NegativeWibes

 improper cache managment to cross site request forger y 1.you have to  check  all visited pages saved in browser cache or not  2 you have to check  csrf  token is applied for  user by user . that should not be expired.  LETS  START  login your account EXAMPLE(abc)  visit all pages  logout the account  now click back buttton u see all visited pages  open profile page   on intercept and click on save  capture this request   we get a csrf token of that user ----------------------------------------------- create new account login that account and go to profile and  capture the  request of update profile and make a csrf form of that request.  now paste csrf token  that we previously taken and save as.html   if abc login accounnt and that html page is send and when he opened that page their profile  get changed -------...

                   HTTP REQUEST AND RESPONSE Http request and response contains some headers . that may be security headers, informational headers etc. for see request and response u have to use  intercepter tool best tool is burp-suite  here  is link of burp-suite pro . you can download and use                                  click here to download                                  HTTP REQUEST::::::                                          open your browser and got to any website and intercept the request ....... request contians followinf information like   given below----- The first line of ev...

hey guys ,, if you  forgotten passowrd or username or both .. dontworry you can reset password  of nessus or add or remove user 1. open terminal and go to sbin directory                          cd /opt/nessus/sbin  2.enter ls command to see all files 3.there  are a file nessuscli by which we can reset password,add user and remove user 4. execute that file ---  ./nessuscli 5.it showing many options like  user-commands,fetch commands,bug reporting commnads.  6.enter  command  ./nessuscli lsuser  it will show username 7.  TO change  password  enter command  ./nessuscli chpasswd <username> 8. enter new password and enjoy If you want to  adduser ,it also easy like reset password   ...Goto same directory and enter command      ./nessuscli adduser       enter any use...

hello guys.. now you willnot have to do spent money on downloading book               you can download any paid book free                                                goto url: http://b-ok.org/                  search any book and download for free:::::::::::::::::::::

For finding vulnerabilities using nmap ..nmap scripts are used 1. nmap --script  vuln <target ip address>  if  not getting apprpriate result use -d (for debugging)         nmap --script vuln <target ip address> -d                          2. If any website using firewall to block your request then you  can use  other methods like (tcp scan,syn scan,ack scan,xmas scan)  for bypassing firewalls and get appropriate results  all scan  types are detailed in next post   SYN SCAN  --  nmap -sS  <target ip address>  TCP SCAN     --  nmap -sT <target ip address> ACK SCAN    --  nmap -sA <target ip address>  sometimes it block your ping request  for overcome this problem use  no ping scan                 ...

   open url:  https://www.hackthebox.eu/invite

Request method is an operation which run on a  resource on a web server. ..... There are mainly 7 methods used in websites............ GET----------for information retrival POST----------for sending data(like form submission) HEAD----------response for GET but no response body TRACE-----------echo client request back PUT------------------for uploading  file DELETE------------- for deleting file CONNECT--------------- for connecting to server websites for their security some methods allowed and some methods disallowed -----now question arises in your mind... how we know that which methods are allowed and disallowed in website???????? we can know this by tools like nmap,metasploit,curl--- BY NMAP http option method by nmap ⇇ if you want to test each method individually--- 2. By Metasploit-----------     enter msfconsole in terminal msf>use auxiliary/scanner/http/options set rhosts run   ...