summary.md 926 B
title: Summary course: intro_pentest section: "Web-Based Exploitation"
layout: lesson
Because the web is becoming more and more “executable” and because nearly every target has a web presence, this chapter examined web-based exploitation. The chapter began by reviewing techniques and tools for interrogating web servers. The use of Nikto was covered by locating specific vulnerabilities in a web server. Exploring the target website by discovering directories and files was demonstrated through the use of a spider. A method for intercepting website requests by using WebScarab was also covered. Code injection attacks, which constitute a serious threat to web security. Code injection attacks, which constitute a series threat to web security, were explored. Specifically, we examined the basics of SQL injection attacks. The chapter concluded with a brief discussing and example of cross-site scripting (XSS).