Web Hacking for Beginners

Explore the basics of SQL and databases, and learn how SQL injection can expose data through select queries, where clauses, and credential risks.

Explore SQL injection as a code injection technique that can bypass login screens by making true statements and ignoring password checks.

Learn to perform sql injection using sqlmap, identify injection points, enumerate databases, tables, and columns, dump data, and optionally crack passwords with a dictionary attack.

learn to prevent sql injection in a PHP web app by applying mysql_real_escape_string and strip_slashes to user input, testing with low security and blocking injections at high security.

Explore how WPScan, a WordPress security scanner, identifies weaknesses through user and plugin enumeration and password brute-force checks on WordPress installations.

Install a local WordPress site, run WPScan to identify version and vulnerable plugins, enumerate user accounts, and assess login security through a brute-force test.

Secure a WordPress site with the all-in-one wp security plugin. Hide the WordPress version, change the admin username, enable brute-force protection, and disable user enumeration; verify with wp scan.

Understand cross-site scripting, a client-side vulnerability that lets attackers inject malicious code to steal cookies, session tokens, and sensitive data. Learn stored (persisted) and reflected XSS types, and see demonstration.

Explore stored cross-site scripting by injecting scripts into blog entries, embedding pages with iframes, and stealing session cookies to impersonate users and access admin accounts.

Learn to prevent cross-site scripting by using the H.M.S. special chars function to convert special characters to HTML entities, then sanitize and wrap any output with UTF-8 encoding via pre_event_access.php.

Learn how BeEF, the browser exploitation framework, hooks browsers with injected JavaScript, manages infected pages locally, and demonstrates alerts, social engineering login captures, and redirects.

Learn how to gain full control over a target using BeEF and Metasploit to craft a reverse payload, deploy an infected site, and establish a listener for remote access.

The lecture explains how the BeEF framework injects malicious JavaScript and shows how a vegan extension can detect and block these actions on a test page.

Explore the concept of a PHP backdoor using Weevely to gain remote access, including uploading a backdoor, establishing a shell, and basic server reconnaissance.

Explore how cross-site request forgery tricks a logged-in user into performing actions. The lecture demonstrates changing a victim's password and discusses social engineering and forged requests.

Explore phishing attacks using social engineering to steal credentials through fake clone websites that harvest usernames and passwords, demonstrated with a credential harvester and website cloning.

Secure your website and personal data by scanning for vulnerabilities with Vega, hardening WordPress with a strong username and security plugins, and using SSL.

Discover how the world works, use a scanner, and explore sequel injection, WordPress security, cross-site scripting, cross-site requests, phishing, and gaining control over targets.