Práctica: Analizar un sitio web con Nikto y Spiderfoot

Curso de Hacking Ético

Bienvenida y panorama general

Lo que aprenderás sobre el hacking ético

Conceptos básicos sobre hacking ético

Vulnerabilidades

Amenazas y ataques comunes

Instalación del entorno de pruebas Kali Linux

Instalación del entorno de pruebas Mutillidae

Instalación del entorno de pruebas Metaesplotaible 3

Práctica: Cross-Site-Scripting, command injection y directorio transversal

Introducción al Hacking Ético

Fases del hacking

Tipos de hacking

Práctica: Obteniendo información de fuentes abiertas con OSINT Framework y Google hacking

Práctica: Analizar un sitio web con Nikto y Spiderfoot

¿Es necesario un hacking ético? Hacking ético como profesión

Pentesting

Conceptos. ¿qué es y qué no es pentesting?

Tipos de pentesting. Fase Pre-ataque

Práctica: Buscando secretos en repositorios GIT

Introducción al escaneo de redes

Práctica: Escaneo de redes con Nmap

Fase de Ataque. Testing de aplicaciones web con Burp suite

Práctica: Explotando vulnerabilidades en metasploitable

Fase Post-ataque. Metodologías

Estándares y aspectos legales

PCI DSS. HIPAA. DMCA.ISO/IEC 27001

Contratos, Reglas de compromisos, Cláusula de no competencia y Acuerdo de confidencialidad

Convenio de Budapest. ¿Cómo vamos en América latina? Salvaguarda de evidencias digitales

Casos típicos de ataques

Malware y Análisis estático de malware

Malware y Análisis dinámico de malware

Sniffing y Cómo realizar un ataque Man in the middle automatico

Sniffing y Cómo realizar un ataque Man in the middle manual

Denegación de servicio. Ataque DOS con LOIC y HOIC

Ingeniería social

Controles y mecanismos de seguridad

Políticas de seguridad. Seguridad física y Controles de acceso

Práctica: Bypass autenticación QR (Reto 6 SANS Holiday hack)

Copias de seguridad. Defensa en lo profundo

Práctica: instalación del IDS snort

Gestión de riesgos y modelado de amenazas

You don't have access to this class

Keep learning! Join and start boosting your career

If you already have an account,

Resources

How to use hacking tools in your search?

In this class, you will delve into the exciting world of ethical hacking, using tools such as Nmap, Nikto and Dirbuster in the context of the vulnerability analysis and discovery phase. These tools are essential for solving hacking challenges effectively and uncovering hidden information that could be critical. We will explore step-by-step how to operate these tools and how to adjust the generated reports to facilitate your analysis, allowing you to implement what you learned in challenge number two of the Sanz Holiday Hack Challenge.

How to start hacking tools in Kali Linux?

Before you start, you need to have a virtual machine configured with Kali Linux, a popular environment for ethical hacking. Log in to the system and open a console to start using the tools.

Configure the virtual machine:
- Start Kali Linux.
- Open a terminal console.
Determine the IP address:
- Use ifconfig to identify the IP address of the machine you are going to analyze.

ifconfig

Start scanning with Nikto:
- Run Nikto to identify vulnerabilities or weak configurations on the web server.

nikto -h http://192.168.2.4/mutillidae/

How to generate an HTML report with Nikto?

Generating an HTML report can be useful to share your scan results or to review them more clearly. Nikto allows you to create easy-to-read reports.

Command to generate HTML report:

nikto -h http://192.168.2.4/mutillidae/ -o report.html

What to do if Nikto has problems?

In recent versions, Nikto may have problems working with SSL or HTTPS. If you encounter SSL-related errors, it is useful to know about alternatives or complementary tools.

Try different OSINT tools such as Espai Git Foo:
Espai Git Foo is an excellent tool that allows you to get information from public sources and explore website structures automatically.
Installation and configuration of Espai Git Foo:
- Download from the official page.
- Installation commands:

pip install lxml requests cryptography beautifulsoup4.

Run Espai Git Foo:

Locate the installation directory and run the script:

python3 sf.py

How to use Espai Git Foo to solve challenges?

Espai Git Foo, with its data fetching and analysis capabilities, can be used to solve challenge number two of the Sanz Holiday Hack Challenge. This tool scans and identifies valuable resources you might need to overcome the challenge.

Steps to use Espai Git Foo:
- Go to "New Scan", assign a name and define the target without including the HTTPS prefix.
- Start the scan and observe the results in the "Browser" section.
- Review relevant documents and links to discover clues that point to the solution.

It is important to explore and experiment with different methods, as there is no single path to solving a hacking challenge. Learning will be about adapting and learning from each technique applied. Keep practicing and don't hesitate to participate in forums and communities to share your discoveries and ask questions - go ahead, the world of ethical hacking awaits you!

Contributions 43

Questions 10

Sort by:

Want to see more contributions, questions and answers from the community?

qAdeAlumnop