VIDEO
HIGHLIGHT
Log InSign up
5 Hacking Tools I Can't Live Without
SummaryTranscriptChat

5 Hacking Tools I Can't Live Without

Tools for Testing Web Applications

In this section, the speaker introduces the tools used for testing web applications and emphasizes the importance of manual testing alongside automation.

Firebug and Dev Tools

  • Firebug, integrated into Dev Tools in 2016-2017, allows easy inspection of pages.
  • Components like console, debugger, network tab, and storage aid in application interaction and behavior analysis.

Burp Suite and Sequencer Feature

  • Burp Suite is highlighted for its significance in testing; sequencer feature analyzes tokens for potential vulnerabilities.
  • Demonstrates configuring token analysis in Burp Suite to identify patterns and assess randomness.

Extensions for Testing Web Applications

The speaker discusses various extensions that enhance the testing process of web applications.

Useful Extensions

  • JWT editor aids in handling JSON Web Tokens efficiently.
  • Pen test mapper provides a checklist for organized testing procedures.
  • Authorize plugin is recommended for access control testing.

Testing Across Different User Accounts

Exploring tools to facilitate testing across multiple user accounts without constant re-login requirements.

Container Plugin

  • Container plugin enables separate sessions for different users, simplifying access control and session issue tests.

Fuzzing with FFUF Tool

Introduction to FFUF tool for endpoint discovery and parameter fuzzing in web applications.

Fuzz Faster You Fool (FFUF)

Results and Endpoint Discovery

In this section, the speaker discusses analyzing results, status codes, sizes, and other information from admin endpoints. Additionally, they touch on subdomain discovery using tools like ffuf and param spider.

Analyzing Endpoints

  • Admin endpoints return a 302 status code, likely redirecting to login.
  • Assets such as profile, robots, and register also show 302 redirects.
  • Subdomain Discovery can be done using ffuf with specific word lists.

Subdomain Discovery with ffuf

The speaker demonstrates how to utilize ffuf for subdomain discovery by specifying word lists and utilizing the host header.

Utilizing ffuf for Subdomains

  • Use ffuf with specified word lists like user share cyclists.
  • Employ DNS Discovery to find subdomains from top 1 million list.
  • Add host header using -H flag in ffuf command.

Filtering Results for Efficiency

This part focuses on filtering out unnecessary results by size to enhance efficiency in result analysis during subdomain discovery.

Filtering Results

  • Filter out results with a size of 1495 using FS flag in ffuf command.
  • Avoid excessive false positives by refining result filters effectively.

Utilizing Param Spider Tool

The speaker introduces the Param Spider tool for endpoint analysis and demonstrates its setup process from GitHub repository cloning to execution.

Setting Up Param Spider

  • Clone Param Spider repository from GitHub.
  • Install requirements using pip3 install -r requirements.txt.
  • Execute Param Spider tool with domain input like ecmsec.com for endpoint analysis.

Endpoint Analysis with Param Spider

The speaker showcases how Param Spider provides insights into endpoints and parameters for further analysis or functionality checks within a target domain.

Endpoint Analysis Process

  • Run Param Spider tool with -D flag followed by the domain name (e.g., ecmsec.com).
Video description

Alex dives into 5 hacking tools he loves in this video! If you have tried any of these tools yourself, let us know in the comments what you thought of them. Remember to hit the subscribe button if you enjoyed this and want to see similar content from our team in the future. #pentesting #cybersecurity #hacking101 #hackingtools #burpsuite 00:00 Intro 00:36 DevTools 01:39 BURP Suite 04:00 Containers 05:00 FFUF 07:25 ParamSpider 08:47 Outro Pentests & Security Consulting: https://tcm-sec.com Get Trained: https://academy.tcm-sec.com Get Certified: https://certifications.tcm-sec.com Merch: https://merch.tcm-sec.com Sponsorship Inquiries: info@thecybermentor.com 📱Social Media📱 ___________________________________________ Twitter: https://twitter.com/thecybermentor Twitch: https://www.twitch.tv/thecybermentor Instagram: https://instagram.com/thecybermentor LinkedIn: https://www.linkedin.com/in/heathadams TikTok: https://tiktok.com/@thecybermentor Discord: https://discord.gg/tcm 💸Donate💸 ___________________________________________ Like the channel? Please consider supporting me on Patreon: https://www.patreon.com/thecybermentor Support the stream (one-time): https://streamlabs.com/thecybermentor Hacker Books: Penetration Testing: A Hands-On Introduction to Hacking: https://amzn.to/31GN7iX The Hacker Playbook 3: https://amzn.to/34XkIY2 Hacking: The Art of Exploitation: https://amzn.to/2VchDyL The Web Application Hacker's Handbook: https://amzn.to/30Fj21S Real-World Bug Hunting: A Field Guide to Web Hacking: https://amzn.to/2V9srOe Social Engineering: The Science of Human Hacking: https://amzn.to/31HAmVx Linux Basics for Hackers: https://amzn.to/34WvcXP Python Crash Course, 2nd Edition: https://amzn.to/30gINu0 Violent Python: https://amzn.to/2QoGoJn Black Hat Python: https://amzn.to/2V9GpQk My Build: lg 32gk850g-b 32" Gaming Monitor:https://amzn.to/30C0qzV darkFlash Phantom Black ATX Mid-Tower Case: https://amzn.to/30d1UW1 EVGA 2080TI: https://amzn.to/30d2lj7 MSI Z390 MotherBoard: https://amzn.to/30eu5TL Intel 9700K: https://amzn.to/2M7hM2p G.SKILL 32GB DDR4 RAM: https://amzn.to/2M638Zb Razer Nommo Chroma Speakers: https://amzn.to/30bWjiK Razer BlackWidow Chroma Keyboard: https://amzn.to/2V7A0or CORSAIR Pro RBG Gaming Mouse: https://amzn.to/30hvg4P Sennheiser RS 175 RF Wireless Headphones: https://amzn.to/31MOgpu My Recording Equipment: Panasonic G85 4K Camera: https://amzn.to/2Mk9vsf Logitech C922x Pro Webcam: https://amzn.to/2LIRxAp Aston Origin Microphone: https://amzn.to/2LFtNNE Rode VideoMicro: https://amzn.to/309yLKH Mackie PROFX8V2 Mixer: https://amzn.to/31HKOMB Elgato Cam Link 4K: https://amzn.to/2QlicYx Elgate Stream Deck: https://amzn.to/2OlchA5 *We are a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for us to earn fees by linking to Amazon.com and affiliated sites.