Cheatography
https://cheatography.com
Web Exploit Penetration Testing
This is a draft cheat sheet. It is a work in progress and is not finished yet.
Parameter Tampering
Hack The Form - Firefox Addon |
Reconnaissance
COMMAND |
ACTION |
recon-ng |
recon scan |
nmap -sT <IP> |
network TCP scan |
nmap -sV <IP> |
network service/version scan |
zenmap |
GUI scan |
Wafw00f |
scan for wafs |
OSINT |
research online |
WHOIS |
DNS info |
Google Dorking |
Google OSINT |
Shodan |
search engine scans web |
NSE |
Nmap scripting engine |
Nessus |
Vulnerability scanner |
BeEF (Browser Exploitation Framework)
|
|
Path/Directory Traversal
URL Manipulation |
insert after page= portion of URL |
URL addition |
../../../../../../../../etc/passwd |
Metasploitable Framework
|
|
XSS Stored
Enter to message field |
<script>alert(document.cookie);</script> |
*vuln from unsanitized input
SQL Injection
sqlmap |
command line autodetect sql inj. vulns |
|
