▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 2020 tool for m performing a denial of service attacks. Quack Toolkit includes SMS attack tool, HTTP attack tool and many other attack tools
T.me/UndercOdeTesting

🦑LETS START:

1) git clone https://github.com/entynetproject/quack

2) cd quack

3) chmod +x install.sh

4) ./install.sh

🦑usage: quack [-h] [--target <IP:port/URL/phone>]
[--tool [SMS|NTP|TCP|UDP|SYN|POD|SLOWLORIS|MEMCACHED|HTTP|NJRAT]]
[--timeout <timeout>] [--threads <threads>] [-u]

optional arguments:
-h, --help show this help message and exit
--target <IP:port/URL/phone>
Target IP:port, URL or phone.
--tool [SMS|NTP|TCP|UDP|SYN|POD|SLOWLORIS|MEMCACHED|HTTP|NJRAT]
Attack tool.
--timeout <timeout> Timeout in secounds.
--threads <threads> Threads count.
-u, --update Update Quack Toolkit.

🦑Example of the SMS attack:

quack --tool SMS --target 15554443333 --time 10 --threads 10
Example of the HTTP attack:

quack --tool HTTP --target http://example.com/ --time 10 --threads 10
Example of the TCP attack:

quack --tool TCP --target 192.168.1.100:80 --time 10 --threads 10


Written by Under Code
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 Make an xbm picture ? by undercode :
> xbm is a simple two-color image bitmap format. It was used more in early cgi. It is currently used on counters.
T.me/UndercOdeTesting

🦑LETS START:

<? php
setXBM (1234567890,0);

function setXBM ($ num, $ mode = 0) {
settype ( $ num, "string");
$ mode = $ mode? 0xff: 0x00;
$ int_width = strlen ($ num); // digits
$ count_width = 8; // single number width
$ count_height = 16; // height

$ bitmap = array (
0 => array (0xff, 0xff, 0xff, 0xc3, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0xc3, 0xff, 0xff, 0xff),
1 => array (0xff, 0xff) , 0xff, 0xcf, 0xc7, 0xcf, 0xcf, 0xcf, 0xcf, 0xcf, 0xcf, 0xcf, 0xcf, 0xff, 0xff, 0xff),
2 => array (0xff, 0xff, 0xff, 0xc3, 0x99, 0x9f, 0x9f, 0xcf , 0xe7, 0xf3, 0xf9, 0xf9, 0x81, 0xff, 0xff, 0xff),
3 => array(0xff, 0xff, 0xff, 0xc3, 0x99, 0x9f, 0x9f, 0xc7, 0x9f, 0x9f, 0x9f, 0x99, 0xc3, 0xff, 0xff, 0xff),
4 => array(0xff, 0xff, 0xff, 0xcf, 0xcf, 0xc7, 0xc7, 0xcb, 0xcb, 0xcd, 0x81, 0xcf, 0x87, 0xff, 0xff, 0xff),
5 => array(0xff, 0xff, 0xff, 0x81, 0xf9, 0xf9, 0xf9, 0xc1, 0x9f, 0x9f, 0x9f, 0x99, 0xc3, 0xff, 0xff, 0xff),
6 => array(0xff, 0xff, 0xff, 0xc7, 0xf3, 0xf9, 0xf9, 0xc1, 0x99, 0x99, 0x99, 0x99, 0xc3, 0xff, 0xff, 0xff),
7 => array(0xff, 0xff, 0xff, 0x81, 0x99, 0x9f, 0x9f, 0xcf, 0xcf, 0xe7, 0xe7, 0xf3, 0xf3, 0xff, 0xff, 0xff),
8 => array(0xff, 0xff, 0xff, 0xc3, 0x99, 0x99, 0x99, 0xc3, 0x99, 0x99, 0x99, 0x99, 0xc3, 0xff, 0xff, 0xff),
9 => array(0xff, 0xff, 0xff, 0xc3, 0x99, 0x99, 0x99, 0x99, 0x83, 0x9f, 0x9f, 0xcf, 0xe3, 0xff, 0xff, 0xff)
);

echo "#define counter_width " .($count_width * $int_width)."\r\n";
echo "#define counter_height " .$count_height. "\r\n";
echo "static unsigned char counter_bits[] = {\r\n";
for($i=0; $i<$count_height; ++$i) {
for($j = 0; $j < $int_width; ++$j) {
printf("0x%2x, ",$bitmap[$num[$j]][$i]^$mode);
}
}


Written by Under Code
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 Network Filtering-Address Mapping with iptables :
> t.me/UnderCodeTesting

🦑LETS START:

many users such redhat os- asks:
> How Can I make my internal FTP server accessible to Internet users? That is how to map IP addresses, please give pointers ..well follow this UnderCode Tutorial

you can't ftp / telnet on the LAN, and then there is really no way, you turned off iptables!> see this fix


1) Ftp dnat
# / sbin / iptables -t nat -A PREROUTING -p tcp -d $ addr0 --dport 20 -i eth0 DNAT --to $ ADDR3 -j: 20
# / sbin / iptables -t NAT -A PREROUTING -p tcp -d $ ADDR0 --dport 21 -i eth0 -j DNAT --to $ ADDR3: 21
this is what I have done An example. Used well. See if it helps you.

2) $ addr0 The IP of the external network card of this machine

3) $ addr1 The IP of the internal server

🦑 Isn't there only one machine that can FTP?
try

1) insertmod ip_nat_ftp
and other related modules. I didn't specify whether a PC can FTP ... but all our LANs can FTP.

2) Or your iptable firewall script was written incorrectly. No open ftp port.

Written by Under Code
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 Seven elements of being a successful programmer recommended by UnderCode
T.me/UnderCodeTesting

1) First, low commitment, high realization: If your commitment is indeed what the manager wants to hear, he will like you. However, he will not like you any more if the software is not delivered in a timely manner as promised.

2) Second, don't put errors in software: Good programmers don't put errors in their code.

3) Third, full of enthusiasm and hard work: Excellent programmers are full of enthusiasm and hard work, they are highly organized, and pay attention to methods, they have the ability to structure things. Moreover, the enthusiasm of most programmers for their hard work is incredible.

4) Fourth, know the unknown factors.

5) Fifth, get along well with team members: Software development is the result of team members' coordinated efforts.

6) Six, good beginning, good end, towards the ultimate goal: always towards the ultimate goal is a very important ability.
One of the things you're looking for when interviewing someone for work is the work he actually participates in on the product the group has already delivered.

7) Seven, learning the emerging technology: Excellent developers are people who are eager to learn.

Written by Under Code
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Hack Like expert

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 HOW TO LOAD IFRAMES IN YOUR MODULES ?


> If you have used one or more modules you must have seen the iframes used for realtime result display. In this tutorial I'm going to show you how to insert them into your module and how they function.

> We need and a bit of php code in order to get started and a screen file that spits out the content.

🦑 𝕃𝔼𝕋𝕊 𝕊𝕋𝔸ℝ𝕋 :

1) The start of your index.php file in your module should look like this:

<?php
if(!defined('IN_SCRIPT')){
exit;
}
// iframe that shows attack
$_CONTEXT['screen'] = array();
$_CONTEXT['screen']['src'] = $_PATHS['module_default_root_http']."/screen.php";
$_CONTEXT['screen']['w'] = 800;
$_CONTEXT['screen']['h'] = 200;
$_CONTEXT['screen']['name'] = "screen";
?>

2) You can however place the context variable anywhere in your code as long as you put it before your html form.

> In case you don't understand what the context variable is about, here's some explanation:

a) src: source of the iframe

b)w: width of the iframe

c)h: height of the iframe

e) name: name of the iframe

🦑 The start of the module with all code would look like this:

<?php
if(!defined('IN_SCRIPT')){
exit;
}
// iframe that shows attack
$_CONTEXT['screen'] = array();
$_CONTEXT['screen']['src'] = $_PATHS['module_default_root_http']."/screen.php";
$_CONTEXT['screen']['w'] = 800;
$_CONTEXT['screen']['h'] = 200;
$_CONTEXT['screen']['name'] = "screen";
$sCode = (isset($sCode) ? $sCode : "");
$sCode .= " <div class=\"moddesc\"><img src=\"./".$_CONTEXT['module_current']."/".$_CONTEXT['module_current'].".png\" width=\"90\" align=\"left\" /><h2>".$_CONTEXT['modules'][$_CONTEXT['module_current']]['name']."</h2>".$_CONTEXT['modules'][$_CONTEXT['module_current']]['description']."</div>\n";
$sCode .= "<form method=\"post\" action=\"".$_CONTEXT['screen']['src']."\" target=\"".$_CONTEXT['screen']['name']."\">\n";
?>

> You can copy the code above for any module you want to create that requires usage of iframes.

Written by Under Code
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Create Your First HackSuite Tutorial by UnderCode :
T.me/UndeCodeTesting

1) In this small tutorial we are going to create a new app for the hacksuite. We're not going to do anything fancy here, we will make a simple app to get familiar how to write compatible scripts for the suite.

2) We are going to create a tool that allows you to get the profile page of a facebook image name..
See this example :

🦑The bold part is the profile id we want, there's a 1001 ways to isolate it but I'll do it the lazy way:

<?php
$sInput = "http://sphotos-a.ak.fbcdn.net/hphotos-ak-prn1/396991_258579564204685_1706121139_n.jpg";
$aInput = @explode("_",$sInput);
if(false==($iInput = @count($aInput))){
die("Invalid facebook image");
}
if(!isset($aInput[$iInput-1]) || $aInput[$iInput-1]!="n.jpg" || !is_numeric($aInput[$iInput-3])){
die("Invalid facebook image, wrong structure");
}
echo"http://www.facebook.com/profile.php?id=".$aInput[$iInput-3];
?>

🦑 This will produce the facebook profile url of where the image originally comes from.

> Of course this is not very useful unless the user can input any url through a form:

<?php
if(!isset($_POST['submit'])){
echo"<form method=\"post\">";
echo"<input type=\"text\" name=\"sUrl\"> <input type=\"submit\" name=\"submit\">";
echo"</form>";
}
else{
$aInput = @explode("_",$_POST['sUrl']);
if(false==($iInput = @count($aInput))){
die("Invalid facebook image");
}
if(!isset($aInput[$iInput-1]) || $aInput[$iInput-1]!="n.jpg" || !is_numeric($aInput[$iInput-3])){
die("Invalid facebook image, wrong structure");
}
echo"http://www.facebook.com/profile.php?id=".$aInput[$iInput-3];
}
?>

🦑 To get started with creating your application click on development and then create new app:

1) name of app: give the app unique names like 'AppName', you can't use

2) names that have this pattern (thc_xx)

3) location: relative location from the hacksuite root folder, eg

4) MyAppFolder/Start, you can't use locations that have this pattern (thc_xx)

5) version: typically applications in the hacksuite start at 0.0.1, you can however use any version

6) When you submit the form, a new form will appear

7) Replace the line echo world with the code above(of course without the php open and close tag), submit the form and you created your first - not so fancy - hacksuite application. You would still need to put some styling and other html but this is just a POC.

Written by Under Code
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑How Identify System Fingerprint Information undercode tutorial
pinterest.com/UnderCodeOfficial

🦑LETS START:

1) Use the -O option of the Nmap command to enable the operating system testing function. The execution command is as follows:

> root@kali:~# nmap -O 192.168.41.136

2) Starting Nmap 6.40 ( http://nmap.org )
Nmap scan report for www.example site... (192.168.xx.xxx)
Host is up (0.00045s latency).
Not shown: 996 closed ports
PORT STATE SERVICE
22/tcp open ssh
53/tcp open domain
80/tcp open http
111/tcp open rpcbind

> MAC Address: 00:0C:29:31:02:17 (VMware) //MAC地址
Device type: general purpose
Running: Linux 2.6.X|3.X
OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3

OS details: Linux..version xx
Network Distance: 1 hop

2) OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 2.18 seconds

3) The output information shows the fingerprint information of the host 192.168.xx.xxx, including the port opened by the target host, the MAC address, the operating system type, and the kernel version.

🦑 Fingerprint recognition tool p0f :

> p0f is a 100% passive fingerprint recognition tool. The tool analyzes the data packets sent by the target host to identify the operating system on the host, even if a good-performance firewall is installed on the system. The main identifying information of p0f is as follows:

> Operating system type;
port;

1) Whether it is running behind a firewall;

2) Whether to run in NAT mode;

3) Whether to run in load balancing mode;

4) Remote system has been started;

5) DSL and ISP information for remote systems.

6) Use p0f to analyze a file captured by Wireshark. The execution command is as follows:

> check picture

🦑 output is a result of p0f analyzing the targethost.pcap package. This information displays detailed information about the client and server, including the operating system type, address, Ethernet mode, running server and port number, etc

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 Draw a network structure diagram :

> The CaseFile tool is used to draw a network structure diagram. Use this tool to quickly add and connect, and to build a network structure diagram flexibly in the form of a graphical interface. This section will introduce the use of Maltego CaseFile.

1) Before using the CaseFile tool, you need to modify the Java and Javac versions used by the system. Because the CaseFile tool is developed in Java, and the tool must run on Java

2) However, in Kali Linux, JDK6 and JDK7 are installed, and CaseFile uses JDK6 by default. After running the CaseFile tool, the menu bar cannot be displayed in the graphical interface. Therefore, you need to change the JDK version

3) Use the update-alternatives command to modify the java command version. The execution command is as follows:

> update-alternatives -- - config java

4) From the output information, you can see that it has been modified to the JDK7 version, and it is in manual mode. Or use the java command to view the current version information. The execution command is as follows:

> root@kali:~# java -version
java version "xy..

5) OpenJDK Runtime Environment (IcedTea 2.3.10) (7u25-2.3.10-1~deb7u1)
OpenJDK Server VM (build 23.7-b01, mixed mode)

6) From the above results, it can be determined that the java command version of the current system

7) Use the update-alternatives command to modify the javac command version. The execution command is as follows:

update-alternatives -- - config javac

8) Use CaseFile to draw a network structure diagram. The specific operation steps are shown below.

> Start CaseFile. Select "Applications" | Kali Linux | "Information Collection" | "Intelligence Analysis" | casefile command in sequence

>them maltego appear on your screan

9) Select Open a blank graph and let me play around, then click Finish button

> this will appear >

🦑 You can see that there is no information from this interface, because no device is selected by default.
T.me/UnderCodeTesting

1) This tool is the same as the Maltego tool, you need to drag each entity from the component Palette into the chart. In this example, select the domain entity and change the domain attributes

2) A comment can be added to the domain in this interface. Point the mouse to the domain entity, and then double-click the comment icon to display

3) ou can see the added comment information on this interface, and this information can be modified. Mouse over the position of the annotation information to modify it. You can also drag other entities on this interface. Here, drag the domain name of another entity to record DNS information from the target host

4) The two entities can be connected on this interface. Just drag a line from one entity to another

5) After connecting two entities You can modify the thickness, format, and color of the line.

🦑Organization Network

1) From this interface, you can see an organization network structure diagram. At this point, the user can save the diagram, and if needed, can open and edit the diagram later.

> Clicking the New button on this interface will create a new Graph, which will be named New Graph (2)

WRITTEN BY UNDERCODE

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Check Your Website security from xss attack- 2020 updated
>XSStrike is a Cross Site Scripting detection suite equipped with four hand written parsers, an intelligent payload generator, a powerful fuzzing engine and an incredibly fast crawler.
twitter.com/UnderCodeTC >check news
> Instead of injecting payloads and checking it works like all the other tools do, XSStrike analyses the response with multiple parsers and then crafts payloads that are guaranteed to work by context analysis integrated with a fuzzing engine. Here are some examples of the payloads generated by XSStrike:

🦑FEATURES :

Reflected and DOM XSS scanning
Multi-threaded crawling
Context analysis
Configurable core
WAF detection & evasion
Outdated JS lib scanning
Intelligent payload generator
Handmade HTML & JavaScript parser
Powerful fuzzing engine
Blind XSS support
Highly researched work-flow
Complete HTTP support
Bruteforce payloads from a file

🦑 𝕀ℕ𝕊𝕋𝔸𝕃𝕃𝕀𝕊𝔸𝕋𝕀𝕆ℕ & ℝ𝕌ℕ :

1) git clone https://github.com/s0md3v/XSStrike

2) cd XSStrike

3) : xsstrike.py [-h] [-u TARGET] [--data DATA] [-t THREADS] [--seeds SEEDS] [--json] [--path]
[--fuzzer] [--update] [--timeout] [--params] [--crawl] [--blind]
[--skip-dom] [--headers] [--proxy] [-d DELAY] [-e ENCODING]

optional arguments:
-h, --help show this help message and exit
-u, --url target url
--data post data
-f, --file load payloads from a file
-t, --threads number of threads
-l, --level level of crawling
-t, --encode payload encoding
--json treat post data as json
--path inject payloads in the path
--seeds load urls from a file as seeds
--fuzzer fuzzer
--update update
--timeout timeout
--params find params
--crawl crawl
--proxy use prox(y|ies)
--blind inject blind xss payloads while crawling
--skip skip confirmation dialogue and poc
--skip-dom skip dom checking
--headers add headers
-d, --delay delay between requests

🦑Tested by UnderCode on

> fedora

> debian

Written by Under Code
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑MALWARES-RISKS from third-party frameworks
> Why don't big companies like using third-party frameworks?
twitter.com/UndercodeTC

🦑 𝕃𝔼𝕋𝕊 𝕊𝕋𝔸ℝ𝕋 :

> Even if some companies are maliciously breaching the server, they are unwilling to make it public or discovered. Because for enterprises, the credit value is minimized. If the information is disclosed, it is not equivalent to telling others that their own security protection is not reliable, so if After some companies have been GP, they will not make any public payment or report the case, giving some criminals an opportunity.

> For individual entrepreneurs, this is a bit miserable. In addition to the trouble of time and energy, there is also a headache of money. After all, you need to add defense against cloud servers and high defense strategies. The cost of consumption every month is It is not low. For entrepreneurs, money is the lifeblood, which is a bit bitter. Next time we talk about how to trace the source of the attacker. This will be a learning article with a little technical content.

It's a bit far away. Back to today's theme- library explosion , it is actually called "drag library" in the hacker's circle, which means that the database of the website is downloaded to the local by the hacker. The explosion of the library has actually existed for a long time, but this time the explosion of many large websites has caused a lot of sensation on the Internet. A certain back garden has already exploded.


Written by Under Code
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Security Tips by UnderCode :
It is necessary to understand how hackers usually do this? :
This is why the platforms of large companies do not like to use third-party frameworks
twitter.com/UnderCodeTC

🦑 𝕃𝔼𝕋𝕊 𝕊𝕋𝔸ℝ𝕋 :

1) Download database files remotely: The use of this method of dragging the library is mainly due to the lack of security awareness of the administrator. When doing database backups or to facilitate data transfer, the database files are directly placed in the Web directory. The Web directory does not have permission control., Anyone can access; there is some open source programs on the website, without modifying the default database; in fact, hackers scan the major websites crazy every day using scanning tools, when your backup file name falls in Hackers' dictionaries can be easily scanned and downloaded by the hacker.

2) Using web application vulnerabilities to drag libraries: With the mature development of open source projects, the emergence of various web open source applications, and open source development frameworks, many start-up companies will directly introduce those open source applications in order to reduce development costs, but they will not Concerned about its subsequent security, hackers will conduct in-depth analysis and research on the target code after they know it. When high-risk zero-day vulnerabilities are discovered, these websites will be in danger of dragging the library.

3) Utilizing web server (Apache, IIS, Tomcat, etc.) vulnerabilities to drag libraries: Web security is actually a combination of web application and web server security; while web server security is composed of two parts: web container and system security. System security is usually It will be processed through an external firewall and shielded external service ports, but the web container must be developed externally. Therefore, if the web container exposes a vulnerability, the website will also be in danger of dragging the library.

4) Use the website to hang a horse and drag the library: A hacker will use software or system vulnerabilities to hang a horse on a specific website. If the website administrator accidentally visits these websites while maintaining the system, without a patch, they will Being implanted in a Trojan can also lead to the risk of subsequent dragging.

5) Spreading malicious files and dragging libraries: hackers will use some anti-killing Trojans, bind them with some software commonly used by administrators, and then spread them on the Internet. When the webmaster downloads and runs, it will also cause the server to implant the Trojan. , Triggering the risk of subsequent dragging.

6) Insiders leak database: Of course, some webmasters will not be able to withstand the temptation of money and sell their maintained database
Social worker website administrator: Perform engineering measures to the administrator of the target website, and obtain some sensitive background user names and passwords, which will cause subsequent drags.

7) Using website phishing: Sometimes hackers will also use website phishing to deceive users to enter the account information in order to obtain some account information. However, this method can only obtain the real information of some accounts and does not invade the server.
Usually, if you explode, you first scan the server several times with a tool.

8) If the blasting is successful, multiple remote control Trojans will be implanted in the server according to the environment and then become their springboard. Usually, multiple administrators are secretly created , which is equivalent to being equipped with a gate. The key is in and out at any time, but at that time, it will not be operated, so it is usually difficult to monitor. Many companies that store user data and information are attacked by various attacks every day. If it is leaked, in addition to the crisis of dishonesty, the company also There may be legal risks.

Written by Under Code
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑How to explode the library ?
T.me/UnderCodeTesting

1) Common BK methods are: 3CKU, \, conn.asp, ddos, DNS string explosion, etc., and more advanced ones include DouX, Ket2, LX2, etc ...

2) Let's take a few websites to test and understand how their security protection is. Many websites do not modify the default database and port, so using mining chicken can almost find the vulnerabilities that the website should have. The results are as follows:

🦑 A forum website as example :

> Results: bbs1.mbd, bbs2.mbd

> Directory group: / temp, / data, / databackup,

> A voting website vulnerability:

> File names: toupiao.asp, about.asp

> Directory group: / wishdb, / toupiao, / backup

> As expected, we got the results we wanted.

3) The principle of the above database explosion vulnerability: This type of website is relatively simple. The database explosion usually adds \ or inc to make the system call data error, and then return to the database to prompt the call data error.

4) The error data generally contains the absolute path of the database. Change the last slash (/) of the URL to \, and finally there will be a correct path in the error.

5) Remember to apply patches in time to fix high-risk vulnerabilities, and use strong passwords and passwords to stop unused ports.

Written by Under Code
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Agency Tip - Proxy service-squid user authentication settings
twitter.com/UnderCodeTC

🦑 𝕃𝔼𝕋𝕊 𝕊𝕋𝔸ℝ𝕋 :

> By default, Squid does not have any authentication procedures, but user authentication can be achieved through external authentication procedures .
Generally there are the following authentication procedures: LDAP authentication, SMB authentication, mysql-based authentication, sock5-based password authentication,
and Radius-based authentication. The following describes the commonly used ncsa authentication. Ncsa is
one of the authentication programs that comes with the Squid source code package . The implementation steps are as follows:

1) Enter the / usr / local / squid / auth_modules / NCSA directory and execute:
make
make install

2) After the compilation is successful, the ncsa_auth executable file is generated, and the generated executable file is copied to the / usr / bin directory.

3) Modify the options in the squid.conf file.
acl auth_user proxy_auth REQUIRED
http_access allow auth_user
authenticate_program / usr / local / squid / bin / ncsa_auth
/ usr / local / squid / etc / passwd

4) Use the tool htpasswd carried by Apache to generate a password file under / usr / locad / squid / etc. And add phase
Corresponding user information. Each line of the password file contains information about one user, namely the username and password. For example, use
htpasswd to generate a password file passwd and add the user me:
htpasswd -c / usr / local / squid / etc / passwd me

5) Restart Squid and the password authentication will take effect.

Written by Under Code
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 Proxy Service-Access Control by URL in Squid :
pinterest.com/UnderCOdeOfficial

🦑 𝕃𝔼𝕋𝕊 𝕊𝕋𝔸ℝ𝕋 :

> The method of access control in Squid through the URL of the visited site:

> In Squid, you can It is convenient to perform access control through the URL of the visited site. An example is as follows:

> Suppose you want to prevent users from accessing all sites with sex in the URL. You can do this:

1) Define a new acl via dstdom_regex. In this example we assume that this new acl is called badrul:
acl badurl dstdom_regex sex

2) Add the corresponding access control items. It should be noted that because Squid checks the legality of access one by one, you must add
http_access deny items (that is, prohibited items) before http_acces allow
to ensure that Squid can Check the project. For example:
http_access deny badurl
http_access allow all
http_access deny ...
and so on.

3) 　In this way, when the URL of the user accessing the site contains the word xxx, Squid will prohibit their access and give an error message of forbidden access.


Written by Under Code
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁