Index

A

B

C

D

E

F

G

H

.htaccess
- about / Concept of .htaccess
hacker
- about / Who is a hacker?
hacking
- about / Who is a hacker?
hard drive
- Kali Linux, installing on / Installing Kali Linux on a hard drive
hashing functions
- about / Hashing for message integrity
Health Insurance Portability and Accountability Act (HIPAA) / Sensitive data handling
heartrate
- download link / Example of extracting user installed apps
Heimdall Suite
- reference / Using Heimdall
Hip Hop Virtual machine (HHVM) / The HTTP header
hooking
- Xposed framework used / Hooking using Xposed framework
hosts, identifying with DNS
- about / Identifying hosts using DNS
- zone transfer, using dig / Zone transfer using dig
- brute force DNS records, using Nmap / Brute force DNS records using Nmap
hosts command
- using / Using the hosts and services commands
HSTS / HSTS – HTTP Strict Transport Security
Htop
- used, for monitoring resource use / Monitoring resource use with Htop
HTTP error codes
- reference / Detecting result of fuzzing
HTTP methods, for penetration testing
- GET method / The GET/POST method
- POST method / The GET/POST method
- HEAD method / The HEAD method
- TRACE method / The TRACE method
- PUT method / The PUT and DELETE methods
- DELETE method / The PUT and DELETE methods
- OPTIONS method / The OPTIONS method
HTTP parameter pollution
- about / HTTP parameter pollution
- mitigation / Mitigation
HTTP response splitting
- about / HTTP response splitting
- mitigation / Mitigation
HTTP Strict Transport Security (HSTS) / SSL stripping limitations
hybrid apps
- about / Hybrid apps, Different types of mobile apps and their threat model
Hydra
- about / Hydra – a brute force password cracker

I

If structures
- about / Working with Boolean logic, Understanding the decision points
image files
- mounting / Mounting image files
improvements, in Kali Linux 2.0
- continuous rolling updates / Improvements in Kali Linux 2.0
- frequent tool updates / Improvements in Kali Linux 2.0
- revamped desktop environment / Improvements in Kali Linux 2.0
- support, for various hardware platforms / Improvements in Kali Linux 2.0
- major tool changes / Improvements in Kali Linux 2.0
incrementer
- about / Reviewing the for loop structure
information gathering, reconnaissance
- about / Reconnaissance – information gathering
- domain registration details / Domain registration details
- hosts, identifying with DNS / Identifying hosts using DNS
- Recon-ng tool / The Recon-ng tool – a framework for information gathering
information leakage
- about / Information leakage
injection-based flaws
- about / Injection-based flaws
- command injection / Command injection
- SQL injection / SQL injection
insecure data storage
- NoSQL database / Insecure data storage – NoSQL database
installation, Kali Linux
- about / Installing Kali Linux
- on USB drive / USB mode
- on Amazon cloud / Kali Linux on Amazon cloud
- on hard drive / Installing Kali Linux on a hard drive
Insufficient Transport Layer Security
- about / Insufficient Transport Layer Security
integrated authentication
- about / Integrated authentication
intent filter
- about / Intent filters
Inter-Process Communication (IPC) mechanism
- about / Drozer
interactive mode
- QARK (Quick Android Review Kit), running in / Running QARK in interactive mode
internal command / Getting help in Weevely
internal storage
- about / Internal storage, Internal storage
Internet Assigned Numbers Authority (IANA) / Application version fingerprinting
interprocess communication (IPC)
- about / Attacks on services
Introspy
- about / Cydia Substrate and Introspy
- Tracer / Cydia Substrate and Introspy
- Analyser / Cydia Substrate and Introspy
- setting up / Cydia Substrate and Introspy
- installing / Cydia Substrate and Introspy
- used, for runtime monitoring and analysis / Runtime monitoring and analysis using Introspy
Intrusion Detection System (IDS)
- about / Zenmap
intrusion detection system (IDS) / Phoning Home with Metasploit
IPInfoDB GeoIP / Reporting modules
IP spoofing / Spoofing network traffic

J

K

L

Leafpad
- about / Gedit – the Gnome text editor
legitimate apps
- infecting / A note on infecting legitimate apps
LinkedIn authenticated contact enumerator / Reporting modules
Linux Unified Key Setup (LUKS)
- about / USB mode
Live Forensic mode
- about / Starting Kali for Forensics
load balancers
- identifying / Identifying load balancers, Other ways of identifying load balancers
- cookie-based load balancer / Cookie-based load balancer
load balancers, identifying
- SSL differences between servers, analyzing / Other ways of identifying load balancers
- different URL, redirecting to / Other ways of identifying load balancers
- DNS records, for load balancers / Other ways of identifying load balancers
- load balancer detector / Other ways of identifying load balancers
- web application firewall (WAF) / Other ways of identifying load balancers
local file include / Local file include
local privilege escalation
- standalone tool, using / Local privilege escalation with a standalone tool
Local Security Authority (LSA) / Phoning Home with Metasploit
logging based vulnerabilities
- about / Logging based vulnerabilities

M

N

NAC (Network Access Controller)
- cracking / Cracking the NAC (Network Access Controller)
native apps
- about / Native apps, Different types of mobile apps and their threat model
netcat (nc) utility / The OPTIONS method
NetCat (Ncat)
- used, for maintaining access / Maintaining access with Ncat
Netcraft hostname enumerator / Reporting modules
NET USE command / Abusing the Windows NET USE command
network
- mapping, to pivot / Mapping the network to pivot
network footprinting
- about / Footprinting the network
- network exploring, with Nmap / Exploring the network with Nmap
- Zenmap / Zenmap
- network range, scanning / Scanning a network range
network protocol fuzzing
- about / Network protocol fuzzing
network range
- difference verbosity makes, viewing / The difference verbosity makes
- scanning / Scanning a network range
Nikto
- about / Nikto
- features / Nikto
NMap
- used, for discovering new machines / Discovering new machines with NMap
Nmap
- network, exploring / Exploring the network with Nmap
- URL, for downloading / Exploring the network with Nmap
- URL / Scanning a network range
Nmap version scan
- about / The Nmap version scan
NoSQL database
- about / Insecure data storage – NoSQL database
- NoSQL demo application functionality / NoSQL demo application functionality
NoSQL demo application functionality
- about / NoSQL demo application functionality

O

Object Relational Model (ORM) / Avoiding SQL injection
Offensives Security's exploit
- reference link / Replacing the executable
OllyDbg
- executing / Running OllyDbg
open source intelligence (OSINT) gathering / Reconnaissance – information gathering
OpenSSL command-line tool
- about / OpenSSL command-line tool
OpenVAS
- about / Running Kali from the live CD, A return to OpenVAS, OpenVAS
- setting up / Setting up and configuring OpenVAS
- configuring / Setting up and configuring OpenVAS
- considerations / A return to OpenVAS
- executing / A return to OpenVAS
Open Web Application Security Project (OWASP)
- about / WebScarab and Zed Attack Proxy
OWASP
- URL / Testing for CSRF flaws
OWASP broken web applications
- reference link / Attacking path traversal using Burp proxy
OWASP GoatDroid
- installing / Installing OWASP GoatDroid
- download link / Installing OWASP GoatDroid
OWASP Mobile Top 10 vulnerabilities
- about / OWASP Top 10 Mobile Risks (2014)
- weak server-side controls / M1: Weak Server-Side Controls
- insecure data storage / M2: Insecure Data Storage
- insufficient transport layer protection / M3: Insufficient Transport Layer Protection
- unintended data leakage / M4: Unintended Data Leakage
- poor authorization and authentication / M5: Poor Authorization and Authentication
- broken cryptography / M6: Broken Cryptography
- client-side injection / M7: Client-Side Injection
- security decisions, via untrusted inputs / M8: Security Decisions via Untrusted Inputs
- improper session handling / M9: Improper Session Handling
- lack of binary protection / M10: Lack of Binary Protections
OWASP SQL injection
- URL / Avoiding SQL injection
OWASP top 10 mobile risks
- about / Relating OWASP top 10 mobile risks and web attacks
OWASP Top 10 Proactive Controls Document
- URL / Quick solutions to cross-site scripting
OWASP ZAP
- used, for zinging Windows servers / Zinging Windows servers with OWASP ZAP
- using, as attack proxy / Using ZAP as an attack proxy
- interface, reading / Reading the ZAP interface
- about / AJAX spider – OWASP ZAP

P

Q

R

Radare2
- executing / Running Radare2
- about / Running Radare2
- URL / Running Radare2
Radare2 tool suite
- about / Additional members of the Radare2 tool suite
- rasm2, executing / Running rasm2
- rahash2, executing / Running rahash2
- radiff2, executing / Running radiff2
- rafind2, executing / Running rafind2
- rax2, executing / Running rax2
radiff2
- executing / Running radiff2
rafind2
- executing / Running rafind2
rahash2
- executing / Running rahash2
rasm2
- executing / Running rasm2
rax2
- executing / Running rax2
rdesktop
- about / Adding a Windows user from the command line
Recon-ng tool
- about / The Recon-ng tool – a framework for information gathering
- domain enumeration / Domain enumeration using recon-ng
- top-level domain enumeration / Sub-level and top-level domain enumeration
- sub-level domain enumeration / Sub-level and top-level domain enumeration
- modules, reporting / Reporting modules
reconnaissance
- about / Reconnaissance
- aim / Reconnaissance
- passive reconnaissance, versus active reconnaissance / Passive reconnaissance versus active reconnaissance
- information gathering / Reconnaissance – information gathering
reconnaissance modules, in Recon-ng
- Netcraft hostname enumerator / Reporting modules
- SSL SAN lookup / Reporting modules
- LinkedIn authenticated contact enumerator / Reporting modules
- IPInfoDB GeoIP / Reporting modules
- Yahoo! hostname enumerator / Reporting modules
- Geocoder and reverse geocoder / Reporting modules
- Pushin modules / Reporting modules
recovery
- installing / Installing recovery softwares
- Odin, using / Using Odin
- Heimdall, using / Using Heimdall
reflected XSS
- about / Reflected XSS
reflected XSS flaw / Cross-site scripting
Regional Internet Registrars (RIR) / Whois – extracting domain information
remote access
- maintaining / Maintaining access
- tracks, covering / Covering our tracks
- maintaining, Ncat used / Maintaining access with Ncat
- Metasploit, used for Phoning Home / Phoning Home with Metasploit
remote file include / Remote file include
request header / The request header
required tools
- installing / Installing the required tools
- Java / Java
resource use
- monitoring, with Htop / Monitoring resource use with Htop
response header / The response header
REST
- about / Web services
RESTful web services
- about / Introducing SOAP and RESTful web services
- features / Introducing SOAP and RESTful web services
reverse engineering
- practicing / Practicing reverse engineering
- debuggers, demystifying / Demystifying debuggers
- disassemblers / Introduction to disassemblers
- tools / Some miscellaneous reverse engineering tools
- Radare2 tool suite / Additional members of the Radare2 tool suite
reverse engineering theory
- about / Reverse engineering theory
- general theory / One general theory of reverse engineering
reverse engineering tools
- about / Some miscellaneous reverse engineering tools
- Radare2, executing / Running Radare2
Robots.txt / Concept of Robots.txt
rooting
- about / What is rooting?
- need for / Why would we root a device?
- advantages / Advantages of rooting
- disadvantages / Disadvantages of rooting
- Custom ROM installation / Rooting Process and Custom ROM installation
rooting, advantages
- unlimited control over device / Unlimited control over the device
- additional apps, installing / Installing additional apps
- features and customization / More features and customization
rooting, disadvantages
- about / Disadvantages of rooting
- security of device, compromising / It compromises the security of your device
- device, bricking / Bricking your device
- voids warranty / Voids warranty
rules of engagement (RoE)
- about / Rules of engagement
- black box testing / Black box testing or Gray box testing
- gray box testing / Black box testing or Gray box testing
- client contact details / Client contact details
- client IT team notifications / Client IT team notifications
- sensitive data handling / Sensitive data handling
- status meeting / Status meeting
runtime monitoring and analysis
- Introspy used / Runtime monitoring and analysis using Introspy

S

T

U

UID per app / UID per app
Unicorn-Scan
- about / Using Unicorn-Scan
- using / Using Unicorn-Scan
USB drive
- Kali Linux, installing on / USB mode
user dictionary cache
- about / User dictionary cache
user installed apps
- extracting, examples / Example of extracting user installed apps
user interface, simple SMS stealer
- about / The user interface
- code, for MainActivity.java / Code for MainActivity.java
- code, for reading SMS / Code for reading SMS
- code, for uploadData() method / Code for the uploadData() method
- complete code, for MainActivity.java / Complete code for MainActivity.java
user interface fuzzing
- about / User interface fuzzing

V

Valgrind Debugger
- used, for discovering memory leaks / Using the Valgrind Debugger to discover memory leaks
virtual hosts
- identifying / Identifying virtual hosts
- locating, with search engines / Locating virtual hosts using search engines
- lookup module, in Recon-ng / The virtual host lookup module in Recon-ng
virtual private network (VPN) / Secure socket layer
VMware images
- of Kali Linux / VMware and ARM images of Kali Linux
vulnerability assessment
- about / Vulnerability assessment
vulnerable apps
- about / Vulnerable apps
- GoatDroid / Vulnerable apps
- SSHDroid / Kali Linux
- FTP Server / Kali Linux
vulnerable bank application
- reference link / Cross-site request forgery

W

X

xHydra
- about / xHydra
- using / xHydra
Xposed framework
- used, for hooking / Hooking using Xposed framework
- about / Hooking using Xposed framework
XSS
- executing, POST method used / XSS using the POST Method
XSS, combining with JavaScript
- about / XSS and JavaScript – a deadly combination
- cookie stealing / Cookie stealing
- key logger / Key logger
- website defacing / Website defacing
XSS attack
- about / An overview of cross-site scripting
- example / An overview of cross-site scripting
xsser
- about / Xsser
- features / Features
- graphical interface / Features
XSS vulnerabilities
- stored XSS flaws / Cross-site scripting
- reflected XSS flaw / Cross-site scripting

Y

Yahoo! hostname enumerator / Reporting modules

Z