β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦To run an external (third party, copied) "WORKING" php script : On Termux
Twitter.com/UndercOdeTc
After installing php
1) Pkg updates
2) Sudo pkg install php
3) save your (executable) script.php in /storage/
example : in /storage/emulated/0/Documents/...FULL...PATH.../
(and other files.txt used by the script, if necessary)
4) Then in Termux App,
>
cd /storage/emulated/0/Documents/...FULL...PATH.../
>
php script.php
5) BUT ... before,
"It is necessary to grant storage permission for Termux on [your device with] Android 6 and higher.
Use 'Settings>Apps>Termux>Permissions>Storage' and set to true."
@UndercOdeOfficial
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦To run an external (third party, copied) "WORKING" php script : On Termux
Twitter.com/UndercOdeTc
After installing php
1) Pkg updates
2) Sudo pkg install php
3) save your (executable) script.php in /storage/
example : in /storage/emulated/0/Documents/...FULL...PATH.../
(and other files.txt used by the script, if necessary)
4) Then in Termux App,
>
cd /storage/emulated/0/Documents/...FULL...PATH.../
>
php script.php
5) BUT ... before,
"It is necessary to grant storage permission for Termux on [your device with] Android 6 and higher.
Use 'Settings>Apps>Termux>Permissions>Storage' and set to true."
@UndercOdeOfficial
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ malwares Setup 2020
An SSH Honeypot >Cowrie is a medium interaction SSH and Telnet honeypot, which can log brute force attacks and an attackerβs shell interaction
pinterest.com/UndercodeOfficial
π¦ ππΌππ πππΈβπ :
1) Change the Port Youβll Use to Administer the Server
Cowrie will be listening for SSH connections on port 22. Youβll want to configure the SSH service to listen on a different port for you to connect to and administer the server.
2)sudo vi /etc/ssh/sshd_config
Under # What ports, IPs and protocols we listen for, change the port number to 3393 or your preferred port number.
3) Write your changes and quit vi.
Ctrl + C
4) Restart the SSH service.
5) service ssh restart
6) By running the command below, you can see that the server is now listening for connections on port 3393.
7) netstat -tan
> Proto Recv-Q Send-Q Local Address Foreign Address State
tcp0 0 0.0.0.0:3393 0.0.0.0:* LISTEN
π¦ Install and Configure Cowrie
1) Download updated package lists.
> sudo apt-get update
2) Install Cowrieβs dependencies.
> sudo apt-get install python2.7 git virtualenv libmpfr-dev libssl-dev libmpc-dev libffi-dev build-essential libpython-dev python-pip
3) Add a new user named, cowrie.
4) sudo adduser β disabled-password cowrie
5) Switch to the new user, cowrie
> sudo su β cowrie
6) Navigate to the home directory of user, cowrie, and clone the cowrie git repository.
> git clone https://github.com/micheloosterhof/cowrie.git
7) Create a new Python virtual environment for cowrie.
8) cd cowrie
9) virtualenv cowrie-env
10) Activate the virtual environment.
> source cowrie-env/bin/activate
11) The terminal will display (cowrie-env) before the username, cowrie.
12) Install pycrypto, Crypto and other requirements.
13) pip install pycrypto Crypto
(cowrie-env)$ pip install -r requirements.txt
14) Generate a key for the cowrie instance.
15) cd data
ssh-keygen -t dsa -b 1024 -f ssh_host_dsa_key
cd ..
16) export PYTHONPATH=/home/cowrie/cowrie
Additional Cowrie Configuration
17) Make a copy of the config file for your new cowrie instance.
18) cd /home/cowrie/cowrie/
19) cp cowrie.cfg.dist cowrie.cfg
vi ./cowrie.cfg
20) Set the hostname in the configuration file to a server name of your choice. E.g. fileserver4
21) Change the Port to listen for incoming SSH connections to port 22.
22) Write your changes and quit vi.
Ctrl + C
:wq
23) Enable authbind in cowrieβs start.sh file.
sudo vi /home/cowrie/cowrie/start.sh
Change line 2 to read:
AUTHBIND_ENABLED=yes
24) sudo apt-get install authbind
25) sudo touch /etc/authbind/byport/22
26) sudo chown cowrie /etc/authbind/byport/22
27) sudo chmod 777 /etc/authbind/byport/22
π¦ Start Cowrie
1) Execute the following commands to start Cowrie.
2) sudo su cowrie
3) cd /home/cowrie/cowrie/
source cowrie-env/bin/activate
4) ./start.sh
5) Verify cowrie is listening on port 22 by running the command below.
netstat -tan
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
6) Execute the following command to stop Cowrie.
./stop.sh
Written by Undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ malwares Setup 2020
An SSH Honeypot >Cowrie is a medium interaction SSH and Telnet honeypot, which can log brute force attacks and an attackerβs shell interaction
pinterest.com/UndercodeOfficial
π¦ ππΌππ πππΈβπ :
1) Change the Port Youβll Use to Administer the Server
Cowrie will be listening for SSH connections on port 22. Youβll want to configure the SSH service to listen on a different port for you to connect to and administer the server.
2)sudo vi /etc/ssh/sshd_config
Under # What ports, IPs and protocols we listen for, change the port number to 3393 or your preferred port number.
3) Write your changes and quit vi.
Ctrl + C
4) Restart the SSH service.
5) service ssh restart
6) By running the command below, you can see that the server is now listening for connections on port 3393.
7) netstat -tan
> Proto Recv-Q Send-Q Local Address Foreign Address State
tcp0 0 0.0.0.0:3393 0.0.0.0:* LISTEN
π¦ Install and Configure Cowrie
1) Download updated package lists.
> sudo apt-get update
2) Install Cowrieβs dependencies.
> sudo apt-get install python2.7 git virtualenv libmpfr-dev libssl-dev libmpc-dev libffi-dev build-essential libpython-dev python-pip
3) Add a new user named, cowrie.
4) sudo adduser β disabled-password cowrie
5) Switch to the new user, cowrie
> sudo su β cowrie
6) Navigate to the home directory of user, cowrie, and clone the cowrie git repository.
> git clone https://github.com/micheloosterhof/cowrie.git
7) Create a new Python virtual environment for cowrie.
8) cd cowrie
9) virtualenv cowrie-env
10) Activate the virtual environment.
> source cowrie-env/bin/activate
11) The terminal will display (cowrie-env) before the username, cowrie.
12) Install pycrypto, Crypto and other requirements.
13) pip install pycrypto Crypto
(cowrie-env)$ pip install -r requirements.txt
14) Generate a key for the cowrie instance.
15) cd data
ssh-keygen -t dsa -b 1024 -f ssh_host_dsa_key
cd ..
16) export PYTHONPATH=/home/cowrie/cowrie
Additional Cowrie Configuration
17) Make a copy of the config file for your new cowrie instance.
18) cd /home/cowrie/cowrie/
19) cp cowrie.cfg.dist cowrie.cfg
vi ./cowrie.cfg
20) Set the hostname in the configuration file to a server name of your choice. E.g. fileserver4
21) Change the Port to listen for incoming SSH connections to port 22.
22) Write your changes and quit vi.
Ctrl + C
:wq
23) Enable authbind in cowrieβs start.sh file.
sudo vi /home/cowrie/cowrie/start.sh
Change line 2 to read:
AUTHBIND_ENABLED=yes
24) sudo apt-get install authbind
25) sudo touch /etc/authbind/byport/22
26) sudo chown cowrie /etc/authbind/byport/22
27) sudo chmod 777 /etc/authbind/byport/22
π¦ Start Cowrie
1) Execute the following commands to start Cowrie.
2) sudo su cowrie
3) cd /home/cowrie/cowrie/
source cowrie-env/bin/activate
4) ./start.sh
5) Verify cowrie is listening on port 22 by running the command below.
netstat -tan
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
6) Execute the following command to stop Cowrie.
./stop.sh
Written by Undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦Usefull Tools for IDS / IPS / Host IDS / Host IPS 2020
instagram.com/UndercOdeTestingCompany
π¦ ππΌππ πππΈβπ :
1) Snort - Snort is a free, open source intrusion prevention system (NIPS) and network intrusion detection system (NIDS), created by Martin Roche Snort is currently under development. Sourcefire, founded by Roesch and CTO. In 2009, Snort entered the OpenWork InfoWorld Hall of
2) Fame as one of the βgreatest [open source] software samples of all timeβ.
3) Bro - Bro is a powerful network analysis infrastructure that is very different from the typical IDS you may know.
4) OSSEC - Integrated HIDS open source. Not for the faint of heart. It takes a little to understand how this works. Performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time notification, and an active response. It works on most operating systems, including Linux, MacOS, Solaris, HP-UX, AIX, and Windows. Lots of reasonable documentation. Sweet spot - medium to large deployment.
5) Suricata - Suricata is a high-performance mechanism for monitoring
network IDS, IPS and network security. Open Source and belongs to the public non-profit foundation Open Foundation Security Foundation (OISF). Suricata was developed by OISF and its suppliers.
6) Security Onion - Security Onion is a Linux distribution for intrusion detection, network security monitoring and log management. It is based on Ubuntu and contains Snort, Suricata, Bro, OSSEC, Sguil, Squert,
7) Snorby, ELSA, Xplico, NetworkMiner and many other security tools. The easy-to-use installation wizard allows you to create an army of distributed sensors for your enterprise in minutes!
8) sshwatch - IPS for SSH is similar to DenyHosts written in Python. It can also collect information about an attacker during an attack in a log.
9) Stealth - Check file integrity, which leaves virtually no residue. The controller starts from another computer, which makes it difficult for an attacker to know that the file system is checked at certain pseudorandom intervals via SSH. Highly recommended for small to medium deployments.
11) AIEngine - AIEngine is an interactive / programmable next-generation Python / Ruby / Java / Lua package checker with training capabilities without any human intervention, NIDS (network intrusion detection) System) functionality, DNS domain classification, network collector, network forensics and much more.
12) Denyhosts - Prevent SSH dictionary attacks and brute force attacks.
Fail2Ban - scans log files and performs actions at IP addresses that show malicious behavior.
13) SSHGuard - a service security software in addition to SSH written in C
Lynis is an open source security audit tool for Linux / Unix.
Written by Undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦Usefull Tools for IDS / IPS / Host IDS / Host IPS 2020
instagram.com/UndercOdeTestingCompany
π¦ ππΌππ πππΈβπ :
1) Snort - Snort is a free, open source intrusion prevention system (NIPS) and network intrusion detection system (NIDS), created by Martin Roche Snort is currently under development. Sourcefire, founded by Roesch and CTO. In 2009, Snort entered the OpenWork InfoWorld Hall of
2) Fame as one of the βgreatest [open source] software samples of all timeβ.
3) Bro - Bro is a powerful network analysis infrastructure that is very different from the typical IDS you may know.
4) OSSEC - Integrated HIDS open source. Not for the faint of heart. It takes a little to understand how this works. Performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time notification, and an active response. It works on most operating systems, including Linux, MacOS, Solaris, HP-UX, AIX, and Windows. Lots of reasonable documentation. Sweet spot - medium to large deployment.
5) Suricata - Suricata is a high-performance mechanism for monitoring
network IDS, IPS and network security. Open Source and belongs to the public non-profit foundation Open Foundation Security Foundation (OISF). Suricata was developed by OISF and its suppliers.
6) Security Onion - Security Onion is a Linux distribution for intrusion detection, network security monitoring and log management. It is based on Ubuntu and contains Snort, Suricata, Bro, OSSEC, Sguil, Squert,
7) Snorby, ELSA, Xplico, NetworkMiner and many other security tools. The easy-to-use installation wizard allows you to create an army of distributed sensors for your enterprise in minutes!
8) sshwatch - IPS for SSH is similar to DenyHosts written in Python. It can also collect information about an attacker during an attack in a log.
9) Stealth - Check file integrity, which leaves virtually no residue. The controller starts from another computer, which makes it difficult for an attacker to know that the file system is checked at certain pseudorandom intervals via SSH. Highly recommended for small to medium deployments.
11) AIEngine - AIEngine is an interactive / programmable next-generation Python / Ruby / Java / Lua package checker with training capabilities without any human intervention, NIDS (network intrusion detection) System) functionality, DNS domain classification, network collector, network forensics and much more.
12) Denyhosts - Prevent SSH dictionary attacks and brute force attacks.
Fail2Ban - scans log files and performs actions at IP addresses that show malicious behavior.
13) SSHGuard - a service security software in addition to SSH written in C
Lynis is an open source security audit tool for Linux / Unix.
Written by Undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ COMMUN VIRUS-MALWARES 2020 top
twitter.com/UndercodeTC
1) Damn Simple Honeypot (DSHP) - Honeypot framework with pluggable handlers.
2) NOVA - uses honeypots as detectors, looks like a complete system.
3) OpenFlow Honeypot (OFPot) - Redirects traffic for unused IP addresses to a honeypot built on POX.
4) OpenCanary - A modular and decentralized honeypot daemon that runs several Canary versions of services and warns when (ab) is in use.
low- ciscoasa_honeypot Honeypot for a Cisco ASA that can detect CVE-2018-0101, DoS vulnerabilities, and remote code execution.
miniprint - Honeypot mid-interaction printer.
π¦ Botnet C2 Tools
1) Hale - Botnet management and control monitor.
2) dnsMole - analyzes DNS traffic and potentially detects botnet commands and monitors server activity, as well as infected hosts.
3) IPv6 attack detection tool
ipv6 attack detector is a Google Summer of Code 2012 project supported by the Honeynet Project.
dynamic code toolkit
4)Frida - Add JavaScript to explore native applications on Windows, Mac, Linux, iOS, and Android.
A tool for converting a site into server decoys
5) HIHAT - Convert arbitrary PHP applications to high-level Honeypots web interfaces.
malware collector
6) Kippo-Malware is a Python script that downloads all malicious files stored as URLs in the Kippo SSH honeypot database.
Distributed Deployment Sensor
7) Modern Honey Network - Multiple snort and honeypot sensor management, uses a network of virtual machines, small SNORT installations, hidden dioneas and a centralized server for management.
π¦Network analysis tool
1) Tracexploit - play network packets.
2) Anonymizer Journal
3) LogAnon - Anonymous logging library that helps ensure anonymous logs are consistent between logs and network captures.
Low-interaction Honeypot (router back door)
4) Honeypot-32764 - Honeypot for the back door of the router (TCP 32764).
5) WAPot - Honeypot that can be used to monitor traffic directed to home routers.
6) Honeynet Farm Traffic Redirector
Honeymole - Deploying multiple sensors that redirect traffic to a centralized collection of honey pots.
7) HTTPS Proxy
mitmproxy - allows you to intercept, verify, modify and play traffic flows.
π¦System hardware
1) Sysdig - An open-source system-level study allows you to record the status and activity of a system from a running GNU / Linux instance, and then save, filter, and analyze the results.
2) Fibratus - A tool for researching and tracking the Windows kernel.
Honeypot for malware distribution via USB
3) Ghost-usb - Honeypot for malware spreading through USB storage devices.
π¦ Data collection
1) Kippo2MySQL - Extracts some very simple statistics from Kippo text log files and inserts them into a MySQL database.
2) Kippo2ElasticSearch is a Python script for transferring data from the
3) Kippo SSH honeypot MySQL database to an ElasticSearch instance (server or cluster).
4) Passive Network Audit Framework Parser
[Passive Network Audit Infrastructure (pnaf)] ( https://github.com/jusafing/pnaf ) is a platform that combines several passive and automated analysis methods to provide an assessment of the security of network platforms.
π¦ VM monitoring and tools
1) Antivmdetect - Script to create templates for use with VirtualBox to make VM detection more difficult.
2) VMCloak - Automatically create a virtual machine and mask for a cuckoo sandbox.
[vmitools] ( http://libvmi.com/ ) is a C library with Python bindings that makes it easy to track the low-level details of a running virtual machine.
π¦ binary debugger
1) Hexgolems - the server part of the debugger Pint - the server part of the debugger and the LUA shell for the PIN code.
2) Hexgolems - external interface of the debugger Schem - external interface of the debugger.
ALL THOSE AVAIBLE AT GITHUB WILL WROTE SOME TUTORIALS FOR those
Written by Undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ COMMUN VIRUS-MALWARES 2020 top
twitter.com/UndercodeTC
1) Damn Simple Honeypot (DSHP) - Honeypot framework with pluggable handlers.
2) NOVA - uses honeypots as detectors, looks like a complete system.
3) OpenFlow Honeypot (OFPot) - Redirects traffic for unused IP addresses to a honeypot built on POX.
4) OpenCanary - A modular and decentralized honeypot daemon that runs several Canary versions of services and warns when (ab) is in use.
low- ciscoasa_honeypot Honeypot for a Cisco ASA that can detect CVE-2018-0101, DoS vulnerabilities, and remote code execution.
miniprint - Honeypot mid-interaction printer.
π¦ Botnet C2 Tools
1) Hale - Botnet management and control monitor.
2) dnsMole - analyzes DNS traffic and potentially detects botnet commands and monitors server activity, as well as infected hosts.
3) IPv6 attack detection tool
ipv6 attack detector is a Google Summer of Code 2012 project supported by the Honeynet Project.
dynamic code toolkit
4)Frida - Add JavaScript to explore native applications on Windows, Mac, Linux, iOS, and Android.
A tool for converting a site into server decoys
5) HIHAT - Convert arbitrary PHP applications to high-level Honeypots web interfaces.
malware collector
6) Kippo-Malware is a Python script that downloads all malicious files stored as URLs in the Kippo SSH honeypot database.
Distributed Deployment Sensor
7) Modern Honey Network - Multiple snort and honeypot sensor management, uses a network of virtual machines, small SNORT installations, hidden dioneas and a centralized server for management.
π¦Network analysis tool
1) Tracexploit - play network packets.
2) Anonymizer Journal
3) LogAnon - Anonymous logging library that helps ensure anonymous logs are consistent between logs and network captures.
Low-interaction Honeypot (router back door)
4) Honeypot-32764 - Honeypot for the back door of the router (TCP 32764).
5) WAPot - Honeypot that can be used to monitor traffic directed to home routers.
6) Honeynet Farm Traffic Redirector
Honeymole - Deploying multiple sensors that redirect traffic to a centralized collection of honey pots.
7) HTTPS Proxy
mitmproxy - allows you to intercept, verify, modify and play traffic flows.
π¦System hardware
1) Sysdig - An open-source system-level study allows you to record the status and activity of a system from a running GNU / Linux instance, and then save, filter, and analyze the results.
2) Fibratus - A tool for researching and tracking the Windows kernel.
Honeypot for malware distribution via USB
3) Ghost-usb - Honeypot for malware spreading through USB storage devices.
π¦ Data collection
1) Kippo2MySQL - Extracts some very simple statistics from Kippo text log files and inserts them into a MySQL database.
2) Kippo2ElasticSearch is a Python script for transferring data from the
3) Kippo SSH honeypot MySQL database to an ElasticSearch instance (server or cluster).
4) Passive Network Audit Framework Parser
[Passive Network Audit Infrastructure (pnaf)] ( https://github.com/jusafing/pnaf ) is a platform that combines several passive and automated analysis methods to provide an assessment of the security of network platforms.
π¦ VM monitoring and tools
1) Antivmdetect - Script to create templates for use with VirtualBox to make VM detection more difficult.
2) VMCloak - Automatically create a virtual machine and mask for a cuckoo sandbox.
[vmitools] ( http://libvmi.com/ ) is a C library with Python bindings that makes it easy to track the low-level details of a running virtual machine.
π¦ binary debugger
1) Hexgolems - the server part of the debugger Pint - the server part of the debugger and the LUA shell for the PIN code.
2) Hexgolems - external interface of the debugger Schem - external interface of the debugger.
ALL THOSE AVAIBLE AT GITHUB WILL WROTE SOME TUTORIALS FOR those
Written by Undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦Deface topic script Deface is a library that allows you to customize HTML (ERB, Haml and Slim) views in a Rails application without editing the underlying view.
> It allows you to easily target html & erb elements as the hooks for customization using CSS selectors as supported by Nokogiri. Rails plugin that allows you to customize ERB views in a Rails application without editing the underlying view updated in 2019
http://pinterest.com/UndercodeOfficial
π¦ πβπππΈπππππΈπππβ & βπβ:
1) on linux os clone https://github.com/spree/deface
2) go dir
3) Ensure that your layout views include doctype, html, head and body tags in a single file, as Nokogiri will create such elements if it detects any of these tags have been incorrectly nested.
4) Parsing will fail and result in invalid output if ERB blocks are responsible for closing an HTML tag that was opened normally, i.e. don't do this: <div <%= ">" %>
5) Gems or Spree Extensions that add overrides to your application will load them in the order they are added to your Gemfile.
6) Applying an override to a view that contains invalid markup (which, occasionally happens in Spree views) can break rendering that would normally pass a browser's own permissive rendering. This is because the nokogiri library takes it upon itself to correct the issue, which doesn't happen prior to applying deface. Sometimes that correction changes the rendering of the view in an unintended manner, appearing to break it. The easiest way to tell if this is the cause of an issue for you is to put your view into http://deface.heroku.com/ and diff the output with the html which rails renders without your override. If you see a difference in the structure of the html, you may have invalid markup in your view which nokogiri is correcting for you. See Spree issue #1789 for an example of what may be wrong in a view.
@UndercOdeOfficial
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦Deface topic script Deface is a library that allows you to customize HTML (ERB, Haml and Slim) views in a Rails application without editing the underlying view.
> It allows you to easily target html & erb elements as the hooks for customization using CSS selectors as supported by Nokogiri. Rails plugin that allows you to customize ERB views in a Rails application without editing the underlying view updated in 2019
http://pinterest.com/UndercodeOfficial
π¦ πβπππΈπππππΈπππβ & βπβ:
1) on linux os clone https://github.com/spree/deface
2) go dir
3) Ensure that your layout views include doctype, html, head and body tags in a single file, as Nokogiri will create such elements if it detects any of these tags have been incorrectly nested.
4) Parsing will fail and result in invalid output if ERB blocks are responsible for closing an HTML tag that was opened normally, i.e. don't do this: <div <%= ">" %>
5) Gems or Spree Extensions that add overrides to your application will load them in the order they are added to your Gemfile.
6) Applying an override to a view that contains invalid markup (which, occasionally happens in Spree views) can break rendering that would normally pass a browser's own permissive rendering. This is because the nokogiri library takes it upon itself to correct the issue, which doesn't happen prior to applying deface. Sometimes that correction changes the rendering of the view in an unintended manner, appearing to break it. The easiest way to tell if this is the cause of an issue for you is to put your view into http://deface.heroku.com/ and diff the output with the html which rails renders without your override. If you see a difference in the structure of the html, you may have invalid markup in your view which nokogiri is correcting for you. See Spree issue #1789 for an example of what may be wrong in a view.
@UndercOdeOfficial
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ What do computer viruses look like? "worm", "trojan" and others
see this pic
see this pic
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Network Configuration-LAN Implementation VLAN Example full by UndercOde
twitter.com/UnderCodeTC
PART 1
π¦ ππΌππ πππΈβπ :
> computer network technology developed from traditional Ethernet (10Mb / s) to fast Ethernet (100Mb / s) ) And Gigabit Ethernet
(1000Mb / s) only a few years, the rapid momentum is surprising. Nowadays, in the construction of medium-to-large-scale networks,
the mainstream network models of so-called βGigabit trunk running and 100M to desktopβ with Gigabit Layer 3 switches as the core are endless. Now, the
network industry is no stranger to the terms "Layer 3 switching" and VLAN.
1) what is Layer 3 switching and VLAN?
To answer this question, let's first look at the working principle of Ethernet. The working principle of Ethernet is to use the bits formed by binary bits to form
frame-by-frame data (actually some electrical pulses) to propagate on the wire. First,
>the nodes on the Ethernet network segment that need to transmit data monitor the wires. This process is called CSMA / CD
(Carrier Sense Multiple Access with Collision Detection
). If, at this time, another node is transmitting data, the listening node will have to wait until
2) the transmission task of the transmitting node ends. If two workstations happen to be transmitting data at the same time, the Ethernet segment will send a
"collision" signal. At this time, all stations on the node will detect the collision signal, because the voltage on the wire exceeds the
standard voltage. At this time, any node on the Ethernet network segment cannot transmit data until the conflict ends. That is, in CSMA
In the / CD mode, only one node can transmit data on the wire during a period of time. The networking
device that forwards Ethernet data frames is a hub, which is a layer of equipment and has a relatively low transmission efficiency.
The occurrence of collisions reduces the bandwidth of Ethernet, and this situation is inevitable. As
the number of nodes on the wire increases, the number of collisions will increase. The obvious solution is to limit the nodes on the Ethernet wires, requiring
3) physical segmentation of the network. Network devices that physically segment the network use bridges and switches. The basic
role of bridges and switches is to send information only to other physical network segments. Therefore, if all the information is only sent to the local physical network segment,
> then no information is passed on the bridges and switches. This can effectively reduce conflicts on the network. Bridges and switches
make forwarding decisions based on the destination MAC (Media Access Control) address. They are Layer 2 devices. We already know the
shortcomings of Ethernet and the impact of collisions on the physical network segment.
Written by Undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Network Configuration-LAN Implementation VLAN Example full by UndercOde
twitter.com/UnderCodeTC
PART 1
π¦ ππΌππ πππΈβπ :
> computer network technology developed from traditional Ethernet (10Mb / s) to fast Ethernet (100Mb / s) ) And Gigabit Ethernet
(1000Mb / s) only a few years, the rapid momentum is surprising. Nowadays, in the construction of medium-to-large-scale networks,
the mainstream network models of so-called βGigabit trunk running and 100M to desktopβ with Gigabit Layer 3 switches as the core are endless. Now, the
network industry is no stranger to the terms "Layer 3 switching" and VLAN.
1) what is Layer 3 switching and VLAN?
To answer this question, let's first look at the working principle of Ethernet. The working principle of Ethernet is to use the bits formed by binary bits to form
frame-by-frame data (actually some electrical pulses) to propagate on the wire. First,
>the nodes on the Ethernet network segment that need to transmit data monitor the wires. This process is called CSMA / CD
(Carrier Sense Multiple Access with Collision Detection
). If, at this time, another node is transmitting data, the listening node will have to wait until
2) the transmission task of the transmitting node ends. If two workstations happen to be transmitting data at the same time, the Ethernet segment will send a
"collision" signal. At this time, all stations on the node will detect the collision signal, because the voltage on the wire exceeds the
standard voltage. At this time, any node on the Ethernet network segment cannot transmit data until the conflict ends. That is, in CSMA
In the / CD mode, only one node can transmit data on the wire during a period of time. The networking
device that forwards Ethernet data frames is a hub, which is a layer of equipment and has a relatively low transmission efficiency.
The occurrence of collisions reduces the bandwidth of Ethernet, and this situation is inevitable. As
the number of nodes on the wire increases, the number of collisions will increase. The obvious solution is to limit the nodes on the Ethernet wires, requiring
3) physical segmentation of the network. Network devices that physically segment the network use bridges and switches. The basic
role of bridges and switches is to send information only to other physical network segments. Therefore, if all the information is only sent to the local physical network segment,
> then no information is passed on the bridges and switches. This can effectively reduce conflicts on the network. Bridges and switches
make forwarding decisions based on the destination MAC (Media Access Control) address. They are Layer 2 devices. We already know the
shortcomings of Ethernet and the impact of collisions on the physical network segment.
Written by Undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Now, let's look at another cause that causes the network to slow down:
( Network Configuration-LAN Implementation VLAN Example full by UndercOde part 2)
t.me/UndercOdeTesting
π¦ ππΌππ πππΈβπ :
1) broadcast. Broadcasts exist on all networks. If they are not properly controlled, they will flood the entire network and
generate a large amount of network traffic. Broadcasting not only consumes bandwidth, but also reduces the processing efficiency of user workstations.
2) Each of various
reasons like, the network operating system (NOS) using broadcast, TCP / IP using the broadcast MAC address resolution from the IP address, so that also
advertises by using broadcasts RIP and IGRP protocol, therefore, is inevitable broadcast
3) Bridges and switches will
forward all broadcast messages, while routers will not. Therefore, in order to control the broadcast, a router must be used. Routers
make forwarding decisions based on Layer 3 headers, destination IP addressing, destination IPX addressing, or destination Appletalk addressing.
4) A router is a
Layer 3 device.
5) we can easily understand the three-layer switching technology. In simple terms, it is the technology that combines routing and switching into one.
6) After a first router for routing data stream, will produce a MAC address and IP address mapping table, when the same number of
time data stream through again, this will be exchanged according to the mapping table directly from the floor rather than re-routing Provides wire-speed performance, which
eliminates network delay caused by router selection and improves the efficiency of packet forwarding. The switch using this technology is
often called a Layer 3 switch.
Written by Undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Now, let's look at another cause that causes the network to slow down:
( Network Configuration-LAN Implementation VLAN Example full by UndercOde part 2)
t.me/UndercOdeTesting
π¦ ππΌππ πππΈβπ :
1) broadcast. Broadcasts exist on all networks. If they are not properly controlled, they will flood the entire network and
generate a large amount of network traffic. Broadcasting not only consumes bandwidth, but also reduces the processing efficiency of user workstations.
2) Each of various
reasons like, the network operating system (NOS) using broadcast, TCP / IP using the broadcast MAC address resolution from the IP address, so that also
advertises by using broadcasts RIP and IGRP protocol, therefore, is inevitable broadcast
3) Bridges and switches will
forward all broadcast messages, while routers will not. Therefore, in order to control the broadcast, a router must be used. Routers
make forwarding decisions based on Layer 3 headers, destination IP addressing, destination IPX addressing, or destination Appletalk addressing.
4) A router is a
Layer 3 device.
5) we can easily understand the three-layer switching technology. In simple terms, it is the technology that combines routing and switching into one.
6) After a first router for routing data stream, will produce a MAC address and IP address mapping table, when the same number of
time data stream through again, this will be exchanged according to the mapping table directly from the floor rather than re-routing Provides wire-speed performance, which
eliminates network delay caused by router selection and improves the efficiency of packet forwarding. The switch using this technology is
often called a Layer 3 switch.
Written by Undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ UNDERSTANDING BEFORE ATTACK :
what is a VLAN? VLAN (Virtual Local Area Network) means virtual local area network.
pinterest.com/UndercOdeOfficial
π¦ ππΌππ πππΈβπ :
1) VLANs do not consider the physical location of users, but logically divide users into
working groups with relatively independent functions based on functions, applications, and other factors . Each user host is connected to a VLAN-enabled switch port and belongs to a VLAN .
2) Members in the same VLAN all share broadcasts to form a broadcast domain, and broadcast information between different VLANs is isolated from each other.
3) In this
way, the entire network is divided into multiple different broadcast domains (VLANs).
4) Generally, if a station in a VLAN sends a broadcast, all stations in this VLAN will
receive the broadcast, but the switch will not send the broadcast to any port in other VLANs. If you want to broadcast
to other VLAN ports, you need to use a Layer 3 switch.
Written by Undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ UNDERSTANDING BEFORE ATTACK :
what is a VLAN? VLAN (Virtual Local Area Network) means virtual local area network.
pinterest.com/UndercOdeOfficial
π¦ ππΌππ πππΈβπ :
1) VLANs do not consider the physical location of users, but logically divide users into
working groups with relatively independent functions based on functions, applications, and other factors . Each user host is connected to a VLAN-enabled switch port and belongs to a VLAN .
2) Members in the same VLAN all share broadcasts to form a broadcast domain, and broadcast information between different VLANs is isolated from each other.
3) In this
way, the entire network is divided into multiple different broadcast domains (VLANs).
4) Generally, if a station in a VLAN sends a broadcast, all stations in this VLAN will
receive the broadcast, but the switch will not send the broadcast to any port in other VLANs. If you want to broadcast
to other VLAN ports, you need to use a Layer 3 switch.
Written by Undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Network Configuration-Find Computer IP by NETBIOS Name
fb.com/UnderCodeTestingCompany
π¦ ππΌππ πππΈβπ :
1) Use nmblookup test to find the IP of the machine with the NETBIOS name test in the same network, if This machine
has multiple IPs and will be listed together.
2) My linux was forced to die under yesterday βs sudden power failure. What should I do
> when I cannot enter KDE when I enter again :
fsck -s -y /
fsck -s -y / var
fsck -s -y / usr
@UndercodeOfficial
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Network Configuration-Find Computer IP by NETBIOS Name
fb.com/UnderCodeTestingCompany
π¦ ππΌππ πππΈβπ :
1) Use nmblookup test to find the IP of the machine with the NETBIOS name test in the same network, if This machine
has multiple IPs and will be listed together.
2) My linux was forced to die under yesterday βs sudden power failure. What should I do
> when I cannot enter KDE when I enter again :
fsck -s -y /
fsck -s -y / var
fsck -s -y / usr
@UndercodeOfficial
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ The Best Antiviruses for Linux in 2020:
twitter.com/UNDERCODETC
π¦ ππΌππ πππΈβπ :
1) Bitdefender GravityZone Business Security β Best for Businesses
www.bitdefender.com
2) Comodo Antivirus for Linux β Best for Home Users
> https://www.comodo.com/home/internet-security/antivirus-for-linux.php
3) ESET NOD32 Antivirus for Linux β Best for New Linux Users (Home)
> www.eset.com
4) Kaspersky Endpoint Security for Linux β Best for Hybrid IT Environments (Business)
> https://me-en.kaspersky.com/small-business-security?redef=1&THRU&reseller=me-en_meta-ksos_acq_ona_sem_bra_onl_b2c__psrch_______&utm_source=google&utm_medium=branded&utm_campaign=ksos-15&ksid=fb29975b-4f58-4bce-8b22-1697c3e77cf9&ksprof_id=434&ksaffcode=305783&ksdevice=c&kschadid=214581515961&kschname=google&kpid=Google|822220295|45727109471|214581515961|kwd-299077543916|c&gclid=EAIaIQobChMIhonei-jG5wIVSdHeCh0nPwlREAAYAiAAEgLYPvD_BwE
5) recommended for ubunto servers- sofos antivirus
> https://www.sophos.com/en-us/products/free-tools/sophos-antivirus-for-linux.aspx
@UndercOdeTesting
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ The Best Antiviruses for Linux in 2020:
twitter.com/UNDERCODETC
π¦ ππΌππ πππΈβπ :
1) Bitdefender GravityZone Business Security β Best for Businesses
www.bitdefender.com
2) Comodo Antivirus for Linux β Best for Home Users
> https://www.comodo.com/home/internet-security/antivirus-for-linux.php
3) ESET NOD32 Antivirus for Linux β Best for New Linux Users (Home)
> www.eset.com
4) Kaspersky Endpoint Security for Linux β Best for Hybrid IT Environments (Business)
> https://me-en.kaspersky.com/small-business-security?redef=1&THRU&reseller=me-en_meta-ksos_acq_ona_sem_bra_onl_b2c__psrch_______&utm_source=google&utm_medium=branded&utm_campaign=ksos-15&ksid=fb29975b-4f58-4bce-8b22-1697c3e77cf9&ksprof_id=434&ksaffcode=305783&ksdevice=c&kschadid=214581515961&kschname=google&kpid=Google|822220295|45727109471|214581515961|kwd-299077543916|c&gclid=EAIaIQobChMIhonei-jG5wIVSdHeCh0nPwlREAAYAiAAEgLYPvD_BwE
5) recommended for ubunto servers- sofos antivirus
> https://www.sophos.com/en-us/products/free-tools/sophos-antivirus-for-linux.aspx
@UndercOdeTesting
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦Topic 2019-2020 termux scripts: configurable prompt builder for Bash and ZSH
t.me/UndercOdeTesting
π¦ ππΌππ πππΈβπ :
a) Termux
>< apt update
> apt install gbt
b) Arch Linux
> yaourt -S gbt
> Or install gbt-git if you would like to run the latest greatest from the master branch.
π¦ CentOS/RHEL
Packages hosted by Packagecloud):
echo '[gbt]
name=GBT YUM repo
baseurl=https://packagecloud.io/gbt/release/el/7/$basearch
gpgkey=https://packagecloud.io/gbt/release/gpgkey
https://packagecloud.io/gbt/release/gpgkey/gbt-release-4C6E79EFF45439B6.pub.gpg
gpgcheck=1
repo_gpgcheck=1' | sudo tee /etc/yum.repos.d/gbt.repo >/dev/null
sudo yum install gbt
Use the exact repository definition from above for all RedHat-based distribution regardless its version.
π¦ Ubuntu/Debian/kali
> Packages hosted by Packagecloud):
1) curl -L https://packagecloud.io/gbt/release/gpgkey | sudo apt-key add -
2) echo 'deb https://packagecloud.io/gbt/release/ubuntu/ xenial main' |
3) sudo tee /etc/apt/sources.list.d/gbt.list >/dev/null
4) sudo apt-get update
5) sudo apt-get install gbt
6) Use the exact repository definition from above for all Debian-based distribution regardless its version.
π¦ Mac
Using Homebrew:
1) brew tap jtyr/repo
2) brew install gbt
3) Or install gbt-git if you would like to run the latest greatest from the master branch.
E N J O Y
@UndercOdeTesting
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦Topic 2019-2020 termux scripts: configurable prompt builder for Bash and ZSH
t.me/UndercOdeTesting
π¦ ππΌππ πππΈβπ :
a) Termux
>< apt update
> apt install gbt
b) Arch Linux
> yaourt -S gbt
> Or install gbt-git if you would like to run the latest greatest from the master branch.
π¦ CentOS/RHEL
Packages hosted by Packagecloud):
echo '[gbt]
name=GBT YUM repo
baseurl=https://packagecloud.io/gbt/release/el/7/$basearch
gpgkey=https://packagecloud.io/gbt/release/gpgkey
https://packagecloud.io/gbt/release/gpgkey/gbt-release-4C6E79EFF45439B6.pub.gpg
gpgcheck=1
repo_gpgcheck=1' | sudo tee /etc/yum.repos.d/gbt.repo >/dev/null
sudo yum install gbt
Use the exact repository definition from above for all RedHat-based distribution regardless its version.
π¦ Ubuntu/Debian/kali
> Packages hosted by Packagecloud):
1) curl -L https://packagecloud.io/gbt/release/gpgkey | sudo apt-key add -
2) echo 'deb https://packagecloud.io/gbt/release/ubuntu/ xenial main' |
3) sudo tee /etc/apt/sources.list.d/gbt.list >/dev/null
4) sudo apt-get update
5) sudo apt-get install gbt
6) Use the exact repository definition from above for all Debian-based distribution regardless its version.
π¦ Mac
Using Homebrew:
1) brew tap jtyr/repo
2) brew install gbt
3) Or install gbt-git if you would like to run the latest greatest from the master branch.
E N J O Y
@UndercOdeTesting
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Updated 2020 repo for web pentesting api
pinterest.com/UndercOdeOfficial
π¦FEATURES :
1) A complete versatile framework to cover up everything from Reconnaissance to Vulnerability Analysis.
2) Has 5 main phases, subdivided into 14 sub-phases consisting a total of 108 modules.
3) Reconnaissance Phase has 50 modules of its own (including active and passive recon, information disclosure modules).
4) Scanning & Enumeration Phase has got 16 modules (including port scans, WAF analysis, etc)
5) Vulnerability Analysis Phase has 37 modules (including most common vulnerabilites in action).
6) Exploits Castle has only 1 exploit. (purely developmental)
And finally, Auxillaries have got 4 modules. more under development
7) All four phases each have a Auto-Awesome module which automates every module for you.
8) You just need the domain, and leave everything is to this tool.
TIDoS has full verbose out support, so you'll know whats going on.
9) Fully user friendly interaction environment. (no shits)
π¦ ππΌππ πππΈβπ :
Presently, for installing globally, you will need to default your Python version to 2.x. However, the work of migration from Python2 to Python3 is already underway.
1) Clone the repository locally and navigate there:
> git clone https://github.com/0xinfection/tidos-framework.git
2) cd tidos-framework
3) Install the dependencies:
> chmod +x install
4) ./install
π¦Now lets run the tool:
TIDoS needs some libraries to run, which can be installed via aptitude or yum Package Managers.
1) sudo apt-get install libncurses5 libxml2 nmap tcpdump libexiv2-dev build-essential python-pip python-xmpp
2) Now after these dependencies are finished installing, we need to install the remaining Python Package dependencies, hence run:
> pip2 install -r requirements.txt
Thats it. You now have TIDoS at your service. Fire it up using:
3) python2 tidos.py
π¦ Docker image :
You can build it from Dockerfile :
1> git clone https://github.com/0xinfection/tidos-framework.git
2> cd tidos-framework/docker
3> docker build -r tidos .
> To run TIDoS :
> docker run --interactive --tty --rm tidos bash
tidos
@UndercOdeTesting
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ Updated 2020 repo for web pentesting api
pinterest.com/UndercOdeOfficial
π¦FEATURES :
1) A complete versatile framework to cover up everything from Reconnaissance to Vulnerability Analysis.
2) Has 5 main phases, subdivided into 14 sub-phases consisting a total of 108 modules.
3) Reconnaissance Phase has 50 modules of its own (including active and passive recon, information disclosure modules).
4) Scanning & Enumeration Phase has got 16 modules (including port scans, WAF analysis, etc)
5) Vulnerability Analysis Phase has 37 modules (including most common vulnerabilites in action).
6) Exploits Castle has only 1 exploit. (purely developmental)
And finally, Auxillaries have got 4 modules. more under development
7) All four phases each have a Auto-Awesome module which automates every module for you.
8) You just need the domain, and leave everything is to this tool.
TIDoS has full verbose out support, so you'll know whats going on.
9) Fully user friendly interaction environment. (no shits)
π¦ ππΌππ πππΈβπ :
Presently, for installing globally, you will need to default your Python version to 2.x. However, the work of migration from Python2 to Python3 is already underway.
1) Clone the repository locally and navigate there:
> git clone https://github.com/0xinfection/tidos-framework.git
2) cd tidos-framework
3) Install the dependencies:
> chmod +x install
4) ./install
π¦Now lets run the tool:
TIDoS needs some libraries to run, which can be installed via aptitude or yum Package Managers.
1) sudo apt-get install libncurses5 libxml2 nmap tcpdump libexiv2-dev build-essential python-pip python-xmpp
2) Now after these dependencies are finished installing, we need to install the remaining Python Package dependencies, hence run:
> pip2 install -r requirements.txt
Thats it. You now have TIDoS at your service. Fire it up using:
3) python2 tidos.py
π¦ Docker image :
You can build it from Dockerfile :
1> git clone https://github.com/0xinfection/tidos-framework.git
2> cd tidos-framework/docker
3> docker build -r tidos .
> To run TIDoS :
> docker run --interactive --tty --rm tidos bash
tidos
@UndercOdeTesting
β β β ο½ππ»βΊπ«Δπ¬πβ β β β