▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
🦑Practice Your Skills :
> WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons.
> This program is a demonstration of common server-side application flaws. The exercises are intended to be used by people to learn about application security and penetration testing techniques.
🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :
1️⃣ git clone https://github.com/WebGoat/WebGoat.git
2️⃣-run-using-docker
> docker run -p 8080:8080 -p 9090:9090 -e TZ=Europe/Amsterdam webgoat/goatandwolf
3️⃣WebGoat will be located at: http://127.0.0.1:8080/WebGoat WebWolf will be located at: http://127.0.0.1:9090/WebWolf
Important:
> Choose the correct timezone, so that the docker container and your host are in the same timezone. As it important for the validity of JWT tokens used in certain exercises.
4️⃣Using docker stack deploy
> Another way to deply WebGoat and WebWolf in a more advanced way is to use a compose-file in a docker stack deploy. You can define which containers should run in which combinations and define all of this in a yaml file. An example of such a file is: goat-with-reverseproxy.yaml
5️⃣This sets up an nginx webserver as reverse proxy to WebGoat and WebWolf. You can change the timezone by adjusting the value in the yaml file.
6️⃣docker stack init
> docker stack deploy --compose-file goat-with-reverseproxy.yaml webgoatdemo
7️⃣Add the following entries in your local hosts file:
127.0.0.1 www.webgoat.local www.webwolf.localhost
You can use the overall start page: http://www.webgoat.local or:
8️⃣WebGoat will be located at: http://www.webgoat.local/WebGoat
WebWolf will be located at: http://www.webwolf.local/WebWolf
Important:
> the current directory on your host will be mapped into the container for keeping state.
🦑Another way :
Standalone
1️⃣Download the latest WebGoat and WebWolf release from https://github.com/WebGoat/WebGoat/releases
java -jar webgoat-server-8.1.0.jar [--server.port=8080] [--server.address=localhost]
java -jar webwolf-8.1.0.jar [--server.port=9090] [--server.address=localhost]
The latest version of WebGoat needs Java 11 or above. By default WebGoat and WebWolf start on port 8080 and 9090 with --server.port you can specify a different port. With server.address you can bind it to a different address (default localhost)
🦑Or
> Run from the sources
1️⃣Prerequisites:
-Java 11
-Maven > 3.2.1
-Your favorite IDE
-Git, or Git support in your IDE
2️⃣Open a command shell/window:
git clone git@github.com:WebGoat/WebGoat.git
Now let's start by compiling the project.
3️⃣cd WebGoat
4️⃣git checkout <<branch_name>>
mvn clean install
5️⃣Now we are ready to run the project. WebGoat 8.x is using Spring-Boot.
mvn -pl webgoat-server spring-boot:run
... you should be running webgoat on localhost:8080/WebGoat momentarily
6️⃣To change IP address add the following variable to WebGoat/webgoat-container/src/main/resources/application.properties file
>server.address=x.x.x.x
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
🦑Practice Your Skills :
> WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons.
> This program is a demonstration of common server-side application flaws. The exercises are intended to be used by people to learn about application security and penetration testing techniques.
🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :
1️⃣ git clone https://github.com/WebGoat/WebGoat.git
2️⃣-run-using-docker
> docker run -p 8080:8080 -p 9090:9090 -e TZ=Europe/Amsterdam webgoat/goatandwolf
3️⃣WebGoat will be located at: http://127.0.0.1:8080/WebGoat WebWolf will be located at: http://127.0.0.1:9090/WebWolf
Important:
> Choose the correct timezone, so that the docker container and your host are in the same timezone. As it important for the validity of JWT tokens used in certain exercises.
4️⃣Using docker stack deploy
> Another way to deply WebGoat and WebWolf in a more advanced way is to use a compose-file in a docker stack deploy. You can define which containers should run in which combinations and define all of this in a yaml file. An example of such a file is: goat-with-reverseproxy.yaml
5️⃣This sets up an nginx webserver as reverse proxy to WebGoat and WebWolf. You can change the timezone by adjusting the value in the yaml file.
6️⃣docker stack init
> docker stack deploy --compose-file goat-with-reverseproxy.yaml webgoatdemo
7️⃣Add the following entries in your local hosts file:
127.0.0.1 www.webgoat.local www.webwolf.localhost
You can use the overall start page: http://www.webgoat.local or:
8️⃣WebGoat will be located at: http://www.webgoat.local/WebGoat
WebWolf will be located at: http://www.webwolf.local/WebWolf
Important:
> the current directory on your host will be mapped into the container for keeping state.
🦑Another way :
Standalone
1️⃣Download the latest WebGoat and WebWolf release from https://github.com/WebGoat/WebGoat/releases
java -jar webgoat-server-8.1.0.jar [--server.port=8080] [--server.address=localhost]
java -jar webwolf-8.1.0.jar [--server.port=9090] [--server.address=localhost]
The latest version of WebGoat needs Java 11 or above. By default WebGoat and WebWolf start on port 8080 and 9090 with --server.port you can specify a different port. With server.address you can bind it to a different address (default localhost)
🦑Or
> Run from the sources
1️⃣Prerequisites:
-Java 11
-Maven > 3.2.1
-Your favorite IDE
-Git, or Git support in your IDE
2️⃣Open a command shell/window:
git clone git@github.com:WebGoat/WebGoat.git
Now let's start by compiling the project.
3️⃣cd WebGoat
4️⃣git checkout <<branch_name>>
mvn clean install
5️⃣Now we are ready to run the project. WebGoat 8.x is using Spring-Boot.
mvn -pl webgoat-server spring-boot:run
... you should be running webgoat on localhost:8080/WebGoat momentarily
6️⃣To change IP address add the following variable to WebGoat/webgoat-container/src/main/resources/application.properties file
>server.address=x.x.x.x
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
GitHub
GitHub - WebGoat/WebGoat: WebGoat is a deliberately insecure application
WebGoat is a deliberately insecure application. Contribute to WebGoat/WebGoat development by creating an account on GitHub.
Forwarded from Backup Legal Mega
🦑Candlestick Trading Ninja: 10 Hour Candlestick Certification —1.67 GB—
https://www.udemy.com/course/candlestick/
https://mega.nz/folder/vGgRzZiY#FYufcGUmO6rIl7Rh6uhiUw
https://www.udemy.com/course/candlestick/
https://mega.nz/folder/vGgRzZiY#FYufcGUmO6rIl7Rh6uhiUw
Udemy
Candlestick Trading Ninja: 10 Hour Glossary & DIY Strategy
Expert Technical Analysis & Candlestick Trading Hacks For Forex, Stock Trading, Day Trading & Swing Trading in 1 course.
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
🦑FREE SPYWARES POPULAR 2020 :
- Spyeye - Script To Generate Win32 .Exe File To Take Screenshots
- Words Scraper - Selenium Based Web Scraper To Generate Passwords List
- JSshell - A JavaScript Reverse Shell For Exploiting XSS Remotely Or Finding Blind XSS, Working With Both Unix And Windows OS
- Astsu - A Network Scanner Tool
- Git-Scanner - A Tool For Bug Hunting Or Pentesting For Targeting Websites That Have Open .git Repositories Available In Public
- Recox - Master Script For Web Reconnaissance
- Jshole - A JavaScript Components Vulnrability Scanner, Based On RetireJS
- GitMonitor - A Github Scanning System To Look For Leaked Sensitive Information Based On Rules
- Eviloffice - Inject Macro And DDE Code Into Excel And Word Documents (Reverse Shell)
- Ligolo - Reverse Tunneling Made Easy For Pentesters, By Pentesters
- Inshackle - Instagram Hacks: Track Unfollowers, Increase Your Followers, Download Stories, Etc
- GhostShell - Malware Indetectable, With AV Bypass Techniques, Anti-Disassembly, And More
- Forerunner - Fast And Extensible Network Scanning Library Featuring Multithreading, Ping Probing, And Scan Fetchers
- Enumy - Linux Post Exploitation Privilege Escalation Enumeration
- Bing-Ip2Hosts - Bingip2Hosts Is A Bing.com Web Scraper That Discovers Websites By IP Address
- Vault - A Tool For Secrets Management, Encryption As A Service, And Privileged Access Management
- ADCollector - A Lightweight Tool To Quickly Extract Valuable Information From The Active Directory Environment For Both Attacking And Defending
- ANDRAX v5R NH-Killer - Penetration Testing on Android
- DroidFiles - Get Files From Android Directories
- Purify - All-in-one Tool For Managing Vulnerability Reports From AppSec
Pipelines
✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
🦑FREE SPYWARES POPULAR 2020 :
- Spyeye - Script To Generate Win32 .Exe File To Take Screenshots
- Words Scraper - Selenium Based Web Scraper To Generate Passwords List
- JSshell - A JavaScript Reverse Shell For Exploiting XSS Remotely Or Finding Blind XSS, Working With Both Unix And Windows OS
- Astsu - A Network Scanner Tool
- Git-Scanner - A Tool For Bug Hunting Or Pentesting For Targeting Websites That Have Open .git Repositories Available In Public
- Recox - Master Script For Web Reconnaissance
- Jshole - A JavaScript Components Vulnrability Scanner, Based On RetireJS
- GitMonitor - A Github Scanning System To Look For Leaked Sensitive Information Based On Rules
- Eviloffice - Inject Macro And DDE Code Into Excel And Word Documents (Reverse Shell)
- Ligolo - Reverse Tunneling Made Easy For Pentesters, By Pentesters
- Inshackle - Instagram Hacks: Track Unfollowers, Increase Your Followers, Download Stories, Etc
- GhostShell - Malware Indetectable, With AV Bypass Techniques, Anti-Disassembly, And More
- Forerunner - Fast And Extensible Network Scanning Library Featuring Multithreading, Ping Probing, And Scan Fetchers
- Enumy - Linux Post Exploitation Privilege Escalation Enumeration
- Bing-Ip2Hosts - Bingip2Hosts Is A Bing.com Web Scraper That Discovers Websites By IP Address
- Vault - A Tool For Secrets Management, Encryption As A Service, And Privileged Access Management
- ADCollector - A Lightweight Tool To Quickly Extract Valuable Information From The Active Directory Environment For Both Attacking And Defending
- ANDRAX v5R NH-Killer - Penetration Testing on Android
- DroidFiles - Get Files From Android Directories
- Purify - All-in-one Tool For Managing Vulnerability Reports From AppSec
Pipelines
✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
KitPloit - PenTest & Hacking Tools
Spyeye - Script To Generate Win32 .Exe File To Take Screenshots
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
🦑Collects information from an email and shows results in a nice visual interface.
🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :
1️⃣git clone https://gitlab.com/kennbroorg/iKy.git
2️⃣cd $IKY_CLONE/install/iKyEasyInstall
3️⃣./iKyEasyInstall.sh # At some point the script will request credentials for sudo
✅Verified on :
-kali
-ubuntu
🦑Kali - ubuntu video tutorial
> https://gitlab.com/kennbroorg/iKy/-/wikis/Videos/Installations
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
🦑Collects information from an email and shows results in a nice visual interface.
🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :
1️⃣git clone https://gitlab.com/kennbroorg/iKy.git
2️⃣cd $IKY_CLONE/install/iKyEasyInstall
3️⃣./iKyEasyInstall.sh # At some point the script will request credentials for sudo
✅Verified on :
-kali
-ubuntu
🦑Kali - ubuntu video tutorial
> https://gitlab.com/kennbroorg/iKy/-/wikis/Videos/Installations
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
GitLab
Kenn Brothers Org / iKy · GitLab
OSINT Project. Collect information from a mail. Gather. Profile. Timeline.
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
🦑2020 Hijack services that relies on QR Code Authentication :
🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :
1️⃣git clone https://github.com/thelinuxchoice/ohmyqr
2️⃣cd ohmyqr
3️⃣bash ohmyqr.sh
🦑How it Works ?
QRLJacking or Quick Response Code Login Jacking is a simple social engineering attack vector capable of session hijacking affecting all applications that rely on the “Login with QR code” feature as a secure way to login into accounts. In a nutshell, the victim scans the attacker’s QR code which results in session hijacking.
✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
🦑2020 Hijack services that relies on QR Code Authentication :
🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :
1️⃣git clone https://github.com/thelinuxchoice/ohmyqr
2️⃣cd ohmyqr
3️⃣bash ohmyqr.sh
🦑How it Works ?
QRLJacking or Quick Response Code Login Jacking is a simple social engineering attack vector capable of session hijacking affecting all applications that rely on the “Login with QR code” feature as a secure way to login into accounts. In a nutshell, the victim scans the attacker’s QR code which results in session hijacking.
✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
🦑Network configuration-Prevent users from browsing using external proxies by Undercode :
Some background knowledge:
1️⃣ HTTP/1.0 protocol defines web server and When the client uses a proxy, in the
HTTP request and response headers, use Via: to identify the proxy server used to prevent the
server loop;
2️⃣ snort is an open source IDS (intrusion detection system) that can be used Host or network IDS. With many IDS
rules, it can perform pattern recognition and matching on the captured (ip, tcp, udp, icmp) packets, and can generate corresponding records.
3️⃣ libnet is open source software that can be used as a network protocol/packet generator.
4️⃣ The TCP/IP network is a packet-switched network.
5️⃣ Snort also has the function of generating IP packets using the libnet library. You can interrupt the TCP connection by issuing a TCP_RESET packet.
🦑 Prerequisites:
1️⃣Snort runs on the route (linux) or through the port mirror function of the switch, runs on the same
network segment of the route
🦑 Implementation:
1️⃣ compile snort with flexresp(flex response) feature
2️⃣ Define snort rules:
alert tcp $HOME_NET any <> $EXTER_NET 80 (msg:"block proxy"; uricontent:"Via:"; resp: rst_all;)
🦑 Effect:
> Internal network users can browse external websites normally.
> If the internal user’s browser is configured with an external proxy, the
HTTP REQUEST and RESPONSE headers will include Via: ... characters, and snort rules will capture this connection, and then
> Send RST packets to client and server sockets. In this way, the TCP connection is terminated.
Written by Undercode
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
🦑Network configuration-Prevent users from browsing using external proxies by Undercode :
Some background knowledge:
1️⃣ HTTP/1.0 protocol defines web server and When the client uses a proxy, in the
HTTP request and response headers, use Via: to identify the proxy server used to prevent the
server loop;
2️⃣ snort is an open source IDS (intrusion detection system) that can be used Host or network IDS. With many IDS
rules, it can perform pattern recognition and matching on the captured (ip, tcp, udp, icmp) packets, and can generate corresponding records.
3️⃣ libnet is open source software that can be used as a network protocol/packet generator.
4️⃣ The TCP/IP network is a packet-switched network.
5️⃣ Snort also has the function of generating IP packets using the libnet library. You can interrupt the TCP connection by issuing a TCP_RESET packet.
🦑 Prerequisites:
1️⃣Snort runs on the route (linux) or through the port mirror function of the switch, runs on the same
network segment of the route
🦑 Implementation:
1️⃣ compile snort with flexresp(flex response) feature
2️⃣ Define snort rules:
alert tcp $HOME_NET any <> $EXTER_NET 80 (msg:"block proxy"; uricontent:"Via:"; resp: rst_all;)
🦑 Effect:
> Internal network users can browse external websites normally.
> If the internal user’s browser is configured with an external proxy, the
HTTP REQUEST and RESPONSE headers will include Via: ... characters, and snort rules will capture this connection, and then
> Send RST packets to client and server sockets. In this way, the TCP connection is terminated.
Written by Undercode
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
🦑2020 updated Reverse Tunneling made easy for pentesters, by pentesters
🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :
1️⃣cd
2️⃣git clone https://github.com/sysdream/ligolo
3️⃣cd ligolo
4️⃣make dep
5️⃣Generate self-signed TLS certificates (will be placed in the certs folder)
make certs TLS_HOST=example.com
NOTE: You can also use your own certificates by using the TLS_CERT make option when calling build. Example: make build-all TLS_CERT=certs/mycert.pem.
6️⃣Build
make build-all
> 3.2. (or) For the current architecture
make build
✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
🦑2020 updated Reverse Tunneling made easy for pentesters, by pentesters
🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :
1️⃣cd
go env GOPATH/src2️⃣git clone https://github.com/sysdream/ligolo
3️⃣cd ligolo
4️⃣make dep
5️⃣Generate self-signed TLS certificates (will be placed in the certs folder)
make certs TLS_HOST=example.com
NOTE: You can also use your own certificates by using the TLS_CERT make option when calling build. Example: make build-all TLS_CERT=certs/mycert.pem.
6️⃣Build
make build-all
> 3.2. (or) For the current architecture
make build
✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
GitHub
GitHub - sysdream/ligolo: Reverse Tunneling made easy for pentesters, by pentesters https://sysdream.com/
Reverse Tunneling made easy for pentesters, by pentesters https://sysdream.com/ - sysdream/ligolo
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
🦑A fast, modern, zero-conf load balancing HTTP(S) router for deploying microservices:
🦑FEATURES :
>Access Logging - customizable access logs
>Access Control - route specific access control
>Certificate Stores - dynamic certificate stores like file system, HTTP server, Consul and Vault
>Compression - GZIP compression for HTTP responses
>Docker Support - Official Docker image, Registrator and Docker Compose example
>Dynamic Reloading - hot reloading of the routing table without downtime
>Graceful Shutdown - wait until requests have completed before shutting down
>HTTP Header Support - inject some HTTP headers into upstream requests
>HTTPS Upstreams - forward requests to HTTPS upstream servers
>Metrics Support - support for Graphite, StatsD/DataDog and Circonus
>PROXY Protocol Support - support for HA Proxy PROXY protocol for inbound requests (use for Amazon ELB)
>Path Stripping - strip prefix paths from incoming requests
>Server-Sent Events/SSE - support for Server-Sent Events/SSE
>TCP Proxy Support - raw TCP proxy support
>TCP-SNI Proxy Support - forward TLS connections based on hostname without re-encryption
>Traffic Shaping - forward N% of traffic upstream without knowing the number of instances
>Web UI - web ui to examine the current routing table
>Websocket Support - websocket support
🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :
Install from source, binary, Docker or Homebrew.
# go 1.9 or higher is required
1️⃣get github.com/fabiolb/fabio (>= go1.9)
2️⃣brew install fabio (OSX/macOS stable)
brew install --devel fabio (OSX/macOS devel)
3️⃣docker pull fabiolb/fabio (Docker)
https://github.com/fabiolb/fabio/releases (pre-built binaries)
4️⃣Register your service in consul.
5️⃣Make sure that each instance registers with a unique ServiceID and a service name without spaces.
6️⃣Register a health check in consul as described here.
7️⃣By default fabio only watches services which have a passing health check, unless overriden with registry.consul.service.status.
8️⃣Register one urlprefix- tag per host/path prefix it serves, e.g.:
#HTTP/S examples
urlprefix-/css # path route
urlprefix-i.com/static # host specific path route
urlprefix-mysite.com/ # host specific catch all route
urlprefix-/foo/bar strip=/foo # path stripping (forward '/bar' to upstream)
urlprefix-/foo/bar proto=https # HTTPS upstream
urlprefix-/foo/bar proto=https tlsskipverify=true # HTTPS upstream and self-signed cert
#TCP examples
urlprefix-:3306 proto=tcp # route external port 3306
Make sure the prefix for HTTP routes contains at least one slash (/).
9️⃣See the full list of options in the Documentation.
🔟Start fabio without a config file (assuming a running consul agent on localhost:8500) Watch the log output how fabio picks up the route to your service. Try starting/stopping your service to see how the routing table changes instantly.
> Send all your HTTP traffic to fabio on port 9999. For TCP proxying see TCP proxy.
Done
✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
🦑A fast, modern, zero-conf load balancing HTTP(S) router for deploying microservices:
🦑FEATURES :
>Access Logging - customizable access logs
>Access Control - route specific access control
>Certificate Stores - dynamic certificate stores like file system, HTTP server, Consul and Vault
>Compression - GZIP compression for HTTP responses
>Docker Support - Official Docker image, Registrator and Docker Compose example
>Dynamic Reloading - hot reloading of the routing table without downtime
>Graceful Shutdown - wait until requests have completed before shutting down
>HTTP Header Support - inject some HTTP headers into upstream requests
>HTTPS Upstreams - forward requests to HTTPS upstream servers
>Metrics Support - support for Graphite, StatsD/DataDog and Circonus
>PROXY Protocol Support - support for HA Proxy PROXY protocol for inbound requests (use for Amazon ELB)
>Path Stripping - strip prefix paths from incoming requests
>Server-Sent Events/SSE - support for Server-Sent Events/SSE
>TCP Proxy Support - raw TCP proxy support
>TCP-SNI Proxy Support - forward TLS connections based on hostname without re-encryption
>Traffic Shaping - forward N% of traffic upstream without knowing the number of instances
>Web UI - web ui to examine the current routing table
>Websocket Support - websocket support
🄸🄽🅂🅃🄰🄻🄻🄸🅂🄰🅃🄸🄾🄽 & 🅁🅄🄽 :
Install from source, binary, Docker or Homebrew.
# go 1.9 or higher is required
1️⃣get github.com/fabiolb/fabio (>= go1.9)
2️⃣brew install fabio (OSX/macOS stable)
brew install --devel fabio (OSX/macOS devel)
3️⃣docker pull fabiolb/fabio (Docker)
https://github.com/fabiolb/fabio/releases (pre-built binaries)
4️⃣Register your service in consul.
5️⃣Make sure that each instance registers with a unique ServiceID and a service name without spaces.
6️⃣Register a health check in consul as described here.
7️⃣By default fabio only watches services which have a passing health check, unless overriden with registry.consul.service.status.
8️⃣Register one urlprefix- tag per host/path prefix it serves, e.g.:
#HTTP/S examples
urlprefix-/css # path route
urlprefix-i.com/static # host specific path route
urlprefix-mysite.com/ # host specific catch all route
urlprefix-/foo/bar strip=/foo # path stripping (forward '/bar' to upstream)
urlprefix-/foo/bar proto=https # HTTPS upstream
urlprefix-/foo/bar proto=https tlsskipverify=true # HTTPS upstream and self-signed cert
#TCP examples
urlprefix-:3306 proto=tcp # route external port 3306
Make sure the prefix for HTTP routes contains at least one slash (/).
9️⃣See the full list of options in the Documentation.
🔟Start fabio without a config file (assuming a running consul agent on localhost:8500) Watch the log output how fabio picks up the route to your service. Try starting/stopping your service to see how the routing table changes instantly.
> Send all your HTTP traffic to fabio on port 9999. For TCP proxying see TCP proxy.
Done
✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
GitHub
GitHub - fabiolb/fabio: Consul Load-Balancing made simple
Consul Load-Balancing made simple. Contribute to fabiolb/fabio development by creating an account on GitHub.
🦑Netflix BINS✅
432328871765xxxx 03/24
432328033101xxxx 11/22
432328690263xxxx 05/24
Ccv generado
CP: 500001
IP 🇸🇦Arabia Saudita
BIN:
518868632255xxxx 09/22
518868100811xxxx 12/24
518868764405xxxx 10/24
Ccv generado
IP 🇦🇺 AUSTRALIA
> Provide us with screanshoats @Undercode_bot
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
432328871765xxxx 03/24
432328033101xxxx 11/22
432328690263xxxx 05/24
Ccv generado
CP: 500001
IP 🇸🇦Arabia Saudita
BIN:
518868632255xxxx 09/22
518868100811xxxx 12/24
518868764405xxxx 10/24
Ccv generado
IP 🇦🇺 AUSTRALIA
> Provide us with screanshoats @Undercode_bot
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
🦑Introduction to Gatsby —1.2 GB—-
2020 - build apps
https://mega.nz/folder/XXwigKwb#lBhgaljgnkHmhvkwHES0u
2020 - build apps
https://mega.nz/folder/XXwigKwb#lBhgaljgnkHmhvkwHES0u
mega.nz
File folder on MEGA
MEGA provides free cloud storage with convenient and powerful always-on privacy. Claim your free 50GB now!
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
🦑WIFI HACKING TOOLS 2020 POPULLAR
🦑 Hak5's Wi-Fi Pineapple
Fully-integrated Wi-Fi man-in-the-middle platform and rogue access point.
[Site](https://www.wifipineapple.com/)
Wiki
🦑 Aircrack-ng
Complete suite of tools to monitor, capture, export, attack and crack wireless
networks.
[Site](https://www.aircrack-ng.org/)
🦑 Airsnort
Site
🦑 Kismet
Useful for troubleshooting Wi-Fi networks. Detects hidden networks.
[Site](https://www.kismetwireless.net/)
🦑Kismac-ng
Network stumbling tool that works on Mac OS X and features support for built-in
WLAN NICs on some Macs.
Site
🦑Fern WiFi Cracker
Automated cracking and nice monitoring capabilities. Very easy to use.
[Site](http://www.fern-pro.com/)
🦑Cowpatty
Features offline dictionary cracking for WPA networks.
Site
🦑 Ghost Phisher
Tool designed around sniffing passwords with an AP emulator, DHCP/DNS/HTTP
server and logging to a built-in database.
[Site](https://github.com/savio-code/ghost-phisher)
# Online Wireless Resources
🦑Wigle.net
Consolidated location and information of wireless networks world-wide in a
centralized database--queried and updated via web app, native clients and
mobile applications.
Site
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
🦑WIFI HACKING TOOLS 2020 POPULLAR
🦑 Hak5's Wi-Fi Pineapple
Fully-integrated Wi-Fi man-in-the-middle platform and rogue access point.
[Site](https://www.wifipineapple.com/)
Wiki
🦑 Aircrack-ng
Complete suite of tools to monitor, capture, export, attack and crack wireless
networks.
[Site](https://www.aircrack-ng.org/)
🦑 Airsnort
Site
🦑 Kismet
Useful for troubleshooting Wi-Fi networks. Detects hidden networks.
[Site](https://www.kismetwireless.net/)
🦑Kismac-ng
Network stumbling tool that works on Mac OS X and features support for built-in
WLAN NICs on some Macs.
Site
🦑Fern WiFi Cracker
Automated cracking and nice monitoring capabilities. Very easy to use.
[Site](http://www.fern-pro.com/)
🦑Cowpatty
Features offline dictionary cracking for WPA networks.
Site
🦑 Ghost Phisher
Tool designed around sniffing passwords with an AP emulator, DHCP/DNS/HTTP
server and logging to a built-in database.
[Site](https://github.com/savio-code/ghost-phisher)
# Online Wireless Resources
🦑Wigle.net
Consolidated location and information of wireless networks world-wide in a
centralized database--queried and updated via web app, native clients and
mobile applications.
Site
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
Hak5
WiFi Pineapple
The industry standard WiFi pentest platform has evolved. Equip your red team with the WiFi Pineapple® Mark VII. Newly refined. Enterprise ready.
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
🦑Additional Notes for wireless pentest adapter
> which one should you choose :
1️⃣ Atheros (AR5XXX, AR9XXX)
Atheros chipsets have been used by many pen testers in the industry because the ability to perform well with many different systems and because it is open source. The main challenge with these drivers is that many laptops have migrated from PCMCIA bus and support for external Atheros-based cards is pretty limited.
2️⃣ Realtek (RTL8187)
The RTL8187 driver is used in many Alfa adapters (USB adapters). The RTL8187 driver is supported by the Linux kernel for years and has been the choice for many pen testers out there. The main challenge with this driver is the lack of 802.11 a, n, and ac support. It can be used for injecting packets into the wireless network and it works with MAC OS X.
3️⃣ Intel Pro Wireless (iwlwifi)
Many vendors out there use Intel 802.11 chipsets in their laptops and desktop systems in the PCIe bus.
Note: Latest versions of the Intel chipsets are supported by the
4️⃣ The Alfa External Wireless Adapters
The Alfa adapters have been used by many pen testers in the industry for years.
5️⃣ The original Alfa AWUS306H
This is the legacy model and basically obsolete.
6️⃣ The Alfa AWUS036NEH
Is the newer version of the AWUS306H and provides support for 802.11n and it is smaller than its predecessor. One of the main challenges out there is that it is not supported by MAC OS X with KisMAC. However, many people use them in laptops or desktop machines using Kali Linux.
7️⃣ The Alfa Atheros AR9271 AWUS036NHA
Compatible with 802.11b, 802.11g or 802.11n using 2.4 GHZ wavelength.
8️⃣ The Alfa AWUS051NH
It's basically the same as the AWUS036NEH, but it adds support for 5 GHz. It is also not supported by MAC OS X.
9️⃣ Panda PAU05
The Panda PAU05 is a 2.4 GHz wireless N adapter that uses the Ralink RT3070 Chipset.
🔟 TP-Link TL-WN722N (100mW)
Very cheap and compatible with Kali Linux. It is not perfect for packet injection.
> TP-Link N150 Wireless High Gain USB Adapter (TL-WN722N)
The TP-LINK TL-WN722N uses the Atheros AR9271 Chipset and is a wireless N adapter. Newer versions may not use the same chipset and you may run into problems with Kali Linux.
✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
🦑Additional Notes for wireless pentest adapter
> which one should you choose :
1️⃣ Atheros (AR5XXX, AR9XXX)
Atheros chipsets have been used by many pen testers in the industry because the ability to perform well with many different systems and because it is open source. The main challenge with these drivers is that many laptops have migrated from PCMCIA bus and support for external Atheros-based cards is pretty limited.
2️⃣ Realtek (RTL8187)
The RTL8187 driver is used in many Alfa adapters (USB adapters). The RTL8187 driver is supported by the Linux kernel for years and has been the choice for many pen testers out there. The main challenge with this driver is the lack of 802.11 a, n, and ac support. It can be used for injecting packets into the wireless network and it works with MAC OS X.
3️⃣ Intel Pro Wireless (iwlwifi)
Many vendors out there use Intel 802.11 chipsets in their laptops and desktop systems in the PCIe bus.
Note: Latest versions of the Intel chipsets are supported by the
iwlwifi or the iwlagn Linux drivers and supported by recent kernels.4️⃣ The Alfa External Wireless Adapters
The Alfa adapters have been used by many pen testers in the industry for years.
5️⃣ The original Alfa AWUS306H
This is the legacy model and basically obsolete.
6️⃣ The Alfa AWUS036NEH
Is the newer version of the AWUS306H and provides support for 802.11n and it is smaller than its predecessor. One of the main challenges out there is that it is not supported by MAC OS X with KisMAC. However, many people use them in laptops or desktop machines using Kali Linux.
7️⃣ The Alfa Atheros AR9271 AWUS036NHA
Compatible with 802.11b, 802.11g or 802.11n using 2.4 GHZ wavelength.
8️⃣ The Alfa AWUS051NH
It's basically the same as the AWUS036NEH, but it adds support for 5 GHz. It is also not supported by MAC OS X.
9️⃣ Panda PAU05
The Panda PAU05 is a 2.4 GHz wireless N adapter that uses the Ralink RT3070 Chipset.
🔟 TP-Link TL-WN722N (100mW)
Very cheap and compatible with Kali Linux. It is not perfect for packet injection.
> TP-Link N150 Wireless High Gain USB Adapter (TL-WN722N)
The TP-LINK TL-WN722N uses the Atheros AR9271 Chipset and is a wireless N adapter. Newer versions may not use the same chipset and you may run into problems with Kali Linux.
✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
Domain Persistence_ Golden Ticket Attack .pdf
4.7 MB
Domain Persistence_ Golden Ticket Attack
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
🦑#ZigBee Resources
Good explanation and introduction to Zigbee: http://resources.infosecinstitute.com/hacking-zigbee-networks/
KillerBee Presentation: http://www.willhackforsushi.com/presentations/toorcon11-wright.pdf
KillerBee Framework: https://github.com/riverloopsec/killerbee
The KillerBee framework is being expanded to support multiple devices. Currently there is support for the River Loop ApiMote, Atmel RZ RAVEN USB Stick, MoteIV Tmote Sky, TelosB mote, and Sewino Sniffer.
Open source hardware: https://github.com/riverloopsec/apimote
Attify ZigBee Framework GitHub Repo: https://github.com/attify/Attify-Zigbee-Framework
✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
🦑#ZigBee Resources
Good explanation and introduction to Zigbee: http://resources.infosecinstitute.com/hacking-zigbee-networks/
KillerBee Presentation: http://www.willhackforsushi.com/presentations/toorcon11-wright.pdf
KillerBee Framework: https://github.com/riverloopsec/killerbee
The KillerBee framework is being expanded to support multiple devices. Currently there is support for the River Loop ApiMote, Atmel RZ RAVEN USB Stick, MoteIV Tmote Sky, TelosB mote, and Sewino Sniffer.
Open source hardware: https://github.com/riverloopsec/apimote
Attify ZigBee Framework GitHub Repo: https://github.com/attify/Attify-Zigbee-Framework
✅git sources
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁
Infosec Resources
Hacking ZigBee Networks
What is ZigBee? Internet of Things (IoT) is what most experts consider as the next step of the Internet revolution where physical objects are invariably