▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Postfix vs. Sendmail :
#fastTips

Postfix and Sendmail are in the same category of Mail Transfer Agents. When selecting the MTA (Mail Transfer Agent) for your system, to choose the best option that meets your needs, you must consider a few important features, such as performance, security, documentation, and feasibility. The following points are given, based on which you can explore some technical aspects of MTAs:

1) More than one configuration file

2) Minimal syntax

3) Which type of scripting language is used

4) Check code stability

5) Source code contribution

6) Set of minimum features

Postfix vs. Sendmail – Comparison


Postfix and Sendmail are both MTAs, but the Postfix mail server is security-oriented, whereas Sendmail is a standard mail transfer agent for Unix systems. Based on the following features, we can easily compare some major differences.

#FastTips
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑How to make iPhone automatically switch between light and dark interface :
#FAStTips

1) The dark interface in iOS 13 and above allows you to look at the screen with comfort. You can use it at any time of the day, but if you prefer to do it only in the dark, it is not very convenient to switch yourself every time. There is a setting that you can set once and forget about it.

2) Dark mode on the iPhone will turn on automatically at dusk, and at sunrise it will switch to the light interface. Sunset and sunrise times are taken from the Weather app, but often the mode is activated earlier. To install it, do the following.

3) Go to Settings> Display & brightness> Appearance> Automatic. Below the Options menu will appear and there are commands “Light until sunset” or “Dark until sunrise”. It depends on which interface is currently enabled. Activate one of these commands.

4) If you previously set your own schedule and have already forgotten about it, instead of sunset and sunrise, a specific time is shown. To switch, click on the settings, "Sunset or sunrise" or "Sunrise or sunset" so that the light interface is during the day and the dark one at night.

5) Now, at sunset, the system will switch from a light interface to a dark one, at sunrise back. You don't even have to move your finger to do this. However, switching does not always happen strictly at sunset and sunrise. In addition, switching occurs when you are not using the device.

6) If you want, you can change the interface manually in the "Screen and brightness" section, through the control center or using the Siri assistant. In this case, you are extending the light or dark period. For example, if you manually set the dark interface at 2 am, the switch to the light interface will occur at sunrise the next day.

@UndercodeTesting
@UndercodeHacking
@UndercodeSecurity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Hidden "Notification History" widget on Android
#Fasttips

1) It so happens that you delete an important notification without thinking or having time to read it. Or you click on the "Delete everything" button. Fortunately, there are ways to read these notifications at least partially.

2) Since Android 4.1 Jelly Bean there is a hidden feature that allows you to watch recently received notifications. To access it, long press on an empty spot on the home screen and select "Widgets". Long press on the Settings widget and drag it to your home screen. A page with several options will appear. Select "Notifications".

3) now you can see the history of all notifications. In this case, we managed to see notifications for the last two days, but depending on their number, the period may be longer or shorter. Shows the title of the notification that sent its apps and the time or date it was sent.

4) In Android 11, this list has been redesigned to show the content of the notification along with other information.

For users of Samsung Galaxy devices, this method does not work. They need to download the Good Lock app from the
> Galaxy Store, install the NotiStar extension https://galaxystore.samsung.com/detail/com.samsung.systemui.notilus

and launch Good Lock from the main menu. The function is also not supported on LG smartphones running Android 10.

> https://galaxystore.samsung.com/detail/com.samsung.android.goodlock


@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁


🦑Website Hacking – The Most Common Techniques

SQL Injection attacks. SQL Injection attack is the most
common website hacking technique.

Cross Site Scripting (XSS)

Denial of Service (DoS/DDoS)

Cross-site request forgery (CSRF or XSRF)

DNS Spoofing (DNS cache poisoning)

Social engineering techniques.

Non-targeted website hacking.

#fastTips
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Exploitation of the blind command injection vulnerability
#FastTips


1) A command injection (also known as remote code execution) vulnerability allows commands to be executed at the operating system level. Such vulnerabilities can be found in web applications, routers.

2) A detailed description of this vulnerability and methods of exploitation are described in the article " OS Command Injection : Concept, Operation, Automated Vulnerability Search".

3) mentions the blind command injection vulnerability and shows examples of its exploitation. However, the blind vulnerability is harder to understand and slightly harder to exploit - instead of injecting a payload and watching the results right in a browser window or console, you need to use a third-party web server.
———————————————————————-

🦑For training we need:

1) machine with web server and vulnerable web application

2) attacker's web server - it could be a second machine on the local network or your hosting

The following script will execute the role of the vulnerable application:

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>undercode </title>
</head>
<body>
<form>
<input name="message" type="text" />
<input type="submit">
</form>

<?php
if (isset($_GET["message"])) {
exec ('echo ' . $_GET["message"] . ' >> /tmp/messages');
}
?>
</body>
</html>

written
@UndercodeTesting
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑What is Capture the Flag - CTF ?
#FastTips

-CTF’s (capture the flag) are computer security/hacking competitions which generally consist of participants breaking, investigating, reverse engineering and doing anything they can to reach the end goal, a “flag” which is usually found as a string of text.


-DEF CON hosts what is the most widely known and first major CTF, occuring annualy at the hacking conference in Las Vegas. Many different competitions have branched off since then, and numerous ones are available year round. One of the best places to see when CTFs are being scheduled is ctftime, an active website with calendars and team rankings.

wiki source
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Finding a CTF :

If you ever wanted to start running, you were probably encouraged to sign up to a 5k to keep focused on a goal. The same principle applies here: pick a CTF in the near future that you want to compete in and come up with a practice schedule. Here are some CTFs that we can recommend:


1) PicoCTF and PlaidCTF by CMU

2) HSCTF is made for high school students

3) Ghost in the Shellcode (GitS)

4) CSAW CTF by NYU-Poly

5) UCSB iCTF is for academics only

6) Defcon CTF

#fastTips
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Overview of Android hierarchical security architecture and core components :
#FastTips

The Android system inherits the security features of the Linux open source operating system and uses a hierarchical approach to ensure system security. This article will introduce the Android hierarchical security architecture and its core components in detail.


1) The Android system inherits the security features of the Linux open source operating system and uses a hierarchical approach to ensure system security.
Android uses Linux 2.6 as the operating system, Linux 2.6 is a standard technology, and Linux is also an open operating system. Android's use of the operating system includes two parts: the core and the driver. The Linux core of Android is the standard Linux 2.6 kernel. Android needs more drivers related to mobile devices.

🦑The main drivers are as follows:

Display driver (DisplayDriver): commonly used Linux-based frame buffer (Frame Buffer) driver

Flash memory driver (FlashMemory Driver)

Camera driver (CameraDriver): commonly used Linux-based v4l (Video for) driver.

Audio Driver (AudioDriver): commonly used based on ALSA (Advanced Linux Sound Arc..

2) Various libraries (Libraries) and Android runtime environment (RunTime)
This level corresponds to the general embedded system and is equivalent to the middleware level. This level of Android is divided into two parts, one is various libraries, and the other is the Android runtime environment. The content of this layer is mostly implemented in C++. Among them, various libraries include:
C library: The standard library of C language, which is also one of the lowest level libraries in the system.

3) Application Framework (ApplicationFramework)
The Android application framework provides APIs for developers at the application layer. It is actually an application framework. Since the upper-level application is built in JAVA, the first level provided by this level includes the various controls needed in the UI program: for example: Views (view components) include lists (list), grids (grid), textboxes Text box), buttons (buttons), etc., and even an embedded Web browser. An Android application can make use of the following parts in the application framework: Activity, Broadcast IntentReceiver, Service, Content Provider.

4) Application
Android applications are mainly user interface (UserInterface), usually written in JAVA program, which can also contain various resource files (placed in the res directory). After the JAVA program and related resources are compiled, an APK package will be generated. Android itself provides many core applications such as the home screen (Home), contacts (Contact), phone (Phone), browser (Browsers) and so on. At the same time, application developers can also use the API of the application framework layer to implement their own programs.

#FastTips
@UndercodeTesting
@UndercodeHacking
@UndercodeSecurity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑VECTOR IN C++:
#FastTips

1) Assigning a Vector during Construction
During construction, an empty vector can be created while another one is assigned to it, as follows:

vector <float> vtr1{1.1, 2.2, 3.3, 4.4};
vector <float> vtr2 =vtr1;

2) The second statement is equivalent to:

vector <float> vtr2 = {1.1, 2.2, 3.3, 4.4};
const Vector

3) A const vector is a vector whose elements cannot be changed. The values in this vector are read-only. When created, the vector appears as follows:

const vector <float> vtr{1.1, 2.2, 3.3, 4.4};

4) In this vector type, no element can be added or removed. Moreover, no value can be changed.

🦑Constructing with Iterator

1) A template provides a generic representation for a data type. An iterator provides a generic representation of scanning through the values of a container. The syntax to create a vector with an iterator is as follows:

template<class InputIterator>
vector(InputIterator first, InputIterator last,const Allocator& = Allocator());

2) This constructs a vector for the range [first, last) using the specified allocator, which will be discussed later in this article.

3) Destroying a Vector
To destroy a vector, simply allow it to go out of scope and destroy is handled automatically.

Vector Capacity
size_type capacity() const noexcept

4) The total number of elements the vector can hold without requiring reallocation is returned by the capacity member function. A code segment for this is as follows:

vector <float> vtr(4);
int num = vtr.capacity();
cout << num << '\n';
The output is 4.

reserve(n)

5) Memory space is not always freely available. Extra space can be reserved in advance. Consider the following code segment:

vector <float> vtr(4);
vtr.reserve(6);
cout << vtr.capacity() << '\n';

6) The output is 6. So, the extra space reserved is 6 – 4 = 2 elements. The function returns void.

size() const noexcept


This returns the number of elements in the vector. The following code illustrates this function:

vector <float> vtr(4);
float sz = vtr.size();
cout << sz << '\n';
The output is 4.

shrink_to_fit()

After giving extra capacity to a vector with the reserve() function, the vector can be sized down to fit to its original size. The following code illustrates this:

vector <float> vtr(4);
vtr.reserve(6);
vtr.shrink_to_fit();
int sz = vtr.size();
cout << sz << '\n';
The output is 4 and not 6. The function returns void.

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑https encryption is also cracked HEIST attack to obtain plaintext from encrypted data :
#fastTips

we know the difference between http and https. For encrypted https, we always think it is relatively safe, but today we are going to talk about a web attack that bypasses HTTPS encryption to obtain plaintext information. I don’t know this. The news is happy or sad for you

1) The conditions for the use of the HEIST attack are very simple, requiring only a few lines of simple javascript code, and no man-in-the-middle attack is required. First, the transmitted sensitive data will be captured and saved. This attack method can obtain private sensitive information such as bank card number, real name, phone number, and social security number.

2) But as we all know, most of these data are encrypted by HTTPS. Then make a probe on the size and length of the encrypted data. Many websites use file compression technology to increase the loading speed of web pages, and attackers can just use the design flaws to decrypt the data payload (similar to BREACH attacks and CRIME attacks).

3) HEIST technology can use new APIs (Resource Timing and Fetch) to calculate the number of transmission frames and windows sent by the target host. Throughout the process, researchers can use a piece of JavaScript code to determine the actual size of the HTTPS response message. Then, the malicious HEIST code can cooperate with the BREACH technology to extract the encrypted information from the user's request data.

4) security researchers will demonstrate how to use malicious advertisements on the New York Times official website to accurately measure the size of the encrypted response information. Throughout the process, security researchers will use a virtual third-party website (targetwebsite.com) to send encrypted information. In addition, they will also demonstrate how to infer data information from security tokens used to prevent cross-site request forgery attacks.

5) Although some websites currently deploy basic security measures, most of them cannot prevent HEIST attacks, so this type of attack may become more frequent in recent years. The current prevention methods for HEIST attacks are to either disable third-party cookies or javascript scripts. But third-party cookies and javascript are the basic requirements for ordinary users to access the web, so the two researchers also hope to find and develop a reasonable and effective solution together through the Black Hat conference.

#FastTips
@UndercodeTesting
@UndercodeHacking
@UndercodeSecurity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁