exports.merge = {
validate: {
query: {
fileName: Joi.string()
.trim()
.required()
.description(
md5: Joi.string()
.trim()
.required()
.description(md5'),
size: Joi.string()
.trim()
.required()
.description('ζ仢倧ε°'),
},
},
permission: {
roles: ['user'],
},
async handler (ctx) {
const { fileName, md5, size } = ctx.request.query
let { name, base: filename, ext } = path.parse(fileName)
const newFileName = randomFilename(name, ext)
await mergeFiles(path.join(uploadDir, md5), uploadDir, newFileName, size)
.then(async () => {
const file = {
key: newFileName,
name: filename,
mime_type: mime.getType(
ext,
path:
provider: 'oss',
size,
owner: ctx.state.user.id,
}
const key = encodeURIComponent(file.key)
.replace(/%/g, '')
.slice(-100)
file.url = await uploadLocalFileToOss(file.path, key)
file.url = getFileUrl(file)
const f = await File.create(omit(file, 'path'))
const files = []
files.push(f)
ctx.body = invokeMap(files, 'toJSON')
})
.catch(() => {
throw Boom.badData
})
},
}
validate: {
query: {
fileName: Joi.string()
.trim()
.required()
.description(
md5: Joi.string()
.trim()
.required()
.description(md5'),
size: Joi.string()
.trim()
.required()
.description('ζ仢倧ε°'),
},
},
permission: {
roles: ['user'],
},
async handler (ctx) {
const { fileName, md5, size } = ctx.request.query
let { name, base: filename, ext } = path.parse(fileName)
const newFileName = randomFilename(name, ext)
await mergeFiles(path.join(uploadDir, md5), uploadDir, newFileName, size)
.then(async () => {
const file = {
key: newFileName,
name: filename,
mime_type: mime.getType(
${uploadDir}/${newFileName}),ext,
path:
${uploadDir}/${newFileName},provider: 'oss',
size,
owner: ctx.state.user.id,
}
const key = encodeURIComponent(file.key)
.replace(/%/g, '')
.slice(-100)
file.url = await uploadLocalFileToOss(file.path, key)
file.url = getFileUrl(file)
const f = await File.create(omit(file, 'path'))
const files = []
files.push(f)
ctx.body = invokeMap(files, 'toJSON')
})
.catch(() => {
throw Boom.badData
})
},
}
π¦ to sum up
This UNDERCODE expert tutorial @undercodetesting
@undercodecourses
describes some of the practices for optimizing the upload of large-format files. It is summarized as the following 4 points:
1) ob.slice slices the file and uploads multiple slices concurrently. After all slices are uploaded, the server is notified to merge to realize the large file slice upload;
2) The native XMLHttpRequest onprogress monitors the upload progress of the slice and obtains the file upload progress in real time;
3) spark-md5 calculates the file MD5 according to the content of the file, gets the unique identifier of the file, and binds it to the file upload status;
4) Before uploading the slices, check the uploaded slice list through the file MD5. Only the slices that have not been uploaded are uploaded during the upload to realize the resuming of the breakpoint.
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
This UNDERCODE expert tutorial @undercodetesting
@undercodecourses
describes some of the practices for optimizing the upload of large-format files. It is summarized as the following 4 points:
1) ob.slice slices the file and uploads multiple slices concurrently. After all slices are uploaded, the server is notified to merge to realize the large file slice upload;
2) The native XMLHttpRequest onprogress monitors the upload progress of the slice and obtains the file upload progress in real time;
3) spark-md5 calculates the file MD5 according to the content of the file, gets the unique identifier of the file, and binds it to the file upload status;
4) Before uploading the slices, check the uploaded slice list through the file MD5. Only the slices that have not been uploaded are uploaded during the upload to realize the resuming of the breakpoint.
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ This expert tut is written by undercode
> don't clone our tutorials
> support & share
> don't clone our tutorials
> support & share
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦Hack news by Undercode :
For security reasons, OpenSSH announced to abandon support for SHA-1 authentication scheme
1) OpenSSH is one of the most popular tools for connecting and managing remote servers. Recently, the team announced plans to abandon support for the SHA-1 authentication scheme. OpenSSH cited the security problems in the SHA-1 hash algorithm in the announcement, which is considered insecure in the industry. The algorithm was cracked by Google cryptography experts in February 2017 and can use SHAttered technology to sign two different files with the same SHA-1 file.
2) However, creating a SHA-1 collision at that time was considered to be very expensive. Therefore, Google experts believe that SHA-1 needs to wait at least half a year in real life until the cost further decreases. Later in the research reports released in May 2019 and January 2020, an updated method was introduced in detail to reduce the cost of the SHA-1 selection-prefix collision attack to less than $ 110,000 and less than $ 50,000.
3) For national-level and high-end cybercrime groups, let them generate an SSH authentication key, so that they can remotely access key servers without being detected, then the price of $ 50,000 is very small. The OpenSSH developer said today: "For this reason, we will disable the 'ssh-rsa' public key signature algorithm by default in a near future version."
π¦Hack news by Undercode :
For security reasons, OpenSSH announced to abandon support for SHA-1 authentication scheme
1) OpenSSH is one of the most popular tools for connecting and managing remote servers. Recently, the team announced plans to abandon support for the SHA-1 authentication scheme. OpenSSH cited the security problems in the SHA-1 hash algorithm in the announcement, which is considered insecure in the industry. The algorithm was cracked by Google cryptography experts in February 2017 and can use SHAttered technology to sign two different files with the same SHA-1 file.
2) However, creating a SHA-1 collision at that time was considered to be very expensive. Therefore, Google experts believe that SHA-1 needs to wait at least half a year in real life until the cost further decreases. Later in the research reports released in May 2019 and January 2020, an updated method was introduced in detail to reduce the cost of the SHA-1 selection-prefix collision attack to less than $ 110,000 and less than $ 50,000.
3) For national-level and high-end cybercrime groups, let them generate an SSH authentication key, so that they can remotely access key servers without being detected, then the price of $ 50,000 is very small. The OpenSSH developer said today: "For this reason, we will disable the 'ssh-rsa' public key signature algorithm by default in a near future version."
4) The OpenSSH application uses the "ssh-rsa" mode to generate SSH authentication keys. One of these keys is stored on the server that the user wants to log in to, and the other is stored in the user's local OpenSSH client, so that the user can access the server without entering a password each time they log in, but authenticates locally Key instead of login.
5) By default, OpenSSH ssh-rsa mode generates these keys by using the SHA-1 hash function, which means that these keys are vulnerable to SHAterred attacks, enabling threat actors to generate duplicate keys. OpenSSH developers said today: "Unfortunately, despite the existence of better alternatives, this algorithm is still widely used, and it is the only remaining public key signature algorithm specified by the original SSH RFCs."
6) The OpenSSH team now requires server owners to check whether their keys have been generated using the default ssh-rsa mode and use different modes to generate new keys. The OpenSSH team stated that the recommended modes are rsa-sha2-256 / 512 (supported since OpenSSH 7.2), ssh-ed25519 (supported since OpenSSH 6.5) or ecdsa-sha2-nistp256 / 384/521 (supported since OpenSSH 5.7) .
@UndercodeTesting
Future new chan @UndercodeNews
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
5) By default, OpenSSH ssh-rsa mode generates these keys by using the SHA-1 hash function, which means that these keys are vulnerable to SHAterred attacks, enabling threat actors to generate duplicate keys. OpenSSH developers said today: "Unfortunately, despite the existence of better alternatives, this algorithm is still widely used, and it is the only remaining public key signature algorithm specified by the original SSH RFCs."
6) The OpenSSH team now requires server owners to check whether their keys have been generated using the default ssh-rsa mode and use different modes to generate new keys. The OpenSSH team stated that the recommended modes are rsa-sha2-256 / 512 (supported since OpenSSH 7.2), ssh-ed25519 (supported since OpenSSH 6.5) or ecdsa-sha2-nistp256 / 384/521 (supported since OpenSSH 5.7) .
@UndercodeTesting
Future new chan @UndercodeNews
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦New updates in sniper tool
T.me/UndercodeTesting
> Automated pentest framework for offensive security experts
π¦FEATURES :
Automatically collects basic recon (ie. whois, ping, DNS, etc.)
Automatically launches Google hacking queries against a target domain
Automatically enumerates open ports via NMap port scanning
Automatically exploit common vulnerabilities
Automatically brute forces sub-domains, gathers DNS info and checks for
zone transfers
Automatically checks for sub-domain hijacking
Automatically runs targeted NMap scripts against open ports
Automatically runs targeted Metasploit scan and exploit modules
Automatically scans all web applications for common vulnerabilities
Automatically brute forces ALL open services
Automatically test for anonymous FTP access
Automatically runs WPScan, Arachni and Nikto for all web services
Automatically enumerates NFS shares
Automatically test for anonymous LDAP access
Automatically enumerate SSL/TLS ciphers, protocols and vulnerabilities
Automatically enumerate SNMP community strings, services and users
Automatically list SMB users and shares, check for NULL sessions and
exploit MS08-067
Automatically tests for open X11 servers
Performs high level enumeration of multiple hosts and subnets
Automatically integrates with Metasploit Pro, MSFConsole and Zenmap for reporting
Automatically gathers screenshots of all web sites
Create individual workspaces to store all scan output
Scheduled scans (https://github.com/1N3/Sn1per/wiki/Scheduled-Scans)
Slack API integration (https://github.com/1N3/Sn1per/wiki/Slack-API-
Integration)
Hunter.io API integration (https://github.com/1N3/Sn1per/wiki/
Hunter.io-API-Integration)
OpenVAS API integration (https://github.com/1N3/Sn1per/wiki/OpenVAS-Integration)
Burpsuite Professional 2.x integration (https://github.com/1N3/Sn1per/wiki/Burpsuite-Professional-2.x-Integration)
Shodan API integration (https://github.com/1N3/Sn1per/wiki/Shodan-Integration)
Censys API integration (https://github.com/1N3/Sn1per/wiki/Censys-API-Integration)
Metasploit integration (https://github.com/1N3/Sn1per/wiki/Metasploit-Integration)
π¦fOR THIS REASON some hackers clone a part from this script and upload to giyhub under their names...jajaj
π¦πβπππΈπππππΈπππβ & βπβ :
1) Download https://raw.githubusercontent.com/1N3/Sn1per/master/Dockerfile
2) docker build -t sn1per .
3) docker run -it sn1per /bin/bash
or
> docker pull xerosecurity/sn1per
>docker run -it xerosecurity/sn1per /bin/bash
β β @undercodeTesting
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦New updates in sniper tool
T.me/UndercodeTesting
> Automated pentest framework for offensive security experts
π¦FEATURES :
Automatically collects basic recon (ie. whois, ping, DNS, etc.)
Automatically launches Google hacking queries against a target domain
Automatically enumerates open ports via NMap port scanning
Automatically exploit common vulnerabilities
Automatically brute forces sub-domains, gathers DNS info and checks for
zone transfers
Automatically checks for sub-domain hijacking
Automatically runs targeted NMap scripts against open ports
Automatically runs targeted Metasploit scan and exploit modules
Automatically scans all web applications for common vulnerabilities
Automatically brute forces ALL open services
Automatically test for anonymous FTP access
Automatically runs WPScan, Arachni and Nikto for all web services
Automatically enumerates NFS shares
Automatically test for anonymous LDAP access
Automatically enumerate SSL/TLS ciphers, protocols and vulnerabilities
Automatically enumerate SNMP community strings, services and users
Automatically list SMB users and shares, check for NULL sessions and
exploit MS08-067
Automatically tests for open X11 servers
Performs high level enumeration of multiple hosts and subnets
Automatically integrates with Metasploit Pro, MSFConsole and Zenmap for reporting
Automatically gathers screenshots of all web sites
Create individual workspaces to store all scan output
Scheduled scans (https://github.com/1N3/Sn1per/wiki/Scheduled-Scans)
Slack API integration (https://github.com/1N3/Sn1per/wiki/Slack-API-
Integration)
Hunter.io API integration (https://github.com/1N3/Sn1per/wiki/
Hunter.io-API-Integration)
OpenVAS API integration (https://github.com/1N3/Sn1per/wiki/OpenVAS-Integration)
Burpsuite Professional 2.x integration (https://github.com/1N3/Sn1per/wiki/Burpsuite-Professional-2.x-Integration)
Shodan API integration (https://github.com/1N3/Sn1per/wiki/Shodan-Integration)
Censys API integration (https://github.com/1N3/Sn1per/wiki/Censys-API-Integration)
Metasploit integration (https://github.com/1N3/Sn1per/wiki/Metasploit-Integration)
π¦fOR THIS REASON some hackers clone a part from this script and upload to giyhub under their names...jajaj
π¦πβπππΈπππππΈπππβ & βπβ :
1) Download https://raw.githubusercontent.com/1N3/Sn1per/master/Dockerfile
2) docker build -t sn1per .
3) docker run -it sn1per /bin/bash
or
> docker pull xerosecurity/sn1per
>docker run -it xerosecurity/sn1per /bin/bash
β β @undercodeTesting
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦Google launches dedicated website to help people avoid online scams
1) Google announced a website on Thursday to teach people how to detect and avoid online scams because digital scams have reached a climax in the case of a coronavirus pandemic. This is named Scamspotter.org websites trying to show people how to recognize false medical examinations, fake vaccine offers or other false medical information. The site also highlights some typical scam patterns, such as love scammers asking target people to send them money or buy them gift cards.
2) Google launched this site in partnership with the Cybercrime Support Network, a nonprofit organization dedicated to helping victims of cyber fraud. The site includes a small quiz that uses common scam scenarios, such as receiving a message about winning a trip to Hawaii, and uses this quiz to test users' ability to fight fraud.
3) Google said that this work was carried out under the circumstance that scammers took advantage of the new crown epidemic at an βastonishing speedβ. Americans have lost more than $ 40 million due to COVID-19 related scams. The Federal Trade Commission predicts that this year, the amount of coronavirus-related or other fraud losses will exceed 2 billion US dollars.
> source twitter.com/UndercodeNews
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦Google launches dedicated website to help people avoid online scams
1) Google announced a website on Thursday to teach people how to detect and avoid online scams because digital scams have reached a climax in the case of a coronavirus pandemic. This is named Scamspotter.org websites trying to show people how to recognize false medical examinations, fake vaccine offers or other false medical information. The site also highlights some typical scam patterns, such as love scammers asking target people to send them money or buy them gift cards.
2) Google launched this site in partnership with the Cybercrime Support Network, a nonprofit organization dedicated to helping victims of cyber fraud. The site includes a small quiz that uses common scam scenarios, such as receiving a message about winning a trip to Hawaii, and uses this quiz to test users' ability to fight fraud.
3) Google said that this work was carried out under the circumstance that scammers took advantage of the new crown epidemic at an βastonishing speedβ. Americans have lost more than $ 40 million due to COVID-19 related scams. The Federal Trade Commission predicts that this year, the amount of coronavirus-related or other fraud losses will exceed 2 billion US dollars.
> source twitter.com/UndercodeNews
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
X (formerly Twitter)
UNDERCODE NEWS (@UndercodeNews) on X
π¦ Latest in Cyber & Tech News with AI-Powered Analysis and Fact Checking.
γjoin us: https://t.co/YVv330UsjQ
More: @DailyCve @UndercodeUpdate
γjoin us: https://t.co/YVv330UsjQ
More: @DailyCve @UndercodeUpdate
Forwarded from Backup Legal Mega
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦LIVE CC β β
LIVE CCN , IP US, ZIP 10010 or 10080
NEED GOOD BROWSER AND VPN
. 4266841632836688|07|2023|208 CCN Correct
. 4266841632325278|07|2022|364 CCN Correct
. 4266841632267132|05|2022|857 CCN Correct
. 4266841632136451|03|2022|072 CCN Correct
. 4266841632517858|04|2024|465 CCN Correct
. 4266841632111587|08|2022|106 CCN Correct
. 4266841632708630|08|2023|636 CCN Correct
. 4266841632740401|07|2022|304 CCN Correct
. 4266841632224810|12|2025|677 CCN Correct
. 4266841632146666|05|2025|626 CCN Correct
. 4266841632268387|06|2024|531 CCN Correct
. 4266841632802417|12|2023|204 CCN Correct
. 4266841632483564|02|2023|010 CCN Correct
. 4266841632086243|06|2025|006 CCN Correct
. 4266841632200562|01|2024|886 CCN Correct
. 4266841632275234|09|2024|704 CCN Correct
. 4266841632285001|03|2023|588 CCN Correct
. 4266841632675250|12|2025|564 CCN Correct
. 4266841632063762|12|2025|171 CCN Correct
. 4266841632867865|01|2025|556 CCN Correct
. 4266841632517502|01|2023|627 CCN Correct
. 4266841632515035|10|2025|472 CCN Correct
. 4266841632514517|11|2023|152 CCN Correct
. 4266841632518385|07|2022|231 CCN Correct
. 4266841632514434|10|2024|335 CCN Correct
. 4266841632510440|09|2024|084 CCN Correct
. 4266841632516520|07|2022|235 CCN Correct
. 4266841632510432|08|2023|500 CCN Correct
. 4266841632516363|12|2025|646 CCN Correct
. 4266841632514517|10|2023|638 CCN Correct
β β verified
those not by undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦LIVE CC β β
LIVE CCN , IP US, ZIP 10010 or 10080
NEED GOOD BROWSER AND VPN
. 4266841632836688|07|2023|208 CCN Correct
. 4266841632325278|07|2022|364 CCN Correct
. 4266841632267132|05|2022|857 CCN Correct
. 4266841632136451|03|2022|072 CCN Correct
. 4266841632517858|04|2024|465 CCN Correct
. 4266841632111587|08|2022|106 CCN Correct
. 4266841632708630|08|2023|636 CCN Correct
. 4266841632740401|07|2022|304 CCN Correct
. 4266841632224810|12|2025|677 CCN Correct
. 4266841632146666|05|2025|626 CCN Correct
. 4266841632268387|06|2024|531 CCN Correct
. 4266841632802417|12|2023|204 CCN Correct
. 4266841632483564|02|2023|010 CCN Correct
. 4266841632086243|06|2025|006 CCN Correct
. 4266841632200562|01|2024|886 CCN Correct
. 4266841632275234|09|2024|704 CCN Correct
. 4266841632285001|03|2023|588 CCN Correct
. 4266841632675250|12|2025|564 CCN Correct
. 4266841632063762|12|2025|171 CCN Correct
. 4266841632867865|01|2025|556 CCN Correct
. 4266841632517502|01|2023|627 CCN Correct
. 4266841632515035|10|2025|472 CCN Correct
. 4266841632514517|11|2023|152 CCN Correct
. 4266841632518385|07|2022|231 CCN Correct
. 4266841632514434|10|2024|335 CCN Correct
. 4266841632510440|09|2024|084 CCN Correct
. 4266841632516520|07|2022|235 CCN Correct
. 4266841632510432|08|2023|500 CCN Correct
. 4266841632516363|12|2025|646 CCN Correct
. 4266841632514517|10|2023|638 CCN Correct
β β verified
those not by undercode
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
Forwarded from Backup Legal Mega
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦BEST CS ZOMBIES IP 2020 FOR GAMERS ::)
83. CS CLARION - [ZM]Army Zombie Plague Server [FreeVIP+Bazooka+Banβk+LaserBomb[[DM]]β 24/32 193.192.58.53:27090 zm_virus_t
150. CS [ZM] AMXPLAY | Zombie DeathMatch 18/31 5.178.87.52:27015 zm_cross
319. CS UGC.LT | Zombie Plague [LASERMINES] 30/32 164.132.159.171:27015 zm_forza
425. CS [ZM] LEGION_UNDEAD [CSO] 27/32 83.222.97.125:27015 zm_deko2
548. CS Zombie.IlegalZone.Ro VIP FREE 00h : 09h 9/32 178.239.20.36:27015 zm_foda
923. CS #1 KiiLeR Zombie Plague[Double Packs/Happy Hour/FullPacks/VIP]@MaxiGames.com.br 11/32 177.54.152.57:27015 zm_[v]irus
1008. CS [ZM] ΠΠ΅ΡΠ²ΠΎΡΠΎΠ΄Π½ΡΠ΅ ΠΠΎΠΌΠ±ΠΈ [FreeVIP] 21/32 46.174.50.24:27206 zm_dust2_cso
1319. CS Destructio Zombie 4.3 {VIP+DM+JP+BAZOOKA+AutosaveBank} 14/32 138.201.147.111:27039 zm_battleground_foda
1492. CS Lost Player | Zombie Plague [Laser + Respawn] | [TR] 18/32 213.238.171.233:27015 zm_3rooms
1942. CS [ZOMBIE] DarkGames [ZP 4.3] 10/32 46.174.53.29:27015 zm_snowbase2
2114. CS [Zombie Plague-FreeVIP|Bank|FDL|Models| NRG-GAMING.EUβ 9/32 93.123.18.61:27017 zm_pis2
2450. CS ««« ΠΠΎΠΌΠ±ΠΈΠ‘ΠΈΡΠΈ [Π€ΠΠ] »»» FREE VIP 9/32 109.248.59.164:27018 zm_deko2
3363. CS [Danger-cs.eu] Zombie Plague [Jetpack|Fast Ammo|24/7|Golden Weaps|Ranks|FUN||1000FPS|MELEE|Massacre| 3/21 93.123.18.91:27015 zm_pis2
3370. CS P[c]T eGames | Zombie Plague ZM Happy Hour ATIVADO 2x Ammopacks | 0/30 177.54.152.27:27041
π¦ source wiki >β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦BEST CS ZOMBIES IP 2020 FOR GAMERS ::)
83. CS CLARION - [ZM]Army Zombie Plague Server [FreeVIP+Bazooka+Banβk+LaserBomb[[DM]]β 24/32 193.192.58.53:27090 zm_virus_t
150. CS [ZM] AMXPLAY | Zombie DeathMatch 18/31 5.178.87.52:27015 zm_cross
319. CS UGC.LT | Zombie Plague [LASERMINES] 30/32 164.132.159.171:27015 zm_forza
425. CS [ZM] LEGION_UNDEAD [CSO] 27/32 83.222.97.125:27015 zm_deko2
548. CS Zombie.IlegalZone.Ro VIP FREE 00h : 09h 9/32 178.239.20.36:27015 zm_foda
923. CS #1 KiiLeR Zombie Plague[Double Packs/Happy Hour/FullPacks/VIP]@MaxiGames.com.br 11/32 177.54.152.57:27015 zm_[v]irus
1008. CS [ZM] ΠΠ΅ΡΠ²ΠΎΡΠΎΠ΄Π½ΡΠ΅ ΠΠΎΠΌΠ±ΠΈ [FreeVIP] 21/32 46.174.50.24:27206 zm_dust2_cso
1319. CS Destructio Zombie 4.3 {VIP+DM+JP+BAZOOKA+AutosaveBank} 14/32 138.201.147.111:27039 zm_battleground_foda
1492. CS Lost Player | Zombie Plague [Laser + Respawn] | [TR] 18/32 213.238.171.233:27015 zm_3rooms
1942. CS [ZOMBIE] DarkGames [ZP 4.3] 10/32 46.174.53.29:27015 zm_snowbase2
2114. CS [Zombie Plague-FreeVIP|Bank|FDL|Models| NRG-GAMING.EUβ 9/32 93.123.18.61:27017 zm_pis2
2450. CS ««« ΠΠΎΠΌΠ±ΠΈΠ‘ΠΈΡΠΈ [Π€ΠΠ] »»» FREE VIP 9/32 109.248.59.164:27018 zm_deko2
3363. CS [Danger-cs.eu] Zombie Plague [Jetpack|Fast Ammo|24/7|Golden Weaps|Ranks|FUN||1000FPS|MELEE|Massacre| 3/21 93.123.18.91:27015 zm_pis2
3370. CS P[c]T eGames | Zombie Plague ZM Happy Hour ATIVADO 2x Ammopacks | 0/30 177.54.152.27:27041
π¦ source wiki >β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦Common methods / processes for hacking websites
Generally speaking, hacker attacks generally have the following behaviors:
1. Information collection
1.1 / Whois information-registrant, phone, email, DNS, address
1.2 / Googlehack-collection of sensitive directories, sensitive files, more information
1.3 / Server IP-Nmap scanning, port corresponding services, C segment
1.4 / Sidenote β Bing query, script tool
1.5 / If you encounter CDNβCloudflare (bypass), start from a subdomain (mail, postfix), DNS transfer domain vulnerability
1.6 / Server, component (fingerprint)-operating system, web server (apache, nginx, iis), scripting language
1.7/ Moreβ¦
Through the information collection stage, the attacker has basically been able to obtain most of the information on the website. Of course, information collection is the first step of the website invasion, which determines the success of the subsequent invasion.
2. Vulnerability mining
2.1 / Detection of Web application fingerprints β Discuz, PHPwind, Dedecms, Ecshopβ¦
2.2 / XSS, CSRF, XSIO, SQLinjection, permission bypass, arbitrary file reading, file inclusion ...
2.3 / Upload vulnerability-truncation, modification, and parsing vulnerability
2.4 / Is there a verification code-brute force cracking
2.5/ Moreβ¦
After a long day, the attacker already has a lot of information on your website and a few small and large vulnerabilities. Next, they will begin to use these vulnerabilities to gain website permissions.
3. Vulnerability exploitation
3.1 / Thinking about purpose-what effect is achieved
3.2 / Hidden, destructive-find the corresponding EXP attack payload based on the detected application fingerprint or write your own
3.3 / Start the vulnerability attack, obtain the corresponding permissions, and get the webshell according to different scenarios
4. Privilege upgrade
4.1 / Select different attack payloads according to the server type for privilege escalation
4.2 / Unable to upgrade the permissions, combined with the obtained data to start password guessing and backtracking information collection
5. Implanted back door
5.1 / Concealment
5.2 / Check and update regularly, keep it periodic
6. Clean up logs
6.1 / camouflage, concealment, to avoid alarm, they usually choose to delete the specified log
6.2 / According to the time period, find the corresponding log file
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦Common methods / processes for hacking websites
Generally speaking, hacker attacks generally have the following behaviors:
1. Information collection
1.1 / Whois information-registrant, phone, email, DNS, address
1.2 / Googlehack-collection of sensitive directories, sensitive files, more information
1.3 / Server IP-Nmap scanning, port corresponding services, C segment
1.4 / Sidenote β Bing query, script tool
1.5 / If you encounter CDNβCloudflare (bypass), start from a subdomain (mail, postfix), DNS transfer domain vulnerability
1.6 / Server, component (fingerprint)-operating system, web server (apache, nginx, iis), scripting language
1.7/ Moreβ¦
Through the information collection stage, the attacker has basically been able to obtain most of the information on the website. Of course, information collection is the first step of the website invasion, which determines the success of the subsequent invasion.
2. Vulnerability mining
2.1 / Detection of Web application fingerprints β Discuz, PHPwind, Dedecms, Ecshopβ¦
2.2 / XSS, CSRF, XSIO, SQLinjection, permission bypass, arbitrary file reading, file inclusion ...
2.3 / Upload vulnerability-truncation, modification, and parsing vulnerability
2.4 / Is there a verification code-brute force cracking
2.5/ Moreβ¦
After a long day, the attacker already has a lot of information on your website and a few small and large vulnerabilities. Next, they will begin to use these vulnerabilities to gain website permissions.
3. Vulnerability exploitation
3.1 / Thinking about purpose-what effect is achieved
3.2 / Hidden, destructive-find the corresponding EXP attack payload based on the detected application fingerprint or write your own
3.3 / Start the vulnerability attack, obtain the corresponding permissions, and get the webshell according to different scenarios
4. Privilege upgrade
4.1 / Select different attack payloads according to the server type for privilege escalation
4.2 / Unable to upgrade the permissions, combined with the obtained data to start password guessing and backtracking information collection
5. Implanted back door
5.1 / Concealment
5.2 / Check and update regularly, keep it periodic
6. Clean up logs
6.1 / camouflage, concealment, to avoid alarm, they usually choose to delete the specified log
6.2 / According to the time period, find the corresponding log file
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
2020-NONLEAK.txt
4.1 KB
Windows/x64 - WinExec Add-Admin Dynamic Null-Free Shellcode (210 Bytes)
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦Tool to look for several security related Android application vulnerabilities
π¦πβπππΈπππππΈπππβ & βπβ :
With pip (no security checks on requirements):
~ pip install --user qark # --user is only needed if not using a virtualenv
~ qark --help
With requirements.txt (security checks on requirements):
~ git clone https://github.com/linkedin/qark
~ cd qark
~ pip install -r requirements.txt
~ pip install . --user # --user is only needed if not using a virtualenv
~ qark --help
π¦Exploit APK
QARK can generate a basic exploit APK for a few of the vulnerabilities that have been found.
To generate the exploit APK there are a few steps to follow. You need to have the Android SDK v21 and build-tools v21.1.2
1) Install the android SDK, you can get it under the 'command line tools': https://developer.android.com/studio/#downloads
2) Unzip the android SDK
3) Go into the new directory and generate the licenses with bin/sdkmanager --licenses
4) Make sure the generated licenses are in the android SDK directory.
5) Install the SDK and the proper build-tools version: bin/sdkmanager --
6) install "platforms;android-21" "sources;android-21" "build-tools;21.1.2"
π¦Included in the types of security vulnerabilities this tool attempts to find are:
Inadvertently exported components
Improperly protected exported components
Intents which are vulnerable to interception or eavesdropping
Improper x.509 certificate validation
Creation of world-readable or world-writeable files
Activities which may leak data
The use of Sticky Intents
Insecurely created Pending Intents
Sending of insecure Broadcast Intents
Private keys embedded in the source
Weak or improper cryptography use
Potentially exploitable WebView configurations
Exported Preference Activities
Tapjacking
Apps which enable backups
Apps which are debuggable
Apps supporting outdated API versions, with known vulnerabilities
@uNDERCODEtESTING
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦Tool to look for several security related Android application vulnerabilities
π¦πβπππΈπππππΈπππβ & βπβ :
With pip (no security checks on requirements):
~ pip install --user qark # --user is only needed if not using a virtualenv
~ qark --help
With requirements.txt (security checks on requirements):
~ git clone https://github.com/linkedin/qark
~ cd qark
~ pip install -r requirements.txt
~ pip install . --user # --user is only needed if not using a virtualenv
~ qark --help
π¦Exploit APK
QARK can generate a basic exploit APK for a few of the vulnerabilities that have been found.
To generate the exploit APK there are a few steps to follow. You need to have the Android SDK v21 and build-tools v21.1.2
1) Install the android SDK, you can get it under the 'command line tools': https://developer.android.com/studio/#downloads
2) Unzip the android SDK
3) Go into the new directory and generate the licenses with bin/sdkmanager --licenses
4) Make sure the generated licenses are in the android SDK directory.
5) Install the SDK and the proper build-tools version: bin/sdkmanager --
6) install "platforms;android-21" "sources;android-21" "build-tools;21.1.2"
π¦Included in the types of security vulnerabilities this tool attempts to find are:
Inadvertently exported components
Improperly protected exported components
Intents which are vulnerable to interception or eavesdropping
Improper x.509 certificate validation
Creation of world-readable or world-writeable files
Activities which may leak data
The use of Sticky Intents
Insecurely created Pending Intents
Sending of insecure Broadcast Intents
Private keys embedded in the source
Weak or improper cryptography use
Potentially exploitable WebView configurations
Exported Preference Activities
Tapjacking
Apps which enable backups
Apps which are debuggable
Apps supporting outdated API versions, with known vulnerabilities
@uNDERCODEtESTING
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
GitHub
GitHub - linkedin/qark: Tool to look for several security related Android application vulnerabilities
Tool to look for several security related Android application vulnerabilities - linkedin/qark
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ 2020 Quickly analyze and reverse engineer Android packages
π¦ ππΌππ πππΈβπ :
FEATURES :
Device info
Intents
Command execution
SQLite references
Logging references
Content providers
Broadcast recievers
Service references
File references
Crypto references
Hardcoded secrets
URL's
Network connections
SSL references
WebView references
π¦ ΝΆUΠ― β β ATκΝΆI
1) git clone https://github.com/1N3/ReverseAPK
2) cd RevereAPK
3) ./install
π¦To use :
reverse-apk <apk name>
@UndercodeOfficial
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦ 2020 Quickly analyze and reverse engineer Android packages
π¦ ππΌππ πππΈβπ :
FEATURES :
Device info
Intents
Command execution
SQLite references
Logging references
Content providers
Broadcast recievers
Service references
File references
Crypto references
Hardcoded secrets
URL's
Network connections
SSL references
WebView references
π¦ ΝΆUΠ― β β ATκΝΆI
1) git clone https://github.com/1N3/ReverseAPK
2) cd RevereAPK
3) ./install
π¦To use :
reverse-apk <apk name>
@UndercodeOfficial
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
GitHub
GitHub - 1N3/ReverseAPK: Quickly analyze and reverse engineer Android packages
Quickly analyze and reverse engineer Android packages - 1N3/ReverseAPK