.:: Dark Site ::.

Hi friends,its been long time since i have't posted some thing so here is some thing that will help you for sure.There are many people out there/students who ask me lot of time i want to learn this security stuff from where i should start. 
 
again let me clearly tell you this web site contains many link pick any one that will be help full to you.now i am making some structured urls from which you can easily learn many things .remember these are all for technical purpose only :). 
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgz4qjw9odYn-k6lOCSsH_g0v9c8Nc0Vhe8l7-6tZumiI1rkrzhiJjZVTHlFjgQL4tXcWkTAcQaIeJ326-xadfadlDLmoQ4NaeVof6Z8Yqf3za_HcZM9Imf8lLTtlCRF1pDer22964r0bXn/s1600/Beginner.jpg" imageanchor="1" ><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgz4qjw9odYn-k6lOCSsH_g0v9c8Nc0Vhe8l7-6tZumiI1rkrzhiJjZVTHlFjgQL4tXcWkTAcQaIeJ326-xadfadlDLmoQ4NaeVof6Z8Yqf3za_HcZM9Imf8lLTtlCRF1pDer22964r0bXn/s320/Beginner.jpg" /></a> 
so here we go for Web application security part. 
Learn the fundamental/primary attacks. 
 
-XSS(cross site scripting ) 
 
<li>Beginners tutorial on XSS :<a href="http://excess-xss.com/">See this link</a> 
<li>Google XSS learning Tutorials: <a href="https://www.google.com/about/appsecurity/learning/xss/">See this link</a> 
<li>Advance attacks bypass XSS Filters/IDS:<a href="https://www.blackhat.com/presentations/bh-usa-09/VELANAVA/BHUSA09-VelaNava-FavoriteXSS-SLIDES.pdf">See this book</a> 
 
-CSRF(Cross Site request Forgery) 
 
Many beginner find this slight difficult to understand so here below link for simple explanation. 
<li>How to find CSRF and Preventing <a href="http://blackhat.com/presentations/bh-usa-06/BH-US-06-Gallagher.pdf">Download this book</a> 
<li>exploiting/attacking with CSRF Vulnerability <a href="http://tipstrickshack.blogspot.com/2012/10/how-to-exploit-csfr-vulnerabilitycsrf.html">See this link</a> 
 
 
-SQL Injection 
 
<li>Introduction to SQL Injection error based sqli: <a href="https://prakharprasad.com/introduction-to-sql-injection-and-exploitation-mysql-5-error-based/">See this link</a> 
<li>MSSQL Injection Complete Tutorial- <a href="https://www.exploit-db.com/papers/12975/">See this link</a> 
<li>Everything you wanted to know about SQL injection - <a href="http://www.troyhunt.com/2013/07/everything-you-wanted-to-know-about-sql.html">See this link</a> 
 
 
Remote Code/Command Execution 
 
<li>How to find RCE in scripts (with examples)- <a href="https://www.exploit-db.com/papers/12885/">See this link</a> 
<li>Yahoo vulnerability LFI Converted to RCE (patched)- <a href="https://soroush.secproject.com/blog/2013/10/yahoo-bug-bounty-program-lfi-reported-and-patched/">See this link</a> 
<li>Remote Code Execution in Elasticsearch - CVE-2015-1427 Deep research <a href="http://jordan-wright.com/blog/2015/03/08/elasticsearch-rce-vulnerability-cve-2015-1427/">See this link</a> 
 
XML external entity attack 
 
<li>How to detect XXE - <a href="http://www.christian-schneider.net/GenericXxeDetection.html">See this link</a> 
<li>XML Out-Of-Band Data Retrieval research Black Hat 2013 - <a href="https://media.blackhat.com/eu-13/briefings/Osipov/bh-eu-13-XML-data-osipov-slides.pdf">Download PDF</a> 
<li>SSRF vs. Business-critical applications: XXE tunneling in SAP - <a href="https://erpscan.com/wp-content/uploads/publications/SSRF-vs-Businness-critical-applications-final-edit.pdf">Download PDF</a> 
<li>What you didn’t know about XXE -<a href="http://2013.appsecusa.org/2013/wp-content/uploads/2013/12/WhatYouDidntKnowAboutXXEAttacks.pdf"> Download PDF</a> 
 
Other few popular attacks on web application 
 
<li>Server side request forgery Attacks - <a href="http://www.slideshare.net/d0znpp/ssrf-attacks-and-sockets-smorgasbord-of-vulnerabilities">Slides</a> 
<li>Cross Site Port Attacks - <a href="http://ibreak.software/2013/05/10/xspa-ssrf-bug-with-facebooks-developer-web-application/">BY Riyaz</a> 
<li>Hunting for Top Bounties - <a href="https://www.youtube.com/watch?v=mQjTgDuLsp4">YouTube link</a> 
<li>How to steal and modify data using Business Logic flaws - <a href="http://www.slideshare.net/fransrosen/how-to-steal-and-modify-data-using-business-logic-flaws-insecure-direct-object-references">Slides Security for developers</a> 
<li>Exploiting CVE-2011-2461 on google.com - <a href="http://blog.mindedsecurity.com/2015/03/exploiting-cve-2011-2461-on-googlecom.html">See the link</a> 
<li><a href="https://pentesterlab.com/exercises/">PentesterLab</a> - - PentesterLab provides vulnerable systems that can be used to test and understand vulnerabilities. (thanks @n0x00) 
<li>InjectX to find XSS - <a href="https://forum.bugcrowd.com/t/tutorial-injectx-to-find-xss/790">See the link</a> thanks @1N3 
 
Of Course there exist bugs in mobile application too so if you are interested on that you will definitely find the link more likable 
 
Android Security learning 
 
<li>Debugging Java Applications Using JDB - <a href="http://www.androidpentesting.com/2014/12/debugging-java-applications-using-jdb.html">See the link to learn</a> 
<li>Learn android security testing - <a href="http://resources.infosecinstitute.com/author/srinivas/">From Srinivas</a> 
 
iOS application testing 
 
<li>Setting Up a Mobile Pentesting Platform - <a href="http://resources.infosecinstitute.com/ios-application-security-part-1-setting-up-a-mobile-pentesting-platform/">Infosec Link</a> 
<li>iOS Application Security -<a href="http://highaltitudehacks.com/">By Prateek Gianchandani</a> 
 
For Advance security researchers you can follow the<a href="https://www.vulnhub.com/"> VULNHUB </a> It s grate source of learning. 
 
Another important website for learning is infosecinstitute that is great place for all type of learner. 
<a href="http://resources.infosecinstitute.com/articles/">Security Articles</a> 
<a href="http://resources.infosecinstitute.com/ebooks/">Security ebook</a> 
<a href="http://resources.infosecinstitute.com/labs/">Lab For practice </a> 
 
Please do comment if you have more useful link and thanks have a nice day keep learning :)

Learning Security Testing : For Beginners

Hi friends,its been long time since i have't posted some thing so here is some thing that will help you for sure.There are many people o...

Learning Security Testing : For Beginners

Popular Posts

Blog Archive