UNDERCODE SECURITY
226 subscribers
295 photos
1.03K files
1.73K links
πŸ¦‘WELCOME IN UNDERCODE TESTING FOR LEARN HACKING | PROGRAMMING | SECURITY & more..

THIS CHANNEL BY :

@UndercodeTesting
UndercodeTesting.com (official)

@iUndercode
iUndercode.com (iOs)

@Dailycve
DailyCve.com


@UndercodeNews
UndercodeNews.com
Download Telegram
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘How to build Debian packages from source ?

Install the required build tools
To build a binary package from source, we first need to install the required build tools. Depending on the command line tool to build the binary package, you may need to install any of the following packages:

1-dpkg-dev
2-devscripts


1) These packages provide many tools for building binary packages from source.

To install "dpkg-dev", run:

$ sudo apt install dpkg-dev


2) To install the β€œdevscripts” package, use the following command:

$ sudo apt install devscripts


3) Include source repositories
Make sure you enable the source repositories.

4) To do this, open the file /etc/apt/sources.list:

$ sudo vim /etc/apt/sources.list


5) You will see several lines in it as shown below:

# See http://help.ubuntu.com/community/UpgradeNotes for how to upgrade to
# newer versions of the distribution.
deb http://in.archive.ubuntu.com/ubuntu focal main restricted
# deb-src http://in.archive.ubuntu.com/ubuntu focal main restricted
[...]

6) To download the source packages, you need to uncomment the "deb-src" line. Remove the # character to uncomment the line. After uncommenting, the repository lines should look like this:

# See http://help.ubuntu.com/community/UpgradeNotes for how to upgrade to
# newer versions of the distribution.
deb http://in.archive.ubuntu.com/ubuntu focal main restricted
deb-src http://in.archive.ubuntu.com/ubuntu focal main restricted
[...]

Save and close the file. Update the list of repositories using the command:

$ sudo apt update

7) Download source packages
Download the source code of the package using the command β€œapt source <package-name>”. For example, the following command will download the source code for β€œgrayex World!” program:

$ apt source yourname

8) Modify debian package source
Cd to the directory containing the package source code.

$ cd yourname-1.10

9) Modify the code as you wish. The code is located in the file "andreyex.c" in the "src" directory.

$ vi src / yourname.c

10) Change the code and / or make any changes. After editing the code, save and close the file.

It's time to create the actual .deb package.

@UndercodeTesting
@UndercodeHacking
@UndercodeSecurity
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘for beginers How to find out someone else's IP (anyone) by sending him a link ?

A) IP logger
IP Logger URL Shortener allows you to track and log IP addresses, GPS location.

IP Logger URL Shortener provides IP address access checker, check what my IP services are, counters and informants.

Step 1. Go to the page https://iplogger.org.

Step 2. Select an option. Location Tracking, Image / Link, Invisible Logger

Step 3: For the purposes of this tutorial, we will be using URL Shortener.
Enter the URL and click Get Logger Code.

Step 4: Copy the IPLogger link for collecting statistics (no BB codes)

Step 5: Remember the IPLogger ID (required to access the registration statistics!), You will need it later to get registered IP addresses.

https://iplogger.org

B) Grabify
Grabify IP Logger allows you to track who clicked on your links. find IP addresses from Facebook, Twitter, friends on other sites.

Step 1: go to https://grabify.link

Step 2. Enter a webpage link to the Grabify website and click the Generate URL button,

Step 3: You will now have a new tracking link like for example. https://grabify.link/GK9OK5 you can use the button below to change the domain of the link to another domain that is less recognizable, or you can use your own domain.

Step 4: Save the tracking code or connection link you will need to get the IP addresses of those who clicked on your Grabify link.

https://grabify.link


@UndercodeTesting
@UndercodeHacking
@UndercodeSecurity
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘πŸ Brute SSH the remote server :


1) For brute-force attacks (brute-force attacks), we will use the Hydra tool , which is included with the Kali Linux distribution. SSH is present on any Linux or Unix server and is generally the primary use for administrators to access and control their systems.

Warning: Hydra is an attack tool

β€œ Use it only on your own systems and networks unless you have written permission from the owner. Otherwise, it is illegal . "

2) To implement the attack, use the command:

# hydra -s 22 -l root -P / usr / share / wordlists / fasttrack .txt 192.168.1.1 -t 4 ssh

3) Now let's analyze it:

- s - The flag indicates the port. It is worth noting that administrators can replace the default port 22 for the ssh service , in order to find out on which port the service is running, it is necessary to perform an initial scan of the target using the Nmap tool . We wrote about how to do this earlier in the article .

- l - the flag indicates the login, in our example we use root and admin. (we can provide a link to the dictionary here)

- P - the flag indicates the password, in our case we use the fasttrack .txt dictionary from the kali distribution , which is located in the / usr / share / wordlists / directory

4) It is worth noting that in order to effectively carry out a brute-force attack, it is worth paying due attention to the preparation of the dictionary, namely: taking into account geographical and linguistic peculiarities, including in the dictionary the name of the company, the names of its subsidiaries, the names of the operating services and applications, the names of employees, etc.

192.168.1.1 - ip address of the target, since the target we are using has a white ip, it is smeared

- t - the flag indicates the number of simultaneously used threads. We indicate 4

ssh - used protocol

5) Based on the results of the team's work, we see that the passwords from the dictionary did not fit for the admin and root logins

@UndercodeTesting
@UndercodeHacking
@UndercodeSecurity
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘SINCE LINUX IS A GOOD target BY HACKERS IN 2020
INSTALL 1 FROM THOSE ANTI-MALWARES & FIREWALLS :

https://www.clamav.net/

https://secure2.sophos.com/en-us/products/free-tools.aspx

https://firejailtools.wordpress.com/

http://rkhunter.sourceforge.net/

https://www.qubes-os.org/

@UndercodeTesting
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘SOME FACEBOOK SCRAPER TOOLS 2020 :

facebook
-post-scraper. Has comments. Uses Selenium.
facebook-scraper-selenium. "Scrape posts from any group or user into a .csv file without needing to register for any API access".
>https://github.com/brutalsavage/facebook-post-scraper

Ultimate Facebook Scraper. "Scrapes almost everything about a Facebook user's profile". Uses Selenium.
>https://github.com/apurvmishra99/facebook-scraper-selenium

Unofficial APIs. List of unofficial APIs for various services, none for Facebook for now, but might be worth to check in the future.
> https://github.com/Rolstenhouse/unofficial-apis

major-scrapy-spiders. Has a profile spider for Scrapy.
>https://github.com/talhashraf/major-scrapy-spiders

facebook-page-post-scraper. Seems abandoned.
FBLYZE. Fork (?).
> https://github.com/DIYgod/RSSHub/blob/master/lib/routes/facebook/page.js

RSSHub. Generates an RSS feed from Facebook pages.
RSS-Bridge. Also generates RSS feeds from Facebook pages.
> https://github.com/RSS-Bridge/rss-bridge/blob/master/bridges/FacebookBridge.php

@UndercodeTesting
@UndercodeHacking
@UndercodeSecurity
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘Serious RCE Flaw Revealed in Popular LibreOffice and OpenOffice Programs ?

1) It's since 2019 and simply opening an innocent office document file on your system could allow hackers to hack into your computer.

2) No, I'm not talking about another vulnerability in Microsoft Office, but about two other most popular alternatives - LibreOffice and Apache OpenOffice - free open source office software used by millions of Windows, MacOS and Linux users.

3) Security researcher Alex Infyur discovered a serious remote code execution (RCE) vulnerability in these two open source office suites, which could be caused by simply opening a maliciously crafted ODT (OpenDocument Text) file.

4) The attack relies on exploiting a directory traversal vulnerability, identified as CVE-2018-16858, to automatically launch a specific software-related python library using a hidden onmouseover event.

5)To exploit this vulnerability, InfΓΌhr created an ODT file with a white hyperlink (so it cannot be seen) that contains an "onmouseover" event to trick the victim into running a locally available python file on their system when placing the mouse anywhere. to an invisible hyperlink.

6) According to the researcher, a python file named "pydoc.py", which is part of LibreOffice's native Python interpreter, accepts arbitrary commands in one of its parameters and executes them through the command line or system console.

PoC Exploit example video :

https://www.youtube.com/watch?v=zVHsKPwtPo4


@UndercodeTesting
@UndercodeHacking
@UndercodeSecurity
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘How to Install and Configure Psensor Sensor Monitor in Linux ?

Installing Psensor

1) It is recommended that you install the β€œlm-sensors” package first before installing psensor to enable extended support for reading various sensors built into the hardware. Run the command below to install lm-sensors in Ubuntu:

$ sudo apt install lm-sensors

2) You can search for the term β€œlm-sensors” in package managers of other Linux distributions.

Once lm-sensors package has been installed, run the command below to enable detection of sensors:

$ sudo sensors-detect

3) Follow the on-screen instructions and enter your answers after carefully reading each question. When you are asked to β€œautomatically add lines”, choose yes. Once you are through the command line wizard, reboot your system and run the command below to view sensor information in a terminal:

$ sensors

4) Now to install psensor in Ubuntu, run the command below:

$ sudo apt install psensor
Packages for other Linux distributions are available here (scroll down).

πŸ¦‘First Run Setup

Launch β€œPsensor” from the application launcher to start the app. You will be presented with a window showing various graphs, sensor readings and threshold values. You will also get a system tray icon for quick access to menu options and current readings.

Now there are two things you might want to configure to tweak the behaviour of the Psensor app. First, you may want to disable the graphical window so that it doesn’t appear everytime you run Psensor. To do so, go to preferences and check the β€œHide window on startup” checkbox in the β€œStartup” tab. To manually view the graphical window, you can use the β€œShow” option in the system tray icon.

Secondly, you may want to automatically launch Psensor in every session. In the same β€œStartup” tab, you will find another checkbox β€œLaunch on session startup”. Check it to launch Psensor automatically on every boot.


@UndercodeTesting
@UndercodeHacking
@UndercodeSecurity
▁ β–‚ β–„ Uπ•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
Forwarded from UNDERCODE NEWS
Social media giant Facebook launched Facebook Pay in August of this year, a payment program for small and medium-sized businesses’ online transactions
#Updates
_
Forwarded from UNDERCODE NEWS
Go up against the breeze! Google aims to amend guidance to reiterate that its charging scheme must be used for in-app transactions.
#international
_
Forwarded from UNDERCODE NEWS
WeChat ate up my phone space before software swallowed the world
#Vulnerabilities
_