+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: how to find website vulnerabilities without google dorks (/showthread.php?tid=5160355)
Pages: Pages
1
2
how to find website vulnerabilities without google dorks - TripleBD - Feb 5, 2016
Hello HF members, I was just wondering how to find website vulnerabilities. I have seen people use google dorks to find random websites but is there any other way? I have read about scanners like acunetix but it is too loud. I am completely new to this and would love if someone helped out. Thanks.[/size]
* - Niko - Feb 6, 2016
You could always try site specific google dorks
Ex) site:yoursite.com ext:php inurl:".php?id="
* - •^v^–[ bLacKn3x ]–^v^• - Feb 6, 2016
You can try to inject POST Parameter if you can't find any GET vuln .
Login- or searching forms for example .
* - TripleBD - Feb 6, 2016
Thanks. Will be trying these methods out. If anyone else has any other ideas please post it.
* - bobby1431 - Feb 9, 2016
thanks thanks thanks thanks thanks
* - TripleBD - Feb 9, 2016
Bump. Would love more tips
* - Razor Dz Trigger - Feb 10, 2016
If you want to Find a vuln in target website ! its easy !
1.Accuntiex !
2.W3aF
3.NikTo
4.if wordpress try wpscan !
and google for some tutorial !
* - Cxdde3990xc - Feb 10, 2016
(Feb 10, 2016 10:46 AM)Dr.MoOn Wrote: If you want to Find a vuln in target website ! its easy !
1.Accuntiex !
2.W3aF
3.NikTo
4.if wordpress try wpscan !
and google for some tutorial !
I died after reading the first 3 because you clearly trust them too much
* - .aaim - Feb 10, 2016
Hi TripleBD, I don't think so, there is any specific tool which will discover all the vulnerabilities from your website. I will be suggesting the same as what others have suggested like google dork for specific site, automated scanners/tools or some good scripts.
In addition to that will suggest you to follow some OWASP Testing guidelines and/or ASVS checklist to test your application.
* - Pixel2604 - Feb 11, 2016
=> Web Security Scanner (Vega)
* - TripleBD - Feb 11, 2016
(Feb 11, 2016 06:56 AM)Pixel2604 Wrote: => Web Security Scanner (Vega)
Is the scanner "loud"?
* - Vellichor - Feb 12, 2016
(Feb 11, 2016 08:26 PM)TripleBD Wrote: Is the scanner "loud"?Every single scanner you'll find is 'loud'.
* - Disparity - Feb 12, 2016
(Feb 10, 2016 10:46 AM)Dr.MoOn Wrote: If you want to Find a vuln in target website ! its easy !
1.Accuntiex !
2.W3aF
3.NikTo
4.if wordpress try wpscan !
and google for some tutorial !
no
* - Noah_ - Feb 12, 2016
First thing I do is see if my target is running a CMS.
If they are I look for public vulns in the CMS.
If there's plugins for the CMS, I look for vulns there too.
If there's nothing there I check for SQLi. (Most of the time you can inject). If there's no injection point then i try networking.
I nmap scan and check out the Daemons and see if I can exploit anything there.
You need a higher level of computers to really hack a website. I don't even suggest attempting to hack a website without really knowing what you're doing. If you want to experiment, set up labs.
* - phuqer - Feb 12, 2016
Try looking up shodan. It'll change your life.