Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Anton Lopanitsyn - Initial reconnaissance of web applications.

DC7499
November 10, 2018
Research
0
250

Anton Lopanitsyn - Initial reconnaissance of web applications.

Often, everything that is right in front of your eyes is being checked more meticulously than parts inaccessible to the average user. We are looking for hidden functionality of web applications for the subsequent search for vulnerabilities.

DC7499

November 10, 2018
Tweet

More Decks by DC7499

See All by DC7499
Sergey Sobko - Hackashop: Hackathon + Pentest + Workshop [RU]
defcon
0
430
Dmitry Sklyarov - Intel ME: Security keys Genealogy, Obfuscation and other Magic
defcon
0
220
Dmitry Volkov - Private messengers: without pain??
defcon
1
210
Andrey Skuratov and Sergey Migalin - DNS tunneling in 2018. What is that, and what to do with it?
defcon
1
190
Sergey Belov - Another side of Bug Bounty programs
defcon
0
240
Dmitry Sklyarov - Intel ME: Flash file system explained
defcon
0
400
Maxim Goryachiy & Mark Ermolov - Inside Intel Management Engine
defcon
0
460
Sergey Golovanov - Indecent Response 2018
defcon
0
370
Kupreev Oleg & Putin Vladimir - Your very own driver for the custom NVMe device from the scratch: reading of the flash memory of iPhone 7
defcon
1
480

Other Decks in Research

See All in Research
The Theory behind Vector DB
matsui_528
0
1.4k
研究効率化Tips_2024 / Research Efficiency Tips 2024
ryo_nakamura
4
2.2k
Rの機械学習フレームワークの紹介〜tidymodelsを中心に〜 / machine_learning_with_r2024
s_uryu
0
210
Prompt Tuning から Fine Tuning への移行時期推定
icoxfog417
17
6.8k
Azure Arc-enabled Serversを利用した ハイブリッド・マルチクラウド環境の管理 / Managing Hybrid Multi-cloud Environments with Azure Arc-enabled Servers
nttcom
0
210
20240209 データを肴に熊本の交通を考える会「車１割削減、渋滞半減、公共交通２倍」をめざし世界に学ぼう
trafficbrain
0
770
第59回名古屋CV・PRMU勉強会：ICCV2023論文紹介（自己教師あり学習）
naok615
0
310
Active Retrieval Augmented Generation
kiyohiro8
3
440
CSC590 Lecture 01
javiergs
PRO
0
130
20240127_熊本から今いちど真面目に都市交通～めざせ「車1割削減、渋滞半減、公共交通2倍」～ 全国路面電車サミット2024宇都宮
trafficbrain
1
650
論文紹介 DISN: Deep Implicit Surface Network for High quality Single-view 3D Reconstruction / DISN: Deep Implicit Surface Network for High quality Single-view 3D Reconstruction
nttcom
0
110
Sosiaalisen median katsaus 02/2024
hponka
0
2.4k

Featured

See All Featured
Building Applications with DynamoDB
mza
88
5.6k
From Idea to $5000 a Month in 5 Months
shpigford
377
45k
Designing Dashboards & Data Visualisations in Web Apps
destraynor
226
51k
Large-scale JavaScript Application Architecture
addyosmani
503
110k
Facilitating Awesome Meetings
lara
41
5.6k
Become a Pro
speakerdeck
PRO
10
4.5k
Typedesign – Prime Four
hannesfritz
36
2.1k
Bootstrapping a Software Product
garrettdimon
PRO
301
110k
Infographics Made Easy
chrislema
237
18k
XXLCSS - How to scale CSS and keep your sanity
sugarenia
240
1.2M
Producing Creativity
orderedlist
PRO
336
39k
Designing for humans not robots
tammielis
247
25k

Transcript

  1. Предварительная разведка веб-приложений Bo0oM

  2. subdomain enumeration • theharvester • recon-ng • aquatone • Sn1per

    • Massdns • Aquatone • Amass

  3. directory enumeration • Dirbuster • Dirsearch • Wfuzz • Hehdirb

  4. None
  5. None

  6. diff Length - 5 Length - 5

  7. Расстояние Левенштейна

  8. SLIDE NAME

  9. Дерево DOM Document Object Model

  10. Обогащение словаря

  11. Обогащение словаря

  12. Обогащение словаря

  13. Обогащение словаря PARSE_JS = False: python3 ParamPP.py -u "https://vk.com/login" ['m',

    'b', 'u', 'al’] PARSE_JS = True: python3 ParamPP.py -u "https://vk.com/login" ['b', 'm', 'al', 'async', 'u', 'ad_video']

  14. Ограничение веб-серверов

  15. Param-Pam-Pam https://github.com/Bo0oM/ParamPamPam #TODO • Json data • Keep-alive • Ченить-там-еще

  16. Param-miner

  17. Q? @i_bo0om @webpwn