Hello guys,
so I got interested in pentesting (web-application precisely) after I found out about hackerone, I searched the web about good tutorials and such but they were all badly structured, I don't really know where to start and what are the basics.
I hope you can guide me.
Thanks
DO NOT DEAL WITH THIS MEMBER
Mar 19, 2017 09:44 AM
(This post was last modified: Mar 19, 2017 09:48 AM by zk34911.)
^
He is interested in Web Application Exploitation, can't you fucking read?
WTF are you even suggesting him? Python directly to automate his stuff in networking and all when he doesn't even know basic shit?
WHY?
Give me a simple reason why a person should start learning Python instead of CSS, HTML, PHP, SQL, JavaScript & HTTP headers if he wants to learn Web Application Exploitation
WTF is wrong with this community
(Mar 19, 2017 09:44 AM)zk34911 Wrote: ^
He is interested in Web Application Exploitation, can't you fucking read?
WTF are you even suggesting him? Python directly to automate his stuff in networking and all when he doesn't even know basic shit?
WHY?
Give me a simple reason why a person should start learning Python instead of CSS, HTML, PHP, SQL, JavaScript & HTTP headers if he wants to learn Web Application Exploitation
WTF is wrong with this community
So I should start with learning CSS, HTML, JavaScript etc ... and HTTP.
After that how did you make the transition to finding exploits, is there any good books or ressources about that ?
Mar 19, 2017 10:13 AM
(This post was last modified: Mar 19, 2017 10:19 AM by KalibRx.)
(Mar 19, 2017 09:44 AM)zk34911 Wrote: ^
He is interested in Web Application Exploitation, can't you fucking read?
WTF are you even suggesting him? Python directly to automate his stuff in networking and all when he doesn't even know basic shit?
WHY?
Give me a simple reason why a person should start learning Python instead of CSS, HTML, PHP, SQL, JavaScript & HTTP headers if he wants to learn Web Application Exploitation
WTF is wrong with this community
You're obviously a child. Why would anyone that has no interest in development, rather only (at least specified) learn anything about CSS? Let me break it down for you little boy:
Reading REAL articles about security, and penetration testing will give code examples. ALWAYS. Do yourself a favor and look at exploit-db. See a pattern? THAT'S RIGHT! All of them have code examples! So is he going to learn HOW to do things, or WHY things work the way they do? If you want to be spoon fed, sure, don't learn python. Apparently you know NOTHING of the sort if you're even questioning FOR A SECOND the validity of learning python with regard to pen-testing.
I beg that you do not listen to zk34911. He is a frightfully unseemly delinquent and a simple-minded cesspool of sub-human filth. He is a conspicuously boorish imbecile and a monstrous air-polluting deplorable calamity of birth. He knows nothing of security, nor much else for that matter.
And another thing I just noticed that made me chuckle. You tossed HTTP in with HTML/CSS/JS. HA! You really know nothing. Lets show you something:
HTML = Hyper-Text Markup Language = (NOT PROGRAMMING).
CSS = Cascading Style Sheets = NOT PROGRAMMING.
PYTHON = PROGRAMMING.
JAVASCRIPT = SCRIPTING.
HTTP (Hyper-Text Transfer Protocol)= PROTOCOL.
You don't automate pentests with javascript you moron. You do it with python (mostly). Obviously you can use another language, but that's what you'll find the most examples on.
Mar 19, 2017 10:14 AM
(This post was last modified: Mar 19, 2017 10:23 AM by Xphile.)
I don't claim to be great at web pentesting as I'm still learning that myself, here's a few resources I've been using recently:
Cybrary's Web Penetration Testing Course - (cybrary.it/course/web-application-pen-testing/)
Cybrary's Ethical Hacking Course (Modules 12, 13 & 14) - (cybrary.it/course/ethical-hacking/)
Cybrary's Advanced Pentesting Course (Module 11) - (cybrary.it/course/advanced-penetration-testing/)
As far as programming languages go, you should learn PHP and JavaScript. You should also become familiar with basic Linux operating systems (How the filesystem works, services like Apache and Nginx). Seen as many servers are running on Debian or Ubuntu. Keep in mind that there are still plenty of Windows and BSD servers present as well.
Translating this over to exploit development will become much easier after you understand the core functions of the web application in-use.
You may want to try out CTF challenges on vulnhub.com, I find them to be very fun ways of testing various hacking methods in a narrative-driven challenge that almost always involves some form of web exploitation.
[EDIT]
Forgot to mention common protocols that can sometimes be exploited:
+ HTTP(S)
+ FTP
+ SSH
+ SQL
I highly suggest learning the basics of networking before digging too deep. Learning how computers interact with one-another is critical when auditing anything.
[/EDIT]
Hope this helped. 🤝
Mar 19, 2017 10:19 AM
(This post was last modified: Mar 19, 2017 10:20 AM by KalibRx.)
For the love of god. SQL is not a programming language. It's a querying language. Big difference. How does anyone learn anything here with all this misinformation spread. Take a class dude. Learn from people who know, not people who read one article and think they're "1337".
(Mar 19, 2017 10:19 AM)KalibRx Wrote: For the love of god. SQL is not a programming language. It's a querying language. Big difference. How does anyone learn anything here with all this misinformation spread. Take a class dude. Learn from people who know, not people who read one article and think they're "1337".
Apologies, I didn't intend for it to be seen as another programming language. Will edit my original post.
Thanks for the suggestions guys : )
(Mar 19, 2017 10:22 AM)Xphile Wrote: Apologies, I didn't intend for it to be seen as another programming language. Will edit my original post.
Sorry man. I honestly thought you were the guy above that I rekt.
DO NOT DEAL WITH THIS MEMBER
Mar 19, 2017 10:38 AM
(This post was last modified: Mar 19, 2017 01:55 PM by zk34911.)
(Mar 19, 2017 10:13 AM)KalibRx Wrote: You're obviously a child. Why would anyone that has no interest in development, rather only (at least specified) learn anything about CSS? Let me break it down for you little boy:
Reading REAL articles about security, and penetration testing will give code examples. ALWAYS. Do yourself a favor and look at exploit-db. See a pattern? THAT'S RIGHT! All of them have code examples! So is he going to learn HOW to do things, or WHY things work the way they do? If you want to be spoon fed, sure, don't learn python. Apparently you know NOTHING of the sort if you're even questioning FOR A SECOND the validity of learning python with regard to pen-testing.
I beg that you do not listen to zk34911. He is a frightfully unseemly delinquent and a simple-minded cesspool of sub-human filth. He is a conspicuously boorish imbecile and a monstrous air-polluting deplorable calamity of birth. He knows nothing of security, nor much else for that matter.
And another thing I just noticed that made me chuckle. You tossed HTTP in with HTML/CSS/JS. HA! You really know nothing. Lets show you something:
HTML = Hyper-Text Markup Language = (NOT PROGRAMMING).
CSS = Cascading Style Sheets = NOT PROGRAMMING.
PYTHON = PROGRAMMING.
JAVASCRIPT = SCRIPTING.
HTTP (Hyper-Text Transfer Protocol)= PROTOCOL.
You don't automate pentests with javascript you moron. You do it with python (mostly). Obviously you can use another language, but that's what you'll find the most examples on.
"You're obviously a child. Why would anyone that has no interest in development, rather only (at least specified) learn anything about CSS? Let me break it down for you little boy"
>> I am 19, thanks for your concern. I didn't said you need to become a programmer when I stressed on the language part, I stressed enough on the fact that you at least need to have a pre-requisite knowledge of HTML and CSS. You know why? Because IT FUCKING HELPS and even when you transition to learn PHP and such, doesn't necessarily mean it would help you in penetrating testing and finding vulnerabilities within. LEARN TO READ. Can you see who is a child now?
"Reading REAL articles about security, and penetration testing will give code examples. ALWAYS. Do yourself a favor and look at exploit-db. See a pattern? THAT'S RIGHT! All of them have code examples! So is he going to learn HOW to do things, or WHY things work the way they do?
>> Yes, they will. I know exploit-db, thank you. You can't stress on the fucking fact that learning via code examples and patterns will remove the importance of learning programming languages down from the basics. YOU ARE FUCKING RETARDED. He is not going to learn how things work or what the fuck is happening if he doesn't know shit or basics. There has to be pre-requsite you moron. WTF IS WRONG WITH THIS FORUM
"If you want to be spoon fed, sure, don't learn python. Apparently you know NOTHING of the sort if you're even questioning FOR A SECOND the validity of learning python with regard to pen-testing."
>> I am not questioning the validity of python with regards to its importance and pen-testing. I am questioning the validity of your opinion regarding to his situation. Don't be pissed, shit happens.
"I beg that you do not listen to zk34911. He knows nothing of security, nor much else for that matter"
>>I know nothing about Security? Seriously BRO? Check my blog, check my bug bounties. Check my Twitter/Instagram, my Bug bounty profiles. My last 3 bugs alone have been valued $1260 from Twitter security engineering team and I have submitted 3 more so you can go fuck yourself. It's unbelievable how this community can't shut its gigantic ego for one second to shut the fuck up and listen
"He is a frightfully unseemly delinquent and a simple-minded cesspool of sub-human filth. He is a conspicuously boorish imbecile and a monstrous air-polluting deplorable calamity of birth"
>> Sorry, can't hear you over the sound of how awesome I am.
" And another thing I just noticed that made me chuckle. You tossed HTTP in with HTML/CSS/JS. HA! You really know nothing. Lets show you something"
>> Yes I put it there. I didn't associate it with any programming language or anything, show me where I said it? You fucking idiot, it's fucking common sense that it isn't a programming languages rather a protocol Don't try so hard. How old are you ? 9? 11?
"HTML = Hyper-Text Markup Language = (NOT PROGRAMMING).
CSS = Cascading Style Sheets = NOT PROGRAMMING.
PYTHON = SCRIPTING.
JAVASCRIPT = PROGRAMMING.
HTTP (Hyper-Text Transfer Protocol)= PROTOCOL."
>> I already know. Thanks for trying too hard. I thought you had a fucking common sense and could get what the fuck I meant. You are not smart. and where did I linked all these under programming language? POINT IT OUT. Also can you crawl under a rock?
" You don't automate pentests with javascript you moron. You do it with python (mostly). Obviously you can use another language, but that's what you'll find the most examples on. "
>> WHO THE FUCK TALKED about automating when you can't even do the shit FUCKING manually? WHEN YOU DONT EVEN KNOW JavaScript? LOOK IN WHAT CONTEXT I AM SPEAKING IN REGARDS TO HIS FUCKING CONDITION?
"For the love of god. SQL is not a programming language. It's a querying language. Big difference. How does anyone learn anything here with all this misinformation spread.
>> I know, We know, everybody knows this. THIS ISN'T MISINFORMATION. THIS IS COMMON SENSE. And where did I put it under programming languages? Point it out.
I've had enough of this shit in this forum
(Mar 19, 2017 10:38 AM)zk34911 Wrote: "You're obviously a child. Why would anyone that has no interest in development, rather only (at least specified) learn anything about CSS? Let me break it down for you little boy"
>> I am 19, thanks for your concern. I didn't said you need to become a programmer when I stressed on the language part, I stressed enough on the fact that you at least need to have a pre-requisite knowledge of HTML and CSS. You know why? Because IT FUCKING HELPS and even when you transition to learn PHP and such, doesn't necessarily mean it would help you in penetrating testing and finding vulnerabilities within. LEARN TO READ. Can you see who is a child now?
"Reading REAL articles about security, and penetration testing will give code examples. ALWAYS. Do yourself a favor and look at exploit-db. See a pattern? THAT'S RIGHT! All of them have code examples! So is he going to learn HOW to do things, or WHY things work the way they do?
>> Yes, they will. I know exploit-db, thank you. You can't stress on the fucking fact that learning via code examples and patterns will remove the importance of learning programming languages down from the basics. YOU ARE FUCKING RETARDED. He is not going to learn how things work or what the fuck is happening if he doesn't know shit or basics. There has to be pre-requsite you moron. WTF IS WRONG WITH THIS FORUM
"If you want to be spoon fed, sure, don't learn python. Apparently you know NOTHING of the sort if you're even questioning FOR A SECOND the validity of learning python with regard to pen-testing."
>> I am not questioning the validity of python with regards to its importance and pen-testing. I am questioning the validity of your opinion regarding to his situation. Don't be pissed, shit happens.
"I beg that you do not listen to zk34911. He knows nothing of security, nor much else for that matter"
>>I know nothing about Security? Seriously BRO? Check my blog, it's in my profile.I hate how this community can't shut their gigantic ego's for one second to shut the fuck up and listen.
"He is a frightfully unseemly delinquent and a simple-minded cesspool of sub-human filth. He is a conspicuously boorish imbecile and a monstrous air-polluting deplorable calamity of birth"
>> Sorry, can't hear you over the sound of how awesome I am.
" And another thing I just noticed that made me chuckle. You tossed HTTP in with HTML/CSS/JS. HA! You really know nothing. Lets show you something"
>> Yes I put it there. I didn't associate with it you fucking idiot, it's fucking common sense that it isn't a programming languages. Don't try to be too hard. How old are you ? 9? 11?
"HTML = Hyper-Text Markup Language = (NOT PROGRAMMING).
CSS = Cascading Style Sheets = NOT PROGRAMMING.
PYTHON = SCRIPTING.
JAVASCRIPT = PROGRAMMING.
HTTP (Hyper-Text Transfer Protocol)= PROTOCOL."
>> I already know. Thanks for trying too hard. I thought you had a fucking common sense and could get what the fuck I meant. You are not smart. Also can you crawl under a rock?
" You don't automate pentests with javascript you moron. You do it with python (mostly). Obviously you can use another language, but that's what you'll find the most examples on. "
>> WHO THE FUCK TALKED about automating when you can't even do the shit FUCKING manually? LOOK IN WHAT CONTEXT I AM SPEAKING IN REGARDS TO HIS FUCKING CONDITION?
"For the love of god. SQL is not a programming language. It's a querying language. Big difference. How does anyone learn anything here with all this misinformation spread.
>> I know, We know, everybody knows this. THIS ISN'T MISINFORMATION. THIS IS COMMON SENSE. And where did I put it in programming languages? Point it out.
I've had enough of this shit in this forum
Hey man, it was a just a misunderstanding, both of you have valid arguments
don't get so mad about it both of you.
(Mar 19, 2017 10:38 AM)zk34911 Wrote: "I beg that you do not listen to zk34911. He knows nothing of security, nor much else for that matter"
>>I know nothing about Security? Seriously BRO? Check my blog, it's in my profile.I hate how this community can't shut their gigantic ego's for one second to shut the fuck up and listen.
I'd recommend taking some time to tidy up your blog and publish some content other than a brief portfolio. From a brief look at the page, I didn't believe you had any credentials what-so-ever to back up your bounty claims, but Twitter supplemented that. I'd recommend hyperlinking to the bounty where applicable.
I think both of you have valid points. There can be multiple roads to get to the same destination. Chill a bit guys, the more riled up you get the less work you're going to get done. People "shut down" when an argument gets heated, and I can already tell you neither of you are going to reach common ground if you keep goin at one another.
Moving on in life in such a way that doesn't include HF. HF allowed me to get into the security field and peaked my interest: I appreciate everyone's time, effort, and encouragement. If for some reason you have a means to message me outside HF, feel free to, but I won't be coming back.
DO NOT DEAL WITH THIS MEMBER
Mar 19, 2017 10:52 AM
(This post was last modified: Mar 19, 2017 03:19 PM by zk34911.)
(Mar 19, 2017 10:46 AM)Shoe Wrote: I'd recommend taking some time to tidy up your blog and publish some content other than a brief portfolio. From a brief look at the page, I didn't believe you had any credentials what-so-ever to back up your bounty claims, but Twitter supplemented that. I'd recommend hyperlinking to the bounty where applicable.
There isn't any content on there as of now, and I don't plan to put any soon. It's just merely a portfolio of achievements. I am going to link my profiles soon
"From a brief look at the page, I didn't believe you had any credentials what-so-ever to back up your bounty claims"
>> I can't PM you right now, so that I could link you to my Bug Bounty profiles. My 3 last bug bounties have been $1000+ from Twitter, you can check it on my Twitter/Instagram profiles which is down below on the blog. You will find your proof there.
"I'd recommend hyperlinking to the bounty where applicable."
>> You can check my Twitter/Instagram and I plan to edit my blog soon. Thanks
EDIT : Linked everything with my blog
(Mar 19, 2017 10:52 AM)zk34911 Wrote: There isn't any content on there as of now, and I don't plan to put any soon. It's just merely a portfolio of achievements.
"From a brief look at the page, I didn't believe you had any credentials what-so-ever to back up your bounty claims"
>> I can't PM you right now, so that I could have linked you to my Bug Bounty profiles. Also my Twitter/Instagram username is down below on the blog. You will find your proof there.
"I'd recommend hyperlinking to the bounty where applicable."
>> You can check my Twitter/Instagram. Thanks
I meant on the blog. I was able to find proof on my own, however if Joe stumbles upon your blog, they may not be so inclined to check your accounts. Just a suggestion.
Moving on in life in such a way that doesn't include HF. HF allowed me to get into the security field and peaked my interest: I appreciate everyone's time, effort, and encouragement. If for some reason you have a means to message me outside HF, feel free to, but I won't be coming back.
|
