Information Gathering
The phase of collecting information is an important part in our process. We are especially looking for information concerning the …
moreOnline password attacks
Network services usually authenticate their users by means of a user name and associated password. If we know of the …
moreLocal Root Exploits
So-called local root exploits often exist especially for older operating systems, which exploit vulnerabilities in the kernel when expanding privileges, …
moreOffline password attacks
Unlike online password attacks, the hashes of the user passwords are available for offline password attacks. A cryptographic hash function …
moreFile Transfer
After we have “built“ an exploit locally on our attacking machine, we still have to transfer it to the target …
moreThe Hacking Guide
Taking a look back, we learned about non-technical but essential aspects of penetration testing in the last chapters. In a …
moreBroken Access Control
In 2021, vulnerabilities in authorization scheme were ranked as the top risk in web applications by the OWASP Top 10 …
moreHacking V: Tunnelling Techniques
We deliberately also kept an eye out for network information during privilege escalation, because IT infrastructure is often split into …
moreHacking VI: Vulnerability scanner and penetration testing frameworks
It goes without saying that many processes in a penetration test can and should be automated. We can write scripts, …
moreTool introduction: netcat
Now that we are able to identify open ports and accessible services on a target system, we can also communicate …
moreTool introduction: masscan
When performing a port scan against an IT infrastructure, we must assume that services can be accessed via any IP …
moreCross-Site Scripting (XSS)
In addition to SQL injection, injection attacks also include cross-site scripting. Due to the lack of input validation, cross-site scripting …
moreHacking IV: Privilege Escalation
We have successfully mastered our first step as an attacker: executing commands on our target system. But in most cases, …
moreHacking III: Web application attacks
User authentication by password is often implemented in web applications. Individual users may be assigned different roles. As a payment …
moreHacking II: Password attacks
In review, scanning networks is the foundation of any attack, as this allows us to discover our attack surface. But …
moreSQL Injections (SQLi)
According to the OWASP TOP 10, injections are among the three most common vulnerabilities in web applications. This also includes …
moreTool introduction: nmap
To identify accessible servers in a network range, nmap can perform a ping sweep using the ICMP protocol. In this …
moreParticularities of IPv6 networks
In this day and age, networks can no longer be scanned only on IPv4 networks. Many companies are gradually migrating …
moreTool introduction: dig
The domain name can provide important information about the job of a target system: As humans have a hard time …
moreHacking I: Scanning networks
In some cases, we need to identify the network ranges of a company ourselves for penetration testing. In the case …
more
binsec academy GmbH - Online IT Security Training with Practical Focus
binsec academy GmbH is provider of online IT security training, offering practical, lab-based courses for professionals. The academy provides hands-on training in areas such as penetration testing and secure software development. Participants gain practical experience through realistic lab environments, including simulations of company networks and applications. Courses are available in multiple programming languages and align with standards like OWASP Top 10 and PCI DSS. Upon successful completion, participants receive certifications such as the Binsec Academy Certified Pentest Professional (BACPP) and Binsec Academy Certified Secure Coding Professional (BACSCP), demonstrating their ability to identify and remediate security vulnerabilities.
Goto binsec acadmy GmbH
binsec GmbH – Experts in Penetration Testing
binsec GmbH is a German IT security company focused on professional penetration testing. With over 10 years of experience, the team conducts in-depth penetration tests on networks, web applications, APIs, and mobile apps. Certified experts systematically identify and document security vulnerabilities to support organizations in improving their security and meeting compliance requirements.
Goto binsec GmbH