Anton Lopanitsyn - Initial reconnaissance of web applications.

Often, everything that is right in front of your eyes is being checked more meticulously than parts inaccessible to the average user. We are looking for hidden functionality of web applications for the subsequent search for vulnerabilities.

Transcript

1. Предварительная разведка
   веб-приложений
   Bo0oM
   

   View Slide

2. subdomain enumeration
   • theharvester
   • recon-ng
   • aquatone
   • Sn1per
   • Massdns
   • Aquatone
   • Amass
   

   View Slide

3. directory enumeration
   • Dirbuster
   • Dirsearch
   • Wfuzz
   • Hehdirb
   

   View Slide

4. View Slide

5. View Slide

6. diff
   Length - 5
   Length - 5
   

   View Slide

7. Расстояние Левенштейна
   

   View Slide

8. SLIDE NAME
   

   View Slide

9. Дерево DOM
   Document Object Model
   

   View Slide

10. Обогащение словаря
    

    View Slide

11. Обогащение словаря
    

    View Slide

12. Обогащение словаря
    

    View Slide

13. Обогащение словаря
    PARSE_JS = False:
    python3 ParamPP.py -u "https://vk.com/login"
    ['m', 'b', 'u', 'al’]
    PARSE_JS = True:
    python3 ParamPP.py -u "https://vk.com/login"
    ['b', 'm', 'al', 'async', 'u', 'ad_video']
    

    View Slide

14. Ограничение веб-серверов
    

    View Slide

15. Param-Pam-Pam
    https://github.com/Bo0oM/ParamPamPam
    #TODO
    • Json data
    • Keep-alive
    • Ченить-там-еще
    

    View Slide

16. Param-miner
    

    View Slide

17. Q?
    @i_bo0om
    @webpwn
    

    View Slide