http://www.ivizsecurity.com/blog/penetration-testing/live-cd-penetration-testing-pen/ Yesterday I was researching for some of the other lesser known live CDs for penetration testing. While I’m an avid user and a fan of backtrack, someone mentioned t…
Web Application Penetration Testing Local File Inclusion (LFI) Testing Techniques Jan 04, 2017, Version 1.0 Contents What is a Local File Inclusion (LFI) vulnerability? Example of Vulnerable Code Identifying LFI Vulnerabilities within Web Application…
第一部分 渗透测试步骤 ---参考资料 Ethical Hacking: The Value of Controlled Penetration Tests 下载地址 链接:https://pan.baidu.com/s/1ELFGTEnVx5d15eWHSmHzrQ 提取码:wd8l 复制这段内容后打开百度网盘手机App,操作更方便哦 1.Snort软件可以安装的操作系统的 Unix /Linux and windows .WinSinff可以安装的额操作系统 Windows 2.扫描…
MITM - ARP Poisoning Theory Man In The Middle Attacks - ARP Poisoning This is one of the most dangerous and effective attacks that can be used, it is used to redirect packets to and from any client to our device, and since we have the network key, we…
此文转载 XXE VALID USE CASE This is a nonmalicious example of how external entities are used: <?xml version="1.0" standalone="no" ?> <!DOCTYPE copyright [ <!ELEMENT copyright (#PCDATA)> <!ENTITY c SYSTEM "http://www.…
1. an SQLi vulnerability will allow you to do the following query the database using select statement forezample users table. you might get the password or usersname Bypass the login page executing successfuly query results Execute system commands…
1.本博客记载的是这本书的学习笔记,还有出现的一些不懂的单词 我也将会记载这篇博客中.记载顺序是按照本书的章节顺序来记载的.最喜欢本书中的一句 you havae no idea how good you have it 哈哈哈哈 需要经常光顾的安全网站 BugTrap AstaLaVista X-Force PacketStorm woowoo SecurityFocus penetration 渗透测试, 洞察力· liability 责任,债务.倾向…
PowerSploit: The Easiest Shell You'll Ever Get - Pentest... Sometimes you just want a shell. You dont want to worry about compiling a binary, testing it against antivirus, figuring out how to upload it to the box and finally... View…
OWASP ZAP(ZED ATTACK PROXY) Automatically find vulnerabilities in web applications. Free and easy to use. It can also be used for manual testing. This is the welcome page. Options Page Scan Policy Setting Page. Attack this target URL http://10.0.0.24…
SQL INJECTION SQLMAP Tool designed to exploit SQL injections. Works with many DB types, MySQL, MSSQL ...etc. >sqlmap --help >sqlmap -u [target URL] Following are examples: sqlmap -u "http://10.0.0.24/mutillidae/index.php?page=user-info.php&…
SQL INJECTION WHAT IS SQL? Most websites use a database to store data. Most data stored in it(usernames, passwords ..etc.) Web application reads, updates and inserts data in the database. Interaction with DB done using SQL. WHY ARE THEY SO DANGEROUS…
ARP Poisoning - arpspoof Arpspoof is a tool part of a suit called dsniff, which contains a number of network penetration tools. Arpspoof can be used to launch a MITM attack and redirect traffic to flow through our device. 1. Tell the target client th…
1.对本书出现的无线网络涉及的命令做一总结 查看无线网卡( Create a monitor mode interface using your card as shown in the following screenshot ) ifconfig -a ifconfig wlan0 (开启无线网卡) airmon-ng start wlan0(开启混杂&监听模式) 扫描无线端口 接入点,(Ensure that channel hopping happens across bout…
Ax_Download www.tenable.com/products/nessus-home,need sent email. Bx_Install su ls dpkg -i [filename] Xx_Start /etc/init.d/nessusd start open firefox enter https://www.[your ip address]:8834 enter name and email enter your user and password Cx_use Ne…
XSS VULNS XSS - CROSS SITE SCRIPTING VULNS Allow an attacker to inject javascript code into the page. The code is executed when the page loads. The code is executed on the client machine, not the server. Three main types: 1. Persistent/Stored XSS 2.…
SQL INJECTION Preventing SQLi Filters can be bypassed. Use a blacklist of commands? Still can be bypassed. Use whitelist? Same issue. -> Use parameterized statements, separate data from SQL code. <?php //$textbox1 = admin' union select # Select * fr…
SQL INJECTION Discovering SQLi in GET Inject by browser URL. Selecting Data From Database Change the number to a big one, then you can get a useful error message. And you can try different number to find the right column. Using “union select 1,2,3,4,…
REMOTE FILE INCLUSION Similar to local file inclusion. But allows an attacker to read ANY file from ANY server. Execute PHP files from other servers on the current server. Store PHP files on other servers as .txt. Pre-Condition: Set allow_url_include…
LOCAL FILE INCLUSION Allows an attacker to read ANY file on the same server. Access files outside www directory. Try to read /etc/passwd file. 1. We know the current file path from the following error. 2. Try to visit following URL: http://10.0.0.24…
