▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Disable SSH Password Authentication in linux :

»Disabling password authentication adds an extra layer of security to your server.

Before disabling SSH password authentication, make sure you can log into your server without a password, and the user you log in with has sudo privileges .

1) Login to your remote server:

ssh sudouser @ serveripaddress


2) Open the SSH configuration file in a text editor :

sudo nano / etc / ssh / sshdconfig


3) Find the following directives and change them as follows:

/ etc / ssh / sshd_config
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM no

4)After that save the file and restart the SSH service by typing:

sudo systemctl restart ssh


5) At this point, password-based authentication is disabled.

E N J O Y ❤️👍🏻
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

HA Rudra_ Vulnhub Walkthrough
FULL WITH PICTURES

Initial Compromise
LFI
Established Foothold
Netcat session
Internal Recon
Access Mysql database
Data Exfiltration
Steganography
Lateral Movement
Connect to ssh
Privilege Escalation
Sudo rights

E N J O Y❤️👍🏻

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 Checking tool for Hash codes, Passwords, and Emails leaked, using leakz module from Aidan Holland, which uses API from Aurelius Wendelken.

🦑F E A T U R E S :

-Grabb email passwords NEW!
-Check passwords leaked.
-Check hash code leaked.
-Check email leaked!

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1) sudo apt update && sudo apt install python3 python3-pip

2) git clone https://github.com/GitHackTools/Leaked

3) cd Leaked

4) bash install_update.sh

5) python3 leaked.py

🦑Install and Run on Windows

1) Download and run Python 3 setup file from Python.org. In Install Python 3 , enable Add Python 3.7 to PATH and For all users

2) Download and run Git setup file from Git-scm.com, choose Use Git from Windows Command Propmt.

3) After that, Run Command Propmt or PowerShell and enter these commands:

4) git clone https://github.com/GitHackTools/Leaked

5) cd Leaked

6) ./install_update.bat

7) python leaked.py

8) choose options via numbers

E N J O Y ❤️👍🏻
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

Respecting Lebanon & Lebanese here...

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑The clickjacking attack :

1) The “clickjacking” attack allows an evil page to click on a “victim site” on behalf of the visitor.

2) Many sites were hacked this way, including Twitter, Facebook, Paypal and other sites. They have all been fixed, of course.

The idea
The idea is very simple.

3) Here’s how clickjacking was done with Facebook:

E X A M P L E :

4) A visitor is lured to the evil page. It doesn’t matter how.
The page has a harmless-looking link on it (like “get rich now” or “click here, very funny”).

5) Over that link the evil page positions a transparent <iframe> with src from facebook.com, in such a way that the “Like” button is right above that link. Usually that’s done with z-index.

6) In attempting to click the link, the visitor in fact clicks the button.
The demo

7) Here’s how the evil page looks. To make things clear, the <iframe> is half-transparent (in real evil pages it’s fully transparent):

<style>
iframe { /* iframe from the victim site */
  width: 400px;
  height: 100px;
  position: absolute;
  top:0; left:-20px;
  opacity: 0.5; /* in real opacity:0 */
  z-index: 1;
}
</style>

<div>Click to get rich now:</div>

<!-- The url from the victim site -->
<iframe src="/clickjacking/facebook.html"></iframe>

<button>Click here!</button>

<div>...And you're cool (I'm a cool hacker actually)!</div>

E N J O Y ❤️👍🏻
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑How to set up a black and white list of web pages and prohibit computers from accessing certain websites

1) Control the USB port. It is forbidden to connect the computer to USB storage devices (U disk, mobile phone, tablet, mobile hard disk, SD card, USB optical drive, etc.), but does not control USB non-storage devices, such as mouse, keyboard, etc. You can also set a specific USB storage device, that is, the computer can only recognize the USB storage device, and you can also set this specific storage device to only copy files to the computer, but not from the computer to it. You can also set a password to copy files.

2) Control the transmission of files from the external network. It is forbidden to send files through the external network, including: setting a specific QQ account to log in or allowing QQ chat, prohibiting QQ uploading files, prohibiting QQ group uploading files, allowing WeChat chatting, prohibiting WeChat uploading files, prohibiting the use of network disks, prohibiting the use of cloud disks, and prohibiting Use mailboxes, prohibit the use of FTP, prohibit the use of any network application to transfer files, etc.

3) Control the transmission of files in the intranet. It is forbidden to use any intranet communication tools, such as Fei Ge, Fei Qiu, etc., and it can also prohibit LAN communication, network sharing, and network cable transmission of computer files.

4) Other methods. It is prohibited to use Bluetooth to send files, prohibit the use of infrared to send files, prohibit computers to install portable wifi to send files, prohibit computers to install wireless routers to send computer files, prohibit computers to install virtual machines to send files, prohibit remote desktops to send computer files, prohibit the use of clipboards, Screenshots etc. are prohibited.

E N J O Y ❤️👍🏻
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑FastTips SqlMap for #termux :

1) apt-get update

2) apt-get upgrade

3) pkg install perl

4) pkg install python2

5) pkg install git

6) git clone https://github.com/sqlmapproject/sqlmap

7) cd sqlmap

8) python2 swlmap.py

9) python2 sqlmap.py -u #website_link --dbs

10) python2 sqlmap.py -u #website_link --dbs --columns

@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Apple Touch ID vulnerability could allow attackers to hijack iCloud account
#NEWS


> Earlier this year, Apple fixes iOS and a macOS the security vulnerability , the vulnerability could allow an attacker to gain unauthorized access to a user's iCloud account.

> This Alkemade, a security expert at IT security company Computest, discovered the vulnerability in February. The vulnerability exists in the TouchID (or FaceID) biometric feature implemented by Apple, which authenticates users to log in to websites on Safari. These are the websites that use Apple ID to log in. After the vulnerability was reported to Apple through the disclosure program, the iPhone manufacturer resolved the vulnerability in a server-side update .

🦑Certification defects :
The core of the vulnerability is: when a user tries to log in to a website that requires Apple ID, it will be prompted to use Touch ID to authenticate the login. Doing so will skip the two-factor authentication step, because it already uses multiple factors for identification, such as equipment and biometric information. When logging in to an Apple domain (such as "icloud.com"), ID and password are usually used for comparison. The website embeds an iframe pointing to Apple’s login authentication server ("https://idmsa.apple.com"). Handle the authentication process.

#NEWS
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑What is Webmin

Simply put, Webmin is a Web-based Unix system management tool. The administrator accesses various management functions of Webmin through the browser and completes the corresponding management actions. At present, Webmin supports most Unix systems. In addition to various versions of Linux, these systems also include: AIX, HPUX, Solaris, Unixware, Irix and FreeBSD.

🦑Compared with other GUI management tools, Webmin has the following significant advantages:

* Web management method enables Webmin to have both local and remote management capabilities;
* Plug-in structure makes Webmin have strong scalability and flexibility. At present, the standard management modules provided by Webmin almost cover common Unix management, and third-party management modules are constantly being developed;
* Access control and SSL support provide sufficient security for remote management;
* Internationalization support, providing multi-language version

is installed Webmin

some linux distributions have been pre-installed Webmin, such as OpenLinux and soft Linux. If your Linux version does not include Webmin, you can download Webmin's RPM package and TARBALL to install.

🦑The following are the installation steps of TAR BALL:

* To install Webmin, you need to install perl 5.0.6 or above. If perl is not installed on the target system, you need to download and install {perl-for-linux} from http://www.cpan.org, and also need to install common perl modules; if you need Webmin to support SSL, you also need to install OpenSSL and perl module Net::SSLeay.
* Go to http://www.webmin.com/ to download webmin-0.91.tar.gz
* Unpack webmin-0.91.tar.gz to the directory where you want to install Webmin, such as /usr/local/webmin
* Run the installation script setup.pl. The installation process will ask for the Webmin configuration file directory, the Log directory and the system's listening port (the default is 10000), and you will also be asked to set the administrator password. The installation script will also install Webmin as a system daemon, which is automatically started when the system is turned on.
* Restart the system and visit http://localhost:10000. If the login interface of Webmin appears, the installation is successful.

🦑Webmin using UNIX system management

has already been said, all management functions are inserted in the form of a module in Webmin. Webmin categorizes various management modules. The main categories are: Webmin, systems, services, hardware and others. When you successfully log in to the home page of Webmin, these categories will be displayed in front of you in different property pages. The picture below is the home page of a Webmin server.

written by
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 how to determine the first matching record, which is not based on the natural order of the records in the data table. definite. The priority of each record in each data table is arranged as follows:
#ProTips

(1) User table: Determined according to the order of host first and user. The search rules are as follows: records that do not contain wildcard characters, records that contain wildcard characters, and empty records. In the same host, continue to arrange according to user, the rules are the same as above.

(2) db table: the order of retrieval is determined by the host field: records that do not contain wildcards, records that contain wildcards, and empty records.

(3) Host table: The search order is determined according to the host field: records that do not contain wildcards, records that contain wildcards, and empty records. We use the following example to illustrate the rules for matching search:

Please remember that if you change these data tables, you must use mysqladmin reload to make it effective.

The following is how the system performs the search:

+-----------+---------+-
| Host | User | ...
+-----------+---------+-
|% | root | ...
|% | jeffrey | ...
| localhost | root | ...
| localhost | | ...
+-----------+---------+- The

🦑search order should be:

localhost/root
localhost/any
any/jeffrey
any/root
like this, if If the user jeffrey on localhost wants to connect to the database, his authorization should be based on the permissions specified in the localhost/"any" line instead of the permissions specified in the "any"/jeffrey line. Please pay attention to this point, because if the configuration is not appropriate It may make you unable to use this database system normally.


written by
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Follow Undercode Testing on :

> Twitter
> Twitter

> instagram

> Facebook

> Pinterest

> Linkedln

> Youtube

> Telegram

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑webdav command line interface is really easy to use so you can easily create a WebDAV server for your own user.

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1)git clone https://github.com/hacdias/webdav.git

2) By default, it runs on a random free port and supports JSON, YAML and TOML configuration. An example of a YAML configuration with the default configurations:

3) # Server related settings
address: 0.0.0.0
port: 0
auth: true
tls: false
cert: cert.pem
key: key.pem
prefix: /

4) # Default user settings (will be merged)
scope: .
modify: true
rules: []

5) # CORS configuration
cors:
enabled: true
credentials: true
allowed_headers:
- Depth
allowed_hosts:
- http://localhost:8080
allowed_methods:
- GET
exposed_headers:
- Content-Length
- Content-Range

6) users:
- username: admin
password: admin
scope: /a/different/path
- username: encrypted
password: "{bcrypt}$2y$10$zEP6oofmXFeHaeMfBNLnP.DO8m.H.Mwhd24/TOX2MWLxAExXi4qgi"
- username: "{env}ENV_USERNAME"
password: "{env}ENV_PASSWORD"
- username: basic
password: basic
modify: false
rules:
- regex: false
allow: false
path: /some/file

7) There are more ways to customize how you run WebDAV through flags and environment variables. Please run webdav --help for more information on that.

8) CORS
The allowed_* properties are optional, the default value for each of them will be *. exposed_headers is optional as well, but is not set if not defined. Setting credentials to true will allow you to:

▪️Use withCredentials = true in javascript.
▪️Use the username:password@host syntax.

E N J O Y ❤️👍🏻
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁