WEB HACKING

WEB SERVER HACKING

WEB APPLICATION HACKING

Comparison of the usage

   • Apache 47%
   • Nginx 36 %
   • IIS 10%
   • Google
   • Lightspeed

Impact

   • Website Defacement (Illigal use)
   • Data Tempering
   • Theft of data
   • Pivot Point (Internal Access)
   • Loss of Trust, Money
   • Identity Theft
   • Damaged Reputation

Techniques



Reason

   • Unnecessary Files, Backups
   • Security Conflict vs functionality
   • Default Settings
   • Default Permission
   • Misconfiguration
   • Default Accounts
   • Security flaws, bug's (Language, server)
   • Temporary SSL
   • Improper Authentication
   • No Hardening
   • joomla, drupal, WordPress
   • Verbose Errors
   • Anonymous users
   • Sample Configuration
   • Remote administration
   • Unnecessary Services

 Methdology

   • Infrastructure Profiling
   • Infrastructure Intermediaries
   • Application Profiling
   • Mirroring site
   • Directory Mapping
   • Vulnerability Scanning
   • Exploitation

Countermeasures

   • Patch
   • Alternative Site / Servers
   • Testing in production
   • Backups
   • Hire Me
   • Protocol Analysis
   • Moniter Accounts
   • Moniter Files & Directorys
   • Encryption
   • Good Architecture (cisco)
   • Vulnerability Scanning (Nikto, Nessus)
   • DLP (Data Loss Prevention)

Tool Types

   • Plug-in
   • Proxies
   • Scanners

Tools

    • Owasp Dirbister
   • Httprint
   • Httrack
   • Angryfuzzer ( hidden dir, Vulnerabilitys)
   • Whatweb
   • Zed Attack Proxy (ZAP)
   • Websecurify
   • Paros Proxy
   • Web Scrarab
   • Acunetix

REF: CYBRARY

No comments:

Post a Comment

Subscribe to: Posts (Atom)

Popular Posts

  • IDS, IPS AND FIREWALL EVASION USING NMAP
    NIDS – Network Intrusion Detection System   • It Uses a network tap, span port, or hub to collect packets on the network  • Attempts t...
  • Introduction To Linux
    In the early 80s Richard Stallman working in the AI lab in MIT started the GNU Project with the goal of creating an entire free and open...
  • TYPES OF FIREWALL
    What is a firewall? A firewall is a software program or piece of hardware that helps screen out hackers, viruses, and worms that tr...
  • VPN CONCENTRATORS
    A VPN concentrator is a type of networking device that provides secure creation of VPN connections and delivery of messages between VPN nod...
  • ZIRIKATU
  • ADVANCE EVASION TECHNIQUES
    Insertion An IDS can accept a packet that an end-system rejects. An IDS that does this makes the mistake of believing that the end-system...
  • PASSWORD GUESSING
    The most common type of attack is password guessing. Attackers can guess passwords locally or remotely using either a manual or automa...