{"id":34646,"date":"2019-10-31T21:59:35","date_gmt":"2019-10-31T18:59:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/web-tools-ili-s-chego-nachat-pentesteru\/"},"modified":"2019-10-31T21:59:35","modified_gmt":"2019-10-31T18:59:35","slug":"web-tools-ili-s-chego-nachat-pentesteru","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/web-tools-ili-s-chego-nachat-pentesteru","title":{"rendered":"Webov\u00e9 n\u00e1stroje, alebo od \u010doho za\u010da\u0165 pentester?","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/dsec\/blog\/447882\/\">Pokra\u010dujeme<\/a><\/noindex> v rozpr\u00e1van\u00ed o u\u017eito\u010dn\u00fdch n\u00e1strojoch pre pentestera. V novom \u010dl\u00e1nku sa zameriame na n\u00e1stroje pre anal\u00fdzu zabezpe\u010denia webov\u00fdch aplik\u00e1ci\u00ed.<\/p>\n<p>N\u00e1\u0161 kolega <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/users\/belove\/\" class=\"user_link\">BeLove<\/a><\/noindex> u\u017e vytvoril podobn\u00fd <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/125317\/\">zoznam<\/a><\/noindex> asi pred siedmimi rokmi. Zauj\u00edmav\u00e9 je pozrie\u0165 sa na to, ktor\u00e9 n\u00e1stroje udr\u017eali a posilnili svoje poz\u00edcie, a ktor\u00e9 ust\u00fapili do pozadia a teraz sa pou\u017e\u00edvaj\u00fa zriedkavo.<br \/>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, alebo od \u010doho za\u010da\u0165 pentester?\" src=\"\/wp-content\/uploads\/2019\/05\/a6d02b9593ebdbe1b11ccc38e6357b2f.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nUpozorn\u00edme, \u017ee sem patr\u00ed aj Burp Suite, ale o \u0148om a jeho u\u017eito\u010dn\u00fdch pluginoch bude samostatn\u00e1 publik\u00e1cia.<\/p>\n<h2>Obsah:<\/h2>\n<p><\/p>\n<ul>\n<li> <noindex><a rel=\"nofollow\" href=\"#Amass\">Amass<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#Altdns\">Altdns<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#aquatone\">aquatone<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#MassDNS\">MassDNS<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#nsec3map\">nsec3map<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#Acunetix\">Acunetix<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#Dirsearch\">Dirsearch<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#wfuzz\">wfuzz<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#ffuf\">ffuf<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#gobuster\">gobuster<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#Arjun\">Arjun<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#LinkFinder\">LinkFinder<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#JSParser\">JSParser<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#sqlmap\">sqlmap<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#NoSQLMap\">NoSQLMap<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#oxml_xxe\">oxml_xxe<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#tplmap\">tplmap<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#CeWL\">CeWL<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#Weakpass\">Weakpass<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#AEM_hacker\">AEM_hacker<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#JoomScan\">JoomScan<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#WPScan\">WPScan<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Amass\"><\/a><\/noindex>Amass<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/OWASP\/Amass\">Amass<\/a><\/noindex> \u2014 n\u00e1stroj na Go na vyh\u013ead\u00e1vanie a preh\u013ead\u00e1vanie subdom\u00e9n DNS a tvorenie mapy vonkaj\u0161ej siete. Amass je projekt OWASP, vytvoren\u00fd na to, aby uk\u00e1zal, ako vyzeraj\u00fa organiz\u00e1cie na internete pre vonkaj\u0161ieho pozorovate\u013ea. N\u00e1zvy subdom\u00e9n z\u00edskava Amass r\u00f4znymi sp\u00f4sobmi, v n\u00e1stroji sa pou\u017e\u00edva ako rekurz\u00edvne preh\u013ead\u00e1vanie subdom\u00e9n, tak aj vyh\u013ead\u00e1vanie v otvoren\u00fdch zdrojoch.<\/p>\n<p>Na zistenie vz\u00e1jomne prepojen\u00fdch sie\u0165ov\u00fdch segmentov a \u010d\u00edsel auton\u00f3mnych syst\u00e9mov Amass pou\u017e\u00edva IP adresy z\u00edskan\u00e9 po\u010das pr\u00e1ce. V\u0161etky n\u00e1jden\u00e9 inform\u00e1cie sa pou\u017e\u00edvaj\u00fa na vytvorenie mapy siete.<\/p>\n<h4>V\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Techniky zberu inform\u00e1ci\u00ed zah\u0155\u0148aj\u00fa:<br \/>\n * DNS \u2014 preh\u013ead\u00e1vanie subdom\u00e9n pod\u013ea slovn\u00edka, bruteforce subdom\u00e9n, \u201einteligentn\u00e9\u201c preh\u013ead\u00e1vanie s pou\u017eit\u00edm mut\u00e1ci\u00ed na z\u00e1klade n\u00e1jden\u00fdch subdom\u00e9n, sp\u00e4tn\u00e9 DNS dopyty a vyh\u013ead\u00e1vanie DNS serverov, na ktor\u00fdch je mo\u017en\u00e9 zrealizova\u0165 dopyt na prenos z\u00f3ny (AXFR); <\/p>\n<p>* Vyh\u013ead\u00e1vanie v otvoren\u00fdch zdrojoch \u2014 Ask, Baidu, Bing, CommonCrawl, DNSDB, DNSDumpster, DNSTable, Dogpile, Exalead, FindSubdomains, Google, IPv4Info, Netcraft, PTRArchive, Riddler, SiteDossier, ThreatCrowd, VirusTotal, Yahoo;<\/p>\n<p>* Vyh\u013ead\u00e1vanie v datab\u00e1zach TLS certifik\u00e1tov \u2014 Censys, CertDB, CertSpotter, Crtsh, Entrust;<\/p>\n<p>* Pou\u017e\u00edvanie API vyh\u013ead\u00e1vac\u00edch syst\u00e9mov \u2014 BinaryEdge, BufferOver, CIRCL, HackerTarget, PassiveTotal, Robtex, SecurityTrails, Shodan, Twitter, Umbrella, URLScan;<\/p>\n<p>* Vyh\u013ead\u00e1vanie vo webov\u00fdch arch\u00edvoch internetu: ArchiveIt, ArchiveToday, Arquivo, LoCArchive, OpenUKArchive, UKGovArchive, Wayback;<\/li>\n<li>Integr\u00e1cia s Maltego; <\/li>\n<li>Zabezpe\u010duje najkompletnej\u0161ie pokrytie \u00falohy vyh\u013ead\u00e1vania DNS subdom\u00e9n.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>D\u00e1vajte pozor na amass.netdomains \u2014 pok\u00fasi sa oslovi\u0165 ka\u017ed\u00fa IP adresu v identifikovanej infra\u0161trukt\u00fare a z\u00edska\u0165 n\u00e1zvy dom\u00e9n z sp\u00e4tn\u00fdch DNS dotazov a TLS certifik\u00e1tov. Toto je \u201ehlasn\u00e1\u201c technika, m\u00f4\u017ee odhali\u0165 va\u0161e spravodajsk\u00e9 aktivity v sk\u00famanej organiz\u00e1cii. <\/li>\n<li>Vysok\u00e1 spotreba pam\u00e4te m\u00f4\u017ee dosiahnu\u0165 a\u017e 2 GB RAM v r\u00f4znych nastaveniach, \u010do neumo\u017en\u00ed spusti\u0165 tento n\u00e1stroj v cloude na lacnom VDS.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, alebo od \u010doho za\u010da\u0165 pentester?\" src=\"\/wp-content\/uploads\/2019\/05\/37e1dd6c273eaef2c7c979a57f98c0d9.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Altdns\"><\/a><\/noindex>Altdns<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/infosec-au\/altdns\">Altdns<\/a><\/noindex> \u2014 n\u00e1stroj v Pythone na zostavovanie slovn\u00edkov na prelomenie DNS subdom\u00e9n. Umo\u017e\u0148uje generova\u0165 mno\u017estvo variant subdom\u00e9n pomocou mut\u00e1ci\u00ed a permut\u00e1ci\u00ed. Na to sa pou\u017e\u00edvaj\u00fa slov\u00e1, ktor\u00e9 sa \u010dasto vyskytuj\u00fa v subdom\u00e9nach (napr\u00edklad: test, dev, staging), v\u0161etky mut\u00e1cie a permut\u00e1cie sa aplikuj\u00fa na u\u017e zn\u00e1me subdom\u00e9ny, ktor\u00e9 je mo\u017en\u00e9 poskytn\u00fa\u0165 do Altdns. Na v\u00fdstupe sa z\u00edskava zoznam vari\u00e1ci\u00ed subdom\u00e9n, ktor\u00e9 m\u00f4\u017eu existova\u0165, a tento zoznam sa n\u00e1sledne m\u00f4\u017ee pou\u017ei\u0165 pri DNS bruteforce.<\/p>\n<h4>V\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Dob\u0159e funguje s ve\u013ek\u00fdmi s\u00fabormi \u00fadajov.<\/li>\n<\/ul>\n<p><\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"aquatone\"><\/a><\/noindex>aquatone<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/michenriksen\/aquatone\">aquatone<\/a><\/noindex> \u2014 predt\u00fdm bol zn\u00e1mej\u0161\u00ed ako \u010fal\u0161\u00ed n\u00e1stroj na vyh\u013ead\u00e1vanie subdom\u00e9n, ale s\u00e1m autor sa vzdal tohto pr\u00edstupu v prospech vy\u0161\u0161ie uveden\u00e9ho Amass. Teraz je aquatone prepisovan\u00fd v Go a je viac zameran\u00fd na predbe\u017en\u00e9 prieskumy webov\u00fdch str\u00e1nok. Na tento \u00fa\u010del aquatone prech\u00e1dza zadan\u00fdmi dom\u00e9nami a h\u013ead\u00e1 na nich webov\u00e9 str\u00e1nky na r\u00f4znych portoch, pot\u00e9 zhroma\u017e\u010fuje v\u0161etky inform\u00e1cie o str\u00e1nke a rob\u00ed sn\u00edmky obrazovky. Je u\u017eito\u010dn\u00fd pre r\u00fdchly predbe\u017en\u00fd prieskum webov\u00fdch str\u00e1nok, po ktorom si m\u00f4\u017eete vybra\u0165 prioritn\u00e9 ciele pre \u00fatoky.<\/p>\n<h4>V\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Na v\u00fdstupe vytv\u00e1ra skupinu s\u00faborov a prie\u010dinkov, ktor\u00e9 s\u00fa pohodln\u00e9 na \u010fal\u0161iu pr\u00e1cu s in\u00fdmi n\u00e1strojmi:<br \/>\n * HTML report so zozbieran\u00fdmi sn\u00edmkami obrazovky a skupinami pod\u013ea podobnosti hlavi\u010diek odpoved\u00ed;<\/p>\n<p>* S\u00fabor so v\u0161etk\u00fdmi URL, na ktor\u00fdch boli n\u00e1jden\u00e9 webov\u00e9 str\u00e1nky;<\/p>\n<p> * S\u00fabor so \u0161tatistikou a \u00fadajmi str\u00e1nky;<\/p>\n<p>* Prie\u010dinok so s\u00fabormi obsahuj\u00facimi hlavi\u010dky odpoved\u00ed od n\u00e1jden\u00fdch cie\u013eov; <\/p>\n<p>* Prie\u010dinok so s\u00fabormi obsahuj\u00facimi telo odpovede od n\u00e1jden\u00fdch cie\u013eov;<\/p>\n<p>* Sn\u00edmky obrazoviek n\u00e1jden\u00fdch webov\u00fdch str\u00e1nok;<\/li>\n<li>Podporuje pr\u00e1cu s XML reportmi z Nmap a Masscan;<\/li>\n<li>Pou\u017e\u00edva headless Chrome\/Chromium na renderovanie sn\u00edmok obrazovky. <\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li> M\u00f4\u017ee up\u00fata\u0165 pozornos\u0165 syst\u00e9mov detekcie naru\u0161en\u00ed, preto vy\u017eaduje konfigur\u00e1ciu.<\/li>\n<\/ul>\n<p>\nSn\u00edmek obrazovky bol uroben\u00fd pre jednu zo star\u00fdch verzi\u00ed aquatone (v0.5.0), v ktorej bol implementovan\u00fd vyh\u013ead\u00e1vanie DNS subdom\u00e9n. Star\u0161ie verzie m\u00f4\u017eete n\u00e1js\u0165 na <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/michenriksen\/aquatone\/releases\">str\u00e1nke vydan\u00ed<\/a><\/noindex>.<br \/>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, alebo od \u010doho za\u010da\u0165 pentester?\" src=\"\/wp-content\/uploads\/2019\/05\/42cf06a7d2ea19f973f76dccd0442bb8.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"MassDNS\"><\/a><\/noindex>MassDNS<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/blechschmidt\/massdns\">MassDNS<\/a><\/noindex> \u2014 \u010fal\u0161\u00ed n\u00e1stroj na vyh\u013ead\u00e1vanie DNS subdom\u00e9n. Jeho hlavnou odli\u0161nos\u0165ou je, \u017ee rob\u00ed DNS dotazy priamo na mno\u017estvo r\u00f4znych DNS resolverov a rob\u00ed to so zna\u010dnou r\u00fdchlos\u0165ou. <\/p>\n<h4>V\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>R\u00fdchly \u2014 dok\u00e1\u017ee spracova\u0165 viac ako 350 tis\u00edc n\u00e1zvov za sekundu.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>MassDNS m\u00f4\u017ee sp\u00f4sobi\u0165 zna\u010dn\u00fa z\u00e1\u0165a\u017e na pou\u017e\u00edvan\u00e9 DNS resolveri, \u010do m\u00f4\u017ee vies\u0165 k zablokovaniu na t\u00fdchto serveroch alebo s\u0165a\u017enos\u0165am na v\u00e1\u0161 poskytovate\u013e. Okrem toho to vytvor\u00ed ve\u013ek\u00fa z\u00e1\u0165a\u017e na DNS servery spolo\u010dnosti, ak nejak\u00e9 maj\u00fa a ak s\u00fa zodpovedn\u00e9 za dom\u00e9ny, ktor\u00e9 sa sna\u017e\u00edte rozl\u00ed\u0161i\u0165. <\/li>\n<li> Zoznam resolverov je v s\u00fa\u010dasnosti zastaran\u00fd, av\u0161ak ak odstr\u00e1nite nefunk\u010dn\u00e9 DNS resolvery a prid\u00e1te nov\u00e9 zn\u00e1me \u2014 v\u0161etko bude v poriadku.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, alebo od \u010doho za\u010da\u0165 pentester?\" src=\"\/wp-content\/uploads\/2019\/05\/a53181d6982b8d115ec5ece79fbca157.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Sn\u00edmka obrazovky aquatone v0.5.0<\/i><\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"nsec3map\"><\/a><\/noindex>nsec3map<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/anonion0\/nsec3map\">nsec3map<\/a><\/noindex> \u2014 n\u00e1stroj na Pythone na z\u00edskanie kompletn\u00e9ho zoznamu dom\u00e9n chr\u00e1nen\u00fdch DNSSEC.<\/p>\n<h4>V\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>R\u00fdchlo zis\u0165uje hostite\u013eov v DNS z\u00f3nach s minim\u00e1lnym po\u010dtom po\u017eiadaviek, ak je v z\u00f3ne povolen\u00e1 podpora DNSSEC;<\/li>\n<li>Podie\u013ea sa plugin pre John the Ripper, ktor\u00fd m\u00f4\u017eete vyu\u017ei\u0165 na hackovanie z\u00edskan\u00fdch hashov NSEC3.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Mnoh\u00e9 DNS chyby sa sprac\u00favaj\u00fa nespr\u00e1vne;<\/li>\n<li>Nie je automatizovan\u00e9 paralelizovanie spracovania NSEC z\u00e1znamov \u2014 mus\u00edte proces oddeli\u0165 manu\u00e1lne;<\/li>\n<li>Vysok\u00e1 spotreba pam\u00e4te.<\/li>\n<\/ul>\n<p><\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Acunetix\"><\/a><\/noindex>Acunetix<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/www.acunetix.com\/\">Acunetix<\/a><\/noindex> \u2014 skener webov\u00fdch zranite\u013enost\u00ed, ktor\u00fd automatizuje proces kontroly bezpe\u010dnosti webov\u00fdch aplik\u00e1ci\u00ed. Testuje aplik\u00e1ciu na pr\u00edtomnos\u0165 SQL injekci\u00ed, XSS, XXE, SSRF a mnoh\u00fdch \u010fal\u0161\u00edch webov\u00fdch zranite\u013enost\u00ed. Av\u0161ak, ako ka\u017ed\u00fd in\u00fd skener mno\u017estva webov\u00fdch zranite\u013enost\u00ed, nenahr\u00e1dza pentestera, preto\u017ee zlo\u017een\u00e9 re\u0165azce zranite\u013enost\u00ed alebo zranite\u013enosti v logike nie s\u00fa schopn\u00e9 n\u00e1js\u0165. Na druhej strane pokr\u00fdva ve\u013emi ve\u013ea r\u00f4znych zranite\u013enost\u00ed, vr\u00e1tane r\u00f4znych CVE, na ktor\u00e9 mohol pentester zabudn\u00fa\u0165, preto je ve\u013emi u\u017eito\u010dn\u00fd na uvo\u013enenie od rutinn\u00fdch kontrol.<\/p>\n<h4>V\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>N\u00edzka \u00farove\u0148 falo\u0161n\u00fdch pozit\u00edv;<\/li>\n<li>V\u00fdsledky je mo\u017en\u00e9 exportova\u0165 vo forme spr\u00e1v;<\/li>\n<li>Realizuje ve\u013ek\u00e9 mno\u017estvo kontrol na r\u00f4zne zranite\u013enosti;<\/li>\n<li>Paraleln\u00e9 skenovanie viacer\u00fdch hostite\u013eov. <\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Nie je algoritmus deduplika\u00e1cie (podobn\u00e9 funkcion\u00e1lne str\u00e1nky Acunetix pova\u017euje za r\u00f4zne, ke\u010f\u017ee maj\u00fa r\u00f4zne URL), ale v\u00fdvoj\u00e1ri na tom pracuj\u00fa;<\/li>\n<li>Vy\u017eaduje in\u0161tal\u00e1ciu na samostatn\u00fd webov\u00fd server, \u010do komplikuje testovanie klientskych syst\u00e9mov s pripojen\u00edm cez VPN a pou\u017e\u00edvanie skenera v izolovanom segmente miestnej klientskej siete;<\/li>\n<li>M\u00f4\u017ee \"za\u0161umie\u0165\" sk\u00faman\u00fa slu\u017ebu, napr\u00edklad posla\u0165 do kontaktn\u00e9ho formul\u00e1ra na webovej str\u00e1nke pr\u00edli\u0161 ve\u013ea \u00fato\u010dn\u00fdch vektorov, \u010d\u00edm sa zna\u010dne skomplikuje podnikanie.<\/li>\n<li>Je to propriet\u00e1rne a teda nebezpe\u010dn\u00e9 rie\u0161enie.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, alebo od \u010doho za\u010da\u0165 pentester?\" src=\"\/wp-content\/uploads\/2019\/05\/3756cfae6f3cbf221c42c8a439f6ee86.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Dirsearch\"><\/a><\/noindex>Dirsearch<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/maurosoria\/dirsearch\">Dirsearch<\/a><\/noindex> \u2014 n\u00e1stroj na Pythone na brute-force adres\u00e1rov a s\u00faborov na webov\u00fdch str\u00e1nkach. <\/p>\n<h4>V\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Dok\u00e1\u017ee rozl\u00ed\u0161i\u0165 skuto\u010dn\u00e9 \u201e200 OK\u201c str\u00e1nky od str\u00e1nok \u201e200 OK\u201c, ale s textom \u201estr\u00e1nka neexistuje\u201c;<\/li>\n<li>Dod\u00e1va sa s u\u017eito\u010dn\u00fdm slovn\u00edkom, ktor\u00fd m\u00e1 dobr\u00fa rovnov\u00e1hu medzi ve\u013ekos\u0165ou a efekt\u00edvnos\u0165ou vyh\u013ead\u00e1vania. Obsahuje \u0161tandardn\u00e9 cesty charakteristick\u00e9 pre mnoh\u00e9 CMS a technologick\u00e9 stacky;<\/li>\n<li>M\u00e1 vlastn\u00fd form\u00e1t slovn\u00edka, ktor\u00fd umo\u017e\u0148uje dosiahnu\u0165 dobr\u00fa efekt\u00edvnos\u0165 a flexibilitu prech\u00e1dzania s\u00fabormi a adres\u00e1rmi;<\/li>\n<li>Pohodln\u00fd v\u00fdstup \u2014 jednoduch\u00fd text, JSON;<\/li>\n<li>Dok\u00e1\u017ee robi\u0165 throttling \u2014 pauzu medzi po\u017eiadavkami, \u010do je nevyhnutn\u00e9 pre ak\u00fako\u013evek slab\u0161iu slu\u017ebu.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Roz\u0161\u00edrenia treba posiela\u0165 v podobe re\u0165azca, \u010do nie je ide\u00e1lne, ak potrebujete posla\u0165 ve\u013ea roz\u0161\u00edren\u00ed naraz;<\/li>\n<li>Aby ste mohli pou\u017ei\u0165 svoj slovn\u00edk, bude ho potrebn\u00e9 trochu upravi\u0165 do form\u00e1tu slovn\u00edkov Dirsearch pre maxim\u00e1lnu efektivitu.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, alebo od \u010doho za\u010da\u0165 pentester?\" src=\"\/wp-content\/uploads\/2019\/05\/00676a0d7916ecc4cc521a3a5e8607e5.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"wfuzz\"><\/a><\/noindex>wfuzz<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/xmendez\/wfuzz\">wfuzz<\/a><\/noindex> \u2014 Python fuzz\u00e9r webov\u00fdch aplik\u00e1ci\u00ed. Pravdepodobne jeden z najzn\u00e1mej\u0161\u00edch web fuzz\u00e9rov. Princ\u00edp je jednoduch\u00fd: wfuzz umo\u017e\u0148uje fuzzova\u0165 ak\u00e9ko\u013evek miesto v HTTP po\u017eiadavke, \u010do poskytuje mo\u017enos\u0165 fuzzova\u0165 GET\/POST parametre, HTTP hlavi\u010dky, vr\u00e1tane cookie a in\u00e9 autentifika\u010dn\u00e9 hlavi\u010dky. Z\u00e1rove\u0148 je vhodn\u00fd aj pre jednoduch\u00e9 brute-force adres\u00e1rov a s\u00faborov, na \u010do je potrebn\u00fd dobr\u00fd slovn\u00edk. M\u00e1 tie\u017e flexibiln\u00fd filter, pomocou ktor\u00e9ho je mo\u017en\u00e9 filtrova\u0165 odpovede z webovej str\u00e1nky pod\u013ea r\u00f4znych parametrov, \u010do umo\u017e\u0148uje dosiahnu\u0165 efekt\u00edvne v\u00fdsledky. <\/p>\n<h4>V\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Viac\u00fa\u010delov\u00fd \u2014 modul\u00e1rna \u0161trukt\u00fara, zostavenie trv\u00e1 nieko\u013eko min\u00fat;<\/li>\n<li>Pohodln\u00fd mechanizmus filtrovania a fuzzovania;<\/li>\n<li>Mo\u017eno fuzzova\u0165 ak\u00fako\u013evekHTTP met\u00f3du a tie\u017e ak\u00e9ko\u013evek miesto v HTTP po\u017eiadavke.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>V stave v\u00fdvoja.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, alebo od \u010doho za\u010da\u0165 pentester?\" src=\"\/wp-content\/uploads\/2019\/05\/f3b2ae5036eb8b8032f16516e78c82d0.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"ffuf\"><\/a><\/noindex>ffuf<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/ffuf\/ffuf\">ffuf<\/a><\/noindex> \u2014 web fuzz\u00e9r nap\u00edsan\u00fd v Go, vytvoren\u00fd pod\u013ea \u201eobrazu a podoby\u201c wfuzz, umo\u017e\u0148uje brute-force s\u00fabory, adres\u00e1re, URL cesty, n\u00e1zvy a hodnoty GET\/POST parametrov, HTTP hlavi\u010dky, vr\u00e1tane hlavi\u010dky Host pre brute-force virtu\u00e1lnych hostite\u013eov. Oproti svojmu n\u00e1protivku wfuzz sa vyzna\u010duje vy\u0161\u0161ou r\u00fdchlos\u0165ou a niektor\u00fdmi nov\u00fdmi funkciami, ako je podpora slovn\u00edkov vo form\u00e1te Dirsearch.<\/p>\n<h4>V\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Filtre s\u00fa podobn\u00e9 filtr\u00e1m wfuzz a umo\u017e\u0148uj\u00fa flexibilne nastavi\u0165 brute-force;<\/li>\n<li>Umo\u017e\u0148uje fuzzova\u0165 hodnoty HTTP hlavi\u010diek, d\u00e1ta POST po\u017eiadaviek a r\u00f4zne \u010dasti URL, vr\u00e1tane n\u00e1zvov a hodn\u00f4t GET parametrov;<\/li>\n<li>M\u00f4\u017eete zada\u0165 ak\u00fako\u013evek HTTP met\u00f3du.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>V stave v\u00fdvoja.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, alebo od \u010doho za\u010da\u0165 pentester?\" src=\"\/wp-content\/uploads\/2019\/05\/f432340ca10a6d834d01be4577f65fe2.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"gobuster\"><\/a><\/noindex>gobuster<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/OJ\/gobuster\">gobuster<\/a><\/noindex> \u2014 n\u00e1stroj na Go pre prieskum, m\u00e1 dva prev\u00e1dzkov\u00e9 re\u017eimy. Prv\u00fd sa pou\u017e\u00edva na bruteforcing s\u00faborov a adres\u00e1rov na webe, druh\u00fd \u2014 na preverovanie DNS subdom\u00e9n. N\u00e1stroj p\u00f4vodne nepodporuje rekurz\u00edvne preh\u013ead\u00e1vanie s\u00faborov a adres\u00e1rov, \u010do s\u00edce \u0161etr\u00ed \u010das, ale na druhej strane je potrebn\u00e9 spusti\u0165 bruteforcing ka\u017ed\u00e9ho nov\u00e9ho koncov\u00e9ho bodu na webe zvl\u00e1\u0161\u0165.<\/p>\n<h4>V\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Vysok\u00e1 r\u00fdchlos\u0165 pr\u00e1ce ako pri preverovan\u00ed DNS subdom\u00e9n, tak aj pri bruteforcingu s\u00faborov a adres\u00e1rov.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>V aktu\u00e1lnej verzii nepodporuje nastavenie HTTP hlavi\u010diek;<\/li>\n<li>Predvolene pova\u017euje za platn\u00e9 iba niektor\u00e9 HTTP stavov\u00e9 k\u00f3dy (200, 204, 301, 302, 307).<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, alebo od \u010doho za\u010da\u0165 pentester?\" src=\"\/wp-content\/uploads\/2019\/05\/2ce6c6ae6bbd0d2dc851ed632b5bc309.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Arjun\"><\/a><\/noindex>Arjun<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/s0md3v\/Arjun\">Arjun<\/a><\/noindex> \u2014 n\u00e1stroj pre bruteforcing skryt\u00fdch HTTP parametrov v GET\/POST parametroch, ako aj v JSON. Vstavan\u00fd slovn\u00edk obsahuje 25 980 slov, ktor\u00e9 Ajrun overuje takmer za 30 sek\u00fand. Zameranie spo\u010d\u00edva v tom, \u017ee Ajrun neoveruje ka\u017ed\u00fd parameter samostatne, ale preveruje naraz ~1000 parametrov a sleduje, \u010di sa odpove\u010f zmenila. Ak sa odpove\u010f zmenila, tak rozdel\u00ed t\u00fdchto 1000 parametrov na dve \u010dasti a prever\u00ed, ktor\u00e1 z t\u00fdchto \u010dast\u00ed ovplyv\u0148uje odpove\u010f. Takto sa s pou\u017eit\u00edm jednoduch\u00e9ho bin\u00e1rneho h\u013eadania n\u00e1jde parameter alebo nieko\u013eko skryt\u00fdch parametrov, ktor\u00e9 mali z\u00e1sadn\u00fd vplyv na odpove\u010f a teda m\u00f4\u017eu existova\u0165. <\/p>\n<h4>V\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Vysok\u00e1 r\u00fdchlos\u0165 pr\u00e1ce v\u010faka bin\u00e1rnemu h\u013eadaniu;<\/li>\n<li>Podpora GET\/POST parametrov, ako aj parametrov vo forme JSON;<\/li>\n<\/ul>\n<p>\nNa podobnom princ\u00edpe funguje aj plugin pre Burp Suite \u2014 <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/PortSwigger\/param-miner\"><b>param-miner<\/b><\/a><\/noindex>, ktor\u00fd je tie\u017e ve\u013emi dobr\u00fd pri h\u013eadan\u00ed skryt\u00fdch HTTP parametrov. Podrobnej\u0161ie ho pop\u00ed\u0161eme v nadch\u00e1dzaj\u00facom \u010dl\u00e1nku o Burp a jeho pluginoch.<br \/>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, alebo od \u010doho za\u010da\u0165 pentester?\" src=\"\/wp-content\/uploads\/2019\/05\/9571552d9954c5d9902ab658ecb77bbb.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"LinkFinder\"><\/a><\/noindex>LinkFinder<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/GerbenJavado\/LinkFinder\">LinkFinder<\/a><\/noindex> \u2014 skript na Pythone na vyh\u013ead\u00e1vanie odkazov v JavaScript s\u00faboroch. Je u\u017eito\u010dn\u00fd na h\u013eadanie skryt\u00fdch alebo zabudnut\u00fdch koncov\u00fdch bodov\/URL vo webovej aplik\u00e1cii.<\/p>\n<h4>V\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>R\u00fdchly;<\/li>\n<li>Existuje \u0161peci\u00e1lny plugin pre Chrome zalo\u017een\u00fd na LinkFinder-e.<\/li>\n<\/ul>\n<p>.<\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Nepohodln\u00fd kone\u010dn\u00fd v\u00fdstup;<\/li>\n<li>Neanalyzuje JavaScript dynamicky;<\/li>\n<li>Celkom jednoduch\u00e1 logika vyh\u013ead\u00e1vania odkazov \u2014 ak je JavaScript ak\u00fdmko\u013evek sp\u00f4sobom obfuskovan\u00fd, alebo odkazy p\u00f4vodne ch\u00fdbaj\u00fa a generuj\u00fa sa dynamicky, tak nem\u00f4\u017ee ni\u010d n\u00e1js\u0165. <\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, alebo od \u010doho za\u010da\u0165 pentester?\" src=\"\/wp-content\/uploads\/2019\/05\/4cbb12ad81b249cdb21a2f4861acc346.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"JSParser\"><\/a><\/noindex>JSParser<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/nahamsec\/JSParser\">JSParser<\/a><\/noindex> \u2014 skript na Pythone, ktor\u00fd vyu\u017e\u00edva <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tornadoweb.org\/en\/stable\/\">Tornado<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"https:\/\/beautifier.io\/\">JSBeautifier<\/a><\/noindex> na anal\u00fdzu relat\u00edvnych URL adries z JavaScript s\u00faborov. Je ve\u013emi u\u017eito\u010dn\u00fd na odha\u013eovanie AJAX po\u017eiadaviek a zostavovanie zoznamu API met\u00f3d, s ktor\u00fdmi interaguje aplik\u00e1cia. Efekt\u00edvne pracuje v p\u00e1re s LinkFinder-om. <\/p>\n<h4>V\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>R\u00fdchle parsovanie JavaScript s\u00faborov.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, alebo od \u010doho za\u010da\u0165 pentester?\" src=\"\/wp-content\/uploads\/2019\/05\/20812f77021319d9d1d7eafd5d394383.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"sqlmap\"><\/a><\/noindex>sqlmap<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/sqlmapproject\/sqlmap\">sqlmap<\/a><\/noindex> \u2014 pravdepodobne jeden z najzn\u00e1mej\u0161\u00edch n\u00e1strojov na anal\u00fdzu webov\u00fdch aplik\u00e1ci\u00ed. Sqlmap automatizuje vyh\u013ead\u00e1vanie a vyu\u017e\u00edvanie SQL injekci\u00ed, pracuje s viacer\u00fdmi dialektmi SQL a m\u00e1 vo svojom arzen\u00e1le obrovsk\u00e9 mno\u017estvo r\u00f4znych techn\u00edk, za\u010d\u00ednaj\u00fac od jednoduch\u00fdch cit\u00e1ci\u00ed a\u017e po zlo\u017eit\u00e9 vektory pre time-based SQL injekcie. Okrem toho m\u00e1 mno\u017estvo techn\u00edk na \u010fal\u0161ie vyu\u017eitie pre r\u00f4zne DBMS, preto je u\u017eito\u010dn\u00fd nielen ako skener SQL injekci\u00ed, ale aj ako mocn\u00fd n\u00e1stroj na vyu\u017e\u00edvanie u\u017e n\u00e1jden\u00fdch SQL injekci\u00ed.<\/p>\n<h4>V\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Ve\u013ea r\u00f4znych techn\u00edk a vektorov;<\/li>\n<li>N\u00edzke mno\u017estvo falo\u0161n\u00fdch pozit\u00edv;<\/li>\n<li>Mnoho mo\u017enost\u00ed presn\u00e9ho nastavenia, r\u00f4zne techniky, cie\u013eov\u00e1 DB, tamper skripty na ob\u00eddenie WAF;<\/li>\n<li>Mo\u017enos\u0165 vytvorenia dumpu v\u00fdstupn\u00fdch \u00fadajov;<\/li>\n<li>Ve\u013ea r\u00f4znych mo\u017enost\u00ed na vyu\u017eitie, napr\u00edklad pre niektor\u00e9 DB \u2014 automatick\u00e9 nahr\u00e1vanie\/vykladanie s\u00faborov, z\u00edskanie mo\u017enosti vykon\u00e1vania pr\u00edkazov (RCE) a \u010fal\u0161ie;<\/li>\n<li>Podpora priameho pripojenia k DB s pou\u017eit\u00edm \u00fadajov z\u00edskan\u00fdch v priebehu \u00fatoku;<\/li>\n<li>Na vstup m\u00f4\u017eeme poskytn\u00fa\u0165 textov\u00fd s\u00fabor s v\u00fdsledkami pr\u00e1ce Burp \u2014 nie je potrebn\u00e9 manu\u00e1lne zostavova\u0165 v\u0161etky atrib\u00faty pr\u00edkazov\u00e9ho riadku.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>\u0164a\u017eko prisp\u00f4sobite\u013en\u00fd, napr\u00edklad nap\u00edsa\u0165 vlastn\u00e9 kontroly kv\u00f4li nedostato\u010dnej dokument\u00e1cii na to;<\/li>\n<li>Bez pr\u00edslu\u0161n\u00fdch nastaven\u00ed vykon\u00e1va ne\u00fapln\u00fd s\u00fabor kontrol, \u010do m\u00f4\u017ee uv\u00e1dza\u0165 do omylu.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, alebo od \u010doho za\u010da\u0165 pentester?\" src=\"\/wp-content\/uploads\/2019\/05\/f99ac42bd3139894668353924112d416.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"NoSQLMap\"><\/a><\/noindex>NoSQLMap<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/codingo\/NoSQLMap\">NoSQLMap<\/a><\/noindex> \u2014 n\u00e1stroj v Pythone na automatiz\u00e1ciu vyh\u013ead\u00e1vania a vyu\u017e\u00edvania NoSQL injekci\u00ed. Je pohodln\u00e9 ho pou\u017e\u00edva\u0165 nie len v NoSQL datab\u00e1zach, ale aj pri audite webov\u00fdch aplik\u00e1ci\u00ed, ktor\u00e9 pou\u017e\u00edvaj\u00fa NoSQL.<\/p>\n<h4>V\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Rovnako ako sqlmap, umo\u017e\u0148uje nielen n\u00e1js\u0165 potenci\u00e1lnu zranite\u013enos\u0165, ale aj overi\u0165 mo\u017enos\u0165 jej vyu\u017eitia pre MongoDB a CouchDB.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Nepodporuje NoSQL pre Redis, Cassandra, na tejto oblasti sa pracuje.<\/li>\n<\/ul>\n<h2><noindex><a rel=\"nofollow\" name=\"oxml_xxe\"><\/a><\/noindex>oxml_xxe<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/BuffaloWill\/oxml_xxe\">oxml_xxe<\/a><\/noindex> \u2014 n\u00e1stroj na vkladanie XXE XML exploitov do r\u00f4znych typov s\u00faborov, v ktor\u00fdch sa ak\u00fdmko\u013evek sp\u00f4sobom pou\u017e\u00edva XML form\u00e1t.<\/p>\n<h4>V\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Podporuje mnoh\u00e9 roz\u0161\u00edren\u00e9 form\u00e1ty, ako DOCX, ODT, SVG, XML.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Nepodporuje \u00faplne PDF, JPEG, GIF;<\/li>\n<li>Vytv\u00e1ra iba jeden s\u00fabor. Na rie\u0161enie tohto probl\u00e9mu mo\u017eno pou\u017ei\u0165 n\u00e1stroj <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/BuffaloWill\/oxml_xxe\">docem<\/a><\/noindex>, ktor\u00fd m\u00f4\u017ee vytvori\u0165 ve\u013ek\u00e9 mno\u017estvo s\u00faborov s payloadmi na r\u00f4znych miestach. <\/li>\n<\/ul>\n<p>\nUveden\u00e9 n\u00e1stroje s\u00fa vynikaj\u00face na testovanie XXE pri nahr\u00e1van\u00ed dokumentov obsahuj\u00facich XML. Nezab\u00fadajte v\u0161ak, \u017ee XML form\u00e1tova\u010de m\u00f4\u017eu by\u0165 pou\u017eit\u00e9 v mnoh\u00fdch in\u00fdch situ\u00e1ci\u00e1ch, napr\u00edklad XML sa m\u00f4\u017ee pou\u017e\u00edva\u0165 ako form\u00e1t d\u00e1t miesto JSON.<\/p>\n<p>Preto odpor\u00fa\u010dame venova\u0165 pozornos\u0165 nasleduj\u00facemu repozit\u00e1ru, ktor\u00fd obsahuje \u0161irok\u00e9 mno\u017estvo r\u00f4znych payloadov: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/swisskyrepo\/PayloadsAllTheThings\">PayloadsAllTheThings<\/a><\/noindex>.<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"tplmap\"><\/a><\/noindex>tplmap<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/epinna\/tplmap\">tplmap<\/a><\/noindex> \u2014 n\u00e1stroj v Pythone na automatick\u00e9 objavovanie a zneu\u017e\u00edvanie zranite\u013enost\u00ed Server-Side Template Injection, m\u00e1 podobn\u00e9 nastavenia a prapory ako sqlmap. Pou\u017e\u00edva nieko\u013eko r\u00f4znych techn\u00edk a vektorov, vr\u00e1tane slep\u00fdch injekci\u00ed a m\u00e1 techniky na vykon\u00e1vanie k\u00f3du a nahr\u00e1vanie\/vykladanie \u013eubovo\u013en\u00fdch s\u00faborov. Okrem toho m\u00e1 vo svojom arzen\u00e1li techniky pre desiatky r\u00f4znych \u0161abl\u00f3nov\u00fdch enginov a niektor\u00e9 techniky na vyh\u013ead\u00e1vanie eval()-podobn\u00fdch injekci\u00ed k\u00f3du v Pythone, Ruby, PHP, JavaScripte. V pr\u00edpade \u00faspe\u0161n\u00e9ho zneu\u017eitia otv\u00e1ra interakt\u00edvnu konzolu.<\/p>\n<h4>V\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Ve\u013ea r\u00f4znych techn\u00edk a vektorov; <\/li>\n<li>Podporuje mno\u017estvo engineov pre renderovanie \u0161abl\u00f3n;<\/li>\n<li>Mno\u017estvo exploit techn\u00edk.<\/li>\n<\/ul>\n<p><\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"CeWL\"><\/a><\/noindex>CeWL<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/digininja\/CeWL\">CeWL<\/a><\/noindex> \u2014 gener\u00e1tor slovn\u00edkov v Ruby, vytvoren\u00fd na extrakciu unik\u00e1tnych slov z ur\u010den\u00e9ho webu, prech\u00e1dza odkazmi na str\u00e1nke do ur\u010ditej h\u013abky. Zlo\u017een\u00fd slovn\u00edk z unik\u00e1tnych slov je mo\u017en\u00e9 nesk\u00f4r vyu\u017ei\u0165 na bruteforce hesiel na slu\u017eb\u00e1ch alebo bruteforce s\u00faborov a adres\u00e1rov na tej istej webovej str\u00e1nke, alebo na \u00fatok na z\u00edskan\u00e9 hash pomocou hashcat alebo John the Ripper. Je u\u017eito\u010dn\u00fd pri zostavovan\u00ed \"cie\u013eov\u00e9ho\" zoznamu potenci\u00e1lnych hesiel.<\/p>\n<h4>V\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Jednoduch\u00e9 na pou\u017eitie.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Je potrebn\u00e9 by\u0165 opatrn\u00fd s h\u013abkou vyh\u013ead\u00e1vania, aby sa nezachytil \u010fal\u0161\u00ed dom\u00e9n.<\/li>\n<\/ul>\n<p><\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Weakpass\"><\/a><\/noindex>Weakpass<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/weakpass.com\">Weakpass<\/a><\/noindex> \u2014 slu\u017eba, ktor\u00e1 obsahuje mno\u017estvo slovn\u00edkov s unik\u00e1tnymi heslami. Mimoriadne u\u017eito\u010dn\u00e9 pre r\u00f4zne \u00falohy spojen\u00e9 s hackovan\u00edm hesiel, za\u010d\u00ednaj\u00fac od jednoduch\u00e9ho online bruteforce \u00fa\u010dtov na cie\u013eov\u00fdch slu\u017eb\u00e1ch, a\u017e po offline bruteforce z\u00edskan\u00fdch hash pomocou <noindex><a rel=\"nofollow\" href=\"https:\/\/hashcat.net\/hashcat\/\">hashcat<\/a><\/noindex> alebo <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/john\/\">John The Ripper<\/a><\/noindex>. Obsahuje pribli\u017ene 8 mili\u00e1rd hesiel s d\u013a\u017ekou od 4 do 25 znakov. <\/p>\n<h4>V\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Obsahuje ako \u0161pecifick\u00e9 slovn\u00edky, tak aj slovn\u00edky s naj\u010dastej\u0161\u00edmi heslami \u2014 je mo\u017en\u00e9 vybra\u0165 konkr\u00e9tny slovn\u00edk pod\u013ea vlastn\u00fdch potrieb;<\/li>\n<li>Slovn\u00edky sa aktualizuj\u00fa a dop\u013a\u0148aj\u00fa nov\u00fdmi heslami;<\/li>\n<li>Slovn\u00edky s\u00fa usporiadan\u00e9 pod\u013ea efektivity. M\u00f4\u017eete si vybra\u0165 variantu pre r\u00fdchly online bruteforce, ako aj pre d\u00f4kladn\u00fd v\u00fdber hesiel z rozsiahleho slovn\u00edka s posledn\u00fdmi \u00fanikmi;<\/li>\n<li>S\u00fa tu kalkula\u010dka, ktor\u00e1 ukazuje \u010das bruteforcingu hesiel na va\u0161om hardv\u00e9ri.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, alebo od \u010doho za\u010da\u0165 pentester?\" src=\"\/wp-content\/uploads\/2019\/05\/1e9daeca2b42b5ba4dd7750bee2ef36c.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDo samostatnej skupiny by sme chceli zaradi\u0165 n\u00e1stroje na kontrolu CMS: WPScan, JoomScan a AEM hacker. <\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"AEM_hacker\"><\/a><\/noindex>AEM_hacker<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/0ang3el\/aem-hacker\">AEM hacker<\/a><\/noindex> \u2014 n\u00e1stroj na identifik\u00e1ciu zranite\u013enost\u00ed v aplik\u00e1ci\u00e1ch Adobe Experience Manager (AEM). <\/p>\n<h4>V\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>M\u00f4\u017ee identifikova\u0165 AEM aplik\u00e1cie zo zoznamu URL zadan\u00fdch ako vstup;<\/li>\n<li>Obsahuje skripty na z\u00edskanie RCE pomocou nahr\u00e1vania JSP shellu alebo exploat\u00e1ciou SSRF.<\/li>\n<\/ul>\n<p><\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"JoomScan\"><\/a><\/noindex>JoomScan<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/rezasp\/joomscan\">JoomScan<\/a><\/noindex> \u2014 n\u00e1stroj nap\u00edsan\u00fd v Perle na automatiz\u00e1ciu zistenia zranite\u013enost\u00ed pri nasaden\u00ed Joomla CMS. <\/p>\n<h4>V\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Schopn\u00fd nach\u00e1dza\u0165 nedostatky v konfigur\u00e1cii a probl\u00e9my administr\u00e1torsk\u00fdch nastaven\u00ed;<\/li>\n<li>Vypisuje verzie Joomla a s nimi s\u00favisiace zranite\u013enosti, rovnako ako pre jednotliv\u00e9 komponenty;<\/li>\n<li>Obsahuje viac ako 1000 exploitov pre komponenty Joomla;<\/li>\n<li>V\u00fdstupy kone\u010dn\u00fdch spr\u00e1v v textovom a HTML form\u00e1te.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, alebo od \u010doho za\u010da\u0165 pentester?\" src=\"\/wp-content\/uploads\/2019\/05\/2f9561213895d338f8e88127bf02c3e6.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"WPScan\"><\/a><\/noindex>WPScan<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/wpscanteam\/wpscan\">WPScan<\/a><\/noindex> \u2014 n\u00e1stroj na skenovanie str\u00e1nok na WordPress, m\u00e1 vo svojom arzen\u00e1li zranite\u013enosti ako pre samotn\u00fd engine WordPress, tak aj pre niektor\u00e9 pluginy.<\/p>\n<h4>V\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Schopn\u00fd vypisova\u0165 nielen nespr\u00e1vne WordPress pluginy a t\u00e9my, ale aj z\u00edska\u0165 zoznam pou\u017e\u00edvate\u013eov a TimThumb s\u00faborov;<\/li>\n<li>M\u00f4\u017ee vykon\u00e1va\u0165 bruteforce \u00fatoky na WordPress str\u00e1nky.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Nev\u00fdhody:<\/h4>\n<p><\/p>\n<ul>\n<li>Bez pr\u00edslu\u0161n\u00fdch nastaven\u00ed vykon\u00e1va ne\u00fapln\u00fd s\u00fabor kontrol, \u010do m\u00f4\u017ee uv\u00e1dza\u0165 do omylu.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Webov\u00e9 n\u00e1stroje, alebo od \u010doho za\u010da\u0165 pentester?\" src=\"\/wp-content\/uploads\/2019\/05\/eb391071eb62381da16c425d95e7cec5.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCelkovo r\u00f4zni \u013eudia preferuj\u00fa pri pr\u00e1ci r\u00f4zne n\u00e1stroje: v\u0161etky s\u00fa svoj\u00edm sp\u00f4sobom dobr\u00e9 a to, \u010do sa p\u00e1\u010di jedn\u00e9mu, nemus\u00ed vyhovova\u0165 in\u00e9mu. Ak si mysl\u00edte, \u017ee sme nez\u00e1konne opomenuli nejak\u00fa dobr\u00fa utilitu \u2014 nap\u00ed\u0161te o nej v koment\u00e1roch!<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/dsec\/blog\/452836\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u043e \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0445 \u0434\u043b\u044f \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0430. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u041d\u0430\u0448 \u043a\u043e\u043b\u043b\u0435\u0433\u0430 BeLove \u0443\u0436\u0435 \u0434\u0435\u043b\u0430\u043b \u043f\u043e\u0434\u043e\u0431\u043d\u0443\u044e \u043f\u043e\u0434\u0431\u043e\u0440\u043a\u0443 \u043e\u043a\u043e\u043b\u043e \u0441\u0435\u043c\u0438 \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434. \u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e \u0432\u0437\u0433\u043b\u044f\u043d\u0443\u0442\u044c, \u043a\u0430\u043a\u0438\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u043b\u0438 \u0438 \u0443\u043a\u0440\u0435\u043f\u0438\u043b\u0438 \u0441\u0432\u043e\u0438 \u043f\u043e\u0437\u0438\u0446\u0438\u0438, \u0430 \u043a\u0430\u043a\u0438\u0435 \u043e\u0442\u043e\u0448\u043b\u0438 \u043d\u0430 \u0437\u0430\u0434\u043d\u0438\u0439 \u043f\u043b\u0430\u043d \u0438 \u0441\u0435\u0439\u0447\u0430\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0440\u0435\u0434\u043a\u043e. \u041e\u0442\u043c\u0435\u0442\u0438\u043c, \u0447\u0442\u043e \u0441\u044e\u0434\u0430 \u0436\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u0438 Burp Suite, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":26108,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-34646","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u043e \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0445 \u0434\u043b\u044f \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0430.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/web-tools-ili-s-chego-nachat-pentesteru\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Web tools, \u0438\u043b\u0438 \u0441 \u0447\u0435\u0433\u043e \u043d\u0430\u0447\u0430\u0442\u044c \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0443? | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u043e \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0445 \u0434\u043b\u044f \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0430.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/web-tools-ili-s-chego-nachat-pentesteru\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:59:35+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:59:35+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Web tools, alebo s \u010d\u00edm za\u010da\u0165 pentester? | ProHoster","description":"Pokra\u010dujeme v rozpr\u00e1van\u00ed o u\u017eito\u010dn\u00fdch n\u00e1strojoch pre pentestera.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/web-tools-ili-s-chego-nachat-pentesteru","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Web tools, \u0438\u043b\u0438 \u0441 \u0447\u0435\u0433\u043e \u043d\u0430\u0447\u0430\u0442\u044c \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0443? | ProHoster","og:description":"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u043e \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0445 \u0434\u043b\u044f \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0430.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/web-tools-ili-s-chego-nachat-pentesteru","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:59:35+00:00","article:modified_time":"2019-10-31T18:59:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34646","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 20:04:30","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:17:23","updated":"2026-01-21 20:04:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/34646","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=34646"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/34646\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/26108"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=34646"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=34646"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=34646"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}