GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → splitline → How-to-Hack-Websites

splitline / How-to-Hack-Websites

Licence: other
開源的正體中文 Web Hacking 學習資源 - 程式安全 2021 Fall

Programming Languages

PHP
23972 projects - #3 most used programming language
HTML
75241 projects
python
139335 projects - #7 most used programming language
hack
652 projects
Dockerfile
14818 projects
javascript
184084 projects - #8 most used programming language
shell
77523 projects

Labels

securityweb-securityctf

Projects that are alternatives of or similar to How-to-Hack-Websites

CJ2018-Final-CTF
Cyber Jawara 2018 Final - Attack & Defense CTF services environments based on Docker.
Stars: ✭ 58 (-80.07%)
Mutual labels:  web-security, ctf
Pentesting toolkit
🏴‍☠️ Tools for pentesting, CTFs & wargames. 🏴‍☠️
Stars: ✭ 1,268 (+335.74%)
Mutual labels:  web-security, ctf
fhq-server
This is an open source platform for competitions of computer security.
Stars: ✭ 33 (-88.66%)
Mutual labels:  ctf
ctf writeups
No description or website provided.
Stars: ✭ 25 (-91.41%)
Mutual labels:  ctf
robot hacking manual
Robot Hacking Manual (RHM). From robotics to cybersecurity. Papers, notes and writeups from a journey into robot cybersecurity.
Stars: ✭ 169 (-41.92%)
Mutual labels:  ctf
firecracker
Stop half-done API specifications! Cherrybomb is a CLI tool that helps you avoid undefined user behaviour by validating your API specifications.
Stars: ✭ 438 (+50.52%)
Mutual labels:  web-security
CTF-Script-And-Template-Thrift-Shop
[180+ scripts] There are a few genuine gems in there. And a lot of spaghetti code. Most of these scripts were for solving CTF's. If you googles something for a CTF and landed here look at the scripts they're all fairly malleable. Sorry for the shitty naming conventions (not really). If you are a recruiter stop. I wont be able to rewrite half thi…
Stars: ✭ 38 (-86.94%)
Mutual labels:  ctf
BerylEnigma
一个为渗透测试与CTF而制作的工具集，主要实现一些加解密的功能。
Stars: ✭ 329 (+13.06%)
Mutual labels:  ctf
webcocktail
An automatic and lightweight web application scanning tool for CTF.
Stars: ✭ 28 (-90.38%)
Mutual labels:  ctf
ctf
CTF programs and writeups
Stars: ✭ 22 (-92.44%)
Mutual labels:  ctf
diwa
A Deliberately Insecure Web Application
Stars: ✭ 32 (-89%)
Mutual labels:  web-security
bento
Bento Toolkit is a minimal fedora-based container for penetration tests and CTF with the sweet addition of GUI applications.
Stars: ✭ 74 (-74.57%)
Mutual labels:  ctf
spellbook
Framework for rapid development and reusable of security tools
Stars: ✭ 67 (-76.98%)
Mutual labels:  ctf
watchman
AML/CTF/KYC/OFAC Search of global watchlist, sanctions, and politically exposed person (PEP)
Stars: ✭ 167 (-42.61%)
Mutual labels:  ctf
Find-PHP-Vulnerabilities
🐛 A plug-in of sublime 2/3 which is able to find PHP vulnerabilities
Stars: ✭ 57 (-80.41%)
Mutual labels:  web-security
cyber-gym
Deliberately vulnerable scripts for Web Security training
Stars: ✭ 19 (-93.47%)
Mutual labels:  web-security
GitCTF
Git-based CTF
Stars: ✭ 53 (-81.79%)
Mutual labels:  ctf
FastPwn
CTF中Pwn的快速利用模板（包含awd pwn）
Stars: ✭ 18 (-93.81%)
Mutual labels:  ctf
PIL-RCE-Ghostscript-CVE-2018-16509
PoC + Docker Environment for Python PIL/Pillow Remote Shell Command Execution via Ghostscript CVE-2018-16509
Stars: ✭ 44 (-84.88%)
Mutual labels:  web-security
Enum.py
A tool to enumerate network services
Stars: ✭ 23 (-92.1%)
Mutual labels:  ctf
View All Similar Projects ➔

How to Hack Websites

Videos

Topics

初章

Full slide

  • Web & Web security introduction [slide]
  • Access control & Bussiness logic
  • Recon & Information leak [slide]
  • Insecure Upload / Path traversal / LFI [slide]
  • Basic injection [slide]
    • Code injection
    • Command injection
    • SQL injection: Basic

續章

Full slide

  • SQL injection: Advanced
    • Union-based
    • Boolean-based
    • Other
  • Server-side request forgery (SSRF)
  • Insecure deserialization
    • Intro
    • Pickle

終章

Full slide

  • Insecure deserialization [slide]
    • PHP
    • POP Chain
    • Misc (Java, .NET etc.)
  • Frontend security: Basic [slide]
    • Same-origin policy
    • CSRF
    • XSS
  • Frontend security: Content Security Policy (CSP) [slide]
  • Frontend security: Advanced
  • Advanced injection
    • NoSQL injection
    • Server-side template injection (SSTI)
  • Misc
    • JavaScript prototype pollution [slide]
    • XXE

Labs

題目之後的 數字 代表的是 docker 對外通訊埠編號

  • Basic
    • Cat Shop 8100
  • SQL injection
    • Login me: Login bypass 8200
    • Login me again: UNION-based SQL injection 8201
  • Command injection
    • DNS tool 8300
    • DNS tool: WAF edition 8301
  • LFI
    • Meow site: Basic LFI 8400
    • HakkaMD: LFI to RCE 8401
  • SSRF
    • Web Preview Service: Use gopher:// to forge a request 8500
    • SSRFrog: Bypass blacklist 8501
  • Deserialization
    • Pickle 8600
    • Cat: Basic PHP unserialize 8601
    • Magic cat: POP chain 8602
  • SSTI
    • Jinja2 SSTI 8700
  • Frontend
    • XSS 8800

Homework

  • Imgura: Information Leak / Upload / LFI
  • DVD Screensaver: Path traversal / SQL injection / Signed Cookie
  • Profile Card: XSS / CSRF / CSP Bypass
  • Double SSTI: SSTI
  • Log me in: FINAL: SQL injection / Information Leak
Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].