How to install Web for Pentester VM in Oracle Virtual Box

Web for Pentester is a pre-configured Virtual Machine ISO prepared for practicing Web Pentesting by PentesterLab. They also provide a course about Web penetration testing along with it. The course page can be found here. So its highly recommended to reviewing the course material to get a better understanding of the topic. This particular vulnerable VM focuses on web application pentesting and its fundamental elements. You can download the VM ISO from here.

Note : Some screenshots are small in sizes, so to saw them in big size please click on it.

Read more »

How to use THC Hydra for bruteforcing Web app Login Forms

Hydra is an online login cracker and form bruteforcer which supports numerous protocols to attack. It is very fast and flexible and this tool makes it possible for researchers and security consultants to show how easy it would be to gain unauthorized access to a system remotely. There are already several login hacker tools available, however none does either support more than one protocol to attack or support parallelized connects. Hydra can be used and compiled cleanly on Linux, Windows/Cygwin, Solaris, FreeBSD/OpenBSD, QNX (Blackberry 10) and OSX. THC Hydra tool supports the following protocols:

Read more »

Wfuzz : How to install, Configure and start with wfuzz in linux based systems (Ubuntu)

Wfuzz is a Python-based flexible web application bruteforcer that can be considered an alternative to Burp Intruder as they both have some common features. It supports various methods and techniques to expose web application vulnerabilities. With Wfuzz we can audit parameters, authentication, forms with brute-forcing GET and POST parameters, cookies, forms, discover unlinked resources such as directories/files, headers and so on.

Read more »