--- title: Best Pentesting posts of 2024 | daily.dev description: The most upvoted Pentesting posts of 2024, curated by the daily.dev community. canonical: https://daily.dev/tags/pentesting/best-of/2024 twitter:card: summary_large_image twitter:site: @dailydotdev og:url: https://daily.dev/tags/pentesting/best-of/2024 og:type: website og:site_name: daily.dev og:title: Best Pentesting posts of 2024 | daily.dev og:description: The most upvoted Pentesting posts of 2024, curated by the daily.dev community. og:image: https://media.daily.dev/image/upload/s--VAY5ToZt--/f_auto/v1724209435/public/daily.dev%20-%20open%20graph --- # Best of Pentesting — 2024 1. 1 [](/posts/naabu-port-scanner-vbyoowcg5 "Naabu port scanner") Article System Weakness · 2y Naabu port scanner Naabu is a fast port scanner written in Go, designed to be reliable and simple to use, especially useful in conjunction with other tools for attack surface discovery in bug bounties and pentests. It can be installed from its GitHub page and comes with various switches similar to Nmap for different functionalities like live host scanning, defining ports, threading, and rate limiting. It's particularly efficient for scanning multiple targets compared to Nmap. 53 2. 2 [](/posts/google-dorking-in-cybersecurity-iz0nfi6mu "Google Dorking in Cybersecurity") Article System Weakness · 2y Google Dorking in Cybersecurity Google Dorking, also known as Google Hacking, is a technique for crafting search queries on Google to access specific sites, file types, or pages. This process is useful in OSINT investigations and penetration testing. The post explains common dorks like 'cache', 'filetype', 'intitle', 'inurl' and their uses, while emphasizing the legal boundaries. It covers use cases such as searching for mentions, documents, web cameras, and sensitive files. The guide also details how to automate these searches with Python scripts and mentions other search engines like Netlas, Shodan, and Censys that can complement Google Dorking. 27 2 3. 3 [](/posts/deepseek-ai-from-prompt-injection-to-account-takeover-embrace-the-red-bapeickbv "DeepSeek AI: From Prompt Injection To Account Takeover · Embrace The Red") Article Embrace The Red · 2y DeepSeek AI: From Prompt Injection To Account Takeover · Embrace The Red DeepSeek AI's recently released reasoning model, DeepSeek-R1-Lite, has garnered significant attention in the AI community. The post describes how the author used pentesting techniques to exploit Cross-Site Scripting (XSS) and prompt injection vulnerabilities, demonstrating a potential account takeover scenario. The vulnerability was reported and fixed promptly by DeepSeek. The post provides insight into the security risks in LLM-powered web apps and the importance of secure session handling. 25 4. 4 [](/posts/securing-laravel-applications-with-stephen-rees-carter-3cfkjzmuy "Securing Laravel Applications with Stephen Rees-Carter") Article Laravel News · 2y Securing Laravel Applications with Stephen Rees-Carter Stephen Rees-Carter shares insights on Laravel security, covering topics such as security consulting, the significance of penetration testing, and common vulnerabilities in Laravel applications. Additional resources include his mailing list, a pentesting series, and a practical Laravel security course. 25 5. 5 [](/posts/wordpress-penetration-testing-a-hacker-s-playbook-c2stqhxyr "WordPress Penetration Testing: A Hacker’s Playbook") Article System Weakness · 2y WordPress Penetration Testing: A Hacker’s Playbook WordPress penetration testing involves understanding the platform's structure, including user roles and common vulnerabilities. Significant targets include the wp-config.php file, plugins, themes, and user roles ranging from administrators to subscribers. Key techniques include checking for default credentials, examining backup files, and exploiting weak spots such as the XML-RPC interface and REST API. Effective tools and methods include WPScan for quick site scans, user enumeration, and surveillance of upload functions. 20 6. 6 [](/posts/h4r5h1t-webcopilot-an-automation-tool-that-enumerates-subdomains-then-filters-out-xss-sqli-open-r-qnlfrgm8h "h4r5h1t/webcopilot: An automation tool that enumerates subdomains then filters out xss, sqli, open redirect, lfi, ssrf and rce parameters and then scans for vulnerabilities.") Article Community Picks · 2y h4r5h1t/webcopilot: An automation tool that enumerates subdomains then filters out xss, sqli, open redirect, lfi, ssrf and rce parameters and then scans for vulnerabilities. WebCopilot is an automation tool that enumerates subdomains, filters out various parameters, and scans for vulnerabilities using open-source tools. 18 7. 7 [](/posts/is-this-the-best-cybersecurity-beginner-cert-includes-giveaway--jcahhbiyp "Is this the best Cybersecurity beginner cert? (Includes Giveaway!)") Video David Bombal · 2y Is this the best Cybersecurity beginner cert? (Includes Giveaway!) 16 8. 8 [](/posts/hacking-websites-great-demos-with-xml-external-entities-xxe--0vplire4j "Hacking websites (great demos) with XML External Entities (XXE)") Video David Bombal · 2y Hacking websites (great demos) with XML External Entities (XXE) David Bumble hosts Tiberius, a well-known web app pentester and content creator, to discuss and demonstrate XML External Entities (XXE) vulnerabilities. Tiberius explains the basics of XXE, its potential risks such as server-side request forgery (SSRF) and file inclusion, and shares practical demonstrations including error-based and out-of-band XXE exploitation. The session also covers the use of Dynamic DTD for easier exploitation and the importance of proper XML parser configuration to mitigate these vulnerabilities. Links to Tiberius's YouTube channel and GitHub repository are provided for further learning and tool access. 12 9. 9 [](/posts/6-api-vulnerability-scanners-15jdojdpg "6 API Vulnerability Scanners") Article Nordic APIs · 3y 6 API Vulnerability Scanners Ensure the security of your APIs with API vulnerability scanners. These scanners can detect potential security risks and help prevent malicious attacks. Consider factors such as ease of use, scanning capabilities, cost, and customer support when choosing a scanner. 12 10. 10 [](/posts/building-your-home-cybersecurity-lab-for-pentesting-setting-up-with-virtualbox-vmware-workstation--gyqxlnwjy "Building Your Home Cybersecurity Lab for Pentesting: Setting Up with VirtualBox, VMware Workstation, and VulnHub") Article Collections · 2y Building Your Home Cybersecurity Lab for Pentesting: Setting Up with VirtualBox, VMware Workstation, and VulnHub Creating a home cybersecurity lab with virtual machines is essential for practicing penetration testing and ethical hacking. This guide covers setting up the lab using platforms like VulnHub and virtualization tools such as VMware Workstation and VirtualBox. Key steps include configuring a Host-Only Network Adapter, importing vulnerable machines, and performing network scans to identify vulnerabilities. 10 [See all Pentesting archives](/tags/pentesting/best-of) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@graph":[{"@type":"CollectionPage","@id":"https://daily.dev/tags/pentesting/best-of/2024#page","url":"https://daily.dev/tags/pentesting/best-of/2024","name":"Best Pentesting Posts of 2024","description":"The most upvoted Pentesting posts of 2024, curated by the daily.dev community.","isPartOf":{"@type":"WebSite","url":"https://daily.dev"}},{"@type":"ItemList","@id":"https://daily.dev/tags/pentesting/best-of/2024#items","numberOfItems":10,"itemListElement":[{"@type":"ListItem","position":1,"url":"https://daily.dev/posts/naabu-port-scanner-vbyoowcg5","name":"Naabu port scanner"},{"@type":"ListItem","position":2,"url":"https://daily.dev/posts/google-dorking-in-cybersecurity-iz0nfi6mu","name":"Google Dorking in Cybersecurity"},{"@type":"ListItem","position":3,"url":"https://daily.dev/posts/deepseek-ai-from-prompt-injection-to-account-takeover-embrace-the-red-bapeickbv","name":"DeepSeek AI: From Prompt Injection To Account Takeover · Embrace The Red"},{"@type":"ListItem","position":4,"url":"https://daily.dev/posts/securing-laravel-applications-with-stephen-rees-carter-3cfkjzmuy","name":"Securing Laravel Applications with Stephen Rees-Carter"},{"@type":"ListItem","position":5,"url":"https://daily.dev/posts/wordpress-penetration-testing-a-hacker-s-playbook-c2stqhxyr","name":"WordPress Penetration Testing: A Hacker’s Playbook"},{"@type":"ListItem","position":6,"url":"https://daily.dev/posts/h4r5h1t-webcopilot-an-automation-tool-that-enumerates-subdomains-then-filters-out-xss-sqli-open-r-qnlfrgm8h","name":"h4r5h1t/webcopilot: An automation tool that enumerates subdomains then filters out xss, sqli, open redirect, lfi, ssrf and rce parameters and then scans for vulnerabilities."},{"@type":"ListItem","position":7,"url":"https://daily.dev/posts/is-this-the-best-cybersecurity-beginner-cert-includes-giveaway--jcahhbiyp","name":"Is this the best Cybersecurity beginner cert? (Includes Giveaway!)"},{"@type":"ListItem","position":8,"url":"https://daily.dev/posts/hacking-websites-great-demos-with-xml-external-entities-xxe--0vplire4j","name":"Hacking websites (great demos) with XML External Entities (XXE)"},{"@type":"ListItem","position":9,"url":"https://daily.dev/posts/6-api-vulnerability-scanners-15jdojdpg","name":"6 API Vulnerability Scanners"},{"@type":"ListItem","position":10,"url":"https://daily.dev/posts/building-your-home-cybersecurity-lab-for-pentesting-setting-up-with-virtualbox-vmware-workstation--gyqxlnwjy","name":"Building Your Home Cybersecurity Lab for Pentesting: Setting Up with VirtualBox, VMware Workstation, and VulnHub"}]},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Tags","item":"https://daily.dev/tags"},{"@type":"ListItem","position":3,"name":"Pentesting","item":"https://daily.dev/tags/pentesting"},{"@type":"ListItem","position":4,"name":"Best of","item":"https://daily.dev/tags/pentesting/best-of"},{"@type":"ListItem","position":5,"name":"2024"}]}]} ```