· 8 years ago · Apr 10, 2018, 12:08 PM
1Burp Suite
2----------
3Burp or Burp Suite is a graphical tool for testing Web application security. The tool is written in Java and developed by PortSwigger Security.
4Burp Decoder - Free Edition
5
6The tool has two versions: a free version that can be downloaded free of charge (Free Edition) and a full version that can be purchased after a trial period (Professional Edition). It was developed to provide a comprehensive solution for web application security checks. In addition to basic functionality, such as proxy server, scanner and intruder, the tool also contains more advanced options such as a spider, a repeater, a decoder, a comparer, an extender and a sequencer.
7
8
9Anand Prakash
10-------------
11 Bug Bounter, who just knows a chota sa tool which goes by the name of Burp Suite.....
12 He earned 2.2 crores....
13
14 Donald Trump --> fb hack --> Hack By Indian Hacker
15 Hack details ---> Black Market
16 2B dollars
17 Black Listed
18 Non Recognized
19
20Brute Forcing
21-------------
22 To try each and every combination which can be made out of the words.... It is known as Hit & Try Method...
23 A,B,C,D
24 ABCD
25 ABDC
26 ADBC
27 DABC
28 DACB
29 DCAB
30 CDAB
31 ----
32 ----
33 ----
34
35Dictionary Attack
36-----------------
37 I have a text file which contains many many different words. I will try each and every word present in my text file and will check out whether it works or not.
38
39Bug Bounty
40----------
41
42Facebook.com
43 ---> Forget Password
44 ---> phone number
45 ---> OTP
46
47
48
49
50
51OTP
52---
53One Time Password
54
55 4 digits ---> 0000-9999
56 6 digits ---> 000000-999999
57
58 facebook.com
59 twitter.com
60 gmail.com
61 paytm.com
62 olacabs.com
63 uber.com
64
65 beta version
66 m.facebook.com
67 beta.gmail.com
68
69
70DEMO
71====
72
731. Start the XAMPP Server
742. Log in to the DVWA
753. Security "Low"
764. In the left pane --> Brute Force
77 To Set Up The Proxy
78 -------------------
795. Start the Burp Suite
806. Goto "Proxy" Tab ---> "Option"
81 In the first box, it is showing me --> 127.0.0.1:8080
82 I will set the proxy on my web browser with same configurations
837. Open web browser. Goto To "Menu" ----> Options
848. In the left side, goto "Advanced" ----> Goto "Network" ---> "Settings" of the Title "Connection"
859. Check Manual Proxy Configuration
86 127.0.0.1 8080
87 Check Mark the box just below.
8810. Clear the box "No Proxy For"
89
90Brute Force
91-----------
92After setting the proxy.....
93
941. Fill the data with username and password
952. Click on submit button
963. My Burp suite will open up automatically
974. It will glow into Orange....
98 Proxy ---> Intercept
995. Select all the data in the box.....
100 Right Click ---> Send to Intruder
1016. My intruder tab will glow into saffron/orange color... My data has been received by the intruder
1027. Goto "Positions" tab inside "Intruder" tab.
1038. In the "Attack Type" ---> Drop Down Menu---> Select "Cluster Bomb"
1049. In the right side of the screen.... there is a button---> "Clear".... press that button.
10510. Select username and click on add
10611. select password and click on add
10712. Goto "Payloads" tab
10813. Select the payload number 1
109 In the first box----> enter the possible names of the users----> we usually import the dictionary file
11014. Select Payload number 2
111 In the first box enter as many passwords as you can. That is... possible passwords.
11215. In the last tab "Options"
113 Scroll the page to "GREP Match"
114 Clear the whole list/box
115 Add the welcome message/error message in the box here..... Click On "Add"
11616. Say the magic words ----> click on "Start Attack"
117
118
119File Inclusion Vulnerability
120============================
1211. LFI --> Local File Inclusion
1222. RFI --> Remote File Inclusion
123
124
125Command Execution Vulnerability
126===============================
127Enter promo code
128Enter your contact number
129Enter your IP Address
130 | --> Pipe Symbol
131 Output of first command will be the input of second command... After executing first command please, execute my second command
132
133
134
135Welcome to the password protected area admin
136
137Introduction to JavaScript
138==========================
139JavaScript is a client side scripting language. Which can we used and viewed by the user. User interface uses this javascript programing language.
140 Popup
141 Games
142 Costomizing sites
143 Facebook.com --> Enlargement of the name, details
144
145Java --> Programming language, used to build softwares
146JavaScript --> Scripting language, used in web applications, web sites. Used in developing interaction with the user interface.
147
148 For using JavaScript, we need to use <script> tag
149
150JavaScript Small Demonstration code
151====================================
152<html>
153<head>
154<title>JavaScript</title>
155</head>
156<body>
157<h1>This is javaScript Page</h1>
158<script>
159alert("It's time to learn JavaScript.... You Are late guys");
160</script>
161</body>
162</html>
163
164Calculator using JavaScript
165===========================
166
167
168js.html
169=======
170<html>
171<head>
172<title>Intro</title>
173</head>
174<body>
175<h1>This is javaScript Page</h1>
176<p>This page is used for calculation of 2 numbers</p>
177<form action="js2.html">
178<input type="submit">
179</form>
180</body>
181</html>
182
183
184js2.html
185========
186<html>
187<head>
188<title>JavaScript2</title>
189</head>
190<body>
191<form>
192First Number: <input type="text" id="one"><br>
193Secon Number: <input type="text" id="two"><br>
194<button type="button" onClick="funct()">add</button>
195</form>
196</body>
197<script>
198function funct()
199{
200var a = document.getElementById('one').value;
201var b = document.getElementById('two').value;
202var c = +a + +b;
203document.write(c);
204}
205</script>
206</html>
207
208
209var a|b|c ===> to declare a variable
210document.write ---> writing something on the web page
211
212XSS -- Cross Site Scripting
213===========================
214 This is a client side attack. Where attacker can make some changes or is able to execute html codes.
215 Attacker can find an entry point, can execute any parameter, apart from those parameters, attacker is able to execute HTML tags.
216 Feedback
217 Review
218 Login
219 Search
220 Categories
221 Messages
222 Name
223 Email ID
224
225Damages which can be done using XSS
226 Deface
227 Redirect any user
228 Cookie Stealing
229
230I can make any user to execute my malicious code.
231
232I have 2 types of XSS
233 1. Reflected XSS
234 2. Stored XSS
235
236Test
237----
238 <h1>Name</h1>
239 <script>alert("XSS")</script>
240
2411. Stored XSS
242=============
243 Persistance XSS
244 The malicious script is stored in the database of the web application. Once the malicious script is stored, the user who is visiting the web page, will be the target of the Stored XSS.
245 Once deployed, all the users will be my target. It never goes off by refreshing, revisiting. It can only be removed by the Database Administrator manually.
246
247Low
248===
249 <h1>Name</h1>
250 <script>alert("XSS")</script>
251 <iframe src="http://www.lucideus.com">
252Cookie Stealing
253 <script>alert(document.cookie)</script>
254
255Medium
256======
257 <script> --> delete
258Answer
259======
260 1. Attribute passing
261 <script type="text/javaScript">
262 <script type="text/javascript">alert("Nizamuddin")</script type="text/javascript">
263 2. It is searching for <script> --> exactly
264 <ScRiPt>
265 <ScRipt>alert("Xss Fir Mil Gya")</ScripT>
266 3. Bluff Master
267 <script>alert("XSS")</script>
268 alert("XSS")
269 <scr<script>ipt> ---> <script>
270
2712. Reflected XSS
272================
273 One time usage xss. Once an attacker injects the malicious code, it will wipe out when the user refreshes the page. Only after injection, the code will automatically will remove.
274Test
275====
276 <script>alert("XSS")</script>
277
278Broken Authentication and Session Management
279============================================
280GET Peremeter
281something=something
282 Where, in the web application or in the website, the management of the user credentials and the cookies are not properly maintained.
283
284 security=low; PHPSESSID=rvtfmektipskckmkv8gouo4a30
285
286 Cookies should be encrypted form
287
288Example
289=======
290e-commerece website ----> www.abcapple.com
291Shoe ----> www.abcapple.com/men/shoe/saleitem?sessionID=2924bjf783&brand=nike
292
293paste
294 www.abcapple.com/men/shoe/saleitem?sessionID=2924bjf783&brand=nike
295send
296
297How I am vulnerable
298===================
2991. User Authentication credentials are not protected when stored ---> encrypted form nahi h
3002. Credentials can be guessed
301 DVWA --> Admin, Password
302 Router -> Admin, admin|password
3033. Session ID are exposed in the URL
304 www.abcapple.com/men/shoe/saleitem?sessionID=2924bjf783&brand=nike
3054. Session ID's are not rotated after some time.
306
307
308
309
310
311https://lucideustech.blogspot.in/2018/03/a-practical-guide-to-dom-based-xss.html