Web on nix4cyber

Data Exfiltration

Mon, 01 Jan 0001 00:00:00 +0000

Data Exfiltration is a post-exploitation technique used in cybersecurity to secretly and successfully transfer sensitive, unauthorized data from a protected network or computer system to an external location, often bypassing security controls and monitoring systems.

Discovery

Mon, 01 Jan 0001 00:00:00 +0000

Discovery, often known as Reconnaissance or Information Gathering, is the crucial initial phase in any security assessment or penetration test where the objective is to passively and actively find targets, map network topology, enumerate subdomains, locate hidden files, and identify potential points of entry before attempting exploitation.

Resources

Mon, 01 Jan 0001 00:00:00 +0000

PayloadsAllTheThings

A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques!

SQLmap

Mon, 01 Jan 0001 00:00:00 +0000

SQLmap is an open-source tool that automates the detection and exploitation of SQL Injection vulnerabilities. It is the essential tool for web penetration testing.

Basic Commands

Action	Command
Simple test	`sqlmap -u $url`
POST Request	`sqlmap -u $url --data "username=test&password=test"`
List databases	`sqlmap -u $url --dbs`
List tables	`sqlmap -u $url -D $dbname --tables`
List columns	`sqlmap -u $url -D $dbname -T $table --columns`
Data Dump	`sqlmap -u $url -D $dbname -T $table -C "COL1,COL2" --dump`

Injection Techniques

SQLmap can use various techniques to extract data. You can specify them to refine your search.