The best tools for a ethical hacker.Before we begin I want to clarify that no tool is the ultimate solution to hack all pages.
To illustrate this I will mention a statistic which estimates that 40% of the pages in internet can be hacked with automated tools. Impressive in itself, but the same study estimated that 90% of the pages you can be hacked manualy.
This indicates that automated tools can be very effective but in many cases you have to use manual techniques. If you are a web security professional you have to know how to execute these attacks manually.
Depending on the phase of the pentest you use different tools. I'm just going to mention the king of each of the categories, there are many more tools.
Recognition phase (Fingerprinting)
This tool comes by default on Linux and Mac computers, there are also websites that offer this service.
We used it to know who is the owner of a website, the contact information and DNS.
A very powerful and versatile port scanner, lets us know which ports are open on a website, what software it uses, if they use firewalls and countless other things.
As we mentioned in previous articles you can also use Google to uncover confidential information of web pages. In a technique known as Google Dorks.
Undoubtedly one of the most important tools, this tool allows you to do almost anything. It is often used to get a map of the website, find hidden content. In the attack phase is also used to intercept requests between your computer and the website letting you perform all kinds of injection attacks and modification of content.
Although most commonly used in attacks on wifi connections it also helps us in attacks on web pages as you can intercept information at a packet level.
This tool is very effective and versatile for SQL injection attacks on all platforms, MySQL, MSSQL, Oracle ...
Somewhat outdated but even so is still widely used methods to crack passwords with brute-force, dictionary attacks and rainbow attacks.
Super powerful tool to attack websites at a network level not at a application level. Even has a brother tool called Armitage that makes the use of Metaspoits even easier.
Control maintenance phase
The most comfortable method and the one that gives you the most control over the server is installing a Shell. c99 is one of the best.
Completely automated programs.
There are a number of tools, which are mainly of vulnerability scanner that are
able to do all these checks automatically.
Just put in the URL you want and click play. Accunetix tries thousands of attacks fully automatically. So many that if your site is large it can cause a denial of service so we recommend using it with caution.
Another drawback is the price, 3.750 Euros.
There are many more tools for testing the security of web pages but this is definitely the ones a ethical hacker must have. What is much more important to have them know how to use it effectively.
Do not use these tools against a page that is not yours or that you don't have written permission to attack, as it would be a crime.
- Shells, a great weapon for cyber criminals.
- Make your own IDS ( Intrusion Detection System )
- How to find, exploit and protect server ports.
- The best tools for a ethical hacker.
- What is Cross site scripting XSS?
- What is a SQL Injection?
- How to be evil with Google Dorks.
- Why SSL is not enough?
- Web Security V.S Legal security
- Parameterized Query, the best defense against SQL Injection.
- How to get your Hacking Solutions security certificate
- 23 Tests that should be included in every professional web application penetration test.
- The 5 best wordPress security plugins
- The cat and mouse game (Bypassing the SQL security controls)
- Why are hackers main target the small and middle size businesses?
- CMS owners under attack?
- Hacking solutions and hotel reservations websites
- What's our mission and why does it matter to you ?
- Who are these hackers?
- Our first blog for you