{"id":34646,"date":"2019-10-31T21:59:35","date_gmt":"2019-10-31T18:59:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/web-tools-ili-s-chego-nachat-pentesteru\/"},"modified":"2019-10-31T21:59:35","modified_gmt":"2019-10-31T18:59:35","slug":"web-tools-ili-s-chego-nachat-pentesteru","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/web-tools-ili-s-chego-nachat-pentesteru","title":{"rendered":"Webov\u00e9 n\u00e1stroje, nebo jak za\u010d\u00edt pentesterovi?","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/dsec\/blog\/447882\/\">Pokra\u010dujeme<\/a><\/noindex> s vypr\u00e1v\u011bn\u00edm o u\u017eite\u010dn\u00fdch n\u00e1stroj\u00edch pro pentestery. V nov\u00e9m \u010dl\u00e1nku si probereme n\u00e1stroje pro anal\u00fdzu zabezpe\u010den\u00ed webov\u00fdch aplikac\u00ed.<\/p>\n<p>N\u00e1\u0161 kolega <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/users\/belove\/\" class=\"user_link\">BeLove<\/a><\/noindex> u\u017e sestavil podobn\u00fd <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/125317\/\">v\u00fdb\u011br<\/a><\/noindex> p\u0159ed asi sedmi lety. Je zaj\u00edmav\u00e9 se pod\u00edvat, kter\u00e9 n\u00e1stroje si udr\u017eely a pos\u00edlily sv\u00e9 pozice, a kter\u00e9 ustoupily do pozad\u00ed a dnes se pou\u017e\u00edvaj\u00ed z\u0159\u00eddka.<br \/>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, nebo jak za\u010d\u00edt pentesterovi?\" src=\"\/wp-content\/uploads\/2019\/05\/a6d02b9593ebdbe1b11ccc38e6357b2f.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nPoznamenejme, \u017ee sem pat\u0159\u00ed i Burp Suite, ale o n\u011bm a jeho u\u017eite\u010dn\u00fdch pluginech bude samostatn\u00e1 publikace.<\/p>\n<h2>Obsah:<\/h2>\n<p><\/p>\n<ul>\n<li> <noindex><a rel=\"nofollow\" href=\"#Amass\">Amass<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#Altdns\">Altdns<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#aquatone\">aquatone<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#MassDNS\">MassDNS<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#nsec3map\">nsec3map<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#Acunetix\">Acunetix<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#Dirsearch\">Dirsearch<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#wfuzz\">wfuzz<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#ffuf\">ffuf<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#gobuster\">gobuster<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#Arjun\">Arjun<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#LinkFinder\">LinkFinder<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#JSParser\">JSParser<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#sqlmap\">sqlmap<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#NoSQLMap\">NoSQLMap<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#oxml_xxe\">oxml_xxe<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#tplmap\">tplmap<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#CeWL\">CeWL<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#Weakpass\">Weakpass<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#AEM_hacker\">AEM_hacker<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#JoomScan\">JoomScan<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#WPScan\">WPScan<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Amass\"><\/a><\/noindex>Amass<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/OWASP\/Amass\">Amass<\/a><\/noindex> \u2014 n\u00e1stroj v jazyce Go pro hled\u00e1n\u00ed a skenov\u00e1n\u00ed DNS subdom\u00e9n a vytv\u00e1\u0159en\u00ed mapy vn\u011bj\u0161\u00ed s\u00edt\u011b. Amass je projekt OWASP, vytvo\u0159en\u00fd k tomu, aby uk\u00e1zal, jak organizace vypadaj\u00ed na internetu pro extern\u00ed pozorovatele. Jm\u00e9na subdom\u00e9n Amass z\u00edsk\u00e1v\u00e1 r\u016fzn\u00fdmi zp\u016fsoby, n\u00e1stroj vyu\u017e\u00edv\u00e1 jak rekurzivn\u00ed prohled\u00e1v\u00e1n\u00ed subdom\u00e9n, tak vyhled\u00e1v\u00e1n\u00ed v otev\u0159en\u00fdch zdroj\u00edch.<\/p>\n<p>K zji\u0161t\u011bn\u00ed souvisej\u00edc\u00edch s\u00ed\u0165ov\u00fdch segment\u016f a \u010d\u00edsel autonomn\u00edch syst\u00e9m\u016f pou\u017e\u00edv\u00e1 Amass IP adresy z\u00edskan\u00e9 b\u011bhem provozu. Ve\u0161ker\u00e9 nalezen\u00e9 informace jsou vyu\u017eity k vytv\u00e1\u0159en\u00ed mapy s\u00edt\u011b.<\/p>\n<h4>Plusy:<\/h4>\n<p><\/p>\n<ul>\n<li>Techniky shroma\u017e\u010fov\u00e1n\u00ed informac\u00ed zahrnuj\u00ed:<br \/>\n * DNS \u2014 prohled\u00e1v\u00e1n\u00ed subdom\u00e9n podle slovn\u00edku, bruteforce subdom\u00e9n, \u201einteligentn\u00ed\u201c prohled\u00e1v\u00e1n\u00ed pomoc\u00ed mutac\u00ed na z\u00e1klad\u011b nalezen\u00fdch subdom\u00e9n, reverzn\u00ed DNS dotazy a vyhled\u00e1v\u00e1n\u00ed DNS server\u016f, na kter\u00fdch je mo\u017en\u00e9 prov\u00e9st dotaz na p\u0159enos z\u00f3ny (AXFR); <\/p>\n<p>* Vyhled\u00e1v\u00e1n\u00ed v otev\u0159en\u00fdch zdroj\u00edch \u2014 Ask, Baidu, Bing, CommonCrawl, DNSDB, DNSDumpster, DNSTable, Dogpile, Exalead, FindSubdomains, Google, IPv4Info, Netcraft, PTRArchive, Riddler, SiteDossier, ThreatCrowd, VirusTotal, Yahoo;<\/p>\n<p>* Vyhled\u00e1v\u00e1n\u00ed v datab\u00e1z\u00edch TLS certifik\u00e1t\u016f \u2014 Censys, CertDB, CertSpotter, Crtsh, Entrust;<\/p>\n<p>* Pou\u017eit\u00ed API vyhled\u00e1va\u010d\u016f \u2014 BinaryEdge, BufferOver, CIRCL, HackerTarget, PassiveTotal, Robtex, SecurityTrails, Shodan, Twitter, Umbrella, URLScan;<\/p>\n<p>* Vyhled\u00e1v\u00e1n\u00ed v arch\u00edvech webu: ArchiveIt, ArchiveToday, Arquivo, LoCArchive, OpenUKArchive, UKGovArchive, Wayback;<\/li>\n<li>Integrace s Maltego; <\/li>\n<li>Nab\u00edz\u00ed nejkompletn\u011bj\u0161\u00ed pokryt\u00ed \u00fakolu p\u0159i vyhled\u00e1v\u00e1n\u00ed DNS subdom\u00e9n.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Pozor na amass.netdomains \u2014 pokus\u00ed se p\u0159ipojit ke ka\u017ed\u00e9 IP adrese v identifikovan\u00e9 infrastruktu\u0159e a z\u00edskat n\u00e1zvy dom\u00e9n z reverzn\u00edch DNS dotaz\u016f a TLS certifik\u00e1t\u016f. Tato \u201ehlasn\u00e1\u201c technika m\u016f\u017ee odhalit va\u0161e zpravodajsk\u00e9 aktivity ve zkouman\u00e9 organizaci. <\/li>\n<li>Vysok\u00e1 spot\u0159eba pam\u011bti, m\u016f\u017ee spot\u0159ebov\u00e1vat a\u017e 2 GB RAM v r\u016fzn\u00fdch nastaven\u00edch, co\u017e neumo\u017en\u00ed spustit tento n\u00e1stroj v cloudu na levn\u00e9 VDS.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, nebo jak za\u010d\u00edt pentesterovi?\" src=\"\/wp-content\/uploads\/2019\/05\/37e1dd6c273eaef2c7c979a57f98c0d9.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Altdns\"><\/a><\/noindex>Altdns<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/infosec-au\/altdns\">Altdns<\/a><\/noindex> \u2014 n\u00e1stroj v Pythonu pro sestavov\u00e1n\u00ed slovn\u00edk\u016f pro prohled\u00e1v\u00e1n\u00ed DNS-subdom\u00e9n. Umo\u017e\u0148uje generovat mno\u017estv\u00ed variant subdom\u00e9n pomoc\u00ed mutac\u00ed a permutac\u00ed. K tomu se pou\u017e\u00edvaj\u00ed slova, kter\u00e1 se \u010dasto objevuj\u00ed v subdom\u00e9n\u00e1ch (nap\u0159\u00edklad: test, dev, staging), v\u0161echny mutace a permutace se aplikuj\u00ed na ji\u017e zn\u00e1m\u00e9 subdom\u00e9ny, kter\u00e9 lze poskytnout na vstupu Altdns. Na v\u00fdstupu vznik\u00e1 seznam variac\u00ed subdom\u00e9n, kter\u00e9 mohou existovat, a tento seznam lze d\u00e1le pou\u017e\u00edt p\u0159i DNS-bruteforce.<\/p>\n<h4>Plusy:<\/h4>\n<p><\/p>\n<ul>\n<li>Dob\u0159e funguje s velk\u00fdmi soubory dat.<\/li>\n<\/ul>\n<p><\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"aquatone\"><\/a><\/noindex>aquatone<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/michenriksen\/aquatone\">aquatone<\/a><\/noindex> \u2014 d\u0159\u00edve byl zn\u00e1m jako dal\u0161\u00ed n\u00e1stroj pro hled\u00e1n\u00ed subdom\u00e9n, ale s\u00e1m autor se vzdal tohoto ve prosp\u011bch v\u00fd\u0161e zm\u00edn\u011bn\u00e9ho Amass. Nyn\u00ed je aquatone p\u0159eps\u00e1n v Go a v\u00edce zam\u011b\u0159en na p\u0159edb\u011b\u017enou pr\u016fzkum webov\u00fdch str\u00e1nek. K tomu aquatone proch\u00e1z\u00ed ozna\u010den\u00fdmi dom\u00e9nami a hled\u00e1 na nich webov\u00e9 str\u00e1nky na r\u016fzn\u00fdch portech, pot\u00e9 shroma\u017e\u010fuje v\u0161echny informace o str\u00e1nce a vytv\u00e1\u0159\u00ed screenshot. Je pohodln\u00fd pro rychlou p\u0159edb\u011b\u017enou pr\u016fzkum webov\u00fdch str\u00e1nek, po n\u011bm\u017e lze vybrat prioritn\u00ed c\u00edle pro \u00fatoky.<\/p>\n<h4>Plusy:<\/h4>\n<p><\/p>\n<ul>\n<li>Na v\u00fdstupu vytv\u00e1\u0159\u00ed skupinu soubor\u016f a slo\u017eek, kter\u00e9 je mo\u017en\u00e9 pohodln\u011b pou\u017e\u00edt p\u0159i dal\u0161\u00ed pr\u00e1ci s jin\u00fdmi n\u00e1stroji:<br \/>\n * HTML-bericht se shrom\u00e1\u017ed\u011bn\u00fdmi sn\u00edmky obrazovky a seskupen\u00fdmi podle podobnosti z\u00e1v\u011bry odpov\u011bd\u00ed;<\/p>\n<p>* Soubor se v\u0161emi URL, na kter\u00fdch byly nalezeny webov\u00e9 str\u00e1nky;<\/p>\n<p> * Soubor se statistikou a daty str\u00e1nky;<\/p>\n<p>* Slo\u017eka se soubory obsahuj\u00edc\u00edmi hlavi\u010dky odpov\u011bd\u00ed od nalezen\u00fdch c\u00edl\u016f; <\/p>\n<p>* Slo\u017eka se soubory obsahuj\u00edc\u00edmi t\u011blo odpov\u011bdi od nalezen\u00fdch c\u00edl\u016f;<\/p>\n<p>* Screenshoty nalezen\u00fdch webov\u00fdch str\u00e1nek;<\/li>\n<li>Podporuje pr\u00e1ci s XML-berichty od Nmap a Masscan;<\/li>\n<li>Pou\u017e\u00edv\u00e1 headless Chrome\/Chromium pro renderov\u00e1n\u00ed screenshot\u016f. <\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li> M\u016f\u017ee upoutat pozornost syst\u00e9m\u016f detekce pr\u016fnik\u016f, a proto vy\u017eaduje nastaven\u00ed.<\/li>\n<\/ul>\n<p>\nScreenshot byl po\u0159\u00edzen pro jednu z star\u0161\u00edch verz\u00ed aquatone (v0.5.0), ve kter\u00e9 byla implementov\u00e1na funkce pro hled\u00e1n\u00ed DNS-subdom\u00e9n. Star\u0161\u00ed verze lze naj\u00edt na <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/michenriksen\/aquatone\/releases\">str\u00e1nce vyd\u00e1n\u00ed<\/a><\/noindex>.<br \/>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, nebo jak za\u010d\u00edt pentesterovi?\" src=\"\/wp-content\/uploads\/2019\/05\/42cf06a7d2ea19f973f76dccd0442bb8.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"MassDNS\"><\/a><\/noindex>MassDNS<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/blechschmidt\/massdns\">MassDNS<\/a><\/noindex> \u2014 dal\u0161\u00ed n\u00e1stroj pro hled\u00e1n\u00ed DNS-subdom\u00e9n. Jeho hlavn\u00ed rozd\u00edl spo\u010d\u00edv\u00e1 v tom, \u017ee prov\u00e1d\u00ed DNS dotazy p\u0159\u00edmo na mno\u017estv\u00ed r\u016fzn\u00fdch DNS resolver\u016f a d\u011bl\u00e1 to s v\u00fdznamnou rychlost\u00ed. <\/p>\n<h4>Plusy:<\/h4>\n<p><\/p>\n<ul>\n<li>Rychl\u00fd \u2013 dok\u00e1\u017ee vy\u0159e\u0161it v\u00edce ne\u017e 350 tis\u00edc jmen za sekundu.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>MassDNS m\u016f\u017ee v\u00fdrazn\u011b zat\u00ed\u017eit pou\u017eit\u00e9 DNS resolvery, co\u017e m\u016f\u017ee v\u00e9st k jejich zablokov\u00e1n\u00ed nebo st\u00ed\u017enostem u va\u0161eho poskytovatele. Krom\u011b toho zp\u016fsob\u00ed velkou z\u00e1t\u011b\u017e na DNS serverech spole\u010dnosti, pokud tyto existuj\u00ed a odpov\u00eddaj\u00ed za dom\u00e9ny, kter\u00e9 se pokou\u0161\u00edte vy\u0159e\u0161it. <\/li>\n<li> Seznam resolver\u016f je v sou\u010dasn\u00e9 dob\u011b zastaral\u00fd, ale pokud odstran\u00edte nefunk\u010dn\u00ed DNS resolvery a p\u0159id\u00e1te nov\u00e9 zn\u00e1m\u00e9, v\u0161e bude v po\u0159\u00e1dku.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, nebo jak za\u010d\u00edt pentesterovi?\" src=\"\/wp-content\/uploads\/2019\/05\/a53181d6982b8d115ec5ece79fbca157.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Sn\u00edmek obrazovky aquatone v0.5.0<\/i><\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"nsec3map\"><\/a><\/noindex>nsec3map<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/anonion0\/nsec3map\">nsec3map<\/a><\/noindex> \u2013 n\u00e1stroj na Pythonu pro z\u00edsk\u00e1n\u00ed kompletn\u00edho seznamu dom\u00e9n chr\u00e1n\u011bn\u00fdch DNSSEC.<\/p>\n<h4>Plusy:<\/h4>\n<p><\/p>\n<ul>\n<li>Rychle detekuje hostitele v DNS z\u00f3n\u00e1ch s minim\u00e1ln\u00edm po\u010dtem dotaz\u016f, pokud je v z\u00f3n\u011b povolena podpora DNSSEC;<\/li>\n<li>Obsahuje plugin pro John the Ripper, kter\u00fd lze pou\u017e\u00edt k prolomen\u00ed z\u00edskan\u00fdch hash\u016f NSEC3.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Mnoho DNS chyb se zpracov\u00e1v\u00e1 nespr\u00e1vn\u011b;<\/li>\n<li>Neexistuje automatick\u00e9 paraleln\u00ed zpracov\u00e1n\u00ed NSEC z\u00e1znam\u016f \u2013 je nutn\u00e9 ru\u010dn\u011b rozd\u011blit jmenn\u00fd prostor;<\/li>\n<li>Vysok\u00e1 spot\u0159eba pam\u011bti.<\/li>\n<\/ul>\n<p><\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Acunetix\"><\/a><\/noindex>Acunetix<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/www.acunetix.com\/\">Acunetix<\/a><\/noindex> \u2013 skener webov\u00fdch zranitelnost\u00ed, kter\u00fd automatizuje proces testov\u00e1n\u00ed bezpe\u010dnosti webov\u00fdch aplikac\u00ed. Testuje aplikaci na p\u0159\u00edtomnost SQL injekc\u00ed, XSS, XXE, SSRF a mnoha dal\u0161\u00edch webov\u00fdch zranitelnost\u00ed. Nicm\u00e9n\u011b jako mnoho jin\u00fdch skener\u016f zranitelnost\u00ed nenahrad\u00ed pentestera, proto\u017ee slo\u017eit\u00e9 \u0159et\u011bzce zranitelnost\u00ed nebo zranitelnosti v logice nen\u00ed schopen naj\u00edt. P\u0159esto pokr\u00fdv\u00e1 mnoho r\u016fzn\u00fdch zranitelnost\u00ed, v\u010detn\u011b r\u016fzn\u00fdch CVE, na kter\u00e9 pentester mohl zapomenout, co\u017e je velmi u\u017eite\u010dn\u00e9 pro uvoln\u011bn\u00ed od rutinn\u00edho testov\u00e1n\u00ed.<\/p>\n<h4>Plusy:<\/h4>\n<p><\/p>\n<ul>\n<li>N\u00edzk\u00e1 \u00farove\u0148 fale\u0161n\u00fdch pozitiv.<\/li>\n<li>V\u00fdsledky lze exportovat ve form\u011b report\u016f;<\/li>\n<li>Prov\u00e1d\u00ed velk\u00e9 mno\u017estv\u00ed kontrol na r\u016fzn\u00e9 zranitelnosti;<\/li>\n<li>Paraleln\u00ed skenov\u00e1n\u00ed n\u011bkolika hostitel\u016f. <\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Neexistuje algoritmus deduplikace (funk\u010dn\u011b stejn\u00e9 str\u00e1nky Acunetix pova\u017euje za r\u016fzn\u00e9, proto\u017ee vedou k r\u016fzn\u00fdm URL), ale v\u00fdvoj\u00e1\u0159i na tom pracuj\u00ed;<\/li>\n<li>Vy\u017eaduje instalaci na samostatn\u00e9m webov\u00e9m serveru, co\u017e komplikuje testov\u00e1n\u00ed klientsk\u00fdch syst\u00e9m\u016f s p\u0159ipojen\u00edm p\u0159es VPN a pou\u017e\u00edv\u00e1n\u00ed skeneru v izolovan\u00e9m segmentu m\u00edstn\u00ed klientsk\u00e9 s\u00edt\u011b;<\/li>\n<li>M\u016f\u017ee \"zne\u010distit\" zkoumanou slu\u017ebu, nap\u0159\u00edklad poslat do kontaktn\u00edho formul\u00e1\u0159e na webu p\u0159\u00edli\u0161 mnoho \u00fato\u010dn\u00fdch vektor\u016f, \u010d\u00edm\u017e m\u016f\u017ee v\u00fdrazn\u011b zkomplikovat podnikov\u00e9 procesy;<\/li>\n<li>Je propriet\u00e1rn\u00ed a tedy placen\u00e9 \u0159e\u0161en\u00ed.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, nebo jak za\u010d\u00edt pentesterovi?\" src=\"\/wp-content\/uploads\/2019\/05\/3756cfae6f3cbf221c42c8a439f6ee86.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Dirsearch\"><\/a><\/noindex>Dirsearch<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/maurosoria\/dirsearch\">Dirsearch<\/a><\/noindex> \u2014 n\u00e1stroj v Pythonu pro bruteforce adres\u00e1\u0159\u016f a soubor\u016f na webov\u00fdch str\u00e1nk\u00e1ch. <\/p>\n<h4>Plusy:<\/h4>\n<p><\/p>\n<ul>\n<li>Dok\u00e1\u017ee rozli\u0161it skute\u010dn\u00e9 str\u00e1nky s \"200 OK\" od str\u00e1nek \"200 OK\", ale s textem \"str\u00e1nka nenalezena\";<\/li>\n<li>Dod\u00e1v\u00e1 se s pohodln\u00fdm slovn\u00edkem, kter\u00fd m\u00e1 dobr\u00fd pom\u011br mezi velikost\u00ed a efektivitou vyhled\u00e1v\u00e1n\u00ed. Obsahuje standardn\u00ed cesty charakteristick\u00e9 pro mnoho CMS a technologick\u00fdch stack\u016f;<\/li>\n<li>Vlastn\u00ed form\u00e1t slovn\u00edku, kter\u00fd umo\u017e\u0148uje dos\u00e1hnout dobr\u00e9 efektivity a flexibility p\u0159i prohled\u00e1v\u00e1n\u00ed soubor\u016f a adres\u00e1\u0159\u016f;<\/li>\n<li>Pohodln\u00fd v\u00fdstup \u2014 jednoduch\u00fd text, JSON;<\/li>\n<li>Dok\u00e1\u017ee prov\u00e1d\u011bt throttling \u2014 pauzy mezi po\u017eadavky, co\u017e je \u017eivotn\u011b d\u016fle\u017eit\u00e9 pro jakoukoli slabou slu\u017ebu.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>P\u0159\u00edpony je t\u0159eba p\u0159ed\u00e1vat jako \u0159et\u011bzec, co\u017e nen\u00ed pohodln\u00e9, pokud je pot\u0159eba p\u0159edat mnoho p\u0159\u00edpon najednou;<\/li>\n<li>Pro pou\u017eit\u00ed vlastn\u00edho slovn\u00edku je nutn\u00e9 ho m\u00edrn\u011b upravit na form\u00e1t slovn\u00edk\u016f Dirsearch pro maxim\u00e1ln\u00ed efektivitu.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, nebo jak za\u010d\u00edt pentesterovi?\" src=\"\/wp-content\/uploads\/2019\/05\/00676a0d7916ecc4cc521a3a5e8607e5.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"wfuzz\"><\/a><\/noindex>wfuzz<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/xmendez\/wfuzz\">wfuzz<\/a><\/noindex> \u2014 webov\u00fd fuzz tester napsan\u00fd v Go, vytvo\u0159en\u00fd podle vzoru wfuzz, umo\u017e\u0148uje bruteforce soubor\u016f, adres\u00e1\u0159\u016f, URL cest, n\u00e1zv\u016f a hodnot GET\/POST parametr\u016f, HTTP hlavi\u010dky, v\u010detn\u011b hlavi\u010dky Host pro bruteforce virtu\u00e1ln\u00edch hostitel\u016f. Na rozd\u00edl od sv\u00e9ho sourozence wfuzz se vyzna\u010duje vy\u0161\u0161\u00ed rychlost\u00ed a n\u011bkter\u00fdmi nov\u00fdmi funkcemi, jako je podpora slovn\u00edk\u016f ve form\u00e1tu Dirsearch. <\/p>\n<h4>Plusy:<\/h4>\n<p><\/p>\n<ul>\n<li>Multi-funk\u010dn\u00ed \u2014 modul\u00e1rn\u00ed struktura, sestaven\u00ed trv\u00e1 n\u011bkolik minut;<\/li>\n<li>Pohodln\u00fd mechanismus filtrace a fuzzingu;<\/li>\n<li>M\u016f\u017eete fuzzovat jakoukoli HTTP metodu, stejn\u011b jako jak\u00e9koli m\u00edsto v HTTP po\u017eadavku.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Ve st\u00e1diu v\u00fdvoje.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, nebo jak za\u010d\u00edt pentesterovi?\" src=\"\/wp-content\/uploads\/2019\/05\/f3b2ae5036eb8b8032f16516e78c82d0.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"ffuf\"><\/a><\/noindex>ffuf<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/ffuf\/ffuf\">ffuf<\/a><\/noindex> \u2014 webov\u00fd fuzz tester napsan\u00fd v Go, vytvo\u0159en\u00fd podle vzoru wfuzz, umo\u017e\u0148uje bruteforce soubor\u016f, adres\u00e1\u0159\u016f, URL cest, n\u00e1zv\u016f a hodnot GET\/POST parametr\u016f, HTTP hlavi\u010dky, v\u010detn\u011b hlavi\u010dky Host pro bruteforce virtu\u00e1ln\u00edch hostitel\u016f. Na rozd\u00edl od sv\u00e9ho sourozence wfuzz se vyzna\u010duje vy\u0161\u0161\u00ed rychlost\u00ed a n\u011bkter\u00fdmi nov\u00fdmi funkcemi, jako je podpora slovn\u00edk\u016f ve form\u00e1tu Dirsearch.<\/p>\n<h4>Plusy:<\/h4>\n<p><\/p>\n<ul>\n<li>Filtry jsou podobn\u00e9 filtr\u016fm wfuzz, umo\u017e\u0148uj\u00ed flexibiln\u011b nastavit bruteforce;<\/li>\n<li>Umo\u017e\u0148uje fuzzovat hodnoty HTTP hlavi\u010dek, data POST po\u017eadavk\u016f a r\u016fzn\u00e9 \u010d\u00e1sti URL, v\u010detn\u011b n\u00e1zv\u016f a hodnot GET parametr\u016f;<\/li>\n<li>M\u016f\u017eete zadat jakoukoli HTTP metodu.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Ve st\u00e1diu v\u00fdvoje.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, nebo jak za\u010d\u00edt pentesterovi?\" src=\"\/wp-content\/uploads\/2019\/05\/f432340ca10a6d834d01be4577f65fe2.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"gobuster\"><\/a><\/noindex>gobuster<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/OJ\/gobuster\">gobuster<\/a><\/noindex> \u2014 n\u00e1stroj na Go pro pr\u016fzkum, m\u00e1 dva pracovn\u00ed re\u017eimy. Prvn\u00ed se pou\u017e\u00edv\u00e1 pro brut\u00e1ln\u00ed s\u00edly soubor\u016f a adres\u00e1\u0159\u016f na webu, druh\u00fd \u2014 pro enumeraci DNS subdom\u00e9n. N\u00e1stroj p\u016fvodn\u011b nepodporuje rekurzivn\u00ed proch\u00e1zen\u00ed soubor\u016f a adres\u00e1\u0159\u016f, co\u017e samoz\u0159ejm\u011b \u0161et\u0159\u00ed \u010das, ale na druhou stranu je t\u0159eba spustit brut\u00e1ln\u00ed s\u00edlu pro ka\u017ed\u00fd nov\u00fd koncov\u00fd bod na webu zvl\u00e1\u0161\u0165.<\/p>\n<h4>Plusy:<\/h4>\n<p><\/p>\n<ul>\n<li>Vysok\u00e1 rychlost p\u0159i pr\u00e1ci jak pro enumeraci DNS subdom\u00e9n, tak pro brut\u00e1ln\u00ed s\u00edlu soubor\u016f a adres\u00e1\u0159\u016f.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>V aktu\u00e1ln\u00ed verzi nepodporuje nastaven\u00ed HTTP hlavi\u010dek;<\/li>\n<li>Ve v\u00fdchoz\u00edm nastaven\u00ed pova\u017euje za platn\u00e9 pouze n\u011bkter\u00e9 HTTP stavov\u00e9 k\u00f3dy (200, 204, 301, 302, 307).<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, nebo jak za\u010d\u00edt pentesterovi?\" src=\"\/wp-content\/uploads\/2019\/05\/2ce6c6ae6bbd0d2dc851ed632b5bc309.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Arjun\"><\/a><\/noindex>Arjun<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/s0md3v\/Arjun\">Arjun<\/a><\/noindex> \u2014 n\u00e1stroj pro brut\u00e1ln\u00ed s\u00edlu skryt\u00fdch HTTP parametr\u016f v GET\/POST parametrech, stejn\u011b jako v JSON. Vestav\u011bn\u00fd slovn\u00edk obsahuje 25 980 slov, kter\u00e1 Ajrun kontroluje t\u00e9m\u011b\u0159 za 30 sekund. D\u016fraz je kladen na to, \u017ee Ajrun nekontroluje ka\u017ed\u00fd parametr zvl\u00e1\u0161\u0165, ale ov\u011b\u0159uje p\u0159ibli\u017en\u011b 1000 parametr\u016f najednou a sleduje, zda se odpov\u011b\u010f zm\u011bnila. Pokud se odpov\u011b\u010f zm\u011bnila, rozd\u011bl\u00ed tuto tis\u00edcovku parametr\u016f na dv\u011b \u010d\u00e1sti a zjist\u00ed, kter\u00e1 z t\u011bchto \u010d\u00e1st\u00ed ovliv\u0148uje odpov\u011b\u010f. Takto se pomoc\u00ed jednoduch\u00e9ho bin\u00e1rn\u00edho vyhled\u00e1v\u00e1n\u00ed nalezne parametr nebo n\u011bkolik skryt\u00fdch parametr\u016f, kter\u00e9 ovlivnily odpov\u011b\u010f a mohou tedy existovat. <\/p>\n<h4>Plusy:<\/h4>\n<p><\/p>\n<ul>\n<li>Vysok\u00e1 rychlost pr\u00e1ce d\u00edky bin\u00e1rn\u00edmu vyhled\u00e1v\u00e1n\u00ed;<\/li>\n<li>Podpora GET\/POST parametr\u016f, stejn\u011b jako parametr\u016f ve form\u00e1tu JSON;<\/li>\n<\/ul>\n<p>\nPodobn\u00fdm zp\u016fsobem funguje i plugin pro Burp Suite \u2014 <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/PortSwigger\/param-miner\"><b>param-miner<\/b><\/a><\/noindex>, kter\u00fd je tak\u00e9 velmi dobr\u00fd ve vyhled\u00e1v\u00e1n\u00ed skryt\u00fdch HTTP parametr\u016f. Podrobn\u011bji o n\u011bm budeme hovo\u0159it v nadch\u00e1zej\u00edc\u00edm \u010dl\u00e1nku o Burp a jeho pluginech.<br \/>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, nebo jak za\u010d\u00edt pentesterovi?\" src=\"\/wp-content\/uploads\/2019\/05\/9571552d9954c5d9902ab658ecb77bbb.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"LinkFinder\"><\/a><\/noindex>LinkFinder<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/GerbenJavado\/LinkFinder\">LinkFinder<\/a><\/noindex> \u2014 skript v Pythonu pro hled\u00e1n\u00ed odkaz\u016f v JavaScriptov\u00fdch souborech. U\u017eite\u010dn\u00fd pro vyhled\u00e1v\u00e1n\u00ed skryt\u00fdch nebo zapomenut\u00fdch koncov\u00fdch bod\u016f\/URL v webov\u00e9 aplikaci.<\/p>\n<h4>Plusy:<\/h4>\n<p><\/p>\n<ul>\n<li>Rychl\u00fd;<\/li>\n<li>Existuje speci\u00e1ln\u00ed plugin pro Chrome zalo\u017een\u00fd na LinkFinderu.<\/li>\n<\/ul>\n<p>.<\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Neprakti\u010dt\u00fd v\u00fdsledn\u00fd v\u00fdstup;<\/li>\n<li>Nerozeb\u00edr\u00e1 JavaScript v dynamice;<\/li>\n<li>Pom\u011brn\u011b jednoduch\u00e1 logika hled\u00e1n\u00ed odkaz\u016f \u2014 pokud je JavaScript n\u011bjak\u00fdm zp\u016fsobem zmate\u010dn\u00fd, nebo odkazy p\u016fvodn\u011b chyb\u00ed a generuj\u00ed se dynamicky, nebude schopen nic naj\u00edt. <\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, nebo jak za\u010d\u00edt pentesterovi?\" src=\"\/wp-content\/uploads\/2019\/05\/4cbb12ad81b249cdb21a2f4861acc346.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"JSParser\"><\/a><\/noindex>JSParser<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/nahamsec\/JSParser\">JSParser<\/a><\/noindex> \u2014 skript v Pythonu, kter\u00fd pou\u017e\u00edv\u00e1 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tornadoweb.org\/en\/stable\/\">Tornado<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"https:\/\/beautifier.io\/\">JSBeautifier<\/a><\/noindex> pro anal\u00fdzu relativn\u00edch URL adres v JavaScriptov\u00fdch souborech. Velmi u\u017eite\u010dn\u00e9 pro odhalen\u00ed AJAXov\u00fdch po\u017eadavk\u016f a sestaven\u00ed seznamu API metod, se kter\u00fdmi aplikace interaguje. Efektivn\u011b funguje v kombinaci s LinkFinderem. <\/p>\n<h4>Plusy:<\/h4>\n<p><\/p>\n<ul>\n<li>Rychl\u00e9 parsov\u00e1n\u00ed JavaScriptov\u00fdch soubor\u016f.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, nebo jak za\u010d\u00edt pentesterovi?\" src=\"\/wp-content\/uploads\/2019\/05\/20812f77021319d9d1d7eafd5d394383.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"sqlmap\"><\/a><\/noindex>sqlmap<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/sqlmapproject\/sqlmap\">sqlmap<\/a><\/noindex> \u2014 pravd\u011bpodobn\u011b jeden z nejzn\u00e1m\u011bj\u0161\u00edch n\u00e1stroj\u016f pro anal\u00fdzu webov\u00fdch aplikac\u00ed. Sqlmap automatizuje hled\u00e1n\u00ed a vyu\u017e\u00edv\u00e1n\u00ed SQL injekc\u00ed, pracuje s r\u016fzn\u00fdmi dialekty SQL a disponuje obrovsk\u00fdm mno\u017estv\u00edm r\u016fzn\u00fdch technik, po\u010d\u00ednaje jednoduch\u00fdmi \u00fatoky s pou\u017eit\u00edm jednoduch\u00fdch uvozovek a kon\u010de slo\u017eit\u00fdmi vektory pro SQL injekce zalo\u017een\u00e9 na \u010dase. Nav\u00edc m\u00e1 mnoho technik pro dal\u0161\u00ed vyu\u017eit\u00ed pro r\u016fzn\u00e9 datab\u00e1zov\u00e9 syst\u00e9my, je tedy u\u017eite\u010dn\u00fd nejen jako skener pro SQL injekce, ale tak\u00e9 jako mocn\u00fd n\u00e1stroj pro vyu\u017eit\u00ed ji\u017e nalezen\u00fdch SQL injekc\u00ed.<\/p>\n<h4>Plusy:<\/h4>\n<p><\/p>\n<ul>\n<li>Velk\u00e9 mno\u017estv\u00ed r\u016fzn\u00fdch technik a vektor\u016f;<\/li>\n<li>N\u00edzk\u00fd po\u010det fale\u0161n\u011b pozitivn\u00edch v\u00fdsledk\u016f;<\/li>\n<li>Mnoho mo\u017enost\u00ed pro p\u0159esn\u00e9 nastaven\u00ed, r\u016fzn\u00e9 techniky, c\u00edlov\u00e1 datab\u00e1ze, skripty pro obch\u00e1zen\u00ed WAF;<\/li>\n<li>Mo\u017enost vytvo\u0159en\u00ed dumpu v\u00fdstupn\u00edch dat;<\/li>\n<li>Mnoho r\u016fzn\u00fdch mo\u017enost\u00ed pro vyu\u017eit\u00ed, nap\u0159\u00edklad pro n\u011bkter\u00e9 datab\u00e1ze \u2014 automatick\u00e9 na\u010d\u00edt\u00e1n\u00ed\/vyt\u011b\u017een\u00ed soubor\u016f, z\u00edsk\u00e1n\u00ed mo\u017enosti vykon\u00e1vat p\u0159\u00edkazy (RCE) a dal\u0161\u00ed;<\/li>\n<li>Podpora p\u0159\u00edm\u00e9ho p\u0159ipojen\u00ed k datab\u00e1zi pomoc\u00ed dat z\u00edskan\u00fdch b\u011bhem \u00fatoku;<\/li>\n<li>Na vstup lze zadat textov\u00fd soubor s v\u00fdsledky pr\u00e1ce Burp \u2014 nen\u00ed pot\u0159eba ru\u010dn\u011b sestavovat v\u0161echny atributy p\u0159\u00edkazov\u00e9ho \u0159\u00e1dku.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Obt\u00ed\u017en\u00e9 p\u0159izp\u016fsobit, nap\u0159\u00edklad napsat vlastn\u00ed ov\u011b\u0159en\u00ed kv\u016fli nedostate\u010dn\u00e9 dokumentaci pro toto;<\/li>\n<li>Bez odpov\u00eddaj\u00edc\u00edho nastaven\u00ed prov\u00e1d\u00ed ne\u00faplnou sadu kontrol, co\u017e m\u016f\u017ee uv\u00e9st v omyl.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, nebo jak za\u010d\u00edt pentesterovi?\" src=\"\/wp-content\/uploads\/2019\/05\/f99ac42bd3139894668353924112d416.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"NoSQLMap\"><\/a><\/noindex>NoSQLMap<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/codingo\/NoSQLMap\">NoSQLMap<\/a><\/noindex> \u2014 n\u00e1stroj v Pythonu pro automatizaci hled\u00e1n\u00ed a exploataci NoSQL injekc\u00ed. Snadno se pou\u017e\u00edv\u00e1 nejen v NoSQL datab\u00e1z\u00edch, ale tak\u00e9 p\u0159\u00edmo p\u0159i auditech webov\u00fdch aplikac\u00ed, kter\u00e9 pou\u017e\u00edvaj\u00ed NoSQL.<\/p>\n<h4>Plusy:<\/h4>\n<p><\/p>\n<ul>\n<li>Podobn\u011b jako sqlmap, umo\u017e\u0148uje nejen nal\u00e9zt potenci\u00e1ln\u00ed zranitelnost, ale tak\u00e9 zkoum\u00e1 mo\u017enost jej\u00ed exploitation pro MongoDB a CouchDB.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Nepodporuje NoSQL pro Redis, Cassandra, na tomto sm\u011bru se pracuje.<\/li>\n<\/ul>\n<h2><noindex><a rel=\"nofollow\" name=\"oxml_xxe\"><\/a><\/noindex>oxml_xxe<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/BuffaloWill\/oxml_xxe\">oxml_xxe<\/a><\/noindex> \u2014 n\u00e1stroj pro vkl\u00e1d\u00e1n\u00ed XXE XML exploit\u016f do r\u016fzn\u00fdch typ\u016f soubor\u016f, ve kter\u00fdch se jak\u00fdmkoli zp\u016fsobem pou\u017e\u00edv\u00e1 XML form\u00e1t.<\/p>\n<h4>Plusy:<\/h4>\n<p><\/p>\n<ul>\n<li>Podporuje mnoho b\u011b\u017en\u00fdch form\u00e1t\u016f, jako jsou DOCX, ODT, SVG, XML.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Podpora PDF, JPEG, GIF nen\u00ed \u00fapln\u011b realizov\u00e1na;<\/li>\n<li>Vytv\u00e1\u0159\u00ed pouze jeden soubor. Pro \u0159e\u0161en\u00ed tohoto probl\u00e9mu lze pou\u017e\u00edt n\u00e1stroj <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/BuffaloWill\/oxml_xxe\">docem<\/a><\/noindex>, kter\u00fd m\u016f\u017ee vytvo\u0159it velk\u00e9 mno\u017estv\u00ed soubor\u016f s payloady na r\u016fzn\u00fdch m\u00edstech. <\/li>\n<\/ul>\n<p>\nUveden\u00e9 n\u00e1stroje \u00fa\u010dinn\u011b testuj\u00ed XXE p\u0159i nahr\u00e1v\u00e1n\u00ed dokument\u016f obsahuj\u00edc\u00edch XML. Nezapom\u00ednejte v\u0161ak, \u017ee zpracovatel\u00e9 XML form\u00e1t\u016f se mohou vyskytovat v mnoha dal\u0161\u00edch p\u0159\u00edpadech, nap\u0159\u00edklad XML m\u016f\u017ee b\u00fdt pou\u017eito jako datov\u00fd form\u00e1t m\u00edsto JSON.<\/p>\n<p>Doporu\u010dujeme proto v\u011bnovat pozornost n\u00e1sleduj\u00edc\u00edmu repozit\u00e1\u0159i, kter\u00fd obsahuje velk\u00e9 mno\u017estv\u00ed r\u016fzn\u00fdch payload\u016f: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/swisskyrepo\/PayloadsAllTheThings\">PayloadsAllTheThings<\/a><\/noindex>.<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"tplmap\"><\/a><\/noindex>tplmap<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/epinna\/tplmap\">tplmap<\/a><\/noindex> \u2014 n\u00e1stroj v Pythonu pro automatick\u00e9 odhalov\u00e1n\u00ed a vyu\u017e\u00edv\u00e1n\u00ed zranitelnost\u00ed Server-Side Template Injection, m\u00e1 podobn\u00e1 nastaven\u00ed a p\u0159\u00edznaky jako sqlmap. Pou\u017e\u00edv\u00e1 n\u011bkolik r\u016fzn\u00fdch technik a vektor\u016f, v\u010detn\u011b blind-injekc\u00ed, a m\u00e1 techniky pro spou\u0161t\u011bn\u00ed k\u00f3du a na\u010d\u00edt\u00e1n\u00ed\/vkl\u00e1d\u00e1n\u00ed libovoln\u00fdch soubor\u016f. Krom\u011b toho m\u00e1 ve sv\u00e9m arzen\u00e1lu techniky pro des\u00edtky r\u016fzn\u00fdch \u0161ablonovac\u00edch stroj\u016f a n\u011bkter\u00e9 techniky pro vyhled\u00e1v\u00e1n\u00ed vybaven\u00ed eval()-podobn\u00fdch injekc\u00ed k\u00f3du v Pythonu, Ruby, PHP, JavaScriptu. V p\u0159\u00edpad\u011b \u00fasp\u011b\u0161n\u00e9 exploatace otev\u00edr\u00e1 interaktivn\u00ed konzoli.<\/p>\n<h4>Plusy:<\/h4>\n<p><\/p>\n<ul>\n<li>Velk\u00e9 mno\u017estv\u00ed r\u016fzn\u00fdch technik a vektor\u016f; <\/li>\n<li>Podporuje mnoho motor\u016f pro rendering \u0161ablon;<\/li>\n<li>Mnoho technik exploatace.<\/li>\n<\/ul>\n<p><\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"CeWL\"><\/a><\/noindex>CeWL<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/digininja\/CeWL\">CeWL<\/a><\/noindex> \u2014 gener\u00e1tor slovn\u00edk\u016f v Ruby, navr\u017een\u00fd pro extrakci unik\u00e1tn\u00edch slov z ur\u010den\u00e9 webov\u00e9 str\u00e1nky, projde odkazy na str\u00e1nce do zadan\u00e9 hloubky. Sestaven\u00fd slovn\u00edk z unik\u00e1tn\u00edch slov lze pot\u00e9 pou\u017e\u00edt k brute force hesel na slu\u017eb\u00e1ch nebo k brute force soubor\u016f a adres\u00e1\u0159\u016f na stejn\u00e9 webov\u00e9 str\u00e1nce, nebo k \u00fatoku na z\u00edskan\u00e9 hashe pomoc\u00ed hashcat nebo John the Ripper. Je u\u017eite\u010dn\u00fd p\u0159i sestavov\u00e1n\u00ed \"c\u00edlov\u00e9ho\" seznamu potenci\u00e1ln\u00edch hesel.<\/p>\n<h4>Plusy:<\/h4>\n<p><\/p>\n<ul>\n<li>Snadn\u00e9 pou\u017eit\u00ed.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Je t\u0159eba b\u00fdt opatrn\u00fd s hloubkou vyhled\u00e1v\u00e1n\u00ed, aby se nezachytily zbyte\u010dn\u00e9 dom\u00e9ny.<\/li>\n<\/ul>\n<p><\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Weakpass\"><\/a><\/noindex>Weakpass<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/weakpass.com\">Weakpass<\/a><\/noindex> \u2014 slu\u017eba obsahuj\u00edc\u00ed mnoho slovn\u00edk\u016f s unik\u00e1tn\u00edmi hesly. Extr\u00e9mn\u011b u\u017eite\u010dn\u00e1 pro r\u016fzn\u00e9 \u00fakoly spojen\u00e9 s hackov\u00e1n\u00edm hesel, od jednoduch\u00e9ho online brute force \u00fa\u010dt\u016f na c\u00edlov\u00fdch slu\u017eb\u00e1ch a\u017e po offline brute force z\u00edskan\u00fdch hash\u016f pomoc\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/hashcat.net\/hashcat\/\">hashcat<\/a><\/noindex> nebo <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/john\/\">John The Ripper<\/a><\/noindex>. Obsahuje p\u0159ibli\u017en\u011b 8 miliard hesel o d\u00e9lce od 4 do 25 znak\u016f. <\/p>\n<h4>Plusy:<\/h4>\n<p><\/p>\n<ul>\n<li>Obsahuje jak specifick\u00e9 slovn\u00edky, tak slovn\u00edky s nej\u010dast\u011bji se vyskytuj\u00edc\u00edmi hesly \u2014 je mo\u017en\u00e9 vybrat konkr\u00e9tn\u00ed slovn\u00edk podle vlastn\u00edch pot\u0159eb;<\/li>\n<li>Slovn\u00edky se pravideln\u011b aktualizuj\u00ed a dopl\u0148uj\u00ed nov\u00fdmi hesly;<\/li>\n<li>Slovn\u00edky jsou se\u0159azeny podle efektivity. M\u016f\u017eete si vybrat variantu jak pro rychl\u00fd online bruteforce, tak pro podrobn\u00e9 vyb\u00edr\u00e1n\u00ed hesel z rozs\u00e1hl\u00e9ho slovn\u00edku s posledn\u00edmi \u00faniky;<\/li>\n<li>Je tu kalkula\u010dka, kter\u00e1 ukazuje \u010das bruteforce hesel na va\u0161em za\u0159\u00edzen\u00ed.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, nebo jak za\u010d\u00edt pentesterovi?\" src=\"\/wp-content\/uploads\/2019\/05\/1e9daeca2b42b5ba4dd7750bee2ef36c.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDo samostatn\u00e9 skupiny bychom cht\u011bli za\u0159adit n\u00e1stroje pro kontrolu CMS: WPScan, JoomScan a AEM hacker. <\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"AEM_hacker\"><\/a><\/noindex>AEM_hacker<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/0ang3el\/aem-hacker\">AEM hacker<\/a><\/noindex> \u2014 n\u00e1stroj pro odhalov\u00e1n\u00ed zranitelnost\u00ed v aplikac\u00edch Adobe Experience Manager (AEM). <\/p>\n<h4>Plusy:<\/h4>\n<p><\/p>\n<ul>\n<li>M\u016f\u017ee detekovat AEM aplikace ze seznamu URL, kter\u00e9 mu byly p\u0159edlo\u017eeny;<\/li>\n<li>Obsahuje skripty pro z\u00edsk\u00e1n\u00ed RCE prost\u0159ednictv\u00edm nahr\u00e1v\u00e1n\u00ed JSP shellu nebo exploitac\u00ed SSRF.<\/li>\n<\/ul>\n<p><\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"JoomScan\"><\/a><\/noindex>JoomScan<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/rezasp\/joomscan\">JoomScan<\/a><\/noindex> \u2014 n\u00e1stroj v Perl pro automatizaci objevov\u00e1n\u00ed zranitelnost\u00ed p\u0159i nasazen\u00ed Joomla CMS. <\/p>\n<h4>Plusy:<\/h4>\n<p><\/p>\n<ul>\n<li>Je schopen vyhled\u00e1vat nedostatky v konfiguraci a probl\u00e9my s administr\u00e1torsk\u00fdmi nastaven\u00edmi;<\/li>\n<li>Vypisuje verze Joomla a s nimi spojen\u00e9 zranitelnosti, podobn\u011b jako pro jednotliv\u00e9 komponenty;<\/li>\n<li>Obsahuje v\u00edce ne\u017e 1000 exploit\u016f na komponenty Joomla;<\/li>\n<li>Vyd\u00e1v\u00e1 z\u00e1v\u011bre\u010dn\u00e9 zpr\u00e1vy ve form\u00e1tu textu a HTML.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, nebo jak za\u010d\u00edt pentesterovi?\" src=\"\/wp-content\/uploads\/2019\/05\/2f9561213895d338f8e88127bf02c3e6.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"WPScan\"><\/a><\/noindex>WPScan<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/wpscanteam\/wpscan\">WPScan<\/a><\/noindex> \u2014 n\u00e1stroj pro skenov\u00e1n\u00ed webov\u00fdch str\u00e1nek na WordPressu, m\u00e1 ve sv\u00e9m arzen\u00e1lu zranitelnosti jak pro samotn\u00fd motor WordPress, tak pro n\u011bkter\u00e9 pluginy.<\/p>\n<h4>Plusy:<\/h4>\n<p><\/p>\n<ul>\n<li>Je schopen vyjmenovat nejen nebezpe\u010dn\u00e9 pluginy a \u0161ablony WordPress, ale tak\u00e9 z\u00edskat seznam u\u017eivatel\u016f a TimThumb soubory;<\/li>\n<li>M\u016f\u017ee prov\u00e1d\u011bt bruteforce \u00fatoky na WordPressov\u00e9 str\u00e1nky.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Bez odpov\u00eddaj\u00edc\u00edho nastaven\u00ed prov\u00e1d\u00ed ne\u00faplnou sadu kontrol, co\u017e m\u016f\u017ee uv\u00e9st v omyl.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, nebo jak za\u010d\u00edt pentesterovi?\" src=\"\/wp-content\/uploads\/2019\/05\/eb391071eb62381da16c425d95e7cec5.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCelkov\u011b r\u016fzn\u00ed lid\u00e9 preferuj\u00ed k pr\u00e1ci r\u016fzn\u00e9 n\u00e1stroje: v\u0161echny jsou dobr\u00e9 sv\u00fdm vlastn\u00edm zp\u016fsobem, a to, co se l\u00edbilo jednomu \u010dlov\u011bku, nemus\u00ed v\u016fbec vyhovovat druh\u00e9mu. Pokud se domn\u00edv\u00e1te, \u017ee jsme nezm\u00ednili n\u011bjakou dobrou utilitu \u2014 dejte n\u00e1m o n\u00ed v\u011bd\u011bt v koment\u00e1\u0159\u00edch!<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/dsec\/blog\/452836\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u043e \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0445 \u0434\u043b\u044f \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0430. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u041d\u0430\u0448 \u043a\u043e\u043b\u043b\u0435\u0433\u0430 BeLove \u0443\u0436\u0435 \u0434\u0435\u043b\u0430\u043b \u043f\u043e\u0434\u043e\u0431\u043d\u0443\u044e \u043f\u043e\u0434\u0431\u043e\u0440\u043a\u0443 \u043e\u043a\u043e\u043b\u043e \u0441\u0435\u043c\u0438 \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434. \u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e \u0432\u0437\u0433\u043b\u044f\u043d\u0443\u0442\u044c, \u043a\u0430\u043a\u0438\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u043b\u0438 \u0438 \u0443\u043a\u0440\u0435\u043f\u0438\u043b\u0438 \u0441\u0432\u043e\u0438 \u043f\u043e\u0437\u0438\u0446\u0438\u0438, \u0430 \u043a\u0430\u043a\u0438\u0435 \u043e\u0442\u043e\u0448\u043b\u0438 \u043d\u0430 \u0437\u0430\u0434\u043d\u0438\u0439 \u043f\u043b\u0430\u043d \u0438 \u0441\u0435\u0439\u0447\u0430\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0440\u0435\u0434\u043a\u043e. \u041e\u0442\u043c\u0435\u0442\u0438\u043c, \u0447\u0442\u043e \u0441\u044e\u0434\u0430 \u0436\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u0438 Burp Suite, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":26108,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-34646","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u043e \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0445 \u0434\u043b\u044f \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0430.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/web-tools-ili-s-chego-nachat-pentesteru\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Web tools, \u0438\u043b\u0438 \u0441 \u0447\u0435\u0433\u043e \u043d\u0430\u0447\u0430\u0442\u044c \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0443? | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u043e \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0445 \u0434\u043b\u044f \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0430.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/web-tools-ili-s-chego-nachat-pentesteru\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:59:35+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:59:35+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Webov\u00e9 n\u00e1stroje, nebo s \u010d\u00edm za\u010d\u00edt pentester? | ProHoster","description":"Pokra\u010dujeme v p\u0159edstaven\u00ed u\u017eite\u010dn\u00fdch n\u00e1stroj\u016f pro pentestera.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/web-tools-ili-s-chego-nachat-pentesteru","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Web tools, \u0438\u043b\u0438 \u0441 \u0447\u0435\u0433\u043e \u043d\u0430\u0447\u0430\u0442\u044c \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0443? | ProHoster","og:description":"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u043e \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0445 \u0434\u043b\u044f \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0430.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/web-tools-ili-s-chego-nachat-pentesteru","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:59:35+00:00","article:modified_time":"2019-10-31T18:59:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34646","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 20:04:30","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:17:23","updated":"2026-01-21 20:04:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/34646","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=34646"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/34646\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/26108"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=34646"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=34646"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=34646"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}