This post will help you if you are hacking an API, you are at the recon stage and you want to generate your own OpenAPI 3.0 documentation for your target API, which you can then open as a collection in Postman to start probing for vulnerabilities. Here, we are going to use Firefox’s developer...
Using Kiterunner with routes-large.kite
So you’ve chosen Kiterunner as your preferred tool for fuzzing APIs ? Good for you (I’ll go into more detail about Kiterunner in a later post – stay tuned). But if you are using a virtual machine to host the linux system you use for your hacking (which I very much recommend) and installed...
Make crAPI accessible on a network
Need to practice your API hacking skills? crAPI is for you. OWASP’s completely ridiculous API (crAPI) is one of several vulnerable apps you can set up as a target on your network. You’ll find installation instructions here. But there’s a catch. Once you have successfully run through the instructions, you will have a functioning...
What is directory traversal?
Some web applications give you access to directories containing files you are allowed to display or download. Imagine a web app that lets users share images of their custom skateboards or bikes. Images uploaded by the site’s users could be all stored in a given directory. If you click on one of these images,...
What is a file inclusion – LFI – RFI
In some situations, a web application will allow a user to access a file stored on the server (such as a text file or a PDF document) and display or render its content to the web page viewed by the user. Imagine a web site that lets users upload their resume and allows hiring...
Your ideal Kali Linux setup
Even if you’re just barely scratching the surface of ethical hacking, I’m sure you’ve figured out that the very first skill you need to acquire is using Linux. If you don’t already have some good practical knowledge of Linux, this should be your prime focus. You’ve also likely read or heard about Kali Linux...
What is an IDOR?
IDOR means Insecure Direct Object Reference. It’s one of the easier web application vulnerabilities to understand (or at least, the basic concept is). An IDOR happens when a user of a web site can find ways to access pages and data that belong to a different user on the same site, by changing a...
What is a command injection?
Web applications sometimes use system commands as part of their features. Imagine a web application that lets you enter an IP address, then pings this address to check if the host is accessible. In order to do this, the app could maybe use the ping command to do the job. Bottom line: a web app...
What is XSS – Cross Site Scripting?
XSS or Cross Site Scripting is a technique that allows malicious users to insert JavaScript code into a page from a target web site. When the page is then displayed or refreshed, the attacker’s JavaScript is executed by the browser just like any legit JavaScript code contained in the code of the page. If...
Clusterbomb or pitchfork?
Clusterbomb and pitchfork are terms you will come across when fuzzing web apps using tools like FFUF or Burp Suite. Let’s see how this works with FFUF. FFUF has two wordlist modes : clusterbomb and pitchfork. These modes will matter when you want to fuzz two separate positions in your target URL, using two wordlists. Here...