โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆTopic pdf tools Offline Digital Forensics Tool for Binary Files...
You can used to hide a dangerous malware in pdf for windows...
>Offline Digital Forensics Tool for Binary Files This tool can be used for (offline) digital forensics and malware analysis as it shows all raw bytes of a file and also the ASCII representations. As you can see from the screenshots, I have used it on a few different file types, TXT, PNG, Compiled C code, and even a packet capture file. It has three columns, one to show the byte count on the far left. Then, in the middle the hexadecimal bytes of the file, and on the right the ASCII representations (if there are any) of the hexadecimal bytes.
instagram.com/UndercOdeTestingCompany
๐ฆ๐โ๐๐๐ธ๐๐๐๐๐ธ๐๐๐โ & โ๐โ:
1) git clone https://github.com/weaknetlabs/ByteForce
2) cd ByteForce
3)Example run :
./ByteForce alg.exe |head -n 20
๐ฆFeatures:
1) HTTP Strings
ByteForce will search Binary files for case-insensitive, plain-text HTTP strings.
2) XOR Brute Force attack (Case-Insensitive)
The XOR brute force attack will try every byte from 0x01 to 0x1f as a XOR key against the byte found in the file. If the result equals the ASCII value of an "H" or "h" I grab the next byte in the file, perform the XOR and look for a "T" ot "t". I continue until I find "[Hh][Tt]{2}[pP]" and if found, I print the bytes until I get a non printable character. The algorithm I wrote will trace steps back into the opened file's bytes accordingly if a non http ASCII value is found.
3)Rotate 13 Check
This will perform a simple ROT13() function that I made on the byte before checking it's value for the "[Hh][tT]{2}[pP]" ASCII values that I searched for in the XOR segment above.
4) XOR-ROT13 Attack
This will perform the brute-force XOR attack after performing the ROT13() function I made on the file's byte before checking it for the "[Hh][tT]{2}[pP]" ASCII values.
5) for PDF Documents
ByteForce has the ability to check the document for a valid PDF header and also to search for plain-text case-insensitive executable file names. This does not deflate/inflate data streams. This is a simple string check on the file.
๐ฆTested by UndercOde On:
> Ubanto
> Kali
@ Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆTopic pdf tools Offline Digital Forensics Tool for Binary Files...
You can used to hide a dangerous malware in pdf for windows...
>Offline Digital Forensics Tool for Binary Files This tool can be used for (offline) digital forensics and malware analysis as it shows all raw bytes of a file and also the ASCII representations. As you can see from the screenshots, I have used it on a few different file types, TXT, PNG, Compiled C code, and even a packet capture file. It has three columns, one to show the byte count on the far left. Then, in the middle the hexadecimal bytes of the file, and on the right the ASCII representations (if there are any) of the hexadecimal bytes.
instagram.com/UndercOdeTestingCompany
๐ฆ๐โ๐๐๐ธ๐๐๐๐๐ธ๐๐๐โ & โ๐โ:
1) git clone https://github.com/weaknetlabs/ByteForce
2) cd ByteForce
3)Example run :
./ByteForce alg.exe |head -n 20
๐ฆFeatures:
1) HTTP Strings
ByteForce will search Binary files for case-insensitive, plain-text HTTP strings.
2) XOR Brute Force attack (Case-Insensitive)
The XOR brute force attack will try every byte from 0x01 to 0x1f as a XOR key against the byte found in the file. If the result equals the ASCII value of an "H" or "h" I grab the next byte in the file, perform the XOR and look for a "T" ot "t". I continue until I find "[Hh][Tt]{2}[pP]" and if found, I print the bytes until I get a non printable character. The algorithm I wrote will trace steps back into the opened file's bytes accordingly if a non http ASCII value is found.
3)Rotate 13 Check
This will perform a simple ROT13() function that I made on the byte before checking it's value for the "[Hh][tT]{2}[pP]" ASCII values that I searched for in the XOR segment above.
4) XOR-ROT13 Attack
This will perform the brute-force XOR attack after performing the ROT13() function I made on the file's byte before checking it for the "[Hh][tT]{2}[pP]" ASCII values.
5) for PDF Documents
ByteForce has the ability to check the document for a valid PDF header and also to search for plain-text case-insensitive executable file names. This does not deflate/inflate data streams. This is a simple string check on the file.
๐ฆTested by UndercOde On:
> Ubanto
> Kali
@ Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆUsefull for termux users Wrapper for Mpv on Termux. Displays play controls in the notification
instagram.com/UndercOdeTestingCompany
๐ฆ๐โ๐๐๐ธ๐๐๐๐๐ธ๐๐๐โ & โ๐โ:
> Manual :
1) git clone https://github.com/Neo-Oli/Termux-Mpv
2) cd Termux-Mpv
3) pyhon setup.py
Or Automate install :
> apt install termux-api python mpv
well done
@ Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆUsefull for termux users Wrapper for Mpv on Termux. Displays play controls in the notification
instagram.com/UndercOdeTestingCompany
๐ฆ๐โ๐๐๐ธ๐๐๐๐๐ธ๐๐๐โ & โ๐โ:
> Manual :
1) git clone https://github.com/Neo-Oli/Termux-Mpv
2) cd Termux-Mpv
3) pyhon setup.py
Or Automate install :
> apt install termux-api python mpv
well done
@ Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆHow Sucessful hack Any Telegram Running On Windows From Termux Or Linux ?
t.me/UndercOdeTestingOfficial
๐ฆ๐โ๐๐๐ธ๐๐๐๐๐ธ๐๐๐โ & โ๐โ:
1) git clone https://github.com/ultrasecurity/TeleKiller.git
2) cd TeleKiller
3) pip install -r requirements.txt
4) python TeleKiller.py
๐ฆFeatures:
> Session Hijacking
> Stealer Local Passcode
> Keylogger
> Shell
> Bypass 2 Step Verification
๐ฆTested by UndercOde :
> Win10(victime)
@ Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆHow Sucessful hack Any Telegram Running On Windows From Termux Or Linux ?
t.me/UndercOdeTestingOfficial
๐ฆ๐โ๐๐๐ธ๐๐๐๐๐ธ๐๐๐โ & โ๐โ:
1) git clone https://github.com/ultrasecurity/TeleKiller.git
2) cd TeleKiller
3) pip install -r requirements.txt
4) python TeleKiller.py
๐ฆFeatures:
> Session Hijacking
> Stealer Local Passcode
> Keylogger
> Shell
> Bypass 2 Step Verification
๐ฆTested by UndercOde :
> Win10(victime)
@ Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆmany ways someone can hack Facebook Profile's lets give s some :
t.me/UndercOdeTestingOfficial
๐ฆ๐ ป๐ ด๐ ๐ ๐๐๐ ฐ๏ธ๐๐:
1) Phishing
Phishing is still the most popular attack vector used for hacking Facebook accounts. There are variety methods to carry out phishing attack. In a simple phishing attacks a hacker creates a fake log in page which exactly looks like the real Facebook page and then asks the victim to log in. Once the victim log in through the fake page the, the victims "Email Address" and "Password" is stored in to a text file, and the hacker then downloads the text file and gets his hands on the victims credentials.
2) Keylogging
Keylogging is the easiest way to hack a Facebook password. Keylogging sometimes can be so dangerous that even a person with good knowledge of computers can fall for it. A Keylogger is basically a small program which, once is installed on victim's computer, will record every thing victim types on his/her computer. The logs are then send back to the attacker by either FTP or directly to hackers email address.
3) Stealer's
Almost 80% percent people use stored passwords in their browser to access the Facebook. This is quite convenient, but can sometimes be extremely dangerous. Stealer's are software's specially designed to capture the saved passwords stored in the victims Internet browser.
4) Session Hijacking
Session Hijacking can be often very dangerous if you are accessing Facebook on a http (non secure) connection. In Session Hijacking attack, a hacker steals the victims browser cookie which is used to authenticate the user on a website, and use it to access the victims account. Session hijacking is widely used on LAN, and WiFi connections.
5) Sidejacking With Firesheep
Sidejacking attack went common in late 2010, however it's still popular now a days. Firesheep is widely used to carry out sidejacking attacks. Firesheep only works when the attacker and victim is on the same WiFi network. A sidejacking attack is basically another name for http session hijacking, but it's more targeted towards WiFi users.
6) Mobile Phone Hacking
Millions of Facebook users access Facebook through their mobile phones. In case the hacker can gain access to the victims mobile phone then he can probably gain access to his/her Facebook account. Their are a lots of Mobile Spying software's used to monitor a Cellphone. The most popular Mobile Phone Spying software's are: Mobile Spy, and Spy Phone Gold.
7) DNS Spoofing
If both the victim and attacker are on the same network, an attacker can use a DNS spoofing attack and change the original Facebook page to his own fake page and hence can get access to victims Facebook account.
8) USB Hacking
If an attacker has physical access to your computer, he could just insert a USB programmed with a function to automatically extract saved passwords in the Internet browser.
9) Man In the Middle Attacks
If the victim and attacker are on the same LAN and on a switch based network, a hacker can place himself between the client and the server, or he could act as a default gateway and hence capturing all the traffic in between.
10) Botnets
Botnets are not commonly used for hacking Facebook accounts, because of it's high setup costs. They are used to carry more advanced attacks. A Botnet is basically a collection of compromised computer. The infection process is same as the key logging, however a Botnet gives you additional options for carrying out attacks with the compromised computer. Some of the most popular Botnets include Spyeye and Zeus.
powred by wiki
@ Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆmany ways someone can hack Facebook Profile's lets give s some :
t.me/UndercOdeTestingOfficial
๐ฆ๐ ป๐ ด๐ ๐ ๐๐๐ ฐ๏ธ๐๐:
1) Phishing
Phishing is still the most popular attack vector used for hacking Facebook accounts. There are variety methods to carry out phishing attack. In a simple phishing attacks a hacker creates a fake log in page which exactly looks like the real Facebook page and then asks the victim to log in. Once the victim log in through the fake page the, the victims "Email Address" and "Password" is stored in to a text file, and the hacker then downloads the text file and gets his hands on the victims credentials.
2) Keylogging
Keylogging is the easiest way to hack a Facebook password. Keylogging sometimes can be so dangerous that even a person with good knowledge of computers can fall for it. A Keylogger is basically a small program which, once is installed on victim's computer, will record every thing victim types on his/her computer. The logs are then send back to the attacker by either FTP or directly to hackers email address.
3) Stealer's
Almost 80% percent people use stored passwords in their browser to access the Facebook. This is quite convenient, but can sometimes be extremely dangerous. Stealer's are software's specially designed to capture the saved passwords stored in the victims Internet browser.
4) Session Hijacking
Session Hijacking can be often very dangerous if you are accessing Facebook on a http (non secure) connection. In Session Hijacking attack, a hacker steals the victims browser cookie which is used to authenticate the user on a website, and use it to access the victims account. Session hijacking is widely used on LAN, and WiFi connections.
5) Sidejacking With Firesheep
Sidejacking attack went common in late 2010, however it's still popular now a days. Firesheep is widely used to carry out sidejacking attacks. Firesheep only works when the attacker and victim is on the same WiFi network. A sidejacking attack is basically another name for http session hijacking, but it's more targeted towards WiFi users.
6) Mobile Phone Hacking
Millions of Facebook users access Facebook through their mobile phones. In case the hacker can gain access to the victims mobile phone then he can probably gain access to his/her Facebook account. Their are a lots of Mobile Spying software's used to monitor a Cellphone. The most popular Mobile Phone Spying software's are: Mobile Spy, and Spy Phone Gold.
7) DNS Spoofing
If both the victim and attacker are on the same network, an attacker can use a DNS spoofing attack and change the original Facebook page to his own fake page and hence can get access to victims Facebook account.
8) USB Hacking
If an attacker has physical access to your computer, he could just insert a USB programmed with a function to automatically extract saved passwords in the Internet browser.
9) Man In the Middle Attacks
If the victim and attacker are on the same LAN and on a switch based network, a hacker can place himself between the client and the server, or he could act as a default gateway and hence capturing all the traffic in between.
10) Botnets
Botnets are not commonly used for hacking Facebook accounts, because of it's high setup costs. They are used to carry more advanced attacks. A Botnet is basically a collection of compromised computer. The infection process is same as the key logging, however a Botnet gives you additional options for carrying out attacks with the compromised computer. Some of the most popular Botnets include Spyeye and Zeus.
powred by wiki
@ Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
UNDERCODE COMMUNITY
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ ๐ฆHow Sucessful hack Any Telegram Running On Windows From Termux Or Linux ? t.me/UndercOdeTestingOfficial ๐ฆ๐โ๐๐๐ธ๐๐๐๐๐ธ๐๐๐โ & โ๐โ: 1) git clone https://github.com/ultrasecurity/TeleKiller.git 2) cd TeleKiller 3) pip install -r requirements.txtโฆ
Require python3 (Termux)& root for some android Version
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆHack Gmail and Facebook/instagram or gmail/any other accounts of Remote PC using DNS Spoofing and SET Toolkit
instagram.com/UndercOdeTestingCompany
๐ฆ๐ ป๐ ด๐ ๐ ๐๐๐ ฐ๏ธ๐๐:
1) git clone https://github.com/SemyonMakhaev/dns-poison
2) cd dns-poison
3) python3 poison.py [-h] server name address
server IP-address of a target server
name Requested domain name
address IP-address of domain this name for writing to server cache
-h or --help Show a help message
๐ฆThis program is trying to put a fake data to a target DNS-server cache. It sends a DNS-request to server and then it sends a DNS-reply to all of server ports, so the program imitates a forwarder of this server
๐ฆTested by Under Code On
>Termux
>ubanto
@ Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆHack Gmail and Facebook/instagram or gmail/any other accounts of Remote PC using DNS Spoofing and SET Toolkit
instagram.com/UndercOdeTestingCompany
๐ฆ๐ ป๐ ด๐ ๐ ๐๐๐ ฐ๏ธ๐๐:
1) git clone https://github.com/SemyonMakhaev/dns-poison
2) cd dns-poison
3) python3 poison.py [-h] server name address
server IP-address of a target server
name Requested domain name
address IP-address of domain this name for writing to server cache
-h or --help Show a help message
๐ฆThis program is trying to put a fake data to a target DNS-server cache. It sends a DNS-request to server and then it sends a DNS-reply to all of server ports, so the program imitates a forwarder of this server
๐ฆTested by Under Code On
>Termux
>ubanto
@ Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆMalicious Scanner Script 2019 websites bug
twitter.com/UndercOdeTC
๐ฆ๐ ป๐ ด๐ ๐ ๐๐๐ ฐ๏ธ๐๐
> At first glance, you notice a curl request to a hacked Russian website, along with a list of 14 typical filenames of the adminer script:
1) _adminer.php
2) ad.php
3) adminer-4.2.5-en.php
4) adminer-4.2.5-mysql.php
5) adminer-4.2.5.php
6) adminer-4.3.0-en.php
7) adminer-4.3.0-mysql-en.php
8) adminer-4.3.0-mysql.php
9) adminer-4.3.0.php
10) adminer-4.3.1-en.php
11) adminer-4.3.1-mysql-en.php
12) adminer-4.3.1-mysql.php
13) adminer-4.3.1.php
14) Adminer.php
๐ฆSO WHAT THIS SCRIPT CAN DO ?
Batches of Domain Names:
> When we made a curl request to that Russian site, it returned a list of 10,000 domain names.
Except for the alphabetical order of the list, there was no apparent pattern in the way the list was compiled. The sites used all kinds of CMSs that were hosted on different servers.
> When we made another request to that URL, it returned a new list of 10,000 domain names. Again, the list was alphabetically sorted โ this time, the new list began where the first one left off.
The same happened on each subsequent request.
๐ฆEstimating Scan Coverage
> This way, request by request, this single script can receive a significant number of domain names. Letโs estimate this number.
> A typical batch of 10 thousand domains consists of domains that begin with the same letter. The difference between #1 and #10,000 might only appear in the 4th letter
>Overall, the script returned over 300,000 domains that began with letter
โbโ.
๐ฆWILL SEND IT LATER ON UNDERCODE TESTING ENGLISH GROUPES
AFTER few nessasary tests
@Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm)
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆMalicious Scanner Script 2019 websites bug
twitter.com/UndercOdeTC
๐ฆ๐ ป๐ ด๐ ๐ ๐๐๐ ฐ๏ธ๐๐
> At first glance, you notice a curl request to a hacked Russian website, along with a list of 14 typical filenames of the adminer script:
1) _adminer.php
2) ad.php
3) adminer-4.2.5-en.php
4) adminer-4.2.5-mysql.php
5) adminer-4.2.5.php
6) adminer-4.3.0-en.php
7) adminer-4.3.0-mysql-en.php
8) adminer-4.3.0-mysql.php
9) adminer-4.3.0.php
10) adminer-4.3.1-en.php
11) adminer-4.3.1-mysql-en.php
12) adminer-4.3.1-mysql.php
13) adminer-4.3.1.php
14) Adminer.php
๐ฆSO WHAT THIS SCRIPT CAN DO ?
Batches of Domain Names:
> When we made a curl request to that Russian site, it returned a list of 10,000 domain names.
Except for the alphabetical order of the list, there was no apparent pattern in the way the list was compiled. The sites used all kinds of CMSs that were hosted on different servers.
> When we made another request to that URL, it returned a new list of 10,000 domain names. Again, the list was alphabetically sorted โ this time, the new list began where the first one left off.
The same happened on each subsequent request.
๐ฆEstimating Scan Coverage
> This way, request by request, this single script can receive a significant number of domain names. Letโs estimate this number.
> A typical batch of 10 thousand domains consists of domains that begin with the same letter. The difference between #1 and #10,000 might only appear in the 4th letter
>Overall, the script returned over 300,000 domains that began with letter
โbโ.
๐ฆWILL SEND IT LATER ON UNDERCODE TESTING ENGLISH GROUPES
AFTER few nessasary tests
@Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm)
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆHow Does the Scanner Works in websites ?
t.me/UNdercOdeTestingOfficial
๐ฆ๐ ป๐ ด๐ ๐ ๐๐๐ ฐ๏ธ๐๐
> Now letโs see how these large lists of domains are being processed. First of all, we know that the scanner script requests them in chunks of 10,000 domains. Thatโs quite a big number when you need to make requests to external websites.
> As you might recall, for each domain the script needs to probe 14 adminer filenames. This means there are 140,000 requests per batch (or around 100 million requests per campaign.). Of course, you canโt expect a script to complete such a large task in one go.
๐ฆ To work around this, the scanner uses the following approach:
1) It saves the list of 140,000 URLs in the โsโ file and the current position in that list in the โcโ file.
2) The script reads URL from position โcโ and then makes requests for up to 3,000 seconds (50 minutes). To do it, they have the following setting:
> and this condition:
if((time()-$t)>3000){ exit(); }
3) To speed things up, the script makes 20 asynchronous requests at once using the โcurl_multi_โฆโ function, instead of regular curl.
4) Once a batch of 20 requests is complete, the script makes another 20 requests and repeats this routine until the execution time runs out.
5) Every 100 requests, a new position in the list is saved in the โcโ file so that next time when the attackers activate the script it will start where it left off.
written by Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm)
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆHow Does the Scanner Works in websites ?
t.me/UNdercOdeTestingOfficial
๐ฆ๐ ป๐ ด๐ ๐ ๐๐๐ ฐ๏ธ๐๐
> Now letโs see how these large lists of domains are being processed. First of all, we know that the scanner script requests them in chunks of 10,000 domains. Thatโs quite a big number when you need to make requests to external websites.
> As you might recall, for each domain the script needs to probe 14 adminer filenames. This means there are 140,000 requests per batch (or around 100 million requests per campaign.). Of course, you canโt expect a script to complete such a large task in one go.
๐ฆ To work around this, the scanner uses the following approach:
1) It saves the list of 140,000 URLs in the โsโ file and the current position in that list in the โcโ file.
2) The script reads URL from position โcโ and then makes requests for up to 3,000 seconds (50 minutes). To do it, they have the following setting:
> and this condition:
if((time()-$t)>3000){ exit(); }
3) To speed things up, the script makes 20 asynchronous requests at once using the โcurl_multi_โฆโ function, instead of regular curl.
4) Once a batch of 20 requests is complete, the script makes another 20 requests and repeats this routine until the execution time runs out.
5) Every 100 requests, a new position in the list is saved in the โcโ file so that next time when the attackers activate the script it will start where it left off.
written by Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm)
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆvulnx spider is an intelligent bot auto shell injector that detect vulnerabilities in multiple types of cms {`wordpress , joomla , drupal , prestashop ..`}
t.me/UndercOdeTestingOfficial
๐ฆ๐โ๐๐๐ธ๐๐๐๐๐ธ๐๐๐โ & โ๐โ:
1) git clone https://github.com/anouarbensaad/vulnx
2) cd vulnx
3) chmod 777 install.sh
4) ./install.sh
๐ฆFEATURES :
> Detects cms (wordpress, joomla, prestashop, drupal, opencart, magento, lokomedia)
> Target informations gatherings
> Target Subdomains gathering
> Multi-threading on demand
> Checks for vulnerabilities
> Auto shell injector
> Exploit dork searcher
> Ports Scan High Level
> Dns-Servers Dump
> Input multiple target to scan.
> Dorks Listing by Name& by ExploitName.
> Export multiple target from Dorks into a logfile.
EN J O Y
@ Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆvulnx spider is an intelligent bot auto shell injector that detect vulnerabilities in multiple types of cms {`wordpress , joomla , drupal , prestashop ..`}
t.me/UndercOdeTestingOfficial
๐ฆ๐โ๐๐๐ธ๐๐๐๐๐ธ๐๐๐โ & โ๐โ:
1) git clone https://github.com/anouarbensaad/vulnx
2) cd vulnx
3) chmod 777 install.sh
4) ./install.sh
๐ฆFEATURES :
> Detects cms (wordpress, joomla, prestashop, drupal, opencart, magento, lokomedia)
> Target informations gatherings
> Target Subdomains gathering
> Multi-threading on demand
> Checks for vulnerabilities
> Auto shell injector
> Exploit dork searcher
> Ports Scan High Level
> Dns-Servers Dump
> Input multiple target to scan.
> Dorks Listing by Name& by ExploitName.
> Export multiple target from Dorks into a logfile.
EN J O Y
@ Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆHOW to simulate http server attacks in Python which logs HackerIP and all the tracing he does into a Logfile then a database.
instagram.com/UndercodeTestingCompany
๐ฆ๐โ๐๐๐ธ๐๐๐๐๐ธ๐๐๐โ & โ๐โ:
(rooted termux/kali)
1) git clone https://github.com/anouarbensaad/HTTP-Honeypot.git
2) cd HTTP-Honeypot
3) run mysql with root user sudo mysql -u root
4) Create the database isetsohoney CREATE DATABASE isetsohoney;
add the privileges to rootGRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY 'isetso';
5) create table log with this fieldsCREATE TABLE log (id int NOT NULL PRIMARY KEY, date datetime, iphacker varchar(255), uri varchar(255));
6) run server with command : python HTTP_Honeypot_Server.py
7) Starting Server ON 999, Username : root , Password : toor
8) Run HTTrack for copy real websites to local directory and copy it in Sys/fake
9) Scan The Server Banner with Nmap nmap -sV --script=banner 192.168.1.1 -p999
> Open http://192.168.1.1:999
๐ฆREQUIREMENTS :
> Python (2.7 or 3.0)
> Apache2
> Mysql-server
> HTTrack
@ Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆHOW to simulate http server attacks in Python which logs HackerIP and all the tracing he does into a Logfile then a database.
instagram.com/UndercodeTestingCompany
๐ฆ๐โ๐๐๐ธ๐๐๐๐๐ธ๐๐๐โ & โ๐โ:
(rooted termux/kali)
1) git clone https://github.com/anouarbensaad/HTTP-Honeypot.git
2) cd HTTP-Honeypot
3) run mysql with root user sudo mysql -u root
4) Create the database isetsohoney CREATE DATABASE isetsohoney;
add the privileges to rootGRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY 'isetso';
5) create table log with this fieldsCREATE TABLE log (id int NOT NULL PRIMARY KEY, date datetime, iphacker varchar(255), uri varchar(255));
6) run server with command : python HTTP_Honeypot_Server.py
7) Starting Server ON 999, Username : root , Password : toor
8) Run HTTrack for copy real websites to local directory and copy it in Sys/fake
9) Scan The Server Banner with Nmap nmap -sV --script=banner 192.168.1.1 -p999
> Open http://192.168.1.1:999
๐ฆREQUIREMENTS :
> Python (2.7 or 3.0)
> Apache2
> Mysql-server
> HTTrack
@ Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆYour can Get hackers news& Scripts from Our Twitter.com/UnderCodeTC
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆWHAT IS DOXXING ATTACK ?
t.me/UndercOdeTestingOfficial
๐ฆ๐ ป๐ ด๐ ๐ ๐๐๐ ฐ๏ธ๐๐:
Doxxing is usually meant to embarrass the victim, draw criticism towards them, get revenge or cause the victim physical harm.
> Doxxing is a very serious threat to your privacy and can ruin peopleโs lives.
> Larger doxxing attacks include public shaming and public humiliation on a large scale. Some people can lose their jobs, families or even their homes as a result of doxxing. Many are forced to change their identities and pay large sums of money to remove unwanted information online.
๐ฆCommon methods include:
1) IP Logging: As mentioned above, this method uses an IP logger (a piece of code you cannot see). The IP logger is typically added to an email or a message to find out your IP address. Once a user has opened the message, the IP address is tracked and sent back to the doxxer.
2) Packet Sniffing: Data you send over a WiFi network can be intercepted by a doxxer if they break into the WiFiโs security measures. The doxxer can then access valuable information such as emails, passwords and bank account details.
3) Reverse Cellphone Lookup: This allows a doxxer to find a victimโs name, email, age and additional information by using their cellphone number.
4) Social Media Stalking: The majority of internet users have social media accounts. Doxxers use these to access information such as names of relatives, birthdays, locations and more.
@ Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆWHAT IS DOXXING ATTACK ?
t.me/UndercOdeTestingOfficial
๐ฆ๐ ป๐ ด๐ ๐ ๐๐๐ ฐ๏ธ๐๐:
Doxxing is usually meant to embarrass the victim, draw criticism towards them, get revenge or cause the victim physical harm.
> Doxxing is a very serious threat to your privacy and can ruin peopleโs lives.
> Larger doxxing attacks include public shaming and public humiliation on a large scale. Some people can lose their jobs, families or even their homes as a result of doxxing. Many are forced to change their identities and pay large sums of money to remove unwanted information online.
๐ฆCommon methods include:
1) IP Logging: As mentioned above, this method uses an IP logger (a piece of code you cannot see). The IP logger is typically added to an email or a message to find out your IP address. Once a user has opened the message, the IP address is tracked and sent back to the doxxer.
2) Packet Sniffing: Data you send over a WiFi network can be intercepted by a doxxer if they break into the WiFiโs security measures. The doxxer can then access valuable information such as emails, passwords and bank account details.
3) Reverse Cellphone Lookup: This allows a doxxer to find a victimโs name, email, age and additional information by using their cellphone number.
4) Social Media Stalking: The majority of internet users have social media accounts. Doxxers use these to access information such as names of relatives, birthdays, locations and more.
@ Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆHow to Avoid Getting Doxxed
instagram.com/UndercOdeTestingCompany
๐ฆ๐ ป๐ ด๐ ๐ ๐๐๐ ฐ๏ธ๐๐:
1) Use a VPN
A virtual private network offers excellent protection from exposing IP addresses and physical addresses of an individual. The VPN takes the user's internet traffic, encrypts it, and sends it through one of the service's servers before heading out to the public internet. In a previous blog, we outlined several VPNs that take privacy and security very seriously.
2) Limiting Personal Information Online
People must go to much greater lengths to dox a person that doesn't share personal information online. Social media sites often ask many of invasive questions, which can lead to attackers learning more than enough about their target. By keeping this information offline entirely, doxxers usually move on to someone else.
3) Auditing Social Media Posts
Over the years, social media profiles fill up with all sorts of data about the person and their past. Take the time to go through social media accounts and delete posts that contain too much personal information. Even if you didn't post it directly, look for comments that may accidentally share this type of data as well.
4) Ask Google to Remove Information
If personal information appears in Google search results, the individual can request that it get removed from the search engine. Google makes this a simple process through an online form. Many data brokers put this type of data online, usually for background checks or crime check information.
5) Avoid Online Quizzes
Some quizzes ask a lot of seemingly random questions, which are actually the answers to common security questions. Plus, it gives attackers more data to work with. Supplying an email address or name to go along with results makes it even easier to associate information from other data sources.
6) Practice Good Cybersecurity Practices
Put anti-virus and malware detection software in place that can stop a doxxer from stealing information through malicious applications. Regularly update software to avoid any security bugs that could lead to being hacked and doxxed. Once an operating system reaches the end of its supported life, switch to a newer version to decreased security vulnerabilities.
7) Change Passwords Regularly
Data breaches happen all the time, so it's usually only a matter of time before a username and password combination gets out in the wild. By switching every month and using a password manager to create complex codes, it's harder for a hacker to break into accounts. An individual can consider using two-factor or multi-factor authentication as well, which requires more than just a username/password combination to access the application.
@ Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆHow to Avoid Getting Doxxed
instagram.com/UndercOdeTestingCompany
๐ฆ๐ ป๐ ด๐ ๐ ๐๐๐ ฐ๏ธ๐๐:
1) Use a VPN
A virtual private network offers excellent protection from exposing IP addresses and physical addresses of an individual. The VPN takes the user's internet traffic, encrypts it, and sends it through one of the service's servers before heading out to the public internet. In a previous blog, we outlined several VPNs that take privacy and security very seriously.
2) Limiting Personal Information Online
People must go to much greater lengths to dox a person that doesn't share personal information online. Social media sites often ask many of invasive questions, which can lead to attackers learning more than enough about their target. By keeping this information offline entirely, doxxers usually move on to someone else.
3) Auditing Social Media Posts
Over the years, social media profiles fill up with all sorts of data about the person and their past. Take the time to go through social media accounts and delete posts that contain too much personal information. Even if you didn't post it directly, look for comments that may accidentally share this type of data as well.
4) Ask Google to Remove Information
If personal information appears in Google search results, the individual can request that it get removed from the search engine. Google makes this a simple process through an online form. Many data brokers put this type of data online, usually for background checks or crime check information.
5) Avoid Online Quizzes
Some quizzes ask a lot of seemingly random questions, which are actually the answers to common security questions. Plus, it gives attackers more data to work with. Supplying an email address or name to go along with results makes it even easier to associate information from other data sources.
6) Practice Good Cybersecurity Practices
Put anti-virus and malware detection software in place that can stop a doxxer from stealing information through malicious applications. Regularly update software to avoid any security bugs that could lead to being hacked and doxxed. Once an operating system reaches the end of its supported life, switch to a newer version to decreased security vulnerabilities.
7) Change Passwords Regularly
Data breaches happen all the time, so it's usually only a matter of time before a username and password combination gets out in the wild. By switching every month and using a password manager to create complex codes, it's harder for a hacker to break into accounts. An individual can consider using two-factor or multi-factor authentication as well, which requires more than just a username/password combination to access the application.
@ Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆ LINKING IN TELEGRAM BOTS 2019
t.me/UndercOdeTestingOfficial
๐ฆDeep linking๐ฆ
1) Telegram bots have a deep linking mechanism, that allows for passing additional parameters to the bot on startup. It could be a command that launches the bot โ or an auth token to connect the user's Telegram account to their account on some external service.
2) Each bot has a link that opens a conversation with it in Telegram โ https://telegram.me/<bot username>. You can add the parameters start or startgroup to this link, with values up to 64 characters long. For example:
> https://telegram.me/triviabot?startgroup=test
A-Z, a-z, 0-9, _ and - are allowed. We recommend using base64url to encode parameters with binary and other types of content.
3) Following a link with the start parameter will open a one-on-one conversation with the bot, showing a START button in the place of the input field. If the startgroup parameter is used, the user is prompted to select a group to add the bot to. As soon as a user confirms the action (presses the START button in their app or selects a group to add the bot to), your bot will receive a message from that user in this format:
/start PAYLOAD
4) PAYLOAD stands for the value of the start or startgroup parameter that was passed in the link.
๐ฆ Deep linking Example
> Suppose the website example.com would like to send notifications to its users via a Telegram bot. Here's what they could do to enable notifications for a user with the ID 123.
1) Create a bot with a suitable username, e.g. @ExampleComBot
2) Set up a webhook for incoming messages
3) Generate a random string of a sufficient length, e.g. $memcache_key = "vCH1vGWJxfSeofSAs0K5PA"
4) Put the value 123 with the key $memcache_key into Memcache for 3600 seconds (one hour)
5) Show our user the button https://telegram.me/ExampleComBot?start=vCH1vGWJxfSeofSAs0K5PA
6) Configure the webhook processor to query Memcached with the parameter that is passed in incoming messages beginning with /start. If the key exists, record the chat_id passed to the webhook as telegram_chat_id for the user 123. Remove the key from Memcache.
7) Now when we want to send a notification to the user 123, check if they have the field telegram_chat_id. If yes, use the sendMessage method in the Bot API to send them a message in Telegram.
THATS ALL ๐
@ Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆ LINKING IN TELEGRAM BOTS 2019
t.me/UndercOdeTestingOfficial
๐ฆDeep linking๐ฆ
1) Telegram bots have a deep linking mechanism, that allows for passing additional parameters to the bot on startup. It could be a command that launches the bot โ or an auth token to connect the user's Telegram account to their account on some external service.
2) Each bot has a link that opens a conversation with it in Telegram โ https://telegram.me/<bot username>. You can add the parameters start or startgroup to this link, with values up to 64 characters long. For example:
> https://telegram.me/triviabot?startgroup=test
A-Z, a-z, 0-9, _ and - are allowed. We recommend using base64url to encode parameters with binary and other types of content.
3) Following a link with the start parameter will open a one-on-one conversation with the bot, showing a START button in the place of the input field. If the startgroup parameter is used, the user is prompted to select a group to add the bot to. As soon as a user confirms the action (presses the START button in their app or selects a group to add the bot to), your bot will receive a message from that user in this format:
/start PAYLOAD
4) PAYLOAD stands for the value of the start or startgroup parameter that was passed in the link.
๐ฆ Deep linking Example
> Suppose the website example.com would like to send notifications to its users via a Telegram bot. Here's what they could do to enable notifications for a user with the ID 123.
1) Create a bot with a suitable username, e.g. @ExampleComBot
2) Set up a webhook for incoming messages
3) Generate a random string of a sufficient length, e.g. $memcache_key = "vCH1vGWJxfSeofSAs0K5PA"
4) Put the value 123 with the key $memcache_key into Memcache for 3600 seconds (one hour)
5) Show our user the button https://telegram.me/ExampleComBot?start=vCH1vGWJxfSeofSAs0K5PA
6) Configure the webhook processor to query Memcached with the parameter that is passed in incoming messages beginning with /start. If the key exists, record the chat_id passed to the webhook as telegram_chat_id for the user 123. Remove the key from Memcache.
7) Now when we want to send a notification to the user 123, check if they have the field telegram_chat_id. If yes, use the sendMessage method in the Bot API to send them a message in Telegram.
THATS ALL ๐
@ Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆ automatic deface many websites at once
instagram.com/UndercodeTestingCompany
๐ฆINSTALLISATION & RUN:
A) Termux:
1) pkg install python2
2) pip2 install requests
3) pkg install git
4) git clone https://github.com/Ranginang67/AOXdeface
5) cd AOXdeface
6) python2 aox.py
B) Linux:
1) apt-get install python
2) apt-get install pthon-pip
3) pip install requests
4) apt-get install git
5) git clone https://github.com/Ranginang67/AOXdeface
6) cd AOXdeface
7) python aox.py
๐ฆ before using this tool, put your deface script with the aox.py file, edit the file 'target.txt' and enter the target url
@ Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆ automatic deface many websites at once
instagram.com/UndercodeTestingCompany
๐ฆINSTALLISATION & RUN:
A) Termux:
1) pkg install python2
2) pip2 install requests
3) pkg install git
4) git clone https://github.com/Ranginang67/AOXdeface
5) cd AOXdeface
6) python2 aox.py
B) Linux:
1) apt-get install python
2) apt-get install pthon-pip
3) pip install requests
4) apt-get install git
5) git clone https://github.com/Ranginang67/AOXdeface
6) cd AOXdeface
7) python aox.py
๐ฆ before using this tool, put your deface script with the aox.py file, edit the file 'target.txt' and enter the target url
@ Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆHow exploite android 2019
Using open Adb ports we can exploit a Andriod Device
t.me/UndercOdeTestingOfficial
๐ฆ๐โ๐๐๐ธ๐๐๐๐๐ธ๐๐๐โ & โ๐โ:
>HOW TO INSTALL WINDOWS
1) git clone https://github.com/Zucccs/PhoneSploit
2) extract adb.rar to the phonesploit directory
3) cd PhoneSploit
4) pip install colorama
5) python2 main.py
> HOW TO INSTALL Linux
1) git clone https://github.com/Zucccs/PhoneSploit
2) cd PhoneSploit
3) pip install colorama
4) python2 main_linux.py
> IF ADB NOT FOUND
sudo apt update sudo apt install android-tools-adb android-tools-fastboot
@ Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆHow exploite android 2019
Using open Adb ports we can exploit a Andriod Device
t.me/UndercOdeTestingOfficial
๐ฆ๐โ๐๐๐ธ๐๐๐๐๐ธ๐๐๐โ & โ๐โ:
>HOW TO INSTALL WINDOWS
1) git clone https://github.com/Zucccs/PhoneSploit
2) extract adb.rar to the phonesploit directory
3) cd PhoneSploit
4) pip install colorama
5) python2 main.py
> HOW TO INSTALL Linux
1) git clone https://github.com/Zucccs/PhoneSploit
2) cd PhoneSploit
3) pip install colorama
4) python2 main_linux.py
> IF ADB NOT FOUND
sudo apt update sudo apt install android-tools-adb android-tools-fastboot
@ Mฬตอ ฬ ฬrฬถฬ.ฬตฬ ฬทอ BฬดอOฬทฬTฬถฬNฬดฬEฬถอTฬถฬ (tm
โ โ โ ๏ฝ๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ