Web Hacking For Beginners

Discover how Google dorking uses targeted search operators like site, in URL, in title, minus operator, and file type to reveal specific information, with examples from login queries and pastebin.

Learn web server fingerprinting by sending requests and analyzing headers and metadata, using nmap, netcat, and a web fingerprinting tool, then Webalizer to reveal Apache on Ubuntu and PHP version.

Learn to use the harvester to gather emails, domains, and subdomains from public sources. Clone the tool, run it with -d and -l, and apply proxies, --shorten, and --screenshot.

Explore http methods by comparing get and post for secure data, inspect requests with Burp Suite, and review options, put, delete, and curl usage.

Learn to enumerate users through error-based testing, guess usernames, automated enumeration, and wordlist attacks, demonstrated on a vulnerable WordPress lab with WPScan and Burp Suite.

Learn about password attacks, including default credentials, password guessing, and wordlist attacks, and explore generating custom word lists with crunch and testing with wpscan to access a site.

Idor stands for insecure direct object reference, a vulnerability where an application exposes internal objects such as profile ids to users, enabling unauthorized access or modification.

Learn how command injection lets attackers inject extra commands into a server through an IP address field, enabling file deletions, listing files, and gaining control.

Learn how http verb tampering exploits improper method validation by altering http request methods like post to delete or options, potentially bypassing authentication in web apps.

Learn how dom xss works by tracing source and sink and how untrusted data can be executed by document.write, enabling cookie theft or page modification.