{"id":34646,"date":"2019-10-31T21:59:35","date_gmt":"2019-10-31T18:59:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/web-tools-ili-s-chego-nachat-pentesteru\/"},"modified":"2019-10-31T21:59:35","modified_gmt":"2019-10-31T18:59:35","slug":"web-tools-ili-s-chego-nachat-pentesteru","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/web-tools-ili-s-chego-nachat-pentesteru","title":{"rendered":"Mjetet n\u00eb internet, ose nga ku t\u00eb filloj\u00eb nj\u00eb pen tester?","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/dsec\/blog\/447882\/\">Po vazhdojm\u00eb<\/a><\/noindex> t\u00eb flasim p\u00ebr mjete t\u00eb dobishme p\u00ebr pen tester. N\u00eb artikullin e ri, do t\u00eb shqyrtojm\u00eb mjetet p\u00ebr analiz\u00ebn e siguris\u00eb s\u00eb aplikacioneve n\u00eb internet.<\/p>\n<p>Kolegu yn\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/users\/belove\/\" class=\"user_link\">BeLove<\/a><\/noindex> ka b\u00ebr\u00eb tashm\u00eb nj\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/125317\/\">grup mjetesh<\/a><\/noindex> rreth shtat\u00eb vite m\u00eb par\u00eb. \u00cbsht\u00eb interesante t\u00eb shohim se cilat mjete e kan\u00eb ruajtur dhe forcua pozit\u00ebn e tyre, dhe cilat kan\u00eb r\u00ebn\u00eb n\u00eb harres\u00eb e tani p\u00ebrdoren rrall\u00eb.<br \/>\n<img decoding=\"async\" alt=\"Mjetet n\u00eb internet, ose nga ku t\u00eb filloj\u00eb nj\u00eb pen tester?\" src=\"\/wp-content\/uploads\/2019\/05\/a6d02b9593ebdbe1b11ccc38e6357b2f.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nT\u00eb theksojm\u00eb se k\u00ebtu p\u00ebrfshihet edhe Burp Suite, por p\u00ebr t\u00eb dhe plugin\u00ebt e tij t\u00eb dobish\u00ebm do t\u00eb ket\u00eb nj\u00eb publikim t\u00eb ve\u00e7ant\u00eb.<\/p>\n<h2>P\u00ebrmbajtja:<\/h2>\n<p><\/p>\n<ul>\n<li> <noindex><a rel=\"nofollow\" href=\"#Amass\">Amass<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#Altdns\">Altdns<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#aquatone\">aquatone<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#MassDNS\">MassDNS<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#nsec3map\">nsec3map<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#Acunetix\">Acunetix<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#Dirsearch\">Dirsearch<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#wfuzz\">wfuzz<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#ffuf\">ffuf<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#gobuster\">gobuster<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#Arjun\">Arjun<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#LinkFinder\">LinkFinder<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#JSParser\">JSParser<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#sqlmap\">sqlmap<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#NoSQLMap\">NoSQLMap<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#oxml_xxe\">oxml_xxe<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#tplmap\">tplmap<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#CeWL\">CeWL<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#Weakpass\">Weakpass<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#AEM_hacker\">AEM_hacker<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#JoomScan\">JoomScan<\/a><\/noindex><\/li>\n<li> <noindex><a rel=\"nofollow\" href=\"#WPScan\">WPScan<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Amass\"><\/a><\/noindex>Amass<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/OWASP\/Amass\">Amass<\/a><\/noindex> \u2014 nj\u00eb veg\u00ebl n\u00eb Go p\u00ebr gjetjen dhe enumerimin e subdomen\u00ebve DNS dhe hartimin e rrjetit t\u00eb jasht\u00ebm. Amass \u00ebsht\u00eb nj\u00eb projekt i OWASP, krijuar p\u00ebr t\u00eb treguar si duken organizatat n\u00eb internet nga nj\u00eb v\u00ebzhgues i jasht\u00ebm. Emrat e subdomen\u00ebve Amass i merr me metoda t\u00eb ndryshme, vegla p\u00ebrdor si enumerimin rekursiv t\u00eb subdomen\u00ebve ashtu edhe k\u00ebrkimin n\u00eb burime t\u00eb hapura.<\/p>\n<p>P\u00ebr t\u00eb zbuluar segmente t\u00eb lidhura rrjetesh dhe numra t\u00eb autonom\u00ebve t\u00eb sistemeve, Amass p\u00ebrdor adresa IP t\u00eb marra gjat\u00eb veprimit. T\u00eb gjitha informacionet e gjetura p\u00ebrdoren p\u00ebr t\u00eb nd\u00ebrtuar nj\u00eb hart\u00eb rrjeti.<\/p>\n<h4>Avantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>Teknikat e mbledhjes s\u00eb informacionit p\u00ebrfshijn\u00eb:<br \/>\n * DNS \u2014 skanimi i n\u00ebn-domen\u00ebve p\u00ebrmes fjalor\u00ebve, forcimi brut i n\u00ebn-domen\u00ebve, skanimi \"inteligjent\" duke p\u00ebrdorur mutacione t\u00eb bazuara n\u00eb n\u00ebn-domen\u00ebt e gjetur, k\u00ebrkesa t\u00eb kund\u00ebrta DNS dhe k\u00ebrkimi i server\u00ebve DNS t\u00eb cil\u00ebt mund t\u00eb k\u00ebrkojn\u00eb p\u00ebr transferimin e zon\u00ebs (AXFR); <\/p>\n<p>* K\u00ebrkimi n\u00eb burime t\u00eb hapura \u2014 Ask, Baidu, Bing, CommonCrawl, DNSDB, DNSDumpster, DNSTable, Dogpile, Exalead, FindSubdomains, Google, IPv4Info, Netcraft, PTRArchive, Riddler, SiteDossier, ThreatCrowd, VirusTotal, Yahoo;<\/p>\n<p>* K\u00ebrkimi n\u00eb bazat e t\u00eb dh\u00ebnave t\u00eb certifikatave TLS \u2014 Censys, CertDB, CertSpotter, Crtsh, Entrust;<\/p>\n<p>* P\u00ebrdorimi i API-ve t\u00eb motor\u00ebve t\u00eb k\u00ebrkimit \u2014 BinaryEdge, BufferOver, CIRCL, HackerTarget, PassiveTotal, Robtex, SecurityTrails, Shodan, Twitter, Umbrella, URLScan;<\/p>\n<p>* K\u00ebrkimi n\u00eb arkivat e web-it t\u00eb Internetit: ArchiveIt, ArchiveToday, Arquivo, LoCArchive, OpenUKArchive, UKGovArchive, Wayback;<\/li>\n<li>Integrimi me Maltego; <\/li>\n<li>Siguron mbulimin m\u00eb t\u00eb plot\u00eb t\u00eb detyr\u00ebs p\u00ebr k\u00ebrkimin e n\u00ebn-domen\u00ebve DNS.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Disavantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>Kujdesi me amass.netdomains \u2014 ai do t\u00eb p\u00ebrpiqet t\u00eb qaset \u00e7do IP n\u00eb infrastruktur\u00ebn e identifikuar dhe t\u00eb marr\u00eb emrat e domenit nga k\u00ebrkesa DNS t\u00eb kund\u00ebrt dhe certifikatat TLS. Kjo \u00ebsht\u00eb nj\u00eb teknik\u00eb \"e zhurmshme\", ajo mund t\u00eb zbuloj\u00eb veprimet tuaja t\u00eb spiunazhit n\u00eb organizat\u00ebn e hulumtuar. <\/li>\n<li>Konsum i lart\u00eb i memories, mund t\u00eb konsumoj\u00eb deri n\u00eb 2 GB RAM n\u00eb konfigurime t\u00eb ndryshme, q\u00eb nuk do t'i lejoj\u00eb k\u00ebtij instrumenti t\u00eb funksionoj\u00eb n\u00eb cloud n\u00eb nj\u00eb VDS t\u00eb lir\u00eb.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Mjetet n\u00eb internet, ose nga ku t\u00eb filloj\u00eb nj\u00eb pen tester?\" src=\"\/wp-content\/uploads\/2019\/05\/37e1dd6c273eaef2c7c979a57f98c0d9.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Altdns\"><\/a><\/noindex>Altdns<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/infosec-au\/altdns\">Altdns<\/a><\/noindex> \u2014 nj\u00eb mjet n\u00eb Python p\u00ebr nd\u00ebrtimin e fjalor\u00ebve p\u00ebr brute-forcing DNS subdomenesh. Lejon gjenerimin e shum\u00eb variant\u00ebve t\u00eb subdomen\u00ebve duke p\u00ebrdorur mutacione dhe permutacione. P\u00ebr k\u00ebt\u00eb p\u00ebrdoren fjal\u00eb q\u00eb shpesh gjenden n\u00eb subdomena (p\u00ebr shembull: test, dev, staging), t\u00eb gjitha mutacionet dhe permutacionet aplikohen n\u00eb subdomen\u00ebt e njohur, t\u00eb cilat mund t\u00eb jepen si input n\u00eb Altdns. Si rezultat, krijohet nj\u00eb list\u00eb e variacioneve t\u00eb subdomen\u00ebve q\u00eb mund t\u00eb ekzistojn\u00eb, dhe kjo list\u00eb mund t\u00eb p\u00ebrdoret m\u00eb von\u00eb gjat\u00eb brute-forcing DNS.<\/p>\n<h4>Avantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>Punon mir\u00eb me grupe t\u00eb m\u00ebdha t\u00eb t\u00eb dh\u00ebnave.<\/li>\n<\/ul>\n<p><\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"aquatone\"><\/a><\/noindex>aquatone<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/michenriksen\/aquatone\">aquatone<\/a><\/noindex> \u2014 dikur ishte m\u00eb i njohur si nj\u00eb tjet\u00ebr mjet p\u00ebr k\u00ebrkimin e subdomen\u00ebve, por autorin vet\u00eb e braktisi at\u00eb n\u00eb favor t\u00eb Amassit t\u00eb p\u00ebrmendur m\u00eb lart. Tani aquatone \u00ebsht\u00eb rishkruar n\u00eb Go dhe \u00ebsht\u00eb m\u00eb shum\u00eb i orientuar p\u00ebr eksplorimin paraprak t\u00eb faqeve t\u00eb internetit. P\u00ebr k\u00ebt\u00eb, aquatone kalon p\u00ebrmes domaineve t\u00eb specifikuara dhe k\u00ebrkon n\u00eb to faqe n\u00eb porte t\u00eb ndryshme, pas s\u00eb cil\u00ebs mbledh t\u00eb gjith\u00eb informacionin n\u00eb lidhje me faqen dhe b\u00ebn nj\u00eb ekranim. \u00cbsht\u00eb i p\u00ebrshtatsh\u00ebm p\u00ebr eksplorimin e shpejt\u00eb t\u00eb faqeve t\u00eb internetit, pas s\u00eb cil\u00ebs mund t\u00eb zgjidhen objektivat prioritare p\u00ebr sulm.<\/p>\n<h4>Avantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>N\u00eb produkt krijon nj\u00eb grup skedar\u00ebsh dhe dosjesh q\u00eb jan\u00eb t\u00eb lehta p\u00ebr tu p\u00ebrdorur n\u00eb pun\u00ebn e m\u00ebtejshme me mjete t\u00eb tjera:<br \/>\n * Raport HTML me screenshot-e t\u00eb mbledhura dhe titujt e p\u00ebrgjigjeve t\u00eb grupuara sipas ngjashm\u00ebris\u00eb;<\/p>\n<p>* Skedari me t\u00eb gjitha URL-t\u00eb ku jan\u00eb gjetur faqet e internetit;<\/p>\n<p> * Skedari me statistikat dhe t\u00eb dh\u00ebnat e faqes;<\/p>\n<p>* Dosja me skedar\u00ebt q\u00eb p\u00ebrmbajn\u00eb titujt e p\u00ebrgjigjeve nga objektivat e gjetura; <\/p>\n<p>* Dosja me skedar\u00ebt q\u00eb p\u00ebrmbajn\u00eb trupin e p\u00ebrgjigjeve nga objektivat e gjetura;<\/p>\n<p>* Screenshot-e t\u00eb faqeve t\u00eb internetit t\u00eb gjetura;<\/li>\n<li>Mb\u00ebshtet pun\u00ebn me raportet XML nga Nmap dhe Masscan;<\/li>\n<li>P\u00ebrdor Chrome\/Chromium pa kok\u00eb p\u00ebr t\u00eb renderizuar screenshot-e. <\/li>\n<\/ul>\n<p><\/p>\n<h4>Disavantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li> Mund t\u00eb t\u00ebrheq\u00eb v\u00ebmendjen e sistemeve t\u00eb zb\u00ebrthimit t\u00eb sulmeve, prandaj k\u00ebrkon konfigurim.<\/li>\n<\/ul>\n<p>\nScreenshot-i \u00ebsht\u00eb b\u00ebr\u00eb p\u00ebr nj\u00eb nga versionet e vjetra t\u00eb aquatone (v0.5.0), n\u00eb t\u00eb cilin \u00ebsht\u00eb realizuar k\u00ebrkimi p\u00ebr DNS-subdomen\u00eb. Versionet e vjetra mund t\u00eb gjenden n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/michenriksen\/aquatone\/releases\">faqen e l\u00ebshimeve<\/a><\/noindex>.<br \/>\n<img decoding=\"async\" alt=\"Mjetet n\u00eb internet, ose nga ku t\u00eb filloj\u00eb nj\u00eb pen tester?\" src=\"\/wp-content\/uploads\/2019\/05\/42cf06a7d2ea19f973f76dccd0442bb8.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"MassDNS\"><\/a><\/noindex>MassDNS<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/blechschmidt\/massdns\">MassDNS<\/a><\/noindex> \u2014 nj\u00eb tjet\u00ebr mjet p\u00ebr k\u00ebrkimet e DNS-subdomen\u00ebve. Dallimi kryesor \u00ebsht\u00eb se ai b\u00ebn k\u00ebrkesa DNS drejtp\u00ebrdrejt te shum\u00eb zgjidh\u00ebs t\u00eb ndrysh\u00ebm DNS dhe e b\u00ebn k\u00ebt\u00eb me nj\u00eb shpejt\u00ebsi t\u00eb konsiderueshme. <\/p>\n<h4>Avantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>Shpejt \u2014 \u00ebsht\u00eb n\u00eb gjendje t\u00eb zgjidh\u00eb m\u00eb shum\u00eb se 350,000 emra n\u00eb sekond\u00eb.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Disavantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>MassDNS mund t\u00eb shkaktoj\u00eb nj\u00eb ngarkes\u00eb t\u00eb konsiderueshme ndaj zgjidh\u00ebsve t\u00eb DNS t\u00eb p\u00ebrdorur, gj\u00eb q\u00eb mund t\u00eb \u00e7oj\u00eb n\u00eb ndalesa n\u00eb k\u00ebto servera ose ankesat ndaj ofruesit tuaj. P\u00ebrve\u00e7 k\u00ebsaj, do t\u00eb shkaktoj\u00eb nj\u00eb ngarkes\u00eb t\u00eb madhe n\u00eb server\u00ebt DNS t\u00eb kompanis\u00eb, n\u00ebse ata kan\u00eb dhe n\u00ebse ata jan\u00eb p\u00ebrgjegj\u00ebs p\u00ebr domenet q\u00eb po p\u00ebrpiqeni t\u00eb zgjidhni. <\/li>\n<li> Lista e zgjidh\u00ebsve aktualisht \u00ebsht\u00eb e vjetruar, megjithat\u00eb, n\u00ebse hiqni zgjidh\u00ebsit DNS t\u00eb pap\u00ebrdorsh\u00ebm dhe shtoni t\u00eb rinjt\u00eb e njohur \u2014 gjith\u00e7ka do t\u00eb jet\u00eb n\u00eb rregull.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Mjetet n\u00eb internet, ose nga ku t\u00eb filloj\u00eb nj\u00eb pen tester?\" src=\"\/wp-content\/uploads\/2019\/05\/a53181d6982b8d115ec5ece79fbca157.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Screenshot-i i aquatone v0.5.0<\/i><\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"nsec3map\"><\/a><\/noindex>nsec3map<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/anonion0\/nsec3map\">nsec3map<\/a><\/noindex> \u2014 nj\u00eb mjet n\u00eb Python p\u00ebr t\u00eb marr\u00eb nj\u00eb list\u00eb t\u00eb plot\u00eb t\u00eb domen\u00ebve q\u00eb mbrohen nga DNSSEC.<\/p>\n<h4>Avantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>Zbulon shpejt hostet n\u00eb zonat DNS me minim t\u00eb k\u00ebrkesave, n\u00ebse mb\u00ebshtetjeja DNSSEC \u00ebsht\u00eb e aktivizuar;<\/li>\n<li>Pjes\u00eb e plugin-it p\u00ebr John the Ripper, i cili mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb thyer hash-et NSEC3 t\u00eb marra.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Disavantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>Shum\u00eb gabime DNS trajtohen gabim;<\/li>\n<li>Nuk ka ndarjen automatike t\u00eb p\u00ebrpunimit t\u00eb sh\u00ebnimeve NSEC \u2014 duhet t\u00eb ndajm\u00eb hap\u00ebsir\u00ebn em\u00ebrore manualisht;<\/li>\n<li>Konsum t\u00eb lart\u00eb t\u00eb memories.<\/li>\n<\/ul>\n<p><\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Acunetix\"><\/a><\/noindex>Acunetix<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/www.acunetix.com\/\">Acunetix<\/a><\/noindex> \u2014 skaneri i dob\u00ebsive n\u00eb ueb, q\u00eb automatizon procesin e kontrollit t\u00eb siguris\u00eb p\u00ebr aplikacionet n\u00eb ueb. Teston aplikacionin p\u00ebr SQL injeksione, XSS, XXE, SSRF dhe shum\u00eb dob\u00ebsi t\u00eb tjera n\u00eb ueb. Megjithat\u00eb, si \u00e7do skaner tjet\u00ebr i shum\u00eb dob\u00ebsive n\u00eb ueb, nuk z\u00ebvend\u00ebson nj\u00eb testues t\u00eb penetrimit, pasi zinxhir\u00ebt e nd\u590d\u6742 ose dob\u00ebsit\u00eb n\u00eb logjik\u00eb nuk mund t\u00eb gjejn\u00eb. Por mbulon shum\u00eb dob\u00ebsi t\u00eb ndryshme, p\u00ebrfshir\u00eb CVE t\u00eb ndryshme, p\u00ebr t\u00eb cilat nj\u00eb testues mund t\u00eb ket\u00eb harruar, prandaj \u00ebsht\u00eb shum\u00eb i dobish\u00ebm p\u00ebr t\u00eb liruar nga kontroll\u00ebt rutin\u00eb.<\/p>\n<h4>Avantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>Niveli i ul\u00ebt i alarm\u00ebve t\u00eb falsifikuara;<\/li>\n<li>Rezultatet mund t\u00eb eksportohen n\u00eb form\u00ebn e raporteve;<\/li>\n<li>Kryen nj\u00eb num\u00ebr t\u00eb madh kontrollesh p\u00ebr dob\u00ebsi t\u00eb ndryshme;<\/li>\n<li>Skanimi paralel i disa hosteve. <\/li>\n<\/ul>\n<p><\/p>\n<h4>Disavantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>Nuk ka nj\u00eb algorit\u00ebm t\u00eb deduplikimit (faqet me funksionalitet t\u00eb ngjash\u00ebm do t\u00eb konsiderohen t\u00eb ndryshme nga Acunetix, sepse ato kan\u00eb URL t\u00eb ndryshme), por zhvilluesit po punojn\u00eb mbi k\u00ebt\u00eb;<\/li>\n<li>K\u00ebrkon instalim n\u00eb nj\u00eb server t\u00eb ve\u00e7ant\u00eb, gj\u00eb q\u00eb e komplikon testimin e sistemeve klientike me lidhje p\u00ebrmes VPN dhe p\u00ebrdorimin e skanerit n\u00eb nj\u00eb segment t\u00eb izoluar t\u00eb rrjetit lokal t\u00eb klientit;<\/li>\n<li>Mund t\u00eb \u201cz\u00ebvend\u00ebsoj\u00eb\u201d sh\u00ebrbimin q\u00eb po hetohet, p\u00ebr shembull, d\u00ebrgon shum\u00eb vektor\u00eb sulmesh n\u00eb formularin e kontaktit n\u00eb faqen e internetit, duke komplikuar k\u00ebshtu shum\u00eb proceset e biznesit;<\/li>\n<li>\u00cbsht\u00eb nj\u00eb zgjidhje proprietar\u00eb dhe, p\u00ebr rrjedhoj\u00eb, jo falas.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Mjetet n\u00eb internet, ose nga ku t\u00eb filloj\u00eb nj\u00eb pen tester?\" src=\"\/wp-content\/uploads\/2019\/05\/3756cfae6f3cbf221c42c8a439f6ee86.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Dirsearch\"><\/a><\/noindex>Dirsearch<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/maurosoria\/dirsearch\">Dirsearch<\/a><\/noindex> \u2014 nj\u00eb instrument n\u00eb Python p\u00ebr bruteforce direktorish dhe skedar\u00ebsh n\u00eb faqe interneti. <\/p>\n<h4>Avantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>Mund t\u00eb dalloj\u00eb faqet e v\u00ebrteta \u201c200 OK\u201d nga faqet \u201c200 OK\u201d, por me tekstin \u201cfaqja nuk u gjet\u201d;<\/li>\n<li>Vjen me nj\u00eb fjalor t\u00eb rehatsh\u00ebm, i cili ka nj\u00eb ekuilib\u00ebr t\u00eb mir\u00eb midis madh\u00ebsis\u00eb dhe efikasitetit t\u00eb k\u00ebrkimit. P\u00ebrmban rrug\u00eb standarde, karakteristike p\u00ebr shum\u00eb CMS dhe kuadrar teknologjik;<\/li>\n<li>Formati i vet i fjalorit, i cili lejon arritjen e nj\u00eb efikasiteti dhe fleksibiliteti t\u00eb mir\u00eb n\u00eb kalimin e skedar\u00ebve dhe direktorive;<\/li>\n<li>Dalja e leht\u00eb \u2014 teksti i thjesht\u00eb, JSON;<\/li>\n<li>Aft\u00ebson t\u00eb b\u00ebj\u00eb throttling \u2014 nj\u00eb pauz\u00eb midis k\u00ebrkesave, q\u00eb \u00ebsht\u00eb jetike p\u00ebr \u00e7do sh\u00ebrbim t\u00eb dob\u00ebt.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Disavantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>Zgjerimet duhet t\u00eb kalohen si nj\u00eb varg, q\u00eb \u00ebsht\u00eb e pap\u00ebrshtatshme n\u00ebse duhen d\u00ebrguar shum\u00eb zgjerime menj\u00ebher\u00eb;<\/li>\n<li>P\u00ebr ta p\u00ebrdorur fjalorin tuaj, do t'ju duhet ta p\u00ebrpunoni at\u00eb pak deri n\u00eb formatin e fjalor\u00ebve Dirsearch p\u00ebr efikasitet maksimal.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Mjetet n\u00eb internet, ose nga ku t\u00eb filloj\u00eb nj\u00eb pen tester?\" src=\"\/wp-content\/uploads\/2019\/05\/00676a0d7916ecc4cc521a3a5e8607e5.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"wfuzz\"><\/a><\/noindex>wfuzz<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/xmendez\/wfuzz\">wfuzz<\/a><\/noindex> \u2014 Nj\u00eb fazz\u00ebr web aplikacionesh i shkruar n\u00eb Python. Ndoshta nj\u00eb nga fazz\u00ebr\u00ebt m\u00eb t\u00eb njohur t\u00eb webit. Parimin \u00ebsht\u00eb i thjesht\u00eb: wfuzz lejon t\u00eb fazzoj\u00eb \u00e7do vend n\u00eb k\u00ebrkes\u00ebn HTTP, \u00e7ka ofron mund\u00ebsin\u00eb p\u00ebr t\u00eb fazzoj\u00eb parametrat GET\/POST, headers HTTP, p\u00ebrfshir\u00eb Cookie dhe headers t\u00eb tjera t\u00eb autentikimit. Nj\u00ebkoh\u00ebsisht, \u00ebsht\u00eb i p\u00ebrshtatsh\u00ebm edhe p\u00ebr thjesht blerjen e rrug\u00ebve dhe skedar\u00ebve, p\u00ebr t\u00eb cilat \u00ebsht\u00eb i nevojsh\u00ebm nj\u00eb fjalor i mir\u00eb. Gjithashtu ka nj\u00eb sistem fleksib\u00ebl filtrimi, me t\u00eb cilin mund t\u00eb filtroni p\u00ebrgjigjet nga ueb-siti sipas parametrave t\u00eb ndrysh\u00ebm, \u00e7ka leht\u00ebson arritjen e rezultateve efikase. <\/p>\n<h4>Avantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>Multifunksional \u2014 struktura modulare, nd\u00ebrtimi merr disa minuta;<\/li>\n<li>Mekaniz\u00ebm filtrimi dhe fazzimi komod;<\/li>\n<li>Mund t\u00eb fazosh \u00e7do metod\u00eb HTTP, si dhe \u00e7do vend n\u00eb k\u00ebrkes\u00ebn HTTP.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Disavantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>E n\u00eb gjendje zhvillimi.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Mjetet n\u00eb internet, ose nga ku t\u00eb filloj\u00eb nj\u00eb pen tester?\" src=\"\/wp-content\/uploads\/2019\/05\/f3b2ae5036eb8b8032f16516e78c82d0.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"ffuf\"><\/a><\/noindex>ffuf<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/ffuf\/ffuf\">ffuf<\/a><\/noindex> \u2014 fazz\u00ebr web n\u00eb Go, i krijuar sipas \u201cimagjinuar dhe ngjash\u00ebm\u201d me wfuzz, lejon t\u00eb b\u00ebhet bruteforcing p\u00ebr skedar\u00eb, drejtime, URL-t\u00eb, emrat dhe vlerat e parametrave GET\/POST, headers HTTP, duke p\u00ebrfshir\u00eb header-in Host p\u00ebr bruteforcing virtuale. Ndryshe nga homologu i tij wfuzz, ai ofron shpejt\u00ebsi m\u00eb t\u00eb lart\u00eb dhe disa ve\u00e7ori t\u00eb reja, p\u00ebr shembull, mb\u00ebshtet fjalor\u00ebt n\u00eb formatin Dirsearch.<\/p>\n<h4>Avantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>Filterat duken si filterat e wfuzz, lejojn\u00eb t\u00eb p\u00ebrshtatet fleksib\u00ebl bruteforcing;<\/li>\n<li>Lejon t\u00eb fazzohet vlerat e headers HTTP, t\u00eb dh\u00ebnat e k\u00ebrkesave POST dhe pjes\u00eb t\u00eb ndryshme t\u00eb URL-t\u00eb, duke p\u00ebrfshir\u00eb emrat dhe vlerat e parametrave GET;<\/li>\n<li>Mund t\u00eb p\u00ebrcaktoni \u00e7far\u00ebdo metode HTTP.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Disavantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>E n\u00eb gjendje zhvillimi.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Mjetet n\u00eb internet, ose nga ku t\u00eb filloj\u00eb nj\u00eb pen tester?\" src=\"\/wp-content\/uploads\/2019\/05\/f432340ca10a6d834d01be4577f65fe2.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"gobuster\"><\/a><\/noindex>gobuster<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/OJ\/gobuster\">gobuster<\/a><\/noindex> \u2014 nj\u00eb mjet n\u00eb Go p\u00ebr hulumtim, ka dy m\u00ebnyra pune. E para p\u00ebrdoret p\u00ebr bruteforcing skedar\u00ebsh dhe drejtimesh n\u00eb nj\u00eb uebsajt, e dyta \u2014 p\u00ebr enumerate DNS-subdomenesh. Mjeti fillimisht nuk mb\u00ebshtet enumerimin recursiv t\u00eb skedar\u00ebve dhe drejtimeve, gj\u00eb q\u00eb, natyrisht, kursen koh\u00eb, por nga ana tjet\u00ebr, bruteforcing \u00e7do endpoint t\u00eb ri n\u00eb nj\u00eb uebsajt duhet t\u00eb iniciohet ve\u00e7mas.<\/p>\n<h4>Avantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>Shpejt\u00ebsi shum\u00eb e lart\u00eb p\u00ebr enumerimin e DNS-subdomenesh, si dhe p\u00ebr bruteforcing skedar\u00ebsh dhe drejtimesh.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Disavantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>N\u00eb versionin aktual, nuk mb\u00ebshtet vendosjen e headers HTTP;<\/li>\n<li>P\u00ebr default, konsideron t\u00eb vlefsh\u00ebm vet\u00ebm disa prej kodeve t\u00eb statusit HTTP (200, 204, 301, 302, 307).<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Mjetet n\u00eb internet, ose nga ku t\u00eb filloj\u00eb nj\u00eb pen tester?\" src=\"\/wp-content\/uploads\/2019\/05\/2ce6c6ae6bbd0d2dc851ed632b5bc309.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Arjun\"><\/a><\/noindex>Arjun<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/s0md3v\/Arjun\">Arjun<\/a><\/noindex> \u2014 nj\u00eb mjet p\u00ebr brute-forcing parametrave t\u00eb fshehur HTTP n\u00eb parametrat GET\/POST, si dhe n\u00eb JSON. Fjalori i integruar ka 25,980 fjal\u00eb, t\u00eb cilat Ajrun i kontrollon p\u00ebr pothuajse 30 sekonda. Pika \u00ebsht\u00eb q\u00eb Ajrun nuk kontrollon \u00e7do parameter ve\u00e7 e ve\u00e7, por kontrollon rreth 1000 parameter n\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb dhe sheh n\u00ebse p\u00ebrgjigjja \u00ebsht\u00eb ndryshuar. N\u00ebse p\u00ebrgjigjja \u00ebsht\u00eb ndryshuar, e ndan k\u00ebt\u00eb 1000 parameter n\u00eb dy pjes\u00eb dhe kontrollon se cila nga k\u00ebto pjes\u00eb ndikon n\u00eb p\u00ebrgjigje. K\u00ebshtu, me nj\u00eb k\u00ebrkim binar t\u00eb thjesht\u00eb gjendet parametri ose disa parametra t\u00eb fshehur q\u00eb ndikonin n\u00eb p\u00ebrgjigje dhe, si pasoj\u00eb, mund t\u00eb ekzistojn\u00eb. <\/p>\n<h4>Avantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>Shpejt\u00ebsi e lart\u00eb pune p\u00ebrmes k\u00ebrkimit binar;<\/li>\n<li>Mb\u00ebshtetje p\u00ebr parametrat GET\/POST, si dhe parametrat n\u00eb form\u00ebn e JSON;<\/li>\n<\/ul>\n<p>\nP\u00ebr nj\u00eb parim t\u00eb ngjash\u00ebm funksionon dhe plugu p\u00ebr Burp Suite \u2014 <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/PortSwigger\/param-miner\"><b>param-miner<\/b><\/a><\/noindex>, i cili gjithashtu \u00ebsht\u00eb shum\u00eb i mir\u00eb n\u00eb k\u00ebrkimin e parametrave t\u00eb fshehur HTTP. M\u00eb shum\u00eb p\u00ebr t\u00eb do t\u00eb flasim n\u00eb artikullin e ardhsh\u00ebm n\u00eb lidhje me Burp dhe plugin\u00ebt e tij.<br \/>\n<img decoding=\"async\" alt=\"Mjetet n\u00eb internet, ose nga ku t\u00eb filloj\u00eb nj\u00eb pen tester?\" src=\"\/wp-content\/uploads\/2019\/05\/9571552d9954c5d9902ab658ecb77bbb.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"LinkFinder\"><\/a><\/noindex>LinkFinder<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/GerbenJavado\/LinkFinder\">LinkFinder<\/a><\/noindex> \u2014 nj\u00eb skenar n\u00eb Python p\u00ebr gjetjen e linkeve n\u00eb skedar\u00ebt JavaScript. E dobishme p\u00ebr gjetjen e endpoint-eve\/URL-ve t\u00eb fshehura ose t\u00eb harruara n\u00eb aplikacionin web.<\/p>\n<h4>Avantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>I shpejt;<\/li>\n<li>Ka nj\u00eb plugin t\u00eb ve\u00e7ant\u00eb p\u00ebr Chrome q\u00eb bazohet n\u00eb LinkFinder.<\/li>\n<\/ul>\n<p>.<\/p>\n<h4>Disavantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>Rezultatet e fundit t\u00eb pap\u00ebrshtatshme;<\/li>\n<li>Nuk analizon JavaScript n\u00eb m\u00ebnyr\u00eb dinamike;<\/li>\n<li>Logjika e k\u00ebrkimit t\u00eb lidhjeve \u00ebsht\u00eb mjaft e thjesht\u00eb - n\u00ebse JavaScript \u00ebsht\u00eb ndonj\u00ebher\u00eb obfuscated, ose lidhjet nuk jan\u00eb fillimisht t\u00eb pranishme dhe gjenerohen dinamikisht, at\u00ebher\u00eb nuk do t\u00eb mund t\u00eb gjej\u00eb asgj\u00eb. <\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Mjetet n\u00eb internet, ose nga ku t\u00eb filloj\u00eb nj\u00eb pen tester?\" src=\"\/wp-content\/uploads\/2019\/05\/4cbb12ad81b249cdb21a2f4861acc346.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"JSParser\"><\/a><\/noindex>JSParser<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/nahamsec\/JSParser\">JSParser<\/a><\/noindex> \u2014 nj\u00eb skenar n\u00eb Python q\u00eb p\u00ebrdor <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tornadoweb.org\/en\/stable\/\">Tornado<\/a><\/noindex> dhe <noindex><a rel=\"nofollow\" href=\"https:\/\/beautifier.io\/\">JSBeautifier<\/a><\/noindex> p\u00ebr t\u00eb analizuar URL-t\u00eb relative nga skedar\u00ebt JavaScript. Shum\u00eb e dobishme p\u00ebr zbuluar k\u00ebrkesat AJAX dhe krijimin e nj\u00eb liste t\u00eb metodave API me t\u00eb cilat nd\u00ebrvepron aplikacioni. Punon efektivisht n\u00eb \u00e7ift me LinkFinder. <\/p>\n<h4>Avantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>Parsing i shpejt\u00eb i skedar\u00ebve JavaScript.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Mjetet n\u00eb internet, ose nga ku t\u00eb filloj\u00eb nj\u00eb pen tester?\" src=\"\/wp-content\/uploads\/2019\/05\/20812f77021319d9d1d7eafd5d394383.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"sqlmap\"><\/a><\/noindex>sqlmap<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/sqlmapproject\/sqlmap\">sqlmap<\/a><\/noindex> \u2014 ndoshta nj\u00eb nga mjetet m\u00eb t\u00eb njohura p\u00ebr analizimin e aplikacioneve web. Sqlmap automatizon k\u00ebrkimin dhe shfryt\u00ebzimin e SQL-injections, punon me disa dialekte SQL, ka nj\u00eb gam\u00eb t\u00eb gjer\u00eb teknikash, duke filluar nga citimi 'n\u00eb front' deri te vektor\u00ebt e nd\u00ebrlikuar p\u00ebr SQL-injections t\u00eb bazuara n\u00eb koh\u00eb. P\u00ebr m\u00eb tep\u00ebr, ka shum\u00eb teknika p\u00ebr shfryt\u00ebzimin e m\u00ebtejsh\u00ebm p\u00ebr sisteme t\u00eb ndryshme DB, prandaj \u00ebsht\u00eb e dobishme jo vet\u00ebm si skaner p\u00ebr SQL-injections, por edhe si nj\u00eb mjet i fuqish\u00ebm p\u00ebr shfryt\u00ebzimin e SQL-injections t\u00eb gjetura tashm\u00eb.<\/p>\n<h4>Avantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>Nj\u00eb gam\u00eb e gjer\u00eb teknike dhe vektor\u00ebsh;<\/li>\n<li>Num\u00ebr i ul\u00ebt i aktivizimeve t\u00eb gabuara;<\/li>\n<li>Shum\u00eb mund\u00ebsi p\u00ebr konfigurim t\u00eb sakt\u00eb, teknika t\u00eb ndryshme, baz\u00eb t\u00eb dh\u00ebnash t\u00eb synuar, skripte t\u00eb manipulimit p\u00ebr t\u00eb kaluar WAF-in;<\/li>\n<li>Mund\u00ebsia p\u00ebr t\u00eb krijuar nj\u00eb dump t\u00eb t\u00eb dh\u00ebnave t\u00eb daljes;<\/li>\n<li>Shum\u00eb mund\u00ebsi t\u00eb ndryshme p\u00ebr shfryt\u00ebzim, p\u00ebr shembull, p\u00ebr disa baza t\u00eb t\u00eb dh\u00ebnash \u2014 ngarkim\/ shkarkim automatik t\u00eb skedar\u00ebve, marrja e mund\u00ebsis\u00eb p\u00ebr t\u00eb ekzekutuar komanda (RCE) dhe t\u00eb tjera;<\/li>\n<li>Mb\u00ebshtetje p\u00ebr lidhje direkte me baz\u00ebn e t\u00eb dh\u00ebnave duke p\u00ebrdorur t\u00eb dh\u00ebnat e marra gjat\u00eb sulmit;<\/li>\n<li>Mund t\u00eb jepet nj\u00eb skedar tekstual me rezultatet e pun\u00ebs s\u00eb Burp-it \u2014 nuk \u00ebsht\u00eb e nevojshme t\u00eb p\u00ebrgatitet manualisht \u00e7do atribut i komand\u00ebs s\u00eb linj\u00ebs.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Disavantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>E v\u00ebshtir\u00eb p\u00ebr t\u2019u personalizuar, p\u00ebr shembull, t\u00eb shkruash kontrollime t\u00eb tua p\u00ebr shkak t\u00eb dokumentacionit t\u00eb varf\u00ebr p\u00ebr k\u00ebt\u00eb;<\/li>\n<li>Pa konfigurime p\u00ebrkat\u00ebse, kryen nj\u00eb grup t\u00eb paplot\u00eb kontrollimesh, gj\u00eb q\u00eb mund t\u00eb krijoj\u00eb konfuzion.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Mjetet n\u00eb internet, ose nga ku t\u00eb filloj\u00eb nj\u00eb pen tester?\" src=\"\/wp-content\/uploads\/2019\/05\/f99ac42bd3139894668353924112d416.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"NoSQLMap\"><\/a><\/noindex>NoSQLMap<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/codingo\/NoSQLMap\">NoSQLMap<\/a><\/noindex> \u2014 nj\u00eb mjet n\u00eb Python p\u00ebr automatizimin e k\u00ebrkimit dhe shfryt\u00ebzimit t\u00eb injeksioneve NoSQL. E thjesht\u00eb p\u00ebr t'u p\u00ebrdorur jo vet\u00ebm n\u00eb bazat e t\u00eb dh\u00ebnave NoSQL, por edhe gjat\u00eb auditimit t\u00eb aplikacioneve web q\u00eb p\u00ebrdorin NoSQL.<\/p>\n<h4>Avantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>Si si sqlmap, jo gjithashtu gjen mund\u00ebsit\u00eb e dob\u00ebsis\u00eb dhe kontrollon mund\u00ebsin\u00eb e shfryt\u00ebzimit t\u00eb saj p\u00ebr MongoDB dhe CouchDB.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Disavantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>Nuk mb\u00ebshtet NoSQL p\u00ebr Redis, Cassandra, zhvillimi n\u00eb k\u00ebt\u00eb drejtim \u00ebsht\u00eb n\u00eb proces.<\/li>\n<\/ul>\n<h2><noindex><a rel=\"nofollow\" name=\"oxml_xxe\"><\/a><\/noindex>oxml_xxe<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/BuffaloWill\/oxml_xxe\">oxml_xxe<\/a><\/noindex> \u2014 nj\u00eb mjet p\u00ebr implementimin e eksploit\u00ebve XXE XML n\u00eb lloje t\u00eb ndryshme skedar\u00ebsh q\u00eb p\u00ebrdorin formatin XML n\u00eb ndonj\u00eb form\u00eb.<\/p>\n<h4>Avantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>Mb\u00ebshtet shum\u00eb formate t\u00eb zakonshme, si DOCX, ODT, SVG, XML.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Disavantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>Nuk \u00ebsht\u00eb plot\u00ebsisht e implementuar mb\u00ebshtetja p\u00ebr PDF, JPEG, GIF;<\/li>\n<li>Krijon vet\u00ebm nj\u00eb skedar. P\u00ebr zgjidhjen e k\u00ebtij problemi, mund t\u00eb p\u00ebrdorni mjetin <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/BuffaloWill\/oxml_xxe\">docem<\/a><\/noindex>, i cili mund t\u00eb krijoj\u00eb nj\u00eb num\u00ebr t\u00eb madh skedar\u00ebsh me payload n\u00eb vende t\u00eb ndryshme. <\/li>\n<\/ul>\n<p>\nMjetet e m\u00ebposhtme jan\u00eb t\u00eb shk\u00eblqyera p\u00ebr testimin e XXE n\u00eb rastin e ngarkimit t\u00eb dokumenteve q\u00eb p\u00ebrmbajn\u00eb XML. Por mos harroni se p\u00ebrpunuesit e formateve XML mund t\u00eb gjenden n\u00eb shum\u00eb raste t\u00eb tjera, p\u00ebr shembull, XML mund t\u00eb p\u00ebrdoret si nj\u00eb format t\u00eb dh\u00ebnash n\u00eb vend t\u00eb JSON.<\/p>\n<p>Prandaj, rekomandojm\u00eb t\u00eb kushtoni v\u00ebmendje k\u00ebtij depoziti, i cili p\u00ebrmban nj\u00eb num\u00ebr t\u00eb madh payload\u00ebsh t\u00eb larmish\u00ebm: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/swisskyrepo\/PayloadsAllTheThings\">PayloadsAllTheThings<\/a><\/noindex>.<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"tplmap\"><\/a><\/noindex>tplmap<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/epinna\/tplmap\">tplmap<\/a><\/noindex> \u2014 nj\u00eb mjet n\u00eb Python p\u00ebr identifikimin dhe shfryt\u00ebzimin automatik t\u00eb dob\u00ebsive t\u00eb Injeksionit t\u00eb Shabllonit Server-Side, me konfigurime dhe flagje t\u00eb ngjashme me sqlmap. P\u00ebrdor disa teknika dhe vektor\u00eb t\u00eb ndrysh\u00ebm, duke p\u00ebrfshir\u00eb injeksionet verbale, si dhe ka teknika p\u00ebr ekzekutimin e kodit dhe ngarkimin\/shkarkimin e skedar\u00ebve t\u00eb rastit. P\u00ebr m\u00eb tep\u00ebr, ka n\u00eb arsenalin e tij teknika p\u00ebr dhjet\u00eb motor\u00eb t\u00eb ndrysh\u00ebm t\u00eb shabllonit dhe disa teknika p\u00ebr gjetjen e injeksioneve t\u00eb ngjashme me eval() n\u00eb Python, Ruby, PHP, JavaScript. N\u00eb rast t\u00eb nj\u00eb shfryt\u00ebzimi t\u00eb suksessh\u00ebm, hap nj\u00eb konsol interaktive.<\/p>\n<h4>Avantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>Nj\u00eb gam\u00eb e gjer\u00eb teknike dhe vektor\u00ebsh; <\/li>\n<li>Mb\u00ebshtet shum\u00eb motor\u00eb p\u00ebr renderimin e shablloneve;<\/li>\n<li>M\u00eb shum\u00eb teknika shfryt\u00ebzimi.<\/li>\n<\/ul>\n<p><\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"CeWL\"><\/a><\/noindex>CeWL<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/digininja\/CeWL\">CeWL<\/a><\/noindex> \u2014 nj\u00eb gjenerator fjal\u00ebsh n\u00eb Ruby, i krijuar p\u00ebr t\u00eb nxjerr\u00eb fjal\u00eb unike nga nj\u00eb faqe interneti e caktuar, kalon p\u00ebrmes lidhjeve n\u00eb sit deri n\u00eb thell\u00ebsin\u00eb e caktuar. Fjalori i p\u00ebrb\u00ebr\u00eb nga fjal\u00eb unike mund t\u00eb p\u00ebrdoret m\u00eb pas p\u00ebr forcimin e fjal\u00ebve t\u00eb kalimit n\u00eb sh\u00ebrbime ose p\u00ebr forcimin e skedar\u00ebve dhe drejtorive n\u00eb t\u00eb nj\u00ebjt\u00ebn faqe, ose p\u00ebr sulme ndaj hapave t\u00eb marra me hashcat ose John the Ripper. I dobish\u00ebm p\u00ebr p\u00ebrgatitjen e nj\u00eb liste \u201ctargeti\u201d t\u00eb mundshmeve p\u00ebr fjal\u00ebkalim.<\/p>\n<h4>Avantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>I thjesht\u00eb p\u00ebr t'u p\u00ebrdorur.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Disavantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>Duhet t\u00eb jeni t\u00eb kujdessh\u00ebm me thell\u00ebsin\u00eb e k\u00ebrkimit p\u00ebr t\u00eb mos kapur domain t\u00eb panevojsh\u00ebm.<\/li>\n<\/ul>\n<p><\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"Weakpass\"><\/a><\/noindex>Weakpass<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/weakpass.com\">Weakpass<\/a><\/noindex> \u2014 nj\u00eb sh\u00ebrbim q\u00eb p\u00ebrmban shum\u00eb fjalor\u00eb me fjal\u00ebkalime unike. Jasht\u00ebzakonisht i dobish\u00ebm p\u00ebr detyra t\u00eb ndryshme t\u00eb lidhura me thyerjen e fjal\u00ebkalimeve, duke filluar nga bruteforcimi online i llogarive n\u00eb sh\u00ebrbimet target, deri te bruteforcimi offline i hash-eve t\u00eb marra me ndihm\u00ebn e <noindex><a rel=\"nofollow\" href=\"https:\/\/hashcat.net\/hashcat\/\">hashcat<\/a><\/noindex> ose <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/john\/\">John The Ripper<\/a><\/noindex>. N\u00eb p\u00ebrb\u00ebrje ka rreth 8 miliard\u00eb fjal\u00ebkalime me gjat\u00ebsi nga 4 deri n\u00eb 25 karaktere. <\/p>\n<h4>Avantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>P\u00ebrmban si fjalor\u00eb specifik\u00eb ashtu edhe fjalor\u00eb me fjal\u00ebkalimet m\u00eb t\u00eb zakonshme - mund t\u00eb zgjidhni nj\u00eb fjalor specifik p\u00ebr nevojat tuaja;<\/li>\n<li>Fjalor\u00ebt p\u00ebrdit\u00ebsohen dhe plot\u00ebsohen me fjal\u00ebkalime t\u00eb reja;<\/li>\n<li>Fjalor\u00ebt jan\u00eb renditur sipas efektivitetit. Mund t\u00eb zgjidhni nj\u00eb variant si p\u00ebr brutalizmin e shpejt\u00eb online, ashtu edhe p\u00ebr p\u00ebrzgjedhjen e holl\u00ebsishme t\u00eb fjal\u00ebkalimeve nga nj\u00eb fjalor i gjer\u00eb me shkarkime t\u00eb fundit;<\/li>\n<li>Ekziston nj\u00eb kalkulator q\u00eb tregon koh\u00ebn e brutalizmit t\u00eb fjal\u00ebkalimeve n\u00eb pajisjen tuaj.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Mjetet n\u00eb internet, ose nga ku t\u00eb filloj\u00eb nj\u00eb pen tester?\" src=\"\/wp-content\/uploads\/2019\/05\/1e9daeca2b42b5ba4dd7750bee2ef36c.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb nj\u00eb grup t\u00eb ve\u00e7ant\u00eb do t\u00eb d\u00ebshironim t\u00eb p\u00ebrfshijm\u00eb mjetet p\u00ebr kontrollin e CMS: WPScan, JoomScan dhe AEM hacker. <\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"AEM_hacker\"><\/a><\/noindex>AEM_hacker<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/0ang3el\/aem-hacker\">AEM hacker<\/a><\/noindex> \u2014 nj\u00eb mjet p\u00ebr identifikimin e dob\u00ebsive n\u00eb aplikacionet Adobe Experience Manager (AEM). <\/p>\n<h4>Avantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>Mund t\u00eb identifikoj\u00eb aplikacionet AEM nga lista e URL-ve q\u00eb i jepet;<\/li>\n<li>P\u00ebrmban skenar\u00eb p\u00ebr t\u00eb fituar RCE p\u00ebrmes ngarkimit t\u00eb nj\u00eb JSP shell ose shfryt\u00ebzimit t\u00eb SSRF.<\/li>\n<\/ul>\n<p><\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"JoomScan\"><\/a><\/noindex>JoomScan<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/rezasp\/joomscan\">JoomScan<\/a><\/noindex> \u2014 nj\u00eb mjet n\u00eb Perl p\u00ebr automatizimin e identifikimit t\u00eb dob\u00ebsive gjat\u00eb konfigurosjes s\u00eb Joomla CMS. <\/p>\n<h4>Avantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>I aft\u00eb p\u00ebr t\u00eb gjetur mang\u00ebsi t\u00eb konfigurimit dhe probleme t\u00eb cil\u00ebsimeve t\u00eb administrator\u00ebve;<\/li>\n<li>Liston versionet e Joomla dhe dob\u00ebsit\u00eb e lidhura, ngjash\u00ebm p\u00ebr komponent\u00ebt e ve\u00e7ant\u00eb;<\/li>\n<li>P\u00ebrmban m\u00eb shum\u00eb se 1000 eksploit\u00eb p\u00ebr komponent\u00eb Joomla;<\/li>\n<li>D\u00ebrgon raporte p\u00ebrfundimtare n\u00eb formate tekstuale dhe HTML.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Mjetet n\u00eb internet, ose nga ku t\u00eb filloj\u00eb nj\u00eb pen tester?\" src=\"\/wp-content\/uploads\/2019\/05\/2f9561213895d338f8e88127bf02c3e6.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2><noindex><a rel=\"nofollow\" name=\"WPScan\"><\/a><\/noindex>WPScan<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/wpscanteam\/wpscan\">WPScan<\/a><\/noindex> \u2014 nj\u00eb mjet p\u00ebr skanimin e faqeve n\u00eb WordPress, ka n\u00eb arsenalin e saj dob\u00ebsi p\u00ebr motorin WordPress si dhe p\u00ebr disa plugina.<\/p>\n<h4>Avantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>I aft\u00eb p\u00ebr t\u00eb enumeruar jo vet\u00ebm pla\u00e7kat dhe temat e pasigurta t\u00eb WordPress, por gjithashtu p\u00ebr t\u00eb siguruar list\u00ebn e p\u00ebrdoruesve dhe skedar\u00ebt TimThumb;<\/li>\n<li>Mund t\u00eb kryej\u00eb sulme brute force n\u00eb faqet WordPress.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Disavantazhet:<\/h4>\n<p><\/p>\n<ul>\n<li>Pa konfigurime p\u00ebrkat\u00ebse, kryen nj\u00eb grup t\u00eb paplot\u00eb kontrollimesh, gj\u00eb q\u00eb mund t\u00eb krijoj\u00eb konfuzion.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Mjetet n\u00eb internet, ose nga ku t\u00eb filloj\u00eb nj\u00eb pen tester?\" src=\"\/wp-content\/uploads\/2019\/05\/eb391071eb62381da16c425d95e7cec5.gif\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb p\u00ebrgjith\u00ebsi, njer\u00ebzit e ndrysh\u00ebm preferojn\u00eb mjete t\u00eb ndryshme p\u00ebr pun\u00eb: t\u00eb gjitha jan\u00eb t\u00eb mira n\u00eb m\u00ebnyr\u00ebn e tyre, dhe ajo q\u00eb i p\u00eblqen nj\u00eb njeriu, mund t\u00eb mos i p\u00ebrshtatet fare nj\u00eb tjetri. N\u00ebse mendoni se ne e kemi injoruar pa arsye ndonj\u00eb mjet t\u00eb mir\u00eb \u2014 na shkruani n\u00eb komentet!<br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/dsec\/blog\/452836\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u043e \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0445 \u0434\u043b\u044f \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0430. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u041d\u0430\u0448 \u043a\u043e\u043b\u043b\u0435\u0433\u0430 BeLove \u0443\u0436\u0435 \u0434\u0435\u043b\u0430\u043b \u043f\u043e\u0434\u043e\u0431\u043d\u0443\u044e \u043f\u043e\u0434\u0431\u043e\u0440\u043a\u0443 \u043e\u043a\u043e\u043b\u043e \u0441\u0435\u043c\u0438 \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434. \u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e \u0432\u0437\u0433\u043b\u044f\u043d\u0443\u0442\u044c, \u043a\u0430\u043a\u0438\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u043b\u0438 \u0438 \u0443\u043a\u0440\u0435\u043f\u0438\u043b\u0438 \u0441\u0432\u043e\u0438 \u043f\u043e\u0437\u0438\u0446\u0438\u0438, \u0430 \u043a\u0430\u043a\u0438\u0435 \u043e\u0442\u043e\u0448\u043b\u0438 \u043d\u0430 \u0437\u0430\u0434\u043d\u0438\u0439 \u043f\u043b\u0430\u043d \u0438 \u0441\u0435\u0439\u0447\u0430\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0440\u0435\u0434\u043a\u043e. \u041e\u0442\u043c\u0435\u0442\u0438\u043c, \u0447\u0442\u043e \u0441\u044e\u0434\u0430 \u0436\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u0438 Burp Suite, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":26108,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-34646","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u043e \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0445 \u0434\u043b\u044f \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0430. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u041d\u0430\u0448 \u043a\u043e\u043b\u043b\u0435\u0433\u0430 BeLove \u0443\u0436\u0435 \u0434\u0435\u043b\u0430\u043b \u043f\u043e\u0434\u043e\u0431\u043d\u0443\u044e \u043f\u043e\u0434\u0431\u043e\u0440\u043a\u0443 \u043e\u043a\u043e\u043b\u043e \u0441\u0435\u043c\u0438 \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434. \u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e \u0432\u0437\u0433\u043b\u044f\u043d\u0443\u0442\u044c, \u043a\u0430\u043a\u0438\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u043b\u0438 \u0438 \u0443\u043a\u0440\u0435\u043f\u0438\u043b\u0438 \u0441\u0432\u043e\u0438 \u043f\u043e\u0437\u0438\u0446\u0438\u0438, \u0430 \u043a\u0430\u043a\u0438\u0435 \u043e\u0442\u043e\u0448\u043b\u0438 \u043d\u0430 \u0437\u0430\u0434\u043d\u0438\u0439 \u043f\u043b\u0430\u043d \u0438 \u0441\u0435\u0439\u0447\u0430\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0440\u0435\u0434\u043a\u043e. \u041e\u0442\u043c\u0435\u0442\u0438\u043c, \u0447\u0442\u043e \u0441\u044e\u0434\u0430 \u0436\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u0438 Burp Suite,\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/web-tools-ili-s-chego-nachat-pentesteru\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Web tools, \u0438\u043b\u0438 \u0441 \u0447\u0435\u0433\u043e \u043d\u0430\u0447\u0430\u0442\u044c \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0443? | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u043e \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0445 \u0434\u043b\u044f \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0430. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u041d\u0430\u0448 \u043a\u043e\u043b\u043b\u0435\u0433\u0430 BeLove \u0443\u0436\u0435 \u0434\u0435\u043b\u0430\u043b \u043f\u043e\u0434\u043e\u0431\u043d\u0443\u044e \u043f\u043e\u0434\u0431\u043e\u0440\u043a\u0443 \u043e\u043a\u043e\u043b\u043e \u0441\u0435\u043c\u0438 \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434. \u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e \u0432\u0437\u0433\u043b\u044f\u043d\u0443\u0442\u044c, \u043a\u0430\u043a\u0438\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u043b\u0438 \u0438 \u0443\u043a\u0440\u0435\u043f\u0438\u043b\u0438 \u0441\u0432\u043e\u0438 \u043f\u043e\u0437\u0438\u0446\u0438\u0438, \u0430 \u043a\u0430\u043a\u0438\u0435 \u043e\u0442\u043e\u0448\u043b\u0438 \u043d\u0430 \u0437\u0430\u0434\u043d\u0438\u0439 \u043f\u043b\u0430\u043d \u0438 \u0441\u0435\u0439\u0447\u0430\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0440\u0435\u0434\u043a\u043e. \u041e\u0442\u043c\u0435\u0442\u0438\u043c, \u0447\u0442\u043e \u0441\u044e\u0434\u0430 \u0436\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u0438 Burp Suite,\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/web-tools-ili-s-chego-nachat-pentesteru\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:59:35+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:59:35+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mjetet web, ose nga t\u00eb fillojm\u00eb testuesit e penetrimit? | ProHoster","description":"Vazhdojm\u00eb t\u00eb flasim p\u00ebr mjete t\u00eb dobishme p\u00ebr testuesit e penetrimit. N\u00eb artikullin e ri do t\u00eb shqyrtojm\u00eb mjetet p\u00ebr analizimin e siguris\u00eb s\u00eb aplikacioneve web. Kolegu yn\u00eb BeLove ka b\u00ebr\u00eb nj\u00eb p\u00ebrzgjedhje t\u00eb ngjashme rreth shtat\u00eb vitesh m\u00eb par\u00eb. \u00cbsht\u00eb interesante t\u00eb shohim se cilat mjete kan\u00eb ruajtur dhe p\u00ebrforcuar pozitat e tyre, dhe cilat jan\u00eb t\u00ebrhequr pas dhe p\u00ebrdoren rrall\u00eb tani. Vlen t\u00eb theksohet se k\u00ebtu p\u00ebrfshihet edhe Burp Suite,","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/web-tools-ili-s-chego-nachat-pentesteru","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Web tools, \u0438\u043b\u0438 \u0441 \u0447\u0435\u0433\u043e \u043d\u0430\u0447\u0430\u0442\u044c \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0443? | ProHoster","og:description":"\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u043e \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0445 \u0434\u043b\u044f \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0430. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0438\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0434\u043b\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. \u041d\u0430\u0448 \u043a\u043e\u043b\u043b\u0435\u0433\u0430 BeLove \u0443\u0436\u0435 \u0434\u0435\u043b\u0430\u043b \u043f\u043e\u0434\u043e\u0431\u043d\u0443\u044e \u043f\u043e\u0434\u0431\u043e\u0440\u043a\u0443 \u043e\u043a\u043e\u043b\u043e \u0441\u0435\u043c\u0438 \u043b\u0435\u0442 \u043d\u0430\u0437\u0430\u0434. \u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e \u0432\u0437\u0433\u043b\u044f\u043d\u0443\u0442\u044c, \u043a\u0430\u043a\u0438\u0435 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u043b\u0438 \u0438 \u0443\u043a\u0440\u0435\u043f\u0438\u043b\u0438 \u0441\u0432\u043e\u0438 \u043f\u043e\u0437\u0438\u0446\u0438\u0438, \u0430 \u043a\u0430\u043a\u0438\u0435 \u043e\u0442\u043e\u0448\u043b\u0438 \u043d\u0430 \u0437\u0430\u0434\u043d\u0438\u0439 \u043f\u043b\u0430\u043d \u0438 \u0441\u0435\u0439\u0447\u0430\u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0440\u0435\u0434\u043a\u043e. \u041e\u0442\u043c\u0435\u0442\u0438\u043c, \u0447\u0442\u043e \u0441\u044e\u0434\u0430 \u0436\u0435 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u0438 Burp Suite,","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/web-tools-ili-s-chego-nachat-pentesteru","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:59:35+00:00","article:modified_time":"2019-10-31T18:59:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"34646","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 20:04:30","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:17:23","updated":"2026-01-21 20:04:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/34646","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=34646"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/34646\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/26108"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=34646"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=34646"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=34646"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}