Don't say we didn't warn you.
This is post 17 of 17 in the series “[ Hacker Night School ]” Cross Site Request Forgery CSRF is a very specialized form of XSS. It relies on the victim being logged into a site, so the attacker can make a false request – to drain the victim’s bank account, for instance. Where to …
This is post 3 of 3 in the series “[ Auditing With the OWASP Top 10 ]” Vulnerability A1: Injection Remember to get the OWASP Proactive Controls for Developers: https://www.owasp.org/images/b/bc/OWASP_Top_10_Proactive_Controls_V3.pdf Practice and Process Open a browser tab to: https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents Once you are there, do a search in the page to highlight all occurrences of injection. …
Continue reading “[ Auditing With OWASP ] :: [ Class 2: Injection ]”
This is post 2 of 3 in the series “[ Auditing With the OWASP Top 10 ]” The OWASP Top Ten Project First, see the wiki entry on the project at: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project The Top Ten proper: https://www.owasp.org/images/7/72/OWASP_Top_10-2017_%28en%29.pdf.pdf (yes really). While you’re at it, get the Testing Checklist: https://www.owasp.org/index.php/Testing_Checklist You’ll need the OWASP Proactive Controls for …
Continue reading “[ Auditing With OWASP ] :: [ Class 1: Beginning ]”
This is post 16 of 17 in the series “[ Hacker Night School ]” Wifi Cracking: Start With the Basics: WEP WEP is so old and weak you’ll hardly ever find it in use, though there are always the few who haven’t paid attention. WEP cracking is a great way to get familiar with the …
Continue reading “[ Hacker Night School ] :: WEP Cracking Basics in Kali”
This is post 5 of 5 in the series “[ Hacking 101 ]” Javascript Javascript runs locally, in your browser. That means you can view it with your browser’s debug console, run it and tinker with it. One issue is locating the scripts your target page uses, which may be listed in META tags or …
This is post 1 of 3 in the series “[ Auditing With the OWASP Top 10 ]” This course is designed for web developers who want to learn how their applications can be attacked, and how to remediate threats, organized around the OWASP Top 10. [ Table of Contents ]
Exploit sudo and SUID files to run your own commands.