舉報 
會員
Kali Linux Web Penetration Testing Cookbook
最新章節：
Index
ThisbookisforITprofessionals,webdevelopers,securityenthusiasts,andsecurityprofessionalswhowantanaccessiblereferenceonhowtofind,exploit,andpreventsecurityvulnerabilitiesinwebapplications.YoushouldknowthebasicsofoperatingaLinuxenvironmentandhavesomeexposuretosecuritytechnologiesandtools.
最新章節
- Index
- A10 – Redirect validation
- A9 – Where to look for known vulnerabilities on third-party components
- A8 – Preventing CSRF
- A7 – Ensuring function level access control
- A6 – Protecting sensitive data
品牌：中圖公司
上架時間：2021-07-16 11:02:51
出版社：Packt Publishing
本書數字版權由中圖公司提供，并由其授權上海閱文信息技術有限公司制作發行
- Index 更新時間：2021-07-16 12:54:15
- A10 – Redirect validation
- A9 – Where to look for known vulnerabilities on third-party components
- A8 – Preventing CSRF
- A7 – Ensuring function level access control
- A6 – Protecting sensitive data
- A5 – Basic security configuration guide
- A4 – Preventing Insecure Direct Object References
- A3 – Preventing cross-site scripting
- A2 – Building proper authentication and session management
- A1 – Preventing injection attacks
- Introduction
- Chapter 10. Mitigation of OWASP Top 10
- Tricking the user to go to our fake site
- Attacking with BeEF
- Using Metasploit's browser_autpwn2 to attack a client
- Creating a reverse shell with Metasploit and capturing its connections
- Using previously saved pages to create a phishing site
- Creating a password harvester with SET
- Introduction
- Chapter 9. Client-Side Attacks and Social Engineering
- Performing DNS spoofing and redirecting traffic
- Obtaining SSL data with SSLsplit
- Setting up an SSL MITM attack
- Modifying data between the server and the client
- Being the MITM and capturing traffic with Wireshark
- Setting up a spoofing attack with Ettercap
- Introduction
- Chapter 8. Man in the Middle Attacks
- Cracking password hashes by brute force using oclHashcat/cudaHashcat
- Cracking password hashes with John the Ripper by using a dictionary
- Executing commands with Shellshock
- Performing a cross-site request forgery attack
- Using SQLMap to get database information
- Exploiting a Blind SQLi
- Exploiting XSS with BeEF
- Exploiting Heartbleed vulnerability
- Searching Exploit-DB for a web server's vulnerabilities
- Introduction
- Chapter 7. Advanced Exploitation
- Using Tomcat Manager to execute code
- Attacking Tomcat's passwords with Metasploit
- Finding and exploiting SQL Injections with SQLMap
- Step by step basic SQL Injection
- Obtaining session cookies through XSS
- Dictionary attacks on login pages with Burp Suite
- Brute-forcing passwords with THC-Hydra
- Exploiting an XML External Entity Injection
- Exploiting OS Command Injections
- Abusing file inclusions and uploads
- Introduction
- Chapter 6. Exploitation – Low Hanging Fruits
- Finding Web vulnerabilities with Metasploit's Wmap
- Using Vega scanner
- Scanning with w3af
- Using OWASP ZAP to scan for vulnerabilities
- Finding vulnerabilities with Wapiti
- Scanning with Nikto
- Introduction
- Chapter 5. Automated Scanners
- Identifying POODLE vulnerability
- Looking for file inclusions
- Obtaining SSL and TLS information with SSLScan
- Identifying vulnerabilities in cookies
- Identifying a blind SQL Injection
- Identifying error based SQL injection
- Identifying cross-site scripting (XSS) vulnerabilities
- Using Burp Suite to view and alter requests
- Using ZAP to view and alter requests
- Using Tamper Data add-on to intercept and modify requests
- Using Hackbar add-on to ease parameter probing
- Introduction
- Chapter 4. Finding Vulnerabilities
- Identifying relevant files and directories from crawling results
- Using WebScarab
- Repeating requests with Burp's repeater
- Using Burp Suite to crawl a website
- Using ZAP's spider
- Downloading the page for offline analysis with HTTrack
- Downloading a page for offline analysis with Wget
- Introduction
- Chapter 3. Crawlers and Spiders
- Finding files and folders with ZAP
- Using John the Ripper to generate a dictionary
- Password profiling with CeWL
- Finding files and folders with DirBuster
- Taking advantage of robots.txt
- Obtaining and modifying cookies
- Using Firebug to analyze and alter basic behavior
- Watching the source code
- Identifying a web application firewall
- Scanning and identifying services with Nmap
- Introduction
- Chapter 2. Reconnaissance
- Getting to know web applications on a vulnerable VM
- Configuring virtual machines for correct communication
- Creating a client virtual machine
- Creating a vulnerable virtual machine
- Installing VirtualBox
- Setting up the Iceweasel browser
- Installing and running OWASP Mantra
- Updating and upgrading Kali Linux
- Introduction
- Chapter 1. Setting Up Kali Linux
- Preface
- www.PacktPub.com
- About the Reviewers
- About the Author
- Credits
- 版權信息
- 封面
- 封面
- 版權信息
- Credits
- About the Author
- About the Reviewers
- www.PacktPub.com
- Preface
- Chapter 1. Setting Up Kali Linux
- Introduction
- Updating and upgrading Kali Linux
- Installing and running OWASP Mantra
- Setting up the Iceweasel browser
- Installing VirtualBox
- Creating a vulnerable virtual machine
- Creating a client virtual machine
- Configuring virtual machines for correct communication
- Getting to know web applications on a vulnerable VM
- Chapter 2. Reconnaissance
- Introduction
- Scanning and identifying services with Nmap
- Identifying a web application firewall
- Watching the source code
- Using Firebug to analyze and alter basic behavior
- Obtaining and modifying cookies
- Taking advantage of robots.txt
- Finding files and folders with DirBuster
- Password profiling with CeWL
- Using John the Ripper to generate a dictionary
- Finding files and folders with ZAP
- Chapter 3. Crawlers and Spiders
- Introduction
- Downloading a page for offline analysis with Wget
- Downloading the page for offline analysis with HTTrack
- Using ZAP's spider
- Using Burp Suite to crawl a website
- Repeating requests with Burp's repeater
- Using WebScarab
- Identifying relevant files and directories from crawling results
- Chapter 4. Finding Vulnerabilities
- Introduction
- Using Hackbar add-on to ease parameter probing
- Using Tamper Data add-on to intercept and modify requests
- Using ZAP to view and alter requests
- Using Burp Suite to view and alter requests
- Identifying cross-site scripting (XSS) vulnerabilities
- Identifying error based SQL injection
- Identifying a blind SQL Injection
- Identifying vulnerabilities in cookies
- Obtaining SSL and TLS information with SSLScan
- Looking for file inclusions
- Identifying POODLE vulnerability
- Chapter 5. Automated Scanners
- Introduction
- Scanning with Nikto
- Finding vulnerabilities with Wapiti
- Using OWASP ZAP to scan for vulnerabilities
- Scanning with w3af
- Using Vega scanner
- Finding Web vulnerabilities with Metasploit's Wmap
- Chapter 6. Exploitation – Low Hanging Fruits
- Introduction
- Abusing file inclusions and uploads
- Exploiting OS Command Injections
- Exploiting an XML External Entity Injection
- Brute-forcing passwords with THC-Hydra
- Dictionary attacks on login pages with Burp Suite
- Obtaining session cookies through XSS
- Step by step basic SQL Injection
- Finding and exploiting SQL Injections with SQLMap
- Attacking Tomcat's passwords with Metasploit
- Using Tomcat Manager to execute code
- Chapter 7. Advanced Exploitation
- Introduction
- Searching Exploit-DB for a web server's vulnerabilities
- Exploiting Heartbleed vulnerability
- Exploiting XSS with BeEF
- Exploiting a Blind SQLi
- Using SQLMap to get database information
- Performing a cross-site request forgery attack
- Executing commands with Shellshock
- Cracking password hashes with John the Ripper by using a dictionary
- Cracking password hashes by brute force using oclHashcat/cudaHashcat
- Chapter 8. Man in the Middle Attacks
- Introduction
- Setting up a spoofing attack with Ettercap
- Being the MITM and capturing traffic with Wireshark
- Modifying data between the server and the client
- Setting up an SSL MITM attack
- Obtaining SSL data with SSLsplit
- Performing DNS spoofing and redirecting traffic
- Chapter 9. Client-Side Attacks and Social Engineering
- Introduction
- Creating a password harvester with SET
- Using previously saved pages to create a phishing site
- Creating a reverse shell with Metasploit and capturing its connections
- Using Metasploit's browser_autpwn2 to attack a client
- Attacking with BeEF
- Tricking the user to go to our fake site
- Chapter 10. Mitigation of OWASP Top 10
- Introduction
- A1 – Preventing injection attacks
- A2 – Building proper authentication and session management
- A3 – Preventing cross-site scripting
- A4 – Preventing Insecure Direct Object References
- A5 – Basic security configuration guide
- A6 – Protecting sensitive data
- A7 – Ensuring function level access control
- A8 – Preventing CSRF
- A9 – Where to look for known vulnerabilities on third-party components
- A10 – Redirect validation
- Index 更新時間：2021-07-16 12:54:15
