MIN

Insecure DOR (Change Secret) nmap 192.168.16.91 --script http-methods --script-args http-method.test-all='/192.168.16.91'nikto -h 192.168.16.91 msfconsole

XSS - Reflected (GET) XSS - Reflected (POST) XSS - Reflected (JSON) XSS - Reflected (AJAX/JSON)burp-suite 사용 XSS - Reflected (AJAX/XML) XSS - Reflected (Back Button)XSS - Reflected (Custom Header) XSS - Reflected (Eval) XSS - Reflected (HREF) (HREF : Hypertext REFerence) XSS - Reflected (Login Form) phpMyAdmin BBCode Tag XSS XSS - Reflected (PHP_SELF) XSS - Re..

A2 - Brocken Auth & Session Mgmt. 1. Broken Auth - CAPTCHA Bypassing 2. Broken Auth - Forgotten Function 3. Broken Auth - Insecure Login Forms 4. Broken Auth - Logout Management 뒤로 가기를 누르면 세션이 그대로 유지되고있는것을 확인 5. Broken Auth - Password Attacks 6. Broken Auth - Weak Passwords 7. Session Mgmt. - Administrative Portals 8. Session Mgmt. - Cookies (HTTPOnly) 다른 사용자로 ..

1. SQL Injection (GET/Search) 2. SQL Injection (GET/Select) 3. SQL Injection (POST/Search) 4. SQL Injection (POST/Select) 5. SQL Injection (AJAX/JSON/jQuery) 6. Manual Intervention Required 7. SQL Injection (Login Form/Hero) 8. SQL Injection (Login Form/user) 9. SQL Injection (SQLite) 10. Drupal SQL Injection (Drupageddon) 11. SQL Injection - St..

linux - ubuntu - beebox 디스크 지정 후 설치 Beebox보안 취약점 실습을 위해 의도적으로 취약하게 만들어진 가상 운영체제 SQL 인젝션, XSS, 파일 업로드 등 다양한 웹 취약점들이 미리 포함된 bWAPP이라는 애플리케이션이 설치되어 있어, 공격과 방어 방법을 직접 연습할 수 있다. bWAPP v2.2 bug Hack Practice Beebox : 192.168.16.30Kali : 192.168.16.97 에서 진행A1 - Injection 1. HTML Injection - Reflected (GET) 2. HTML Injection - Reflected (POST) 3. HTML Injection - Reflected (Current URL) 4. HTM..