▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑What is Protocol layer security ?
fb.com/undercodeTesting

🦑 𝕃𝔼𝕋𝕊 𝕊𝕋𝔸ℝ𝕋 :

1) Protocol layer securityProtocol layer security mainly involves content related to the TCP / IP layered model, including the working principles and characteristics of common protocols, defects, protection or alternative measures, and so on. There are many reasons why a system learns TCP / IP.

2) To properly implement firewall filtering, security administrators must have a deep understanding of the IP and TCP / UDP layers of TCP / IP, and hackers often use parts of the TCP / IP stack or to breach network security. So you must also understand these things clearly

WRITTEN BY UNDERCODE
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑2020 updated topic > Create native Mac applications from command line scripts
t.me/undercodeTesting

🦑 𝕃𝔼𝕋𝕊 𝕊𝕋𝔸ℝ𝕋 :

>https://github.com/sveinbjornt/Platypus (official git)


>open term and type brew cask install platypus

🦑Features

1) Supports shell scripts, Python, Perl, Ruby, PHP, Swift, Expect, Tcl, AWK, JavaScript, AppleScript or any other user-specified interpreter

2) Apps can display graphical feedback of script execution as a progress bar, text window with script output, droplet, WebKit HTML rendering or status item menu

3) Apps support receiving dragged and dropped files or text snippets, which are then passed to the script as arguments

4) Apps can execute scripts with root privileges via the macOS Security Framework

5) Apps can register as handlers for URI schemes

6) Apps can be configured to run in the background (LSUIElement)

7)Set own application icon or select from presets

8) Set app's associated file types, identifier, version, author, etc.

9)Graphical interface for bundling support files with the script

10) Command line tool for automation and build process integration
"Profiles" can be used to save app configurations

11) Built-in script editor, or linking with external editor of choice
Extensive documentation and many built-in examples to help you get started

12) Fast, responsive native app written in Objective-C/Cocoa

🦑Tested by UnderCode
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 xss vulnerabilities everyone should know by undercode :
> When reading materials about XSS, we usually see the classic <script> alert (1) </ script> as proof of this vulnerability (PoC-Proof of Concept). Although it is correct, it does not go beyond this range, which allows novices in the field to find more solutions to deal with this situation. Therefore, this is something everyone should know and be able to exploit the 7 XSS vulnerabilitiesare :
fb.com/undercodeTesting

🦑 𝕃𝔼𝕋𝕊 𝕊𝕋𝔸ℝ𝕋 :

1) At the beginning of the source code, there is an HTML comment with all the parameters used to trigger each case, and they apply to both GET and POST requests.

2) We can see that all cases are source-based, which means that the injection always appears in the source code retrieved by the HTTP response body. Independent of the types being reflected or stored, what matters here is the context in which they appear when displayed, so we will always use the reflected type as the main example. Some XSS flaws do not appear in the source code, and DOM-based flaws are not covered here.

> Remember to try the following example only in browsers without local XSS filtering (such as Mozilla Firefox ).

3) URL reflection
When the URL is reflected somehow in the source code, we can add our own XSS vector / payload to it. For PHP pages, you can use a slash (/) to add anything in the URL after the page name (no changes needed).

> check out undercode picture sended here

The leading label dash (">") needs to be used to break through the current label so that we can insert a new label.

>Although there are multiple reasons for using different languages ​​(reflection may also appear in path or URL parameters), for PHP, the reason is usually the global variable $ _SERVER ["PHP_SELF"] in the action field of the submit form

🦑2) Simple HTMLi (HTML injection)
The simplest input is reflected directly in the code between or after existing tags. No need to escape or break anything, any simple XSS vector (such as <tag handler = jsCode>) will do the job.

3)Inline HTMLi
Almost as simple as the previous one, but preceded by a lowercase ">" to break the current label.

4) Inline HTMLi: no broken tags
When the input is placed in an HTML attribute and the filter condition is greater than the character (>), the current tag cannot be broken as in the previous case.

This will turn the value off and provide space for inserting the onmouseover event handler. Point to alert (1) followed by double slashes to comment out the hanging quotes. When the victim points the mouse to the affected input field, a js popup window will be triggered.

🦑 will posts some from our hacking video tutorial later on youtube (more detailed )

5) Js (JavaScript) block in HTMLi
The input sometimes falls into a javascript block, usually the value of some variable in the code. However, because HTML tags have priority in the browser's parsing, we can simply terminate the block and insert a new tag.

6) Simple Js injection
If script tags were filtered in some way, the previous method would fail.

7) Escaped Js Injection
In the former case, if you escape the quotes (responsible for the breakthrough of the variable value) with a backslash (\), the injection will not work (the syntax is invalid).

> That's it for today. Recently, two-way foil security launched a practical class for vulnerability mining

🦑those xss vulnerabilities everyone should know

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 Universal Radio Hacker: investigate wireless protocols 2020 from few hours updated :
fb.com/undercodeTesting

🦑 𝕃𝔼𝕋𝕊 𝕊𝕋𝔸ℝ𝕋 :

The Universal Radio Hacker (URH) is a software for investigating unknown wireless protocols. Features include

1) hardware interfaces for common Software Defined Radios
easy demodulation of signals

2) assigning participants to keep an overview of your data
customizable decodings to crack even sophisticated encodings like C1101 data whitening

3) assign labels to reveal the logic of the protocol

4) automatic reverse engineering of protocol fields

5) fuzzing component to find security leaks

6) modulation support to send the data back to the target

7)simulation environment to perform stateful attacks

🦑 Without installation
To execute the Universal Radio Hacker without installation, just run:

git clone https://github.com/jopohl/urh/
cd urh/src/urh
./main.py
Note, before first usage the C++ extensions will be built.

🦑 Installing from source
To install from source you need to have python-setuptools installed. You can get it e.g. with pip install setuptools. Once the setuptools are installed use:

git clone https://github.com/jopohl/urh/
cd urh
python setup.py install

🦑TESTED BY UNDERCODE
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 Analysis of DLink RCE Vulnerability CVE-2019-17621
fb.com/undercodeTesting

🦑 𝕃𝔼𝕋𝕊 𝕊𝕋𝔸ℝ𝕋 :

> Environment construction
Before installing and configuring the operating environment, you must know the version of the Linux system you are using and the version of Qemu, because this directly affects your subsequent choice of installing various dependent packages, mips qemu images, etc., all versions correspond to . The RUN the To correctly & Final System of The Basic Environment for the this IS The Vulnerability Analysis and Machine The Virtual Previous Ubuntu18.04 Qemu Compiled and Runtime Environment based Installed The ON-QEMU 4.0.0 Source code:

1) QEMU Image at The debianmips the Download from Site at The https://people.debian.org/~aurel32/qemu/mips/ . Since at The Virtual Machine IS Ubuntu Linux, download debian_squeeze_mips_standard.qcow2 and vmlinux-2.6.32-5-4kc-malta

🦑 MIPS system network configuration

1) To use QEMU to run a MIPS system, you need to set the ubuntu virtual machine as a bridge, so that the ubuntu system can communicate with the QEMU virtual machine and transmit data (this operation is similar to configuring the VMware Workstation bridge to communicate with the physical machine).

2) To get the installation dependencies, execute the following command:

> sudo apt-get install bridge-utils uml-utilities

> Ubuntu modified host network configuration, the network interface

> ubuntu configuration file / etc / network / interfaces modified as follows and save it, close:
sudo gedit /etc/network/interfaces

3) Modified QEMU network interface startup script, reboot the network configuration to take effect, execute the following command:

sudo gedit /etc/qemu-ifup

🦑Save the file / etc / qemu-ifup later, given executable permissions, and then restart all network configurations take effect:

> sudo chmod a + x / etc / qemu-ifup

> sudo /etc/init.d/networking restart