Finding vulnerabilities?

Hi all,

I am trying to get into the hacking community, and reading as much as possible :) . I was reading a very intersting article yesterday on a guy doing a security check on forums by finding, and showing examples, of how to exploit XSS vulnerabilities.

Although he did show how to exploit these vulnerabilities which is great if you're a script kiddie, it did not show how to find them, it just suddenly skipped to "Then I found this..." rather than showing how he found it.

Could any1 either explain personally, or direct me to articles on the subject of finding website vulnerabilities please?

Thanks in advance.

I guess I'll answer you in a post, rather than an AP assignment. This is an Information Security website, not a hacking site. We do not promote nor encourage hacking. Thank You :)

Quote:

---

This is an Information Security website

---

Maybe it`s just me but the guy was asking for information wasn`t he? the question didn`t sound malisious.His question did pertain to security. I think the negs are way off here.

Mike

Quote:

---

I am trying to get into the hacking community

---

Yes, he is looking for information. But apparently, what is he going to do with the information he is searching for? Sorry, but with an opener like that if it look's like a cracker/kiddie and smell's like one, it probably is.

Quote:

---

Although he did show how to exploit these vulnerabilities which is great if you're a script kiddie, it did not show how to find them, it just suddenly skipped to "Then I found this..." rather than showing how he found it.

---

Did I not make it clear here that I did not want to exploit the vulnerabilities, just find them? I would like to know about security, web security, and to know that surely you have to know how to find the problems to be able to fix them? Damn.

Quote:

---

Yes, he is looking for information. But apparently, what is he going to do with the information he is searching for?

---

I've actually being thinking about a career in ICT. Problem?

Quote:

---

We do not promote nor encourage hacking.

---

As far as I am aware, hacking is the knowledge of computer security...it is cracking which is the misuse of that knowledge. Notice how I didn't mention any interest in cracking?

lomu,

You have to understand where people are coming from here. nobody wants to aid you in hacking websites...ya know?

That is why people are hesitant to answer questions like this. Especially when it is your first or second post. You underdig?

Word your posts better next time.

BTW...A search engine would render much better answers. Use one.

mike

Okay, well in that event I'm sorry. I looked at your post in Web Security and I can see your interested more in the security aspect of thing's rather than the "hacking world". But you gotta see it from my perspective. When you say thing's like "I am trying to get into the hacking community" it make's me think of what your intention's are. Anyways, sorry man. Hopefully if you post more and help some people out you'll regain your AP's and everything. Good luck on your quest for knowledge of vulnerabilities. :)



EDIT:

Quote:

---

Word your posts better next time.

---

Couldn't have said it better myself. :)

Damn I'm good. Thread re-opened. :D

Quote:

---

Damn I'm good. Thread re-opened.

---

Hmm..maybe you could take the poor guy`s negs away. :D

[edit]
Actually it looks like they may have evened out
[/edit]

lomu,

Now ask yourself, what kind of impression does this give to a bunch of security minded of folks?

Quote:

---

Could any1 either explain personally, or direct me to articles on the subject of finding website vulnerabilities

---

Unfortunately, we get approached all the time by people who ask us to show them, how to hack this or how to hack that. It gets old! If we jump first before looking, we are human and have a few vulnerabilities ourselves. However, you own some of the responsibility as well. Judging by your post, you did not read any part of the guidance provided for the new members or you ignored it. Those threads are not there for your to kiss our backsides. But rather, to let you know what is expected of your participation. Additionally they are there for you to maximize your learning opportunity and to let us know by your posts that you are not some lamer looking for a exploit.

If we have erred and misjudged you initially hang around and you will find we are very quick to resolve our differences and welcome you.

cheers

Hey... I found some IIS exploit scanners, but since they were some sort of script files that didnt have any extension i didnt udnerstand a **** of how to use them :cool:

Anyone wanna be so kind and tell me how you use those files?
I want to exploit scan our host because someone told me that its insecure...

Wow :eek: MsM you are good :D Anyways, I'm glad this thread is re-opened and the dude is given another chance.

Quote:

---

Hey... I found some IIS exploit scanners, but since they were some sort of script files that didnt have any extension i didnt udnerstand a **** of how to use them

Anyone wanna be so kind and tell me how you use those files?
I want to exploit scan our host because someone told me that its insecure

---

haha...now there is a carefully worded question.

What you mean? Im a dumb swede so i dont understand much :)

Anyways, was that question to stupid to answer or did i mess up?

Quote:

---

Anyways, was that question to stupid to answer or did i mess up?

---

I guess you had to read the entire post to get it.

Quote:

---

Hey... I found some IIS exploit scanners, but since they were some sort of script files that didnt have any extension i didnt udnerstand a **** of how to use them

Anyone wanna be so kind and tell me how you use those files?
I want to exploit scan our host because someone told me that its insecure...

---

You never really gave indepth details as to what you were using...just some IIS exploit scanners.

Yea, thats the thing, i didnt understand **** of it :) it was a zip archive, i think i got it from this site with some files without extension, when i opened them in notepad they were like binary files, but was a little different characters in it....

(Correct me if I'm a little off vets)

Actually your terminology is a wee bit off. Cracking isn't "bad hacking" per se, it's breaking passwords. Hacking can be good or bad, depending on what kind of hacker you are (black hat, grey hat, white hat, etc.). The safest thing to do in these parts is to just never use the term hacker in any form or fashion in relation to yourself. Go with the term security instead, as it will prevent any misconcpetions such as this.

Hacking is simply what you make of it, and what you choose to do with the knowledge you posess. If you use it for malicious reason's, that's wrong (it's also kiddie-like and considered cracking). If you use it to learn more about a system (such as your own) or to gain more knowledge, then it's okay.