UNDERCODE COMMUNITY
2.68K subscribers
1.23K photos
31 videos
2.65K files
80.2K links
πŸ¦‘ Undercode Cyber World!
@UndercodeCommunity


1️⃣ World first platform which Collect & Analyzes every New hacking method.
+ AI Pratice
@Undercode_Testing

2️⃣ Cyber & Tech NEWS:
@Undercode_News

3️⃣ CVE @Daily_CVE

✨ Web & Services:
β†’ Undercode.help
Download Telegram
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘ PHP can also be used as Shell ScriptPHP :



1) popular. Recently, PHP (Personal Hypertext Preprocessor) seems to have become the most widely used web processing language on Linux / Unix in the past two years. Its convenience, powerful functions and OpenSource features make it gradually eroded to Traditional CGI and even the market of MicroSoft ASP (Active Server Page), almost all major websites recruit talents with PHP as a basic condition.

2) PHP does have this qualification and can be so
popular for the following reasons: PHP is OpenSource software, which is completely free and can be distributed freely, so it attracts a lot of people to use, and because of this, it attracts commercial companies to develop better. Engine and optimization software

3) PHP itself is very simple and easy to understand, simple command syntax, plus some basic object-oriented processing capabilities, so that novices are enough to learn in the shortest time.


4) PHP provides a lot of functions, including mathematical processing, string processing, network-related functions, various database support, image processing functions, and a large number of developers are developing various new functions for PHP. Sex is excellent.


5) PHP is very easy to combine with Apache. It is used as an Apache module. The installation is quite simple. Because Apache currently occupies 60% of the Web Server market worldwide, PHP naturally becomes the best match for Apache.


6) However, this time the topic to be addressed is not the application of PHP in web design, but the application of PHP in Shell Script. The commonly known Shell Script is about tcsh, bash, perl or python. I want Talking about using PHP as Shell Script.
πŸ¦‘ SO PHP CAN USED AS SHEL SCRIPTING LET S SEND AN EXAMPLE
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘ Installation of PHP executable files :



1) Generally, PHP as a webpage processing language is compiled into Apache modules. Of course, it is not done here, so it is very simple to compile. Just perform the following actions as root:

> unlock php-3.0.xx. After tar.gz

> cd php

> configure

> make is

2) compiled, there is an executable file in the php directory, the file name is php, copy it to / usr / local / bin. Note that if the file is too large, you can use the strip command to remove unnecessary information in php mode, so that the file will be much smaller.

πŸ¦‘ The first program
begins to write our first PHP Shell Script program. This example prints "Hello world!":
#! / Usr / local / bin / php -q
<?
Echo "Hello, world!";
?>

1) Note that PHP was originally used in web applications, so it will send HTML HEADER by default, but here we are going to use PHP as Shell Script, "-q"

2) In this example, / usr / local / bin / php means to execute PHP under / usr / local / bin / because we just installed it there. The echo command prints out "Hello, world!", where the "" character is a newline character.

3) Note that after saving this program as a file, chmod must be made executable (chmod + x file name) before it can be executed.
Advanced use of I

4) Sometimes we need to send some parameters when the program is executed, such as the ls command, which can be added with the -l parameter. PHP Shell Script also supports this usage, with two special variables: $ argc records the number of parameters sent later, and the parameters stored in the $ argv [] array parameters are the contents of the parameters. For example, I now want to design a program that calculates the sum of two numbers:
#! / Usr / local / bin / php -q
<?
$ Sum = 0;
$ sum = $ sum + $ argv [1] + $ argv [2] ;
echo $ sum;
?>
Assuming this program is named sum.php3, execute sum.php3 1 2 Press enter and 3 will be printed.
If you want to calculate the sum of an unspecified number of parameters, then you have to use the special variable $ argc:
#! / Usr / local / bin / php -q
<?
$ Sum = 0;
for ($ t = 1; $ t <= $ argc; $ t ++)
$ sum = $ sum + $ argv [$ t];
echo $ sum;
?>
πŸ¦‘ Assuming this program is named bigsum.php3, execute bigsum.php3 1 2 3 4 5 Press enter to print out 15, execute bigsum.php3 1 2 3 4 5 6 Press enter Print out 21.

> Sometimes we need to input data during program execution, but PHP is originally used for web design, and the data input on the web page is naturally input by FORM, so this problem comes when PHP is used as Shell Script. In PHP, there is a function to open files, and under Linux / Uinx, input (input) can be done by opening a file. We want to open the device file / dev / stdin (stdin is Means standard input), the procedure is as follows:
#! / Usr / local / bin / php -q
<?
$ Fp = fopen ("/ dev / stdin", "r");
$ inputstr = fgets ($ fp, 100 );
fclose ($ fp);

echo "\ n ---------------------- \ n";
echo $ inputstr;
?>
where fgets ($ fp , 100) refers to the file from $ fp (that is, "/ dev / stdin" ) To read 100 bytes of data, the program will stop at this line and wait for our input. After we press enter, the program will print out the data we just entered.
Advanced Use II
Although it can already handle input, such a function is obviously too simple to cope with larger applications. For example, I need a function to remove HTML from a stream of data (data stream). To deal with the ability of input and output steering, we can first design the program as follows:
#! / Usr / local / bin / php -q
<?
$ Fp = fopen ("/ dev / stdin", "r");

while (! Feof ( $ fp)) {
$ c = fgetc ($ fp);
$ inputstr = $ inputstr. $ c;
};

fclose ($ fp);

echo $ inputstr;
?>
Assuming this program is named filt.php3, if you directly When this program is executed, it will wait for you to enter it until you press Ctrl + D to print your input data. We can execute it like this :
more filt.php3 | filt.php3
This method is to filt The .php3 program is shown with more and turned to the filt.php3 program. The filt.php3 will continue to receive data (in fact, the filt.php3 program code itself), and finally print it out.
We can add HTML filtering to it:
#! / Usr / local / bin / php -q
<?
$ Fp = fopen ("/ dev / stdin", "

while (! feof ($ fp)) {
$ c = fgetc ($ fp);
$ inputstr = $ inputstr. $ c;
};

fclose ($ fp);

$ inputstr = ereg_replace ("<([^ <>] * )> "," ", $ inputstr);

echo $ inputstr;
?>
πŸ¦‘ Assuming that this program is named filt2.php3, so that the filtering function is completed, do n’t believe it, please take an HTML file to try:
more xxx.html | filt2.php3
You will see the deleted HTML TAG file.

πŸ¦‘ SO PHP CAN USED AS SHELL HACKING SCRIPTING ?


> PHP used as Shell Script is actually quite easy to use, because PHP itself is very easy to learn, and it supports a variety of databases, after you have often used PHP to design your website, absolutely do not like to use other Shell Script language to deal with other parts that must be non-web pages. At this time, the benefits of using PHP as Shell Script will be revealed. You can develop the entire system in a consistent manner without having to use PHP and then use it. Perl / Python or C.

> The domestic PHP atmosphere is already very prosperous. LinuxFab on this site has been developed entirely with PHP and MySQL. In fact, there are many magical uses of PHP. There are opportunities to introduce it in the future. If readers need information about PHP, welcome to this site Participate in more discussions on the PHP forum.
& nbs

written by undercode
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
πŸ¦‘ ANY DOUBT FEEL FREE TO ASK @UNDERCODE_Testing
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘FOR BEGINERS Instructions for using the ORACLE function in PHP3 full by Undercode :


1) let SELECT command can use PHP variables.

Syntax: boolean OCIDefineByName (int stmt, string ColumnName, mixed & variable, int [type]);

Return value: boolean

function Category: database features


πŸ¦‘ Description

> This function is used to define the designated PHP variables, so that it can Used by the SELECT instruction in the SQL instruction.

> Pay attention to the case, because the field names in the Oracle database are actually capitalized names. The parameter stmt is the string index after Oracle parsing (OCIParse). The parameter ColumnName is the column name on the Oracle data table.

> The variable must be preceded by an ampersand, which indicates the address of the PHP variable. The parameter type is usually omitted. It is worth noting that when you want to use the new data types LOB / ROWID / BFILE unique to Oracle 8, you need to execute the OCINewDescriptor () function first. The successful execution of this function returns a true value.

πŸ¦‘ OCIBindByName
makes PHP variables available for dynamic SQL.

Syntax: boolean OCIBindByName (int stmt, string ph_name, mixed & variable, int length, int [type]);

return value: Boolean value

πŸ¦‘ Function type: database function
Description


> This function is used to define the specified PHP variable so that it can be used by dynamic SQL commands (Oracle Placeholder). Pay attention to the case, because the field names in the Oracle database are actually capitalized names. The parameter stmt is the string index after Oracle parsing (OCIParse). The parameter ph_name is the variable to be used by the dynamic SQL instruction. The variable must be preceded by an ampersand, which indicates the address of the PHP variable. The parameter length is the length of the data. If it is set to -1, the maximum value of the specified variable data is used. The parameter type can be omitted. The values are OCI_B_FILE (binary file), OCI_B_CFILE (text file), OCI_B_CLOB (text LOB), OCI_B_BLOB (bit LOB), and OCI_B_ROWID (ROWID). It is worth noting that when you want to use the new data type LOB / ROWID / BFILE unique to Oracle 8, you need to first execute the OCINewDescriptor () function, and you must set the length parameter to -1. The successful execution of this function returns a true value.

πŸ¦‘ OCILogon
opens the link with Oracle.

Syntax: int OCILogon (string username, string password, string [OCACLE_SID]);

Return value: integer

πŸ¦‘ function Category: Database function

Description


This function makes PHP with Oracle to link. The parameters username and password are the connected account and password respectively. The parameter OCACLE_SID is the database name and can be omitted. The return value is the code of the connection.
OCILogOff
Close the link with Oracle.

Syntax: boolean OCILogOff (int connection);

Return value: boolean

πŸ¦‘ function Category: Database function


Description


This function makes PHP with Oracle link end. The parameter connection is the connection code to connect to Oracle. The return value true means success, false means an error occurred.
OCIExecute
executes Oracle's instruction section.

Syntax: boolean OCIExecute (int statement, int [mode]);

Return value: boolean

πŸ¦‘ function Category: database feature

Description


This function is used to execute the specified command Oracle section, before executing must first be OCIParse ( ) Analyzed the SQL syntax of this section. The parameter statement is the analyzed code. The parameter mode can be omitted and its default value is OCI_COMMIT_ON_SUCCESS. The return value true means success, false means an error occurred.
OCICommit
puts Oracle transaction processing into practice

Syntax: boolean OCICommit (int connection);

Return value: Boolean value

πŸ¦‘ Function type: Database function
This function will permanently modify the transaction after the last commit / rollback. The parameter connection is the connection code to connect to Oracle. The return value true means success, false means an error occurred.
OCIRollback
cancels the current transaction.

Syntax: boolean OCIRollback (int connection);

Return value: boolean

πŸ¦‘ function Category: database features




Description


This function canceled Oracle transaction processing (transaction) made changes to the database. The parameter connection is the connection code to connect to Oracle. If successful, it returns true, otherwise it returns false.
OCINumRows gets
the number of affected fields.

Syntax: int OCINumRows (int statement);

Return value: integer

πŸ¦‘ function Category: database features




Description


This function returns the field (column) number of affected by the UPDATE command, etc., etc. If you use SQL SELECT command will not influential. The parameter statement is the analyzed code.
OCIResult gets a
column from the data in the current row.

Syntax: string OCIResult (int statement, mixed column);

Return value: string

πŸ¦‘ Function type: database function


Description


This function returns a column of data. The parameter statement is the analyzed code. The parameter column is the field name. If new data forms (ROWIDs, LOBs, and FILEs) are used, the returned data are all strings.
OCIFetch gets
a row of the returned data.

Syntax: int OCIFetch (int statement);

Return value: integer

πŸ¦‘ function Category: database features


Description


This function is used to obtain a non-null data. The parameter statement is the analyzed code. The return value true means successfully retrieved a column, false means that the column is empty or other errors occur.
OCIFetchInto
retrieves Oracle data and puts it into the array.

Syntax: int OCIFetchInto (array & result, int [mode]);

Return value: integer

πŸ¦‘ function types: Database Function




Description


This function will retrieve the data into Oracle result in an array. Returns the number of fields in each row, or false if it fails. The parameter mode can be omitted, the default value is OCI_NUM, and others include OCI_ASSOC, OCI_RETURN_NULLS, and OCI_RETURN_LOBS.
OCIColumnIsNULL
tests whether the returned line is empty.

Syntax: boolean OCIColumnIsNULL (int stmt, mixed column);

return value: Boolean value

πŸ¦‘ Function type: database function




Description


This function is used to test the returned row (column) is null value (NULL). Return true to indicate a null value.
OCIColumnSize gets
the size of the column type.

Syntax: int OCIColumnSize (int stmt, mixed column);

Return value: integer

database features: the type of function




Description


Size of this function can get the field (column) type (type) of.
OCINewDescriptor
initial new LOB / FILE description.

Syntax: string OCINewDescriptor (int connection, int [type]);

Return value: String

πŸ¦‘function Category: database features


Description


This function is used to initialize new LOB / FILE value description.
OCIParse
analyzes SQL syntax.

Syntax: int OCIParse (int connection, string query);

Return value: integer

πŸ¦‘ function Category: database features




Description


This function can be used to analyze SQL syntax or the PL / SQL section for errors. Parameter connect


▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘2020 Do quick, hassle-free email marketing with this small but very powerful tool
t.me/undercodeTesting

πŸ¦‘ π•ƒπ”Όπ•‹π•Š π•Šπ•‹π”Έβ„π•‹ :

1) Install bulk-mail-cli

> Assuming that you have node and npm installed... Run the following in your terminal.

npm i -g bulk-mail-cli

2) Just run bulkmail support in your terminal to see what commands and flags you can use to do awesome things.

3) for cloning https://github.com/adventmail/bulk-mail-cli

πŸ¦‘Configuration file
{
"credentials": {
"email": "{{EMAIL}}",
"password": "{{PASSWORD}}", // turn on less-secure-apps to send emails: https://myaccount.google.com/lesssecureapps?pli=1
"host": "smtp.gmail.com", // depends on what service you are using
"port": 465, // 465 / 587
"secureConnection": true // boolean: true | false
},
"mail": {
"subject": "Heya {{fname}} {{lname}}! Just wanted to say hi!",
"from": "Chandler Bing <chandlerbing@friends.com>", // keep the format
"to": "leads.csv", // path to csv (relative to where this file is)
"theme": "themes/Newsletter/theme.html", // path to csv (relative to where this file is)
"attachments": [
// relative path to the attachment files. Keep this array empty if no attachments.
// SEE THE EXAMPLES BELOW.
{
"filename": "{{fname}}'s Demo CSV.csv", // You may use string patterns in fileName
"path": "leads.csv" // You may use string patterns in path too!
},
{
"filename": "{{fname}} {{lname}}'s Resume.pdf",
"path": "https://raw.githubusercontent.com/KumarAbhirup/resume/master/Kumar%20Abhirup%20CV.pdf"
}
]
},
"configuration": {
"mailInterval": "*/10 * * * * *", // Cron Expression: To mail every 10 seconds [ >= 10 seconds recommended ]
"verbose": true // boolean: True if you want a log of the live process in the terminal.
}
}


πŸ¦‘ e n j o y best bulk mail sender
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘ Hacker attack and defense to crack account and password by undercode :

πŸ¦‘ π•ƒπ”Όπ•‹π•Š π•Šπ•‹π”Έβ„π•‹ :

1) Someone once got a password file from a larger ISP's server host for email. Through the analysis of certain tools and dictionaries, the analysis results show that as long as the hackers use dim sum a little, they can get a large number of accounts and passwords.

2) According to a standard introduced by the Internet Security Committee, it is divided into 5 levels, of which the advanced level includes the following levels, and the cracking level of each level is roughly as follows:

CR-1: No tools are used, just a simple guess.

CR-2 level: Use its account or account-related information as a password dictionary tool to crack.

CR-3 level: Use tools within 6 digits and a simple password dictionary not exceeding 10M to crack.

CR-4 level: Use auxiliary tools to expand the password dictionary and crack it.

CR-5 level: Brute force cracking, use dictionary generator to generate super dictionary or directly use brute force tool to crack.

πŸ¦‘However, due to the weak security awareness of many Internet users, most users use passwords that are the same as their own names or abbreviated with their own names in pinyin, so that when he tells others their email addresses, it is equivalent to telling others their own passwords

writen by undercode
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘fast cracking guide :

A) Network Assassin II (English name: NetHacker II)

> Cyber ​​Assassin is a Chinese network security detection software designed by Tianxing for security professionals. It can easily search out the shared hosts in the local area network, and then scan the shared resources of the shared server.

> Its sniffer function can also intercept the passwords of POP3, FTP, Telnet services used in the local area network.

> Now the broadband of the community is also a type of local area network, and the network assassin can do a good job.

> After the software is downloaded and decompressed, double-click the main program nethacker.exe to open the network assassin. Select the "Search Shared Host" command under "Host Resources", then enter the IP address range you want to scan, and then click the "Start Search" button to search for the host with the share.

> After the search is completed, it will be in the lower left of the main interface The search results are displayed on the side. (If there are no search results, you can try to turn off your personal firewall). Select the corresponding host in the lower left corner and expand it, right-click the mouse button in the corresponding shared resource, "map the network hard disk" of the directory to be accessed, so that the corresponding directory of the remote computer can be opened in "My Computer" .


> If the local computer has a shared password set, you can use the password guessing solution built into the network assassin to crack. Right-click the mouse in the specified shared resource and select "Share Guessing Machine" in the pop-up menu. Before you click "Start Guessing", you must set the correct dictionary. This is the key to success or failure.

> Now you can choose Define the appropriate password character set and combination method and password length.

> In addition, the network assassin also integrates some related network tools, including IP and host name converters, Finger client query tools, host port scanning tools, host finder, domain name finder, Telnet client program, etc. You can view the network status and your own IP.
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘ Cracking tip 2 :
> Snadboy's Revelation
t.me/undercodeTesting

πŸ¦‘ π•ƒπ”Όπ•‹π•Š π•Šπ•‹π”Έβ„π•‹ :

1) SnadBoy's Revelation This is a small and powerful password revealing tool that can view "*********" passwords in Windows, including those saved by some applications (such as mail client programs, FTP programs, etc.) "********" password, after downloading and installing the software, just drag the left button of the mouse to the cross box, and then the password will be displayed.

2) It is much faster than powerful cracking software. (Xiaorong's "Streamer" is also a cracking tool that hackers like to use. It is both a scanning software with powerful functions and powerful cracking and attacking functions.)

3) L0phtCrack4.0 (referred to as LC4)

> LC4 is currently the most popular Windows cracking tool. This tool can be used to crack passwords from Sam files where passwords are saved. For the case where Sam files can be obtained, choosing it is the best way to obtain the login password of the other party.

> It also has the function of importing passwords locally and remotely.

> Open LC4, and create a new task, and then click "Import (IMPORT)" | "Import from SAM file" to open the SAM file waiting to be cracked. At this time LC4 will automatically analyze this file and display the user name in the file. Then click "Begin Audit" in "Session" to start cracking the password. If the password is not very complicated, the result will be available in a short time.

> If the cracking fails to produce results, you can select "Cracking Options" under "Tasks", select a more comprehensive password list, and activate functional mode and brute force mode cracking, then select "Restart Cracking Command" under the "Task" column, if It is a 6-digit password, and the results will be available soon.

> https://sectools.org/tool/l0phtcrack/

writen by undercode
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘Use adb shell and pm to install the apk package to the Android phone :
t.me/UndercodeTesting



1) After installing Android Studio, adb is usually in / Users / exchen / Library / Android / sdk / platform-tools directory

2) Set the environment variables or switch to the directory where adb is located, execute adb devices to view the devices connected to the machine, the command is as follows:

./adb devices

3) List of devices attached
0123456789ABCDEF device
emulator-5554 device

1
2
3
.....

4) ./adb devices
List of devices attached
0123456789ABCDEF device
emulator-5554 device

5) You can see that the above information shows that two devices are connected, one is a real machine and the other is an emulator. Since two devices need to specify the target device when performing operations, such as installing apk, the command is as follows:

> ./adb -s 0123456789ABCDEF install ~/Downloads/test.apk

Performing Push Install
adb: error: failed to copy '/Users/exchen/Downloads/test.apk' to '/data/local/tmp/test.apk': couldn't read from device
/Users/momo/Downloads/test.apk: 0 files pushed. 92.5 MB/s (131056 bytes in 0.001s)

Β» so continue with

> ./adb -s 0123456789ABCDEF install ~/Downloads/test.apk
Performing Push Install
adb: error: failed to copy '/Users/exchen/Downloads/test.apk' to '/data/local/tmp/test.apk': couldn't read from device
/Users/momo/Downloads/test.apk: 0 files pushed. 92.5 MB/s (131056 bytes in 0.001s)

πŸ¦‘At this point, we see that the installation failed because the upload of the apk package to the / data / local / tmp / directory failed. Execute the adb shell and try to execute chmod to grant permissions, but the prompt denies access. The information is as follows:

> ./adb -s 0123456789ABCDEF shell
shell@Coolpad5367:/ $ chmod -R 755 data
Unable to chmod data: Permission denied

πŸ¦‘THE FIX :

> No way, it seems that this directory has no permission to read and write, try to push test.apk to the SD card, the command is as follows:

1) ./adb -s 0123456789ABCDEF push ~/Downloads/test.apk /sdcard


2) If the push is successful, the SD card has read and write permissions. On the phone, try to click on the file management to install, but the installation button is gray and cannot be clicked. Finally, try to install using the pm command, the command is as follows:

> ./adb shell
shell@Coolpad5367:/ chmod 755 /sdcard/test.apk
shell@Coolpad5367:/ $ pm install -f /sdcard/test.apk
pkg: /sdcard/test.apk
Success

writen by undercode
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘ before crack an app :About Android Apk decompilation and then compile back can not install normally

1) After using apktool to decompile the apk, compile it back, and find that it cannot be installed normally, but use ApkToolKitV3.0 to decompile, and then compile it back to install normally.

2) The main reason is that using apktool to compile back without a signature. So it cannot be installed, and ApkToolKitV3. 0 Compile back and sign it.

3)_After compiling with apktool, then sign with signapk.jar.
Java -jar signapk.jar testkey.x509.pem testkey.pk8 test.apk test-signed.apk The

>following is packaged The apktool, which contains signapk.jar, can be used directly

▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁