What you need for this book
by Gilberto Nájera-Gutiérrez
Kali Linux Web Penetration Testing Cookbook
- Kali Linux Web Penetration Testing Cookbook
- Table of Contents
- Kali Linux Web Penetration Testing Cookbook
- Credits
- About the Author
- About the Reviewers
- www.PacktPub.com
- Preface
- 1. Setting Up Kali Linux
- Introduction
- Updating and upgrading Kali Linux
- Installing and running OWASP Mantra
- Setting up the Iceweasel browser
- Installing VirtualBox
- Creating a vulnerable virtual machine
- Creating a client virtual machine
- Configuring virtual machines for correct communication
- Getting to know web applications on a vulnerable VM
- 2. Reconnaissance
- Introduction
- Scanning and identifying services with Nmap
- Identifying a web application firewall
- Watching the source code
- Using Firebug to analyze and alter basic behavior
- Obtaining and modifying cookies
- Taking advantage of robots.txt
- Finding files and folders with DirBuster
- Password profiling with CeWL
- Using John the Ripper to generate a dictionary
- Finding files and folders with ZAP
- 3. Crawlers and Spiders
- 4. Finding Vulnerabilities
- Introduction
- Using Hackbar add-on to ease parameter probing
- Using Tamper Data add-on to intercept and modify requests
- Using ZAP to view and alter requests
- Using Burp Suite to view and alter requests
- Identifying cross-site scripting (XSS) vulnerabilities
- Identifying error based SQL injection
- Identifying a blind SQL Injection
- Identifying vulnerabilities in cookies
- Obtaining SSL and TLS information with SSLScan
- Looking for file inclusions
- Identifying POODLE vulnerability
- 5. Automated Scanners
- 6. Exploitation – Low Hanging Fruits
- Introduction
- Abusing file inclusions and uploads
- Exploiting OS Command Injections
- Exploiting an XML External Entity Injection
- Brute-forcing passwords with THC-Hydra
- Dictionary attacks on login pages with Burp Suite
- Obtaining session cookies through XSS
- Step by step basic SQL Injection
- Finding and exploiting SQL Injections with SQLMap
- Attacking Tomcat's passwords with Metasploit
- Using Tomcat Manager to execute code
- 7. Advanced Exploitation
- Introduction
- Searching Exploit-DB for a web server's vulnerabilities
- Exploiting Heartbleed vulnerability
- Exploiting XSS with BeEF
- Exploiting a Blind SQLi
- Using SQLMap to get database information
- Performing a cross-site request forgery attack
- Executing commands with Shellshock
- Cracking password hashes with John the Ripper by using a dictionary
- Cracking password hashes by brute force using oclHashcat/cudaHashcat
- 8. Man in the Middle Attacks
- 9. Client-Side Attacks and Social Engineering
- 10. Mitigation of OWASP Top 10
- Introduction
- A1 – Preventing injection attacks
- A2 – Building proper authentication and session management
- A3 – Preventing cross-site scripting
- A4 – Preventing Insecure Direct Object References
- A5 – Basic security configuration guide
- A6 – Protecting sensitive data
- A7 – Ensuring function level access control
- A8 – Preventing CSRF
- A9 – Where to look for known vulnerabilities on third-party components
- A10 – Redirect validation
- Index
To successfully follow all recipes in this book, the reader needs to have a basic understanding of the following topics:
- Linux OS installation
- Unix/Linux command-line usage
- HTML
- PHP web application programming
The only hardware that is necessary is a personal computer, preferably with Kali Linux 2.0 installed, although it may have any other operation system capable of running VirtualBox or other virtualization software. As for specifications, the recommend setup is:
- Intel i5, i7, or similar CPU
- 500 GB hard drive
- 8 GB RAM
- Internet connection
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.