当当云阅读 > 进口书 > 外文原版书 > 电脑/网络 > Kali Linux Web Penetration Testing Cookbook

| | 手机阅读

扫描下载当当云阅读App

Kali Linux Web Penetration Testing Cookbook电子书

售价：¥

10人正在读 | 0人评论

9.8

作者：Gilberto Nájera-Gutiérrez

出版社：Packt Publishing

出版时间：2016-02-29

字数：103.1万

所属分类：进口书 > 外文原版书 > 电脑/网络

温馨提示：数字商品不支持退换货，不提供源文件，不支持导出打印

为你推荐

读书简介
目录
累计评论(0条)

读书简介
目录
累计评论(0条)

Over 80 recipes on how to identify, exploit, and test web application security with Kali Linux 2About This BookFamiliarize yourself with the most common web vulnerabilities a web application faces, and understand how attackers take advantage of themSet up a penetration testing lab to conduct a preliminary assessment of attack surfaces and run exploitsLearn how to prevent vulnerabilities in web applications before an attacker can make the most of itWho This Book Is ForThis book is for IT professionals, web developers, security enthusiasts, and security professionals who want an accessible reference on how to find, exploit, and prevent security vulnerabilities in web applications. You should know the basics of operating a Linux environment and have some exposure to security technologies and tools.What You Will LearnSet up a penetration testing laboratory in a secure wayFind out what information is useful to gather when performing penetration tests and where to look for itUse crawlers and spiders to investigate an entire website in minutesDiscover security vulnerabilities in web applications in the web browser and using command-line toolsImprove your testing efficiency with the use of automated vulnerability scannersExploit vulnerabilities that require a complex setup, run custom-made exploits, and prepare for extraordinary scenariosSet up Man in the Middle attacks and use them to identify and exploit security flaws within the communication between users and the web serverCreate a malicious site that will find and exploit vulnerabilities in the user's web browserRepair the most common web vulnerabilities and understand how to prevent them becoming a threat to a site's securityIn DetailWeb applications are a huge point of attack for malicious hackers and a critical area for security professionals and penetration testers to lock down and secure. Kali Linux is a Linux-based penetration testing platform and operating system that provides a huge array of testing tools, many of which can be used specifically to execute web penetration testing.This book will teach you, in the form step-by-step recipes, how to detect a wide array of vulnerabilities, exploit them to analyze their consequences, and ultimately buffer attackable surfaces so applications are more secure, for you and your users.Starting from the setup of a testing laboratory, this book will give you the skills you need to cover every stage of a penetration test: from gathering information about the system and the application to identifying vulnerabilities through manual testing and the use of vulnerability scanners to both basic and advanced exploitation techniques that may lead to a full system compromise. Finally, we will put this into the context of OWASP and the top 10 web application vulnerabilities you are most likely to encounter, equipping you with the ability to combat them effectively. By the end of the book, you will have the required skills to identify, exploit, and prevent web application vulnerabilities.Style and approachTaking a recipe-based approach to web security, this book has been designed to cover each stage of a penetration test, with de*ions on how tools work and why certain programming or configuration practices can become security vulnerabilities that may put a whole system, or network, at risk. Each topic is presented as a sequence of tasks and contains a proper explanation of why each task is performed and what it accomplishes.

目录展开

Kali Linux Web Penetration Testing Cookbook

Table of Contents

Kali Linux Web Penetration Testing Cookbook

Credits

About the Author

About the Reviewers

www.PacktPub.com

eBooks, discount offers, and more

Why subscribe?

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Downloading the example code

Errata

Piracy

Questions

1. Setting Up Kali Linux

Introduction

Updating and upgrading Kali Linux

Getting ready

How to do it...

How it works...

There's more...

Installing and running OWASP Mantra

Getting ready

How to do it...

See also

Setting up the Iceweasel browser

How to do it...

How it works...

There's more...

Installing VirtualBox

Getting ready

How to do it...

How it works...

There's more...

See also

Creating a vulnerable virtual machine

How to do it...

How it works...

See also

Creating a client virtual machine

How to do it...

How it works...

See also

Configuring virtual machines for correct communication

Getting ready

How to do it...

How it works...

Getting to know web applications on a vulnerable VM

Getting ready

How to do it...

How it works...

2. Reconnaissance

Introduction

Scanning and identifying services with Nmap

Getting ready

How to do it...

How it works...

There's more...

See also

Identifying a web application firewall

How to do it...

How it works...

Watching the source code

Getting ready

How to do it...

How it works...

Using Firebug to analyze and alter basic behavior

Getting ready

How to do it...

How it works...

There's more...

Obtaining and modifying cookies

Getting ready

How to do it...

How it works...

Taking advantage of robots.txt

How to do it...

How it works...

Finding files and folders with DirBuster

Getting ready

How to do it...

How it works...

Password profiling with CeWL

How to do it...

How it works...

See also

Using John the Ripper to generate a dictionary

Getting ready

How to do it...

How it works...

There's more...

Finding files and folders with ZAP

Getting ready

How to do it...

How it works...

See also

3. Crawlers and Spiders

Introduction

Downloading a page for offline analysis with Wget

Getting ready

How to do it...

How it works...

There's more...

Downloading the page for offline analysis with HTTrack

Getting ready

How to do it...

How it works...

There's more...

Using ZAP's spider

Getting ready

How to do it...

How it works...

There's more...

Using Burp Suite to crawl a website

Getting ready

How to do it...

How it works...

Repeating requests with Burp's repeater

Getting ready

How to do it...

How it works...

Using WebScarab

Getting ready

How to do it...

How it works...

Identifying relevant files and directories from crawling results

How to do it...

How it works...

4. Finding Vulnerabilities

Introduction

Using Hackbar add-on to ease parameter probing

Getting ready

How to do it...

How it works...

Using Tamper Data add-on to intercept and modify requests

How to do it...

How it works...

Using ZAP to view and alter requests

Getting ready

How to do it...

How it works...

Using Burp Suite to view and alter requests

Getting ready

How to do it...

How it works...

Identifying cross-site scripting (XSS) vulnerabilities

How to do it...

How it works...

There's more...

Identifying error based SQL injection

How to do it...

How it works...

There's more...

Identifying a blind SQL Injection

How to do it...

How it works...

See also

Identifying vulnerabilities in cookies

How to do it

How it works...

There's more...

Obtaining SSL and TLS information with SSLScan

How to do it...

How it works...

There's more...

See also

Looking for file inclusions

How to do it...

How it works...

There's more...

Identifying POODLE vulnerability

Getting ready

How to do it...

How it works...

See also

5. Automated Scanners

Introduction

Scanning with Nikto

How to do it...

How it works...

Finding vulnerabilities with Wapiti

How to do it...

How it works...

Using OWASP ZAP to scan for vulnerabilities

Getting ready

How to do it...

How it works...

There's more...

Scanning with w3af

How to do it...

How it works...

There's more...

Using Vega scanner

How to do it...

How it works...

Finding Web vulnerabilities with Metasploit's Wmap

Getting ready

How to do it...

How it works...

6. Exploitation – Low Hanging Fruits

Introduction

Abusing file inclusions and uploads

Getting ready

How to do it...

How it works...

There's more...

Exploiting OS Command Injections

How to do it...

How it works...

Exploiting an XML External Entity Injection

Getting ready

How to do it...

How it works...

There's more...

See also

Brute-forcing passwords with THC-Hydra

Getting ready

How to do it...

How it works...

There's more...

Dictionary attacks on login pages with Burp Suite

Getting ready

How to do it...

How it works...

There's more...

Obtaining session cookies through XSS

Getting ready

How to do it...

How it works...

There's more...

Step by step basic SQL Injection

How to do it...

How it works...

Finding and exploiting SQL Injections with SQLMap

How to do it...

How it works...

There's more...

See also

Attacking Tomcat's passwords with Metasploit

Getting ready

How to do it...

How it works...

See also

Using Tomcat Manager to execute code

How to do it...

How it works...

7. Advanced Exploitation

Introduction

Searching Exploit-DB for a web server's vulnerabilities

How to do it...

How it works...

There's more...

See also

Exploiting Heartbleed vulnerability

Getting ready

How to do it...

How it works...

Exploiting XSS with BeEF

Getting ready

How to do it...

How it works...

There's more...

Exploiting a Blind SQLi

Getting ready

How to do it...

How it works...

There's more...

Using SQLMap to get database information

How to do it...

How it works...

Performing a cross-site request forgery attack

Getting ready

How to do it...

Executing commands with Shellshock

How to do it...

How it works...

There's more...

Cracking password hashes with John the Ripper by using a dictionary

How to do it...

How it works...

Cracking password hashes by brute force using oclHashcat/cudaHashcat

Getting ready

How to do it...

How it works...

8. Man in the Middle Attacks

Introduction

Setting up a spoofing attack with Ettercap

Getting ready

How to do it...

How it works...

Being the MITM and capturing traffic with Wireshark

Getting ready

How to do it...

How it works...

See also

Modifying data between the server and the client

Getting ready

How to do it...

How it works...

There's more...

See also

Setting up an SSL MITM attack

How to do it...

How it works...

See also

Obtaining SSL data with SSLsplit

Getting ready

How to do it...

How it works...

Performing DNS spoofing and redirecting traffic

Getting ready

How to do it...

How it works...

See also

9. Client-Side Attacks and Social Engineering

Introduction

Creating a password harvester with SET

How to do it...

How it works...

Using previously saved pages to create a phishing site

Getting ready

How to do it...

How it works...

Creating a reverse shell with Metasploit and capturing its connections

How to do it...

How it works...

Using Metasploit's browser_autpwn2 to attack a client

How to do it...

How it works...

Attacking with BeEF

Getting ready

How to do it...

How it works...

Tricking the user to go to our fake site

How to do it...

How it works...

There's more...

See also

10. Mitigation of OWASP Top 10

Introduction

A1 – Preventing injection attacks

How to do it...

How it works...

See also

A2 – Building proper authentication and session management

How to do it...

How it works...

See also

A3 – Preventing cross-site scripting

How to do it...

How it works...

See also

A4 – Preventing Insecure Direct Object References

How to do it...

How it works...

A5 – Basic security configuration guide

How to do it...

How it works...

A6 – Protecting sensitive data

How to do it...

How it works...

A7 – Ensuring function level access control

How to do it...

How it works...

A8 – Preventing CSRF

How to do it...

How it works...

See also

A9 – Where to look for known vulnerabilities on third-party components

How to do it...

How it works...

A10 – Redirect validation

How to do it...

How it works...

Index

累计评论(0条) 0个书友正在讨论这本书 发表评论

发表评论

发表评论，分享你的想法吧！

发表评论

买过这本书的人还买过

读了这本书的人还在读

支持设备

Mastering Python Regular Expressions ￥45.77

Félix López

￥45.77

Boost.Asio C++ Network Programming Cookbook ￥90.46

Dmytro Radchuk

￥90.46

Beginning C++ Programming ￥90.46

Richard Grimes

￥90.46

Mastering Python ￥71.93

Rick van Hattem

￥71.93

Cybersecurity – Attack and Defense Strategies ￥73.02

Yuri Diogenes,Erdal Ozkaya

￥73.02

Spring 5 Design Patterns ￥80.65

Dinesh Rajput

￥80.65

GitHub Essentials ￥54.49

Achilleas Pipinellis

￥54.49

Java 9: Building Robust Modular Applications ￥63.21

Dr. Edward Lavieri,Peter Verhas,Jason Lee

￥63.21

Hands-On Machine Learning for Cybersecurity ￥81.74

Soma Halder

￥81.74

MQTT Essentials - A Lightweight IoT Protocol ￥71.93

Gastón C. Hillar

￥71.93

更多同类图书 >