UNDERCODE COMMUNITY
2.68K subscribers
1.23K photos
31 videos
2.65K files
80.2K links
๐Ÿฆ‘ Undercode Cyber World!
@UndercodeCommunity


1๏ธโƒฃ World first platform which Collect & Analyzes every New hacking method.
+ AI Pratice
@Undercode_Testing

2๏ธโƒฃ Cyber & Tech NEWS:
@Undercode_News

3๏ธโƒฃ CVE @Daily_CVE

โœจ Web & Services:
โ†’ Undercode.help
Download Telegram
- - - - - Uา‰Nา‰Dา‰Eา‰Rา‰Cา‰Oา‰Dา‰Eา‰- - - - -

๐Ÿฆ‘ A fake implementation of AWS SNS to test against Tested :
t.me/UnderCodeTestingOfficial

๐Ÿฆ‘INSTALLISATION & RUN:

There are 2 ways of running FakeSNS, as a gem, or as plain Rack app. The first is easy, the latter is more flexible.

A) As a gem:

1) git clone https://github.com/yourkarma/fake_sns

2) cd fake_sns

3) gem install fake_sns

4) fake_sns -p 9292

5) To configure AWS-SDK to send messages here:

AWS.config(
use_ssl: false,
sns_endpoint: "0.0.0.0",
sns_port: 9292,
)

๐Ÿฆ‘ Command line options:

1) Store the database somewhere else: --database FILENAME or specify an in memory database that will be lost: --database :memory:


2) To get a YAML representation of all the data known to FakeSNS, do a GET request to the root path:

> curl -X GET http://localhost:9292/

3) To change the database, submit the contents you got from the previous step, augment it and submit it as the body of a PUT request:

> curl -X GET http://localhost:9292/ -o my-data.yml
vim my-data.yml

> curl -X PUT --data @my-data.yml http://localhost:9292/

4) To reset the entire database, send a DELETE request:

> curl -X DELETE http://localhost:9292/

5) To send ALL the messages stored in the queue, you can send a post request:

> curl -X POST http://localhost:9292/drain

6) You can also just send a single message:

> curl -X POST http://localhost:9292/drain/:message_id

7) Currently, only HTTP/HTTPS and SQS endpoints are working. You'll need to pass AWS config (in JSON format) for the SQS integration to work. See [FakeSNS] [fake_sns] for more information.

> curl \
-X POST \
--data '{"aws_config": {"use_ssl": false, "sqs_endpoint": "localhost", "sqs_port": 4789, "secret_access_key": "xxx", "access_key_id": "yyy"}}' \
http://localhost:9292/drain

๐Ÿฆ‘ENJOY

Written by @ ฬตอ‘Mฬตอ˜ ฬ ฬ–rฬถฬ•.ฬตฬ ฬทอ Bฬดอ˜Oฬทฬ“Tฬถฬ†NฬดฬEฬถอ›Tฬถฬ…(tm
- - - - - Uา‰Nา‰Dา‰Eา‰Rา‰Cา‰Oา‰Dา‰Eา‰- - - - -


Written by @ ฬตอ‘Mฬตอ˜ ฬ ฬ–rฬถฬ•.ฬตฬ ฬทอ Bฬดอ˜Oฬทฬ“Tฬถฬ†NฬดฬEฬถอ›Tฬถฬ…(tm
- - - - - Uา‰Nา‰Dา‰Eา‰Rา‰Cา‰Oา‰Dา‰Eา‰- - - - -
- - - - Uา‰Nา‰Dา‰Eา‰Rา‰Cา‰Oา‰Dา‰Eา‰- - - -

๐Ÿฆ‘HOW PROTECT YOUR LIinux Server FROM HACK:
(instagram.com/UnderCodeTestingCompany)

๐Ÿฆ‘๐Ÿ…ป๐Ÿ…ด๐Ÿ†ƒ ๐Ÿ†‚ ๐Ÿ†‚๐Ÿ†ƒ๐Ÿ…ฐ๏ธ๐Ÿ†๐Ÿ†ƒ:

> Nothing safe 100% but some tricks make you more secure:

1) update && upgrade the all packages on the server;

2) Install ufw - plain firewall;

3) close all server's ports besides SSH, HTTP(s) ports;

4) Install and config fail2ban utility. It helps to analyze the /var/log/auth.log and ban some IPs if they make some wrong activity;

5) change sshd config to accept the authorization only by private key.


๐Ÿฆ‘What if Your linux server is infected ?

your server is infected, and you need to know how to research and clean it.

> The best way - recreating the VPS.

> From their dashboard, it is possible to recreate (drop and create new) VPS with the same IP in one click.

> After that on local PC, was generated SSH keys with an ssh-keygen utility (is a part of standard OpenSSH package).

@ ฬตอ‘Mฬตอ˜ ฬ ฬ–rฬถฬ•.ฬตฬ ฬทอ Bฬดอ˜Oฬทฬ“Tฬถฬ†NฬดฬEฬถอ›Tฬถฬ…(tm
- - - - - Uา‰Nา‰Dา‰Eา‰Rา‰Cา‰Oา‰Dา‰Eา‰- - - -
- - - - Uา‰Nา‰Dา‰Eา‰Rา‰Cา‰Oา‰Dา‰Eา‰- - - - -

๐Ÿฆ‘BEST OS FOR SERVER HOST:
T.me/iosDeveloppers

๐Ÿฆ‘We will start this list with maybe the most well known Os till less:

1) Ubuntu Server

2) Debian can be configured till host or persoanl uses & Hosts

3) Fedora

4) Microsoft Windows Server recommended and used by undercOde

5) CentOS Server

6) Red Hat Enterprise Linux Server

7) Unix Server

@ ฬตอ‘Mฬตอ˜ ฬ ฬ–rฬถฬ•.ฬตฬ ฬทอ Bฬดอ˜Oฬทฬ“Tฬถฬ†NฬดฬEฬถอ›Tฬถฬ…(tm
- - - - - Uา‰Nา‰Dา‰Eา‰Rา‰Cา‰Oา‰Dา‰Eา‰- - - -
- - - - Uา‰Nา‰Dา‰Eา‰Rา‰Cา‰Oา‰Dา‰Eา‰- - - - -

๐Ÿฆ‘Types of Attacks against Web Servers:
t.me/UnderCodeTestingOfficial

1) Directory traversal attacks

> This type of attacks exploits bugs in the web server to gain unauthorized access to files and folders that are not in the public domain. Once the attacker has gained access, they can download sensitive information, execute commands on the server or install malicious software.

2) Denial of Service Attacks

> With this type of attack, the web server may crash or become unavailable to the legitimate users.

3) Domain Name System Hijacking

> With this type of attacker, the DNS setting are changed to point to the attackerโ€™s web server. All traffic that was supposed to be sent to the web server is redirected to the wrong one.

4) Sniffing

> Unencrypted data sent over the network may be intercepted and used to gain unauthorized access to the web server.

5) Phishing

> With this type of attack, the attack impersonates the bsites and directs traffic to the fake website. Unsuspecting users may be tricked into submitting sensitive data such as login details, credit card numbers, etc.

6) Pharming

> With this type of attack, the attacker compromises the Domain Name System (DNS) servers or on the user computer so that traffic is directed to a malicious site.

7) Defacement

> With this type of attack, the attacker replaces the organizationโ€™s website with a different page that contains the hackerโ€™s name, images and may include background music and messages not recommended

Written by ฬตอ‘Mฬตอ˜ ฬ ฬ–rฬถฬ•.ฬตฬ ฬทอ Bฬดอ˜Oฬทฬ“Tฬถฬ†NฬดฬEฬถอ›Tฬถฬ…(tm
- - - - - Uา‰Nา‰Dา‰Eา‰Rา‰Cา‰Oา‰Dา‰Eา‰- - - -
- - - - - Uา‰Nา‰Dา‰Eา‰Rา‰Cา‰Oา‰Dา‰Eา‰- - - - -

๐Ÿฆ‘ Lists of games can be hacked with game gardian
t.me/IOsDeveloppers

๐Ÿฆ‘๐Ÿ…ป๐Ÿ…ด๐Ÿ†ƒ ๐Ÿ†‚ ๐Ÿ†‚๐Ÿ†ƒ๐Ÿ…ฐ๏ธ๐Ÿ†๐Ÿ†ƒ:

1) Kingsman: The Secret Service
https://play.google.com/store/apps/details?id=com.yesgnome.kingsman

2) Demon hunt 2: the legend of archer
https://play.google.com/store/apps/details?id=com.ycgame.acrherGlory

3) Dragon's Blade
https://play.google.com/store/apps/details?id=com.natemonster.dragonsblade

4) Knight of Pen and Paper 2
https://play.google.com/store/apps/details?id=com.paradoxplaza.kopp2

5) Dead Ahead: Zombie Warfare
https://play.google.com/store/apps/details?id=com.mobirate.DeadAheadTactics

6) Stickman Legends - Ninja Hero: Knight, Shooter RPG
https://play.google.com/store/apps/details?id=com.zitga.ninja.stickman.legends

7) Kingdom Quest: Crimson Warden
https://play.google.com/store/apps/details?id=com.mmde.crimsonwarden1

8) DemonSouls (Action RPG)
https://play.google.com/store/apps/details?id=com.nova.DemonSouls

9) Linear Quest
https://play.google.com/store/apps/details?id=com.llgroup.linearquest

10) Merchants of Space: Galactic Outpost Strategy
https://play.google.com/store/apps/details?id=com.possiblegames.outpost

11) Mystic Guardian : Old School Action RPG
https://play.google.com/store/apps/details?id=com.buffstudio.mysticguardian

12) Spaceship V
https://play.google.com/store/apps/details?id=com.nsouls.spaceshipv

13) Space STG II - Death Rain
https://play.google.com/store/apps/details?id=org.ovh.grzegorzaeSTG2

14) Space City: building game
https://play.google.com/store/apps/details?id=com.spheregamestudios.spacecity

15) Caves (Roguelike)
https://play.google.com/store/apps/details?id=thirty.six.dev.underworld

@ ฬตอ‘Mฬตอ˜ ฬ ฬ–rฬถฬ•.ฬตฬ ฬทอ Bฬดอ˜Oฬทฬ“Tฬถฬ†NฬดฬEฬถอ›Tฬถฬ…(tm
- - - - - Uา‰Nา‰Dา‰Eา‰Rา‰Cา‰Oา‰Dา‰Eา‰- - - - -
- - - - - Uา‰Nา‰Dา‰Eา‰Rา‰Cา‰Oา‰Dา‰Eา‰- - - - -

๐Ÿฆ‘ generate random wordlist for brutefocre attacks
(instagram.com/UnderCodeTestingCompany)

๐Ÿฆ‘INSTALLISATION & RUN:

$ apt-get update -y

$ apt-get upgrade -y

$ pkg install python -y

$ pkg install python2 -y

$ pkg install git -y

$ pip install requests

$ pip install random

$ ls

$ git clone https://github.com/noob-hackers/lazybee

$ ls

$ cd lazybee

$ ls

$ python2 lazybee.py

@ ฬตอ‘Mฬตอ˜ ฬ ฬ–rฬถฬ•.ฬตฬ ฬทอ Bฬดอ˜Oฬทฬ“Tฬถฬ†NฬดฬEฬถอ›Tฬถฬ…(tm
- - - - - Uา‰Nา‰Dา‰Eา‰Rา‰Cา‰Oา‰Dา‰Eา‰- - - - -
- - - - - Uา‰Nา‰Dา‰Eา‰Rา‰Cา‰Oา‰Dา‰Eา‰- - - - -

๐Ÿฆ‘WHAT IS Application service provider (ASP)
(t.me/UnderCodeTestingOfficial)

๐Ÿฆ‘๐Ÿ…ป๐Ÿ…ด๐Ÿ†ƒ ๐Ÿ†‚ ๐Ÿ†‚๐Ÿ†ƒ๐Ÿ…ฐ๏ธ๐Ÿ†๐Ÿ†ƒ:


> application service provider (ASP)

WhatIs.com

> An application service provider (ASP) is a company that offers individuals or enterprises access to applications and related services over the internet.

> The term has largely been replaced by software as a service (SaaS) provider, although in some parts of the world, companies use the two labels interchangeably.

>Once referred to as "apps-on-tap," ASP services became an important alternative, not only for individuals and smaller companies with low budgets for information technology, but also for larger companies exploring the idea of outsourcing their information technology (IT) infrastructure around the turn of the century.

> Early ASPs focused on delivering specialized applications that were expensive to install and maintain.

> Essentially, the model required the ASP customer to purchase the software and then pay a provider to host it.

๐Ÿฆ‘Difference between ASP and SaaS delivery models?

> In an ASP delivery model, the customer typically purchases software and pays an ASP to host and maintain it. In contrast, SaaS vendors manage the software they have developed on their own.

> Traditional ASPs used a single-tenant architecture and software clients had to be installed on the end users' computers. In contrast, SaaS providers use a multi-tenant architecture that allows an application to be accessed through a web browser and serve multiple users and businesses.

>Customers who still need providers that will host specific, customized applications or off-the-shelf applications in a secure data center, may still choose to look for an application service provider.

@ ฬตอ‘Mฬตอ˜ ฬ ฬ–rฬถฬ•.ฬตฬ ฬทอ Bฬดอ˜Oฬทฬ“Tฬถฬ†NฬดฬEฬถอ›Tฬถฬ…(tm
- - - - - Uา‰Nา‰Dา‰Eา‰Rา‰Cา‰Oา‰Dา‰Eา‰- - - - -
โ€”โ€”โ€”โ€”๐–€๐–“D๐–Š๐–—๐•ฎ๐–”D๐–Šโ€”โ€”โ€”-

AFTER THIS ARTICLE IAM SURE THAT YOU WILL TAKE AS WARNING <<NOTHING ANONYMOUS 100%>>
WHY TOR ISNT ANONYMOUS
T.me/UnderCodeTestingOfficial)

๐Ÿฆ‘๐Ÿ…ป๐Ÿ…ด๐Ÿ†ƒ ๐Ÿ†‚ ๐Ÿ†‚๐Ÿ†ƒ๐Ÿ…ฐ๏ธ๐Ÿ†๐Ÿ†ƒ

1) Exit Nodes Can Be Sniffed:

> when you use Tor, your Internet traffic is routed through Torโ€™s network and goes through several randomly selected relays before exiting the Tor network.

> Tor is designed so that it is theoretically impossible to know which computer actually requested the traffic. Your computer may have initiated the connection or it may just be acting as a relay, relaying that encrypted traffic to another Tor node....

> Tor network and connect to Googleโ€™s servers. The last Tor node, where your traffic leaves the Tor network and enters the open Internet, can be monitored. This node where traffic exits the Tor network is known as an โ€œexit nodeโ€ or โ€œexit relay.โ€

>When using Tor, be sure to use encrypted (HTTPS) websites for anything sensitive. Bear in mind that your traffic could be monitored โ€“ not just by governments, but by malicious people looking for private data.

2) JavaScript, Plug-ins, and Other Applications Can Leak Your IP:

> preconfigured with secure settings. JavaScript is disabled, plug-ins canโ€™t run, and the browser will warn you if you attempt to download a file and open it on another app
but if youโ€™re trying to hide your IP, you donโ€™t want to use JavaScript. Your browserโ€™s JavaScript engine, plug-ins like Adobe Flash, and external applications like Adobe Reader or even a video player could all potentially โ€œleakโ€ your real IP address to a website that tries to acquire it.

3) Running an Exit Node Puts You At Risk

> you should think twice before running an exit relay, which is a place where Tor traffic comes out of the anonymous network and connects to the open Internet. If criminals use Tor for illegal things and the traffic comes out of your exit relay, that traffic will be traceable to your IP address and you may get a knock on your door and your computer equipment confiscated

4) THIS is a problem for both Torโ€™s users and exit node operators. In addition, the software that runs on our computers wasnโ€™t designed to hide our IP addresses, which results in risks when doing anything beyond viewing plain HTML pages in the Tor browser.

@ Mr. botnet(tm)
___
โ€”โ€”โ€”โ€”โ€”
๐–€๐–“D๐–Š๐–—๐•ฎ๐–”D๐–Š
โ€”โ€”โ€”โ€”โ€”โ€”๐–€๐–“D๐–Š๐–—๐•ฎ๐–”D๐–Šโ€”โ€”โ€”โ€”โ€”-

๐Ÿฆ‘Facebook Hack Box Termux / Linux/ Windows
Instagram.com/UnderCodeTestingCompany

๐Ÿฆ‘INSTALL & RUN:

> For Debien Based Systems

1) sudo apt-get install git

2) git clone https://github.com/m4rktn/xsmash

3) cd xsmash

4) python2 xsmash.py
For Termux

5) apt-get install python2 git

6) git clone https://github.com/m4rktn/xsmash && cd xsmash

7) python2 xsmash.py


๐Ÿฆ‘ For Windows

1) Install Python2.7 From https://www.python.org/downloads/

2) Go To https://github.com/m4rktn/xsmash And Download In ".zip" Format

3) Extract xsmash-master.zip

4) Just Click In Xsmash.py


@ MR.Botnet
โ€”โ€”โ€”โ€”โ€”๐–€๐–“D๐–Š๐–—๐•ฎ๐–”D๐–Šโ€”โ€”โ€”โ€”โ€”
โ€”โ€”โ€”โ€”-๐–€๐–“D๐–Š๐–—๐•ฎ๐–”D๐–Šโ€”โ€”โ€”โ€”

๐Ÿฆ‘IAM WONDERING AS MANY HACKERS DONT KNOW EXACTLY WHAT IS ZERO-DAY EXPLOITE :
(T.me/UnderCodeTestingOfficial)

๐Ÿฆ‘๐Ÿ…ป๐Ÿ…ด๐Ÿ†ƒ ๐Ÿ†‚ ๐Ÿ†‚๐Ÿ†ƒ๐Ÿ…ฐ๏ธ๐Ÿ†๐Ÿ†ƒ

> The term โ€œzero-dayโ€ refers to a newly discovered software vulnerability. Because the developer has just learned of the flaw, it also means an official patch or update to fix the issue hasnโ€™t been released.

> So, โ€œzero-dayโ€ refers to the fact that the developers have โ€œzero daysโ€ to fix the problem that has just been exposed and perhaps already exploited by hackers.

> Once the vulnerability becomes publicly known, the vendor has to work quickly to fix the issue to protect its users.
But the software vendor may fail to release a patch before hackers manage to exploit the security hole. Thatโ€™s known as a zero-day attack.

@MR. botNet
โ€”โ€”โ€”โ€”โ€”๐–€๐–“D๐–Š๐–—๐•ฎ๐–”D๐–Šโ€”โ€”โ€”โ€”โ€”โ€”
โ€”โ€”โ€”โ€”โ€”๐–€๐–“D๐–Š๐–—๐•ฎ๐–”D๐–Šโ€”โ€”โ€”โ€”โ€”

๐Ÿฆ‘FEW STEPS TO PROTECT 90% AGAINST ZERO-DAY NEW EXPLOITE
Facebook.com/UnderCodeTestingCompanie


๐Ÿฆ‘๐Ÿ…ป๐Ÿ…ด๐Ÿ†ƒ ๐Ÿ†‚ ๐Ÿ†‚๐Ÿ†ƒ๐Ÿ…ฐ๏ธ๐Ÿ†๐Ÿ†ƒ:

1) Never install unnecessary software: each software installed on your system is a window of entry for a potential Zero Day. Itโ€™s recommended that you review the list of software once in a while and uninstall those that you no longer use.

2) Keep updated: the software that you keep should always be updated to the latest version.

3) Use a reliable firewall: if it is impossible to detect a malware that comes from an unknown vulnerability, maybe we could detect a suspicious connection and stop it before itโ€™s too late

4) Keep software and security patches up to date by downloading the latest software releases and updates. Installing security patches fixes bugs that the previous version may have missed.

5) Establish safe and effective personal online security habits.

6) Configure security settings for your operating system, internet browser, and security software.

7) Install a proactive and comprehensive security software to help block known and unknown threats to vulnerabilities.

@ Mr. botnet(tm)
โ€”โ€”โ€”โ€”โ€”-๐–€๐–“D๐–Š๐–—๐•ฎ๐–”D๐–Šโ€”โ€”โ€”โ€”โ€”โ€”
โ€”โ€”โ€”โ€”โ€”๐–€๐–“D๐–Š๐–—๐•ฎ๐–”D๐–Šโ€”โ€”โ€”โ€”โ€”-

๐Ÿฆ‘DIFFERENCE BETWEEN PROTOCOLES BY UndercOde:
T.me/UnderCodeTestingOfficial

๐Ÿฆ‘๐Ÿ…ป๐Ÿ…ด๐Ÿ†ƒ ๐Ÿ†‚ ๐Ÿ†‚๐Ÿ†ƒ๐Ÿ…ฐ๏ธ๐Ÿ†๐Ÿ†ƒ:

> Communication protocols are, by definition, sets of rules that govern the formats and interactions between communicating parties. These rules may be implicit and informal, as in typical everyday social interactions between people. But electronics, and digital computers especially, require things to be far more explicit and formalized in order for reliable communication to occur.

๐Ÿฆ‘A Standard in this context is an attempt to resolve an area of potential misunderstanding or disagreement. Communication protocols are one of many areas that standards may apply to. A notable set of standards that are not communication protocols, for example, are the SI weight and measurement standards. These provide a fixed reference to which you can compare any given quantity in order to measure it in a way that will be unambiguous to everyone with access to the standard, or a reasonable approximation of it.

> ACommunication Protocol Standard is therefore a formalization of the rules of a communication protocol such that those with access to the standard can (ideally) unambiguously determine whether any particular attempt at communication complies with those rules. Just as comparing a particular mass of metal against the SI standard kilogram will determine how close the mass is to a kilogram, comparing a particular protocol implementation against a protocol standard will determine whether it is truly following that protocol according to the standard. When all parties are properly following the protocol as formalized in the standard, it is (again, ideally) guaranteed to result in the level of communication that the protocol was designed to accommodate.

๐Ÿฆ‘A Communication Protocol Specification is a means by which the rules and formats of a communication protocol can be described at a formal level, and it is often part of (indeed, the largest part of) a communication protocol standard. While the purpose of a standard is to create a means to determine whether something is truly an instance of the standardized thing, the purpose of a specification is to define exactly what the thing is in the case where the thing is defined by rules and formats, as a communication protocol is. An unambiguous definition of what something is can be used both to create a new instance of that thing and to determine whether an existing thing is an instance of the thing being defined.

> So a specification can be used as a standard, but being a standard also carries the weight of some social agreement that there is value in complying with the specification well enough for multiple implementations to have some assurance of working together. The parties interested in this agreement work together to form a Standards Body in order to define the standards that they will agree on for the purpose of their desire to be able to rely on compliance to a protocol. Without the presence of this social agreement and the standards body by which the standards are produced, protocol specifications aren't generally considered to constitute standards, though well-defined specifications definitely have the potential to be used as standards.

@Mฬตอ˜ ฬ ฬ–rฬถฬ•.ฬตฬ ฬทอ Bฬดอ˜Oฬทฬ“Tฬถฬ†NฬดฬEฬถอ›Tฬถฬ…(tm
โ€”โ€”โ€”โ€”โ€”๐–€๐–“D๐–Š๐–—๐•ฎ๐–”D๐–Šโ€”โ€”โ€”โ€”โ€”โ€”-
- - - - Uา‰Nา‰Dา‰Eา‰Rา‰Cา‰Oา‰Dา‰Eา‰- - - - -

๐Ÿฆ‘HOW To Break Username And Password Browser Logins for Major MODEMS router by ๐–€๐–“d๐–Š๐–—๐•ฎ๐–”d๐–Š:
T.me/UnderCodeTestingOfficial

๐Ÿฆ‘๐Ÿ…ป๐Ÿ…ด๐Ÿ†ƒ๐Ÿ†‚ ๐Ÿ†‚๐Ÿ†ƒ๐Ÿ…ฐ๐Ÿ†๐Ÿ†ƒ:

A) FIND THE GATEWAY:

simply layout a few different possibilities:

1) Checking out the network settings from the OS's Settings panels

2) Using ipconfig on Windows and ifconfig on Unix machines from the terminal

3) Use Fuzzer as a Target Discovery tool. This fiddle will help you out
Or arp-scan to sccan ip
Then Opem Ip (Default getway in browser)

B) GATHER SOME TRAFFIC

a good way to start would be exploring the router's web server for something beyond what meets the eye.

2) For this reason use HTTPView and have analysed the traffic from one attempted log-in.

> applied some filters to get rid of the media and styling responses from the server

C) ANALYZING THE RESULTS AND FIRST EXPLOIT

1> It is safe to ignore all the jQuery files as well as the language files or at the very least don't start your search there.

2> working in Chrome, Can t analyse the responses straight from HTTPView, so I need to replicate the request in Rest and do analysis there. There is this interesting bit that have found in the

/menu.html file:

3> Take a closer look at lines 228 and 247. Although, the definition of the readCookie function is missing, it is safe to assume that it reads a cookie and userData is the name of that cookie.

4> Example From line 247 we can deduce that the value of cookie should be root, if we want to see interesting things happening.
To exploit this, use the Chrome Extension EditThisCookie

E) SCANNING THE ROUTER AS ROOT:

> scan is the better option.

For this, I will use Scanner with the userData=root cookie already set.

> In addiotion, enable the 'Directed Scan' option in the Co-pilot tab so that Scanner relies as its input

>Once Scanner has started, navigate to 5-10 pages on the router that require you to be logged in such as /basicSetup.html and /basicDHCP.html and let the tool do its job. After the transactions have stopped coming in, you can analyse the results for interesting findings.

F) COMPLETE CONTROL:

> DocsisConfigFile.xml is usually the file that contains a bunch of useful information about the router's configuration

> it contains plenty of interesting information including a username and password in plain text that I can confirm work without a problem.

FULL ACCESS GAINED!

@ ฬตอ‘Mฬตอ˜ ฬ ฬ–rฬถฬ•.ฬตฬ ฬทอ Bฬดอ˜Oฬทฬ“Tฬถฬ†NฬดฬEฬถอ›Tฬถฬ…(tm
- - - - - Uา‰Nา‰Dา‰Eา‰Rา‰Cา‰Oา‰Dา‰Eา‰- - - -
How Hijack sessions ๐Ÿฆ‘.pdf
136.6 KB
LEARN PASSWORD CRACKING ๐Ÿฆ‘.pdf
489.8 KB
- - - - - Uา‰Nา‰Dา‰Eา‰Rา‰Cา‰Oา‰Dา‰Eา‰- - - - -

๐Ÿฆ‘CRACKING FULL TUTORIAL LINUX/TERMUX(root):
Instagram.com/UnderCodeTestingCompany)


๐Ÿฆ‘FEATURES:

1) Brute Force Attack (7 characters)

2) Dictionary Attack

3) All wordlists in "hcatOptimizedWordlists" with "best64.rule"

4) wordlists/rockyou.txt with "d3ad0ne.rule"

5) wordlists/rockyou.txt with "T0XlC.rule"

6) Top Mask Attack (Target Time = 4 Hours)

โ€ข Fingerprint Attack
โ€ข Combinator Attack
โ€ข Hybrid Attack
โ€ข Extra - Just For Good Measure
โ—ฆ Runs a dictionary attack using wordlists/rockyou.txt with chained "combinator.rule" and "InsidePro-PasswordsPro.rule" rules


๐Ÿฆ‘OPTIONS :


(1) Quick Crack
(2) Extensive Pure_Hate Methodology Crack
(3) Brute Force Attack
(4) Top Mask Attack
(5) Fingerprint Attack
(6) Combinator Attack
(7) Hybrid Attack
(8) Pathwell Top 100 Mask Brute Force Crack
(9) PRINCE Attack
(10) YOLO Combinator Attack
(11) Middle Combinator Attack
(12) Thorough Combinator
......

๐Ÿฆ‘INSTALLISATION & RUN:


1) Get the latest hashcat binaries (https://hashcat.net/hashcat/)

> OSX Install (https://www.phillips321.co.uk/2016/07/09/hashcat-on-os-x-getting-it-going/)

2) mkdir -p hashcat/deps

3) git clone https://github.com/KhronosGroup/OpenCL-Headers.git hashcat/deps/OpenCL

4) cd hashcat/

5) make

6) make install

7) Download hate_crack

8) git clone https://github.com/trustedsec/hate_crack.git

โ€ข Customize binary and wordlist paths in "config.json"

โ€ข Make sure that at least "rockyou.txt" is within your "wordlists" path

9) Create Optimized Wordlists
wordlist_optimizer.py - parses all wordlists from <input file list>, sorts them by length and de-duplicates into <output directory>

WELL DONE !

10) usage: python wordlist_optimizer.py <input file list> <output directory>

> python wordlist_optimizer.py wordlists.txt ../optimized_wordlists


WRITTEN BY ฬตอ‘Mฬตอ˜ ฬ ฬ–rฬถฬ•.ฬตฬ ฬทอ Bฬดอ˜Oฬทฬ“Tฬถฬ†NฬดฬEฬถอ›Tฬถฬ…(tm
- - - - - Uา‰Nา‰Dา‰Eา‰Rา‰Cา‰Oา‰Dา‰Eา‰- - - - -
โ€”โ€”โ€”โ€”๐–€๐–“D๐–Š๐–—๐•ฎ๐–”D๐–Šโ€”โ€”โ€”โ€”


๐Ÿฆ‘RESOLVE CAN T reach some websites with VPN connected:
(Instagram.com/UnderCodeTestingCompany)

๐Ÿฆ‘After a successful connection, you might not be able to reach some or all websites.

> There are a few things you could try to fix this issue.

1) Try switching between a few different servers.

2) If youโ€™re using the Windows, Android, or macOS OpenVPN app, switch from UDP to TCP in the app settings.

3) If you know and trust the website youโ€™re trying to access, turn off the CyberSec feature in the app settings and try again. If you can access the site with CyberSec off, please inform our customer support agents about it.

4) Your antivirus/firewall may be blocking the access. If you suspect that may be the case, add exceptions for NordVPN.exe and nordvpn-service.exe to your antivirus/firewall applications.

5) Try other connection methods, such as OpenVPN manual or IKEv2. Different connection methods have different network configurations.

6) If you have recently installed our app, try restarting your device.

@ Mr. botnet(tm)
โ€”โ€”โ€”โ€”โ€”UNDERCODEโ€”โ€”โ€”โ€”-
- - - - - Uา‰Nา‰Dา‰Eา‰Rา‰Cา‰Oา‰Dา‰Eา‰- - - - -

๐Ÿฆ‘What is IPv4 vs IPv6 & Whatโ€™s the Difference?
(facebook.com/UnderCodeTestingCompanie)

๐Ÿฆ‘๐Ÿ…ป๐Ÿ…ด๐Ÿ†ƒ ๐Ÿ†‚ ๐Ÿ†‚๐Ÿ†ƒ๐Ÿ…ฐ๏ธ๐Ÿ†๐Ÿ†ƒ:

Maybee we ve heared About Ipv4/ipv6 and we used always but without knowing what we do so :

๐Ÿฆ‘What is IPv4?

1) IPv4 was the first version of IP. It was deployed for production in the ARPANET in 1983. Today it is most widely used IP version. It is used to identify devices on a network using an addressing system.

2) The IPv4 uses a 32-bit address scheme allowing to store 2^32 addresses which is more than 4 billion addresses. Till date, it is considered the primary Internet Protocol and carries 94% of Internet traffic.

๐Ÿฆ‘What is IPv6?

1) It is the most recent version of the Internet Protocol. Internet Engineer Taskforce initiated it in early 1994. The design and development of that suite is now called IPv6.

2) This new IP address version is being deployed to fulfill the need for more Internet addresses. It was aimed to resolve issues which are associated with IPv4. With 128-bit address space, it allows 340 undecillion unique address space. IPv6 also called IPng (Internet Protocol next generation).


๐Ÿฆ‘Differences:

1) Connectionless Protocol

2) Allow creating a simple virtual communication layer over diversified devices

3) It requires less memory, and ease of remembering addresses

4) Already supported protocol by millions of devices

5) Offers video libraries and conferences

๐Ÿฆ‘Features of IPv6

1) Hierarchical addressing and routing infrastructure

2) Stateful and Stateless configuration

3) Support for quality of service (QoS)

4) An ideal protocol for neighboring node interaction

@ ฬตอ‘Mฬตอ˜ ฬ ฬ–rฬถฬ•.ฬตฬ ฬทอ Bฬดอ˜Oฬทฬ“Tฬถฬ†NฬดฬEฬถอ›Tฬถฬ…(tm
- - - - - Uา‰Nา‰Dา‰Eา‰Rา‰Cา‰Oา‰Dา‰Eา‰- - - - -