[TripleBD]

Hello HF members, I was just wondering how to find website vulnerabilities. I have seen people use google dorks to find random websites but is there any other way? I have read about scanners like acunetix but it is too loud. I am completely new to this and would love if someone helped out. Thanks.[/size]

[Niko]

You could always try site specific google dorks

Ex) site:yoursite.com ext:php inurl:".php?id="

[•^v^–[ bLacKn3x ]–^v^•]

You can try to inject POST Parameter if you can't find any GET vuln .

Login- or searching forms for example .

[TripleBD]

Thanks. Will be trying these methods out. If anyone else has any other ideas please post it.

[bobby1431]

thanks thanks thanks thanks thanks

[TripleBD]

Bump. Would love more tips

[Razor Dz Trigger]

If you want to Find a vuln in target website ! its easy !

1.Accuntiex !
2.W3aF
3.NikTo
4.if wordpress try wpscan !

and google for some tutorial !

[Cxdde3990xc]

If you want to Find a vuln in target website ! its easy !

1.Accuntiex !
2.W3aF
3.NikTo
4.if wordpress try wpscan !

and google for some tutorial !

I died after reading the first 3 because you clearly trust them too much

[.aaim]

Hi TripleBD, I don't think so, there is any specific tool which will discover all the vulnerabilities from your website. I will be suggesting the same as what others have suggested like google dork for specific site, automated scanners/tools or some good scripts.

In addition to that will suggest you to follow some OWASP Testing guidelines and/or ASVS checklist to test your application.

[Pixel2604]

=> Web Security Scanner (Vega)

[TripleBD]

=> Web Security Scanner (Vega)

Is the scanner "loud"?

[Vellichor]

Is the scanner "loud"?

Every single scanner you'll find is 'loud'.

[Disparity]

If you want to Find a vuln in target website ! its easy !

1.Accuntiex !
2.W3aF
3.NikTo
4.if wordpress try wpscan !

and google for some tutorial !

no

[Noah_]

First thing I do is see if my target is running a CMS.
If they are I look for public vulns in the CMS.
If there's plugins for the CMS, I look for vulns there too.
If there's nothing there I check for SQLi. (Most of the time you can inject). If there's no injection point then i try networking.
I nmap scan and check out the Daemons and see if I can exploit anything there.

You need a higher level of computers to really hack a website. I don't even suggest attempting to hack a website without really knowing what you're doing. If you want to experiment, set up labs.

[phuqer]

Try looking up shodan. It'll change your life.