50.4 Web, MySQL, OWASP and Kali terms
SQLi, prepared statements, Burp, Nmap, Metasploitable – web + lab tools. Alphabetical. Ethics = OWN lab only.
| Term | Meaning | मराठी अर्थ |
|---|---|---|
| Burp Suite | Intercepting proxy for web testing (OWN lab apps only). | — (English madhech vapra) |
| CSRF | Cross-Site Request Forgery – tricking a logged-in browser into an action. | क्रॉस-साइट विनंती बनावट |
| DVWA | Damn Vulnerable Web Application – intentional practice target. | — (English madhech vapra) |
| Gobuster / Dirb | Tools that discover hidden paths with a wordlist (OWN host only). | — (English madhech vapra) |
| Hashcat | Fast password-hash cracker for lab hashes you own. | — (English madhech vapra) |
| IDOR | Insecure Direct Object Reference – changing an ID to reach another user’s object. | असुरक्षित थेट वस्तू संदर्भ |
| Juice Shop | OWASP Juice Shop – modern vulnerable web app for practice. | — (English madhech vapra) |
| Kali Linux | Security distribution used in class for authorised lab tools. | — (English madhech vapra) |
| Metasploit | Exploitation framework – awareness on Metasploitable only in this book. | — (English madhech vapra) |
| Metasploitable | Intentionally vulnerable Linux VM for safe practice (192.168.56.20). |
— (English madhech vapra) |
| Nmap | Network mapper for host/port discovery (OWN IPs; prefer -T2 in class). |
— (English madhech vapra) |
| OWASP Top 10 | Community list of common web risk classes (and fixes). | — (English madhech vapra) |
| Prepared statement | SQL with placeholders so user input cannot change the query structure. | तयार SQL विधान (इंजेक्शन रोखणे) |
| sqlmap | Automated SQLi tester – only against OWN DVWA/Juice, never random sites. | — (English madhech vapra) |
| SQL injection (SQLi) | Attacker input that changes SQL meaning (fix with prepared statements). | SQL इंजेक्शन |
| SQL_SAFE_UPDATES | MySQL mode that blocks reckless UPDATE/DELETE without a key WHERE. | — (English madhech vapra) |
| SSRF | Server-Side Request Forgery – tricking the server to fetch internal URLs. | सर्व्हर-साइड विनंती बनावट |
| Table | MySQL structure of rows and columns. | — (English madhech vapra) |
| Wordlist | File of candidate passwords / paths for lab cracking or discovery. | — (English madhech vapra) |
| XSS | Cross-Site Scripting – injecting script into pages other users view. | क्रॉस-साइट स्क्रिप्टिंग |
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Runs sqlmap on random websites | Only OWN DVWA/Juice; prepared statements + least DB priv |
| Uses Metasploit against cafe phones | Metasploitable 192.168.56.20 only; patch/disable after awareness |
Turns off SQL_SAFE_UPDATES forever “for speed” |
Keep safe updates on; WHERE on keys; backups |
Ravindra Bagale's Tip
Tool name rattlo ≠ ethical hacker. Nmap / Burp / Metasploit line type karaycha asel tar pehle OWN IP notebook madhe. SQLi fix = prepared statements – “escape manually” shortcut interview madhe weak. Lakshat theva.
Lab
Against only host-only targets: gentle sudo nmap -sS -T2 -p 80,443,3306 192.168.56.20 -oN ~/labs/glossary-nmap.txt. Map three glossary terms you just saw (open port, service, Blue control). No Metasploit on anything except Metasploitable if your class already covered it.