If you are not using Social-Engineer Toolkit (SET, https://www.trustedsec.com/social-engineer-toolkit/), you are missing out on something important. We can certainly use it to spoof Google, Facebook, and Twitter to attract victims and launch attacks or scrape their credentials, but we can also use it in spoofing our target web application so as to hijack sessions and map user behaviors. As victims unknowingly browse these duplicate websites from the comfort of a coffee shop chair, attackers can gather the victims' passwords or even inject a command shell that gives them full access to the victims' systems. It is a great tool for security professionals to demonstrate how users more often than not will not pay attention to the location where they enter sensitive information as long as the page looks legit.
Let's take a look at how to...
Mastering Kali Linux for Web Penetration Testing
By :
Mastering Kali Linux for Web Penetration Testing
By:
Overview of this book
You will start by delving into some common web application architectures in use, both in private and public cloud instances. You will also learn about the most common frameworks for testing, such as OWASP OGT version 4, and how to use them to guide your efforts. In the next section, you will be introduced to web pentesting with core tools and you will also see how to make web applications more secure through rigorous penetration tests using advanced features in open source tools. The book will then show you how to better hone your web pentesting skills in safe environments that can ensure low-risk experimentation with the powerful tools and features in Kali Linux that go beyond a typical script-kiddie approach. After establishing how to test these powerful tools safely, you will understand how to better identify vulnerabilities, position and deploy exploits, compromise authentication and authorization, and test the resilience and exposure applications possess.
By the end of this book, you will be well-versed with the web service architecture to identify and evade various protection mechanisms that are used on the Web today. You will leave this book with a greater mastery of essential test techniques needed to verify the secure design, development, and operation of your customers' web applications.
Related Content you might be interested in
Current Title:
Mastering Kali Linux for Web Penetration Testing
Table of Contents (13 chapters)
Preface
Free Chapter
Common Web Applications and Architectures
Guidelines for Preparation and Testing
Stalking Prey Through Target Recon
Scanning for Vulnerabilities with Arachni
Proxy Operations with OWASP ZAP and Burp Suite
Infiltrating Sessions via Cross-Site Scripting
Injection and Overflow Testing
Exploiting Trust Through Cryptography Testing
Stress Testing Authentication and Session Management
Launching Client-Side Attacks
Breaking the Application Logic
Educating the Customer and Finishing Up
Customer Reviews