During this informative session, our focus centered on elucidating various methodologies through which an individual can potentially exploit vulnerabilities within web applications. By engaging with the students from the University of Dodoma, we provided valuable insights into a spectrum of techniques employed when assessing a web application's security resilience. By imparting these multifaceted approaches, our objective was to equip the participants with a comprehensive understanding of potential attack vectors, thereby enhancing their capacity to effectively evaluate and fortify the security posture of web applications.

1. Web Hacking

2. Whoami?
❖ Kharim Mchatta
❖ CEO of HACK IT CONSULTANCY
❖ Cybersecurity professional (Pen tester & Digital Forensics expert)
❖ Founder of H4K-IT (Cybersec community inTZ)
❖ CTF player
❖ Blogger
❖ Author at eForensics and Pentets Magazine
❖ DW Swahili Subject matter expert (cybersecurity)

3. What is web
hacking

4. Kharim
Internet Website
Access
Scans the
Web app
Look for security
Flaws
Web hacking is the process of looking for security flaws in the web application.These flaws could
Be a result of misconfiguration, outdated software’s or design flaw.
WEB APPLICATION HACKING

5. PHASES OF HACKING

6. Planning

7. Recon

8. Threat Modelling

9. Scanning

10. Exploitation

11. Gaining Access &
Maintenance

12. Documentation

13. PHASES OF HACKING

14. What is
Threat
Modelling

15. Threat
Modelling
From
Business
Perspective

16. Threat
Modelling
From
Business
Perspective
Hackers
PC Servers Applications
Firewall
Organization
PROTECTING
Threats
Threat Modelling from a business perspective is the process of
People
Assets
Virus/worms

17. Threat
Modelling
From
Attackers
Perspective

18. ASSETS ATTACKERS
ATTACKERS PERSPECTIVE
Hackers
Firewall
Server
Credentials
Admin Panel Hidden Directories
Databases

19. WEB HACKING
TOOLS
Wafwoof
Burpsuite
Dirbuster &
Gobuster
Netsparker &
Acunetix
Wappalyzer
Wpscan/cmsscan/
joomscan
WEB APPLICATION HACKING TOOLS

20. OTHER TOOLS
➢ Dirsearch/dirb/dirbuster
➢ wfuzz
➢ sqlmap
➢ searchsploit
➢ Netdiscover

21. THAT’S ALL FOLKS

22. Author: Kharim Mchatta
Contacts
Kharimhmchatta@gmail.com kharim.h mchatta
KMchatta 0735212145