In this post, AnonyViet will help you check if your website is attacked by python sql syntax 🙂 …!!!

And it will only work if the variables use the GET method.

Here we will write a code in python language.

We will need an internet connection to check and a vulnerable website.

To find a vulnerable website for testing, go to google and type dorks SQLi :

inurl: "index.php? Cat_id ="

You follow the steps below to write a piece of python code:

First open notepad/sublime Text , … create a file then save it: new.py

We will use sys, urllib and urllib.request modules. So import the following libraries: import sys, urllib, urllib.request or import sys, import urllib and import urllib.request

Next: Now we will need to select the input type.

1. Use the input(“”) command to get input from the user.

fullurl = input(“Please specify the full vulnerable url: “)

2. Code that makes a web request

This is the most important part.

resp = urllib.request.urlopen(fullurl + "=1\' or \'1\' = \'1\'")
body = resp.read()
fullbody = body.decode(‘utf-8’)

Now make our program check if the target is vulnerable, once we have response then we have to check if it has SQL error.

We will use this code:

if “You have an error in your SQL syntax” in fullbody:

print (“The website is classic SQL injection vulnerable!”)

else:

print (“The website is not classic SQL injection vulnerable!”)

Ok. Now let’s run it:

Use the command: python “name”.py

Then enter the site you found at the beginning.

Ok so it worked.

Method 2: Use it quickly, then use it

• python “name”.py -w website

Now to prevent Hacker from checking my site with SQL injection, I do the following:

Prevent SQLi on MYSQL simply use the string mysql_real_escape for queries, for example:

$query = sprintf(“SELECT * FROM users where user=’%s’ AND password=’%s’,

                        mysql_real_escape_string($username)

                        mysql_real_escape_string($password)

Wish you success and accompany AnonyViet.

Love !!

Website security is always a necessary issue before operating on the Internet. If you want to check if your Website has security holes, use OWASP ZAP – Zed Attack Proxy software to scan for errors.

OWASP ZAP – Zed Attack Proxy is an open source tool that allows you to test the robustness of your application against security vulnerabilities. But what exactly is OWASP ZAP?

In a nutshell, this is a vulnerability testing tool that helps programmers and security professionals discover website vulnerabilities. You can perform a variety of tasks through OWASP ZAP, including scanning web requests, using dictionary lists to find files and folders on the web server, and crawling websites to find all the files and folders on the web server. link and URL. In addition, you can intercept, view, modify, and forward web requests between the browser and the web application using OWASP ZAP.

OWASP ZAP scanning can reveal problems related to SQL injectionbroken authentication, exposed sensitive data, broken access control, security misconfiguration, Cross-Site Scripting (XSS)insecure decryption, components with known vulnerabilities, and any missing security headers.

In this article, we will see how OWASP ZAP works, how to set up ZAP, how to create our own crawlers to scan for vulnerabilities.

How does OWASP ZAP work?

OWASP ZAP is a proxy server that scans all traffic running through it. This proxy server includes automated tools that allow you to block security holes on your website and generate reports from its findings. Here’s a quick diagram of how ZAP works.

ZAP creates its attacks by running the ZAP browser on a URL. During this process, ZAP will use its crawlers to gather information about a target application, scan all available pages, and then run the active scanner on it. The active scanner will accurately identify any vulnerabilities using known attack methods on the targets it receives from the scan. Alerts will be issued if potential vulnerabilities are detected and flagged from high to low based on the level of risk.

Setting up ZAP – Zed Attack Proxy

Step 1: To set up OWASP ZAP, you need to install it first. You can access: zaproxy.org/download to select an installer that is compatible with your operating system.

Step 2: Once downloaded, run the installer.

Step 3: Read and accept the terms and conditions to continue.

Step 4: Select ‘Standard installation’ and click ‘Next’.

Step 5: Click ‘Install’ to finish.

Step 6: Wait a moment for the program to finish installing.

Step 7: Once done, you will be directed to a screen that looks something like this.

Create ZAP Spider

To run the first scan, run the newly installed OWASP ZAP. You will be greeted with a screen that looks like this:

Once the download is complete, you will get a screen that looks like the image below. In the main ‘Quick Start’ view, you can choose between ‘Automated Scan’ and ‘Manual Explore”. For this tutorial, select ‘Automated Scan’.

This option will give you a page like the image below. You can run it on your application by pointing the destination URL to the localhost your application is currently running on.

This is an example of when in the scan phase.

Once done, you can click on the ‘Alerts’ tab to see all the potential vulnerabilities.

Based on the example and scan results above, we can see that the issues detected are not serious and can be easily remedied, such as X-Frame-Options and Anti-CSRF Tokens.

The impact of a vulnerability can be assessed by the number of specific alerts. For example, cross-domain JavaScript source file inclusion seems to be a bug of some sort. However, if we dig deeper, we find that the risk is classified as low because of the reliable source.

Here’s a screenshot of one of the flagged warnings and reports generated for the cross-domain JavaScript source file inclusion error. Right below is a solution on how to reduce this vulnerability based on this bug.

Conversely, if we want to start vulnerability testing based on severity, OWASP ZAP will automatically rank from highest to lowest in the ‘Alerts’ file list. The top warning on the list is ‘Vulnerable JS Library’. The report is marked as medium risk because the jQuery used is not the latest version.

A little more digging into jquery-2.1.4 tells us that this target site is vulnerable to Cross-site Scripting (XSS) attacks via elements from untrusted sources. This is because in the JQuery version, DOM manipulation methods can execute untrusted code.

Conclusion

The Quick Scan function of OWASP ZAP – Zed Attack Proxy will not “hack” your Web. However, it will give you an overview of the security issues and vulnerabilities your website is facing.

Using OWASP ZAP during the programming phase can also help us improve our security processes by identifying problems before they grow too large over time. It is easier to fix a potential vulnerability when it is small than when it is large and affects the entire developed application.

One thing to keep in mind is that if you run OWASP ZAP on a more mature application with lots of legacy code, you may get a large number of warnings. This is normal, especially if security is not part of the growth mindset at first. As long as you prioritize your vulnerabilities and find ways to address them, it will increase the security of your application.

In addition to running the function Quick Scan manually every time, you can also automate it into your workflow via Docker Packaged Scans, GitHub Actions or automation frameworks.

I was assigned the task of finding vulnerabilities in the Website. Before you need to do network scouting/network scouting, the term is called Recon. If used manually, it is quite time consuming, today I will introduce you to Tool reconFTW to help you scout your friends very well, integrated with many functions to help collect accurate information about the Website you are scanning.

What is a website security vulnerability?

Website security vulnerabilities are weaknesses in the design and configuration of the system, web developer error or negligence in the operation of the website. The existence of these vulnerabilities is a danger to developers as well as website visitors when black hat hackers can fully exploit them to be able to steal your data or information. your personal information, the user’s and more

Hackers use scanning tools to detect a wide range of websites with poor security configuration or websites on popular platforms like WordPress that have published vulnerabilities that have not been addressed by the website owner or web developer, and They will use them to attack, install malicious code and destroy websites.

Some studies show that in 2019, every 45 minutes, a website will be “visited” by hackers and mainly black hat hackers. This is enough to talk about how dangerous the existence of security holes is.

Common types of website security vulnerabilities

• SQL Injection (you can see more articles use SQLmap For more details)
• Broken Authentication
• Cross Site Scripting
• Server-Side Template Injection
• Insecure Direct Object References

reconFTW is a software from the github community and authored by six2dez. This is a network reconnaissance tool, also known as a network spy, and it can collect information of the website such as the owner, the domain name is associated with but most importantly, this tool is capable of automating the process. Check your website’s security, list all subdomains, and do a comprehensive vulnerability check. reconFTW uses a variety of methods to test including:

• passive
• bruteforce
• permutations
• certificate transparency
• source code scraping
• analytics
• DNS records

It also performs various vulnerability checks like XSS, Open Redirects, SSRF, CRLF, LFI, SQLi, SSL check, SSTI,DNS, etc. Along with that, reconFTW can OSINT (trace tracing) and scan target’s port.

To say, compared to tools like Burpsuite, in terms of features, they are not inferior to them but also can run the tool simply and easily. After experiencing, this is an extremely suitable tool for those of you who cannot use tools like nmap or Burpsuite.

At the same time, after the whole detective process has been completed, all that has been collected will be aggregated into a single file and it is quite convenient if you want to reopen it to check and check for possible errors. available on the website.

It takes a long time to run the entire network reconnaissance feature, but I just need to sit and eat because the whole process has been automated and optimized so that the user can easily. collect information

Note before doing

It is strictly forbidden to take advantage of the security holes of non-proprietary websites to wreak havoc. Anonyviet will not be responsible for any of your actions. Please continue if you already agree with this note!

Instructions for using reconFTW to scan website security holes

Installation Instructions

You can visit the official tool’s github link here

For live installation / using virtual machine / using VPS

git clone https://github.com/six2dez/reconftw
cd reconftw/
./install.sh

#khởi động tool
./reconftw.sh -d [tên miền] -r

For Docker

Method 1: From DockerHub

docker pull six2dez/reconftw:main
wget https://raw.githubusercontent.com/six2dez/reconftw/main/reconftw.cfg
mkdir Recon

#câu lệnh khời động tool
docker run -d -v $PWD/reconftw.cfg:/root/Tools/reconftw/reconftw.cfg -v $PWD/Recon/:/root/Tools/reconftw/Recon/ --name reconftwSCAN --rm six2dez/reconftw:main -d [tên miền] -r

Method 2: from Github

git clone https://github.com/six2dez/reconftw
cd reconftw
docker build -t reconftw Docker/.

#câu lệnh khởi động tool
docker run -v $PWD/reconftw.cfg:/root/Tools/reconftw/reconftw.cfg -v $PWD/Recon/:/root/Tools/reconftw/Recon/ --name reconftwSCAN --rm reconftw -d [tên miền] -r

User manual

Syntax: ./reconftw.sh [tùy chọn dành cho mục tiêu] [Input cho mục tiêu] [chế độ(mode)] [các tùy chọn khác]

For option for target

Here:

Target.com is the domain you want to attack

-r: I will explain in the mode (mode)

• -d: for 1 domain name
  For example: ./reconftw.sh -d target.com -r
• -l: use a list of domains
  For example: ./reconftw.sh -l targets.txt -r
• -m: for 1 target but multiple domains
  For example:./reconftw.sh -m target -l domains.txt -r
• -i: add subdomains as list
  For example:./reconftw.sh -d target.com -i in.txt -r
• -x: exclude subdomains
  For example: ./reconftw.sh -d target.com -x oos.txt -r

For modes

Usually, I recommend using -r over the others because I only use that. If you want full scan, use -a

Note: processing speed depends on the mode you choose and the speed of your home network. Sometimes with large web it will take quite a while.

• -r: Website scouting with all modes (no attack)
  For example: ./reconftw.sh -d target.com -r
• -S: Search Subdomains
  For example: ./reconftw.sh -d target.com -s

• -p: Only run as passive
  For example: ./reconftw.sh -d target.com -p

• -w: Check the website provided in the list
  For example: ./reconftw.sh -l targetlist.txt -w

• -a: Run all functions
  For example: ./reconftw.sh -d target.com -a

• -n: osint – tracing
  For example: ./reconftw.sh -d target.com -n

• -H: show help
  For example: ./reconftw.sh -h


For other options

• –deep: Run deep scan
• -v: VPS – use when you run on VPS
• -f conf_file: use another config (not recommended)
• -o: Save output of reconFTW

Some examples of usage

• Run web snooping with a unique domain name: ./reconftw.sh -d target.com -r
• Run web scouting with a list of domains: ./reconftw.sh -l sites.txt -r -o /output/directory/
• Run web scouting with a list of domains on vps: ./reconftw.sh -d target.com -r --deep -o /output/directory/

• Run web snooping with multiple domains from 1 company: ./reconftw.sh -m company -l domains_list.txt -r

• Boot into Full power mode: ./reconftw.sh -d target.com -a


Eg:

Actual Demo

First, I run the following command: ./reconftw.sh -d duocphamviethung.com.vn -r

After it finishes scanning, it returns the results. There is a statistics of the time it takes to scan and complete the task. Currently, it has taken me up to 2 hours for a small website, so please note the time!

All files are saved in folder Recon/[tên website tấn công] if you don’t set its output.

Here, the file that you need to pay attention to is the nuclei_output file because this file will return a CVE error code that hackers can use to exploit information. You can go to Google and search for the error code to find the solution to fix it as soon as possible!

Use it to pentest your system only!

What is Nuclei?

Nuclei is an open source toolkit used to scan Website security holes, also known as Bug finder. Some Bug Hunters are using this tool to receive bounties from websites with weak security. A special feature that Nuclei is favored by many Hackers is that it has a large user community and error code templates are always updated regularly, so when a vulnerability has just been released, Nuclei already has a template to scan.

Another highlight is that Nuclei is completely free and you can customize how to scan Website as well as create templates to scan Website bugs to your liking.

Nuclei can scan various protocols, including DNS, HTTP, TCP and many more. All kinds of security checks can be done using kernel templates.

How to install Nuclei

It is recommended to turn off anti-virus programs on Windows when performing an Upgrade Kali Linux to avoid blocking installation packages. To install Nuclei, execute the following commands on Kali Linux:

sudo su

Enter password user

apt-get update -y

apt-get upgrade -y

Because nuclei is written in Goland language, so we need to install Goland on Kali Linux, execute the following commands:

apt install gccgo-go -y
apt install golang-go -y

Install Nuclei to scan Website security holes

git clone https://github.com/projectdiscovery/nuclei.git; \
cd nuclei/v2/cmd/nuclei; \
go build; \
mv nuclei /usr/local/bin/; \
nuclei -version;

After the installation is complete, type the command nuclei -h to start

The case of reported nuclei outdated, is because you downloaded the old version. Let’s execute the update template command again.

Use the command:
go install -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest


sudo nuclei -update

If successful, you will see the following interface:

If you want to use nuclei to find Bug Website on Windows, download the version Windows kernel back to use.

How to use Nuclei to scan Website vulnerabilities

To proceed to find Bug Website we execute the following command:

nuclei -u địa-chỉ-website

Eg: nuclei -u https://domain.com

In case some Websites will have a firewall (WAF) and block scanning processes, you can reduce the frequency of sending requests to the server by rate-limit. Let’s use the parameter: --rate-limit.

Eg: nuclei -u https://domain.com -rate-limit 1 //ie send 1 second send 1 request

To bypass WAF, you can change the packet header to avoid blocking, with the parameter -h

Eg: nuclei -u https://domain.com -rate-limit 1 -header 'User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64)'

In case you want to scan many Web pages, create a file named url.txt, fill in 1 Web page per line, then use the syntax -list url.txt

You can see some more examples when scanning Website vulnerabilities at nuclei’s home page.