TOPICS COVERED IN THIS TUTORIAL
What is a web application? What are Web Threats?
Top 10 web haking tools
WHAT IS A WEB APPLICATION? WHAT ARE WEB THREATS?
A web application ( website) is an application based on the client-server model. The server provides database access and the business logic. It is hosted on a web server. .
SQL Injection – the goal of this threat could be to bypass login algorithms, sabotage the data, etc.
Denial of Service Attacks – the goal of this threat could be to deny legitimate users access to the resource
Cross-Site Scripting XSS – the goal of this threat could be to inject code that can be executed on the client-side browser.
Cookie/Session Poisoning – the goal of this threat is to modify cookies/session data by an attacker to gain unauthorized access.
Form Tampering – the goal of this threat is to modify form data such as prices in e-commerce applications so that the attacker can get items at reduced prices.
Code Injection – the goal of this threat is to inject code such as PHP, Python, etc. that can be executed on the server. The code can install backdoors, reveal sensitive information, etc.
Defacement – the goal of this threat is to modify the page been displayed on a website and redirecting all page requests to a single page that contains the attacker’s message.
TOP 10 WEBSITE HACKING TOOLS.
BURP SUITE. :-
Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application’s attack surface, through to finding and exploiting security vulnerabilities.Burp gives you full control, letting you combine advanced manual techniques with state-of-the-art automation, to make your work faster, more effective, and more fun.
Source: http://portswigger.net/burp/
NIKTO NIKTO DARKWEBSOLUTIONS.COM
Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 6400 potentially dangerous files/CGIs, checks for outdated versions of over 1200 servers, and version specific problems on over 270 servers. It also checks for server configuration items such as the presence of multiple index files, HTTP server options, and will attempt to identify installed web servers and software. Scan items and plugins are frequently updated and can be automatically updated.
Source:
METASPLOITMETASPLOIT :-
The Metasploit Framework (MSF) is far more than just a collection of exploits. It’s an infrastructure that you can build upon and utilize for your custom needs. This allows you to concentrate on your unique environment, and not have to reinvent the wheel. I consider the MSF to be one of the single most useful auditing tools freely available to security professionals today. From a wide array of commercial grade exploits and an extensive exploit development environment, all the way to network information gathering tools and web vulnerability plugins, the Metasploit Framework provides a truly impressive work environment.
Source: https://www.offensive-security.com/metas...roduction/
NMAP :-
NMAP (“NETWORK MAPPER”) IS A FREE AND OPEN SOURCE (LICENSE) UTILITY FOR NETWORK DISCOVERY AND SECURITY AUDITING. MANY SYSTEMS AND NETWORK ADMINISTRATORS ALSO FIND IT USEFUL FOR TASKS SUCH AS NETWORK INVENTORY, MANAGING SERVICE UPGRADE SCHEDULES, AND MONITORING HOST OR SERVICE UPTIME. NMAP USES RAW IP PACKETS IN NOVEL WAYS TO DETERMINE WHAT HOSTS ARE AVAILABLE ON THE NETWORK, WHAT SERVICES (APPLICATION NAME AND VERSION) THOSE HOSTS ARE OFFERING, WHAT OPERATING SYSTEMS (AND OS VERSIONS) THEY ARE RUNNING, WHAT TYPE OF PACKET FILTERS/FIREWALLS ARE IN USE, AND DOZENS OF OTHER CHARACTERISTICS. IT WAS DESIGNED TO RAPIDLY SCAN LARGE NETWORKS, BUT WORKS FINE AGAINST SINGLE HOSTS. NMAP RUNS ON ALL MAJOR COMPUTER OPERATING SYSTEMS, AND OFFICIAL BINARY PACKAGES ARE AVAILABLE FOR LINUX, WINDOWS, AND MAC OS X. IN ADDITION TO THE CLASSIC COMMAND-LINE NMAP EXECUTABLE, THE NMAP SUITE INCLUDES AN ADVANCED GUI AND RESULTS VIEWER (ZENMAP), A FLEXIBLE DATA TRANSFER, REDIRECTION, AND DEBUGGING TOOL (NCAT), A UTILITY FOR COMPARING SCAN RESULTS (NDIFF), AND A PACKET GENERATION AND RESPONSE ANALYSIS TOOL (NPING). SOURCE: HTTPS://NMAP.ORG/
WIRESHARK:-
Wireshark is the world’s foremost and widely-used network protocol analyzer. It lets you see what’s happening on your network at a microscopic level and is the de facto (and often de jure) standard across many commercial and non-profit enterprises, government agencies, and educational institutions. Wireshark development thrives thanks to the volunteer contributions of networking experts around the globe and is the continuation of a project started by Gerald Combs in 1998.
Source: https://www.wireshark.org/
6 – NESSUS
Nessus is the most trusted vulnerability scanning platform for auditors and security analysts. Users can schedule scans across multiple scanners, use wizards to easily and quickly create policies, schedule scans and send results via email. Nessus supports more technologies than any other vendor, including operating systems, network devices, hypervisors, databases, tablets/phones, web servers and critical infrastructure.
Source: https://www.tenable.com/products/nessus-...ty-scanner
7 – THC HYDRA
Number one of the biggest security holes are passwords, as every password security study shows. Hydra is a parallized login cracker which supports numerous protocols to attack. New modules
are easy to add, beside that, it is flexible and very fast.Hydra was tested to compile on Linux, Windows/Cygwin, Solaris 11, FreeBSD 8.1, OpenBSD, OSX, QNX/Blackberry, and is made available under GPLv3 with a special OpenSSL license expansion.
Source: https://www.thc.org/thc-hydra/
8. SQL MAP:-
sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.
Source: http://sqlmap.org/
9. WPS SCAN:-
WPS is an open source penetration testing tool that automates the process of detecting and exploiting wordpress websites. It comes with a powerful detection engine, many niche features for the ultimate penetration tester. we need kali linux or termux to use this tool. we will discuss later how to use wpscan to enumurate the username and how to hack wordpress website using bruteforce.
source:- https://wpscan.org/
10. RED HAWK:-
Red Hawk is an open source web applications tool that can be used for web information gathering and vulnerability scanning purpose
HOW TO USE :- https://darkwebsolutions.com/what-is-red-hawk/
HOW TO HACK WEBSITES:-
For more visit :- https://darkwebsolutions.com/how-to-hack-websites/
What is a web application? What are Web Threats?
Top 10 web haking tools
WHAT IS A WEB APPLICATION? WHAT ARE WEB THREATS?
A web application ( website) is an application based on the client-server model. The server provides database access and the business logic. It is hosted on a web server. .
SQL Injection – the goal of this threat could be to bypass login algorithms, sabotage the data, etc.
Denial of Service Attacks – the goal of this threat could be to deny legitimate users access to the resource
Cross-Site Scripting XSS – the goal of this threat could be to inject code that can be executed on the client-side browser.
Cookie/Session Poisoning – the goal of this threat is to modify cookies/session data by an attacker to gain unauthorized access.
Form Tampering – the goal of this threat is to modify form data such as prices in e-commerce applications so that the attacker can get items at reduced prices.
Code Injection – the goal of this threat is to inject code such as PHP, Python, etc. that can be executed on the server. The code can install backdoors, reveal sensitive information, etc.
Defacement – the goal of this threat is to modify the page been displayed on a website and redirecting all page requests to a single page that contains the attacker’s message.
TOP 10 WEBSITE HACKING TOOLS.
BURP SUITE. :-
Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application’s attack surface, through to finding and exploiting security vulnerabilities.Burp gives you full control, letting you combine advanced manual techniques with state-of-the-art automation, to make your work faster, more effective, and more fun.
Source: http://portswigger.net/burp/
NIKTO NIKTO DARKWEBSOLUTIONS.COM
Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 6400 potentially dangerous files/CGIs, checks for outdated versions of over 1200 servers, and version specific problems on over 270 servers. It also checks for server configuration items such as the presence of multiple index files, HTTP server options, and will attempt to identify installed web servers and software. Scan items and plugins are frequently updated and can be automatically updated.
Source:
METASPLOITMETASPLOIT :-
The Metasploit Framework (MSF) is far more than just a collection of exploits. It’s an infrastructure that you can build upon and utilize for your custom needs. This allows you to concentrate on your unique environment, and not have to reinvent the wheel. I consider the MSF to be one of the single most useful auditing tools freely available to security professionals today. From a wide array of commercial grade exploits and an extensive exploit development environment, all the way to network information gathering tools and web vulnerability plugins, the Metasploit Framework provides a truly impressive work environment.
Source: https://www.offensive-security.com/metas...roduction/
NMAP :-
NMAP (“NETWORK MAPPER”) IS A FREE AND OPEN SOURCE (LICENSE) UTILITY FOR NETWORK DISCOVERY AND SECURITY AUDITING. MANY SYSTEMS AND NETWORK ADMINISTRATORS ALSO FIND IT USEFUL FOR TASKS SUCH AS NETWORK INVENTORY, MANAGING SERVICE UPGRADE SCHEDULES, AND MONITORING HOST OR SERVICE UPTIME. NMAP USES RAW IP PACKETS IN NOVEL WAYS TO DETERMINE WHAT HOSTS ARE AVAILABLE ON THE NETWORK, WHAT SERVICES (APPLICATION NAME AND VERSION) THOSE HOSTS ARE OFFERING, WHAT OPERATING SYSTEMS (AND OS VERSIONS) THEY ARE RUNNING, WHAT TYPE OF PACKET FILTERS/FIREWALLS ARE IN USE, AND DOZENS OF OTHER CHARACTERISTICS. IT WAS DESIGNED TO RAPIDLY SCAN LARGE NETWORKS, BUT WORKS FINE AGAINST SINGLE HOSTS. NMAP RUNS ON ALL MAJOR COMPUTER OPERATING SYSTEMS, AND OFFICIAL BINARY PACKAGES ARE AVAILABLE FOR LINUX, WINDOWS, AND MAC OS X. IN ADDITION TO THE CLASSIC COMMAND-LINE NMAP EXECUTABLE, THE NMAP SUITE INCLUDES AN ADVANCED GUI AND RESULTS VIEWER (ZENMAP), A FLEXIBLE DATA TRANSFER, REDIRECTION, AND DEBUGGING TOOL (NCAT), A UTILITY FOR COMPARING SCAN RESULTS (NDIFF), AND A PACKET GENERATION AND RESPONSE ANALYSIS TOOL (NPING). SOURCE: HTTPS://NMAP.ORG/
WIRESHARK:-
Wireshark is the world’s foremost and widely-used network protocol analyzer. It lets you see what’s happening on your network at a microscopic level and is the de facto (and often de jure) standard across many commercial and non-profit enterprises, government agencies, and educational institutions. Wireshark development thrives thanks to the volunteer contributions of networking experts around the globe and is the continuation of a project started by Gerald Combs in 1998.
Source: https://www.wireshark.org/
6 – NESSUS
Nessus is the most trusted vulnerability scanning platform for auditors and security analysts. Users can schedule scans across multiple scanners, use wizards to easily and quickly create policies, schedule scans and send results via email. Nessus supports more technologies than any other vendor, including operating systems, network devices, hypervisors, databases, tablets/phones, web servers and critical infrastructure.
Source: https://www.tenable.com/products/nessus-...ty-scanner
7 – THC HYDRA
Number one of the biggest security holes are passwords, as every password security study shows. Hydra is a parallized login cracker which supports numerous protocols to attack. New modules
are easy to add, beside that, it is flexible and very fast.Hydra was tested to compile on Linux, Windows/Cygwin, Solaris 11, FreeBSD 8.1, OpenBSD, OSX, QNX/Blackberry, and is made available under GPLv3 with a special OpenSSL license expansion.
Source: https://www.thc.org/thc-hydra/
8. SQL MAP:-
sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.
Source: http://sqlmap.org/
9. WPS SCAN:-
WPS is an open source penetration testing tool that automates the process of detecting and exploiting wordpress websites. It comes with a powerful detection engine, many niche features for the ultimate penetration tester. we need kali linux or termux to use this tool. we will discuss later how to use wpscan to enumurate the username and how to hack wordpress website using bruteforce.
source:- https://wpscan.org/
10. RED HAWK:-
Red Hawk is an open source web applications tool that can be used for web information gathering and vulnerability scanning purpose
HOW TO USE :- https://darkwebsolutions.com/what-is-red-hawk/
HOW TO HACK WEBSITES:-
For more visit :- https://darkwebsolutions.com/how-to-hack-websites/
