Christophe
Forum Replies Created
-
Argh! When I re-uploaded the videos in higher-def, I accidentally paste in the wrong URL and didn’t notice. Please try now @qedpro10 !
https://cybr.com/courses/cross-site-scripting-xss-the-practical-guide/lessons/beef-hook/
-
Personally, I’d recommend that you work on applications that interest you. That’s one of the biggest factors in my consideration, because if it’s an app/project I’m interested in, I’m far more likely to stick to it than not, regardless of large or small scope
-
Just wanted to update here that the course is now officially fully uploaded!
-
Since a hashcat upgrade to v6.0.0+, running hashcat within a virtualized environment is giving errors. The best approach is to not run hashcat inside of Virtual Box or VMWare, and instead, to run it on your host machine. There will be fewer issues with drivers and access to more of your hardware that way.
-
Unfortunately, the recording software we were using stopped working partly through the episode, so Jayson’s audio did not record 🙁
This was jampacked full of awesome info, so I’m super bummed that this happened. Luckily, those who attended the live recording were able to hear it so it wasn’t a total loss.
Sorry, will work to make sure that doesn’t happen again!
-
hey! Yes, the course is live and in Early Preview. Early Preview means that a significant portion of the course has been uploaded, and I’ll continue to add content to it every week until it’s complete. So now is the best time to get the course because I discount it while it’s in Early Preview, and you get all updates!
-
Blind injections can be pretty tricky to pull off but they can also be quite rewarding. I’ve chatted with some bounty hunters who’ve been quite successful but who have never found a blind injection in the wild (mostly from not focusing on that much though I think)…so, could be a good area to focus on, but I’d expect a bit of a challenge!
-
Hey Anthony, a more in-depth OS Command Injection course is not currently on the roadmap since it’s more of a niche topic and I have not had many requests for it. But, pretty cool to see the addition of GraphQL injection support and the author of the tool has been friendly and responsive when we’ve chatted in the past, so I’m not saying never 🙂
-
Search bars can be a great place for reflected XSS, since they usually also change the URL as you search. So for example, say we had this search endpoint:
cybr.com/search/
When we’d type something in the search bar, we might see this happening to the URL:
cybr.com/search/?q=example search query
If you managed to find an XSS vulnerability through the search bar, and you could copy/paste the URL containing your payload, you could send it to a victim, and if they clicked on it, they’d trigger the XSS:
cybr.com/search/?q=<script>alert(1)</script>
-
Not sure that I’ve come across any data to directly answer your question, so I’d be curious to see some, but I have run across this from HackerOne (attached).
This image represents Year-Over-Year growth of the top ten vulnerabilities disclosed on their platform.
Source: https://www.hackerone.com/hacker-powered-security-report
-
I do think that upgrading to the professional edition of Burp can be a great investment. However, like with most other things, it will only be a great investment if you also invest in and dedicate time to learning how Burp works.
Burp does have some overlapping features with some of the automated scanners you’ve mentioned using in the past, but it doesn’t always mean it will completely replace them. Also, automated scanners are there as a tool you can use in addition to your other efforts. What I mean by that is buying Burp pro won’t magically reveal more bugs overnight but it will give you a tool that can help you explore an application, understand how requests are sent back and forth, and try stuff out by intercepting and replaying those requests.
Hope this helps and good luck!!
-
Fantastic! I can’t wait to see your progress reports and help you push forward. Will definitely be on the lookout for those!
-
Burp, sqlmap, and Commix serve very different purposes. Yes, Burp does have some tooling that can do scans for sqli or OS command injections, but sqlmap is dedicated to finding sqli and Commix is dedicated to finding OS command injections. Those tools were built for very specific purposes instead of trying to do everything under the sun.
This is a terrible analogy, but my brain is mush right now and I can’t think of a better one: it’s kind of like if you bought a weed eater and asked if you could cut your grass with it. Technically you could, but it’ll take longer and won’t look even or good at all. So instead, you go and get a tool dedicated to the task: a lawnmower. The lawnmower will do a great job of cutting your grass, but it won’t help with your edges or the rest of your yard.
So oftentimes, you’ll use a proxy tool like Burp or ZAP to thoroughly check out your target, and if you find interesting endpoints that you want to test for sqli, you’ll pull out sqlmap and use the information you’ve proxied from Burp to craft attacks with sqlmap.
-
Definitely get familiar with tooling before trying to use it on real environments. For one, your success rate won’t be high if you’re not properly using the tool(s), but also some of them can cause damage to environments or data, so it’s important to make sure you’re not abusing the environments you’re going after.
-
Burp does include plugins either by default or as extensions you can download and add that have some similar functionality, but a lot of times, 3rd party tools can still be more powerful. Not always – some of those extensions are fantastic.
Do keep in mind that even the best tools in the world won’t give you anything if the tool is either improperly used or being used against endpoints that don’t have vulnerabilities. So regardless of the tool you use, personally I think the most important part is truly learning how the tool(s) work and when they should be employed against a target.