SlideShare une entreprise Scribd logo
1  sur  20
Web Application Hacking
By
Muchammad Sholeh

Sharing Knowledge Session, Bank Danamon Lt. 5 KSI
Hacking Methodology
Computer Search Engine
By ShodanHq
Shodan Exploits
A n I n t r o d u c t io n t o Z A P
T h e O W A S P Z e d A tta c k P ro x y
Main Feature
A ll t h e e s s e n t ia ls f o r w e b a p p lic a t io n t e s t in g

•

I n t e r c e p t in g P r o x y

•

A c t iv e a n d P a s s iv e S c a n n e r s

•

S p id e r

•

R e p o r t G e n e r a t io n

•

B r u t e F o r c e ( u s in g O W A S P D ir B u s t e r c o d e )

•

F u z z in g ( u s in g O W A S P J B r o F u z z c o d e )
The Additional Features
•

A u t o t a g g in g

•

Po rt sca n n e r

•

Sm a rt ca rd su p p o rt

•

S e s s io n c o m p a r is o n

•

In v o k e e xte rn a l a p p s

•

B e a n S h e ll in t e g r a t io n

•

A P I + H e a d le s s m o d e

•

D y n a m ic S S L C e r t if ic a t e s

•

A n t i C S R F t o k e n h a n d lin g
http://www.nuovoline.com/order.php?do=etc%2Fpasswd
List Tools Scanning and
Enumeration
●

Zap Proxy

●

Arachni

●

W3AF

●

Wapiti

●

OpenVas

●

Nessus

●

Nikto.PL

●

NMAP

●

ShodanHQ
Penetration Testing OS Base on
OSS
●

Backtrack Linux

●

Kali Linux

●

OWASP

●

OSWTF

●

Samurai Linux

●

4n6

●

etc
Common Vulnerability Reference
●

CVE (Common Vulnerability Exposure)

●

OSVDB (Open Source Vulenerability Database)

●

ExploitDB (http://www.exploit-db.com/)

●

National Vulnerability Database

●

Common Vulnerability Scoring System (CVSSSIG) -FIRST

●

CVE Details (http://www.cvedetails.com/)

●

Injector Exploitation Tools

●

Exploit-ID (http://www.exploit-id.com/)
EOF

Contenu connexe

Tendances

Investigacion oprativa silva
Investigacion oprativa silvaInvestigacion oprativa silva
Investigacion oprativa silva
ybettsilva2014
 

Tendances (6)

Python (part 0)
Python (part 0)Python (part 0)
Python (part 0)
 
Digital Marketing is the era in Marketing. Do you agree?
Digital Marketing is the era in Marketing. Do you agree? Digital Marketing is the era in Marketing. Do you agree?
Digital Marketing is the era in Marketing. Do you agree?
 
Mock proposal for digitisation project
Mock proposal for digitisation projectMock proposal for digitisation project
Mock proposal for digitisation project
 
AWS para Torpes - Introducción a AWS
AWS para Torpes - Introducción a AWSAWS para Torpes - Introducción a AWS
AWS para Torpes - Introducción a AWS
 
Investigacion oprativa silva
Investigacion oprativa silvaInvestigacion oprativa silva
Investigacion oprativa silva
 
Возможности сабмитов в SEO. А нужно ли ими вообще заниматься?
Возможности сабмитов в SEO. А нужно ли ими вообще заниматься?Возможности сабмитов в SEO. А нужно ли ими вообще заниматься?
Возможности сабмитов в SEO. А нужно ли ими вообще заниматься?
 

Similaire à Web Application Hacking

Ninja Correlation of APT Binaries
Ninja Correlation of APT BinariesNinja Correlation of APT Binaries
Ninja Correlation of APT Binaries
CODE BLUE
 
SharePoint Saturday Redmond - Building solutions with the future in mind
SharePoint Saturday Redmond - Building solutions with the future in mindSharePoint Saturday Redmond - Building solutions with the future in mind
SharePoint Saturday Redmond - Building solutions with the future in mind
Chris Johnson
 
From Content Strategy to Drupal Site Building - Connecting the dots
From Content Strategy to Drupal Site Building - Connecting the dotsFrom Content Strategy to Drupal Site Building - Connecting the dots
From Content Strategy to Drupal Site Building - Connecting the dots
Ronald Ashri
 
From Content Strategy to Drupal Site Building - Connecting the Dots
From Content Strategy to Drupal Site Building - Connecting the DotsFrom Content Strategy to Drupal Site Building - Connecting the Dots
From Content Strategy to Drupal Site Building - Connecting the Dots
Ronald Ashri
 

Similaire à Web Application Hacking (20)

Transforming developer from Commodity to Premium - A tale of micorservices
Transforming developer from Commodity to Premium - A tale of micorservicesTransforming developer from Commodity to Premium - A tale of micorservices
Transforming developer from Commodity to Premium - A tale of micorservices
 
Ninja Correlation of APT Binaries
Ninja Correlation of APT BinariesNinja Correlation of APT Binaries
Ninja Correlation of APT Binaries
 
Switching horses midstream - From Waterfall to Agile
Switching horses midstream - From Waterfall to AgileSwitching horses midstream - From Waterfall to Agile
Switching horses midstream - From Waterfall to Agile
 
The Road to QA
The Road to QAThe Road to QA
The Road to QA
 
Information Security Project Management
Information Security Project ManagementInformation Security Project Management
Information Security Project Management
 
PRESENTATION
PRESENTATIONPRESENTATION
PRESENTATION
 
DNX GLOBAL Workshop ★ Katja Andes - Transforming your passion into a valid bu...
DNX GLOBAL Workshop ★ Katja Andes - Transforming your passion into a valid bu...DNX GLOBAL Workshop ★ Katja Andes - Transforming your passion into a valid bu...
DNX GLOBAL Workshop ★ Katja Andes - Transforming your passion into a valid bu...
 
SharePoint Saturday Redmond - Building solutions with the future in mind
SharePoint Saturday Redmond - Building solutions with the future in mindSharePoint Saturday Redmond - Building solutions with the future in mind
SharePoint Saturday Redmond - Building solutions with the future in mind
 
CIA For WordPress Developers
CIA For WordPress DevelopersCIA For WordPress Developers
CIA For WordPress Developers
 
From Content Strategy to Drupal Site Building - Connecting the dots
From Content Strategy to Drupal Site Building - Connecting the dotsFrom Content Strategy to Drupal Site Building - Connecting the dots
From Content Strategy to Drupal Site Building - Connecting the dots
 
From Content Strategy to Drupal Site Building - Connecting the Dots
From Content Strategy to Drupal Site Building - Connecting the DotsFrom Content Strategy to Drupal Site Building - Connecting the Dots
From Content Strategy to Drupal Site Building - Connecting the Dots
 
Tailoring Malaysian Blockchain Regulations For Digital Economy 2018 MIGHT
Tailoring Malaysian Blockchain Regulations For Digital Economy 2018 MIGHT Tailoring Malaysian Blockchain Regulations For Digital Economy 2018 MIGHT
Tailoring Malaysian Blockchain Regulations For Digital Economy 2018 MIGHT
 
Selection
SelectionSelection
Selection
 
Offline-first: Making your app resilient to network failures
Offline-first: Making your app resilient to network failuresOffline-first: Making your app resilient to network failures
Offline-first: Making your app resilient to network failures
 
Canary Deployments on Amazon EKS with Istio - SRV305 - Chicago AWS Summit
Canary Deployments on Amazon EKS with Istio - SRV305 - Chicago AWS SummitCanary Deployments on Amazon EKS with Istio - SRV305 - Chicago AWS Summit
Canary Deployments on Amazon EKS with Istio - SRV305 - Chicago AWS Summit
 
Uncover Python's Potential in Machine Learning
Uncover Python's Potential in Machine LearningUncover Python's Potential in Machine Learning
Uncover Python's Potential in Machine Learning
 
Gain Maximum Visibility - DEM06 - Anaheim AWS Summit
Gain Maximum Visibility - DEM06 - Anaheim AWS SummitGain Maximum Visibility - DEM06 - Anaheim AWS Summit
Gain Maximum Visibility - DEM06 - Anaheim AWS Summit
 
Yammer time
Yammer timeYammer time
Yammer time
 
War robot.pptx
War robot.pptxWar robot.pptx
War robot.pptx
 
MVP-Style Influencer Programs for Fun & Profit
MVP-Style Influencer Programs for Fun & ProfitMVP-Style Influencer Programs for Fun & Profit
MVP-Style Influencer Programs for Fun & Profit
 

Plus de Muchammad Sholeh (13)

Roadmap govcsirt versi sholeh
Roadmap govcsirt versi sholehRoadmap govcsirt versi sholeh
Roadmap govcsirt versi sholeh
 
Ssl presentation verindo_rev_sholeh
Ssl presentation verindo_rev_sholehSsl presentation verindo_rev_sholeh
Ssl presentation verindo_rev_sholeh
 
Spreadsheet
SpreadsheetSpreadsheet
Spreadsheet
 
Softwarelegal dirjenaptika-sholeh
Softwarelegal dirjenaptika-sholehSoftwarelegal dirjenaptika-sholeh
Softwarelegal dirjenaptika-sholeh
 
Se legal foss makassar
Se legal foss makassarSe legal foss makassar
Se legal foss makassar
 
Openoffice 3.2.1 presentation
Openoffice 3.2.1 presentationOpenoffice 3.2.1 presentation
Openoffice 3.2.1 presentation
 
Ooo writer pendahuluan
Ooo writer pendahuluanOoo writer pendahuluan
Ooo writer pendahuluan
 
Ooo writer
Ooo writerOoo writer
Ooo writer
 
IT Government
IT GovernmentIT Government
IT Government
 
Open source Traning at Brebes
Open source Traning at BrebesOpen source Traning at Brebes
Open source Traning at Brebes
 
Dss pert1
Dss pert1Dss pert1
Dss pert1
 
Pert1 netprog
Pert1 netprogPert1 netprog
Pert1 netprog
 
Gov csirt sholeh
Gov csirt sholehGov csirt sholeh
Gov csirt sholeh
 

Dernier

EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptxEIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
Earley Information Science
 

Dernier (20)

Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organization
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
 
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdfThe Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf
 
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
 
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptxEIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
EIS-Webinar-Prompt-Knowledge-Eng-2024-04-08.pptx
 
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men08448380779 Call Girls In Greater Kailash - I Women Seeking Men
08448380779 Call Girls In Greater Kailash - I Women Seeking Men
 
🐬 The future of MySQL is Postgres 🐘
🐬  The future of MySQL is Postgres   🐘🐬  The future of MySQL is Postgres   🐘
🐬 The future of MySQL is Postgres 🐘
 
The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024The 7 Things I Know About Cyber Security After 25 Years | April 2024
The 7 Things I Know About Cyber Security After 25 Years | April 2024
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processors
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024
 
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
 
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
 
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
 
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day Presentation
 

Web Application Hacking

  • 1. Web Application Hacking By Muchammad Sholeh Sharing Knowledge Session, Bank Danamon Lt. 5 KSI
  • 2.
  • 3.
  • 4.
  • 5.
  • 6.
  • 7.
  • 9.
  • 12. A n I n t r o d u c t io n t o Z A P T h e O W A S P Z e d A tta c k P ro x y
  • 13. Main Feature A ll t h e e s s e n t ia ls f o r w e b a p p lic a t io n t e s t in g • I n t e r c e p t in g P r o x y • A c t iv e a n d P a s s iv e S c a n n e r s • S p id e r • R e p o r t G e n e r a t io n • B r u t e F o r c e ( u s in g O W A S P D ir B u s t e r c o d e ) • F u z z in g ( u s in g O W A S P J B r o F u z z c o d e )
  • 14. The Additional Features • A u t o t a g g in g • Po rt sca n n e r • Sm a rt ca rd su p p o rt • S e s s io n c o m p a r is o n • In v o k e e xte rn a l a p p s • B e a n S h e ll in t e g r a t io n • A P I + H e a d le s s m o d e • D y n a m ic S S L C e r t if ic a t e s • A n t i C S R F t o k e n h a n d lin g
  • 16.
  • 17. List Tools Scanning and Enumeration ● Zap Proxy ● Arachni ● W3AF ● Wapiti ● OpenVas ● Nessus ● Nikto.PL ● NMAP ● ShodanHQ
  • 18. Penetration Testing OS Base on OSS ● Backtrack Linux ● Kali Linux ● OWASP ● OSWTF ● Samurai Linux ● 4n6 ● etc
  • 19. Common Vulnerability Reference ● CVE (Common Vulnerability Exposure) ● OSVDB (Open Source Vulenerability Database) ● ExploitDB (http://www.exploit-db.com/) ● National Vulnerability Database ● Common Vulnerability Scoring System (CVSSSIG) -FIRST ● CVE Details (http://www.cvedetails.com/) ● Injector Exploitation Tools ● Exploit-ID (http://www.exploit-id.com/)
  • 20. EOF