Vulnerabilities qhov chaw. Lub vas sab Xyuas. Program yuav luam theej duab lub site rau vulnerabilities

website ruaj ntseg qhov teeb meem yeej tsis tau raws li mob raws li nyob rau hauv lub xyoo pua 21st. Ntawm cov hoob kawm, qhov no yog vim lub kev kis ntawm lub Internet nyob rau hauv yuav luag tag nrho cov lag luam thiab liaj teb. Txhua txhua hnub, hackers thiab kev ruaj ntseg ua hauj lwm pom ib tug ob peb tshiab vulnerabilities qhov chaw. Muaj ntau ntawm lawv yog cov tam sim ntawd kaw tswv thiab developers, tab sis ib txhia nyob twj ywm li no. Uas yog siv los ntawm cov attackers. Tab sis siv ib tug hacked site yuav ua zoo raug mob mus rau ob nws cov neeg siv thiab cov servers uas nws yog tsis muaj tsev nyob.

Hom ntawm qhov chaw vulnerabilities

Thaum koj tsim Web pages uas siv los ntawm ib tug ntau ntawm lwm yam kev siv hluav taws xob yees. Ib txhia yog sophisticated thiab lub sij hawm-mus soj ntsuam, thiab ib co yog cov tshiab thiab tsis tau hnav. Nyob rau hauv txhua rooj plaub, muaj ntau ntawm ntau ntau yam ntawm qhov chaw ntawm vulnerabilities:

• XSS. Ib lub tsev kawm muaj ib tug me me daim ntawv. Lawv pab cov neeg siv nkag ntaub ntawv thiab tau txais ib tug tshwm sim, sau npe yog nqa tawm los yog xa cov lus. Hloov nyob rau hauv daim ntawv ntawm cov tshwj xeeb qhov tseem ceeb yuav ua lub tua ntawm ib tug tej yam tsab ntawv, uas muaj peev xwm ua rau ib tug ua txhaum ntawm lub sam xeeb ntawm qhov chaw thiab compromising cov ntaub ntawv.
• SQL-txhaj tshuaj. Ib tug heev heev thiab zoo mus nce nkag tau mus rau pub leej twg paub cov ntaub ntawv. Qhov no yuav tshwm sim yog los ntawm lub chaw nyob bar, los yog ntawm daim ntawv. Cov txheej txheem yog nqa tawm los ntawm hloov lub qhov tseem ceeb uas tsis tau lim scripts thiab query lub database. Thiab nrog rau kom paub nws yuav ua rau muaj kev ruaj ntseg txhaum cai.

• HTML-kev ua yuam kev. Zoo tib yam li hais tias ntawm lub XSS, tab sis tsis nyob tsab ntawv code, thiab HTML.
• Cov kev ruaj khov ntawm qhov chaw uas txuam nrog qhov kev tso kawm ntawm cov ntaub ntawv thiab Wage nyob rau hauv lub neej ntawd chaw. Piv txwv li, kev paub txog cov qauv ntawm cov nplooj ntawv Web site, koj yuav tau mus txog lub koom haum saib xyuas vaj huam sib luag code.
• Tsis txaus tiv thaiv ntawm lub teeb ntawm lub operating system rau neeg rau zaub mov. Yog hais tias muaj, lub ruaj khov yog tam sim no, ces tus attacker yuav tsum tau rau txim tuag arbitrary code.
• Phem passwords. Ib tug ntawm cov feem ntau pom tseeb vulnerabilities qhov chaw - siv zog qhov tseem ceeb los tiv thaiv lawv cov account. Tshwj xeeb tshaj yog yog hais tias nws yog ib tug thawj tswj.
• Tsis phwj. Nws yuav siv thaum hloov ntaub ntawv los ntawm lub cim xeeb, yog li ntawd koj yuav tau ua kom lawv tus kheej kev kho me ntsis. Nws tshwm sim thaum qhov kev koom tes ntawm zoo tag nrho yuav software.
• Hloov seem ntawm koj qhov chaw. Recreating lub caij nyoog daim ntawv ntawm lub website los txiav mus rau tus neeg uas tsis tau xav tias ib tug ua kom yuam kev thiab nkag mus rau koj tus kheej kom paub meej, tom qab ib co sij hawm dua attacker.
• Tsis kam muab kev pab cuam. Feem ntau cov sij hawm no yog to taub lub nres rau ntawm lub neeg rau zaub mov thaum nws tau txais ib tug loj tus naj npawb ntawm kev thov uas yuav tsis tau lis, thiab tsuas "rau" los yog yuav tsis tau mus ua hauj lwm cov neeg siv cov. Cov kev ruaj khov lus dag nyob rau hauv lub fact tias ib tug IP lim tsis configured kom zoo.

Txhob raug Scan Site

Security tshwj xeeb ua ib tug tshwj xeeb kev tshawb ntawm cov web kev pab rau cov uas tsis thiab tsis xws luag uas yuav ua rau ntes. Tej pov thawj qhov chaw hu ua pentesting. Cov txheej txheem ntsuam qhov code siv los ntawm lub CMS, lub xub ntiag ntawm rhiab modules thiab ntau lwm nthuav kev ntsuam xyuas.

SQL-txhaj

Qhov no hom ntawm kev kuaj qhov chaw txiav txim seb tsab ntawv ntxaij lim dej tus tau txais qhov tseem ceeb nyob rau hauv qhov kev npaj ntawm kev thov mus rau lub database. Kev ib tug yooj yim kev kuaj yuav ua tau manually. Yuav ua li cas mus nrhiav tau SQL ruaj khov rau ntawm qhov chaw? Leej twg thiaj yuav los sib tham.

Piv txwv li, yog ib qhov chaw kuv-sayt.rf. Nyob rau nws sab pem hauv ntej muaj ib tug catalog. Mus rau nws, koj muaj peev xwm yuav nrhiav tau nyob rau hauv qhov chaw nyob bar ib yam dab tsi zoo li kuv-sayt.rf /? Product_id = 1. Nws yog yuav hais tias qhov no yog ib kev thov mus rau lub database. Yuav kom nrhiav tau ib qhov chaw vulnerabilities yuav xub mus hloov nyob rau hauv kab ib zaug xwb quote. Raws li ib tug tshwm sim, yuav tsum tau kuv-sayt.rf /? Product_id = 1 '. Yog hais tias koj nias lub "Sau" khawm ntawm cov nplooj ntawv, ib qho yuam kev lus, lub ruaj khov tshwm sim.

Tam sim no koj muaj peev xwm siv ntau yam kev xaiv rau cov kev xaiv ntawm qhov tseem ceeb. Siv ua ke tswv zam, commenting thiab ntau lwm tus neeg.

XSS

Qhov no hom ntawm kev ruaj khov muaj ob hom - active thiab passive.

Active txhais tau tias cov kev taw qhia ntawm ib daim cai nyob rau hauv lub database los yog nyob rau hauv cov ntaub ntawv nyob rau hauv lub neeg rau zaub mov. Nws yog ntau txaus ntshai thiab unpredictable.

Passive hom yuav luring tus neeg mus rau ib tug tej chaw nyob ntawm qhov chaw uas muaj siab phem code.

Siv XSS attacker yuav nyiag ncuav qab zib. Thiab tej zaum lawv yuav muaj ib qho tseem ceeb cov neeg siv cov ntaub ntawv. Txawm ntau dire txim tau nyiag kev sib kho.

Tsis tas li ntawd, lub attacker yuav siv tsab ntawv rau ntawm qhov chaw thiaj li mus ua thaum lub sij hawm ntawm xa nws muab tus neeg siv cov ntaub ntawv ncaj qha mus rau hauv lub ob txhais tes ntawm ib qho kev attacker.

Automation ntawm cov kev tshawb fawb cov txheej txheem

Lub network yuav nrhiav tau ib tug ntau ntawm nthuav kom txhob raug scanners site. Ib txhia tuaj nyob ib leeg, ib txhia tuaj nrog ob peb zoo sib xws thiab merged mus rau hauv ib tug ib daim duab, zoo li Kali Linux. Yuav tseem yuav tau muab ib tug txheej txheem cej luam ntawm cov feem ntau nrov cuab yeej rau automate txoj kev ntawm khaws vulnerabilities.

Nmap

Qhov yooj yim lub website kom txhob raug scanner uas yuav qhia kom paub meej xws li cov operating system siv ports thiab cov kev pab cuam. Raug daim ntaub ntawv:

nmap -sS 127.0.0.1, qhov twg es tsis txhob ntawm lub zos IP chaw nyob yog tsim nyog los hloov tiag tiag xeem site.

Xaus tsab ntawv ceeb toom rau dab tsi kev pab no khiav ntawm nws, thiab uas ports yog qhib thaum lub sij hawm no. Raws li cov lus qhia no, koj muaj peev xwm sim siv twb pom tias kev ruaj khov.

Ntawm no yog ob peb lub lag luam rau ib tug nmap scan kev tsis ncaj ncees:

• -Ib tug. Pheev scan uas dumped ib tug ntau ntawm cov ntaub ntawv, tab sis tej zaum nws yuav siv sij hawm lub sij hawm.
• -O. Nws yog sim kom paub tias cov operating system siv rau koj neeg rau zaub mov.
• -D. Spoof ib tug IP chaw nyob uas ib daim tshev yog ua rau thaum koj saib nws yog tsis yooj yim sua rau neeg rau zaub mov cav los mus txiav txim qhov twg tus nres tshwm sim.
• -p. Cov kab kev los ntawm ports. Xyuas ob peb cov kev pab cuam rau txoj kev qhib.
• -S. Nws tso cai rau koj kom meej qhov tseeb IP chaw nyob.

WPScan

Qhov kev pab no yog yuav luam theej duab lub site rau vulnerabilities nyob rau hauv Kali Linux tis. Tsim los xyuas web kev pab rau cov WordPress CMS. nws yog sau nyob rau hauv Ruby, yog li khiav zoo li no:

ruby ./wpscan.rb --help. Qhov no hais kom ua yuav qhia tag nrho cov muaj cov kev xaiv thiab cov tsiaj ntawv.

hais kom ua yuav siv tau los khiav ib tug yooj yim kev kuaj:

ruby ./wpscan.rb --url some-sayt.ru

Nyob rau hauv kev WPScan - zoo nkauj yooj yim rau siv hluav taws xob los mus ntsuam xyuas koj qhov chaw nyob "wordpress" vulnerabilities.

Nikto

Program site khij rau vulnerabilities, uas yog muaj nyob rau hauv Kali Linux tis. Nws muab hwj chim loj tuition rau tag nrho nws cov simplicity:

• Luam theej duab raws tu qauv nrog HTTP thiab HTTPS;
• bypassing ntau ua-nrhiav kom tau cov cuab yeej;
• ntau qhov chaw nres nkoj PP, txawm nyob rau hauv uas tsis yog-tus qauv ntau yam;
• txhawb txoj kev siv cov npe servers;
• nws yog ua tau los siv rau kev twb kev txuas thiab plug-ins.

Yuav pib nikto xav tau mus rau lub system tau ntsia Perl. Qhov yooj yim tsom xam yog ua raws li nram no:

Perl nikto.pl -h 192.168.0.1.

Qhov kev pab cuam yuav tsum "noj" ib phau ntawv cov ntaub ntawv uas teev cov Web neeg rau zaub mov chaw nyob:

Perl nikto.pl -h file.txt

Qhov cuab yeej no yuav tsis tsuas pab kev ruaj ntseg cov tub txawg rau kev Pentest, tab sis network cov thawj coj thiab cov kev pab kom muaj cov kev kho mob qhov chaw.

Burp Suite

Ib tug heev haib mus xyuas tsis tau tsuas yog ntawm qhov chaw, tab sis xyuas ntawm tej network. Muaj ib tug built-in muaj nuj nqi ntawm cov hloov thov tau dhau hauv qhov kev xeem neeg rau zaub mov. Ntse scanner muaj peev xwm ntawm yeej saib rau ob peb hom vulnerabilities ib zaug. Nws yog ua tau kom txuag tau tus tshwm sim ntawm qhov tam sim no kev ua si thiab ces rov pib dua nws. Yooj tsis tsuas siv peb-tog plug-ins, tab sis kuj yuav sau ntawv rau koj tus kheej.

Cov nqi hluav taws xob muaj nws tus kheej graphical neeg siv interface, uas yog undoubtedly yooj yim, tshwj xeeb tshaj yog rau cov novice neeg siv.

SQLmap

Tej zaum cov feem ntau yooj yim thiab haib cuab tam rau nrhiav SQL thiab XSS vulnerabilities. Sau nws zoo yuav qhia raws li:

• Kev them nyiaj yug yuav luag tag nrho cov hom ntawm database tswj systems;
• muaj peev xwm siv rau yooj yim txoj kev los mus txiav txim rau daim ntawv thov thiab SQL-txhaj;
• Cov neeg siv busting hom, lawv hashes, passwords thiab lwm yam ntaub ntawv.

Ua ntej siv SQLmap thawj feem ntau pom ib tug lam tau lam ua qhov chaw ntawm ib tug dork - dawb paug lus nug nrhiav xyaw los pab koj maj tawm lub yees kev pab tsim nyog web.

Ces qhov chaw nyob ntawm cov nplooj ntawv yog pauv mus rau qhov kev pab cuam, thiab nws inspects. Yog hais tias muaj kev vam meej, lub ntsiab txhais ntawm kev ruaj khov nqi hluav taws xob yuav nws tus kheej thiab nws cov kev siv mus nce tag nrho nkag tau mus rau lub chaw.

Webslayer

Ib tug me me hluav taws xob uas tso cai rau koj mus tua brute quab yuam. Tau "brute quab yuam" ntaub ntawv ntawm lub neej, qhov kev sib kho tsis ntawm lub site. Nws txhawb multi-threading, uas muaj feem xyuam rau cov kev ua tau zoo yog zoo heev. Koj yuav tau xaiv passwords recursively nested nplooj ntawv. Muaj yog ib lub npe them nyiaj yug.

Resources rau koj lub checking

Nyob rau hauv lub network muaj ntau ntau lwm yam cuab yeej ntsuam xyuas cov kev ruaj khov ntawm online chaw:

• coder-diary.ru. Tej yam yooj yim site rau kev soj ntsuam. Cia li sau qhov chaw nyob, lub chaw pab thiab nias rau ntawm "Kos". Qhov kev tshawb tej zaum yuav siv sij hawm ib tug ntev lub sij hawm, yog li ntawd koj yuav hais kom meej koj email chaw nyob nyob rau hauv thiaj li yuav tuaj nyob rau thaum xaus ntawm cov kev tshwm sim ncaj qha nyob rau hauv lub tub rau khoom mus kuaj. muaj txog 2,500 lub npe hu vulnerabilities nyob rau hauv lub site.
• https://cryptoreport.websecurity.symantec.com/checker/. Online Service daim tshev rau cov SSL thiab TLS daim ntawv pov thawj los ntawm lub tuam txhab Symantec. Nws yuav tsum tau tsuas rau qhov chaw nyob, lub chaw.
• https://find-xss.net/scanner/. Peb tes num yog ib tug nyias muaj nyias ib PHP ntaub ntawv scans websites rau vulnerabilities los yog ZIP archive. Koj yuav tau qhia lub hom ntawm cov ntaub ntawv yuav tsum tau kuaj thiab cov cim, uas yog shielded los ntawm cov ntaub ntawv nyob rau hauv tsab ntawv.
• http://insafety.org/scanner.php. Scanner mus kuaj qhov chaw hauv platform "1C-Bitrix". Tej yam yooj yim thiab intuitive interface.

Lub algorithm rau PP rau vulnerabilities

Tej network kev ruaj ntseg cov kws ua ib daim tshev rau ib tug yooj yim algorithm:

1. Thaum xub thawj nws manually los yog los ntawm kev siv cia cov cuab yeej tsom xam seb puas muaj tej yam online ruaj khov. Yog hais tias yog, ces nws txiav txim lawv hom.
2. Nyob ntawm seb lub hom tam sim no kom txhob raug ua ntxiv tsiv. Piv txwv li, yog hais tias peb paub tus CMS, ces xaiv rau qhov uas haum txoj kev nres. Yog hais tias nws yog ib tug SQL-txhaj tshuaj, cov xaiv queries mus rau lub database.
3. Lub hom phiaj tseem ceeb yog yuav tau privileged nkag tau mus rau tus thawj tswj vaj huam sib luag. Yog hais tias nws twb tsis tau mus cuag xws li, tej zaum nws yog tsim nyog mus sim thiab tsim tau ib cov fake chaw nyob nrog cov kev taw qhia ntawm nws tsab ntawv nrog rau tom ntej hloov lwm lub tsev ntawm tus neeg.
4. Yog hais tias tej nres los yog allergic tsis, nws pib sau cov ntaub ntawv: yog muaj ntau ruaj khov uas tsis xws luag yog tam sim no.
5. Raws li cov ntaub ntawv kev ruaj ntseg cov kws muaj txuj hais tias lub site tswv txog cov teeb meem thiab yuav ua li cas los daws lawv.
6. Vulnerabilities yog tshem tawm nrog nws ob txhais tes los yog nrog kev pab los ntawm peb-tog masters.

Ib tug ob peb kev nyab xeeb tswv yim

Cov neeg uas yog nws tus kheej npaj nws tus kheej lub website, yuav pab rau qhov yooj yim lub tswv yim thiab tricks.

Khoom cov ntaub ntawv yuav tsum tau lim thiaj li hais tias cov scripts los yog queries yuav tsis khiav sawv-ib leeg los yog mus muab cov ntaub ntawv los ntawm lub database.

Siv complex thiab muaj zog passwords mus saib tau cov thawj coj vaj huam sib luag, nyob rau hauv kev txiav txim kom tsis txhob muaj ib tug ua tau brute quab yuam.

Yog hais tias lub website yog raws li nyob rau hauv ib lub CMS, koj yuav tsum kom sai li sai raws li pov thawj plugins, templates thiab modules yuav ua tau nquag hloov nws thiab thov. Tsis txhob tshooj lub site nrog ruaj Cheebtsam.

Feem ntau mus saib cov neeg rau zaub mov cav rau tej yam txawv txawv occurrences los yog kev ua.

Xyuas koj tus kheej qhov chaw ob peb scanners thiab cov kev pab cuam.

Qhov tseeb neeg rau zaub mov configuration - tus yuam sij rau nws ruaj khov thiab muaj kev nyab xeeb lub lag luam.

Yog hais tias tau, siv ib tug SSL daim ntawv pov thawj. Qhov no yuav tiv thaiv kom txhob interception ntawm tus kheej los yog cov ntaub ntawv npog ntawm lub neeg rau zaub mov thiab cov neeg siv.

Seev kev ruaj ntseg. Nws ua rau kev txiav txim zoo rau nruab los yog txuas lub software los mus tiv thaiv intrusion thiab lwm ntshai heev txawm.

xaus

Cov tsab xov xwm muab zoo xaav, tab sis txawm nws yog tsis txaus los piav txog nyob rau hauv kom meej txhua yam ntawm network kev ruaj ntseg. Yuav kom tiv nrog qhov teeb meem ntawm cov ntaub ntawv kev ruaj ntseg, nws yog tsim nyog los kawm ib tug ntau ntawm cov ntaub ntawv thiab cov lus qhia. Thiab kuj yuav kawm ib Rev ntawm cov cuab yeej thiab technologies. Koj muaj peev xwm nrhiav tswv yim thiab kev pab los ntawm cov chaw uas paub txhij txhua nyob rau hauv Pentest thiab tshawb web resources. Txawm hais tias cov kev pab cuam, thiab yuav tig mus rau hauv ib tug zoo npaum li cas, tag nrho cov tib qhov chaw ruaj ntseg yuav ua tau ntau npaum li cas kim nyob rau hauv nyiaj txiag nqe lus thiab nyob rau hauv reputational.