▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Crack mysql root password :

Windows:

1) Log in to the system with the system administrator.

2) Stop the MySQL service.

3) Enter the command window, and then enter the MySQL installation directory, for example, my installation directory is c:\mysql, enter C:\mysql\bin

4) Skip the permission check to start MySQL,
c:\mysql\bin>mysqld-nt --skip-grant-tables

5) Reopen a window, enter the c:\mysql\bin directory, and set the new root password

 c:\mysql\bin>mysqladmin -u root flush-privileges password "newpassword"

>c:\mysql \bin>mysqladmin -u root -p shutdown

6) replace newpassword with the root password you want to use. The second command will prompt you to enter the new password. Repeat the password entered in the first command.

7) Stop MySQL Server and start Mysql in normal mode

@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

Windows hacking with pictures :)

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Hack email accounts or passwords using session cookie :

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

A) UNDERSTANDING :

1) Cookies spoofing is to obtain the corresponding user permission to log in by modifying the content of Cookies in a system that only authenticates users with Cookies.

🦑 So what are Cookies?

<> Let me give you a professional explanation. Cookies is a text file stored in the browser directory, which records the information about your visit to a specific site, and can only be read back by the site that created the Cookie. It consists of 255 characters and only occupies 4KB of hard disk space. When the user is browsing a certain site, it is stored in the random access memory RAM of the user machine, and after exiting the browser, it is stored in the user's hard disk. Most of the information stored in Cookies is common

Second, principle analysis

B ) A T T A C K :

Let's first take a look at how 6kbbs is done. In login.asp we find 113-124 lines, look here : ))

if login=false then tl=" login failed" mes=mes&"
·Return to fill in "else Response.Cookies(prefix)("lgname")
=lgname session(prefix"lgname")=
lgname Response.Cookies(prefix)("lgpwd")=
lgpwd Response.Cookies(prefix)("lgtype")=
lgtype Response.Cookies(prefix)("lgcook")=
cook if cook>0 then Response.Cookies(prefix).Expires=
date+cook end if

3) Let me change the meaning of this passage. If you fail to log in, it will show you login failed and lead you back to the previous page, otherwise it will be written into Cookies for you. If your Cookies have it, then yours The expiration time is the expiration time of your cookies-that is, the time you save the cookies.

4) now I take 6kbbs as an example, and assume that you have already obtained the website database or the administrator's MD5 encrypted password. How to get it, go to the search engine to search for the keyword "powered by 6kbbs", and then you will see a lot of 6kbbs websites.

5) Open IECookiesView, this software is used to view and modify the cookies of this machine, which is very convenient for our cookies to deceive and invade.

N O T E S :

<> The deception of this undercode tutorial can only get the front-end administrator authority, the back-end needs to enter a password, and it is Session authentication, not Cookies, so we can't deceive.

<> Cookies spoofing exists in a large number of current programs that do not do Session verification. So, if you get the database or administrator encryption password, you might as well try Cookies spoofing, it will have unexpected effects.

E N J O Y ❤️👍🏻
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑2020 apps FOR SHOWING WIFI SAVED PASSWORD :

Download it from https://play.google.com/store/apps/details?id=com.doionline.wifipasswordrecovery&hl=en_US

Download it from https://wifi-password-root.en.uptodown.com/android

Download it from https://play.google.com/store/apps/details?id=com.sbacham.srinu.showwifipassword2017&hl=en_US

Download it from https://play.google.com/store/apps/details?id=com.matic.showwifipassword&hl=en

🦑for windows :

https://wifi-password-revealer.en.uptodown.com/windows

@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑BEST TORRENT SITES FOR MOVIES :

> https://thepiratebay10.org

> https://rarbg.to/index70.php

> https://1337x.to/

> https://torrentz2.eu/ (sometimes down)

> http://www.yts.am/

> https://eztv.io/

> https://zooqle.com/

> https://zooqle.com/

> https://torrentdownloads.mrunblock.xyz/

> https://www.limetorrents.info/

N O T E :

you can.t download without any torrent client app ;)

E N J O Y ❤️👍🏻
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑A powerful and useful hacker dictionary builder for a brute-force attack

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1) git clone --depth=1 --branch=master https://www.github.com/landgrey/
pydictor.git

2) cd pydictor/

3) chmod +x pydictor.py

4) python pydictor.py

5) choose options as shown in picture :)

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

#News
Threat Post reported that: Chromium kernel-based browsers have been exposed to a content security policy (CSP) vulnerability that can be bypassed, leaving billions of users vulnerable to attackers to steal data and execute malicious code. PerimeterX network security researcher Gal Weizman pointed out that the vulnerability (CVE-2020-6519) can be found in Chrome browsers for Windows, Mac and Android, as well as Opera and Edge.

>It is reported that as a Web standard, the Content Security Policy (CSP) is designed to prevent certain types of attacks, such as cross-site scripting (XSS) and data-injection.

CSP allows web administrators to specify the effective source range of scripts executable by browsers, so that browsers compatible with the standard only execute script loading operations from trusted sources.

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑With Django Hijack, admins can log in and work on behalf of other users without having to know their credentials

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1) Get the latest stable release from PyPi:

pip install django-hijack

2) In your settings.py, add hijack and the dependency compat to your installed apps:

INSTALLEDAPPS = (
...,
'hijack',
'compat',
)

3) Finally, add the Django Hijack URLs to urls.py:

urlpatterns = [
...
url(r'^hijack/', include('hijack.urls', namespace='hijack')),
]

4) After installing
Setting up redirections

> You should specify a HIJACKLOGINREDIRECTURL and a HIJACKLOGOUTREDIRECTURL. This is where admins are redirected to after hijacking or releasing a user. Both settings default to LOGINREDIRECTURL.

# settings.py
HIJACKLOGINREDIRECTURL = '/profile/' # Where admins are redirected to after hijacking a user
HIJACKLOGOUTREDIRECTURL = '/admin/auth/user/' # Where admins are redirected to after releasing a user

5) Setting up the notification bar
We strongly recommend displaying a notification bar to everyone who is hijacking another user. This reduces the risk of an admin hijacking someone inadvertently or forgetting to release the user afterwards.

6) To set up the notification bar, add the following lines to your base.html or to another template in which you want the notification bar to be displayed.

<!-- At the top -->
{% load staticfiles %}
{% load hijacktags %}

...

<!-- In the head -->
<link rel="stylesheet" type="text/css" href="{% static 'hijack/hijack-styles.css' %}" />

...

<!-- Directly after <body> -->
{% hijacknotification %}

...

7) If your project uses Bootstrap you may want to set HIJACKUSEBOOTSTRAP = True in your project settings. Django Hijack will display a Bootstrap notification bar that does not overlap with the default navbar.

8) Generic template filter
We also provide a generic template filter to check if you are currently hijacking a user. This is useful for displaying/hiding elements besides the notification bar.

{% load hijacktags %}
{% if request|ishijacked %}
...
{% endif %}

9) The following URLs are available by default:

/hijack/<user id>
/hijack/username/<username>
/hijack/email/<user email>

10) If the hijacking is successful, the user is redirected to the HIJACKLOGINREDIRECTURL, and the yellow notification bar is displayed at the top of the landing page.

Here is a reference implementation of a button that allows a superuser to hijack the user referenced by the context variable user:

 action="/hijack/{{ user.id }}/" method="post">
    {% csrf_token %}
    <button type="submit">Hijack {{ user.username }}</button>
</form>

more on : https://django-hijack.readthedocs.io/en/stable/

E N J O Y ❤️👍🏻
U S E F O R L E A R N
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Termux/beginers Accessing and managing files in termux

1) To manage and access files in termux then you must type below command

> termux-setup-storage

2) To access a directory cd command is used

> The termux default directory is located at /data/data/com.termux/

3) You can access it anytime by typing cd $home


4) ls Command is used to see the list of sub directories

5) To access your internal sdcard you have to type cd /sdcard && ls

6) To Access your External Sdcard the same command is used cd /sdcard0/ && ls

7) To Remove/delete an empty Directory or a file, use this command: rm -rf filename

8) Where filename belongs to the name of the file or directory
Similarly, you can use rm -r filename

9) To Make a Directory mkdir Command is used
Eg: mkdir Hello

10) Where Hello Belongs to a Directory Name

11) For Copying files from one directory to another, cp Command is used
eg: cp /path/file /path

12) Similarly for moving files mv Command is used
Termux also Supports zipping and Unzipping of Zip files
For that zip , unzip Commands are used

13) Let's talk about Networking
ifconfig Command is used to get all the information regarding your Network IP Address

14) To check a particular website is accessible or not in your ISP then you can check that through termux by typing

ping website
Eg: ping google.com

15) The Interesting thing is you can access the internet through termux, directly in the command line

Firstly you have to install the w3m package by typing

pkg install w3m

16) After that type below command to access any website

w3m website
eg: w3m google.com
Lynx is similar to w3m

17) To install lynx, type pkg install lynx
After that type lynx google.com

18) Now In this Section i will teach you How To Install Useful Packages/Hacking Tools On your Android mobile

@UndercodeTesting
termux wiki xd
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

More than 100,000 BEC attacks on 6,600 organizations :

How to avoid such attacks
Barracuda's researchers analyzed the attacks of 6,600 organizations and found that in many cases, cybercriminals used the same email address to attack different organizations. The number of organizations attacked by each malicious account ranges from one to 256. The number of email attacks sent by a malicious account ranges from 1 to more than 600 emails, with an average of only 19.

In fact, setting up email services such as Gmail for free can allow anyone to create a malicious account with potential BEC attacks. In order to protect themselves from this threat, organizations need to defend themselves, such as investing more in email security and using artificial intelligence to identify abnormal senders and requests.

However, no security software can be 100% effective, especially if the sender seems to be using a perfectly legitimate email.
#news'
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

Fuzzing VulnServer with Peach
#full with pictures

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑TOPIC TERMUX-LINUX
2020 NEW UPDATE FOR WEBHACKING -

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1) sudo git clone https://github.com/Manisso/fsociety.git

2) cd fsociety

3) sudo ./install.sh

4)Simply CHOOSE OPTIONS VIA NUMBERS

E N J O Y ❤️👍🏻
U S E F O R L E A R N
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

24/24 posts enjoy & share us ❤️👍🏻

T.me/UndercodeTesting

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁



🦑NETWORK HACKING MATERIAL 2020 :

http://www.milescan.com ParosPro

https://www.qualys.com/enterprises/qualysguard/web-application-scanning/ Qualys Web Application Scanning

http://www.beyondtrust.com/Products/RetinaNetworkSecurityScanner/ Retina

https://www.owasp.org/index.php/OWASP_Xenotix_XSS_Exploit_Framework Xenotix XSS Exploit Framework

https://github.com/future-architect/vuls Vulnerability scanner for Linux, agentless, written in golang.

https://github.com/rastating/wordpress-exploit-framework A Ruby framework for developing and using modules which aid in the penetration testing of WordPress powered websites and systems.

http://www.xss-payloads.com/ XSS Payloads to leverage XSS vulnerabilities, build custom payloads, practice penetration testing skills.

https://github.com/joaomatosf/jexboss JBoss (and others Java Deserialization Vulnerabilities) verify and EXploitation Tool

https://github.com/commixproject/commix Automated All-in-One OS command injection and exploitation tool

https://github.com/pathetiq/BurpSmartBuster A Burp Suite content discovery plugin that add the smart into the Buster!

https://github.com/GoSecure/csp-auditor Burp and ZAP plugin to analyze CSP headers

https://github.com/ffleming/timing_attack Perform timing attacks against web applications

https://github.com/lalithr95/fuzzapi Fuzzapi is a tool used for REST API pentesting

https://github.com/owtf/owtf Offensive Web Testing Framework (OWTF)

https://github.com/nccgroup/wssip Application for capturing, modifying and sending custom WebSocket data from client to server and vice versa.

https://github.com/tijme/angularjs-csti-scanner Automated client-side template injection (sandbox escape/bypass) detection for AngularJS (ACSTIS).

https://reshift.softwaresecured.com A source code analysis tool for detecting and managing Java security vulnerabilities.

https://encoding.tools Web app for transforming binary data and
strings, including hashes and various encodings. GPLv3 offline version available.

https://gchq.github.io/CyberChef/ A "Cyber Swiss Army Knife" for carrying out various encodings and transformations of binary data and strings.

E N J O Y ❤️👍🏻
U S E F O R L E A R N
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑How to set unlimited users and file descriptions on Linux server:
If you get “too many files open limit” error on Linux server because there is a limit on opening files in Linux according to user session.

1) We need to add a line to /etc/sysctl.conf and run sysctl -p:

fs.file-max = 80000


2) We can check the default limits using the following command:

cat / proc / sys / fs / file-max


3) file-max is the maximum file descriptor. This is a kernel setting applied at the system level.

4) Similarly, you can check the default values ​​for the root user.

ulimit -a


5) We can also set hard and soft limits by editing this vim file /etc/security/limits.conf

* hard nofile 600000
* soft nofile 600000


6) Set hard and soft limits for Linux user

linux hard nofile 600000
linux soft nofile 600000


7) Then run sysctl -p to make the changes.

We can also set the process limit for the root user to unlimited with ulimit -u unlimited and store these lines in /root/.bashrc forever.

We can also check how many files are currently open using lsof | wc -l

8) Check how many file descriptions are currently in use: more / proc / sys / fs / file-nr

9) Check the limit on the currently open file descriptor using the following commands.

more / proc / sys / fs / file-max
sysctl -a | grep fs.file-max

10) After making the changes, you need to log out and log back in. There are many options available and you can check them out on the official RedHat page.

E N J O Y ❤️👍🏻
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑The NetWalker ransomware group has made 25 million USD since March 2020 :
#news

> Security company McAfee said today that operators of NetWalker ransomware are believed to have earned more than $25 million in ransom payments since March this year. Although there are no accurate and up-to-date statistics, the $25 million figure put NetWalker at the top of the most successful ransomware gangs currently known. Other known names include Ryuk, Dharma, and REvil (Sodinokibi).


> McAfee recently released a comprehensive report on NetWalker's operations, which can track payments made by victims to the Bitcoin address of the ransomware group. However, security experts believe that because their views are incomplete, the gang may gain more benefits from their illegal actions.

#News
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑HomeHackingUltimate Guide To : Ethical Hacking With Termux
Lazymux contains Several Hacking Tools of Kali Linux at One Place so now its easy to Install Lazymux In Termux

Lazymux Contains the Following Hacking Tools

01 Sudo 11 SQLMap
02 NMap 12 Black Hydra
03 Hydra 13 Fl00d & Fl00d2
04 FB Brute Force 14 Infoga
05 Webdav 15 LANs.py
06 RED HAWK 16 Pagodo
07 Brutal 17 FBUP
08 Metasploit 18 KnockMail
09 1337Hash 19 Ufonet
10 IPLoc 20 Commix

21 D-Tect 31 ReconDog
22 A-Rat 32 Meisha
23 Torshammer 33 Kali NetHunter
24 Slowloris 34 Ngrok
25 DSSS 35 Weeman
26 SQLiv 36 Cupp
27 Wifite 37 Hash-Buster
28 Wifite 2 38 Routersploit
29 MSFPC 39 Ubuntu
30 Kwetza 40 Fedora

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

Then Type this Command

1) apt Update && apt upgrade

Now We have to Install git by typing this command

pkg install git

2) Then Now We need Python2 environment in Termux so type the command pkg install python to install python

3) Now almost done type below command to install Lazymux on Termux

git clone https://github.com/Gameye98/Lazymux

4) After Cloning successful

> cd Lazymux && ls

5) Now you have to type below command for menu of Lazymux Hacking Tools

> python lazymux.py

6) Now select your Desired Tool To Install and us

E N J O Y ❤️👍🏻
U S E F O R L E A R N
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁