Module 7-9

Module 7-9

1. Module 7

   • Tools
     • Burp Suite – Intercepts and modifies HTTP requests/responses for testing.
     • OWASP ZAP – Scans for vulnerabilities like XSS and SQLi.
     • SQLMap – Automates SQL injection discovery and exploitation.
     • Acunetix – Web vulnerability scanner.
     • Nikto – Web server scanner that tests for outdated software and misconfigurations.
   • Techniques
     • Fuzzing – Sending random input to web apps to trigger errors and vulnerabilities.
     • Parameter tampering – Modifying URL/query parameters to bypass controls.
     • Cookie poisoning – Altering cookie values to manipulate sessions.
     • Session hijacking – Stealing session tokens to impersonate users.
     • Code injection – Inserting code into form fields or inputs to exploit the app.

2. Module 8

   • Tools
     • Aircrack-ng Suite
       • Airodump-ng – Captures wireless packets.
       • Aireplay-ng – Injects packets into a network.
       • Aircrack-ng – Cracks WEP/WPA keys.
     • WiFiPhisher – Automates Evil Twin phishing attacks.
     • Reaver – Brute-forces WPS PINs to access WPA/WPA2.
     • BluetoothView – Scans nearby Bluetooth devices.
     • BlueZ – Linux Bluetooth protocol stack for attack testing.
   • Techniques
     • Packet sniffing – Capturing unencrypted traffic over Wi-Fi.
     • Deauthentication attack – Forces devices to disconnect to capture handshakes.
     • Fake AP creation – Setting up rogue access points to trick users.
     • Bluetooth spoofing – Imitating trusted Bluetooth devices.
     • Brute-forcing WPA keys – Trying multiple key combinations to break encryption.

3. Module 9

   • Tools
     • Malwarebytes Mobile Security – Detects and removes mobile malware.
     • Lookout Security – Provides theft alerts, safe browsing, and privacy monitoring.
     • Zimperium zIPS – Enterprise mobile threat defense platform.
     • Norton Mobile Security – Offers anti-malware, web protection, and device security.
     • Appie / MobSF (Mobile Security Framework) – Mobile app analysis and penetration testing tool.
   • Techniques
     • App repackaging – Modifying legitimate apps to include malware.
     • SMiShing – Phishing via SMS messages.
     • Rooting/Jailbreaking – Bypassing manufacturer controls to access system files.
     • Spyware deployment – Covertly installing surveillance tools on mobile devices.
     • Privilege escalation – Gaining higher permissions than intended.