3 ms·

Appreciate it. You're quite right about thinking outside of the box. I guess I need a better baseline of understanding to be able to do that better in this case

Appreciate it. You're quite right about thinking outside of the box. I guess I need a better baseline of understanding to be able to do that better in this case. The entry point of the attack vector is interesting though. I wouldn't have considered a third-party service "innocuously" causing the problem as I was trying to think of a sexier direct exploit into the website's system.

Shared404 6y ago
Glad to be of service. If you want to learn more about security hacking, check out hackthissite.org , and I would be happy to recommend some more things to check out if you're interested. Indeed. Honestly, I only realized it because I saw that site when I looked up favicon. Otherwise, I would have been doing the same thing.
- IMAYousaf 6y ago
  Appreciate it. Will take all the resources you got.
  - Shared404 6y ago
    Sorry, I just saw this. Disclaimer: I'm not particularly good at this, so whatever comments I make are well intentioned but may be of varying accuracy. ... Online sources: * OWASP.org is a good place to find info. If you look something up, there's a good chance you will find it here. * https://owasp.org/www-project-web-security-testing-guide/ https://owasp.org/www-project-web-security-testing-guide/ Thanks to redis_mic for this one, I didn't know it existed until today. * overthewire.org Similar to HTS, but you don't need an account. The subject matter covered is also slightly different. * https://0x00sec.org/ https://0x00sec.org/ A forum dedicated to security. There's a lot of script kiddies, but also some gold. * https://www.hackerone.com/ https://www.hackerone.com/ What better way to learn then practice on live targets? That being said, I would do some of the others first. ... I do a lot of learning through reading, so books: * Network Security Assessment by Chris McNab. I have second edition, which is a good and instructive read, but quite outdated. * Real-World Bug Hunting by Peter Yaworski. Web security 101. Good read, and fairly useful. * Advanced Penetration Testing by Wil Allsop. Outdated, but interesting. You will never use flash again after reading this. * Social Engineering, The Science of Human Hacking by Christopher Hadnagy. This is a very interesting read. Also, one of the few that can't go out of date. ... This should be enough to get you started. There's a couple more books I can think of, but they tend to be more specialized into certain fields of security and less approachable/generally applicable. If you want these recommendations as well, feel free to email me, my email's in my bio.
    - IMAYousaf 6y ago
      Thank you so much!

Shared404 6y ago

Glad to be of service. If you want to learn more about security hacking, check out hackthissite.org , and I would be happy to recommend some more things to check out if you're interested. Indeed. Honestly, I only realized it because I saw that site when I looked up favicon. Otherwise, I would have been doing the same thing.

IMAYousaf 6y ago
Appreciate it. Will take all the resources you got.
- Shared404 6y ago
  Sorry, I just saw this. Disclaimer: I'm not particularly good at this, so whatever comments I make are well intentioned but may be of varying accuracy. ... Online sources: * OWASP.org is a good place to find info. If you look something up, there's a good chance you will find it here. * https://owasp.org/www-project-web-security-testing-guide/ https://owasp.org/www-project-web-security-testing-guide/ Thanks to redis_mic for this one, I didn't know it existed until today. * overthewire.org Similar to HTS, but you don't need an account. The subject matter covered is also slightly different. * https://0x00sec.org/ https://0x00sec.org/ A forum dedicated to security. There's a lot of script kiddies, but also some gold. * https://www.hackerone.com/ https://www.hackerone.com/ What better way to learn then practice on live targets? That being said, I would do some of the others first. ... I do a lot of learning through reading, so books: * Network Security Assessment by Chris McNab. I have second edition, which is a good and instructive read, but quite outdated. * Real-World Bug Hunting by Peter Yaworski. Web security 101. Good read, and fairly useful. * Advanced Penetration Testing by Wil Allsop. Outdated, but interesting. You will never use flash again after reading this. * Social Engineering, The Science of Human Hacking by Christopher Hadnagy. This is a very interesting read. Also, one of the few that can't go out of date. ... This should be enough to get you started. There's a couple more books I can think of, but they tend to be more specialized into certain fields of security and less approachable/generally applicable. If you want these recommendations as well, feel free to email me, my email's in my bio.
  - IMAYousaf 6y ago
    Thank you so much!