4 ms·

It seems so simple and straight forward to do this attack, and the $5k pay day is a nice bonus too. But finding things like this must take a lot of time to disc

It seems so simple and straight forward to do this attack, and the $5k pay day is a nice bonus too. But finding things like this must take a lot of time to discover. I would love to know about methodologies on how you can start to do penetration testing. Does anyone have any recommended resources ? TIA !

dm2 13y ago
https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Proje... https://www.owasp.org/index.php/Top_10_2013-Top_10 https://www.owasp.org/index.php/Top_10_2013-Top_10 http://www.nsa.gov/ia/_files/support/I733-034R-2007.pdf http://www.nsa.gov/ia/_files/support/I733-034R-2007.pdf http://www.nsa.gov/ia/_files/factsheets/TSA-13-1019-FS.pdf http://www.nsa.gov/ia/_files/factsheets/TSA-13-1019-FS.pdf https://code.google.com/p/skipfish/ https://code.google.com/p/skipfish/ http://google-gruyere.appspot.com/ http://google-gruyere.appspot.com/ http://www.google.com/about/appsecurity/tools/ http://www.google.com/about/appsecurity/tools/ http://googleonlinesecurity.blogspot.com/2010/11/rewarding-web-application-security.html http://googleonlinesecurity.blogspot.com/2010/11/rewarding-w... http://www-01.ibm.com/software/tivoli/governance/security/application-security.html http://www-01.ibm.com/software/tivoli/governance/security/ap... http://www-01.ibm.com/software/tivoli/products/security-network-intrusion-prevention/web-application-security.html http://www-01.ibm.com/software/tivoli/products/security-netw... http://msdn.microsoft.com/en-us/library/ff649874.aspx http://msdn.microsoft.com/en-us/library/ff649874.aspx http://msdn.microsoft.com/en-us/library/ff649461.aspx http://msdn.microsoft.com/en-us/library/ff649461.aspx Source: typing "web application security" into google.com You could probably also search for "Hacking Forums" or something similar and find lots of black hat resources.
- blackdogie 13y ago
  THANK YOU !
pipeline_tux 13y ago
The OWASP testing guide is a very good start: https://www.owasp.org/images/5/56/OWASP_Testing_Guide_v3.pdf https://www.owasp.org/images/5/56/OWASP_Testing_Guide_v3.pdf It covers the process of a web application test and explains 90% of the vulnerabilities you'll find in web apps and how to test for them.
- blackdogie 13y ago
  Thanks for the link. Very helpful.

dm2 13y ago

https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Proje... https://www.owasp.org/index.php/Top_10_2013-Top_10 https://www.owasp.org/index.php/Top_10_2013-Top_10 http://www.nsa.gov/ia/_files/support/I733-034R-2007.pdf http://www.nsa.gov/ia/_files/support/I733-034R-2007.pdf http://www.nsa.gov/ia/_files/factsheets/TSA-13-1019-FS.pdf http://www.nsa.gov/ia/_files/factsheets/TSA-13-1019-FS.pdf https://code.google.com/p/skipfish/ https://code.google.com/p/skipfish/ http://google-gruyere.appspot.com/ http://google-gruyere.appspot.com/ http://www.google.com/about/appsecurity/tools/ http://www.google.com/about/appsecurity/tools/ http://googleonlinesecurity.blogspot.com/2010/11/rewarding-web-application-security.html http://googleonlinesecurity.blogspot.com/2010/11/rewarding-w... http://www-01.ibm.com/software/tivoli/governance/security/application-security.html http://www-01.ibm.com/software/tivoli/governance/security/ap... http://www-01.ibm.com/software/tivoli/products/security-network-intrusion-prevention/web-application-security.html http://www-01.ibm.com/software/tivoli/products/security-netw... http://msdn.microsoft.com/en-us/library/ff649874.aspx http://msdn.microsoft.com/en-us/library/ff649874.aspx http://msdn.microsoft.com/en-us/library/ff649461.aspx http://msdn.microsoft.com/en-us/library/ff649461.aspx Source: typing "web application security" into google.com You could probably also search for "Hacking Forums" or something similar and find lots of black hat resources.

blackdogie 13y ago
THANK YOU !

pipeline_tux 13y ago

The OWASP testing guide is a very good start: https://www.owasp.org/images/5/56/OWASP_Testing_Guide_v3.pdf https://www.owasp.org/images/5/56/OWASP_Testing_Guide_v3.pdf It covers the process of a web application test and explains 90% of the vulnerabilities you'll find in web apps and how to test for them.

blackdogie 13y ago
Thanks for the link. Very helpful.