Ethical Hacking 101

-

In today's digital landscape, software security is paramount. To safeguard applications from cyber attacks, developers must embrace Ethical Hacking—an innovative approach that empowers them to uncover vulnerabilities and strengthen security measures.

Ethical Hacking involves adopting the mindset of malicious hackers to identify weaknesses and fortify defences against unauthorised access, data breaches, and other threats. By integrating this practice into the coding process, developers gain valuable insights, proactively mitigating risks and creating more robust and secure software systems. 

I took a basic lesson from Snyk about Ethical Hacking, which helps me consider security measures in coding. 

Process 

  • Plan & Prepare (Reconnaissance phase) 
  • Scan & Enumerate 
  • Exploit 
  • Analyse & Report
  • Communicate & Collaborate
  • Continuous Education & Professional Development 

Tools 

  • Nmap: network scanner 
  • Burp Suite: security testing of web applications 
  • Metasploit: penetration tests 
  • Wireshark: packet analyser 
  • Maltego: intelligence and forensics, graphical link analysis for real-time data mining. 
  • Snyk: scan, prioritize, and fix security vulnerabilities of codes 
  • John the Ripper: password cracking tool 
  • Wappalyzer: Find out what websites are built with 
  • Kali linux: for digital forensics and penetration testing 
  •  

Best Practices 

  • Obtain permissions before conducting any testing 
  • Follow all relevant laws and regulations 
  • Do not use tools or techniques that could cause damage or disruption 
  • Use a risk-based approach 
  • Document your findings and provide a report to the owner 

 

XSS (Cross-Site Scripting) 


Cross-Site Scripting attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites.


Example: Try to fill in 

[Totally Safe Link] 

(javascript&#58document;cookieStore.g et('super_secret_cookie'8#41;.then((e&# 

41; => 

{document.getElementsByClassName('v-text-field _slot'8#41; 

[1].childNodes[1].value='${e.namel = $ 

{e.value} 

*;document.getElementsByClassName('v 

-text-field slot'8#41; 

[1].childNodes [1].dispatchEvent(new 

Event ('input')8#41;;document.getEl ementsByClassName'v-text-field _slot'8#41; 

[1].nextElementSibling.childNodes[0].clic k(8#41;}8#41; 

 

Then conduct Prototype Pollution, says caused by lodash. See detail at https://github.com/Kirill89/prototype-pollution-explained/blob/master/README.md 

 

Path Traversal 


A path traversal attack (also known as directory traversal) aims to access files and directories that are stored outside the web root folder.


Example: Send a request like /82e82e/82e82e/82e82/8282/82e%2e/etc/passwd , due to some libraries like st@0.2.4 


Vulnerability Disclosure Program & Bug Bounty

  • Hackerone 
  • Bugcrowd 
  • Intigriti 
  • Promote responsible disclosure and incentivizing bug hunting 
  • Identify and address security weaknesses before they can be exploited by malicious actors 
  • Improve the overall security of software and systems 
  • Include scope and objectives, methodology, findings and vulnerabilities, risk assessment and severity ratings, and recommendations for mitigation 
  • Consider honesty, accuracy, confidentiality. and respect for 3rd-party agreement 

 

Resources 


Comments

Post a Comment

Popular posts from this blog

Event: Developer Productivity Engineering: What's in it for me?

-
Image
Manchester Java Community hosted another great session in Thoughtworks . The speaker is Trisha Gee , co-author of the renowned book Head First Java .  The speaker pointed out that the productivity of developers did not mainly come from individual developer themselves but from the organisation which offers productive environments or not. The factor includes work space size, quietness, privateness, any diversion or needless interruption. On technology side, productivity can be improved by consistency and reliability of builds. Very fast feedback can improve productivity and quality, thus increase revenue, reduce cost and improve brand. References: DEVELOPER PRODUCTIVITY ENGINEERING: WHAT’S IN IT FOR ME? The 2019 Tidelift managed open source survey results Peopleware: Productive Projects and Teams Software Productivity   The Goal: A Process of Ongoing Improvement Improve the Performance of Gradle Builds CI fanout Netflix Pursues Soft DevEx Goals with Hard DevProd Metrics using Test Distri
Read more

Mark Six Analyst

-
Open Source in the world of software is amazing. Developers share and distribute source codes with each other. SourceForge is one of the well-known platforms. I have registered my first Open Source project in SourceForge. The project is called Mark Six Analyst at https://sourceforge.net/projects/marksixanalyst/ . It is a simple tool to forecast the result of Hong Kong lottery or so-called Mark Six by various statistics methods. For the success of the project, I would like to thank Java, JavaDB (Apache Derby), Java Swing, Java Persistence API, TopLink, Hibernate Entity Manager, NetBeans and CsvReader. Because of them, developing a software application becomes rapidly quicker and the developed application becomes more stable and much easily maintained. Especially for Java Persistence API or called JPA, developers are less annoyed to handle entity EJBs and Object-Relational Mapping. It is helpful for developing an application with a database of complicated entity relationships. On the ot
Read more