β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Linux SSH Security Tips
1οΈβ£ Disable blank passwords
Yes. It is possible to have Linux accounts without any passwords. If these users try to use SSH, they will also not need passwords to access the server through SSH.
This is a security risk. You must prohibit the use of blank passwords. In the file / etc / ssh / sshdconfig, be sure to set the PermitEmptyPasswords parameter to no.
PermitEmptyPasswords no
2οΈβ£Change the default SSH ports
The default SSH port is 22, and most test scripts are written for that port only. Changing the default SSH port should add an additional layer of security, as the number of attacks (on port 22) can be reduced.
Find the port information in the configuration file and change it to another:
Port 2345
3οΈβ£ Disable root login via SSH
To be honest, using the server as root itself should be prohibited. This is risky and leaves no trace of an audit. A mechanism like sudo exists only for this reason.
If you have sudo users added to your system, you must use this sudo user to access the server via SSH instead of root.
You can disable root login by changing the PermitRootLogin parameter and setting it as follows:
PermitRootLogin no
4οΈβ£Disable ssh 1 protocol
This is if you are using an older Linux distribution. In some older versions of SSH, SSH 1 may be available. This protocol has known vulnerabilities and should not be used.
In newer versions of SSH, the SSH 2 protocol is automatically enabled, but with a double check this will not hurt.
Protocol 2
5οΈβ£ Set the idle timeout interval
The idle interval is the time during which the SSH connection can remain active without any activity. Such empty sessions also pose a security risk. It is recommended that you set the idle interval.
The timeout interval is counted in seconds and defaults to 0. You can change it to 300 to save a five minute timeout interval.
ClientAliveInterval 300
After this interval, the SSH server will send a valid message to the client. If he does not receive a response, the connection will be closed and the end user will be logged out.
You can also control how many times it sends a live message before disconnecting:
ClientAliveCountMax 2
6οΈβ£Allow SSH access only to selected users
When it comes to security, you must follow the principle of least privilege. Do not be right when it is not required.
You may have several users on your Linux system. Do you need to allow SSH access to all of them? Probably no.
The approach in this case would be to allow SSH access to selected multiple users and thus restrict access to all other users.
AllowUsers User1 User2
You can also add selected users to a new group and allow only this group access to SSH.
AllowGroups sshgroup
You can also use DenyUsers and DenyGroups to restrict SSH access to specific users and groups.
7οΈβ£ Disable X11 Forwarding
The X11 or X display server is the base platform for the graphics environment. Forwarding X11 allows you to use the GUI application through SSH.
Essentially, the client launches the GUI application on the server, but thanks to the X11 transfer between the computers, the channel opens and the GUI applications are displayed on the client computer.
The X11 protocol is not security oriented. If you do not need this, you should disable X11 forwarding to SSH.
X11Forwarding no
8οΈβ£Automatically mitigate brute force attacks
To prevent SSH attacks, you can use a security tool such as Fail2Ban.
Fail2Ban checks for failed login attempts from different IP addresses. If these unsuccessful attempts cross the threshold for a set period of time, this prohibits IP access to SSH for a certain period of time.
You can customize all of these options to suit your preferences and requirements.
9οΈβ£Disable password based on SSH login
No matter how much you try, you will always see unsuccessful login attempts via SSH on your Linux server. Attackers are smart, and the scripts they use often take care of the default settings of Fail2Ban-like tools.
π¦Linux SSH Security Tips
1οΈβ£ Disable blank passwords
Yes. It is possible to have Linux accounts without any passwords. If these users try to use SSH, they will also not need passwords to access the server through SSH.
This is a security risk. You must prohibit the use of blank passwords. In the file / etc / ssh / sshdconfig, be sure to set the PermitEmptyPasswords parameter to no.
PermitEmptyPasswords no
2οΈβ£Change the default SSH ports
The default SSH port is 22, and most test scripts are written for that port only. Changing the default SSH port should add an additional layer of security, as the number of attacks (on port 22) can be reduced.
Find the port information in the configuration file and change it to another:
Port 2345
3οΈβ£ Disable root login via SSH
To be honest, using the server as root itself should be prohibited. This is risky and leaves no trace of an audit. A mechanism like sudo exists only for this reason.
If you have sudo users added to your system, you must use this sudo user to access the server via SSH instead of root.
You can disable root login by changing the PermitRootLogin parameter and setting it as follows:
PermitRootLogin no
4οΈβ£Disable ssh 1 protocol
This is if you are using an older Linux distribution. In some older versions of SSH, SSH 1 may be available. This protocol has known vulnerabilities and should not be used.
In newer versions of SSH, the SSH 2 protocol is automatically enabled, but with a double check this will not hurt.
Protocol 2
5οΈβ£ Set the idle timeout interval
The idle interval is the time during which the SSH connection can remain active without any activity. Such empty sessions also pose a security risk. It is recommended that you set the idle interval.
The timeout interval is counted in seconds and defaults to 0. You can change it to 300 to save a five minute timeout interval.
ClientAliveInterval 300
After this interval, the SSH server will send a valid message to the client. If he does not receive a response, the connection will be closed and the end user will be logged out.
You can also control how many times it sends a live message before disconnecting:
ClientAliveCountMax 2
6οΈβ£Allow SSH access only to selected users
When it comes to security, you must follow the principle of least privilege. Do not be right when it is not required.
You may have several users on your Linux system. Do you need to allow SSH access to all of them? Probably no.
The approach in this case would be to allow SSH access to selected multiple users and thus restrict access to all other users.
AllowUsers User1 User2
You can also add selected users to a new group and allow only this group access to SSH.
AllowGroups sshgroup
You can also use DenyUsers and DenyGroups to restrict SSH access to specific users and groups.
7οΈβ£ Disable X11 Forwarding
The X11 or X display server is the base platform for the graphics environment. Forwarding X11 allows you to use the GUI application through SSH.
Essentially, the client launches the GUI application on the server, but thanks to the X11 transfer between the computers, the channel opens and the GUI applications are displayed on the client computer.
The X11 protocol is not security oriented. If you do not need this, you should disable X11 forwarding to SSH.
X11Forwarding no
8οΈβ£Automatically mitigate brute force attacks
To prevent SSH attacks, you can use a security tool such as Fail2Ban.
Fail2Ban checks for failed login attempts from different IP addresses. If these unsuccessful attempts cross the threshold for a set period of time, this prohibits IP access to SSH for a certain period of time.
You can customize all of these options to suit your preferences and requirements.
9οΈβ£Disable password based on SSH login
No matter how much you try, you will always see unsuccessful login attempts via SSH on your Linux server. Attackers are smart, and the scripts they use often take care of the default settings of Fail2Ban-like tools.
The Dark Side of _Manual Work is a Bug_.pdf
293.9 KB
The Dark Side of _Manual Work is a Bug_
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦Microsoft Edge silently imports Firefox data without permission
#UndercodeNews
> Some users found that the new version of Edge updated to the device through Windows Update will import data from Firefox, even if the user does not authorize Edge to do this.
> According to krankie 's description, Microsoft designed some elements in the UI to "deceive and mislead" users. After updating the system, after the Edge installation is complete, Microsoft will display a maximized Edge window to the user, but it will first pop up a modal dialog box containing only the "Get Started" button.
> Therefore, the user cannot close Edge directly or close the modal dialog box. The only option is to use the task manager to kill this process. But even if you close it, Edge will be automatically fixed to the taskbar.
> Finally, he also mentioned that the new version of Edge imports data from other browsers without user permission.
"Unless you close it through the task manager instead of performing a forced setting, it will copy the data anyway, the worst thing is that most people will never know what Edge is doing, because they will never open it again."
> In addition, Microsoft will cancel the system's default browser settings, so when the user clicks on a URL, they need to re-select the default browser.
> Microsoft has been silent on this. Therefore, although the original wizard was actually manually killed by the user, so far, the reason for importing Edge data into Firefox data is still unknown.
@UndercodeNews
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Microsoft Edge silently imports Firefox data without permission
#UndercodeNews
> Some users found that the new version of Edge updated to the device through Windows Update will import data from Firefox, even if the user does not authorize Edge to do this.
> According to krankie 's description, Microsoft designed some elements in the UI to "deceive and mislead" users. After updating the system, after the Edge installation is complete, Microsoft will display a maximized Edge window to the user, but it will first pop up a modal dialog box containing only the "Get Started" button.
> Therefore, the user cannot close Edge directly or close the modal dialog box. The only option is to use the task manager to kill this process. But even if you close it, Edge will be automatically fixed to the taskbar.
> Finally, he also mentioned that the new version of Edge imports data from other browsers without user permission.
"Unless you close it through the task manager instead of performing a forced setting, it will copy the data anyway, the worst thing is that most people will never know what Edge is doing, because they will never open it again."
> In addition, Microsoft will cancel the system's default browser settings, so when the user clicks on a URL, they need to re-select the default browser.
> Microsoft has been silent on this. Therefore, although the original wizard was actually manually killed by the user, so far, the reason for importing Edge data into Firefox data is still unknown.
@UndercodeNews
β β β Uππ»βΊπ«Δπ¬πβ β β β
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦#Terms & #FastTips about Windows servers
> HTTP
This is a web server.
> SMB
The SMB protocol provides the file server on the local network .
> MSSQL
Database management system.
> FTP
A protocol that provides the operation of a file server.
> LDAP
LDAP (Lightweight Directory Access Protocol) is an application layer protocol for accessing the X.500 directory service developed by the IETF as a lightweight version of the ITU-T DAP protocol. LDAP is a relatively simple protocol that uses TCP / IP and allows authentication (bind), search (search) and comparison (compare), as well as the operation of adding, changing or deleting records. Typically, an LDAP server accepts incoming connections to port 389 over TCP or UDP. SSL encapsulated LDAP sessions typically use port 636.
Share usβ€οΈππ»
written by
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦#Terms & #FastTips about Windows servers
> HTTP
This is a web server.
> SMB
The SMB protocol provides the file server on the local network .
> MSSQL
Database management system.
> FTP
A protocol that provides the operation of a file server.
> LDAP
LDAP (Lightweight Directory Access Protocol) is an application layer protocol for accessing the X.500 directory service developed by the IETF as a lightweight version of the ITU-T DAP protocol. LDAP is a relatively simple protocol that uses TCP / IP and allows authentication (bind), search (search) and comparison (compare), as well as the operation of adding, changing or deleting records. Typically, an LDAP server accepts incoming connections to port 389 over TCP or UDP. SSL encapsulated LDAP sessions typically use port 636.
Share usβ€οΈππ»
written by
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
Performing Domain Reconnaissance Using PowerShell .pdf
182.9 KB
Written Tutorial
pdf- Performing Domain Reconnaissance Using PowerShellβ β β Uππ»βΊπ«6π¬πβ β β β
π¦In the authentication scheme implemented using SMB or SMB2 messages, regardless of what kind of authentication dialect will be used (LM, LMv2, NTLM, NTLM2, NTLMv2), the authentication process proceeds as follows:
#WindowsServer
1οΈβ£The client tries to establish a connection with the server and sends a request in which it informs the server in which dialects it is able to authenticate, for example: LM, NTLM, NTLM2, NTLMv2. Therefore, the dialect of LMv2 authentication between the client and server is excluded.
2οΈβ£The server from the dialect list received from the client (by default) selects the most secure dialect (for example, NTLMv2), then sends a response to the client.
3οΈβ£The client, having decided on the dialect of authentication, tries to access the server and sends a request to NEGOTIATE-MESSAGE.
4οΈβ£The server receives a request from the client and sends it a response CHALLENGEMESSAGE, which contains a random sequence of 8 bytes. It is called Server Challenge.
5οΈβ£The client, having received the Server Challenge sequence from the server, encrypts this sequence with its password, and then sends the server an AUTHENTICATEMESSAGE response that contains 24 bytes.
6οΈβ£When the server receives the response, it performs the same encryption operation of the Server Challenge sequence as the client performed. Then, comparing your results with the response from the client, on the basis of a match, allows or denies access.
Share usβ€οΈππ»
written by
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
β β β Uππ»βΊπ«6π¬πβ β β β
π¦In the authentication scheme implemented using SMB or SMB2 messages, regardless of what kind of authentication dialect will be used (LM, LMv2, NTLM, NTLM2, NTLMv2), the authentication process proceeds as follows:
#WindowsServer
1οΈβ£The client tries to establish a connection with the server and sends a request in which it informs the server in which dialects it is able to authenticate, for example: LM, NTLM, NTLM2, NTLMv2. Therefore, the dialect of LMv2 authentication between the client and server is excluded.
2οΈβ£The server from the dialect list received from the client (by default) selects the most secure dialect (for example, NTLMv2), then sends a response to the client.
3οΈβ£The client, having decided on the dialect of authentication, tries to access the server and sends a request to NEGOTIATE-MESSAGE.
4οΈβ£The server receives a request from the client and sends it a response CHALLENGEMESSAGE, which contains a random sequence of 8 bytes. It is called Server Challenge.
5οΈβ£The client, having received the Server Challenge sequence from the server, encrypts this sequence with its password, and then sends the server an AUTHENTICATEMESSAGE response that contains 24 bytes.
6οΈβ£When the server receives the response, it performs the same encryption operation of the Server Challenge sequence as the client performed. Then, comparing your results with the response from the client, on the basis of a match, allows or denies access.
Share usβ€οΈππ»
written by
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
β β β Uππ»βΊπ«6π¬πβ β β β
β β β Uππ»βΊπ«6π¬πβ β β β
π¦What is NBT-NS ?
#WindowsServer
> NBT-NS is NetBIOS-NS , i.e. NetBIOS Name Service.
The NetBIOS Name Service is one of three NetBIOS services: a name service (NetBIOS-NS) for registering and resolving names.
> To start sessions or distribute datagrams, the application must register its NetBIOS name using the name service. NetBIOS names are 16 octets in length and vary by implementation.
> Often the 16th octet, called the NetBIOS suffix, indicates the type of resource and can be used to tell other applications which type of service the system offers. In NBT, the name service runs on UDP port 137 (TCP port 137 can also be used, but is rarely used).
π¦NetBIOS name service primitives:
1οΈβ£Add name - Register a NetBIOS name.
2οΈβ£Add group name - Register the NetBIOS name of the group.
3οΈβ£Delete name - Unregisters the NetBIOS name or group name.
4οΈβ£Find name - Search for a NetBIOS name on the network.
written by
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦What is NBT-NS ?
#WindowsServer
> NBT-NS is NetBIOS-NS , i.e. NetBIOS Name Service.
The NetBIOS Name Service is one of three NetBIOS services: a name service (NetBIOS-NS) for registering and resolving names.
> To start sessions or distribute datagrams, the application must register its NetBIOS name using the name service. NetBIOS names are 16 octets in length and vary by implementation.
> Often the 16th octet, called the NetBIOS suffix, indicates the type of resource and can be used to tell other applications which type of service the system offers. In NBT, the name service runs on UDP port 137 (TCP port 137 can also be used, but is rarely used).
π¦NetBIOS name service primitives:
1οΈβ£Add name - Register a NetBIOS name.
2οΈβ£Add group name - Register the NetBIOS name of the group.
3οΈβ£Delete name - Unregisters the NetBIOS name or group name.
4οΈβ£Find name - Search for a NetBIOS name on the network.
NetBIOS name resolution is not supported by Microsoft for Internet Protocol Version 6 (IPv6).
Share usβ€οΈππ»written by
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β Uππ»βΊπ«6π¬πβ β β β
π¦There are two ways to redirect traffic for this attack on the local network:
#FastTips
βARP spoofing . During this attack, the computer of the attacker sends out false messages to the ARP packet that the MAC address of the router is the MAC address of the computer of the attacker. As a result, computers on the local network start sending network packets through the attacker's computer. This is a universal option that is suitable in all cases.
βDNS spoofing . The point is in replacing answers to DNS queries, as a result, the victim's computer will receive the wrong IP addresses for the requested hosts. This option is suitable only if the connection to the remote SSH server is performed by the host name, for example:
<font style="vertical-align: inherit;"><font style="vertical-align: inherit;">ssh root@web.site</font></font>
Share usβ€οΈππ»
written by
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦There are two ways to redirect traffic for this attack on the local network:
#FastTips
βARP spoofing . During this attack, the computer of the attacker sends out false messages to the ARP packet that the MAC address of the router is the MAC address of the computer of the attacker. As a result, computers on the local network start sending network packets through the attacker's computer. This is a universal option that is suitable in all cases.
βDNS spoofing . The point is in replacing answers to DNS queries, as a result, the victim's computer will receive the wrong IP addresses for the requested hosts. This option is suitable only if the connection to the remote SSH server is performed by the host name, for example:
<font style="vertical-align: inherit;"><font style="vertical-align: inherit;">ssh root@web.site</font></font>
command)> DNS spoofing can be performed during a man-in-the-middle attack, or using a fraudulent DNS server (in this case, the IP address of the fraudulent DNS server will need to be set in the router or on the victimβs computer .
Share usβ€οΈππ»
written by
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β Uππ»βΊπ«6π¬πβ β β β
π¦How to intercept SSH password ??
#FastTips
The SSH protocol allows you to connect to another computer to execute commands on it and transfer files. SSH uses strong encryption, so the transmitted network traffic cannot be decrypted or modified.
π¦In SSH, you can use two methods to enter the remote computer:
1οΈβ£enter user password on the remote system
2οΈβ£public key authentication
π¦If you are logged in with a password, you can imagine the following attack scenario:
1οΈβ£user traffic is redirected to the attacking machine
2οΈβ£the attacker monitors attempts to connect to the SSH server and redirects them to its SSH server
3οΈβ£The attacker's SSH server is configured, firstly, to keep a log of all entered data, including the user's password, and, secondly, send commands to the legitimate SSH server to which the user wants to connect, to execute them, and then return the results to the legitimate user
π¦The SSH MITM tool consists of several components:
1οΈβ£modified ssh server
2οΈβ£auxiliary scripts to perform related actions: detect SSH connections, ARP spoofing and traffic sniffing, port forwarding.
In The following operation, SSH MITM uses the following tools (make sure that they are installed on your system):
> tshark ( Wireshark command-line version )
> ettercap (used only for ARP spoofing, so you can use arpspoof instead )
> nmap
> iptables
written by
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦How to intercept SSH password ??
#FastTips
The SSH protocol allows you to connect to another computer to execute commands on it and transfer files. SSH uses strong encryption, so the transmitted network traffic cannot be decrypted or modified.
π¦In SSH, you can use two methods to enter the remote computer:
1οΈβ£enter user password on the remote system
2οΈβ£public key authentication
π¦If you are logged in with a password, you can imagine the following attack scenario:
1οΈβ£user traffic is redirected to the attacking machine
2οΈβ£the attacker monitors attempts to connect to the SSH server and redirects them to its SSH server
3οΈβ£The attacker's SSH server is configured, firstly, to keep a log of all entered data, including the user's password, and, secondly, send commands to the legitimate SSH server to which the user wants to connect, to execute them, and then return the results to the legitimate user
π¦The SSH MITM tool consists of several components:
1οΈβ£modified ssh server
2οΈβ£auxiliary scripts to perform related actions: detect SSH connections, ARP spoofing and traffic sniffing, port forwarding.
In The following operation, SSH MITM uses the following tools (make sure that they are installed on your system):
> tshark ( Wireshark command-line version )
> ettercap (used only for ARP spoofing, so you can use arpspoof instead )
> nmap
> iptables
(avaible pre installed on major of Linux os-)
Share usβ€οΈππ»written by
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β Uππ»βΊπ«6π¬πβ β β β
π¦#ExpertTip -if you have a fast server VPN Connection Must Be :
1οΈβ£The source port is bits 0-15. This is the packet source port that describes where the response packet should be sent. It can actually be set to zero if the port value is not applicable. For example, sometimes we do not need a response packet, then the packet can be installed on the zero port of the source. In most implementations, it is set to some port number.
2οΈβ£Destination port - bits 16-31. The destination port of the packet. This is required for all packets, unlike the packet source port.
As with the TCP protocol, one of the standard ports is usually used for the server (for example, port 53 for DNS servers), and the source port is selected arbitrarily for each connection, usually these are port numbers with a large number (tens of thousands).
3οΈβ£Length - bits 32-47. The length field indicates the length of the entire packet in octets, including the header and parts of the data. The shortest packet possible can be 8 octets long.
A field specifying the length of the entire datagram (header and data) in bytes. The minimum length is equal to the length of the header - 8 bytes. Theoretically, the maximum field size is 65535 bytes for a UDP datagram (8 bytes per header and 65527 per data). The actual limit for data length when using IPv4 is 65507 (in addition to 8 bytes per UDP header, another 20 by IP header is required).
4οΈβ£The checksum is bits 48-63. The checksum is the same checksum as in the TCP header, except that it contains a different data set. In other words, this is in addition to the sum of the extra parts of the IP header, the entire UDP header, UDP data, and the padding at the end when necessary.
written by
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦#ExpertTip -if you have a fast server VPN Connection Must Be :
1οΈβ£The source port is bits 0-15. This is the packet source port that describes where the response packet should be sent. It can actually be set to zero if the port value is not applicable. For example, sometimes we do not need a response packet, then the packet can be installed on the zero port of the source. In most implementations, it is set to some port number.
2οΈβ£Destination port - bits 16-31. The destination port of the packet. This is required for all packets, unlike the packet source port.
As with the TCP protocol, one of the standard ports is usually used for the server (for example, port 53 for DNS servers), and the source port is selected arbitrarily for each connection, usually these are port numbers with a large number (tens of thousands).
3οΈβ£Length - bits 32-47. The length field indicates the length of the entire packet in octets, including the header and parts of the data. The shortest packet possible can be 8 octets long.
A field specifying the length of the entire datagram (header and data) in bytes. The minimum length is equal to the length of the header - 8 bytes. Theoretically, the maximum field size is 65535 bytes for a UDP datagram (8 bytes per header and 65527 per data). The actual limit for data length when using IPv4 is 65507 (in addition to 8 bytes per UDP header, another 20 by IP header is required).
4οΈβ£The checksum is bits 48-63. The checksum is the same checksum as in the TCP header, except that it contains a different data set. In other words, this is in addition to the sum of the extra parts of the IP header, the entire UDP header, UDP data, and the padding at the end when necessary.
>The checksum field is used to check the header and data for errors. If the sum is not generated by the transmitter, then the field is filled with zeros. This field is optional for IPv4.
Share usβ€οΈππ»written by
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β Uππ»βΊπ«6π¬πβ β β β
π¦How spam facebook message ?
πΈπ½π π π°π»π»πΈπ π°π πΈπΎπ½ & π π π½ :
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
π¦How spam facebook message ?
πΈπ½π π π°π»π»πΈπ π°π πΈπΎπ½ & π π π½ :
1οΈβ£pkg install updateShare usβ€οΈππ»
2οΈβ£pkg install upgrade
3οΈβ£pkg install git
4οΈβ£pkg install python2
5οΈβ£pip2 install --upgrade pip
6οΈβ£git clone https://github.com/errorBrain/spamchat.git
7οΈβ£cd Spamchat
8οΈβ£pip2 install -r requirements.txt
9οΈβ£python2 messenger.py
πsetup message
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
β β β ο½ππ»βΊπ«Δπ¬πβ β β β
β β β Uππ»βΊπ«6π¬πβ β β β
π¦HttpLiveProxyGrabber termux-linux
#ToolsforNoobs
πΈπ½π π π°π»π»πΈπ π°π πΈπΎπ½ & π π π½ :
π¦HttpLiveProxyGrabber termux-linux
#ToolsforNoobs
πΈπ½π π π°π»π»πΈπ π°π πΈπΎπ½ & π π π½ :
1οΈβ£git clone https://github.com/04x/HttpLiveProxyGrabber.gitβ β β ο½ππ»βΊπ«Δπ¬πβ β β β
2οΈβ£cd HttpLiveProxyGrabber
3οΈβ£python2 ProxGrab.py
4οΈβ£Choose options via numbers
β β β Uππ»βΊπ«6π¬πβ β β β
π¦Some of the vulnerabilities in a web application that contains DVWA;
#FastTips :
1οΈβ£Brute force : Brute force HTTP form login page; used to test brute force password attack tools and shows the insecurity of weak passwords.
2οΈβ£Execution (implementation) of commands : Execution of commands at the operating system level.
3οΈβ£Cross-Site Request Forgery (CSRF): Allows the attacker to change the application administrator password.
4οΈβ£File Inclusion : Allows an βattackerβ to attach remote / local files to a web application.
5οΈβ£SQL injection: Allows an βattackerβ to inject SQL expressions into HTTP from the input field; DVWA includes blind and error-based SQL injection.
Insecure file upload : Allows an βattackerβ to upload malicious files to a web server.
6οΈβ£Cross Site Scripting (XSS) : Attacker can embed its scripts in a web application / database. DVWA includes mirrored and stored XSS.
7οΈβ£Easter eggs: revealing full paths, authentication bypass, and some others.
Homepage: http://dvwa.co.uk/
Share usβ€οΈππ»
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
β β β Uππ»βΊπ«6π¬πβ β β β
π¦Some of the vulnerabilities in a web application that contains DVWA;
#FastTips :
1οΈβ£Brute force : Brute force HTTP form login page; used to test brute force password attack tools and shows the insecurity of weak passwords.
2οΈβ£Execution (implementation) of commands : Execution of commands at the operating system level.
3οΈβ£Cross-Site Request Forgery (CSRF): Allows the attacker to change the application administrator password.
4οΈβ£File Inclusion : Allows an βattackerβ to attach remote / local files to a web application.
5οΈβ£SQL injection: Allows an βattackerβ to inject SQL expressions into HTTP from the input field; DVWA includes blind and error-based SQL injection.
Insecure file upload : Allows an βattackerβ to upload malicious files to a web server.
6οΈβ£Cross Site Scripting (XSS) : Attacker can embed its scripts in a web application / database. DVWA includes mirrored and stored XSS.
7οΈβ£Easter eggs: revealing full paths, authentication bypass, and some others.
Homepage: http://dvwa.co.uk/
Share usβ€οΈππ»
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
β β β Uππ»βΊπ«6π¬πβ β β β
Forwarded from Free Premium Accounts Telegram Channel - Netflix - Spotify
Please open Telegram to view this post
VIEW IN TELEGRAM
Forwarded from Free Premium Accounts Telegram Channel - Netflix - Spotify
Please open Telegram to view this post
VIEW IN TELEGRAM
Forwarded from Free Premium Accounts Telegram Channel - Netflix - Spotify
Please open Telegram to view this post
VIEW IN TELEGRAM
Forwarded from UNDERCODE SECURITY