UNDERCODE COMMUNITY
2.69K subscribers
1.23K photos
31 videos
2.65K files
80.8K links
🦑 Undercode Cyber World!
@UndercodeCommunity


1️⃣ World first platform which Collect & Analyzes every New hacking method.
+ AI Pratice
@Undercode_Testing

2️⃣ Cyber & Tech NEWS:
@Undercode_News

3️⃣ CVE @Daily_CVE

Web & Services:
Undercode.help
Download Telegram
Forwarded from UNDERCODE TESTING
🦑 Honeypot Integration with Elastic Stack - A Practical Guide 🛡

In this project , i have integrated Honeypot (trap for hackers) with the ELK Stack to monitor the real-time alerts and advanced threat hunting. 🕵️‍♂️
🔧 Key Steps:

1️⃣ Honeypot Setup: Deployed multiple honeypot services to capture malicious activity. (Requires a public IP 🌐)

2️⃣ ELK Stack Installation: The Elastic Stack plays a pivotal role in collecting, storing, and visualizing the data from the T-Pot honeypot. 📊

3️⃣ Data Filtration & Visualization: Filtered and visualized attack data in Kibana for actionable insights. 🔍📈

Note : This project can be extended to capture the IOC’s like users can add their own threat intelligence databases and can use python scripts to train the machine learning models for future use .🔒For instance , a MISP instance can be setup to store the IOC's from this honeypot.

Ref: HAMZA JAMEEL
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
Forwarded from Exploiting Crew (Pr1vAt3)
Forwarded from Exploiting Crew (Pr1vAt3)
🦑 ShellSweep: Detecting Web Shells Made Easy for Defenders 🚀

🐚 What is ShellSweep?
ShellSweep is a suite of open-source tools designed to detect web shells using entropy analysis, static code checks, and heuristic methods. From incident response to threat hunting, ShellSweep helps defenders identify suspicious files quickly and efficiently.

🛠Why Defenders Need ShellSweep
Test Your Coverage: Validate analytic detection for file mods, process executions, and suspicious behavior from web shells.
Tuning & Training: Scan web servers, analyze entropy baselines, and tune detection to YOUR environment.
Lightweight & Customizable: Works locally, supports PowerShell, Python, and Lua. Full control with zero dependency on external services.

🐚 ShellSweep: The foundation.
- Detects web shells using entropy-based analysis.
- Scans key extensions (.asp, .aspx, .php, .jsp) for high-entropy anomalies.
- Outputs file paths, entropy values, and hashes.

🐚🐚 ShellSweepPlus: Enhanced detection.
- Dynamic entropy thresholds.
- Multi-layered detection: Entropy, StdDev, Mixed Mode, and Heuristics.
- Static code analysis to spot malicious patterns.
- JSON outputs for structured results & further analysis.

🐚🐚🐚 ShellSweepX: Next-level, centralized detection.
- Combines entropy analysis, machine learning, and YARA rule matching.
- Cross-platform (PowerShell, Python, Bash).
- API integration for automated scans and result management.
- Web interface for visualizing and managing detections.

Perfect for Incident Responders & Threat Hunters
🛡 Deploy ShellSweep tools in test or production environments.
🔍 Load up your preferred web shells, simulate uploads, and refine detection rules.
📈 Detect new or obfuscated threats. Identify gaps. Tune your defenses.

🧰 ShellSweep: ShellSweeping the Evil!

Ref: Michael H.Michael H.
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
Forwarded from Exploiting Crew (Pr1vAt3)
Forwarded from Exploiting Crew (Pr1vAt3)
🦑Encryption vs Hashing - What's the difference?

Imagine you have a secret recipe for a cake, and you want to share it with a friend.

🤵Encryption:

You lock the recipe in a box with a key and give the box to your friend.

Your friend can unlock the box (with the key you gave them) and read the recipe.

If someone else finds the box without the key, they can't read it.
Key Point: It can be reversed if you have the key (decrypt it).

🧛Hashing:

You put the recipe in a blender and blend it into a unique smoothie.

Now it’s impossible to get the original recipe back from the smoothie.

But if someone else blends the exact same recipe, they’ll get the exact same smoothie.

Key Point: One-way process. You can’t go back to the recipe, but you can check if two smoothies match.

In short:

Encryption is like locking something up—can be unlocked.

Hashing is like turning it into mush—you can’t un-mush it!

As both methods involve turning data into a scrambled form, one might consider these two the same. However, there is a distinction you must know about:

Data is encrypted twice while it’s only hashed once.

One can encrypt/decrypt a piece of data, meaning that the original text can be retrieved back. However, retrieval of plain text isn’t possible if data is hashed once.

Ref: Santosh Nandakumar
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁