/cyb/ - cyberpunk and cybersecurity

I don't often pentest, but I do penciltest on occasion.

>>2895

Nikto is out of date.

Browse to the site hosted on 80. Open the dev console (or inspect element). Peruse the sources, watch the different transfers in the Network tab.

Once you get a feel for how the site works, start playing with request variables. What happens if this equals zero? What happens if I submit this JSON payload without authentication?

Unless you are participating in a CTF, immediately stop using scripts and tools (short of dirsearch). Bad news friend: hacking sites require you to learn the sites manually.

>>2900
You would be surprised but many of these are actually about reusing other people's exploits. Since the Kioptrix website recommends using Backtrack 3 or 4 to solve it I wouldn't be surprised if it was just about running the right tool with the right arguments.

I have no idea where's the fun in that, but I guess it makes beginners feel like hackers.

>>2901

Right, I used nikto just because I didn't know what else to use to be honest.

I'm fine with using tools for enumeration/discovery, but I'd like to avoid metasploit etc. in regards to the actual exploit – not opposed to copying someone else's script though

>>2901
gotta start someone arisu,