← スキル一覧に戻る
pentesting-from-beginner-to-advanced
by zebbern
A Collection of penetration testing and Linux administration commands in PDFs. Include's detailed guides on tools like Nmap, Sqlmap, Hydra, and Linux system management etc..
⭐ 13🍴 3📅 2026年1月22日
Manusで実行SKILL.md
name: Pentesting from Beginner to Advanced description: | The assistant provides a structured web application penetration testing learning path from fundamentals to advanced techniques. Activate when users ask about "learning pentesting," "web security training," "OWASP vulnerabilities," "BurpSuite tutorial," "penetration testing roadmap," or "web app security course." version: "1.0.0" tags:
- training
- web-security
- owasp
- burpsuite
- learning-path
Pentesting from Beginner to Advanced
Purpose
Provide a structured learning path for web application penetration testing, progressing from foundational concepts through advanced exploitation techniques. Guide learners through each phase of the web security assessment process.
Inputs/Prerequisites
- Basic computer and networking knowledge
- Kali Linux or security-focused OS
- BurpSuite installed and configured
- Lab environment (bWAPP, DVWA, or similar)
- Web browser with developer tools
Outputs/Deliverables
- Foundational web security knowledge
- Practical exploitation skills
- Understanding of OWASP Top 10
- Ability to conduct web application assessments
- Vulnerability identification and reporting skills
Core Workflow
Phase 1: History and Fundamentals
Understanding the Internet:
- Learn how the internet was developed
- Understand client-server architecture
- Grasp basic web communication models
Key Concepts:
- HTTP protocol fundamentals
- Request/response structure
- Client vs server-side processing
Phase 2: Web and Server Technology
HTTP Protocol Basics:
HTTP Request Structure:
GET /page HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0
Accept: text/html
Cookie: session=abc123
HTTP Response Structure:
HTTP/1.1 200 OK
Content-Type: text/html
Set-Cookie: session=xyz789
<html>...</html>
Essential Concepts:
| Topic | Description |
|---|---|
| HTTP Methods | GET, POST, PUT, DELETE, OPTIONS |
| Status Codes | 200 OK, 301 Redirect, 403 Forbidden, 404 Not Found, 500 Error |
| Headers | Request and response metadata |
| Cookies | Session management, tracking |
| Sessions | Server-side state management |
| URLs | Structure and parameters |
| REST APIs | Resource-based web services |
Encoding Types:
# URL Encoding
Space -> %20
< -> %3C
> -> %3E
" -> %22
# HTML Encoding
< -> <
> -> >
& -> &
# Base64 Encoding
echo "text" | base64
echo "dGV4dAo=" | base64 -d
Phase 3: Lab Setup with BurpSuite
Install BurpSuite:
# Download from PortSwigger
# Configure browser proxy: 127.0.0.1:8080
# Import Burp CA certificate
Configure Browser:
- Set proxy to 127.0.0.1:8080
- Import BurpSuite CA certificate
- Disable certificate validation for testing
BurpSuite Modules:
| Module | Purpose |
|---|---|
| Proxy | Intercept and modify traffic |
| Repeater | Manually modify and resend requests |
| Intruder | Automated attacks and fuzzing |
| Scanner | Automated vulnerability detection |
| Decoder | Encode/decode data |
| Comparer | Compare responses |
| Sequencer | Analyze session token randomness |
Set Up Practice Lab:
# Install Docker
apt install docker.io
# Run bWAPP
docker run -d -p 80:80 raesene/bwapp
# Run DVWA
docker run -d -p 80:80 vulnerables/web-dvwa
# Access at http://localhost
Phase 4: Application Mapping
Discovery Techniques:
# Robots.txt analysis
curl http://target/robots.txt
# Directory brute forcing
gobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt
dirbuster -u http://target -l /usr/share/wordlists/dirb/common.txt
# Spidering with Burp
# Use Target > Site Map > Spider
Entry Point Identification:
- Forms and input fields
- URL parameters
- Hidden fields
- Cookies
- HTTP headers
Technology Fingerprinting:
# Whatweb
whatweb http://target
# Wappalyzer (browser extension)
# Nmap fingerprinting
nmap -sV --script http-enum target
# Banner grabbing
curl -I http://target
Phase 5: OWASP Top 10 Vulnerabilities
1. Injection (A03:2021)
# SQL Injection
' OR 1=1--
" OR ""="
'; DROP TABLE users;--
# Command Injection
; ls -la
| cat /etc/passwd
&& whoami
# LDAP Injection
*)(uid=*))(|(uid=*
2. Broken Authentication (A07:2021)
- Weak passwords
- Session fixation
- Credential stuffing
- Missing MFA
- Insecure password recovery
3. Cross-Site Scripting (A03:2021)
<!-- Reflected XSS -->
<script>alert('XSS')</script>
<!-- Stored XSS -->
<img src=x onerror="alert('XSS')">
<!-- DOM-based XSS -->
<svg onload="alert('XSS')">
<!-- Filter bypass -->
<ScRiPt>alert('XSS')</ScRiPt>
<img src="x" onerror="alert('XSS')">
4. Insecure Direct Object Reference (A01:2021)
# IDOR Examples
/api/user/123 -> /api/user/124
/download?id=1 -> /download?id=2
/invoice/10001 -> /invoice/10002
5. Security Misconfiguration (A05:2021)
- Default credentials
- Unnecessary features enabled
- Error messages revealing info
- Missing security headers
- Outdated software
6. Sensitive Data Exposure (A02:2021)
- Unencrypted transmission
- Weak encryption
- Exposed API keys
- Hardcoded credentials
- Information in error messages
7. Missing Access Controls (A01:2021)
- Horizontal privilege escalation
- Vertical privilege escalation
- Forced browsing to admin pages
- API without authentication
8. Cross-Site Request Forgery (A01:2021)
<!-- CSRF Attack Form -->
<form action="http://target/transfer" method="POST">
<input type="hidden" name="amount" value="10000">
<input type="hidden" name="to" value="attacker">
<input type="submit" value="Click Me!">
</form>
9. Components with Known Vulnerabilities (A06:2021)
# Check for CVEs
searchsploit apache 2.4
searchsploit wordpress 5.0
# Retire.js for JavaScript
retire --path /path/to/js
10. Insufficient Logging (A09:2021)
- Failed login attempts not logged
- No audit trail
- Logs not monitored
- Logs stored insecurely
Phase 6: Session Management Testing
Session Analysis:
# Burp Sequencer
# Analyze token randomness and predictability
# Check for:
- Session fixation
- Session hijacking
- Weak session tokens
- Missing timeout
- Insecure transmission
Cookie Security Flags:
Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=Strict
| Flag | Purpose |
|---|---|
| Secure | HTTPS only |
| HttpOnly | No JavaScript access |
| SameSite | CSRF protection |
Phase 7: Bypassing Client-Side Controls
Hidden Field Manipulation:
<!-- Original -->
<input type="hidden" name="price" value="100">
<!-- Modified in Burp -->
<input type="hidden" name="price" value="1">
JavaScript Validation Bypass:
- Disable JavaScript in browser
- Intercept and modify with Burp
- Replay requests with modified values
Phase 8: Authentication Attacks
Common Techniques:
# Brute force
hydra -l admin -P passwords.txt target http-post-form "/login:user=^USER^&pass=^PASS^:Invalid"
# Username enumeration
# Different responses for valid/invalid users
# Password reset flaws
# Predictable tokens, no rate limiting
Phase 9: Access Control Testing
IDOR Testing:
# Increment IDs
/user/1 -> /user/2
# Change parameters
?role=user -> ?role=admin
# Use Burp Intruder for automation
Phase 10: Input Validation Testing
Injection Points:
# All user input
# URL parameters
# Form fields
# Headers (User-Agent, Referer)
# Cookies
# File uploads
Fuzzing with Burp:
- Send request to Intruder
- Mark injection points
- Select payload list
- Analyze responses
Phase 11: Error Code Analysis
# Force errors for information
- Invalid input types
- Long strings
- Special characters
- SQL syntax errors
# Look for:
- Stack traces
- Database errors
- Path disclosure
- Version information
Phase 12: Cryptography Testing
# Check for:
- Weak algorithms (MD5, SHA1, DES)
- ECB mode usage
- Hardcoded keys
- Missing encryption
# SSL/TLS testing
sslscan target:443
testssl.sh target
Phase 13: Business Logic Vulnerabilities
Common Issues:
- Price manipulation
- Skipping workflow steps
- Race conditions
- Abuse of functionality
Testing Approach:
- Understand normal workflow
- Attempt to skip steps
- Modify values mid-process
- Test race conditions
Quick Reference
Essential Tools
| Tool | Purpose |
|---|---|
| BurpSuite | Web proxy and testing |
| OWASP ZAP | Open source alternative |
| sqlmap | SQL injection automation |
| Nikto | Web server scanning |
| Gobuster | Directory enumeration |
Testing Checklist
□ Map application and entry points
□ Test authentication mechanisms
□ Check authorization controls
□ Test input validation
□ Analyze session management
□ Check for injection flaws
□ Test business logic
□ Review error handling
□ Assess cryptographic implementation
Constraints
- Only test authorized systems
- Lab environments are essential for learning
- Real-world applications may differ from labs
- Tools require understanding, not just execution
Examples
Example 1: Quick XSS Test
<script>alert(document.domain)</script>
Example 2: SQLi Detection
' OR '1'='1
Troubleshooting
| Issue | Solution |
|---|---|
| Burp not intercepting | Check proxy settings, CA certificate |
| Lab not loading | Verify Docker is running |
| Payloads blocked | Try encoding, alternative syntax |
| Tool errors | Check dependencies, permissions |
スコア
総合スコア
65/100
リポジトリの品質指標に基づく評価
✓SKILL.md
SKILL.mdファイルが含まれている
+20
○LICENSE
ライセンスが設定されている
0/10
✓説明文
100文字以上の説明がある
+10
○人気
GitHub Stars 100以上
0/15
✓最近の活動
1ヶ月以内に更新
+10
○フォーク
10回以上フォークされている
0/5
✓Issue管理
オープンIssueが50未満
+5
✓言語
プログラミング言語が設定されている
+5
✓タグ
1つ以上のタグが設定されている
+5
レビュー
💬
レビュー機能は近日公開予定です
