O'Reilly logo

IoT Penetration Testing Cookbook by Aditya Gupta, Aaron Guzman

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

How to do it...

When attempting to find a reflective XSS vulnerability, we start by observing parameter input behavior to see whether the data is reflected back to the user. Web proxys such as OWASP ZAP and Burp Suite can help automate the discovery process with their scanning engines:

  1. Navigate through the application to find potential reflected values. Usually places to probe are diagnostic pages, troubleshooting, or configuration pages that change services or daemons running on the embedded device. The following screenshot shows a potential starting point for discovering a web vulnerability:
  1. Proxy the HTTP request in ZAP and make a change ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required