▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 Android developpements part 4:
instagram.com/UndercOdeTestingCompany

🦑 𝕃𝔼𝕋𝕊 𝕊𝕋𝔸ℝ𝕋

🦑 AbsoluteLayout:

1) AbsoluteLayout is also called absolute layout. Components placed in this layout need to specify their exact coordinate values ​​through the two properties android: layout_x and android: layout_y and display them on the screen.

2) In theory, AbsoluteLayout can be used to complete any layout design, and it has great flexibility, but it is not recommended in actual engineering applications. Because using this layout not only needs to accurately calculate the size of each component, increase the amount of calculation, but also produces different effects when the application runs on mobile phones with different screen sizes.

3) An example AbsoluteLayoutDemo demonstrates the use of AbsoluteLayout layout
> check picture about this chat

🦑 The TableLayout layout provides several special properties that can achieve the following special effects.

1) android: shrinkColumns property: This property is used to set shrinkable columns. When the collapsible column is too wide for other columns in the layout to display completely, the collapsible column will stretch vertically, compressing the space it takes up so that the other columns can be fully displayed. android: shrinkColumns = "1" means that the second column is set as a shrinkable column and the number of columns starts from 0.

2) android: stretchColumns property: This property is used to set stretchable columns. Stretchable columns automatically expand to fill all available space. android: stretchColumns = "1" means set the second column as a stretchable column.

3) android: collapseColumns property: This property is used to set hidden columns. android: collapseColumns = "1" means the second column is hidden and not displayed.

Written by UndercOde
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Adnroid developpements Customize views :
> Here is a brief introduction to the units of size types commonly used in the Android system.



1) Pixel: Abbreviated as px. Represents physical pixels on the screen.

2) Pounds: points, abbreviated as pt. 1pt equals 1/72 of an inch and is often used in the printing industry.

3) Zoom in on pixels: sp. It is mainly used for font display. Android uses sp as the font size unit by default.

4) Density Independent Pixel: Abbreviated as dip or dp. This size uses a 160dp screen as a reference, and then uses this screen to map to the actual screen. There will be corresponding scaling effects on screens with different resolutions to apply to screens with different resolutions. If you use px, 320px occupies the width of HVGA. On WVGA, you can only take up less than half of the screen. It must not be what you want.
Millimeter: mm.

🦑 WebView

1) The WebView component is a subclass of AbsoluteLayout and is used to display Web pages. With WebView, you can easily develop your own web browser. Only the basic usage of WebView is introduced here, and it will be further explained in the later study of Web App.

2) Create a project WebViewDemo and add Internet access to it in the AndroidManifest.xml file:
<uses-permission android: name = "android.permission.INTERNET" />

2) Add a WebView component to the layout file main.xml. The content of Main.xml is as follows:
<? xml version = "1.0" encoding = "utf-8"?>
<LinearLayout xmlns: android = "http://schemas.android.com/apk/res/android"
android: layout_width = "fill_parent"
android: layout_height = "fill_parent"
android: orientation = "vertical" >
<WebView
android: id = "@ + id / webView1"
android: layout_width = "match_parent"
android: layout_height = "match_parent" />
</ LinearLayout>
The code of the Activity file WebViewDemoActivity.java in the example WebViewDemo is as follows:
Plain Text Copy
package introduction . android . webView ;
import android . app . Activity ;
import android . os . Bundle ;
Import Android . WebKit . WebView ;
public class WebViewDemoActivity extends Activity {
private WebView webView ;
/ **
* Called when the acctivity is first crested .
* /
@Override
public void onCreate ( Bundle saveInstanceState ) {
super . onCreate ( saveInstanceState );
the setContentView ( R & lt . layout . main );
the webView = ( the WebView ) the findViewById ( R & lt . ID . webView1 );
webView . getSettings (). set JavaScript Enabled ( true );
webView . loadUrl ( "http://www.google.com" );
}
}
Written by UndercOde
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁


🦑 2020 Exploite tool: Kali-Parrot-debian
T.me/UndercOdeTesting
hackerEnv is an automation tool that quickly and easily sweep IPs and scan ports, vulnerabilities and exploit them. Then, it hands you an interactive shell for further testing. Also, it generates HTML and docx reports. It uses other tools such as nmap, nikto, metasploit and hydra.

𝕀𝕟𝕤𝕥𝕒𝕝𝕝𝕚𝕤𝕒𝕥𝕚𝕠𝕟 & ℝ𝕦𝕟:

apt update; apt upgrade -y
1) git clone https://github.com/abdulr7mann/hackerEnv.git

2) cd /opt/hackerEnv

3) chmod +x hackerEnv

If you want to use it anywhere on the system, create a shortcut using:

4) ln -s /opt/hackerEnv/hackerEnv /usr/local/bin/

🦑
Usage:
hackerEnv <flag> <argument>

Example:
hackerEnv -t 10.10.10.10
hackerEnv -t "10.10.10.10\n20.20.20.20"
hackerEnv -t 10.10.10.10 -i eth0
hackerEnv -i eth0 -s 24
hackerEnv -s 24

Flages:
hackerEnv -h, --help Display this help message.
hackerEnv --update Update tool.
hackerEnv Scan the entire network.
hackerEnv -t Pass a specific target's IP.
hackerEnv -t Pass mutipule targets' IPs separated by comma Ex: hackerEnv -t "10.10.10.10\n20.20.20.20"
hackerEnv -i To specify an interface.
hackerEnv -a Pass attacker's IP.
hackerEnv -s To specify subNetwork 24 or 23 etc exclude /
hackerEnv -e, --aggressive Enable aggressive port scan
hackerEnv -oA genetrate report in HTML and DOCX format

Written by UndercOde
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 Web-Pentesting 2019 script:
>ITWSV is automated penetration testing tool which performs information gathering, auditing and reporting.
twitter.com/UndercOdeTc

𝕀𝕟𝕤𝕥𝕒𝕝𝕝𝕚𝕤𝕒𝕥𝕚𝕠𝕟 & ℝ𝕦𝕟:

1) git clone https://github.com/penetrate2hack/ITWSV.git

2) cd ITWSV

3) chmod +x start.sh

4) chmod +x update.sh (only if required)

5) ./start.sh

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 How to solve the winodws error recovery by UndercOde:
> generally we will choose to successfully restart the configuration and restart; in fact, this is a cure for the symptoms and not the root cause, and such problems will still occur repeatedly. Winodws error recovery tips are generally caused by recently installed hardware or software, the following editor will share how to solve windows error recovery.
t.me/UndercOdeTesting

🦑 𝕃𝔼𝕋𝕊 𝕊𝕋𝔸ℝ𝕋

A) Determine when the error occurs

> If the error occurs while setting up a new computer, or after recovering the computer, select "Open Startup Repair (Recommended)" from the error screen and let Windows repair its files.

> If the error persists after the repair, please perform a system recovery to restore the computer to its original configuration. After the recovery is complete, make sure that you have set up Windows and that you can see all the icons and sidebars on the Windows desktop before shutting down your computer.

2) If this error occurs during normal use, or after you recently added software or hardware, follow these steps to recover your Windows desktop.

B) Remove recently added hardware

> Follow these steps to disconnect recently added hardware and check for errors.

Note: If new internal devices (sound cards, hard disks, etc.) are added to the computer before the error occurs, disconnect these internal hardware before performing the following operations.

1) Turn off the computer and unplug the power cord.

2) Disconnect all unnecessary peripherals (printers, scanners, cameras, zip drives, telephone lines, network cables, and other devices). Only mouse, keyboard, and monitor connections remain.

3) Press and hold the "Power" button on the front of the computer. Release after five seconds.

4)Reinsert the power cord.

5)Start the computer.

6)The display shows the information again.

7) If the error recurs, skip to the next step.

8) If the computer successfully enters the Windows desktop instead of restarting with an error message, reconnect a device and wait for Windows to recognize the device.

9) Connect one device at a time and restart the computer after each connection until you find the device that caused the error. Do not use equipment that is known to cause errors.

C) Repair

> In the error screen, select "Open Startup Repair (Recommended)" and let Windows repair its files. If the error recurs, proceed to the next step and use System Restore.

D) Use System Restore


Follow these steps to restore Windows to an earlier time:

1) Shut down the computer.

2) Disconnect all devices except the mouse, keyboard, and monitor.

3)Start the computer and press the "F8" key repeatedly when the logo screen appears. The Windows startup screen appears.

4)Use the up and down arrow keys to highlight "Safe Mode with Command Prompt" and press the "Enter" key. If the error message appears again, skip to the next step and perform a system recovery.

5) When the login screen appears, select "Administrator" and enter the password (if any).

6) Click "Start" → "All Programs" → "Accessories" in turn, and click "Command Prompt". The Command Prompt window opens.

7) Enter in the command prompt:

cd \ windows \ system32 \ restore

Then press the keyboard "Enter"

8) Enter the command again: rstrui

Then press the "Enter" key

9)The system will open the "System Restore" program

Written by UndercOde
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑How to track down a process or potential virus that is eating my bandwidth on Windows 10 ? From Wiki :


1) Start Task Manger (CTRL+SHIFT+ESC)

2) Select the Performance tab

3) Click the Resource Monitor... button at the bottom of the tab

4) When Resource Monitor starts click the Network tab
Investigate all the Processes with Network Activity to locate the offending process

5) If you are unsure about a particular process you can right click on it and Search Online for more information on that process:

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑What is RefRef Malware ?

1) RefRef is a Perl-based DoS attack tool developed by the Hacktivist group ‘Anonymous’ that uses a vulnerability in MySQL to perform an SQL injection involving the MySQL BENCHMARK() function.

2) RefRef abuses the BENCHMARK () function which allows for the repeated execution of an expression in order to exhaust a targeted server’s resources.
instagram.com/UndercOdeTestingCompany

3) Unlike LOIC (a network stress testing tool whose use to level DDoS attacks was popularized by Anonymous),

4) RefRef does not require a vast number of machines in order to take down a server due to the nature of its attack vector.

5) If the server’s backend uses MySQL and is vulnerable, few machines are needed to cause a significant outage. A 17-second attack from a single machine on 2011 was able to bring Pastebin offline for 42 minutes.

@UndercOdeOfficial
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 ADB Miner: A Botnet Surfaces FROM 2018 :
Radware’s Emergency Response Team has been monitoring the emergence of a new botnet
pinterest.com/UndercOdeOfficial

> ADB.miner malware takes advantage of Android-based devices that expose debug capabilities to the Internet. When a remote host exposes its Android Debug Bridge (ADB) control port, any Android emulator on the Internet has full install, start, reboot and root shell access without authentication.

>Part of the malware, xmrig binaries (Monero cryptocurrency miners) are executing on the devices.

🦑 Bot User Tools

> Getting root shell access using Android SDK platform tools:
C:\bin\android-platform-tools\platform-tools>adb shell "id"
uid=0(root) gid=0(root)

> All ADB connections start with the CNXN fixed string, matching the pattern intercepted by Radware’s honeypots:
0000000: 43 4e 58 4e 00 00 00 01 00 10 00 00 07 00 00 00 CNXN
0000010: 32 02 00 00 bc b1 a7 b1 68 6f 73 74 3a 3a 00 2.......host
Commands performed against a target device:
{ name: "adb"; service: "adb"; host: "100.115.92.2"; port: "5555"; probe: [ "^CNXN" ]; }

>The Monero wallet address that collects the return on the mining investment is 44XT4KvmobTQfeWa6PCQF5RDosr2MLWm43AsaE3o5iNRXXTfDbYk2VPHTVedTQHZyfXNzMn8YYF2466d3FSDT7gJS8gdHAr

🦑Hashes/IOC
91f0ffdec958388adab53b5a473265d7ce86d0a3da4622490c9199baecce31b8 xmrig32
a881b27c388448cf9d77443ea23be4d751b3b565b773e1d97a7dbb0702189812 xmrig64
940b47e9b71ba4968cfefd7ae6c374a319f2439e9b71ee0965e20a0ce00dcd67 droidbot
6b973256325b0f93c45a1ae8a964218b6c86aa3c509453f0325754eb2dcfef0e droidbot.apk

🦑 Effective DDoS Protection Essentials

1) Hybrid DDoS Protection - On-premise and cloud DDoS protection for real-time DDoS attack prevention that also addresses high volume attacks and protects from pipe saturation

2) Behavioral-Based Detection - Quickly and accurately identify and block anomalies while allowing legitimate traffic through

3) Real-Time Signature Creation - Promptly protect from unknown threats and zero-day attacks

4) A Cyber-Security Emergency Response Plan - A dedicated emergency team of experts who have experience with Internet of Things security and handling IoT outbreaks

5) Intelligence on Active Threat Actors – high fidelity, correlated and analyzed date for preemptive protection against currently active known attackers.

@UndercOdeOfficial
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 Assembly debugging skills and simple cracking by UndercOde
This post is suitable for students who are interested in assembly debugging or want to get started cracking.

🦑 The following uses arm linux (android) as an example.

1) elf introduction

2) For the next crack we are going to make, the most important information is to know that elf is mainly composed of headers, tables, and segments.

3) Some commonly used tools are objdumpand readelf. Of course, gdb is even more essential.

4) To see the distribution of each segment:

> readelf -S a.out

5) To (hexadecimal) output a segment (output here .rodata):

readelf -x .rodata a.out

6) To disassemble the code snippet ( .text
>objdump -d a.out > a.out.dum

🦑 Assembly instruction

1) Because the libraries to be cracked are generally stripped and do not see the source code information, they often deal with assembly instructions.

2) Different architectures have different instructions, such as x86, arm. But basically the same is the assembly principle, that is, registers, PC (program pointer), SP (stack pointer), constant / stack / memory read and write. Only by understanding these basic principles, and then looking at the instructions and understanding the architectural differences, can we be more comfortable.

3) Here I want to hack an arm library, so I know some arm instructions in advance, you can refer to arm infocenter .

🦑 gdb

1)objdumpInferring the source code directly from the parsed assembly code is a labor-intensive task. You have to force yourself to work like a machine, and imagine the states of various registers and pointers in your brain. (And often the assembly code is -Ooptimized)

2) Therefore, by gdb“debugging” the target file in the running state, the value of the register can be printed in real time, the calling sequence of the process can be tracked, and the code principle can be quickly clarified.

3)Because the instructions to be debugged are assembly instructions, they are slightly different from regular source-based debugging.

Here are a few commonly used gdb commands.

> Display disassembly code:

layout asm
Step into the assembly code:

si
Step-by-step assembly code:

ni

> Display register information:

info registers

> Print register value:

p /x $r0

> Print the memory value (assuming r0 holds the memory address)

x $r0

Written by UndercOde
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑How to Crack Nginux Server :
twitter.com/UndercOdeTC

🦑 𝕃𝔼𝕋𝕊 𝕊𝕋𝔸ℝ𝕋

> A brief introduction to fail2ban

> Fail2ban can monitor the system log, match the error information in the log (using regular expressions), and perform corresponding masking actions (supporting multiple, generally calling iptables), is a very useful and powerful software.

> For example: the attacker keeps trying to exhaustively use SSH, SMTP, FTP passwords, etc. As long as the preset value is reached, fail2ban will call the firewall to block this IP, and can send an email to notify the system administrator.

🦑 Functions and features:

1) Support a large number of services: sshd, apache, qmail, etc.

2) Support multiple actions: iptables, tcp-wrapper, shorewall, mail notifications, etc.

3) Support wildcard characters in the logpath option

4) Gamin support is required (Gamin is used to monitor files and directories Whether to change)

5) If email notification is required, the system must ensure that email can be sent normally in advance

🦑 Fail2ban installation and configuration file introduction

> Installation
1) epel-release

2) yum -y install epel-release
# fail2ban

3) yum -y install fail2ban


🦑 File directory structure

/etc/fail2ban ## fail2ban

/etc/fail2ban/action.d ## iptables 、mail ...

/etc/fail2ban/filter.d

/etc/fail2ban/jail.conf ## fail2ban

/etc/fail2ban/fail2ban.conf ## fail2ban 、
sock

Written by UndercOde
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Crack Nginux Server By UndercOde:
PART 2

> fail2ban.conf configuration file

1) shell > grep -v ^# /etc/fail2ban/fail2ban.conf

[Definition]
loglevel = 3

logtarget = /var/log/fail2ban.log ## fail2ban ]

socket = /var/run/fail2ban/fail2ban.sock ## sock

pidfile = /var/run/fail2ban/fail2ban.pid ## pid

🦑 jail.conf protection configuration

shell > grep -v ^# /etc/fail2ban/jail.conf

[DEFAULT]

ignoreip = 127.0.0.1/8

bantime = 600

findtime = 600
maxretry = 3
backend = auto
usedns = warn
[ssh-iptables]
enabled = true
filter = sshd sshd.conf
action = iptables[name=SSH, port=ssh, protocol=tcp]
logpath = /var/log/secure
maxretry = 5

🦑 Configure to prevent the nginx server web directory from being scanned by hackers

1) Add the following to the end of the jail.conf file

2) shell > vim /etc/fail2ban/jail.conf
[nginx]
enabled = true
port = http,https
filter = nginx
action = iptables[name=nginx, port=http, protocol=tcp]
logpath = /www/lnmp/log/nginx/access.log
bantime = 3600
findtime = 60
maxretry = 5

🦑 Add the nginx.conf file in the etc / fail2ban / filter.d directory and append the following:

1) shell > vim /etc/fail2ban/filter.d/nginx.conf

[Definition]
2) failregex = <HOST> -.*- .*HTTP/1.* 404 .*$
ignoreregex

Written by UndercOde
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Crack Nginux 2020 Part 3 by UndercOde:
pits skipped by fail2ban


🦑 fail2ban fails to start

1) Check if the configuration file format is correct

> fail2ban-regex /www/lnmp/log/nginx/access.log /etc/fail2ban/filter.d/nginx.conf

2) Query the startup cause according to the startup information, and enter the pit (nginx log file path configuration error)

> fail2ban-client start

🦑 How to delete the disabled blacklist IP in fail2ban
fail2ban-configuration

1) fail2ban-client set // unbanip IP

2) fail2ban-client set nginx unbanip 8.8.8.8
iptaables delete corresponding rules

3) shell > iptables -nL --line-numbers

4) Chain INPUT (policy ACCEPT)
num target prot opt source destination

> f2b-nginx tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80

5) Chain FORWARD (policy ACCEPT)

>num target prot opt source destination

6) Chain OUTPUT (policy ACCEPT)
num target prot opt source destination

7) Chain f2b-nginx (1 references)

> num target prot opt source destination

> REJECT all -- 8.8.8.8 0.0.0.0/0 reject-with icmp-port-unreachable

> REJECT all -- 9.9.9.9 0.0.0.0/0 reject-with icmp-port-unreachable

> RETURN all -- 0.0.0.0/0 0.0.0.0/0

🦑 iptables
shell > iptables -D f2b-nginx 1

USE THOSE TUTORIALS FOR LEARN ONLY
Written by UndercOde
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 IOTA cryptocurrency shuts down entire network after wallet vulnerability is exploited
Recently News from twitter.com/UnderCodeTC

> IOTA is not a cryptocurrency based on the mathematical concept of a directed acyclic graph, not a blockchain.It was born in 2017, the hottest of Bitcoin.

> Last week, the foundation managing IOTA shut down the entire cryptocurrency network after learning that hackers were using the official wallet application vulnerability to steal user funds .

>The attack occurred on February 12, and within 25 minutes of receiving the report, the IOTA Foundation shut down Coordinator, the last node used to approve the transaction, preventing hackers from stealing user funds, but in fact closed the entire network.

>The attacker is believed to have targeted 10 high-value users, using the vulnerability of the official wallet application Trinity to steal funds. According to unofficial sources, about $ 1.6 million worth of IOTA coins were stolen. The IOTA team released version 1.4 on Sunday, fixing an exploited vulnerability. The network is still offline and developers are finalizing remediation plans.

Written by UndercOde
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁