Ethical Hacking 101

-

In today's digital landscape, software security is paramount. To safeguard applications from cyber attacks, developers must embrace Ethical Hacking—an innovative approach that empowers them to uncover vulnerabilities and strengthen security measures.

Ethical Hacking involves adopting the mindset of malicious hackers to identify weaknesses and fortify defences against unauthorised access, data breaches, and other threats. By integrating this practice into the coding process, developers gain valuable insights, proactively mitigating risks and creating more robust and secure software systems. 

I took a basic lesson from Snyk about Ethical Hacking, which helps me consider security measures in coding. 

Process 

  • Plan & Prepare (Reconnaissance phase) 
  • Scan & Enumerate 
  • Exploit 
  • Analyse & Report
  • Communicate & Collaborate
  • Continuous Education & Professional Development 

Tools 

  • Nmap: network scanner 
  • Burp Suite: security testing of web applications 
  • Metasploit: penetration tests 
  • Wireshark: packet analyser 
  • Maltego: intelligence and forensics, graphical link analysis for real-time data mining. 
  • Snyk: scan, prioritize, and fix security vulnerabilities of codes 
  • John the Ripper: password cracking tool 
  • Wappalyzer: Find out what websites are built with 
  • Kali linux: for digital forensics and penetration testing 
  •  

Best Practices 

  • Obtain permissions before conducting any testing 
  • Follow all relevant laws and regulations 
  • Do not use tools or techniques that could cause damage or disruption 
  • Use a risk-based approach 
  • Document your findings and provide a report to the owner 

 

XSS (Cross-Site Scripting) 


Cross-Site Scripting attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites.


Example: Try to fill in 

[Totally Safe Link] 

(javascript&#58document;cookieStore.g et('super_secret_cookie'8#41;.then((e&# 

41; => 

{document.getElementsByClassName('v-text-field _slot'8#41; 

[1].childNodes[1].value='${e.namel = $ 

{e.value} 

*;document.getElementsByClassName('v 

-text-field slot'8#41; 

[1].childNodes [1].dispatchEvent(new 

Event ('input')8#41;;document.getEl ementsByClassName'v-text-field _slot'8#41; 

[1].nextElementSibling.childNodes[0].clic k(8#41;}8#41; 

 

Then conduct Prototype Pollution, says caused by lodash. See detail at https://github.com/Kirill89/prototype-pollution-explained/blob/master/README.md 

 

Path Traversal 


A path traversal attack (also known as directory traversal) aims to access files and directories that are stored outside the web root folder.


Example: Send a request like /82e82e/82e82e/82e82/8282/82e%2e/etc/passwd , due to some libraries like st@0.2.4 


Vulnerability Disclosure Program & Bug Bounty

  • Hackerone 
  • Bugcrowd 
  • Intigriti 
  • Promote responsible disclosure and incentivizing bug hunting 
  • Identify and address security weaknesses before they can be exploited by malicious actors 
  • Improve the overall security of software and systems 
  • Include scope and objectives, methodology, findings and vulnerabilities, risk assessment and severity ratings, and recommendations for mitigation 
  • Consider honesty, accuracy, confidentiality. and respect for 3rd-party agreement 

 

Resources 


Comments

Post a Comment

Popular posts from this blog

[Event] JManc (28th June 2024)

-
Image
My Sharing about JavaFX Attending JManc , an unconference organised by Manchester Java Community and hosted at Auto Trader 's offices, was an exciting experience. This unique event demonstrating the essence of participant-driven learning and collaboration, set the stage for a series of engaging and enlightening sessions. Propose and vote for topics In the morning, we proposed topics using sticky notes. Afterward, we voted on these topics with dots, shaping the day's agenda based on collective interest. This process itself was a testament to the community's diverse interests and expertise. Breakfast Keynote by Helen Scott Keynote by Helen Scott The unconference kicked off with a keynote by Helen Scott from JetBrains . Helen's talk centered on AI, a topic so crucial and timely that, as she humorously noted, audience would have thrown her out of the window if she did not speak of AI. Her insights into AI's impact on development and the future of programming set a tho...
Read more

Tales from Earthsea

-
Image
Recommendation: please read the original novel series Earthsea before you watch the movie (Japanese: ゲド戦記, meaning the Story of Ged's Battles), otherwise you'd sleep very well in the cinema. I left some comment about this movie in other blogs , here is its English translation: I don't think that the problem of the movie is the fault of the plot, because the director Goro Miyazaki (Japanese: 宮崎吾朗) is not the author of the novel and the novel is an award-winning piece. The problem is that he selected a wrong media to express his own vision. First of all, the novel is not popular in Chinese society. Few people would spend hours to finish the books before watching the movie. The director selected to start the movie by the third book of the series, however. It would make audiences lose their way. This is because much background information has been described in previous book, say Tenar's experience in The Tombs of Atuan. Unlike his father Hayao Miyazaki (Japanese: 宮崎駿) as t...
Read more

Real View Will

-
I am a HIP (hidden, inactive and passive) member. I had looked for any suitable activity, so I attended the gathering last Saturday. There were three guests to talk about investment in personnal opinions instead of standard words. This is the irreplaceable value of a private gathering. The first guest was a broker. He began with introduction of investment theories. In his opinion, investing in stock is like multi-level marketing. When a stock releases, an investor buys and introduces it to another. The second investors buys it and the stock price increases. And so on, until no following investor buys it to support the stock price and the price drops. This figure simply explained the relationship between the cash flow of the market and the stock price. The second guest was a reporter. Being a reporter, he has experienced many issues under table. He identified unstated relationships amongst various parties such as the authories, the academics, mass media, institutional investors and smal...
Read more