File Inclusion is one of those vulnerabilities that often hides in plain sight. At first, it might look like just another piece of functionality within a web application—allowing users to load files or dynamic content. However, when not handled securely, this feature can open the door to serious security risks. In simple terms, file inclusion … Ler mais
The SQLMap Essentials module introduces the fundamentals of using SQLMap, a powerful automated tool for detecting and exploiting SQL injection (SQLi) vulnerabilities. Through this module, you will learn: This module is designed to take you from the basics of discovering SQLi flaws to the advanced enumeration needed to retrieve all relevant data from a target … Ler mais
Databases are a critical part of any web application, providing a structured way to store, retrieve, and manage information using SQL (Structured Query Language). SQL Injection is a powerful attack technique that targets vulnerabilities in an application’s code. By injecting malicious SQL queries through input fields or application parameters, an attacker can: This makes SQL … Ler mais
This module dives into brute-force techniques, showing how attackers attempt to gain unauthorized access by systematically guessing passwords. Tools like Hydra and Medusa are commonly used for such attacks, each allowing testers to target a variety of services efficiently. We explore practical attack scenarios, including targeting SSH, FTP, and web login forms, demonstrating how weak … Ler mais
In this module, we dive into the essential skills of web fuzzing and directory brute forcing using the powerful tool Ffuf. These techniques are key to uncovering hidden pages, directories, and parameters that might not be immediately visible on a web application. By mastering these skills, you’ll gain the ability to map web applications more … Ler mais
When it comes to testing web applications, having a reliable framework is essential. This module will introduce you to two of the most popular tools in the field: Burp Suite and OWASP ZAP, both of which provide comprehensive functionality for finding and exploiting vulnerabilities in web applications. Intercepting Web Requests With our proxy now up … Ler mais
Organizations rely on a standard set of services to keep their operations running smoothly. But each of these services can also be a potential entry point for attackers. That’s why it’s crucial to perform penetration testing—both internally and externally—on every service to ensure they aren’t introducing security risks. In this module, we’ll walk through how … Ler mais
In this comprehensive module, you will gain the essential knowledge and practical skills required to identify and effectively utilize shells and payloads to establish a foothold on vulnerable systems, both Windows and Linux. By understanding how attackers leverage these tools, you will learn how to navigate and manipulate target environments safely and efficiently. The module … Ler mais
Retrieving hidden data Lab: SQL injection vulnerability in WHERE clause allowing retrieval of hidden data Open the lab and click on the Gifts button Switch to your burp suite and identify the request Click on it with right button and choose Send to repeater. In the repeater, put a SQLi payload and click on the … Ler mais
API Documentation Lab: Exploiting an API endpoint using documentation To solve the lab, find the exposed API documentation and delete carlos. You can log in to your own account using the following credentials: wiener:peter. Open the lab and click in My account link Use the credencials (wiener:peter) to logging the site Update your user account Go to … Ler mais
Definition:A vulnerability assessment is a systematic process of identifying, quantifying, and prioritizing security weaknesses in a system, network, or application. Unlike a full penetration test, it focuses on detection and reporting rather than exploitation. Key Differences: Vulnerability Assessment vs Penetration Test Aspect Vulnerability Assessment Penetration Test Goal Identify and quantify vulnerabilities Exploit vulnerabilities to assess … Ler mais
What it is: Primary Uses: Why it’s valuable: Introduction to Metasploit Core Concept: Components: Features & Capabilities: Modules: Strengths: Diagram Concept: If you want, I can also make a simple visual workflow showing how a Metasploit exploit goes from module selection to payload execution, which is great for learning and reporting. Do you want me … Ler mais