Les nouveautés et Tutoriels de Votre Codeur | SEO | Création de site web | Création de logiciel

seo Download XSS Exploits Cross Site Scripting Attacks and Defense book free 2013

Seo Master present to you:

Download XSS Exploits Cross Site Scripting Attacks and Defense book free 

Download XSS Exploits Cross Site Scripting


today i am going to share very interesting book XSS Exploits Cross Site Scripting Attacks and Defense download free. most of my fans and followers ask so many question about cross site scripting XSS n how to find cross site scripting xss . so that's why i am going to share this book with you . 

Download XSS book free


i have share in my previous articles how to find cross site scripting XSS and so many other article related to others vulnerability. if you don't know what is cross site scripting XSS vulnerability so read my previous articles.     

Download from here 

Download cross site scripting XSS book


2013, By: Seo Master

seo How to recover your hacked Wordpress blog ? 2013

Seo Master present to you:

How to recover your hacked WordPress blog or website 



                                      recover hacked Wordpress blog

WordPress is one of the most popular content management systems at present. and at same time it is Most targeted as well. so today i will teach you some tips and Methods on how to patch/recover your site when your website is hacked (which is hosted on WP) and this post is also for those who want to keep there WordPress sites safe.


How to recover Hacked Wordpress website 

if your WP website is attacked then follow these steps and get your site back.

Backup - if your website is infected to a small extent then it is still much necessary for you to secure the backup of your website before waiting to see your things changing to worse.you can use Plugin called BackupBuddy for this purpose but, i advice you to use UpdraftPlus Backup because it is free plugin and best alternate of Backupbuddy.

Change Login Details and Secret Access Keys – at the time you feel or see that your site is defaced then immediately check whether your login details are changed or not because some hackers didnt change login details in hurry. so if hacker did'nt changed your login details then quicky change login details and Wp-config secret access keys too.

Running scanners - The scanner are basically used to identify compromises at database level You can try out Cloud Sites WP Scanner plug-in or Sucuri Malware Scanner. After running the scanner you can proceed to next step.


                                                 recover hacked Wordpress website


Installing Your WordPress Again – Next important step involves Deleting all the files existing in the directory of WordPress except wp-config.php file and wp-content directory. After that you need to download and install a totally fresh copy of WordPress.

Review content folder - check all the folders in wp-content directory if you feel some folder does'nt belong to your site or seems sespicious then remove it , dont worry if you mistakenly removed any folder which is part of your blog and is not suspicious then you can get it back through backup files after even removing.

Review Plug-ins - Now this is time to analyza all your plug-ins simply remove all plug-ins from your Panel which you did'nt use and other plug-ins which you need should be uninstalled and INSTALLED again for security purposes.

Check your .htaccess file for hacks-  Hackers can use your .htaccess to redirect to malicious sites from your URL. Look in the base folder for your site, not just your blog's folder. Hackers will try to hide their code at the bottom of the file, so scroll down. They may also change the permissions of the .htaccess file to stop newbies from editing the file. Change the permissions back to 644.

Now analyze your theme- 
 task of removing the extra themes which are not in use currently. Next task again involves reviewing your activated theme. Look through the PHP or Javascript code to find out any suspicious activity there. Most of the time hackers make such malicious changes in header.php or footer.php files.
2013, By: Seo Master

seo how to find xss cross site scripting vulnerability in website 2013

Seo Master present to you:

 how to find xss cross site scripting vulnerability in website xss scripting

Today we will discuss how to find Cross site scripting XSS in common website. As I am security Researcher I have found many Cross site scripting XSS Vulnerabilities in website. So cross site scripting XSS is find not a difficult task but if you are newbie so May you have face some problems to Find  xss scripting in starting . 
But if you read my previous article that what is cross site scripting XSS and its types then you just have idea about how to find Cross site scripting XSS. and I have also share a tutorial how to find vulnerable website so now then you have to able to find cross site scripting . So let’s start  
First of all you have to find the input filed like search bar, Login page, subscribe by email and Contact us page. If you find input then we can inject over payload in the input field.

The question is that what is Payload or vector?

Payload or vector is a JavaScript code which we can insert in input field to find XSS scriptin.

So here I have taken a one example of vulnerable website

I have searched my news on website and I am searching a news for nomanramzan but as you seen in below picture no news found on nomanramzan and after that you just right click on the anywhere of website and click on View page source 
 xss scripting xss


Then press CTRL + F for search nomanramzan and Note the location where the input is placed. as you seen in below picture website taken an input and search value for nomanramzan . so now the important step is that we have put out nomanramzan from “ ”
xss cross site scripting bug

Now I am going to check whether the server sanitize the input or not .  If I am giving the input this <> in input field . Sometime server sanitized the code and then code look like this &lt;&gt;.

So now in this condition website server not sanitize our input and this indicate that the website is vulnerable to XSS Now finally I have put a Payload 

 "><img src=x onerror=prompt(1);>

In the search bar then you have seen below picture. Now it will display pop-up box. So finally we have successfully find a cross site scripting XSS 
 cross site scripting vulnerability

Then again right click on website and then press CTRL + F for search for the payload "><img src=x onerror=prompt(1);> or value and finally you have checked that over payload put out from “” .
how to find xss cross site scripting vulnerability in website

Finally we have find a cross site scripting XSS vulnerability . Hopefully you enjoyed this tutorial. If you have any problem so you can comment below
2013, By: Seo Master

seo How to find vulnerable website for XSS | SQLI | LFI | RFI 2013

Seo Master present to you:

 How to find vulnerable website for XSS | SQLI | LFI | RFI

Most of the people search in Google or other search engine to check the vulnerable website and in the end some are successful and some are not. This is also problem for newbie who don’t know how to check the vulnerable website.in starting When I was also found vulnerable website. so its very difficult for me and then later on I have researched on it and Now i make some Google Dorks for check vulnerable website for you.

google dorks xss sqli

So in my previous article I have explained that the top vulnerabilities and also tutorials on Cross site scripting. So it’s very easy to find vulnerable website with the help of search engine.

There are lot of dorks to check the website is it vulnerable or not. So you think that the lot of people use these Google dorks already. So you have to use your mind and check some another technique also. When you search in Google you have to check below of search bar some tools. so use these tools also like I give you one example the website update in 24 hours before .  I have also search like below 

google search engine tricks

Check website for Cross site scripting XSS:

inurl:".php?search="

inurl:".php?searchstring="


inurl:search.php?q=


inurl:com_feedpostold/feedpost.php?url=


inurl:/poll/default.asp?catid=

 

inurl:/search_results.php?search=
 
inurl:scrapbook.php?id=
 

inurl:headersearch.php?sid=

Check website for SQL injection SQLI:


inurl:"id=" & intext:"Warning: mysql_fetch_assoc()

inurl:"id=" & intext:"Warning: mysql_num_rows()

inurl:"id=" & intext:"Warning: session_start()

inurl:"id=" & intext:"Warning: mysql_fetch_array()

inurl:"id=" & intext:"Warning: session_start()

inurl:"id=" & intext:"Warning: getimagesize()
inurl:"id=" & intext:"Warning: is_writable()
inurl:"id=" & intext:"Warning: getimagesize()
inurl:"id=" & intext:"Warning: Unknown()
inurl:"id=" & intext:"Warning: require()
inurl:"id=" & intext:"Warning: mysql_result()
inurl:"id=" & intext:"Warning: pg_exec()
inurl:"id=" & intext:"Warning: mysql_result()
inurl:"id=" & intext:"Warning: mysql_num_rows()
inurl:"id=" & intext:"Warning: mysql_query()
inurl:"id=" & intext:"Warning: array_merge()
inurl:"id=" & intext:"Warning: preg_match()

How to check Sub domain :

If you want to find vulnerabilities of website . so you should go for sub domain. The best dork for searching subdomain is below 
Site: URL –inurl:www
Like if I want to find the subdomain of Google . so it’s like below and don’t add Http and www with the domain 
Site: google.com –inurl:www

check subdomain dorks


Hope you like my tutorials. If you want to ask any question you can ask me thanks  
2013, By: Seo Master

seo what is cross site scripting XSS and types of cross site scripting XSS 2013

Seo Master present to you:

 what is cross site scripting XSS and its types

Today I will explain you what is cross sitescripting. In my previous article I have explained that the top security flaw in a website. According to the open web application security project cross site scripting XSS is very common security flaw in the website. This threat very dangerous for the website. Most of my fans and followers ask so many questions about cross site scripting XSS. As I am security researcher I have also found 100 Cross site scripting XSS on website.so I am going discuss with you complete guide of cross site scripting So guys lets  

what is cross site scripting

If you want to find Cross sitescripting XSS so you have to learn following prerequisite

Basic Knowledge in Hypertext markup language (HTML)
Strong Knowledge of JavaScript
Basic knowledge of HTTP client server Architecure
Basic knowledge of (PHP, ASP.NET)

What is cross site scripting XSS?

Cross site scripting XSS is one of the common website security flaws that allow a Hacker | Attacker to run his client side scripts like JavaScript’s payload into website that is viewed by others. with the cross site scripting bug may be hacker bypass access control .if hacker successfully exploit cross site scripting XSS so then hacker easily do steal account, phishing attack and many more. In simple word with the help of cross site scripting XSS hacker inject his malicious JavaScript payload into website then a user visit the website link then it will execute the malicious JavaScript payload.

Types of Cross site scripting XSS:

There are two types of Cross site scripting XSS
                1.      Persistent XSS ( Stored XSS)
                2.      Non persistent XSS ( Reflective XSS)

noman ramzan cross site scripting

Persistent Cross site scripting XSS:

The persistent XSS also known as stored XSS. As shown with the name of stored XSS and this Cross site scripting XSS stored somewhere. When attacker used Cross site scripting XSS malicious code inject into the website and then this payload saved by the server in the database  and then is will run in the normal link of website.

Example of persistent XSS

There are so many website which support the forum and where the user register and ask a question like answer.yahoo.com. if the Hacker post a message with the malicious JavaScript payload then if the server fail to sanitize the payload and then code execute easily. So whenever user read to this post and open a link then inject code cookie stealing of a user and then hacker easily bypass his account.

NON persistent Cross site scripting  XSS:

Non persistent also known as reflected XSS. This is very common vulnerability discover by security Researchers. And this is find in the search filed like search, contact page and subscribe email. in this attack hacker inject payload will send to the server with the request of HTTPrequest and then server embed with html file and then return HTTPresponse to the browser. When the browser execute the file and then it’s also execute the scripts. so it’s a reflective XSS.

DOM based Cross site scripting XSS:

In the addition to these types DOM based XSS also third type of cross site scripting XSS. This is very important part of XSS. Most of the big website like Microsoft, PayPal, Nokia, eBay and many more website. Later on IN SHA ALLAH I will explain more about DOM based XSS.

XSS attack cross site scripting

 so in my next tutorials . i will tell you about how to find Cross site scripting XSS. and if you have any problem or any quary so you can ask me   
2013, By: Seo Master

seo owasp top vulnerability | Cross site scripting XSS | SQLI | CSRF | LFI | RFI 2013

Seo Master present to you:

 owasp top vulnerability | Cross site scripting XSS | SQLI | CSRF | LFI | RFI

 Ethical Hacking is very important part for the website and other domain. Now a day’s Hacker easily access on the website. With the common mistakes of developer’s, website owner has been in trouble. As I am security Researcher I have also found 1000 of security flaw in website. I have reported it. Like Microsoft, opera, adobe, Nokia, Braintree, soundcloud, eBay. But now a day’s Hackers easily access on website database. But in the same way Ethical hacker’s (Security Researcher) or white hacker’s done the job. And save the website from the black hat hacker’s. There are lots of security flaws (vulnerability) in website. According the open web application security project (OWSAP) there are lots of security flaw in website. This is top ten security flaw as follow 


 owasp top vulnerability

A1 – Injection

Injection flaws, such as SQL, OS, and LDAP injection occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing unauthorized data.

A2 – Broken Authentication and Session Management 

Application functions related to authentication and session management are often not implemented correctly, allowing attackers to compromise passwords, keys, session tokens, or exploit other implementation flaws to assume other users’ identities.

XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation or escaping. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.

A4 – Insecure Direct Object References

•A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, or database key. Without an access control check or other protection, attackers can manipulate these references to access unauthorized data.

A5 – Security Misconfiguration

Good security requires having a secure configuration defined and deployed for the application, frameworks, application server, web server, database server, and platform. All these settings should be defined, implemented, and maintained as many are not shipped with secure defaults. This includes keeping all software up to date.

A6 – Sensitive Data Exposure

Many web applications do not properly protect sensitive data, such as credit cards, tax ids, and authentication credentials. Attackers may steal or modify such weakly protected data to conduct identity theft, credit card fraud, or other crimes. Sensitive data deserves extra protection such as encryption at rest or in transit, as well as special precautions when exchanged with the browser.

A7 – Missing Function Level Access Control

Virtually all web applications verify function level access rights before making that functionality visible in the UI. However, applications need to perform the same access control checks on the server when each function is accessed. If requests are not verified, attackers will be able to forge requests in order to access unauthorized functionality.

A8 - Cross-Site Request Forgery (CSRF)

A CSRF attack forces a logged-on victim’s browser to send a forged HTTP request, including the victim’s session cookie and any other automatically included authentication information, to a vulnerable web application. This allows the attacker to force the victim’s browser to generate requests the vulnerable application thinks are legitimate requests from the victim.

A9 - Using Components with Known Vulnerabilities

Vulnerable components, such as libraries, frameworks, and other software modules almost always run with full privilege. So, if exploited, they can cause serious data loss or server takeover. Applications using these vulnerable components may undermine their defenses and enable a range of possible attacks and impacts.

A10 – Unvalidated Redirects and Forwards

Web applications frequently redirect and forward users to other pages and websites, and use untrusted data to determine the destination pages. Without proper validation, attackers can redirect victims to phishing or malware sites, or use forwards to access unauthorized pages.

So this is top ten vulnerability which is very common. So in my next tutorials I will explain you that how to find a vulnerability in website. If you have any problem regarding vulnerability so comment below or you can directly contact with me. click here
2013, By: Seo Master
Powered by Blogger.