The OWASP Top 10 is a widely recognized list of the most critical security risks for web applications. It is updated every few years based on data analysis and community feedback. The latest version, released in 2021, introduces some new categories and changes some existing ones to reflect the current threat landscape. As developers, we…
Continue reading →
If you are a penetration tester, you might need to crack passwords on Linux systems as part of your engagements. One of the tools you can use for this purpose is John the Ripper (JtR), an open source password cracker that supports many encryption and hashing algorithms. This blog post is intended to provide an educational…
Continue reading →
In this article we will investigate other functionalities of the Cyber Security test tool Hydra. In one of the previous articles we cracked a user password on a Linux system through SSH. In this example we do not know the exact username of any FTP user. We will create a list of possible usernames along…
Continue reading →
The OWASP Top 10 is a standard awareness document that lists the most common weaknesses of modern web applications. Burp Suite will help our application security testing along the Developer Mode of the browser. We will break in to the OWASP Juice Shop, the most modern and sophisticated insecure web shop. Important note: hacking in…
Continue reading →
In the first part of this series we found out a user’s password with Hydra with simply attacking his account via SSH. It is a so called “dictionary attack”, and because of the lack of security measurements we could get into the remote system. In this exercise we continue our Ethical Hacking journey and we…
Continue reading →
In this presentation we will crack the password of a general Linux user via SSH in our personal lab. The machine from which we start the attack is a Kali Linux box, and the attacked machine is an ordinary Debian Linux on which a user set a weak password. Unfortunately the security settings are weak…
Continue reading →