How to find a vulnerability on a website

[subornaakter24]

Checking a website for vulnerability is done in several stages. You can't just click a button and quickly identify all the weak points in one fell swoop - it's important to get as much detailed information about them as possible. The process consists of the following steps:

Data collection (reconnaissance): You need to find out as much information as possible about the network or servers you are using.

Analysis and scanning (taking into account the received intelligence) of vulnerabilities detected on your web resource.

Trial operation. Testers do not always perform loadrunner protocol list this stage, it is only done if the danger needs to be demonstrated.

Correction. Here, measures are taken to eliminate weaknesses found on the web platform.

At each of the listed stages, it is necessary to perform a number of actions, using a certain toolkit. Practice shows that using each of these tester programs separately is not as effective as combining them in the form of a ready-made environment for testing for possible threats. This refers to checking a site for vulnerabilities via KaliLinux (from Linux). This is very convenient: you just need to take the system saved there from a flash drive and run its installation on the hard drive of your device.

Intelligence gathering (reconnaissance)
Your goal at the initial stage of searching for vulnerabilities on a site is to find out what data about you may become available to outsiders. There is a special tool for this, in particular nmap. It shows information about the services running on the server (and their versions), the ports used, and the version of the operating system itself.

Collection of information

Source: Ground Picture / shutterstock.com

For example, to view the working ports on your device, you need to run the following command in KaliLinux:

nmap -sS 192.168.91.249

The digital sequence is the IP of your resource. As a result, you will see which ports are open and which services the system uses. However, this information is already enough to draw certain conclusions. For example, if the computer has an SSH, web, proxy server (on port 3128) and, for example, Samba (a file sharing tool), then it is clear that they may well contain vulnerabilities.

For deeper reconnaissance, Nmap's A option is a great choice. The command looks like this: