4 ms·

Although I am impressed by the work, I dislike these writeups. In similar bug bounty posts, a user will post all this brilliant setup code, these tools I never

Although I am impressed by the work, I dislike these writeups. In similar bug bounty posts, a user will post all this brilliant setup code, these tools I never heard of to decompile binaries, view source, get through obfuscation, etc. Then, when you get to the meat and bones, they just go "Ok and vulnurability is here, and you exploit it like this. Ta data." It's very anti-climatic, and I don't learn much in the process. I would like to learn more about what your thought process is like after you get the code. How did you narrow your focus on ActiveRecord? Did you just know from seeing it? I would love to learn more. Do expert pen-testers have this checklist of exploits they try? Sorry if it sounds like whiny, I would just love it if these had more meat in the actual finding of the exploit as they did the setup.

lvh 10y ago
It's a bit of both. It's not so much a checklist as a classes of bugs, but close enough. That includes vulnerabilities like SQL injection, command injection, stored and reflected XSS, et cetera. The WAHH (Web Application Hacker's Handbook) is a good place to start here; it walks through a lot of these standard classes of web app vulns. Something WAHH touches on, and experienced pentesters get a feel for, is more complex interactions. Often that means chaining several not-so-bad bugs together to build something really exciting. Sometimes they're just obscure consequences of say, a rather complex authorization system. These are typically a lot harder to find, and may involve simultaneous code audits. Ideally, your long-term in-house security people find these, because any attacker that does is in the 95th cleverness percentile. So, TL;DR: start with WAHH; then go find some vulns, and start thinking about what the app does in terms of alternative things a program could do that a reasonable programmer who was just trying to get it to work might not have thought about. If you're looking for tools to play with, you can do worse than downloading Kali and running it on a VM. If nothing else, it'll give you a pretty big catalog of tools to start looking at. I think WAHH covers basic Burp Suite usage, but Kali has some other tools like sqlmap and BeEF that aren't too tricky to get started with. WAHH: http://mdsec.net/wahh/ http://mdsec.net/wahh/ Kali: https://www.kali.org/ https://www.kali.org/
- chupasaurus 10y ago
  Also want to mention Web Hacking 101 [0], which is written specifically for newbies in vulnerability searching, with real cases and explanation of how certain bugs are or could be found. [0] https://leanpub.com/web-hacking-101 https://leanpub.com/web-hacking-101
andy_ppp 10y ago
So there are various ways to learn about the basics (aside from experience); look into SQL injection, XSS and CSRF as a starter then once you understand and can attempt to perform those, you can work your way through this comprehensive if dry guide: https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table... It literally contains almost everything for Webapps. The next step is finding your own exploits or doing bug bounties. If you are more interested in the other side of hacking (i.e. everything but webapps, usually OS level stuff) someone more informed than me can probably give you advice, but starting with microcorruption or similar won't hurt.
mettamage 10y ago
Regarding the tools, I recognize two-third of the tools from my web security class. So there are places where you can learn this.

lvh 10y ago

It's a bit of both. It's not so much a checklist as a classes of bugs, but close enough. That includes vulnerabilities like SQL injection, command injection, stored and reflected XSS, et cetera. The WAHH (Web Application Hacker's Handbook) is a good place to start here; it walks through a lot of these standard classes of web app vulns. Something WAHH touches on, and experienced pentesters get a feel for, is more complex interactions. Often that means chaining several not-so-bad bugs together to build something really exciting. Sometimes they're just obscure consequences of say, a rather complex authorization system. These are typically a lot harder to find, and may involve simultaneous code audits. Ideally, your long-term in-house security people find these, because any attacker that does is in the 95th cleverness percentile. So, TL;DR: start with WAHH; then go find some vulns, and start thinking about what the app does in terms of alternative things a program could do that a reasonable programmer who was just trying to get it to work might not have thought about. If you're looking for tools to play with, you can do worse than downloading Kali and running it on a VM. If nothing else, it'll give you a pretty big catalog of tools to start looking at. I think WAHH covers basic Burp Suite usage, but Kali has some other tools like sqlmap and BeEF that aren't too tricky to get started with. WAHH: http://mdsec.net/wahh/ http://mdsec.net/wahh/ Kali: https://www.kali.org/ https://www.kali.org/

chupasaurus 10y ago
Also want to mention Web Hacking 101 [0], which is written specifically for newbies in vulnerability searching, with real cases and explanation of how certain bugs are or could be found. [0] https://leanpub.com/web-hacking-101 https://leanpub.com/web-hacking-101

andy_ppp 10y ago

So there are various ways to learn about the basics (aside from experience); look into SQL injection, XSS and CSRF as a starter then once you understand and can attempt to perform those, you can work your way through this comprehensive if dry guide: https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table... It literally contains almost everything for Webapps. The next step is finding your own exploits or doing bug bounties. If you are more interested in the other side of hacking (i.e. everything but webapps, usually OS level stuff) someone more informed than me can probably give you advice, but starting with microcorruption or similar won't hurt.

mettamage 10y ago

Regarding the tools, I recognize two-third of the tools from my web security class. So there are places where you can learn this.