All Web Application Attack Techniques

太过爱你忘了你带给我的痛 2022-10-02 02:53 11阅读 0赞

Pnig0s1992 P.S:Just follow this to learn Web Attack.

This list is not full, if there is some attack I missed post in thread please.  
  
  
This list below fits in category **Parameter manipulation**

*  Arbitary File Deletion
 *  Code Execution
 *  Cookie Manipulation ( meta http-equiv & crlf injection )
 *  CRLF Injection ( HTTP response splitting )
 *  Cross Frame Scripting ( XFS )
 *  Cross-Site Scripting ( XSS )
 *  Directory traversal
 *  Email Injection
 *  File inclusion
 *  Full path disclosure
 *  LDAP Injection
 *  PHP code injection
 *  PHP curl\_exec() url is controlled by user
 *  PHP invalid data type error message
 *  PHP preg\_replace used on user input
 *  PHP unserialize() used on user input
 *  Remote XSL inclusion
 *  Script source code disclosure
 *  Server-Side Includes (SSI) Injection
 *  SQL injection
 *  URL redirection
 *  XPath Injection vulnerability
 *  EXIF

This list below fits in category

**MultiRequest parameter manipulation**

*  Blind SQL injection (timing)
 *  Blind SQL/XPath injection (many types)

This list below fits in category

**File checks**

*  8.3 DOS filename source code disclosure
 *  Search for Backup files
 *  Cross Site Scripting in URI
 *  PHP super-globals-overwrite
 *  Script errors ( such as the Microsoft IIS Cookie Variable Information Disclosure )

This list below fits in category

**Directory checks**

*  Cross Site Scripting in path
 *  Cross Site Scripting in Referer
 *  Directory permissions ( mostly for IIS )
 *  HTTP Verb Tampering ( HTTP Verb POST & HTTP Verb WVS )
 *  Possible sensitive files
 *  Possible sensitive files
 *  Session fixation ( jsessionid & PHPSESSID session fixation )
 *  Vulnerabilities ( e.g. Apache Tomcat Directory Traversal, ASP.NET error message etc )
 *  WebDAV ( very vulnerable component of IIS servers )

This list below fits in category

**Text Search Disclosure**

*  Application error message
 *  Check for common files
 *  Directory Listing
 *  Email address found
 *  Local path disclosure
 *  Possible sensitive files
 *  Microsoft Office possible sensitive information
 *  Possible internal IP address disclosure
 *  Possible server path disclosure ( Unix and Windows )
 *  Possible username or password disclosure
 *  Sensitive data not encrypted
 *  Source code disclosure
 *  Trojan shell ( r57,c99,crystal shell etc )
 *  ( IF ANY )Wordpress database credentials disclosure

This list below fits in category

**File Uploads**

*  Unrestricted File Upload

This list below fits in category

**Authentication**

*  Microsoft IIS WebDAV Authentication Bypass
 *  SQL injection in the authentication header
 *  Weak Password
 *  GHDB - Google hacking database ( using dorks to find what google crawlers have found like passwords etc )

This list below fits in category

**Web Services - Parameter manipulation & with multirequest**

*  Application Error Message ( testing with empty, NULL, negative, big hex etc )
 *  Code Execution
 *  SQL Injection
 *  XPath Injection
 *  Blind SQL/XPath injection ( test for numeric,string,number inputs etc )
 *  Stored Cross-Site Scripting ( XSS )
 *  Cross-Site Request Forgery ( CSRF )

转载于:https://blog.51cto.com/pnig0s1992/500382

发表评论取消回复

表情：

评论列表（有 0 条评论，11人围观）

还没有评论，来说两句吧...

相关阅读

相关 Web Application Pentesting Tools

Web Application Pentesting Tools Organization [OWASP][] – The Open Web Applicat

川长思鸟来/ 2023年10月05日 09:17/ 0 赞/ 34 阅读

相关 Web Application Vulnerability Scanners

Vulnerability Scanning Tools Description Web Application Vulnerability Scanners ar

亦凉/ 2023年10月05日 09:16/ 0 赞/ 5 阅读

相关 TEXTURE COMPRESSION TECHNIQUES

TEXTURE COMPRESSION TECHNIQUES T. Paltashev1, I. Perminov2 1 Advanced Micro Devices

浅浅的花香味﹌/ 2022年12月28日 04:12/ 0 赞/ 1493 阅读

相关 All Web Application Attack Techniques

Pnig0s1992 P.S:Just follow this to learn Web Attack. This list is not full, if there is

太过爱你忘了你带给我的痛/ 2022年10月02日 02:53/ 0 赞/ 12 阅读

相关 Outlier Detection Techniques

Outlier Detection Techniques 16th ACM SIGKDD Conference on Knowledge Discovery and Data

╰+哭是因爲堅強的太久メ/ 2022年08月19日 01:41/ 0 赞/ 146 阅读

相关 Metal Tips and Techniques

Metal Tips and Techniques This chapter discusses tips and techniques that can improve

我就是我/ 2022年08月18日 05:59/ 0 赞/ 168 阅读

相关 Viola-Jones technique

[Viola Jones Face Detector][] Viola Jones Face Detector是Paul viola 和 Michael J Jones共

桃扇骨/ 2022年07月17日 02:39/ 0 赞/ 175 阅读

相关 Web Application

Web Application 在计算中，web应用或web应用是客户端 - 服务器软件应用，其中客户端（或用户接口）在web浏览器中运行。常见的网络应用包括

水深无声/ 2022年07月14日 14:35/ 0 赞/ 131 阅读

相关 WAF(Web Application Firewall)

1、生产背景 Web应用防护系统（Web Application Firewall, 简称：WAF）代表了一类新兴的信息安全技术，用以解决诸如防火墙一类传

淡淡的烟草味﹌/ 2022年06月17日 10:42/ 0 赞/ 147 阅读

相关 Developing Large Web Applications

[Developing Large Web Applications][] 转载于:https://www.cnblogs.com/gavinhughhu/archive/2

怼烎@/ 2021年12月05日 05:39/ 0 赞/ 159 阅读