- Kali Linux Web Penetration Testing Cookbook
- Table of Contents
- Kali Linux Web Penetration Testing Cookbook
- Credits
- About the Author
- About the Reviewers
- www.PacktPub.com
- Preface
- 1. Setting Up Kali Linux
- Introduction
- Updating and upgrading Kali Linux
- Installing and running OWASP Mantra
- Setting up the Iceweasel browser
- Installing VirtualBox
- Creating a vulnerable virtual machine
- Creating a client virtual machine
- Configuring virtual machines for correct communication
- Getting to know web applications on a vulnerable VM
- 2. Reconnaissance
- Introduction
- Scanning and identifying services with Nmap
- Identifying a web application firewall
- Watching the source code
- Using Firebug to analyze and alter basic behavior
- Obtaining and modifying cookies
- Taking advantage of robots.txt
- Finding files and folders with DirBuster
- Password profiling with CeWL
- Using John the Ripper to generate a dictionary
- Finding files and folders with ZAP
- 3. Crawlers and Spiders
- 4. Finding Vulnerabilities
- Introduction
- Using Hackbar add-on to ease parameter probing
- Using Tamper Data add-on to intercept and modify requests
- Using ZAP to view and alter requests
- Using Burp Suite to view and alter requests
- Identifying cross-site scripting (XSS) vulnerabilities
- Identifying error based SQL injection
- Identifying a blind SQL Injection
- Identifying vulnerabilities in cookies
- Obtaining SSL and TLS information with SSLScan
- Looking for file inclusions
- Identifying POODLE vulnerability
- 5. Automated Scanners
- 6. Exploitation – Low Hanging Fruits
- Introduction
- Abusing file inclusions and uploads
- Exploiting OS Command Injections
- Exploiting an XML External Entity Injection
- Brute-forcing passwords with THC-Hydra
- Dictionary attacks on login pages with Burp Suite
- Obtaining session cookies through XSS
- Step by step basic SQL Injection
- Finding and exploiting SQL Injections with SQLMap
- Attacking Tomcat's passwords with Metasploit
- Using Tomcat Manager to execute code
- 7. Advanced Exploitation
- Introduction
- Searching Exploit-DB for a web server's vulnerabilities
- Exploiting Heartbleed vulnerability
- Exploiting XSS with BeEF
- Exploiting a Blind SQLi
- Using SQLMap to get database information
- Performing a cross-site request forgery attack
- Executing commands with Shellshock
- Cracking password hashes with John the Ripper by using a dictionary
- Cracking password hashes by brute force using oclHashcat/cudaHashcat
- 8. Man in the Middle Attacks
- 9. Client-Side Attacks and Social Engineering
- 10. Mitigation of OWASP Top 10
- Introduction
- A1 – Preventing injection attacks
- A2 – Building proper authentication and session management
- A3 – Preventing cross-site scripting
- A4 – Preventing Insecure Direct Object References
- A5 – Basic security configuration guide
- A6 – Protecting sensitive data
- A7 – Ensuring function level access control
- A8 – Preventing CSRF
- A9 – Where to look for known vulnerabilities on third-party components
- A10 – Redirect validation
- Index
Author
Gilberto Nájera-Gutiérrez
Reviewers
Gregory Douglas Hill
Nikunj Jadawala
Abhinav Rai
Commissioning Editor
Julian Ursell
Acquisition Editors
Tushar Gupta
Usha Iyer
Content Development Editor
Arun Nadar
Technical Editor
Pramod Kumavat
Copy Editor
Sneha Singh
Project Coordinator
Nikhil Nair
Proofreader
Safis Editing
Indexer
Rekha Nair
Graphics
Abhinash Sahu
Production Coordinator
Manu Joseph
Cover Work
Manu Joseph
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.