Resources and tools that will help you in your day to day activities by Vignesh

This is my first article in an international arena. Basically, from my web application testing background, I will share a few lists of resources and tools that will help you in your day to day activities.

There are three basic types of pentesters:

• Testers who just blindly follow the tools

• Testers who follow the tools according to the requirements and concepts

• Testers who write the tools and scripts

The resources in this article will mostly pertain to the second category of testers.

Let’s discuss a few important tools here and some tips related to them. Before starting, here are a few brief rules for beginners that need to be considered while testing:

• Never trust automated scanner’s output as it might contain false positives

• Test thoroughly for each and every endpoint

• Always manually fuzz the application, not with automated fuzzers

• Never brute-force or social engineer the webserver

• Learn about OWASP top 10 vulnerabilities, which is the common standard for everything

• If you are looking for a methodology that you can follow, you can look at the OSTTM, which will guide you with a step by step approach

Training:

I want to learn but I don’t know where to start. If this is your first thought, follow the instructions or some short tips:

• Start with Google bug bounty university guide where they will provide you with enormous ways to test

• You can read the OWASP testing guide https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents for a basic list of tests and training

• Look for some YouTube channels or security blogs that you can follow

Resources:

Some books and valuable resources that a web application pentester shouldn't miss are:

• The Web Application Hacker's Handbook: Discovering and Exploiting Security Flaws, 1st Edition

• The Tangled Web by Michal Zalewski

• Ross Anderson's Security Engineering

• Writing Secure Code v2 from MS Press

• Hacking: The Next Generation.

Some Black Box Testing Tools:

If you need to know about some tools that exist in the market, the OWASP has a list here: https://www.owasp.org/index.php/Appendix_A:_Testing_Tools

Bug Bounty Platforms:

• Hackerone

• BugCrowd

• Synack

• Cobalt.io

Practice Sites:

• DVWA application

• Acunterix test sites

• HackThisSite

Some Bookmarks:

For future reference, you can download or import this bookmark list which will be helpful in following up issues:

• https://github.com/kurobeats/pentest-bookmarks/blob/master/BookmarksList.md

• https://github.com/jhaddix/pentest-bookmarks/blob/master/wiki/BookmarksList.wiki

• https://code.google.com/archive/p/pentest-bookmarks/downloads

• http://www.getmantra.com/hackery/

Cheat Sheets:

During pentesting, you will come across a lot of things to test. In order to assist you, the following cheat sheets may help you during testing. These are the three most common types of cheat sheets:

1) XSS

• https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet

• https://html5sec.org/

• https://www.blackhat.com/presentations/bh-usa-09/VELANAVA/BHUSA09-VelaNava-FavoriteXSS-SLIDES.pdf

• https://gist.github.com/sseffa/11031135

• ha.ckers.org/xss.html

• http://code.google.com/p/fuzzdb/:

• http://packetstormsecurity.com/files/download/124419/WAF_Bypassing_By_RAFAYBALOCH.pdf

• https://docs.adobe.com/docs/en/cq/5-6-1/developing/securitychecklist/_jcr_content/par/download/file.res/xss_cheat_sheet.pdf

• http://brutelogic.com.br/blog/cheat-sheet/

• http://codev587.net/xss-filter-evasion-cheat-sheet-no1.html

2) SQL Injection

• http://pentestmonkey.net/cheat-sheet/sql-injection/mysql-sql-injection-cheat-sheet
• https://www.netsparker.com/blog/web-security/sql-injection-cheat-sheet/
• http://www.sqlinjectionwiki.com/Categories/2/mysql-sql-injection-cheat-sheet/
• https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
• https://www.owasp.org/index.php/Testing_for_SQL_Injection_%28OTG-INPVAL-005%29
• https://www.exploit-db.com/papers/13650/
• http://www.veracode.com/security/sql-injection
• https://information.rapid7.com/rs/rapid7/images/R7%20SQL_Injection_Cheat_Sheet.v1.pdf
• http://resources.infosecinstitute.com/sql-injection-cheat-sheet/

3) Command Injection

• https://www.owasp.org/index.php/Command_Injection

• https://repo.zenk-security.com/Techniques%20d.attaques%20%20.%20%20Failles/Injection%20non-sql%20Cheat%20Sheet.pdf

• https://www.checkmarx.com/knowledge/knowledgebase/OS-Command_Injection

• https://www.blackhat.com/docs/eu-15/materials/eu-15-Stasinopoulos-Commix-Detecting-And-Exploiting-Command-Injection-Flaws-wp.pdf

• https://www.blackhat.com/presentations/bh-dc-10/Bannedit/BlackHat-DC-2010-Bannedit-Advanced-Command-Injection-Exploitation-1-slides.pdf

• http://thehackpot.blogspot.in/2014/05/blind-os-command-injection-attacks.html

• http://pentestmonkey.net/tag/cheatsheet

YouTube Channels:

• https://www.youtube.com/user/Hak5Darren

• https://www.youtube.com/user/DEFCONConference

• https://www.youtube.com/user/BlackHatOfficialYT

• https://www.youtube.com/user/JackkTutorials

• https://www.youtube.com/user/DonDoes30

Tools:

Although there are a lot of tools in the market for testing, I hereby present some of the tools that might help you in your day to day life:

• http://tools.kali.org/tools-listing

• http://cyborg.ztrela.com/tools/

• https://github.com/mre/awesome-static-analysis

• https://github.com/enaqx/awesome-pentest

I hope I covered some of the basic resources that will help my fellow testers for day to day usage. In the future, if I get a chance, I will come back with another set of helpful links.

---

Author: blueberry-Vignesh4303

Google VRP, Pentester by profession ,bug bounty hunter whom spends main time at analysing web and malware.