Showing posts with label Penetration Testing. Show all posts
Showing posts with label Penetration Testing. Show all posts
Mobile Penetration Testing of Android Applications
Friday, October 31, 2025
Computer security is no more about PCs. Is your TV, fridge and mobile phone. Learn to audit mobile apps!
Preview this Course
Description
You already know some computer and network ethical hacking? What about moving forward and applying it to mobile apps as well? This course is for the beginners and may be useful for some advanced users as well.
Android Hacking and Penetration Testing course is a hands-on video course. The course will focus on the tools and techniques for testing the Security of Android Mobile applications. Android, the Google operating system that’s on 80% of the world’s smartphones. In extreme cases, hackers with malicious intent can do much more than send premium text messages. In this video you will learn how to hack Android applications.
In this course you will apply web hacking techniques you already know on Android environment. Furthermore, we are going to explore OWASP Top Ten Mobile and Web most common vulnerabilities. This is an intermediate level course.
Who this course is for:
- penetration testers, security professionals and amateurs
- web and mobile application developers
- security enthusiasts
Website Hacking / Penetration Testing & Bug Bounty Hunting
Saturday, October 23, 2021
Free Coupon Discount - Website Hacking / Penetration Testing & Bug Bounty Hunting, Become a bug bounty hunter! Hack websites & web applications like black hat hackers and secure them like experts.| Created by Zaid Sabih, z Security
Students also bought
- Learn Python & Ethical Hacking From Scratch
- Introduction to Cybercrime
- ARP spoofing &Man In The Middle Attacks Execution &Detection
- Hands-On Ethical Hacking and Network Security Applied 2020
- The Complete Cyber Security Course : End Point Protection!
Preview this Udemy Course GET COUPON CODE
Description
Note: The contents of this course are not covered in any of my other courses except for some basics. Although website hacking is covered in one of my other courses, that course only covers the basics where this course dives much deeper in this topic covering more techniques, more vulnerabilities, advanced exploitation, advanced post exploitation, bypassing security and more!
Welcome to my this comprehensive course on Website penetration testing. In this course you'll learn website / web applications hacking & Bug Bounty hunting! This course assumes you have NO prior knowledge in hacking, and by the end of it you'll be at a high level, being able to hack & discover bugs in websites like black-hat hackers and secure them like security experts!
This course is highly practical but it won't neglect the theory, first you'll learn how to install the needed software (on Windows, Linux and Mac OS X) and then we'll start with websites basics, the different components that make a website, the technologies used, and then we'll dive into website hacking straight away. From here onwards you'll learn everything by example, by discovering vulnerabilities and exploiting them to hack into websites, so we'll never have any dry boring theoretical lectures.
Before jumping into hacking, you'll first learn how to gather comprehensive information about the target website, then the course is divided into a number of sections, each section covers how to discover, exploit and mitigate a common web application vulnerability, for each vulnerability you will first learn the basic exploitation, then you will learn advanced techniques to bypass security, escalate your privileges, access the database, and even use the hacked websites to hack into other websites on the same server.
All of the vulnerabilities covered here are very common in bug bounty programs, and most of them are part of the OWASP top 10.
You will learn how and why these vulnerabilities are exploitable, how to fix them and what are the right practices to avoid causing them.
Here's a more detailed breakdown of the course content:
1. Information Gathering - In this section you'll learn how to gather information about a target website, you'll learn how to discover its DNS information, the services used, subdomains, un-published directories, sensitive files, user emails, websites on the same server and even the hosting provider. This information is crucial as it increases the chances of being able to successfully gain access to the target website.
2. Discovery, Exploitation & Mitigation - In this section you will learn how to discover, exploit and mitigate a large number of vulnerabilities, this section is divided into a number of sub-sections, each covering a specific vulnerability, firstly you will learn what is that vulnerability and what does it allow us to do, then you will learn how to exploit this vulnerability and bypass security, and finally we will analyse the code causing this vulnerability and see how to fix it, the following vulnerabilities are covered in the course:
File upload - This vulnerability allow attackers to upload executable files on the target web server, exploiting these vulnerabilities properly gives you full control over the target website.
Code Execution - This vulnerability allow users to execute system code on the target web server, this can be used to execute malicious code and get a reverse shell access which gives the attacker full control over the target web server.
Local File Inclusion - This vulnerability can be used to read any file on the target server, so it can be exploited to read sensitive files, we will not stop at that though, you will learn two methods to exploit this vulnerability to get a reverse shell connection which gives you full control over the target web server.
Remote File Inclusion - This vulnerability can be used to load remote files, exploiting this vulnerability properly gives you full control over the target web server.
SQL Injection - This is one of the most dangerous vulnerabilities, it is everywhere and can be exploited to do all of the things the above vulnerabilities allow us to do and more, so it allows you to login as admin without knowing the password, access the database and get all data stored there such as usernames, passwords, credit cards ....etc, read/write files and even get a reverse shell access which gives you full control over the target server!
Cross Site Scripting (XSS) - This vulnerability can be used to inject javascript code in vulnerable pages, we won't stop at that, you will learn how to steal credentials from users (such as facebook or youtube passwords) and even gain full access to their computer.
Insecure Session Management - In this section you will learn how to exploit insecure session management in web applications and login to other user accounts without knowing their password, you'll also learn how to discover and exploit CSRF (Cross Site Request Forgery) vulnerabilities to force users to change their password, or submit any request you want.
Brute Force & Dictionary Attacks - In this section you will learn what are these attacks, the difference between them and how to launch them, in successful cases you will be able to guess the password for a target user.
3. Post Exploitation - In this section you will learn what can you do with the access you gained by exploiting the above vulnerabilities, you will learn how to convert reverse shell access to a Weevely access and vice versa, you will learn how to execute system commands on the target server, navigate between directories, access other websites on the same server, upload/download files, access the database and even download the whole database to your local machine. You will also learn how to bypass security and do all of that even if you did not have enough permissions!
With this course you get 24/7 support, so if you have any questions you can post them in the Q&A section and we'll respond to you within 15 hours.
Notes:
This course is created for educational purposes only and all the attacks are launched in my own lab or against systems that I have permission to test.
This course is totally a product of Zaid Sabih & zSecurity, no other organization is associated with it or a certification exam. Although, you will receive a Course Completion Certification from Udemy, apart from that NO OTHER ORGANIZATION IS INVOLVED.
Who this course is for:
Anybody interested in learning website & web application hacking / penetration testing.
Anybody interested in becoming a bug bounty hunter.
Anybody interested website hacking.
Anybody interested in learning how to secure websites & web applications from hacker.
Web developers so they can create secure web application & secure their existing ones.
Web admins so they can secure their websites.
100% Off Udemy Coupon . Free Udemy Courses . Online Classes
Web Security & Bug Bounty: Learn Penetration Testing in 2021
Friday, October 22, 2021
Web Security & Bug Bounty: Learn Penetration Testing in 2021, Become a bug bounty hunter! Learn to hack websites, fix vulnerabilities, and improve web security online for clients.
Online Courses Udemy GET COUPON CODE
What you'll learn
- Learn Penetration Testing from scratch to become a bug bounty hunter and web security expert
- Discover, exploit, and mitigate all types of web vulnerabilities. Secure any of your future applications using best practices
- Setting up your Hacking Lab: Kali Linux and Virtual Machines (Works with Windows/Mac/Linux)
- How to make money from Bug Bounty Hunting and make a career of it
- Attacking Systems With Known Vulnerabilities
- Website Enumeration & Information Gathering
- Bug Hunter and the Burpsuite Tool
- HTML Injections
- Command Injection/Execution
- Broken Authentication
- Brutefroce Attacks
- Broken Access Control
- Security Misconfiguration
- Cross Site Scripting - XSS
- SQL Injection
- XML, XPath Injection, XXE
- Logging And Monitoring Best Practices
- Web Fundamentals
- Networking Fundamentals
- Linux Terminal Fundamentals
Description
Just launched with all modern Bug Bounty and Penetration Testing tools and best practices for 2021! Join a live online community of over 500,000+ students and a course taught by industry experts. This course will take you from absolute beginner, all the way to becoming a security expert and bug bounty hunter to improve security for your clients and any future web applications you may create!
This course is focused on learning by doing. We are going to teach you how penetration testing works, by actually practicing the techniques and methods used by bug bounty hunters today. We will start off by creating our virtual hacking lab to make sure we keep your computers safe throughout the course, as well as doing things legally, and having our computers set up for penetrations testing.
We dive into topics like:
1) Introduction To Bug Bounty:
Here we just touch on theory of what exactly is Bug Bounty and Penetration Testing
Quick example of one vulnerability that we will cover.
Pen Tester career path.
2) Our Virtual Lab Setup:
Create our virtual lab that we will use throughout the course (Kali Linux machine).
Install a vulnerable VM called OWASPBWA that we will attack.
Create an online account on TryHackMe platform.
With almost every vulnerability, we will cover an example on TryHackMe and also on our vulnerable Virtual Machine.
From here choose 2 different paths depending on the knowledge that you already have.
3) Website Enumeration & Information Gathering
This is where we start with the practical Bug Bounty/ Website Penetration Testing. We cover numerous tactics and tools that allow us to gather as much information about a certain website. For this, we use different tools like Dirb, Nikto, Nmap. We also use google hacking which is useful skill to have once tools are not available.
4) Introduction To Burpsuite
This is a very important tool for a Bug Hunter. Pretty much every Bug Hunter out there knows about this tool (and probably uses it). It has many different features that make hunting for bugs easier. Some of those features are crawling the webpage, intercepting and changing HTTP requests, brute-force attacks and more.
5) HTML Injection
This is our first bug. It's also one of the easiest so we start with it. HTML injection is essentially just finding a vulnerable input on the webpage that allows HTML code to be injected. That code is later rendered out on the page as real HTML.
6) Command Injection/Execution
Our first dangerous bug. Injecting commands is possible when server runs our input through its system unfiltered. This could be something like a webpage that allows us to ping other websites but doesn't check whether we inputed a different command other than the IP address that it needs. This allows us to run commands on the system, compromise system through a reverse shell and compromise accounts on that system (and all the data).
7) Broken Authentication
This is another vulnerability that occurs on websites. It essentially refers to weakness in 2 areas session management and credential management. It allows the attacker to impersonate legitimate users online. We show different examples through cookie values, HTTP requests, Forgot password page etc.
8) Brutefroce Attacks
This can be a problem even if the website is secure. If client has an easy and simple password set, then it will be also easy to guess it. We cover different tools used to send lots of password on the webpage in order to break into an account.
9) Sensitive Data Exposure
This isn't a vulnerability in the system. Instead it's when developers forget to remove important information during production that can be used to perform an attack. We cover an example where developer forgot to remove the entire database from being accessible to regular users.
10) Broken Access Control
Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification or destruction of all data, or performing a business function outside of the limits of the user. Here we cover a vulnerability called Insecure direct object reference. A simple example would be an application that has user IDs in the URL. If it doesn't properly store and manage those IDs an attacker could potentially change the ID and access the information of another user.
11) Security Misconfiguration
We put this as a separate section, however all the previous vulnerabilities also belong to it. Here we show an example of a vulnerability where the admins of websites haven't changed the default credentials for a certain application that runs on their server.
12) Cross Site Scripting - XSS
This is a big vulnerability and is very common in many websites out there. This vulnerability allows us to execute Javascript code on the webpage. This is due to user input not being well filtered and processing the input as javascript code. There are 3 main types of XSS which are Stored, Reflected and DOM based XSS. We cover these 3 plus some unusual ones.
13) SQL Injection
Another big vulnerability out there and a really dangerous one. Many websites communicate with the Database, whether it being a database that stores product information or user information. If the communication between the user and the database is not filtered and checked, it could allow the attacker to send an SQL query and communicate with the database itself, allowing them to extract the entire database or even delete it. There are couple of types of SQL injection such as Error based or Blind SQL injection.
14) XML, XPath Injection, XXE
XXE or XML External Entity is a vulnerability that allows an attacker to interfere with a website that processes XML data. It could allow the attacker to run a reverse shell or read files on the target system making it another severe vulnerability.
15) Components With Known Vulnerabilities
Even if the website might not be vulnerable, the server might be running some other components/applications that have a known vulnerability that hasn't been patched yet. This could allow us to perform various types of attacks depending on what that vulnerability is.
16) Insufficient Logging And Monitoring
Logging and monitoring should always be done from security standpoint. Logging allows us to keep track of all the requests and information that goes through our application. This can help us determine whether a certain attack is taking place or if the attack already happened, it allows us to examine it a little deeper, see which attack it was, and then apply that knowledge to change the application so that the same attack doesn't happen again.
17) Monetizing Bug Bounty Hunting
After practicing and covering all the vulnerabilities, it's important to mention how we can monetize our knowledge. We mention different platforms that can be used to start your career as a bug hunter, and we also take one platform as an example to show how a bug bounty program looks like and what to pay attention to when applying.
18) Bonus - Web Developer Fundamentals
For anyone lacking some knowledge in Web Development or knowledge in how exactly websites work and are structured
19) Bonus - Linux Terminal
For anyone lacking some knowledge in simple usage of linux terminal as we will be using it throughout the course
20) Bonus - Networking
Fundamentals of networking and some basic terms used as Penetration Testers or Bug Bounty hunters.
We guarantee you this is the most comprehensive online course on bug bounty hunting, penetration testing, and web security skills! Have a look at the course outline video to see all the topics we are going to cover, all the projects we’re going to build, and all the techniques you’re going to learn to become a top penetration tester!
Taught By:
Andrei is the instructor of the highest rated technical courses on Udemy as well as one of the fastest growing. His graduates have moved on to work for some of the biggest tech companies around the world like Apple, Google, Tesla, Amazon, JP Morgan, IBM, UNIQLO etc... He has been working as a senior software developer in Silicon Valley and Toronto for many years, and is now taking all that he has learned, to teach programming skills and to help you discover the amazing career opportunities that being a developer allows in life.
Having been a self taught programmer, he understands that there is an overwhelming number of online courses, tutorials and books that are overly verbose and inadequate at teaching proper skills. Most people feel paralyzed and don't know where to start when learning a complex subject matter, or even worse, most people don't have $20,000 to spend on a coding bootcamp. Programming skills should be affordable and open to all. An education material should teach real life skills that are current and they should not waste a student's valuable time. Having learned important lessons from working for Fortune 500 companies, tech startups, to even founding his own business, he is now dedicating 100% of his time to teaching others valuable software development skills in order to take control of their life and work in an exciting industry with infinite possibilities.
Andrei promises you that there are no other courses out there as comprehensive and as well explained. He believes that in order to learn anything of value, you need to start with the foundation and develop the roots of the tree. Only from there will you be able to learn concepts and specific skills(leaves) that connect to the foundation. Learning becomes exponential when structured in this way.
Taking his experience in educational psychology and coding, Andrei's courses will take you on an understanding of complex subjects that you never thought would be possible.
--------
Aleksa is a Penetration Tester with over 5 years of experience in Ethical Hacking and Cyber Security. As a self made hacker that started from a young age he has learned it all from Ethical Hacking and Cyber Security to Online Privacy and How To Become Anonymous Online.
He has worked and discovered vulnerabilities for multiple companies and governments. He also worked as a freelancer that tested private web applications. He believes that Online Security and Privacy is something valuable but also that it doesn't get enough attention as many cyber attacks are being executed every single day! No System is Safe and that is why we are here to discover vulnerabilities and secure them before the bad guys attempt anything malicious!
His main goal as an instructor is to teach the foundations of Ethical Hacking and Cyber Security to anyone who wants to pursue this as a career or wants to learn it to protect themselves online. Cyber attacks and online security is something that changes really fast so we as hackers must always be ready to learn new things in order to better protect Networks, Websites, Machines .. and also people!
See you inside the courses!
Who this course is for:
- Anybody interested in becoming a bug bounty hunter or penetration tester
- Anybody interested in web security and how hackers take advantage of vulnerabilities
- Anybody looking to go beyond a normal "beginner" tutorial that doesn't give you a chance to practice
- Any developer looking to secure their web applications and servers from hackers
100% Off Udemy Coupon . Free Udemy Courses . Online Classes
Ethical Hacking Offensive Penetration Testing OSCP Prep
Sunday, June 7, 2020
Free Coupon Discount - Practical Hands on Offensive Penetration Testing OSCP - Beginner to Advance - Created by Abhinav Anand
Students also bought
- Hands-on Penetration Testing Labs 4.0
- Mastering thick client application penetration testing
- Website Hacking / Penetration Testing & Bug Bounty Hunting
- TOTAL: Ethical Hacking & CompTIA PenTest+ + 2 FREE Tests.
- Hands-on Penetration Testing Labs 3.0
Preview this Udemy Course GET COUPON CODE
Description
In this course,you will learn how to exploit most of OWASP Top 10 vulnerabilities,Linux & Windows 10 OS to gain root access of servers This is designed to clear OSCP certification as well as those who want to excel in Cyber Security & Ethical Hacking Domain.
1. Running NMAP & other discovery tools.
2. Exploitation of OWASP Top 10 vulnerabilities and compromise user account,Dump Databases,Deface user's application with real words scenarios
3. Penetration Testing with Kali Linux including Metasploit,AV Evasion,Gain access of a shell,Privilege Escalation & many more
4. Hacking Windows OS using Empire Powershell ,Run Mimikatz,Pass the Hash,Dumping NTLM hashes,Getting Golden Ticket,Kerbros Ticket
5. Exploitation of 10 vulnerable VMs with real world scenarios
Who this course is for:
Aspirants who are seeking carrear in information Seucurity,Information Security professional,Cyber Security Professional,Cyber Security Enthusiasts,IT Security.
Beginner in Cyber Security,Aspiring OSCP Certification,Aspiring Ethical Hackers
100% Off Udemy Coupon . Free Udemy Courses . Online Classes
Windows Privilege Escalation
Saturday, March 7, 2020
Free Coupon Discount - Windows Privilege Escalation, Finding and exploiting Windows vulnerabilities and misconfigurations to gain an administrator shell | Created by Tib3rius
Preview this Udemy Course - GET COUPON CODE
Description
This course teaches privilege escalation in Windows, from basics such as how permissions work, to in-depth coverage and demonstrations of actual privilege escalation techniques. The course comes with a full set of slides, and a script which can be used by students to create an intentionally vulnerable Windows 10 configuration to practice their own privilege escalation skills on.
Please note that this course is aimed at students currently taking, or planning to take the OSCP, and thus covers more common forms of privilege escalation. Some extra methods are included, and more methods may be added in the future, however this course was not designed to cover every possible (or obscure) method.
Who this course is for:
Beginner and intermediate ethical hackers.
Students currently taking or planning to take the PWK/OSCP course.
100% Off Udemy Coupon . Free Udemy Courses . Online Classes
Subscribe to:
Posts (Atom)