Page 47 - Hands-On Bug Hunting for Penetration Testers

Preparing for an Engagement Chapter 3

Technical Requirements

This chapter, like many, will rely on a VOJY command shell ([TI) to bootstrap and interact
with programs installed via their graphical installer, a package manager (IPNFCSFX), or a
tarball. It will also include several desktop apps, all of which we'll install, via similar
methods, into a macOS High Sierra ( ) environment. When a web browser is
required, we will use Chrome ( ).

For some of these, there will be an explicit Windows option. In that case, the menus may
look different but the available actions will be the same. When no Windows option is
available, you might have to dual-boot with one of the more user-friendly Linux distros.

Tools

We'll be using a variety of tools this chapter, some of which we'll be coming back to
throughout the book:

XGV[[
TDSBQZ
TUSJLFS
Burp Suite
Homebrew (package manager)
SecLists
WJSUVBMFOW
KFOW(Java version manager)
Java Development Kit (JDK)
Java Runtime Environment (JRE) 1.6 or greater

XGV[[ is a fuzzer and discovery tool built by pentesters for pentesters. To install it, simply
use QJQ: QJQ JOTUBMM XGV[[.

Homebrew is an excellent package manager for macOS that allows you to install
dependencies from the command line, much like you would with BQU HFU in Debian or
ZVN in Redhat-flavored Linux distributions. Homebrew is easily installed via its website
(IUUQT CSFX TI ), then packages can be installed simply via CSFX JOTUBMM
1"$,"(&@/".& .

[ 32 ]