Pre-attack is a phase where an attacker attempts to discover information about their target. This can involve network reconnaissance, operational intelligence, historical information, etc.

learn more… | top users | synonyms

9
votes
2answers
927 views

User Enumeration Vulnerability while creating Google account

When we create a Google account, Google tells us whether an account with specified username exists or not. Doesn't that lead to user enumeration? Why not let users fill other information first, ...
4
votes
1answer
1k views

Discovering a vulnerable service on a machine

I am trying to get access to one of the machines in my lab. it has 2 tcp ports that I am highly suspecting which are: port 25 tcp port 111 tcp For port 25, it is supposed to be running SMTP, ...
3
votes
3answers
2k views

User name enumeration?

From what I understand it is bad security practice to display informative failed login messages like: The email you entered does not exist Instead of Incorrect email/password combination ...
7
votes
3answers
745 views

How important is CAPTCHA on registration pages?

I am working on a site and I would like to add CAPTCHA to the user registration page to prevent user name enumeration. I am working with a front end developer who feels pretty strongly that we should ...
1
vote
1answer
102 views

Network enumeration protection [closed]

I was reading about DNS security, and readed about Zone Transfer and how can be used to retrieve host information of a network, so not allowing Zone Tranfer from external sources will be the solution ...
2
votes
1answer
1k views

How can I misuse the information of DCE service enumeration?

Nessus reports almost on any Windows machine "DCE service enumaration". With the metasploit module tcp_dcerpc_auditor I get the following information: 192.168.1.23 - UUID ...
4
votes
1answer
735 views

Techniques for fingerprinting a web based content management system (CMS)

Let's say we have a random basic blog or informational website: just some pages with information, a sidebar with an overview of the archives, the normal stuff. We know of this website that it's built ...