(Jun 12, 2017 05:00 AM)pop.pop.ret Wrote:  PHP and SQL are definitely two great starting points. You pretty much answered your own question.
Don't bother focusing on learning SQL injection, instead just learn PHP and various DBMS languages then you should naturally begin to understand how SQLi works

(Jun 12, 2017 05:08 AM)UKpower Wrote:  can u suggest me few books?

---

should I learn PHP to understand DBMS better?

• Do I just want to do website penetration testing?
  


• What do I already know?
  

(Jun 12, 2017 05:17 AM)pop.pop.ret Wrote:  Yeah, look into the mysqli_* functions and PDO prepared statements within PHP - then learn various flavours of SQL e.g. MySQL, Postgre, etc. I cannot stress how important it is to actually learn PHP and SQL before learning SQL Injection. You'd use PHP to deal w/ DBMS interactivity in the sense that you'd handle the user inputs and then query the database with those inputs via PHP. SQL injection vulns are very often as a result of badly written PHP code.
As for books, I'm not sure off of the top of my head... but OWASP is a good resource and the site I'm about to launch will go into a LOT of detail regarding SQLi - I'll link you once its ready.

(Jun 12, 2017 05:20 AM)Meterpreter Wrote:  Look at SQLi and CSS.

Meterpreter Wrote:My learning curve was reversed. I learnt SQLi at a very young age and when I went into my IT degree later on I understood SQL fluently. :')

But agreed, much easier just to learn SQL then SQLi.

(Jun 12, 2017 05:22 AM)pop.pop.ret Wrote:  What does CSS have to do with any of this? Am I missing something? The only practical application of CSS within web-based pentesting that I can even think of is RPO aka Relative Path Overwrite


I did this also but I think my understanding of SQLi got WAY deeper after I learned SQL as a DMBS lang :)

(Jun 12, 2017 05:12 AM)Meterpreter Wrote:  Really depends what you want to offer. Website penetration alone you should just start off with SQLi, CSS, Metasploit for webserver testing.

But I'd strongly suggest looking at some more enjoyable angles of PT, like targeting whole networks rather than just websites.

(Jun 12, 2017 05:26 AM)Meterpreter Wrote:  Cross Site Scripting was just a suggestion as I have never heard of a SQLi tester. Merely website penetration tester, but even the ones I know who focused on purely website pentesting have migrated to architecture and websites.

It's a really silly thing really, as you may mark a website as safe, however the actual webserver is vulnerable.

(Jun 12, 2017 05:27 AM)Giratina Wrote:  Couldn't agree with your post more.
As someone with a lot of experience in IT security (through interest in my spare time), I find it difficult to find projects to utilize my skills. How do you go about this?

Obviously it's not difficult to put my abilities to work, but I'd rather not be sued by anyone.

(Jun 12, 2017 05:12 AM)Meterpreter Wrote:  SQLi tester? Never heard of it.

Website penetration testing and architectural penetration tester.

External penetration testing, internal penetration testing, or both?

You can penetration test someones website and leave it there. Or you can go further to exploit their server and gain access to their internal network.

Really depends what you want to offer. Website penetration alone you should just start off with SQLi, CSS, Metasploit for webserver testing.

But I'd strongly suggest looking at some more enjoyable angles of PT, like targeting whole networks rather than just websites.

(Jun 12, 2017 05:30 AM)UKpower Wrote:  What should I learn to understand your question?
Dude seriously.. never knew there are two kinds of testings... Please give me more suggestions..

Quote:Abuse of Callback Functionality
Access Control Bypass
Arbitrary/Unrestricted File Upload
Content Forgery
Covert Redirect
Cross Site Scripting (XSS)
Cross Site Framing
Cross Site History Manipulation (XSHM)
Cross Site Flashing (XSF)
Cross Site Tracing (XST)
Cross Site Request Forgery (CSRF)
Cross Site Timing Attack
Cross Site Port Attack (XSPA)
CRLF Injection
CSV Excel Macro Injection (CEMI)
Directory Traversal
Execution After Redirect (EAR)
Full Path Disclosure (FPD)
HTTP Request Smuggling/Response Splitting
Information Disclosure
Insecure Direct Object Reference (IDOR)
Local File Inclusion (LFI)
LDAP Injection
Mass Assignment
NoSQL Injection
Object Injection
Open Redirect
Race Conditions
Reflected File Download (RFD)
Relative Path Overwrite (RPO)
Remote Command Execution (RCE)
Remote XSL Inclusion
Remote File Inclusion (RFI)
Resource Exhaustion
Resource Injection
Session Fixation
Session Prediction
Session Puzzling
Special Element Injection
SSI Injection
Server-Sided Request Forgery (SSRF)
XML External Entity Injection (XXE)
XPATH Injection
Web Cache Deception

(Jun 12, 2017 05:20 AM)Meterpreter Wrote:  I wrote a massive comment but it decided not to post.

Determine:

• Do I just want to do website penetration testing?
  


• What do I already know?
  

Personally, I think you should look into website penetration as a part of architecture penetration testing: That is penetration testing (PTing) webservers.

Do you really want to only offer website penetration testing? You're limiting yourself to external website penetration tests. Why not look at internal and external penetration testing of architecture, and learning how to pivot to gain access to entire networks as well as PTing websites?

If you're certain on solely website PT then there's nothing else I can really say. Look at SQLi and CSS. Keep up to date with firmware vulnerabilities in common website bases such as Wordpress and BB. And if you're still not sure about only doing websites, try learning some basic Metasploit knowledge and target webservers.

---

My learning curve was reversed. I learnt SQLi at a very young age and when I went into my IT degree later on I understood SQL fluently. :')

But agreed, much easier just to learn SQL then SQLi.

(Jun 12, 2017 05:35 AM)UKpower Wrote:  OMG! your 18 and ur already knew so many things ! you gotta be a child prodigy. I've wasted all my life learning nothing. Can you do me one favor? I know this sounds crazy but what you do can save a human beings life.

Can you tell me the things i should learn to get a good job as an good web penetration tester (internal,external, all kind of things (honestly i have no clue what u were saying))
1) do this
2) then do that
3) then u do this thing..

can u please tell me in this manner so i could make a note (probably make schedules, if possible attend some tuition,coaching..etc)

(Jun 12, 2017 05:29 AM)pop.pop.ret Wrote:  Do you do many bug bounties? I find them to a challenging yet profitable way to improve my skills

(Jun 12, 2017 05:32 AM)pop.pop.ret Wrote:  Here's some web-based attacks that you can learn instead of focusing only on SQLi:
[...]

(Jun 12, 2017 05:35 AM)UKpower Wrote:  Can you tell me the things i should learn to get a good job as an good web penetration tester (internal,external, all kind of things (honestly i have no clue what u were saying))
1) do this
2) then do that
3) then u do this thing..

can u please tell me in this manner so i could make a note (probably make schedules, if possible attend some tuition,coaching..etc)