Attacking the AuthenticationUsername EnumerationInvalid Username with Invalid PasswordValid Username with Invalid PasswordEnabling Browser Cache to Store PasswordsBrute Force and Dictionary AttacksTypes of AuthenticationHTTP Basic AuthenticationHTTP-Digest AuthenticationForm-Based AuthenticationExploiting Password Reset FeatureEtsy.com Password Reset VulnerabilityAttacking Form-Based AuthenticationBrute Force AttackAttacking HTTP Basic AuthFurther ReadingLog-In Protection MechanismsCAPTCHA Validation FlawCAPTCHA Reset FlawManipulating User-Agents to Bypass CAPTCHA and Other ProtectionsReal-World ExampleAuthentication Bypass AttacksAuthentication Bypass Using SQL InjectionTesting for SQL Injection Auth BypassAuthentication Bypass Using XPATH InjectionTesting for XPATH InjectionAuthentication Bypass Using Response TamperingCrawling Restricted LinksTesting for the VulnerabilityAutomating It with Burp SuiteAuthentication Bypass with Insecure Cookie HandlingSession AttacksGuessing Weak Session IDSession Fixation AttacksRequirements for This AttackHow the Attack WorksSQL Injection AttacksWhat Is an SQL Injection?Types of SQL InjectionUnion-Based SQL InjectionError-Based SQL InjectionBlind SQL InjectionDetecting SQL InjectionDetermining the Injection TypeUnion-Based SQL Injection (MySQL)Testing for SQL InjectionDetermining the Number of ColumnsDetermining the Vulnerable ColumnsFingerprinting the DatabaseEnumeration InformationInformation_schemaInformation_schema TablesEnumerating All Available DatabasesEnumerating All Available Tables in the DatabaseExtracting Columns from TablesExtracting Data from ColumnsUsing group _ concatMySQL Version ≤ 5Guessing Table NamesGuessing ColumnsSQL Injection to Remote Command ExecutionReading FilesWriting FilesBlind SQL InjectionBoolean-Based SQLiTrue StatementFalse StatementEnumerating the DB UserEnumerating the MYSQL VersionGuessing TablesGuessing Columns in the TableExtracting Data from ColumnsTime-Based SQL InjectionVulnerable ApplicationTesting for Time-Based SQL InjectionEnumerating the DB UserGuessing the Table NamesGuessing the ColumnsExtracting Data from ColumnsAutomating SQL Injections with SqlmapEnumerating DatabasesEnumerating TablesEnumerating the ColumnsExtracting Data from the ColumnsHTTP Header–Based SQL InjectionOperating System Takeover with SqlmapOS-CMDOS-SHELLOS-PWNXSS (Cross-Site Scripting)How to Identify XSS VulnerabilityTypes of Cross-Site ScriptingReflected/Nonpersistent XSSVulnerable CodeMedium SecurityVulnerable CodeHigh SecurityBypassing htmlspecialcharsUTF-32 XSS Trick: Bypass 1Svg Craziness: Bypass 2Bypass 3: href AttributeStored XSS/Persistent XSSPayloadsBlind XSSDOM-Based XSSDetecting DOM-Based XSSSources (Inputs)Sinks (Creating/Modifying HTML Elements)Static JS Analysis to Identify DOM-Based XSSHow Does It Work?Setting Up JSPRIMEDominator: Dynamic Taint AnalysisPOC for Internet ExplorerPOC for ChromePros/ConsCross Browser DOM XSS DetectionTypes of DOM-Based XSSReflected DOM XSSStored DOM XSSExploiting XSSCookie Stealing with XSSExploiting XSS for Conducting Phishing AttacksCompromising Victim’s Browser with XSSExploiting XSS with BeEFSetting Up BeEF on BackTrackDemo PagesBeEF ModulesModule: Replace HREFsModule: GetcookieModule: TabnabbingBeEF in ActionCross-Site Request Forgery (CSRF)Why Does a CSRF Attack Work?How to AttackGET-Based CSRFPOST-Based CSRFCSRF Protection TechniquesReferrer-Based CheckingAnti-CSRF TokensPredicting/Brute Forcing Weak Anti-CSRF Token AlgorithmTokens Not Validated upon ServerAnalyzing Weak Anti-CSRF Token StrengthBypassing CSRF with XSSFile Upload VulnerabilitiesBypassing Client Side RestrictionsBypassing MIME-Type ValidationReal-World ExampleBypassing Blacklist-Based ProtectionsCase 1: Blocking Malicious ExtensionsBypassCase 2: Case-Sensitive BypassBypassReal-World ExampleVulnerable CodeCase 3: When All Dangerous Extensions Are BlockedXSS via File UploadFlash-Based XSS via File UploadCase 4: Double Extensions VulnerabilitiesApache Double Extension IssuesIIS 6 Double Extension IssuesCase 5: Using Trailing DotsCase 6: Null Byte TrickCase 7: Bypassing Image ValidationCase 8: Overwriting Critical FilesReal-World ExampleFile Inclusion VulnerabilitiesRemote File InclusionPatching File Inclusions on the Server SideLocal File InclusionLinuxWindowsLFI Exploitation Using /proc/self/environLog File InjectionFinding Log Files: Other TricksExploiting LFI Using PHP InputExploiting LFI Using File UploadsRead Source Code via LFILocal File Disclosure VulnerabilityVulnerable CodeLocal File Disclosure TricksRemote Command ExecutionUploading ShellsServer Side Include InjectionTesting a Website for SSI InjectionExecuting System CommandsSpawning a ShellSSRF AttacksImpactExample of a Vulnerable PHP CodeRemote SSRFSimple SSRFPartial SSRFDenial of ServiceDenial of Service Using External Entity Expansion (XEE)Full SSRFdict://gopher://http://Causing the CrashOverwriting Return AddressGenerating ShellcodeServer HackingApache ServerTesting for Disabled FunctionsOpen _ basedir MisconfigurationUsing CURL to Bypass Open _ basedir RestrictionsOpen _ basedir PHP 5.2.9 BypassReferenceBypassing open _ basedir Using CGI ShellBypassing open _ basedir Using Mod _ Perl, Mod _ PythonEscalating Privileges Using Local Root ExploitsBack ConnectingFinding the Local Root ExploitUsageFinding a Writable DirectoryBypassing Symlinks to Read Configuration FilesWho Is Affected?Basic SyntaxWhy This WorksSymlink Bypass: Example 1Finding the Username/etc/passwd File/etc/valiases FilePath DisclosureUploading .htaccess to Follow SymlinksSymlinking the Configuration FilesConnecting to and Manipulating the DatabaseUpdating the PasswordSymlink the Root DirectoryExample 3: Compromising WHMCS ServerFinding a WHMCS ServerSymlinking the Configuration FileWHMCS KillerDisabling Security MechanismsDisabling Mod _ SecurityDisabling Open _ basedir and Safe _ modeUsing CGI, PERL, or Python Shell to Bypass SymlinksConclusion
