+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Preferred way of attacking a website? (/showthread.php?tid=6140729)
Preferred way of attacking a website? - SIM-4887667 - Feb 18, 2021
Looking to get everyone's opinion on their preferred way of attacking a website to gain administrative access to it.
I figured making a form for everyone to fill out would be the most efficient way of getting feed back in an orderly manner.
Q: Do you prefer front end or back end attacks?
A:
Q: What is your favorite vulnerability to find in the front end/back end?
A:
Q: Are you more passive and lowkey or cause a bunch of noise and not give a fuck?
A:
Will update the thread more once I have more questions, looking forward to hearing everyone's feedback. Please refrain from LQ posts unless they are genuinely funny.
RE: Preferred way of attacking a website? - Crypt - Feb 18, 2021
The FBI is getting more and more tricky with the way they ask you to incriminate yourself.
RE: Preferred way of attacking a website? - SIM-4887667 - Feb 18, 2021
(Feb 18, 2021 07:30 PM)Crypt Wrote: The FBI is getting more and more tricky with the way they ask you to incriminate yourself.
this is LQ. Please remove yourself from the conversation thanks
RE: Preferred way of attacking a website? - Crypt - Feb 18, 2021
(Feb 18, 2021 07:31 PM)Goomstar Wrote: this is LQ. Please remove yourself from the conversation thanks
This thread is LQ and a stupid question considering there are so many different factors that come into play with the questions you're asking. If anyone actually answers these questions make sure you add "I had permission to do this by the admin" to the end of your answers.
Also what VPN are you using because your IP matches 2 other members. Trust scan is all over the place.🕵️
RE: Preferred way of attacking a website? - SIM-4887667 - Feb 18, 2021
(Feb 18, 2021 07:33 PM)Crypt Wrote: This thread is LQ and a stupid question considering there are so many different factors that come into play with the questions you're asking. If anyone actually answers these questions make sure you add "I had permission to do this by the admin" to the end of your answers.
Also what VPN are you using because your IP matches 2 other members. Trust scan is all over the place.🕵️
Not asking anyone to incriminate themselves by admitting to any crimes. I did not say "when you are obtaining illegal access to a website", I said attacking. Very vague. If someone came to me threatening me with legal action over something that was posted on this thread I would look them in the eyes and tell them "I can not confirm nor deny any of the allegations being made against me at this point in time and would like to know if I am under arrest or being detained. That being said I would like to plead the fifth and refrain from any further conversation with you"
Done & over with.
Doesnt matter what VPN im using lol IPs dont meant shit, all bout the B-Ratings and Im getting mine built steadily.
Now please, enough trash on the first page. If you wanna keep arguing feel free to convo me (dont take up PM space) and ill make sure I ignore it :D
RE: Preferred way of attacking a website? - linkinpork - Feb 18, 2021
Disclaimer: This comes from training as red team so don't expect these to be the perfect methods. To each their own.
(Feb 18, 2021 07:26 PM)Goomstar Wrote: Q: Do you prefer front end or back end attacks?
Recon decides that. Fingerprinting and attack surface mapping always comes first. Webserver has a weakness > poke it. Non-web service port has a weakness > exploit.
(Feb 18, 2021 07:26 PM)Goomstar Wrote: Q: What is your favorite vulnerability to find in the front end/back end?
> Fuzz login panel
> OSINT on admin
> Find admin credentials in public sources
> Log in with credentials
> Profit!
But this only works in very classic targets.
(Feb 18, 2021 07:26 PM)Goomstar Wrote: Q: Are you more passive and lowkey or cause a bunch of noise and not give a fugg?
Again, recon decides that. Good WAF and active sysadmin > stealth. No WAF and inactive sysadmin > threads to over 9000
![[Image: Over_9000%21.png]](https://upload.wikimedia.org/wikipedia/en/9/9f/Over_9000%21.png)
RE: Preferred way of attacking a website? - SIM-4887667 - Feb 19, 2021
(Feb 18, 2021 11:04 PM)linkinpork Wrote: Disclaimer: This comes from training as red team so don't expect these to be the perfect methods. To each their own.
Recon decides that. Fingerprinting and attack surface mapping always comes first. Webserver has a weakness > poke it. Non-web service port has a weakness > exploit.
> Fuzz login panel
> OSINT on admin
> Find admin credentials in public sources
> Log in with credentials
> Profit!
But this only works in very classic targets.
Again, recon decides that. Good WAF and active sysadmin > stealth. No WAF and inactive sysadmin > threads to over 9000
This is exactly the kind of response I was looking for, so thank you.
I understand where you’re coming from, no point in wasting time looking for poorly written code if there’s an outdated service on the server!
I wish my shit setup could handle 9000 threads 🤣😕