+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Is there an automated tool to exploit OWASP 10 vulns? (/showthread.php?tid=5176221)
Is there an automated tool to exploit OWASP 10 vulns? - Redshadow - Feb 19, 2016
Hello everyone. I'm new to this beautiful forum. Don't rage if am wrong, thank you!
Just wondering, is there a free or paid automated tool to exploit OWASP 10 vulns on website?
Leave a reply, thanks for reading this thread.
* - bass booster - Feb 19, 2016
So you want to use a test hack site with automated tool?
I smell a skid
#skidalert
* - SirNoobHack - Feb 19, 2016
(Feb 19, 2016 08:38 AM)bass booster Wrote: So you want to use a test hack site with automated tool?
I smell a skid
#skidalert
Probably, yes. OP you shouldn't try to exploit something if you don't know how and what it exploits.
* - .aaim - Feb 19, 2016
(Feb 19, 2016 07:03 AM)Redshadow Wrote: Hello everyone. I'm new to this beautiful forum. Don't rage if am wrong, thank you!
Just wondering, is there a free or paid automated tool to exploit OWASP 10 vulns on website?
Leave a reply, thanks for reading this thread.
There are automation tools like OWASP ZAP, Acunetix, Netsparker, which can automate the scan.But there are high chances of false negative. So its advised try to learn manual testing and understand the working of application to exploit. Try exploiting vulnerable machine on site like vulnhub.
* - Redshadow - Feb 20, 2016
(Feb 19, 2016 11:35 AM).aaim Wrote: There are automation tools like OWASP ZAP, Acunetix, Netsparker, which can automate the scan.But there are high chances of false negative. So its advised try to learn manual testing and understand the working of application to exploit. Try exploiting vulnerable machine on site like vulnhub.
Thanks for the advise man. Don't rage at my question. Do you know of any OWASP 10 vulns exploit tool like W3af?
* - .aaim - Feb 20, 2016
(Feb 20, 2016 04:13 AM)Redshadow Wrote: Thanks for the advise man. Don't rage at my question. Do you know of any OWASP 10 vulns exploit tool like W3af?
I have already mentioned them. OWASP ZAP is the project of OWASP community only and is open source, so you can try that.
Try to search for OWASP top 10 searching tools. will surely give you list of different free and good tools with their advantages/disadvantages.
Also try to follow OWASP top 10 testing guide 4.0. Which mentions different vulnerabilities and how to test them manually or by using automated tools. Hope the following link will help you.
https www(dot)owasp(dot)org/index(dot)php/ZAPpingTheTop10
* - Redshadow - Feb 20, 2016
(Feb 20, 2016 11:11 AM).aaim Wrote: I have already mentioned them. OWASP ZAP is the project of OWASP community only and is open source, so you can try that.
Try to search for OWASP top 10 searching tools. will surely give you list of different free and good tools with their advantages/disadvantages.
Also try to follow OWASP top 10 testing guide 4.0. Which mentions different vulnerabilities and how to test them manually or by using automated tools. Hope the following link will help you.
https www(dot)owasp(dot)org/index(dot)php/ZAPpingTheTop10
Thanks man, I will do more research on this but for now, I just finished scanning a website with OWASP ZAP in Kali Linux 2.0.
Vulns Discovered Are:
1. Secure Page Includes Mixed Content Including Script
2. X-Frame-Options Header Not Set
3. Cookie Set Without Secure Flag
4. Cross-Domain Javascript Sources File Inclusion
5. Incomplete Or No Cache-Control And Pragma HTTP Header Set
6. Secure Page Includes Mixed Content
7. Web Browser XSS Protection Not Enabled
8. X-Content-Type-Options Header Missing
How do I go about exploiting these vulns found in OWASP ZAP scan results?
For now, I can only exploit sql injection vulns. Please don't be angry by my ignorant. I am new here!