successful bug-finding program.

You can choose a private bug-fighting program that involves multiple hackers, or a public one that collects thousands of sources.

3) SafeHats
If you work in a business and don't feel comfortable publishing your bug bounty program - and at the same time need more attention than a regular bug-reward platform can offer - SafeHats is your safest bet.
Dedicated security consultant, detailed hacker profiles, invite-only participation - all provided based on your needs and the maturity of your security model.

4) intigriti
Intigriti is a comprehensive bug bounty platform that connects you with White Hat hackers, whether you want to run a private or public program.

There are many generous things for hackers to get rich a little.
Depending on the size of the company and the industry, it is possible to hunt for bugs from 1,000 to 20,000 euros.


5) Synack
Synack seems to be one of those market exceptions that break the mold and end up doing something massive.
Their Hack the Pentagon security program was a major event that led to the discovery of several critical vulnerabilities.
So if you are looking for not only error detection but also top-notch security guidance and training, Synack is the place for you.

@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

sock5 proxies

https://pastebin.com/m6k8wdVC

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑DNS FILTERING :

Benefits of using DNS filtering

1) There are many benefits to using DNS filtering for you and your family.

You've probably already tried this technique, but here's some more things you need to know:

2) Provides safe internet browsing
Using DNS filtering means blocking malicious sites that could potentially steal your personal information.

🦑Some other threats:

Ransomware
Phishing
Spyware
Virus s
Malicious software
You can avoid all of the above risks simply by applying a DNS filter.
Protects your data
We all have important data on your devices, and most of the time we don't use backups.

3) If you also do, you risk losing all your data if you visit dangerous Internet sources.

Luckily, the following software will take care of this for you.

Protects your device
Regardless of whether you are browsing websites from your phone, tablet or computer, visiting malicious websites can harm your device.

Some websites can install viruses on your device remotely, which can spoil functionality and make it partially useless.

@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑ios Exploits :

Assetsd Type Confusion
lio_listio iOS 11.4.1 bug
libsqlite3 Infoleak -not yet-
libsqlite3 Memory Corruption -not yet-
Webkit Bug
Kernel Denial of Service
AFC (Apple File Conduit) Infoleak

https://github.com/rhaym-jailbreak/Exploits

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Requirements for the attacked router
Not all routers are suitable for the attacks in question, and old or highly secure equipment creates even more connection problems that sometimes cannot be established at all, for example, if the server cabinet is locked. Therefore, there are a number of specific conditions that must be met for the implementation of the task:

1) Free USB port: connecting power from the router itself via USB may be an ideal solution, but in our test we used a 3350 mAh self-contained battery, which allowed the

2) Orange Pi Zero to work uninterruptedly for 10 hours under medium to heavy load.

3) Available Ethernet port: to carry out an attack, you will need a free network connector on the router, but in large networks all RJ-45s are busy, so here it is preferable to use Orange Pi R1 with two connected Ethernet interfaces, which allow unauthorized connection to network devices by an intermediary method ( MITM).

4) Working DHCP Service: This component, which works in almost all network infrastructures, is required to automatically obtain an IP address for the Orange Pi Zero. However, institutions with a high level of information security, such as, for example, banks, may use complex static network configurations that can be used only after passing authentication, but such cases are beyond the scope of our publication, so we will not consider them for now.



@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. All the information we have so far is included in this page.

https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails

All sim tools in one place

https://github.com/gabessolo/SIM-TOOLS

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑rogue software tampering with ie homepage

1) The registry value corresponding to the internet option:

　　HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page

　　The value of this item is synchronized with the home page in the ie option, you can try it first.

2) Bind the operating parameters of the ie main program:

　　HKEY_CLASSES_ROOT\Applications\iexplore.exe\shell\open\command


ie main program operating parameters

　　The normal value of this item is "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1. The rogue software appends its own website address as a running parameter, then it will automatically jump to when opening the main program of ie The website, this trick is ruthless.

3) Bind the ieframe.dll home page command of the ie form control:

　　HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command

Home page command of ie form control

　　The default value of this item is "C:\Program Files\Internet Explorer\iexplore.exe". Similarly, rogue URLs may be appended to block the homepage.

4) Bind ie shortcut operation target:

　　There is also a method that can't be searched in the registry, but is far away in front of you, is to modify the run target in the ie shortcut properties. Note that it is a shortcut, not the ie icon displayed by default on the desktop. There are four normal ie shortcuts:
ie shortcut

　　It can be seen that the above three ie shortcuts are created by the desktop ie icon, by the ie icon at the top of the start menu, and by the system disk ie main program (Of course, if you hide the extension, the third shortcut will not be available. exe suffix), the fourth is the "Start Internet Explorer" icon on the quick launch bar to the right of the start button. Right-click to view these shortcut properties:

Ie shortcut created from the start menu ie icon

Shortcut created by the ie icon in the quick launch bar
6) 　The author has deleted the icon to start IE in the quick launch bar. I put a pen to memorialize, and come from afar, so the window above is slightly foreign. For these two shortcuts, the target default value is "C:\Program Files\Internet Explorer\iexplore.exe". Now the virus is free to drill. As long as you append your own URL to the back, then you can use this icon When you open IE, you will immediately jump to its web site, which is extremely versatile.

7)Therefore, I suggest that if the homepage is tampered with and cannot be changed back, please right-click the shortcut opened when you start IE, and see if there is an additional URL after the property "Target", delete it if there is any; if not, go to the registry Check out those possible locations:

　　HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
　　HKEY_CLASSES_ROOT\Applications\iexplore.exe\shell\open\command
　　HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command

@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑FOR CRACKING :

The MD5


MD5Decrypter (UK)
http://www.md5decrypter.co.uk/

Plain the Text-
http://plain-text.info/add/

Crackfoo -NNC
http://crackfoo.nicenamecrew.com/

Hashcrack
http://hashcrack.com/index.php

, Gdata
http://gdataonline.com/seekhash.php

MD5this
http://www.md5this.com/crack-it-/index.php

MD5crack
http://md5crack.com/

Noisette
http://md5.noisette.ch/index.php

Joomlaaa
http://www.joomlaaa.com/md5-coding-decoding
Igrkio


MD5decrypter
http://www.md5decrypter.com/

Shell-Storm
http://www.shell-storm.org/md5/

NetMD5crack
http://www.netmd5crack.com/cracker/

XMD5
http://md5.thekaine.de/

IF A WEBSITE DOWN, TRY AGAIN LATER
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑How to remotely install applications on an Android smartphone :

Step 1. Open the Play Store in a browser
If you have a link to the app, you can follow it in a browser on any device and then go to step 3.

It usually starts with visiting the Play Store through the device's browser. If it's an iPhone or Mac, you can use the Safari browser. The store link looks like play.google.com/store.



Step 2. Find the app page in the store
You can jump directly to the application you want if you have a link to the page. Alternatively, you can search the store by name. It is possible to filter search results. For example, select only apps in a tab in the menu on the left. You can click "See More" next to the "Applications" section in the search results.



Step 3. Remote installation of the application
Click on the "Install" button. If the app is already installed on the device, this is reported. You need to sign in to your Google account, which is used on the Android device.

If you are already signed in and you are not using this Android device, you can change your account by clicking on your profile picture in the upper right corner.



You will see a list of Android devices associated with this account, including tablets and Android TVs. If the currently selected device is not where you will install the application, click on the name of the desired device in the drop-down menu. After selecting, click "Continue".


If this is the first time you do this, a window will appear asking when authorization is required. Whichever option you choose, a password is always required for a remote installation. You can also add the need to enter a password when shopping.

Select the option you want and click Save. After the download is complete, a message appears that the application is being installed.


Return to your smartphone and the installation of the application will begin. The duration depends on the connection speed.


@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑ENCRYPT EMAIL :
use PKI/CA certification to encrypt encrypted mail

1) Most of the current email encryption systems are based on this encryption method. PKI (Public Key Infrastructure) refers to the public key infrastructure, and CA (Certificate Authority) refers to the certification center.

2) PKI technically solves various obstacles to network communication security; CA solves the problem of network trust from multiple perspectives such as operation, management, regulation, law, and personnel. Therefore, people collectively referred to as "PKI/CA".

3) From the perspective of the overall structure, PKI/CA is mainly composed of end users, certification centers and registration agencies. The working principle of PKI/CA is to establish a trust network by issuing and maintaining digital certificates. Users in the same trust network complete identity authentication and security processing through the digital certificates they apply for.

4) The registration center is responsible for reviewing the true identity of the certificate applicant. After the review is passed, it is responsible for uploading user information to the certification center through the network, and the certification center is responsible for the final certification processing.

5) The revocation and renewal of the certificate also needs to be submitted by the registration agency to the certification center for processing. In general, the certification center is oriented to each registration center, and the registration center is oriented to the end user, and the registration agency is the intermediate channel between the user and the certification center. The management of public key certificates is a complex system.

6) A typical, complete and effective CA system should at least have the following parts: public key cryptographic certificate management; blacklist release and management; key backup and recovery; automatic key update; historical key management; support for cross-certification, etc. Wait. The PKI/CA certification system is relatively mature, but when it is applied to an email encryption system, there are also complex key management. It is necessary to exchange keys before encryption and decryption operations, etc. The well-known email encryption system PGP uses this encryption process for encryption. .

7) This encryption method is only suitable for enterprises, organizations and some high-end users. Because of the trouble to obtain CA certificates and cumbersome exchanges, this type of email encryption mode has been difficult to popularize.


@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑ANOTHER METHODE UNLOCK ENCRYPTED EXCEL:

Unlocking files with Microsoft Visual Basic for Applications
If you lose your password from Excel documents, one of the ways to recover it is to use the MS VBA program, which you need to download from the official Microsoft website.

Step 1: Run "VBA" and open the Excel spreadsheet, from which the passphrase is lost through the menu "File" - "Open"

Step 2: Click "Insert" in the toolbar and select the "Module" option

Step 3: Press the key combination "Alt + F11", then the "VBA" window will appear on the right

Step 4: Enter the command "VBA" in this window

Step 5: Next, you need to press "F5" to start the recovery process

Step 6: Wait a few minutes until the end of unlocking, after which a new window will appear with a set password, which can be used without restrictions for normal editing of our file
The only drawback of this method is that it is applicable only to one Excel sheet, and if there are several of them, you will have to repeat this procedure for each part of the table.


@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁