Jump to content

Recommended Posts

Posted

 

In this thread, I'll include all web hacking techniques and methods. The list is not provided by me. I just found it on my HDD. Credits go to whoever collected this information.

 

Parameter manipulation

 

[*] Arbitary File Deletion

[*] Code Execution

[*] Cookie Manipulation ( meta http-equiv & crlf injection )

[*] CRLF Injection ( HTTP response splitting )

[*] Cross Frame Scripting ( XFS )

[*] Cross-Site Scripting ( XSS )

[*] Directory traversal

[*] Email Injection

[*] File inclusion

[*] Full path disclosure

[*] LDAP Injection

[*] PHP code injection

[*] PHP curl_exec() url is controlled by user

[*] PHP invalid data type error message

[*] PHP preg_replace used on user input

[*] PHP unserialize() used on user input

[*] Remote XSL inclusion

[*] Script source code disclosure

[*] Server-Side Includes (SSI) Injection

[*] SQL injection

[*] URL redirection

[*] XPath Injection vulnerability

[*] EXIF

[*]Buffer Overflows

[*]Clickjacking

[*]Dangling Pointers

[*]Format String Attack

[*]FTP Bounce Attack

[*]Symlinking

 

 

This list below fits in category MultiRequest parameter manipulation

 

[*] Blind SQL injection (timing)

[*] Blind SQL/XPath injection (many types)

 

 

This list below fits in category File checks

 

[*] 8.3 DOS filename source code disclosure

[*] Search for Backup files

[*] Cross Site Scripting in URI

[*] PHP super-globals-overwrite

[*] Script errors ( such as the Microsoft IIS Cookie Variable Information Disclosure )

 

 

This list below fits in category Directory checks

 

[*] Cross Site Scripting in path

[*] Cross Site Scripting in Referer

[*] Directory permissions ( mostly for IIS )

[*] HTTP Verb Tampering ( HTTP Verb POST & HTTP Verb WVS )

[*] Possible sensitive files

[*] Session fixation ( jsessionid & PHPSESSID session fixation )

[*] Vulnerabilities ( e.g. Apache Tomcat Directory Traversal, ASP.NET error message etc )

[*] WebDAV ( very vulnerable component of IIS servers )

 

This list below fits in category Text Search Disclosure

 

[*] Application error message

[*] Check for common files

[*] Directory Listing

[*] Email address found

[*] Local path disclosure

[*] Possible sensitive files

[*] Microsoft Office possible sensitive information

[*] Possible internal IP address disclosure

[*] Possible server path disclosure ( Unix and Windows )

[*] Possible username or password disclosure

[*] Sensitive data not encrypted

[*] Source code disclosure

[*] Trojan shell ( r57,c99,crystal shell etc )

[*] ( IF ANY )Wordpress database credentials disclosure

 

This list below fits in category File Uploads

 

[*] Unrestricted File Upload

 

This list below fits in category Authentication

 

[*] Microsoft IIS WebDAV Authentication Bypass

[*] SQL injection in the authentication header

[*] Weak Password

[*] GHDB - Google hacking database ( using dorks to find what google crawlers have found like passwords etc )

 

This list below fits in category Web Services - Parameter manipulation & with multirequest

 

[*] Application Error Message ( testing with empty, NULL, negative, big hex etc )

[*] Code Execution

[*] SQL Injection

[*] XPath Injection

[*] Blind SQL/XPath injection ( test for numeric,string,number inputs etc )

[*] Stored Cross-Site Scripting ( XSS )

[*] Cross-Site Request Forgery ( CSRF )

 

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now


  • Posts

    • ⚡ Weekend Stock Refresh! Fast order fulfillment is active. Get Gemini Pro Advanced + Google One cloud storage activated on your own personal email within minutes.
    • New Release World & atmosphere A complete dynamic weather system has arrived, with Clear, Light Rain, Rain, Heavy Rain, Storm, Snow, and Windy presets. Rain and snow react to roofs, wind moves foliage, lightning illuminates storms, exposed ground becomes wet and develops puddles, and snow builds up and melts over time. Weather includes Low to Ultra quality levels and advanced controls for precipitation, wind, cloud cover, lightning, surface wetness, puddles, and snow. The game server can also select or restore the current weather while local quality settings continue to control rendering cost. The weather can be controlled from the server with custom packets. For more details use Shift+Alt+P. Enhanced lighting now allows authored lamps, fires, and other light sources to illuminate towns and interiors. Lights can pulse, flicker, blink, and strobe, flames produce warm dynamic light, and lamps display depth-aware halos. Remastered emissive surfaces are now supported, beginning with illuminated windows in Giran that glow and cast light into their surroundings. Broadcasting Towers now use their correct original scale and animated rings and glow effects. Map, quests & navigation A complete quest journal has been added, with active and completed quests, expandable stages, descriptions, requirements, item progress, quest inventory integration, location controls, and quest cancellation. Quest objectives now appear through flashing minimap and world-map markers, an overhead directional guide, a notification button beside chat, and rotating quest symbols above eligible NPCs. Server-directed radar markers now work across the live minimap and world map, including the original overhead guidance effect and arrival behavior. The original tutorial system now works, including scrollable tutorial pages, animated illustrations, the flashing question button, tutorial links, and movement, camera, pickup, and sit/rest progression events. Server-opened town maps now display their original artwork and the supplied player marker. Shops, storage & items Personal, clan, castle, and freight warehouses now work, including deposits, withdrawals, stack quantities, fees, weight and capacity previews, tooltips, and the original warning and empty-storage dialogs. Account freight now works through the original recipient picker and delivery window, allowing items to be sent to another character on the same account. Multisell exchanges now work, with paged recipe lists, product details, required materials, quantity selection, warnings, and server-backed completion. Manor seed purchasing is now supported through the shop interface, including availability and pricing. Inventory items can now be dragged to the trash button and destroyed after the appropriate warning or quantity prompt. The original in-game calculator now works with mouse and keyboard input. Community The Community Board is now available from the system menu or Alt+B, with Home, Favorites, Region, Clan, Memo, Mail, and Friends sections, retained navigation, forms, scrolling, minimization, and server-provided pages. Characters, cameras & events Striders and Wyverns now render as fully animated mounts with the rider attached correctly. Striders remain ground-based, while Wyverns support three-dimensional flight. Characters now enter a proper falling state after high drops or airborne dismounts, with falling animations and server-authoritative landing and fall-damage handling. Players can now sit on authored world chairs using the correct sit, wait, and stand animations. Server-driven special camera sequences now work, including target tracking, interpolation, duration, widescreen bars, and restoration to the normal camera. GM camera mode and server-authorized ///fly movement are now supported. The original 102-second Kamael teaser sequence has been restored with its complete slideshow, transitions, panning artwork, localized subtitles, and narration. Hats, masks, circlets, and other hair accessories now use their authored head placement and correctly adjust the character's hairstyle. Timed server confirmation dialogs, short-duration status effects, regeneration previews, and the seasonal Christmas Seal presentation are now supported. Interface & performance Character creation has been refined with corrected description wrapping, clipping, layout, and name-entry presentation. Tutorial and NPC dialog windows now use polished proportional scrollbars, improved HTML layout, and correctly sized illustrations and controls. A new independent 3D render-resolution setting offers Native, 720p, 900p, 1080p, 1440p, and 4K choices while keeping the window, HUD, text, and FermaUI at native resolution. Major rendering optimizations reduce unnecessary work in local lighting, shadows, visibility, exposure, bloom, post-processing, and GPU diagnostics. Download from the launcher you have installed, or at https://updates.fermata.gg/ if you don't have the launcher. Fermata Light Engine Preview All lights can be baked in the client, shipped to the users, and exported and imported as .femlight files.
  • Topics

×
×
  • Create New...

Important Information

This community uses essential cookies to function properly. Non-essential cookies and third-party services are used only with your consent. Read our Privacy Policy and We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue..