Category: Web Penetration Testing

Web Penetration Testing

Web Application Information Gathering

Retrieve HTTP response header curl -I -i -X HEAD –insecure example.comcurl -I -i -X HEAD –insecure example.com echo -e ‘HEAD / HTTP/1.0\r\n\r\n’ | nc example.com 80echo -e ‘HEAD / HTTP/1.0\r\n\r\n’ | nc example.com 80 Malformed requests test GET / HTTP/3.1 Host: hostname User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: text/html Accept-Language: en-US,en;q=0.5 Content-Length: …

Web Penetration Testing

Web application bruteforcer

Wfuzz is a tool designed to brutefore web applications, it’s very flexible, it supports: Recursion (when doing directory discovery) Post data bruteforcing Header bruteforcing Output to HTML (easy for just clicking the links and checking the page, even with postdata!) Colored output Hide results by return code, word numbers, line numbers, etc. Url encoding Cookies …

Web Penetration Testing

Web Application Pentest

Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 6700 potentially dangerous files/programs, checks for outdated versions of over 1250 servers, and version specific problems on over 270 servers. It also checks for server configuration items such as the presence of multiple index …

Burp, Web Penetration Testing

Using Burp Intruder to Test CSRF Protected Applications

1. Open Intruder Tab 2. Define Attack Target 3. Select Pitchfork as Attack type. Define your payload positions. 4. Define grep rule. Open Options tab -> click Add button under Grep – Extract section. A new window opens -> click fetch response button and select your csrf token value and press ok. 5. Select Paylod …