Week 2: Exploring Red Team tools, tactics and procedures Course

Penetration testers frequently find themselves running the same commands and tools or going through the same processes. In certain environments, those tools might not be available to use or install. Scripting languages are a time and resource-effective solution for both these problems. They allow quick and straightforward automation of mundane tasks that can help save considerable amounts of time. They also provide numerous libraries to communicate with different protocols, operating systems, and programs. This versatility aids in constructing new tools or creating versions of the already existing ones when the testing environment makes it impossible to access themThis lab covers scripting using Python and Bash. It aims to provide an insight into the benefits of task automation by explaining:● Basic Scripting○ Handling user input○ Iterations○ Logical branching● Automation● Creating pentesting tools and utilities

In this lab you will learn about File Inclusion and Cross-Site Request Forgery attacks.File Inclusion vulnerabilities are caused when unvalidated input parameters are passed to back-end programming functions that access server files. The back end represents the server-side of the application, specifically its code and database. An attacker can change the file name in an HTTP request and include malicious scripts instead. Depending on the script, the attacker can:● Execute code on the server● Perform XSS attacks● Cause a Denial of Service (DOS)● Manipulate data● Access sensitive information...............................................................................................................................Cross-site request forgery (CSRF), also known as XSRF, Sea Surf, or Session Riding, is a vulnerability where unauthorized commands are submitted from a user that the web application trusts. The delivery mechanisms for CSRF attacks are similar to those for Reflected XSS. An attacker uses social engineering to trick the victim into sending a forged request to a server. The server does not block the request since it is made from an authenticated user.

In this lab you will walkthrough an example of both HTML and SQL injections.HTML injections are vulnerabilities created from poor coding techniques and failure to sanitize user input that allow attackers to inject malicious payloads into the website's HTML code and modify its content. Based on the vulnerability, an attacker can change a few code lines, add entire forms that can then be used to trick users into providing sensitive information or change the website's entire layout.SQL injection is a web security vulnerability that permits an adversary to inject malicious SQL statements in the queries that an application makes to its database. It allows an unauthorized entity to view data to which they should not have access, like other users' information