Be a Web Application Penetration Tester from Scratch

Installation might be tricky for various user as some of us are in windows and some are on MAC. This video will take all of us to the same page. MAC user can use Oracle Virtual Box and windows users can use Vm player to install kali as virtual Operating system. Having entire seperate machine as pentest lab is not prefered at all.

Although, if you have once installed Kali Linux on Virtual machines, then installing windows is not a big deal. But still we don't want you to leave in any kind of question. This movie will walk you through installation of windows based operating system in Virtual environment.

after installation of kali the first that you want to do is to take a quick look on how this operating system looks like. it's just a simple Debian based system having a lot of pentesting tools preinstalled. This makes all the thing as plug and play option.

This movie will talk about, what we have done so far in the course. It will help you to make sure that we all are on same page.

Having target is great but getting information about target is not that easy. Every small information like email and login page is of very high importance. IN pentesting gathering information requires fixed steps and there should also be time limit to gather information. You cannot dedicate endless time, waiting that some information will pop up.

For any initial research about target, Google is the best website to look for. But don't be narrow minded. There are lot of other websites like DuckDuckgo and Baidu. Make sure that you take use of all resources. If you are using google then make use that you are aware of google dorks for precised results.

As we were talking about google dorks, you should be aware of few website (discussed in the movie) so that you are all time aware of important and updated dorks of Google. Also we will talk about Shodan which is a unique search engine.

Many time to analyze any website, without triggering the alarm, we need to check out for few links and related stuff. We can do that by taking an offline copy of the site. For this we can use httrack, which is available for windows as well as Linux.

Zone transfer comprises a preamble followed by the actual data transfer. The preamble comprises a lookup of the Start of Authority (SOA) resource record for the "zone apex", the node of the DNS namespace that is at the top of the "zone". The fields of this SOA resource record, in particular the "serial number", determine whether the actual data transfer need occur at all.

Nmap (Network Mapper) is a security scanner originally written by Gordon Lyon (also known by his pseudonym Fyodor Vaskovich) used to discover hosts and services on a computer network, thus creating a "map" of the network. To accomplish its goal, Nmap sends specially crafted packets to the target host and then analyzes the responses.

It is important that you should be aware of tools but having too much dependencies on tools is surely going to lead into future problems. A real pentester is never dependent on tools but will always looking to create new tools for future use.

This movie will talk about, what we have done so far in the course. It will help you to make sure that we all are on same page.

this entire section is dedicated to OWASP. It is easy to understand how tools works but tough to have a guideline that when to use which tool. This section will take you through step by step process of analyzing each phase of an application.

There are several different vendors and versions of web servers on the market today. Knowing the type of web server that is being tested significantly helps in the testing process and can also change the course of the test. Please note that it usually takes several different commands to accurately identify the web server, as different versions may react similarly to the same command.

Code review is probably the single-most effective technique for identifying security flaws. When used together with automated tools and manual penetration testing, code review can significantly increase the cost effectiveness of an application security verification effort.

A Web crawler is an Internet bot that systematically browses the World Wide Web, typically for the purpose of Web indexing. A Web crawler may also be called a Web spider, an ant, an automatic indexer, or (in the FOAF software context) a Web scutter.

Web search engines and some other sites use Web crawling or spidering software to update their web content or indexes of others sites' web content.

A filename extension is a suffix (separated from the base filename by a dot or space) to the name of a computer file applied to indicate the encoding (file format) of its contents or usage. Examples of filename extensions are .png, .jpeg, .exe, .dmg and .txt.

The Hypertext Transfer Protocol (HTTP) is designed to enable communications between clients and servers.

HTTP works as a request-response protocol between a client and server.

A web browser may be the client, and an application on a computer that hosts a web site may be the server.

Example: A client (browser) submits an HTTP request to the server; then the server returns a response to the client. The response contains status information about the request and may also contain the requested content.

identity management (IdM) describes the management of individual principals, their authentication, authorization, and privileges within or across system and enterprise boundaries with the goal of increasing security and productivity while decreasing cost, downtime and repetitive tasks.

The terms "Identity Management" and "Identity and Access Management" (or IAM) are used interchangeably in the area of Identity access management, while identity management itself falls under the umbrella of IT Security

When we design a new application, usually developer create some test accounts and at latter point, they forget to remove them. Make sure that every test account is disabled. Also look for crediantials in the code comments. Usually there is password of the account is lying there.

Credentials in cryptography establish the identity of a party to communication. Usually they take the form of machine-readable cryptographic keys and/or passwords. Cryptographic credentials may be self-issued, or issued by a trusted third party; in many cases the only criterion for issuance is unambiguous association of the credential with a specific, real individual or other entity

While most applications require authentication to gain access to private information or to execute tasks, not every authentication method is able to provide adequate security. Negligence, ignorance, or simple understatement of security threats often result in authentication schemes that can be bypassed by simply skipping the log in page and directly calling an internal page that is supposed to be accessed only after authentication has been performed.

A password policy is a set of rules designed to enhance computer security by encouraging users to employ strong passwords and use them properly. A password policy is often part of an organization's official regulations and may be taught as part of security awareness training. The password policy may either be advisory or mandated by technical means. Some governments have national authentication frameworks that define requirements for user authentication to government services, including requirements for passwords.

A security question is used as an authenticator by banks, cable companies and wireless providers as an extra security layer. Due to the commonplace nature of social-media, many of the older traditional security questions are no longer useful or secure. It is important to remember that a security question is just another password

File inclusion vulnerability is a type of vulnerability most often found on websites. It allows an attacker to include a file, usually through a script on the web server. The vulnerability occurs due to the use of user-supplied input without proper validation. This can lead to something as minimal as outputting the contents of the file or more serious events such as:

1. Code execution on the web server
2. Code execution on the client-side such as JavaScript which can lead to other attacks such as cross site scripting (XSS)
3. Denial of service (DoS)
4. Data theft/manipulation

Applications frequently use the actual name or key of an object when generating web pages. Applications don't always verify the user is authorized for the target object. This results in an insecure direct object reference flaw. Testers can easily manipulate parameter values to detect such flaws. Code analysis quickly shows whether authorization is properly verified.

In computer science, in particular networking, a session is a semi-permanent interactive information interchange, also known as a dialogue, a conversation or a meeting, between two or more communicating devices, or between a computer and user (see Login session). A session is set up or established at a certain point in time, and then torn down at some later point. An established communication session may involve more than one message in each direction. A session is typically, but not always, stateful, meaning that at least one of the communicating parts needs to save information about the session history in order to be able to communicate, as opposed to stateless communication, where the communication consists of independent requests with responses.

Most client-server sessions are maintained by the transport layer - a single connection for a single session. However each transaction phase of a Web/HTTP session creates a separate connection. Maintaining session continuity between phases required a session ID. The session ID is embedded within the <A HREF> or <FORM> links of dynamic web pages so that it is passed back to the CGI. CGI then uses the session ID to ensure session continuity between transaction phases. One advantage of one connection-per-phase is that it works well over low bandwidth (modem) connections. Deity used a sessionID, screenID and actionID to simplify the design of multiple phase sessions.

Cross-site request forgery, also known as a one-click attack or session riding and abbreviated as CSRF (sometimes pronounced sea-surf) or XSRF, is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts. Unlike cross-site scripting (XSS), which exploits the trust a user has for a particular site, CSRF exploits the trust that a site has in a user's browser.

a login or logon or sign in refers to the credentials required to obtain access to a computer system or other restricted area. Logging in or on and signing in or on is the process by which individual access to a computer system is controlled by identifying and authenticating the user through the credentials presented by the user.

Once a user has logged in, they can then log out or log off when access is no longer needed. To log out is to close off one's access to a computer system after having previously logged in.

SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker). SQL injection must exploit a security vulnerability in an application's software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database.

This movie will talk about, what we have done so far in the course. It will help you to make sure that we all are on same page.

Webshag is a multi-threaded, multi-platform web server audit tool. Written in Python, it gathers commonly useful functionalities for web server auditing like website crawling, URL scanning or file fuzzing.

Webshag can be used to scan a web server in HTTP or HTTPS, through a proxy and using HTTP authentication (Basic and Digest). In addition to that it proposes innovative IDS evasion functionalities aimed at making correlation between request more complicated (e.g. use a different random per request HTTP proxy server).

The Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications.

It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing.

ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually.

WebSploit Advanced MITM Framework

• Autopwn - Used From Metasploit For Scan and Exploit Target Service
• wmap - Scan,Crawler Target Used From Metasploit wmap plugin
• format infector - inject reverse & bind payload into file format
• phpmyadmin Scanner
• CloudFlare resolver
• LFI Bypasser
• Apache Users Scanner
• Dir Bruter
• admin finder
• MLITM Attack - Man Left In The Middle, XSS Phishing Attacks
• MITM - Man In The Middle Attack
• Java Applet Attack
• MFOD Attack Vector
• ARP Dos Attack
• Web Killer Attack
• Fake Update Attack
• Fake Access point Attack
• Wifi Honeypot
• Wifi Jammer
• Wifi Dos
• Wifi Mass De-Authentication Attack
• Bluetooth POD Attack

In cryptography, a brute-force attack, or exhaustive key search, is a cryptanalytic attack that can, in theory, be used against any encrypted data (except for data encrypted in an information-theoretically secure manner). Such an attack might be used when it is not possible to take advantage of other weaknesses in an encryption system (if any exist) that would make the task easier. It consists of systematically checking all possible keys or passwords until the correct one is found. In the worst case, this would involve traversing the entire search space

The Social-Engineer Toolkit (SET) was created and written by the founder of TrustedSec. It is an open-source Python-driven tool aimed at penetration testing around Social-Engineering. SET has been presented at large-scale conferences including Blackhat, DerbyCon, Defcon, and ShmooCon. With over two million downloads, SET is the standard for social-engineering penetration tests and supported heavily within the security community.

Security is not at all top priority

Too much v/s Too less

100$-200$ per hour; APP: 2000$-3000$

We will alo talk about standards of audit report

Steps:

1. Approach and meeting.

In this movie we will create a formal report. WHile creating formal report, we should take care about the format. A detailed format is mentioned in this movie that will help you to prepare good report.

In this movie we will install a deliberately vulnerable for testing purposes. Make sure that you are not connected to internet while running this machine as this machine is vulnerable and any other attacker may get into your system. All resource are available for free.

When password guessing, this method is very fast when used to check all short passwords, but for longer passwords other methods such as the dictionary attack are used because of the time a brute-force search takes.

When key guessing, the key length used in the cipher determines the practical feasibility of performing a brute-force attack, with longer keys exponentially more difficult to crack than shorter ones.

arbitrary code execution is used to describe an attacker's ability to execute any commands of the attacker's choice on a target machine or in a target process. It is commonly used in arbitrary code execution vulnerability to describe a software bug that gives an attacker a way to execute arbitrary code. A program that is designed to exploit such a vulnerability is called an arbitrary code execution exploit. Most of these vulnerabilities allow the execution of machine code and most exploits therefore inject and execute shellcode to give an attacker an easy way to manually run arbitrary commands. The ability to trigger arbitrary code execution from one machine on another (especially via a wide-area network such as the Internet) is often referred to as remote code execution.

The attack works by including a link or script in a page that accesses a site to which the user is known (or is supposed) to have been authenticated. For example, one user, Alice, might be browsing a chat forum where another user, Mallory, has posted a message.

File inclusion vulnerability is a type of vulnerability most often found on websites. It allows an attacker to include a file, usually through a script on the web server. The vulnerability occurs due to the use of user-supplied input without proper validation. This can lead to something as minimal as outputting the contents of the file

With most development platforms, parameterized statements that work with parameters can be used (sometimes called placeholders or bind variables) instead of embedding user input in the statement. A placeholder can only store a value of the given type and not an arbitrary SQL fragment. Hence the SQL injection would simply be treated as a strange (and probably invalid) parameter value.

In many cases, the SQL statement is fixed, and each parameter is a scalar, not a table. The user input is then assigned (bound) to a parameter

Website defacement is an attack on a website that changes the visual appearance of the site or a webpage. These are typically the work of system crackers, who break into a web server and replace the hosted website with one of their own. Defacement is generally meant as a kind of electronic graffiti, although recently it has become a means to spread messages by politically motivated "cyber protesters" or hacktivists.

Lets practice on a bit detailed platform then the last one. Web Goat is currently very broad aplication to practice vulnerabilities. You can download the 7zip version of the application or if you want the other file type, then installtion steps will very a little

Writing an end to this course is not at all possible. We will be adding more videos in this course on monthly basis so that you can get updates on modern attack vectors.