▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 Crack hashes in seconds: Md5 Cracker 2019 :
t.me/UnderCodeTesting

🦑𝕀ℕ𝕊𝕋𝔸𝕃𝕃𝕀𝕊𝔸𝕋𝕀𝕆ℕ & ℝ𝕌ℕ:

1) git clone https://github.com/s0md3v/Hash-Buster

2) cd Hash-Buster

3) Hash-Buster can be run directly from the python script but I highly suggest you to install it with

> make install

4) python hash.py/

5) buster -s <hash>

6) Finding hashes from a directory
just specify a directory and Hash Buster will go through all the files and directories present in it, looking for hashes.

> buster -d /root/Documents

7) Hash Buster can find your hashes even if they are stored in a file like this

🦑Tested On:

> Kali

> Debian


▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Most advanced XSS scanner
> XSStrike is a Cross Site Scripting detection suite equipped with four hand written parsers, an intelligent payload generator, a powerful fuzzing engine and an incredibly fast crawler.

> Instead of injecting payloads and checking it works like all the other tools do, XSStrike analyses the response with multiple parsers and then crafts payloads that are guaranteed to work by context analysis integrated with a fuzzing engine. Here are some examples of the payloads generated by XSStrike:

}]};(confirm)()//\
<A%0aONMouseOvER%0d=%0d[8].find(confirm)>z
</tiTlE/><a%0donpOintErentER%0d=%0d(prompt)``>z
</SCRiPT/><DETAILs/+/onpoINTERenTEr%0a=%0aa=prompt,a()//
t.me/UndercOdeTestingOfficial

🦑𝕀ℕ𝕊𝕋𝔸𝕃𝕃𝕀𝕊𝔸𝕋𝕀𝕆ℕ & ℝ𝕌ℕ:

1) git clone https://github.com/s0md3v/XSStrike

2) cd XSSrtike

3) pip install -m requirements.txt

4) python xsstrike.py

🦑Features:

> Reflected and DOM XSS scanning

> Multi-threaded crawling

> Context analysis

> Configurable core

> WAF detection & evasion

> Outdated JS lib scanning

> Intelligent payload generator

> Handmade HTML & JavaScript parser

> Powerful fuzzing engine

> Blind XSS support


> Highly researched work-flow

> Complete HTTP support

> Bruteforce payloads from a file

> Powered by Photon, Zetanize and Arjun

> Payload Encoding

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Network Trick
Tensorflow implementation of Deep Convolutional Generative Adversarial Networks which is a stabilize Generative Adversarial Networks


🦑𝕀ℕ𝕊𝕋𝔸𝕃𝕃𝕀𝕊𝔸𝕋𝕀𝕆ℕ & ℝ𝕌ℕ:

1) git clone https://github.com/carpedm20/DCGAN-tensorflow

2) cd DCGAN-tensorflow

3) python download.py mnist celebA

4) To train a model with downloaded dataset:

> python main.py --dataset mnist --input_height=28 --output_height=28 --train

> python main.py --dataset celebA --input_height=108 --train --crop

🦑 To test with an existing model:

1) python main.py --dataset mnist --input_height=28 --output_height=28

2) python main.py --dataset celebA --input_height=108 --crop

> Or, you can use your own dataset (without central crop) by:

3) mkdir data/DATASET_NAME
... add images to data/DATASET_NAME ...

4) python main.py --dataset DATASET_NAME --train

5) python main.py --dataset DATASET_NAME

6) # example

7) python main.py --dataset=eyes --input_fname_pattern="*_cropped.png" --train

8) If your dataset is located in a different root directory:

> python main.py --dataset DATASET_NAME --data_dir DATASET_ROOT_DIR --train

9) python main.py --dataset DATASET_NAME --data_dir DATASET_ROOT_DIR
> # example

10) python main.py --dataset=eyes --data_dir ../datasets/ --input_fname_pattern="*_cropped.png" --train



▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑How to Discover Cross-Domain Relations with Generative Adversarial Networks


🦑𝕀ℕ𝕊𝕋𝔸𝕃𝕃𝕀𝕊𝔸𝕋𝕀𝕆ℕ & ℝ𝕌ℕ:

1) git clone https://github.com/carpedm20/DiscoGAN-pytorch

2) cd DiscoGAN-pytorch

3) Or > sudo apt-get install imagemagick (avaible ata ubanto Repo)

> mogrify -resize 256x256! -quality 100 -path YOUR_DATASET_NAME/A/*.jpg

> mogrify -resize 256x256! -quality 100 -path YOUR_DATASET_NAME/B/*.jpg

🦑 for Mac

1) brew install imagemagick

> mogrify -resize 256x256! -quality 100 -path YOUR_DATASET_NAME/A/*.jpg
$ mogrify -resize 256x256! -quality 100 -path YOUR_DATASET_NAME/B/*.jpg

2) for scale and center crop
$ mogrify -resize 256x256^ -gravity center -crop 256x256+0+0 -quality 100 -path ../A/*.jpg

🦑To train a model:

1) python main.py --dataset=edges2shoes --num_gpu=1

2) python main.py --dataset=YOUR_DATASET_NAME --num_gpu=4

> To test a model (use your load_path):

3) python main.py --dataset=edges2handbags --load_path=logs/edges2handbags_2017-03-18_10-55-37 --num_gpu=0 --is_train=False


▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑What is PostgreSQL ? (@ wikipedia)


> PostgreSQL is a general purpose and object-relational database management system, the most advanced open source database system. PostgreSQL was developed based on POSTGRES 4.2 at Berkeley Computer Science Department, University of California.

>PostgreSQL was designed to run on UNIX-like platforms. However, PostgreSQL was then also designed to be portable so that it could run on various platforms such as Mac OS X, Solaris, and Windows.

>PostgreSQL is free and open source software. Its source code is available under PostgreSQL license, a liberal open source license. You are free to use, modify and distribute PostgreSQL in any form.

>PostgreSQL requires very minimum maintained efforts because of its stability. Therefore, if you develop applications based on PostgreSQL, the total cost of ownership is low in comparison with other database management systems.

🦑Features:

> User-defined types

> Table inheritance

> Sophisticated locking mechanism

> Foreign key referential integrity

> Views, rules, subquery

🦑Official Download Link:

>https://www.postgresql.org/

> Nested transactions (savepoints)

> Multi-version concurrency control (MVCC)

> Asynchronous replication


▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Best IKE Scanner Original Tool


🦑𝕀ℕ𝕊𝕋𝔸𝕃𝕃𝕀𝕊𝔸𝕋𝕀𝕆ℕ & ℝ𝕌ℕ:

Termux-root/Kali/Debian/Parrot

1) git clone https://github.com/royhills/ike-scan

2) cd ike-scan

3) autoreconf --install to generate a viable ./configure file

4) Run ./configure or ./configure --with-openssl to use the OpenSSL libraries

5) Run make to build the project

6) Run make check to verify that everything works as expected

7) Run make install

8) ike-scan -h

🦑Features:

1) Discovery Determine which hosts in a given IP range are running IKE. This is done by displaying those hosts which respond to the IKE requests sent by ike-scan.

2) Fingerprinting Determine which IKE implementation the hosts are using, and in some cases determine the version of software that they are running. This is done in two ways: firstly by UDP backoff fingerprinting which involves recording the times of the IKE response packets from the target hosts and comparing the observed retransmission backoff pattern against known patterns; and secondly by Vendor ID fingerprinting which compares Vendor ID payloads from the VPN servers against known vendor id patterns.

3) Transform Enumeration Find which transform attributes are supported by the VPN server for IKE Phase-1 (e.g. encryption algorithm, hash algorithm etc.).

4) User Enumeration For some VPN systems, discover valid VPN usernames.

5) Pre-Shared Key Cracking Perform offline dictionary or brute-force password cracking for IKE Aggressive Mode with Pre-Shared Key authentication. This uses ike-scan to obtain the hash and other parameters, and psk-crack (which is part of the ike-scan package) to perform the cracking

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑BugBounty in Linkedln How I was able to bypass Open Redirection Protection


1) Open redirection vulnerabilities arise when an application incorporates user-controllable data into the target of a redirection in an unsafe way. An attacker can construct a URL within the application that causes a redirection to an arbitrary external domain

2)Example a site contain vulparan parameter indicates where to send user upon successful login.

> If website doesn’t validate the “vulparam” parameter value to make sure that target web page is legitimate and intended, attacker could manipulate that parameter to send a victim to a fake page crafted by attacker

3) Now simply changing the “url” value to any malicious site won’t work

> As you can see there is an extra parameter “urlHash” which looks like some hash value for the URL to which the user getting redirected so if “urlHash” value is the actual valid hash value for the “url” then only successful redirection will take place.

> One thing was clear till now basic techniques were not going to do anything good and then I went back to the raw request to find some help —

🦑 “How about changing the referer header value and see whether the validation working there?”

4) So I quickly jumped into it and changed the header value to some other domains and [face palm] still no luck. :/ .

Let’s give one more try , searched for LinkedIn android app referer and found the following link-

> https://github.com/snowplow/referer-parser/issues/131 and there came across LinkedIn android referer value as “ android-app://com.linkedin.android” . I used the referer value in the “referer” header field and the rest As show in pictures will sendNext

5) Successful redirection and yeah finally I managed to bypass the Open redirection protection of LinkedIn
e n j o y


▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂
🦑All in one 2020 recon, scanning,
parsing, and creating malicious payloads and listeners with Metasploit. For use with Kali Linux
and the Penetration Testers Framework (PTF).


🦑𝕀ℕ𝕊𝕋𝔸𝕃𝕃𝕀𝕊𝔸𝕋𝕀𝕆ℕ & ℝ𝕌ℕ:
1) git clone https://github.com/leebaird/discover /opt/discover/
> All scripts must be ran from this location.

2) cd /opt/discover/

3) chmod 777 update.sh

4) ./update.sh


🦑RECON
1. Domain
2. Person
3. Parse salesforce

🦑SCANNING
4. Generate target list
5. CIDR
6. List
7. IP, range, or domain
8. Rerun Nmap scripts and MSF aux

🦑WEB
9. Insecure direct object reference
10. Open multiple tabs in Firefox
11. Nikto
12. SSL

🦑MISC
13. Parse XML
14. Generate a malicious payload
15. Start a Metasploit listener


▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
🦑How to create a fake AP and sniff data.



🦑𝕀ℕ𝕊𝕋𝔸𝕃𝕃𝕀𝕊𝔸𝕋𝕀𝕆ℕ & ℝ𝕌ℕ:
1) git clone https://github.com/xdavidhu/mitmAP

2) cd mitmAP

3) python mitmAP.py

🦑How it Works:

1) SSLstrip2 for HSTS bypass

2) Image capture with Driftnet

3) TShark for command line .pcap capture

🦑Features:

> SSLstrip2

> Driftnet

> Tshark

> Full featured access point, with configurable speed limit

> mitmproxy

> Wireshark

> DNS Spoofing

> Saving results to file

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
🦑2019 tool that discovers valid subdomains for websites.

> Designed as a passive framework to be useful for bug bounties and safe for penetration testing.

🦑𝕀ℕ𝕊𝕋𝔸𝕃𝕃𝕀𝕊𝔸𝕋𝕀𝕆ℕ & ℝ𝕌ℕ:
1) git clone https://github.com/projectdiscovery/subfinder/releases/

2) Download .tar

3) tar -xzvf subfinder-linux-amd64.tar

4) mv subfinder-linux-amd64 /usr/bin/subfinder

5)subfinder

🦑If you want to build it yourself, you can go get the repo

> go get -v github.com/projectdiscovery/subfinder/cmd/subfinder

> If you wish to upgrade the package you can use:

> go get -u -v github.com/projectdiscovery/subfinder/cmd/subfinder


🦑Running:

1) If you are using docker, you need to first create your directory structure holding subfinder configuration file. After modifying the default config.yaml file, you can run:

2) mkdir $HOME/.config/subfinder

3) cp config.yaml $HOME/.config/subfinder/config.yaml

4) nano $HOME/.config/subfinder/config.yaml

5) docker run -v $HOME/.config/subfinder:/root/.config/subfinder -it ice3man/subfinder -d freelancer.com

🦑How To Use:

1) Running Subfinder

To run the tool on a target, just use the following command.

2) subfinder -d freelancer.com

This will run the tool against freelancer.com. There are a number of configuration options that you can pass along with this command. The verbose switch (-v) can be used to display verbose information.

[CERTSPOTTER] www.fi.freelancer.com
[DNSDUMPSTER] hosting.freelancer.com
[DNSDUMPSTER] support.freelancer.com
[DNSDUMPSTER] accounts.freelancer.com
[DNSDUMPSTER] phabricator.freelancer.com
[DNSDUMPSTER] cdn1.freelancer.com
[DNSDUMPSTER] t1.freelancer.com
[DNSDUMPSTER] wdc.t1.freelancer.com
[DNSDUMPSTER] dal.t1.freelancer.com

The -o command can be used to specify an output file.

> subfinder -d freelancer.com -o output.txt


▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑fsstat displays the details associated with a file system. The output of this command is file system specific. At a minimum, the range of meta-data values (inode numbers) and content units (blocks or clusters) are given. Also given are details from the Super Block, such as mount times and and features. For file systems that use groups (FFS and EXT2FS), the layout of each group is listed.

>For a FAT file system, the FAT table is displayed in a condensed format. Note that the data is in sectors and not in clusters.


🦑𝕀ℕ𝕊𝕋𝔸𝕃𝕃𝕀𝕊𝔸𝕋𝕀𝕆ℕ & ℝ𝕌ℕ:

1) Its kali pre-installed tool

2) To Run

> fsstat [-f fstype ] [-i imgtype] [-o imgoffset] [-b dev_sector_size] [-tvV] image [images]


🦑Commands :
-t type
Print the file system type only.
-f fstype
Specify the file system type. Use ’-f list’ to list the supported file system types. If not given, autodetection methods are used.
-i imgtype
Identify the type of image file, such as raw. Use ’-i list’ to list the supported types. If not given, autodetection methods are used.
-o imgoffset
The sector offset where the file system starts in the image.
-b dev_sector_size
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed.
-v
Verbose output of debugging statements to stderr
-V
Display version


▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑A Simple Termux(root) /Kali/parrot tools To scan port , Brute force protocol Service ,scan website , exploit system , exploit sql injection website and also have other characteristics


🦑𝕀ℕ𝕊𝕋𝔸𝕃𝕃𝕀𝕊𝔸𝕋𝕀𝕆ℕ & ℝ𝕌ℕ:

1) git clone https://github.com/joker25000/DZGEN

2) The installation the tool

3) cd DZGEN

4) chmod +x DZGEN

5) ./DZGEN

6) Run DZGEN tool in terminal

> DZGEN

🦑Tested By UnderCode

> kali

> debian


▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Understand before attack how it works

> How do hackers or remote attackers obtain the WPA or WPA2 Handshake from a wireless access point easily?


1) Communication Negotiation

When the connection is first established between two modems, the negotiation of communication restrictions and boundaries occurs for a brief period of time. Afterwards, the infamous "squealing" noise that people hear from old, dial-up modems sporting speaker outputs (it's a sound that modifies its pitch a hundred times every second) once the connection has been successfully made is the aural manifestation of two modems engaging in the handshake process. Thereafter, once everything has been agreed upon in regards to parameters, they're (the parameters) are used to offer streamlined information transmission over the channel as a function of its capacity and quality.

🦑Free High Quality WiFi

Although handshakes are more often than not what hackers need to capture in order to gain unauthorized access to systems and networks—or at the very least, get free, high-quality WiFi superior to those found in coffee shops and libraries—it's a necessary and unavoidable step to ensuring smooth connections from two otherwise different and normally mismatched systems. In turn, a Wired Protected Access or WPA handshake to keep intruders or unauthorized users from accessing the network (e.g., a four-way Temporal Key Integrity Protocol or TKIP handshake, with TKIP referring to one of many encryption algorithms that WPA supports).

🦑WPA Handshake Exploit

As for using WPA handshakes as exploits for security breaches, there are a variety of methods suited for this hacking task. Any hacker who wants to capture a four-way TKIP handshake without any help will probably have to observe Internet traffic for hours-on-end, patiently stalking for a client to link to a network. As easier way to capture handshakes for hacking purposes involves the use of a hacking tool called Aircrack-ng and forced deauthentication of a connected client PC in order to make him reconnect back up to the server exactly when you want him to connect.

🦑Authentication Capture

Ironically enough, it's during the procedure wherein the encrypted WPA key is re-exchanged that a connection is most vulnerable for hacker attack—the very process needed to protect a network can open it up to attack, like barging into a house while someone is in the middle of bolting the locks on his doors. Once the full authentication handshake has been captured from the client and an access point, the hacker can easily decrypt the information behind the handshake, thus allowing him the key to access the previously impenetrable network.



▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑2020 Massive wave of account hijacks hits YouTube creators



> Several high-profile accounts from the YouTube creators car community have fallen victim to these attacks already. The list includes channels such as Built [Instagram post, YouTube channel], Troy Sowers [Instagram post, YouTube channel], MaxtChekVids [YouTube channel], PURE Function [Instagram post, YouTube Support post, YouTube channel], and Musafir [Instagram post, YouTube channel].

🦑How They Attack?

1) Coordinated campaign bypassed 2FA

> The account hacks are the result of a coordinated campaign that consisted of messages luring users to phishing sites, where hackers logged account credentials.

> According to a channel owner who managed to recover their account before this article's publication and received additional information from YouTube's staff, we got some insight into how the full attack chain might have gone down.

2) Hackers use phishing emails to lure victims on fake Google login pages, where they collect users' account credentials

3) Hackers break into Google accounts

4) Hackers re-assign popular channels to new owners

5) Hackers change the channel's vanity URL, giving the original account owner and his followers the impression that their account had been deleted.

@M̵͘ ̠̖r̶̕.̵́ ̷͠B̴͘O̷̓T̶̆Ń̴E̶͛T̶̅(og)
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Topic termux/kali onex is a hacking tool installer and package manager for hackers. Onex is a library of all hacking tools for Turmex and other Linux distributions. onex can install any third party tool or any hacking tool for you.
instagram.com/UndercOdeTesting

🦑𝕀ℕ𝕊𝕋𝔸𝕃𝕃𝕀𝕊𝔸𝕋𝕀𝕆ℕ & ℝ𝕌ℕ:

1) apt update

2) apt install git

3) git clone https://github.com/Rajkumrdusad/onex.git

4) chmod +x onex/install

5) sh onex/install if not work than use ./onex/install

6) onex -h or onex help for help.

🦑Options :

> onex install [tool_name] install any tool.

> onex -i [tool_name] install any tool.

> onex search [tool_name] search any tool.

> onex -s [tool_name] search any tool.

> onex list list all tools.

> onex list -a list all tools.

> onex -l list all tools.

> onex -l -a list all tools.

> onex help get help.

> onex -h get help.

type

> onex star: to start onex menu mode.

@M̵͘ ̠̖r̶̕.̵́ ̷͠B̴͘O̷̓T̶̆Ń̴E̶͛T̶̅(og)
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑
Zero-Day Code Injection and Persistence Technique Full by UndercOde:
t.me/UnderCodeTesting

🦑𝕀ℕ𝕊𝕋𝔸𝕃𝕃𝕀𝕊𝔸𝕋𝕀𝕆ℕ & ℝ𝕌ℕ:

DoubleAgent is a new Zero-Day technique for injecting code and maintaining persistence on a machine (i.e. auto-run).

DoubleAgent can exploit:

> Every Windows version (Windows XP to Windows 10)

> Every Windows architecture (x86 and x64)

> Every Windows user (SYSTEM/Admin/etc.)

> Every target process, including privileged processes (OS/Antivirus/etc.)

> patched windows 8 and higher

1) git clone https://github.com/Cybellum/DoubleAgent

2) cd DoubleAgent

3) Build the main solution twice, once in x86 and once in x64. This step is crucial as it creates both x86 and x64 versions of DoubleAgentDll.dll which is required in order to perform a successful installation.

4) Copy the entire bin folder to the target machine.
Execute the installer:

Usage: DoubleAgent.exe install\uninstall\repair process_name

e.g. DoubleAgent.exe install cmd.exe

🦑ATTACK VECTOR :

1) Attacking Antivirus & Next Generation Antivirus – Taking full control of any antivirus by injecting code into it while bypassing all of its self-protection mechanism. The attack has been verified and works on all the major antiviruses including but not limited to: Avast, AVG, Avira, Bitdefender, Comodo, ESET, F-Secure, Kaspersky, Malwarebytes, McAfee, Norton, Panda, Quick Heal and Trend Micro. For more details, checkout our Taking Full Control Over Your Antivirus article.

2) Installing Persistent Malware – Installing malware that can “survive” reboots and are automatically executed once the operating system boots.

3) Hijacking Permissions – Hijacking the permissions of an existing trusted process to perform malicious operations in disguise of the trusted process. e.g. Exfiltrating data, C&C communication, lateral movement, stealing and encrypting sensitive data.

4) Altering Process Behavior – Modifying the behavior of the process. e.g. Installing backdoors, weakening encryption algorithms, etc.

5) Attacking Other Users/Sessions – Injecting code to processes of other users/sessions (SYSTEM/Admin/etc.).

WELL DONE !~


▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑HOW ADD NEW BRIDGE TO TOR BROWSER TESTED



1) Once the bridge is running, find its bridge line. For obfs4, the bridge line is in the file <datadir>/pt_state/obfs4_bridgeline.txt.

2) You need to insert the external IP/port, and the fingerprint from the file <datadir>/fingerprint.

3) File a new ticket that contains the bridge line.
Component: Applications/Tor Browser
Keywords: tbb-bridges

4) Make a pull request at https://github.com/OpenObservatory/ooni-resources that adds the new bridge's IP/port to the file bridge_reachability/tor-bridges-ip-port.csv. (This will cause OONI to start testing the reachability of the new bridge.)

Thats all!

@M̵͘ ̠̖r̶̕.̵́ ̷͠B̴͘O̷̓T̶̆Ń̴E̶͛T̶̅(tm)
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 Install ADB & FastBoot Tools in Termux!
2019
t.me/UndercOdeTestingOfficial

🦑𝕀ℕ𝕊𝕋𝔸𝕃𝕃𝕀𝕊𝔸𝕋𝕀𝕆ℕ & ℝ𝕌ℕ:

A) Silent installation:

1) Copy and paste the following command in Termux to silently install Tools:

> apt update > /dev/null 2>&1 && apt --assume-yes install wget > /dev/null

2) wget https://github.com/MasterDevX/Termux-ADB/raw/master/

3) InstallTools.sh -q && bash InstallTools.sh

B) Common installation:

1) Copy and paste the following command in Termux to install Tools with logs output:

> apt update && apt install wget && wget https://github.com/MasterDevX/Termux-ADB/raw/master/InstallTools.sh && bash InstallTools.sh

🦑Tested

@M̵͘ ̠̖r̶̕.̵́ ̷͠B̴͘O̷̓T̶̆Ń̴E̶͛T̶̅(tm)
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑How To Compress / Decompress Brawl Stars SC files on Windows / Linux / Android!
instagram.com/UnderCodeTesting

🦑𝕀ℕ𝕊𝕋𝔸𝕃𝕃𝕀𝕊𝔸𝕋𝕀𝕆ℕ & ℝ𝕌ℕ:

> On Windows:

1) Download Python 3.5 or newer version from official page.
>https://www.python.org/downloads/

2) Install Python. While Installing, enable such parameters as "Add Python to PATH", "Install pip", "Install py launcher", "Associate files with Python" and "Add Python to environment variables".

3) Download XCoder from releases page and extract it.
> https://github.com/MasterDevX/XCoder/releases

4) Execute "Init.py" file to install required modules and create workspace directories.

🦑On Linux:

1) Open Terminal and install Python by executing following command:

2) sudo apt-get update && sudo apt-get install python3 python3-pip

3) Download XCoder from releases page and extract it.
> https://github.com/MasterDevX/XCoder/releases

4) Execute "Init.py" file to install required modules and create workspace directories.

🦑 On Android:

1) Download and install PyDroid app from Google Play.
> https://play.google.com/store/apps/details?id=ru.iiec.pydroid3

2) Open PyDroid and wait until Python installs.

3) Download XCoder from releases page and extract it.
> https://github.com/MasterDevX/XCoder/releases


4) In PyDroid open and execute "Init.py" file to install required modules and create workspace directories.


🦑 How to use

> To compile SC:

1) Put folders with texture name and .png files inside them in the "In-Decompressed-SC" directory and execute "SC-Encode.py" script. After the process will be finished, your .sc files will appear in "Out-Compressed-SC" folder.

2) To decompile SC:

> Put .sc files in the "In-Compressed-SC" directory and execute "SC-Decode.py" script. After the process will be finished, your .png files will appear in "Out-Decompressed-SC" folder.

🦑Tested By undercOde

> win server essentiel

> android 8.0

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁


🦑IP Spoofing FULL :

The term IP (Internet Protocol) address spoofing refers to the creation of IP packets with a forged (spoofed) source IP address with the purpose of concealing the identity of the sender or impersonating another computing system.
T.me/UnderCodeTesting
🦑Why it works ?
IP-Spoofing works because trusted services only rely on network address based authentication. Since IP is easily duped, address forgery is not difficult.
The main reason is security weakness in the TCP protocol known as sequence number prediction.

🦑How it works ?
To completely understand how ip spoofing can take place, one must examine the structure of the TCP/IP protocol suite. A basic understanding of these headers and network exchanges is crucial to the process.

🦑Internet Protocol (IP) :
It is a network protocol operating at layer 3 (network) of the OSI model. It is a connectionless model, meaning there is no information regarding transaction state, which is used to route packets on a network. Additionally, there is no method in place to ensure that a packet is properly delivered to the destination.

> Examining the IP header, we can see that the first 12 bytes (or the top 3 rows of the header) contain various information about the packet. The next 8 bytes (the next 2 rows), however, contains the source and destination IP addresses. Using one of several tools, an attacker can easily modify these addresses – specifically the “source address” field.

🦑Transmission Control Protocol (TCP) :
It is the connection-oriented, reliable transport protocol in the TCP/IP suite. Connection-oriented simply means that the two hosts participating in a discussion must first establish a connection via the 3-way handshake (SYN-SYN/ACK-ACK). Reliability is provided by data sequencing and acknowledgement. TCP assigns sequence numbers to every segment and acknowledges any and all data segments recieved from the other end.


> As you can see above, the first 12 bytes of the TCP packet, which contain port and sequencing information.

> TCP sequence numbers can simply be thought of as 32-bit counters. They range from 0 to 4,294,967,295. Every byte of data exchanged across a TCP connection (along with certain flags) is sequenced. The sequence number field in the TCP header will contain the sequence number of the *first* byte of data in the TCP segment. The acknowledgement number field in the TCP header holds the value of next *expected* sequence number, and also acknowledges *all* data up through this ACK number minus one.

> TCP packets can be manipulated using several packet crafting softwares available on the internet.

🦑The Attack
IP-spoofing consists of several steps. First, the target host is choosen. Next, a pattern of trust is discovered, along with a trusted host. The trusted host is then disabled, and the target's TCP sequence numbers are sampled. The trusted host is impersonated, the sequence numbers guessed, and a connection attempt is made to a service that only requires address-based authentication. If successful, the attacker executes a simple command to leave a backdoor.

> Spoofing can be implemented by different ways as given below -

🦑Non-Blind Spoofing :- This type of attack takes place when the attacker is on the same subnet as the victim. The sequence and acknowledgement numbers can be sniffed, eliminating the potential difficulty of calculating them accurately.

🦑Blind Spoofing :- Here the sequence and acknowledgement numbers are unreachable. In order to circumvent this, several packets are sent to the target machine in order to sample sequence numbers.

🦑Usage :


IP spoofing is almost always used in what is currently one of the most difficult attacks to defend against – Denial of Service attacks, or DoS.

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁