October 2024
Intermediate to advanced
330 pages
8h 53m
Spanish
Content preview from Seguridad de las aplicaciones web
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
Capítulo 4. Encontrar subdominios
Este trabajo se ha traducido utilizando IA. Agradecemos tus opiniones y comentarios: translation-feedback@oreilly.com
En para examinar y probar los puntos finales de la API, primero debemos estar familiarizados con la estructura de dominios que utiliza una aplicación web. En el mundo actual es raro que se utilice un único dominio para servir a una aplicación web en su totalidad. Lo más frecuente es que las aplicaciones web se dividan como mínimo en dominios de cliente y servidor, además del conocido"https://www" frente a sólo"https://". Ser capaz de encontrar y registrar iterativamente los subdominios que alimentan una aplicación web es una técnica útil de primer reconocimiento contra esa aplicación web.
Múltiples aplicaciones por dominio
Supongamos en que estamos intentando mapear las aplicaciones web de MegaBank para realizar mejor una prueba de penetración de caja negra patrocinada por ese banco. Sabemos que MegaBank tiene una aplicación en la que los usuarios pueden iniciar sesión y acceder a sus cuentas bancarias. Esta aplicación se encuentra en https://www.mega-bank.com.
Tenemos especial curiosidad por saber si MegaBank tiene otros servidores accesibles en Internet vinculados al nombre de dominio mega-bank.com. Sabemos que MegaBank tiene un programa de recompensas por fallos, y el alcance de ese programa cubre el dominio principal mega-bank. com de forma bastante exhaustiva. Como resultado, cualquier vulnerabilidad fácil de encontrar en ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.