LWE..

COM

Education With Earning

(Learning With Earning)

ETHICAL Hacking Course

English & Hindi

[Link] Contact Us : +917477466951

Education With Earning
(Learning With Earning)

[Link] Contact Us : +917477466951

 4 Months Live
01 02 Software Support
Classes

03 Hardcopy Certification 04 Earning Source

Start LWE NOW

[Link] Contact Us : +917477466951
 We Are The Right Place To Start Your Career In the
Field of Cyber Security / Ethical Hacking
Hundreds of satisfied Learners are already touching height and earning much
more than they expected. If you are willing to kickstart your career in the field of
cyber security you are in the right place!
Introduction to Ethical Hacking
Fundamentals of Ethical Hacking
Starting Out In Cyber Sec
Networking
Introductory Networking
Web Fundamentals
Network Security
Topics To Be C Fundamentals of Linux
Foot printing and Information
o v e r e d Gathering
Scanning Networks
VulnerabilityAnalysis
Website Hacking
System Hacking
Hacking Android
Hacking Wireless Networks
CIA,OSI Model, Network topology
Cryptography
 Introduction t o E thical
01 Linux OS
H a c k in g
Linux is a family of open-source
Unix-like operating systems 04 Ethical Hacking
based on the Linux kernel, an 02 Type of hackers
operating system kernel first A white hat is an ethical computer
Types of Hackers with ethical hacker, or a computer security expert,
released on September 17, 1991,
by Linus Torvalds. Linux is
hacking tutorial, hackers, 03 Networking who specializes in penetration testing
introduction, hacking, types of and other testing methodologies that
typically packaged in a Linux hackers, famous hackers, Networking is the exchange of
distribution. information and ideas among ensure the security of an organization's
environmental setup, network information systems.
penetration testing ... people with a common
profession or special interest,
usually in an informal social
setting.

What is Ethical Hacking

What is Bug Bounty
Black Hat Hacker
Ethical hackers use their knowledge to
A bug bounty program is a deal offered by A black hat hacker is a hacker who
secure and improve the technology of
many websites, organizations and software violates computer security for their
organizations. They provide an essential
developers by which individuals can receive own personal profit or out of malice.
service to these organizations by looking
recognition and compensation for reporting
for vulnerabilities that can lead to a
bugs, especially those pertaining to security
security breach.
exploits and vulnerabilities.
F u n d a m e n t a l s o f E t h i c a l Hacking

Information Networking Vulnerability Exploitation

Gathering
Gaining Access Scanning
 Starting Out In Cyber Sec
If you already have a basic idea on the different career tracks in the Industry, search the Hacktivities page for different
walkthroughs and challenges. If you want some more structured learning, check out our learning paths.

Offensive Security
The first large area within Cyber
Security is the offensive side. This
area involves attacking different
applications and technologies to
discover vulnerabilities.

D
Defensive Security
This is the second major area within
Security. While Offensive Security involves
actively finding vulnerabilities and
misconfigurations within technologies,
Defensive Security involves detecting and
stopping these attacks.
[Link]
 Networking Identifying Devices on a Network
Begin learning the fundamentals of computer Now we can change our name through deed
networking in this bite-sized and interactive module. poll, but we can't, however, change our
fingerprints. Every human has an individual
set of fingerprints which means that even if
they change their name, there is still an
identity behind it. Devices have the same
thing: two means of identification, with one
being permeable. These are:

Ping (ICMP)
Ping is one of the most fundamental network
tools available to us. Ping
What is Networking? uses ICMP (Internet Control Message Protoc
A computer network is a set of computers ol) packets to determine the performance of a
sharing resources located on or provided by connection between devices, for example, if
network nodes. The computers usecommon the connection exists or is reliable.
communication protocols over digital
interconnections to communicate with each
other. What is the Internet?
The Internet is one giant network that
[Link] consists of many, many small networks within
atisnetworking itself. Using our example from the previous
task, let's now imagine that Alice made
some new friends named Zayn and Toby
that she wants to introduce to Bob and Jim.
The problem is that Alice is the only person
who speaks the same language as Zayn a..
 Networking
Begin learning the fundamentals of computer Internet Protocol version 4 | IPV4
networking in this bite-sized and interactive module.
Internet Protocol version 4 is the fourth
version of the Internet Protocol. It is one of
the core protocols of standards-based
internetworking methods in the Internet and
other packet- switched networks. IPv4 was
the first version deployed for production on
SATNET in 1982 and on the ARPANET in
IP Addresses January 1983.
Briefly, an IP address (or Internet Protocol)
address can be used as a way of identifying Internet Protocol version 6 | IPV6
a host on a network for a period of time,
Internet Protocol version 6 is the most recent
where that IP address can then be
version of the Internet Protocol, the
associated with another device without the IP
communications protocol that provides an
address changing. First, let's split up
identification and location system for
precisely what an IP address is in the
computers on networks and routes traffic
diagram below:
across the Internet.

NAT :Network Address Translation MAC Addresses

Network address translation is a method of A media access control address is a unique
mapping an IP address space into anotherby identifier assigned to a network interface
modifying network address information in the controller for use as a network address in
IP header of packets while they are in transit communications within a network segment.
across a traffic routing device. This use is common in most IEEE 802
networking technologies, including Ethernet,
Wi-Fi, and Bluetooth.

[Link]
[Link] Contact Us : +917477466951
 Protocol in
Computer
Total Number of Protocols
in Networking : 65535
In computer networking, a port is a communication
endpoint. At the software level, within an operating
system, a port is a logical construct that identifies a
specific process or a type of network service. A port is
identified for each transport protocol and address
combination by a 16- bit unsigned number, known as
the port number. The most common transport
protocols that use port numbers are the Transmission
Control Protocol (TCP) and the User Datagram
Protocol (UDP).
 Introductory Networking
Traceroute The TCP/IP Model

The logical follow-up to the ping command is The TCP/IP model is, in many ways, very similar to the OSI
'traceroute'. Traceroute can be used to map the model. It's a few years older, and serves as the basis for real-
path your request takes as it heads to the world networking. The TCP/IP model consists of four layers:
target machine. Application, Transport, Internet and Network Interface. Between
them, these cover the same range of functions as the seven
layers of the OSI Model.

Ping | Packet InterNet Groper The OSI Model: An Overview

At this stage, hopefully all of the theory has made The OSI (Open Systems Interconnection) Model
sense and you now understand the basic models is a standardised model which we use to
behind computer networking. demonstrate the theory behind computer
networking. In practice, it's actually the more
compact TCP/IP model that real-world
networking is based off; however the OSI model,
in many ways, is easier to get an initial
understanding from.
WHOIS
WHOIS is a query and response protocol that is widely
used for querying databases that store the registered users
or assignees of an Internet resource, such as a domain
name, an IP address block or an autonomous system, but
is also used for a wider range of other information.

[Link]
[Link] Contact Us : +917477466951
 Open Systems Interconnection (OSI) Model

Application Layer
The application layer of the OSI model essentially provides
networking options to programs running on a computer.

Presentation Layer
The presentation layer receives data from the application layer.

Session Layer
When the session layer receives the correctly formatted data from
the presentation layer, it looks to see if it can set up a connection
with the other computer across the network.

Transport Layer
The transport layer is a very interesting layer that serves numerous
important functions. Its first purpose is to choose the protocol over
Data Link Layer
which the data is to be transmitted.
The data link layer focuses on the physical addressing of the
transmission. Network Layer
The network layer is responsible for locating the destination of your
request. For example, the Internet is a huge network; when you
Physical Layer want to request information from a webpage,
The physical layer is right down to the hardware of the computer.
This is where the electrical pulses that make up data transfer over
a network are sent and received.
 CIA Model | Information Security
Confidentiality,
Integrity, The Common Information Model is an open standard that defines how managed
elements in an IT environment are represented as a common set of objects and
Availability relationships between them.

Confidentiality

Integrity

Availability
 Surface Web, Deep Web and Dark Web

The Surface Web

D A
is what users access in their regular day-to-day
activity. It is available to the general public using
standard search engines and can be accessed
using standard web browsers that do not require
any special configuration, such as Mozilla Firefox,
Microsoft’s Internet Explorer or Edge, and Google
R K
Chrome.

The Deep Web

The Dark Web
Get a modern PowerPoint Presentation that is
beautifully designed. I hope and I believe that is a less accessible subset of the Deep Web that relies on connections
this Template will your Time, Money and made between trusted peers and requires specialized software, tools, or
Reputation. equipment to access. Two popular tools for this are Tor and I2P. These
tools are commonly known for providing user anonymity. Once logged
into Tor or I2P the most direct way to find pages on the Dark Web is to
receive a link to the page from someone who already knows about the
page. The Dark Web is well known due to media reporting on illicit
activity that occurs there.
N e t w o r k T o p o l o g y (B us , R i ng, St a r, M es h, T re e , Hy b ri d )

MESH Network BUS Network TREE Network RING Network HYBRID Network STAR Network
topology topology topology topology topology topology

[Link]
[Link]/room/intr
otolan
Web Fundamentals
Introduction and objectives
We'll cover HTTP requests and responses, web
servers, cookies and then put them all to use in a mini
Capture the Flag at the end.

Finding the server

Initially, a DNS request is made. DNS is like Requests
a giant phone book that takes a URL (Like There are 9 different HTTP "verbs", also
[Link] and turns it into an known as methods. Each one has a different
IP address. This means that people don’t function. We've mentioned GET requests
have to remember IP addresses for their already, these are used to retrieve content.
favourite websites. POST : POST requests are used to send
data to a web server, like adding a comment
or performing a login.
Responses
The server should reply with a response. Cookies
The response follows a similar structure
Cookies are small bits of data that are
to the request, but the first line describes
stored in your browser. Each browser will
the status rather than a verb and a path.
store them separately, so cookies in
The status will normally be a code, you're
Chrome won't be available in Firefox. They
probably already familiar with 404: Not
have a huge number of uses, but the most
found.
common are either session management
or advertising (tracking cookies). Cookies
[Link] are normally sent with every HTTP request
made to a server.
 Intrusion Detection System (IDS)
Firewall Intrusion Detection System (IDS)
An intrusion detection system is a passive
Honeypots monitoring solution for detecting
cybersecurity threats to an organization. If a
Intrusion Prevention potential intrusion is detected, the IDS
generates an alert that notifies security
System (IPS) personnel to investigate the incident and take
remediative action.

Firewall
In computing, a firewall is a network security
Intrusion Prevention System (IPS)
system that monitors and controls incoming
An intrusion prevention system (IPS) is an and outgoing network traffic based on
active protection system. Like the IDS, it predetermined security rules. A firewall
attempts to identify potential threats based upon typically establishes a barrier between a
monitoring features of a protected host or trusted network and an untrusted network,
network and can use signature, anomaly, or such as the Internet.
hybrid detection methods.

Honeypots
In computer terminology, a honeypot is
a computer security mechanism set to
detect, deflect, or, in some manner,
counteract attempts at unauthorized
use of information systems.
 Honeypots Setup
Network Security
Detection Hacking Attack
In computer terminology, a honeypot is a computer
security mechanism set to detect, deflect, or, in some
manner, counteract attempts at unauthorized use of
information systems.

Pentbox 1.8 | Github

 F u n d a m e n t a l s o f Linux
O p e n S o u r c e OS

Linux
Penetration
Testing OS
Linux is a family of open-source
H a c k e r ’s L i n u x Unix-like operating systems based
on the Linux kernel, an operating
system kernel first released on
Kali Linux September 17, 1991, by Linus
Torvalds. Linux is typically
packaged in a Linux distribution.
Parrot Security

Backbox Linux
 Foot printing and Information
Gathering
There are two types of Foot printing that can be used: active Foot printing and passive Foot printing. Active Foot
printing is the process of using tools and techniques, such as performing a ping sweep or using the traceroute
command, to gather information on a target.

Active Footprinting Passive Footprinting

Active footprinting means to Passive foot printing means
perform footprinting by collecting information of a
getting in direct touch with system located at a remote
the target machine. distance from the attacker.
 Foot printing and Information
01
Whois Look Gathering
WHOIS is a query and
05 Wayback Machine
The Wayback Machine is a
response protocol that is widely Mirroring Websites
used for querying databases
03 digital archive of the World
It allows you to download a World Wide Web, founded by the
that store the registered users Internet Archive, a nonprofit
or assignees of an Internet Wide Web site from the Internet
to a local directory. library based in San Francisco.
resource, such as a domain It allows the user to go “back in
name, an IP address block or time” and see what websites
an autonomous system, but is looked like in the past
also used for a wider range of
other information.

Whois Look Mirroring Websites Wayback Machine

Wappalyzer Google Dork Shodan

06 Shodan
02 Wappalyzer
Shodan is a search engine
Identify web technologies Wappalyzer 04 Google Dork that lets the user find specific
is a technology profiler that shows you types of computers
what websites are built with. Find out Google hacking, also named
Google Dorking, is a hacker connected to the internet
what CMS a website is using, as well using a variety of filters.
as any framework, ecommerce technique that uses Google
Search and other Google Some have also described it
platform, JavaScript libraries and many as a search engine of service
more. applications to find security
holes in the configuration and banners, which are metadata
computer code that websites that the server sends back to
are using. the client.
 Foot printing and Information
01
Gathering
Subdomain Enumeration
Subdomain enumeration is the
05 Ping
A ping is a Command Prompt
process of finding valid (resolvable) CMS Enumeration command that can be used to test a
subdomains for one or more
03
connection between one computer
domain(s). Unless the DNS server CMSmap is a python open source
and another. Think of it in terms of
exposes a full DNS zone (via CMS scanner that automates the
sonar on a submarine. ... When the
AFXR), it is really hard to obtain a process of detecting security flaws of
ping strikes a nearby object, it will
list of existing subdomains. The the most popular CMSs. The main
echo back. Operators can
common practice is to use a purpose of CMSmap is to integrate
determine an object's distance by
dictionary of common names,trying common vulnerabilities for different
the length of time it takes to return
to resolve them types of CMSs in a single tool.
the echo.

Subdomain CMS Enumeration Ping

Enumeration
Tracert Eavesdropping Email Tracking

06 Shodan
02 Tracert
Email tracking service that
In computing, traceroute and tracert 04 Eavesdropping tracks email you sent. Sends
are computer network diagnostic you notification
commands for displaying possible Attacker tries to record
personal conversation of the when email gets opened, find
routes and measuring transit delays of out when & where recipients
packets across an Internet Protocol target victim with someone
that’s being held over read your emails.
network. [Link]
communication mediums like
Telephone.

[Link] Contact Us : +917477466951

 Google Dork
intitle: which finds strings in the title of a page

info:which displays summary information

allintext:which finds all terms in the title of a page
about a page

inurl:which finds strings in the URL of a page

Simple PowerPoint Presentation

site:which restricts a search to a particular site

or domain

filetype:which finds specific types of files (doc,

pdf, mp3 etc)

Exploit-DB
link:which searches for all links to a site or URL

cache:which displays Google’s cached copy

of a page
 Scanning Networks
Network scanning helps to detect all the active hosts on a network and maps
them to their IP addresses. Network scanners send a packet or ping to every possible IP
address and wait for a response to determine the status of the applications or devices (hosts)

Types of Network Scanning

A port scanner is an application designed to probe a server or host for open
ports. Such an application may be used by administrators to verify security
Port scanning policies of their networks and by attackers to identify network services
running on a host and exploit vulnerabilities.

Network scanning refers to the use of a computer network to gather

information regarding computing systems. Network scanning is mainly used
Network scanning for security assessment, system maintenance, and also for performing
attacks by hackers. ... Recognize filtering systems between the user and the
targeted hosts.

Nmap is a free and open-source network scanner created by Gordon Lyon.

Nmap is used to discover hosts and services on a computer network by
Nmap Scanner sending packets and analyzing the responses. Nmap provides a number of
features for probing computer networks, including host discovery and service
and operating system detection.

[Link] Contact Us : +917477466951

 Nmap: the Network Mapper Security Scanner
Nmap provides a number of features for probing computer networks, including host discovery and service
and operating system detection.

Open-source Network Nmap Posts Scanning Nmap Host Scanning

A port scanner is an application designed to One of the very first steps in any
Scanner Created by probe a server or host for open ports.
attackers to identify network services
network reconnaissance mission is to
reduce a (sometimes huge) set of IP
Gordon Lyon running on a host and exploit vulnerabilities.
nmap -p- [Link]
ranges into a list of active or
interesting hosts nmap [Link]

Nmap Version Scanning

Detecting Service and Application Versions Nmap OS Scanning
By default, Nmap identifies open ports on OS scanning is one of the most
the target host and correlates those port powerful features of Nmap. information
numbers with common services associated on the OS (and version) of a host.
with those ports, nmap -[Link] nmap -O [Link]

Nmap verbosity Scanning Nmap Timing Template to level 5

Fortunately, Nmap developers allow While the fine-grained timing controls
us to quickly and easily retrieve discussed in the previous section are
information about a scan while it's powerful and effective, some people
running, by starting the scan with find them confusing. nmap –T5 [Link]
increased verbosity.
nmap -v [Link]

[Link] Contact Us : +917477466951

 Vulnerability Analysis
Nikto Web Server Scanner
Nikto is a free software command-line vulnerability scanner that scans
webservers for dangerous files/CGIs, outdated server software and other
problems. It performs generic and server type specific checks. It also captures
and prints any cookies received. 01
Nmap Vulnerability
WpScan
WPScan is an open source WordPress security scanner. You can use it to scan A vulnerability assessmentis
your WordPress website the process of identifying,
quantifying, and prioritizing
02 06 the vulnerabilities in a
Nmap Security Scanner system.
Nmap is a free and open-source network scanner created by Gordon Lyon. WpScan Option
Nmap is used to discover hosts and services on a computer network by sending
packets and analyzing the responses. Nmap provides a number of features for
probing computer networks, including host discovery and service and operating
system detection. 03
Acunetix
Vega Vulnerability Scanner
SPARTA is a python GUI application that simplifies network infrastructure
penetration testing by aiding the penetration tester in the scanning and enumeration 05
phase. Vega
Scanner
Acunetix Web Vulnerability Scanner
Acunetix is an application security testing solution for securing your websites,web
applications, andAPIs
 Vulnerability Analysis
OWASP Zed Scanner
OWASP ZAP is an open-source web application security scanner. It is intended
to be used by both those new to application security as well as professional
penetration testers. It is one of the most active Open Web Application Security
Project projects and has been given Flagship status. 01
OWASP Zed Vulnerability
Burp Suite Scanner
Scanner
Burp Scanner automates the task of scanning web sites for content and A vulnerability assessmentis
vulnerabilities. the process of identifying,
quantifying, and prioritizing
02 04 the vulnerabilities in a
system.
Burp Suite Option

03

)

[Link] Contact Us : +917477466951

 Website Hacking
Brute Force
Cross-Site Scripting (XSS) In cryptography, a brute-force attack consists of an attacker submitting many
Cross-site scripting is a type of security vulnerability passwords or passphrases with the hope of eventually guessing correctly. The
typically found in web applications. XSS attacks attacker systematically checks all possible passwords and passphrases until the
enable attackers to inject client-side scripts into web correct one is found.
pages viewed by other users. Across-site scripting
vulnerability may be used by attackers to bypass Clickjacking
access controls such as the same-originpolicy.
Clickjacking is a malicious technique of tricking a user
into clicking on something different from what the
user perceives, thus potentially revealing confidential
information or allowing others to take control of their
Command Injection
computer while clicking on seemingly innocuous
Command injection is a cyber attack that involves objects, including web pages.
executing arbitrary commands on a host operating system
(OS). Typically, the threat actor injects the commands by
exploiting an application vulnerability, such as insufficient SQL Injection
input validation. SQL injection is a code injection technique used to
attack data-driven applications, in which malicious
SQL statements are inserted into an entry fieldfor
Server-side request forgery (SSRF) execution.
Cross site request forgery (CSRF)
In this section, we'll explain what server-side
request forgery is, describe some common Cross site request forgery (CSRF), also known as XSRF, Sea
examples, and explain how to find and exploit Surf or Session Riding, is an attack vector that tricks a web
various kinds of SSRF vulnerabilities. browser into executing an unwanted action in an application
to which a user is logged in. A successful CSRF attack can
be devastating for both the business and user.
[Link] Contact Us : +917477466951
 System Hacking
Windows Remote Hacking (RAT) Bypass Windows Login
The Remote Access Trojan (RAT) can Password
almost be considered the “legacy” tool Reset Administrator & User
of hackers. The RAT is a malware program Passwords on Any Windows without
that uses a back door for administrative Reformatting or Reinstalling System.
control over the targeted computer. 100% Success Rate!

Recover ZIP Files, PDF

Cookie Stealing Attack
Many times, forgetting administrator password
You can simply impress your audience is a big headache for users, if you don't have
and add a unique zing and appeal to your reset disk or another admin account, in such
Presentations. Easy to change colors, situation, the only thing you can do is reformat
photos and Text. Get a modern your hard drive or re-install your windows
system, but this would cause the loss of all data
PowerPoint Presentation that is
or computer crashed, it's not an ideal solution
beautifully designed.

[Link] Contact Us : +917477466951

 System Hacking
Keylogger System Hacking File Extension Spoofer
Keystroke logging, often referred to as keylogging
More advanced users know that to run an
or keyboard capturing, is the action of recording
exe in Windows its necessary to use the
the keys struck on a keyboard, typically covertly,
file extension “.exe”. If a malware
so that a person using the keyboard is unaware
developer wanted to distribute a file that
that their actions are being monitored. Data can
was still executable but looked like a pdf it
then be retrieved by the person operating the
would still have to be called something
logging program.

Virus Creating
USB To System Hacking A computer virus is a type of computer program
Hacker Hack System Data Using usb that, when executed, replicates itself by
Device modifying other computer programs and
inserting its own code. If this replication
succeeds, the affected areas are then said to be
"infected" with a computer virus. Computer
viruses generally require a host program

[Link] Contact Us : +917477466951

 Android Device Hacking
Android Hacker Keylogger
Android Remote Hacking Keystroke logging, often referred to as
The Remote Access Trojan (RAT) can almostbe keylogging or keyboard capturing, is the action of
considered the “legacy” tool of hackers. recording the keys struck on a keyboard, typically
The RAT is a malware program that uses a back covertly, so that a person using the keyboard is
door for administrative control over the targeted unaware that their actions are being monitored.
computer. Data can then be retrieved by the person
operating the logging program.

Coming soon
Network Scanning …
Network scanning refers to the use of a
computer network to gather information regarding
computing systems. Network scanning is mainly
used for security assessment, system
maintenance, and also for performing attacks by
hackers.

[Link] Contact Us : +917477466951

Android Hacking Termux Course
Turmux
Termux is an Android terminal emulator and Linux environment app that works directly with no rooting or setup
required. A minimal base system is installed automatically - additional packages are available using the APT
package manager.

Topic

Install and Setup Turmux Install Script And Tools Github Learning Hacking commend
 Hacking Wireless Networks
What Is WPS
WIFI Hacking
Wi-Fi Protected Setup (WPS) is a
WIFI Hacking Using WPS Security
feature supplied with many routers.
you can use to find out if your
It is designed to make the process
access point is vulnerable to WPS
of connecting to a secure wireless
protocol. As usual, the application
network from a computer or other
lets you carry out this check on any
device easier.
network, but it’s recommended to
use it exclusively on your own.

WIFI NETCUT | Network Hacking

Netcut, invented by [Link], is a WIFI Jamming | WIFI DOSS

tool that protects and manages your blocking or interference with
private network. This tool works by wireless communications. In some
tracking and manipulating the MAC cases jammers work by the
Addresses that are connected to the transmission of radio signals that
network. disrupt communications by
decreasing the signal-to-noise ratio.
The concept can be used in wireless
data networks to disrupt information
WiFi Hacking | WIFI Phishing flow.

Wifiphisher is a rogue Access Point

framework for conducting red team
engagements or Wi-Fi security
testing.
 WEB PENETRATION Testing

Firewall
In computing, a firewall is a network security Use HTTPS
system that monitors and controls incoming As a consumer, you may already know
and outgoing network traffic based on to always look for the green lock image
predetermined security rules. A firewall and https in your browser bar any time
typically establishes a barrier between a you provide sensitive information to a
trusted network and an untrusted network, website.
such as the Internet.

Website
Security
Up-To-Date Topic Don’t help the hackers
Using a CMS with various useful plugins and look out for phishing emails and other
extensions offers a lot of benefits, but it also brings scams.
risk. The leading cause of website infections is
vulnerabilities in a content management system’s
extensible components.
 Basic SSRF against the local server
01  Why do applications behave in this way, and implicitly trust requests
that come from the local machine? This can arise for various reasons:

Basic SSRF against another back-end system

02  It is common to see applications containing SSRF behavior together
with defenses aimed at preventing malicious exploitation. Often, these
defenses can be circumvented.

SSRF with blacklist-based input filter

Server-Side
Request Forgery 03  Some applications only allow input that matches, begins with, or contains,
a whitelist of permitted values. In this situation, you can sometimes
circumvent the filter by exploiting inconsistencies in URLparsing.

SSRF with whitelist-based input filter

04  Some applications only allow input that matches, begins with, or contains,
a whitelist of permitted values. In this situation, you can sometimes
circumvent the filter by exploiting inconsistencies in URLparsing.
Server-side request forgery (also known as SSRF) is a web security
vulnerability that allows an attacker to induce the server-side application to Bypassing SSRF filters via open redirection

05
make HTTP requests to an arbitrary domain of the attacker's [Link] a
typical SSRF attack, the attacker might cause the server to make a  It is sometimes possible to circumvent any kind of filter-based defenses
connection to internal-only services within the organization's infrastructure. by exploiting an open redirection vulnerability.
In other cases, they may be able to force the server to connect to arbitrary
external systems, potentially leaking sensitive data such as authorization
credentials.
 Excessive trust in client-side controls
01  Why do applications behave in this way, and implicitly trust requests
that come from the local machine? This can arise for various reasons:

High-level logic vulnerability

02  It is common to see applications containing SSRF behavior together
with defenses aimed at preventing malicious exploitation. Often, these
defenses can be circumvented.

Business logic
Price Tampering Vulnerabilities
Vulnerabilities In this section, we'll introduce the concept of business logic vulnerabilities and
Hence, web parameter tampering attack is possible by manipulating the price using explain how they can arise due to flawed assumptions about user behavior. We'll
a simple web proxy tool (Tamper data, burpsuite etc.) or by editing the amount discuss the potential impact of logic flaws and teach you how they can be
using the browser's web inspector tool. Notice the form field called price, which is exploited. You can also practice what you've learned using our interactive labs,
flagged as hidden. which are based on real bugs that we've encountered in the wild. Finally, we'll
provide some general best practices to help you prevent these kinds of logic
flaws arising in your own applications.
 IDOR examples
01  There are many examples of access control vulnerabilities where
user-controlled parameter values are used to access resources or
functions directly.

IDOR vulnerability with direct reference to

02 database objects
 Consider a website that uses the following URL to access the customer
account page, by retrieving information from the back-end
database:[Link]
[Link]/customer_account?customer_number=132355Here, the
customer number is used directly as a record index in queries that are
performed on the back-end database.
 If no other controls are in place, an attacker can simply modify the
customer_number value, bypassing access controls to view the records of
Insecure Direct Object other customers. This is an example of an IDOR vulnerability leading to
horizontal privilege [Link] attacker might be able to perform
References (IDOR) horizontal and vertical privilege escalation by altering the user to one with
additional privileges while bypassing access controls. Other possibilities
include exploiting password leakage or modifying parameters once the
 Insecure direct object references (IDOR) are a type of access control attacker has landed in the user's accounts page, forexample.
vulnerability that arises when an application uses user-supplied input to
access objects directly. The term IDOR was popularized by its
appearance in the OWASP 2007 Top Ten. However, it is just one
example of many access control implementation mistakes that can lead
to access controls being circumvented. IDOR vulnerabilities are most
commonly associated with horizontal privilege escalation, but they can
also arise in relation to vertical privilege escalation.
 How does XSS work?
01  Cross-site scripting works by manipulating a vulnerable web site so
that it returns malicious JavaScript to users. When the maliciouscode
executes inside a victim's browser, the attacker can fully compromise
their interaction with the application.

XSS proof of concept

02  You can confirm most kinds of XSS vulnerability by injecting a payload
that causes your own browser to execute some arbitrary JavaScript.
It's long been common practice to use the alert() function for this
purpose because it's short, harmless, and pretty hard to miss whenit's
successfully called. In fact, you solve the majority of our XSS labs by
invoking alert() in a simulated victim's browser.
 Unfortunately, there's a slight hitch if you use Chrome. From version
92 onward (July 20th, 2021), cross-origin iframes are prevented from
calling alert(). As these are used to construct some of the more
advanced XSS attacks, you'll sometimes need to use an alternative
PoC payload. In this scenario, we recommend the print() function. If
Cross Site you're interested in learning more about this change and why we like
print(),
Scripting (XSS)?  As the simulated victim in our labs uses Chrome, we've amended the
Hence, web parameter tampering attack is possible by manipulating the price affected labs so that they can also be solved using print(). We've
using a simple web proxy tool (Tamper data, burpsuite etc.) or by editing the indicated this in the instructions wherever relevant.
amount using the browser's web inspector tool. Notice the form field called price,
which is flagged as hidden.
 Reflected cross-site scripting
01 Reflected XSS is the simplest variety of cross-site scripting. It arises
when an application receives data in an HTTP request and includes that
data within the immediate response in an unsafe way.

Stored cross-site scripting

02 The data in question might be submitted to the application via HTTP
requests; for example, comments on a blog post, user nicknames in a chat
room, or contact details on a customer order. In other cases, the data
might arrive from other untrusted sources;..

DOM-based cross-site scripting

02  In the following example, an application uses some JavaScript to read
the value from an input field and write that value to an element within
the
HTML:

What are the types

of XSS attacks?
 Reflected XSS, where the malicious script comes from the current HTTP
request.
 Stored XSS, where the malicious script comes from the website's
database.
 DOM-based XSS, where the vulnerability exists in client-side code rather
than server-side code.