β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Hacking with shells pdfs :
https://paper.seebug.org/papers/Security%20Conf/KCon/2015/Shell%20Hacking.pdf
http://langevin.univ-tln.fr/cours/UPS/extra/Linux-101-Hacks.pdf
http://opensecuritytraining.info/HTID_files/Day11-SoftwareExploitation-Shellcode.pdf
http://docshare01.docshare.tips/files/26981/269810551.pdf
https://doc.lagout.org/security/linux-server-hacks.pdf
http://www.deer-run.com/~hal/EUGLUG-Hacking.pdf
http://www.it-docs.net/download/doc/900/linux-101-hacks---practical-examples-to-build-a-strong-fundation-in-linux---.html
https://www.imperva.com/docs/HII_Remote_and_Local_File_Inclusion_Vulnerabilities.pdf
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Hacking with shells pdfs :
https://paper.seebug.org/papers/Security%20Conf/KCon/2015/Shell%20Hacking.pdf
http://langevin.univ-tln.fr/cours/UPS/extra/Linux-101-Hacks.pdf
http://opensecuritytraining.info/HTID_files/Day11-SoftwareExploitation-Shellcode.pdf
http://docshare01.docshare.tips/files/26981/269810551.pdf
https://doc.lagout.org/security/linux-server-hacks.pdf
http://www.deer-run.com/~hal/EUGLUG-Hacking.pdf
http://www.it-docs.net/download/doc/900/linux-101-hacks---practical-examples-to-build-a-strong-fundation-in-linux---.html
https://www.imperva.com/docs/HII_Remote_and_Local_File_Inclusion_Vulnerabilities.pdf
β β β Uππ»βΊπ«Δπ¬πβ β β β
Forwarded from UNDERCODE NEWS
It is confirmed that Samsung is betting on the simple model, planning to substantially . the price of the Galaxy S21.
#Technologies
#Technologies
Forwarded from UNDERCODE NEWS
How did NASDAQ jumped 2.6% ? Is Tesla worth more than Facebook ?
#Analytiques
#Analytiques
Forwarded from DailyCVE
π΅Unpacthed Telegram Desktop Vulnerability - Api issue could allow attacker to disable notification for specific user:
https://dailycve.com/unpacthed-telegram-desktop-vulnerability-api-issue-could-allow-attacker-disable-notification
https://dailycve.com/unpacthed-telegram-desktop-vulnerability-api-issue-could-allow-attacker-disable-notification
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Powerfull real hacking utilities :
Automatically collects basic recon
Automatically launches Google hacking queries against a target domain
Automatically enumerates open ports via NMap port scanning
Automatically brute forces sub-domains, gathers DNS info and checks for zone transfers
Automatically checks for sub-domain hijacking
Automatically runs targeted NMap scripts against open ports
Automatically runs targeted Metasploit scan and exploit modules
Automatically scans all web applications for common vulnerabilities
Automatically brute forces ALL open services
Automatically test for anonymous FTP access
Automatically runs WPScan, Arachni and Nikto for all web services
Automatically enumerates NFS shares
Automatically test for anonymous LDAP access
Automatically enumerate SSL/TLS ciphers, protocols and vulnerabilities
Automatically enumerate SNMP community strings, services and users
Automatically list SMB users and shares, check for NULL sessions and exploit MS08-067
Automatically exploit vulnerable JBoss, Java RMI and Tomcat servers
Automatically tests for open X11 servers
Auto-pwn added for Metasploitable, ShellShock, MS08-067, Default Tomcat Creds
Performs high level enumeration of multiple hosts and subnets
Automatically integrates with Metasploit Pro, MSFConsole and Zenmap for reporting
Automatically gathers screenshots of all web sites
Create individual workspaces to store all scan output
AUTO-PWN:
Apache Struts CVE-2018-11776 RCE exploit
Android Insecure ADB RCE auto exploit
Apache Tomcat CVE-2017-12617 RCE exploit
Oracle WebLogic WLS-WSAT Component Deserialisation RCE CVE-2017-10271 exploit
Drupal Drupalgedon2 RCE CVE-2018-7600
GPON Router RCE CVE-2018-10561
Apache Struts 2 RCE CVE-2017-5638
Apache Struts 2 RCE CVE-2017-9805
Apache Jakarta RCE CVE-2017-5638
Shellshock GNU Bash RCE CVE-2014-6271
HeartBleed OpenSSL Detection CVE-2014-0160
Default Apache Tomcat Creds CVE-2009-3843
MS Windows SMB RCE MS08-067
Webmin File Disclosure CVE-2006-3392
Anonymous FTP Access
PHPMyAdmin Backdoor RCE
PHPMyAdmin Auth Bypass
JBoss Java De-Serialization RCEs
πΈπ½π π π°π»π»πΈπ π°π πΈπΎπ½ & π π π½ :
1) Download https://github.com/telnet22/Kn0ck
2) -> knock.conf
CENSYS_APP_ID="REDACTED"
CENSYS_API_SECRET="REDACTED"
Β» KALI LINUX INSTALL:
chmod +x install.sh
./install.sh
Β» DEBIAN OR UBUNTU INSTALL:
chmod +x install_for_debian_ubuntu.sh
./install_for_debian_ubuntu.sh
[*] NORMAL MODE
knock -t <TARGET>
[*] NORMAL MODE + OSINT + RECON
knock -t <TARGET> | -o (Osint) | -re (Recon)
[*] STEALTH MODE + OSINT + RECON
knock -t <TARGET> | -m stealth | -o (Osint) | -re (Recon)
[*] DISCOVER MODE
knock -t <Target> | -m discover | -w <WORSPACE_ALIAS>
[*] SCAN ONLY SPECIFIC PORT
knock -t <TARGET> | -m port | -p <portnum>
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Powerfull real hacking utilities :
Automatically collects basic recon
Automatically launches Google hacking queries against a target domain
Automatically enumerates open ports via NMap port scanning
Automatically brute forces sub-domains, gathers DNS info and checks for zone transfers
Automatically checks for sub-domain hijacking
Automatically runs targeted NMap scripts against open ports
Automatically runs targeted Metasploit scan and exploit modules
Automatically scans all web applications for common vulnerabilities
Automatically brute forces ALL open services
Automatically test for anonymous FTP access
Automatically runs WPScan, Arachni and Nikto for all web services
Automatically enumerates NFS shares
Automatically test for anonymous LDAP access
Automatically enumerate SSL/TLS ciphers, protocols and vulnerabilities
Automatically enumerate SNMP community strings, services and users
Automatically list SMB users and shares, check for NULL sessions and exploit MS08-067
Automatically exploit vulnerable JBoss, Java RMI and Tomcat servers
Automatically tests for open X11 servers
Auto-pwn added for Metasploitable, ShellShock, MS08-067, Default Tomcat Creds
Performs high level enumeration of multiple hosts and subnets
Automatically integrates with Metasploit Pro, MSFConsole and Zenmap for reporting
Automatically gathers screenshots of all web sites
Create individual workspaces to store all scan output
AUTO-PWN:
Apache Struts CVE-2018-11776 RCE exploit
Android Insecure ADB RCE auto exploit
Apache Tomcat CVE-2017-12617 RCE exploit
Oracle WebLogic WLS-WSAT Component Deserialisation RCE CVE-2017-10271 exploit
Drupal Drupalgedon2 RCE CVE-2018-7600
GPON Router RCE CVE-2018-10561
Apache Struts 2 RCE CVE-2017-5638
Apache Struts 2 RCE CVE-2017-9805
Apache Jakarta RCE CVE-2017-5638
Shellshock GNU Bash RCE CVE-2014-6271
HeartBleed OpenSSL Detection CVE-2014-0160
Default Apache Tomcat Creds CVE-2009-3843
MS Windows SMB RCE MS08-067
Webmin File Disclosure CVE-2006-3392
Anonymous FTP Access
PHPMyAdmin Backdoor RCE
PHPMyAdmin Auth Bypass
JBoss Java De-Serialization RCEs
πΈπ½π π π°π»π»πΈπ π°π πΈπΎπ½ & π π π½ :
1) Download https://github.com/telnet22/Kn0ck
2) -> knock.conf
CENSYS_APP_ID="REDACTED"
CENSYS_API_SECRET="REDACTED"
Β» KALI LINUX INSTALL:
chmod +x install.sh
./install.sh
Β» DEBIAN OR UBUNTU INSTALL:
chmod +x install_for_debian_ubuntu.sh
./install_for_debian_ubuntu.sh
[*] NORMAL MODE
knock -t <TARGET>
[*] NORMAL MODE + OSINT + RECON
knock -t <TARGET> | -o (Osint) | -re (Recon)
[*] STEALTH MODE + OSINT + RECON
knock -t <TARGET> | -m stealth | -o (Osint) | -re (Recon)
[*] DISCOVER MODE
knock -t <Target> | -m discover | -w <WORSPACE_ALIAS>
[*] SCAN ONLY SPECIFIC PORT
knock -t <TARGET> | -m port | -p <portnum>
β β β Uππ»βΊπ«Δπ¬πβ β β β
GitHub
GitHub - 0x0d3ad/Kn0ck: Automated Tools Pentest
Automated Tools Pentest. Contribute to 0x0d3ad/Kn0ck development by creating an account on GitHub.
Forwarded from DailyCVE
π΅MERCUSYS Mercury devices allow Directory Traversal :
https://dailycve.com/mercusys-mercury-devices-allow-directory-traversal
https://dailycve.com/mercusys-mercury-devices-allow-directory-traversal
Dailycve
MERCUSYS Mercury devices allow Directory Traversal | CVE
Details:
MERCUSYS Mercury X18G 1.0.5 devices, as shown by the /../../conf/template/uhttpd.json URI, allow Directory Traversal via ../ to the UPnP server.
Affected Versions:
X18G 1.0.5
Vulnerability:
Directory Traversal
References:
https:/β¦
MERCUSYS Mercury X18G 1.0.5 devices, as shown by the /../../conf/template/uhttpd.json URI, allow Directory Traversal via ../ to the UPnP server.
Affected Versions:
X18G 1.0.5
Vulnerability:
Directory Traversal
References:
https:/β¦
Forwarded from UNDERCODE NEWS
Horizon, the domestic artificial intelligence chip firm, announced the completion of the US$400 million C2 round.
#Technologies
#Technologies
Forwarded from UNDERCODE NEWS
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦WPA 2 - WIFI HACKING PDFS:
http://webpages.eng.wayne.edu/~fy8421/16sp-csc5991/slides/lab7/wpa2-cracking-kolias.pdf
http://www.og150.com/assets/Wireless%20Pre-Shared%20Key%20Cracking%20WPA,%20WPA2.pdf
https://www.techscience.com/iasc/v25n1/39645/pdf
https://ijarse.com/images/fullpdf/1519302206_SVCET2084ijarse.pdf
https://owasp.org/www-chapter-dorset/assets/presentations/2020-01/OWASP-wlans.pdf
https://benjaminkiesl.github.io/publications/a_formal_analysis_of_ieees_wpa2_cremers_kiesl_medinger.pdf
https://alexandreborgesbrazil.files.wordpress.com/2014/02/cracking_wireless.pdf
http://www.iaea.org/inis/collection/NCLCollectionStore/_Public/46/130/46130069.pdf
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦WPA 2 - WIFI HACKING PDFS:
http://webpages.eng.wayne.edu/~fy8421/16sp-csc5991/slides/lab7/wpa2-cracking-kolias.pdf
http://www.og150.com/assets/Wireless%20Pre-Shared%20Key%20Cracking%20WPA,%20WPA2.pdf
https://www.techscience.com/iasc/v25n1/39645/pdf
https://ijarse.com/images/fullpdf/1519302206_SVCET2084ijarse.pdf
https://owasp.org/www-chapter-dorset/assets/presentations/2020-01/OWASP-wlans.pdf
https://benjaminkiesl.github.io/publications/a_formal_analysis_of_ieees_wpa2_cremers_kiesl_medinger.pdf
https://alexandreborgesbrazil.files.wordpress.com/2014/02/cracking_wireless.pdf
http://www.iaea.org/inis/collection/NCLCollectionStore/_Public/46/130/46130069.pdf
β β β Uππ»βΊπ«Δπ¬πβ β β β
Forwarded from DailyCVE
π΅Bug in discord api, causing a security issue :
https://dailycve.com/bug-discord-api-causing-security-issue
https://dailycve.com/bug-discord-api-causing-security-issue
Dailycve
Bug in discord api, causing a security issue | CVE
Details:
Fetching a guild template via the API on v6 gives you a serialized_source_guild in v8 payload serialisation and not v6.
Steps to Reproduce
GET /api/v6/guilds/templates/{code}
Expected Behavior
v6 guild data (e.g.permission_overwrites areβ¦
Forwarded from UNDERCODE NEWS
Don Brovskis, Vice President of the European: The European Union is still committed to settling the conflict with the United States over the levy on internet services.
#International
#International
Forwarded from UNDERCODE NEWS
Amazon is setting up an affordable housing initiative but is not changing the job standards.
#International
#International
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦ Parsing the / etc / shadow file :
1.Username: This is your login name.
2. Password: This is your encrypted password. The password must be at least 8-12 characters long, including special characters, numbers, lowercase letters, etc.
Usually the password format is $ id $ salt $ hashed. $ Id is an algorithm used in GNU / Linux as follows:
$1$ this is MD5
$2a$ this is Blowfish
$2y$ this is Blowfish
$5$ it's SHA-256
$6$ this is SHA-512
3. Last change of password (last change): days since January 1, 1970, when the password was last changed.
4. Minimum: The minimum number of days required to change the password, that is, the number of days remaining before the user is allowed to change their password.
5. Maximum: The maximum number of days the password is valid (after this user is forced to change his password)
6. Warning: The number of days before the password expires that the user is warned to change the password.
7. Inactivity: the number of days after the password expires that the account has been disabled.
8. Expiration Date: Days from January 1, 1970, when this account is disabled, that is, an absolute date indicating when the login can no longer be used.
How do I change my password?
Use the following syntax to change your own password:
$ passwd
See the passwd command man page for more information.
How can I change the password for another user?
You must be root to change the password for other users:
# passwd userNameHere
or
$ sudo passwd userNameHere
How do I change or set password expiration information?
To change the password expiration information for a user, use the chage command on Linux.
The syntax is as follows (again, you must be root to set the password again):
chage username
chage [options] username
chage itsecforu
chage -l tom
The following options are possible:
-d, --lastday LAST_DAY set date of last password change to LAST_DAY
-E, --expiredate EXPIRE_DATE set account expiration date to EXPIRE_DATE
-h, --help display this help message and exit
-I, --inactive INACTIVE set password inactive after expiration
to INACTIVE
-l, --list show account aging information
-m, --mindays MIN_DAYS set minimum number of days before password
change to MIN_DAYS
-M, --maxdays MAX_DAYS set maximim number of days before password
change to MAX_DAYS
-R, --root CHROOT_DIR directory to chroot into
-W, --warndays WARN_DAYS set expiration warning days to WARN_DAYS
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦ Parsing the / etc / shadow file :
1.Username: This is your login name.
2. Password: This is your encrypted password. The password must be at least 8-12 characters long, including special characters, numbers, lowercase letters, etc.
Usually the password format is $ id $ salt $ hashed. $ Id is an algorithm used in GNU / Linux as follows:
$1$ this is MD5
$2a$ this is Blowfish
$2y$ this is Blowfish
$5$ it's SHA-256
$6$ this is SHA-512
3. Last change of password (last change): days since January 1, 1970, when the password was last changed.
4. Minimum: The minimum number of days required to change the password, that is, the number of days remaining before the user is allowed to change their password.
5. Maximum: The maximum number of days the password is valid (after this user is forced to change his password)
6. Warning: The number of days before the password expires that the user is warned to change the password.
7. Inactivity: the number of days after the password expires that the account has been disabled.
8. Expiration Date: Days from January 1, 1970, when this account is disabled, that is, an absolute date indicating when the login can no longer be used.
How do I change my password?
Use the following syntax to change your own password:
$ passwd
See the passwd command man page for more information.
How can I change the password for another user?
You must be root to change the password for other users:
# passwd userNameHere
or
$ sudo passwd userNameHere
How do I change or set password expiration information?
To change the password expiration information for a user, use the chage command on Linux.
The syntax is as follows (again, you must be root to set the password again):
chage username
chage [options] username
chage itsecforu
chage -l tom
The following options are possible:
-d, --lastday LAST_DAY set date of last password change to LAST_DAY
-E, --expiredate EXPIRE_DATE set account expiration date to EXPIRE_DATE
-h, --help display this help message and exit
-I, --inactive INACTIVE set password inactive after expiration
to INACTIVE
-l, --list show account aging information
-m, --mindays MIN_DAYS set minimum number of days before password
change to MIN_DAYS
-M, --maxdays MAX_DAYS set maximim number of days before password
change to MAX_DAYS
-R, --root CHROOT_DIR directory to chroot into
-W, --warndays WARN_DAYS set expiration warning days to WARN_DAYS
β β β Uππ»βΊπ«Δπ¬πβ β β β
Forwarded from DailyCVE
π΅FasterXML jackson-databind code issue vulnerability:
https://dailycve.com/fasterxml-jackson-databind-code-issue-vulnerability
https://dailycve.com/fasterxml-jackson-databind-code-issue-vulnerability
Dailycve
FasterXML jackson-databind code issue vulnerability | CVE
Details:
FasterXML jackson-databind is a JAVA-based library that can use JAVA objects to translate data formats such as XML and JSON. Jackson can quickly translate Java objects to Json objects and xml records, as well as to Java objects with Json and xml.β¦
FasterXML jackson-databind is a JAVA-based library that can use JAVA objects to translate data formats such as XML and JSON. Jackson can quickly translate Java objects to Json objects and xml records, as well as to Java objects with Json and xml.β¦
Forwarded from UNDERCODE NEWS
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Go example code to modify the file name recursively:
package main
import (
"bufio"
"fmt"
"io/ioutil"
"log"
"os"
"strings"
)
var pathSeparator = string(os.PathSeparator)
/**
*/
func rename(path string, old string, new string) (err error) {
files, err := ioutil.ReadDir(path)
if err != nil {
return err
}
for _, fileInfo := range files {
if fileInfo.IsDir() {
err = rename(path+pathSeparator+fileInfo.Name(), old, new)
if err != nil {
return err
}
err = os.Rename(path+pathSeparator+fileInfo.Name(), path+pathSeparator+strings.Replace(fileInfo.Name(), old, new, -1))
if err != nil {
return err
}
} else {
err = os.Rename(path+pathSeparator+fileInfo.Name(), path+pathSeparator+strings.Replace(fileInfo.Name(), old, new, -1))
if err != nil {
return err
}
}
}
return err
}
func main() {
reader := bufio.NewReader(os.Stdin)
filePath, _ := reader.ReadString('\n')
filePath = strings.Replace(filePath, "\n", "", -1)
fmt.Print(οΌ")
reader = bufio.NewReader(os.Stdin)
name, _ := reader.ReadString('\n')
name = strings.Replace(name, "\n", "", -1)
err := rename(filePath, name, "")
if err != nil {
log.FatalfοΌ%v\n", err)
}
err = os.Rename(filePath, strings.Replace(filePath, name, "", -1))
if err != nil {
log.Fatalf
}
fmt.Println("success")
}
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Go example code to modify the file name recursively:
package main
import (
"bufio"
"fmt"
"io/ioutil"
"log"
"os"
"strings"
)
var pathSeparator = string(os.PathSeparator)
/**
*/
func rename(path string, old string, new string) (err error) {
files, err := ioutil.ReadDir(path)
if err != nil {
return err
}
for _, fileInfo := range files {
if fileInfo.IsDir() {
err = rename(path+pathSeparator+fileInfo.Name(), old, new)
if err != nil {
return err
}
err = os.Rename(path+pathSeparator+fileInfo.Name(), path+pathSeparator+strings.Replace(fileInfo.Name(), old, new, -1))
if err != nil {
return err
}
} else {
err = os.Rename(path+pathSeparator+fileInfo.Name(), path+pathSeparator+strings.Replace(fileInfo.Name(), old, new, -1))
if err != nil {
return err
}
}
}
return err
}
func main() {
reader := bufio.NewReader(os.Stdin)
filePath, _ := reader.ReadString('\n')
filePath = strings.Replace(filePath, "\n", "", -1)
fmt.Print(οΌ")
reader = bufio.NewReader(os.Stdin)
name, _ := reader.ReadString('\n')
name = strings.Replace(name, "\n", "", -1)
err := rename(filePath, name, "")
if err != nil {
log.FatalfοΌ%v\n", err)
}
err = os.Rename(filePath, strings.Replace(filePath, name, "", -1))
if err != nil {
log.Fatalf
}
fmt.Println("success")
}
β β β Uππ»βΊπ«Δπ¬πβ β β β
Hi all, https://Best.undercode.help :
In this blog we want to upload daily links about top rated apps/softwares and much more checkout the next message, and thanks.
In this blog we want to upload daily links about top rated apps/softwares and much more checkout the next message, and thanks.
Best 50 websites for watching movies for Free in 2021 :
https://best.undercode.help/best-50-websites-for-watch-movies-for-free-in-2021/
https://best.undercode.help/best-50-websites-for-watch-movies-for-free-in-2021/
best.undercode.help
Best 50 websites for watch movies for free in 2021 :
β¦
Forwarded from UNDERCODE NEWS
Valve officially released a Steam beta announcement, opened the remote fun function for domestic players.
#Updates
#Updates
Forwarded from UNDERCODE NEWS
The Russian government has formed the final version of the list of Russian programs for installation on new mobile devices.
#International
#International