+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Web Hacking Explained Common Web Application Hacking Techniques (/showthread.php?tid=30193)
Web Hacking Explained Common Web Application Hacking Techniques - Rino3444 - Oct 10, 2008
Chapter 1:- Preparing Ourselves
This might be a little abrupt start for our hacking lectures but I have to make this one as I a lot of people were messaging me regarding this stuff
What is Web Hacking :-
Web Hacking is a technique that relies purely on HTTP traffic to hack. It means the only gross tool you need a application that enables you to parse HTTP traffic , that is obviously your web-browser
Now which web-browser to choose :-
You can use any webbrowser you like. But I recommend using Firefox as its plugins/addons gives you an edge over the web application security
Some of the useful plugins:-
Web Developer Toolbar
Tamper Data
Advanced Dork
Live HTTP Headers
Ref Control
User Agent Switcher -- You don't really need it use -- about:config->general.useragent.overide->new string value
Switch Proxy
FireBug
etc. can't think of more will add as soon I think some other are relevant for webhacking
Don't like firefox :-
Use opera or lynx , I don't care as long as you understand basics .everything should go smooth
Infact I myself use Opera (coz it works good on slow connections)
What are the different types of Web Hacking techniques ?
The most common webhacking techniques prevalent these days are XSS , CSRF , RFI ,LFI and SQL injection. Most commonly you'll encounter these kind of vulnerabilities.
Now let me explain all these terms in brief . in subsequent lectures we'll discuss them in detail
:::::::::::::::::::: XSS :::::::::::::::::::::::::
Cross Site Scripting commonly called as XSS
[remember CSS stands for Casacading Style Sheets ]
it is a method of attck where the webserver is tricked to display/execute/present malicious HTML/javascript client side script to the victim
Most commonly XSS is used for Stealing Sessions ,cookies ,Phishing (If a login page a XSS vulnerable , makes the attack stealthy ) , or tricking user by displaying wrong info
Look out the XSS thread to get your targets :-
::::::::::::::::::::: CSRF :::::::::::::::::::::::::
Cross site Request forgery abbreviated as CSRF or XSRF
this type of attack uses a websites trust to exploit the user. some of the urls of the site are meant for certain tasks
::::::::::::::::::::RFI & LFI :::::::::::::::::::::::
Remote File Inclusion and Local File Inlcusion
It is a server side scripting vulnerability . This type of attack occurs when a programmer forgets to predefine the variables which are used to include files .If a server side script (php) calls for another script to be inlcuded through a variable . then we can inject the variable to include our remote file (usually a php shell) or local file (usually password file :- etc/passwd)
::::::::::::::::: SQL injections ::::::::::::::::
These vulnerability arise when a programmer fails sanitise user input and has a buggy sql query that permits execution of other sql commands
this type of attack can be used to get hold of entire database by extraction of data
well SQL injection is a very big topic in itslef we'll talk about it later in great details
Now i think you have understood the basics of various web hacking techniques
we'll be studying them deeply in next few lectures
Suggestions and Feedbacks are appreciated
- Be6tu5 - Oct 10, 2008
Thanks for the quick crash course Rino3444. 🙂