An attempt to penetrate a system's security in an effort to evaluate the protections in place.
0
votes
1answer
42 views
Protect an application that uses internet from packet sniffing
I developed a stand alone application such a way that, application use a remote service (using SOAP/REST) which available WWW. I am using HTTPS though out the application calls. It was perfectly ...
7
votes
1answer
138 views
Why does Hydra return 16 valid passwords when none are valid?
I've been playing around with Hydra and DVWA and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are.
I assume ...
12
votes
1answer
357 views
How can I spoof a phone call and make it appear to come from another phone?
I'm performing a penetration test against a company. Part of my social engineering procedure is to contact the IT department and try to convince them to that I'm an employee in the company and get ...
1
vote
1answer
66 views
How to MiTM insert an iframe using burp or another tool?
So, I am trying to obtain a cookie without the secure flag enabled over HTTPS.
After reading about it, I came across an answer:
You visit https://secure.example.com/ which drops a cookie on
your ...
5
votes
2answers
110 views
Client-side attacks with custom malware in penetration tests
I regularly perform pen-tests against web applications, operating systems, etc. Occasionally, I'm luck enough to do a 'red-teaming' exercise and get to attack at all conceivable points of a network ...
-6
votes
0answers
80 views
Intrusion detection system - Design and Analysis [closed]
There is a corporation, say Fizzy Drinks, that has a network suited in a single building. The scope of the corporation is to build up an Intrusion Detection System , to monitor that a rival ...
0
votes
2answers
88 views
Blackbox vs whitebox testing your own site?
When performing a security audit of one's own site is one of these methods of testing generally considered better? Would I be wasting my time by doing blackbox testing when I have access to ...
1
vote
1answer
55 views
How do I verify versions of Adobe?
I ran a vulnerability scan against a server and it is pulling back a lot of Adobe vulnerabilities. I ran a Wireshark capture on the scan but I can't seem to write up a Wireshark filter on the packets. ...
-5
votes
0answers
35 views
How do I add API keys to recon-ng? [closed]
Does anyone know how to add API-Keys to Recon-ng?
https://bitbucket.org/LaNMaSteR53/recon-ng
im getting errors that say it wont work.
-2
votes
0answers
30 views
Summer Security Activities [closed]
I am hobbled up this summer due to a leg injury and will be unable to do the hiking I usually do.
I teach high school and am thinking about setting up a club for the students where they will learn ...
0
votes
2answers
69 views
How do I obtain user info from SET?
I am trying to create a phishing email for a project I am on. In the email I want to link to a site that will collect IP, browser, date/time of when visited. nothing malicious but to just prove that ...
5
votes
1answer
153 views
Pen Testing ASP.NET application with Backtrack
We have developed an ASP.NET Based Enterprise Application which is is soon to be released. Now, we are concerned about the security aspects of the application. I've been looking into Backtrack 5 and ...
-4
votes
1answer
135 views
Am I part of a botnet or hack? [closed]
(FYI: my network has been hacked before...see other thread).
I have 2 routers daisy-chained. Router #1 hosts Windows PCs and a VOIP box on subnet 172. Its LAN4 goes to WAN of Router#2, which serves ...
-2
votes
0answers
104 views
History of RAT + Strange networking recently… was I hacked again? [closed]
(FYI, my PCs were infected and remote accessed in the past by a friend/stalker, & I’ve reinstalled the network few times already. Recently added Router#2 to double-NAT).
My network has 2 routers ...
0
votes
1answer
197 views
Please recommend scanner that allows to find XSS and SQL injections vulnerabilities for Web Application [closed]
We develop Web Application:
Platform is Redhat 6.3/6.4
Presentation tier is JSF2
Persistence tier is Hibernate
Server is JBoss 4
Database is PostgreSQL 9.0.13.
We want to run scanner during our ...
4
votes
2answers
92 views
Executing arbitrary commands through iptables-restore input
During a pentest I found a way to add arbitrary iptables firewall rules to a server. These rules get applied by way of the iptables-restore command, and I've been wondering whether there is any way to ...
3
votes
2answers
155 views
Vulnerability testing without the use of exploits?
I was doing some testing on a server to see if it was vulnerable to a 0-day local exploit (the exploit was for gaining root privileges using a bug in the Linux kernel). There was no real information ...
17
votes
2answers
965 views
Is it posible to make shellcode with C++?
Usualy I write assembly programs and thens dump their contents to get the shellcode. What I was wondering instead of assembly can I write a c++ program, then dump that and then use it instead of the ...
4
votes
2answers
150 views
Security test lab setup [closed]
I want to setup a testing lab in my basement for penetration/vulnerability testing & offensive/defensive security skills. I believe I have all the equipment that I need, and if I'll need something ...
18
votes
0answers
569 views
Where can I find a vulnerable operating system to practice pentests on? [duplicate]
I am looking for vulnerable operating systems that are used for practicing pentests. Damn Vulnerable Linux (DVL) is not maintained anymore. Are there any other simillar OS´s to download somewhere that ...
7
votes
1answer
846 views
Penetration testing Windows Phone 8 apps w/o source
I am interested in performing a penetration test of a Windows Phone 8 application for which I do not have the source code. While I can easily validate network communication security, it is more ...
1
vote
2answers
84 views
Relationship between penetration testing and false positive results
I had read through several research papers that discussed the trend of existing automation scanners to produce false positive results. I also read through some articles that showing the manual ...
3
votes
3answers
111 views
Can Penetration Testing be considered as a part of a Vulnerability Management Program?
Can Penetration Testing be considered as a part of an exhaustive Vulnerability Management program?
P.S: I realise the difference between penetration testing and vulnerability assessment. But I want to ...
3
votes
3answers
150 views
Web application security standards/certificates
I'm currently working on Web application/service that (hopefully) will be used in a wide variety of ways. Of course I'm looking to attracting some commercial users as well, and as we all know, they ...
3
votes
1answer
90 views
Best option to fuzz a C Network Program
I have a client/server simple program in C. I want to test the server running on different machine with random inputs. I have looked at 'Bunny-the-fuzzer' but from what I can understand It wont be ...
4
votes
2answers
354 views
SQL Injection - Extracting database data from the page content
I have a question I am hoping someone could help with..
I am in the process of writing an SQL Injection tool from scratch (I am aware there are already excellent tools out there such as SQL Map, but ...
4
votes
1answer
202 views
How to use NMap to portscan a SonicWall that is blocking all attemtps?
It seems that SonicWall is blocking attemtps to scan its ports. I know it has some ports open, like 443, because if I access using the browser I get a web site. But when I try to use NMap I can't see ...
0
votes
0answers
59 views
Web Application Pen Testing career advise needed [closed]
I have 8 years Java development experience and now I am looking to change career into web app pen testing. Its purely because of interest.
Could you all please suggest where to start and how to ...
6
votes
3answers
228 views
TCP Sequence Prediction and it's prominence in modern systems/networks
I have a question regarding your experience of TCP Sequence Prediction that I am hoping someone could help with.
I am aware of how TCP Sequence Prediction works and how the connection can be hijacked ...
-4
votes
2answers
143 views
Is it illegal to test a website and report the security bugs to them? [closed]
I am doing testing on some websites and I have found some serious bugs in those sites.
I am not sure if this is legal or not.
Is it ever legal?
How can I find out if it's legal where I live?
What ...
7
votes
5answers
773 views
I have a client that is worried about DDOS attacks on their site, and they want penetration testing. Will that help?
My client wants to look into hiring a third party to perform penetration tests on the website that we're developing for them. The website is just a simple 3-month contest site where people can upload ...
7
votes
1answer
93 views
Is there a public database of mutex names that are associated with malware?
I remember seeing something like this a while back, and it'd be incredibly useful for a project I'm working on. Essentially there was a list of mutex names, with a list of malware identifiers (e.g. ...
0
votes
2answers
65 views
Relation between boolean blind SQLi and time blind SQLi?
I am part of a team which developing web app penetration testing framework, and I am taking care of SQLi detection. When I tested multiple known vulnerable local sites found Boolean Blind flaw always ...
-2
votes
2answers
205 views
Evaluating candidates for Hacker/Pen Test Positions [closed]
If I need to employ Penetration Testers, what are the procedures to follow and how to examine candidates to know their skills and qualifications.
Also, I need to know what are the ...
1
vote
1answer
135 views
Choosing the right tools [closed]
I'm totally new in the field of penetration testing, like almost no experience, only read lots of books and papers. I encountered lots of interesting tools during studying, many are famous like ...
-3
votes
1answer
141 views
Is there website for FastTrack? [closed]
i have searched about this automated penetration testing tool to get its docs and source code, i searched a lot and all i found is tutorials and this
$ svn co http://svn.thepentest.com/fasttrack/
a ...
4
votes
3answers
236 views
What dangerous characters need to be filtered from user input prior to use in a DB2 SQL query?
I'm looking to fully understand how to properly filter/escape dangerous characters from user input that will be interpolated into a DB2 SQL query.
The sanitization routing that I'm analyzing works ...
1
vote
1answer
307 views
How can I monitor a named pipe?
I have installed an application that opens a named pipe that is accessible over the network. I would like to monitor/sniff what is sent to this named pipe, any idea how I can do that?
Edit: Even ...
5
votes
3answers
329 views
Fresh Graduate Going into Penetration Testing
As a fresh graduate I'm wondering what my chances are of joining a great pen-testing group. Is there a risk that a career in pen-testing may one day not be needed? If so, how applicable will skills ...
3
votes
5answers
2k views
Testing for HTTP TRACE method
How can I test for HTTP TRACE on my web-server?
I need to train a Tester how to verify that the HTTP TRACE method is disabled.
Ideally I need a script to paste into Firebug to initiate a https ...
3
votes
5answers
521 views
Affordable web application attack tools
I've been using Burp Intruder (part of Burp suite), but in the free edition of Burp Suite the Intruder functionality is Time-throttled. As a student pen tester however, I can't justify the cost of ...
1
vote
2answers
221 views
How do I find a target on the wired network, from an attack system on Wi-Fi?
I'm trying to practice penetration testing on my home network. The target system is my desktop computer, which is connected to the network via ethernet cable. The attack system is my laptop, which is ...
4
votes
1answer
281 views
How can XML Injection be exploited , need example?
So I found this explanation for a vulnerability on some cms :
The XML parser at /WorkArea/Blogs/xmlrpc.aspx is vulnerable to XML
external entity attacks which can be used to Scan behind ...
0
votes
1answer
394 views
Penetration testing job entry exam [closed]
What type of hands on tests should I expect in a interview for a entry level penetration tester?
And what do examiners expect a candidate to accomplish (i.e. full compromise)?
The reason I ask is ...
0
votes
1answer
81 views
All I see is RPC, how do I proceed?
I finished a tiered hacking exercise, and after submitting it was told that the last tier (a machine on the network) was not possible to attack in the given exercise.
The machine was only running ...
0
votes
1answer
133 views
How to conduct a disguised LSA attack against OSPF?
I want to do disguised LSA attacks on OSPF network and be able to more analyze, so I do not know how it works in practice. This is a penetration test.
The attack is described in the address [+]. I ...
4
votes
3answers
510 views
SQL Injection How to inject Clean/Rest URLS
I have a question I'm hoping you could help me with?
Unclean url's:
http://example.com/index.php?page=foo
http://example.com/products?category=2&pid=25
...
8
votes
2answers
229 views
Should a penetration tester have training in ISO 27001/ITIL etc?
I recently got offered a promotion but as part of the package I've been requested to do ISO 27001, ITIL, ARPA and other kinds of training. I've previously avoided this sort of training as I felt it ...
0
votes
0answers
108 views
How to use Maltego in a team? [closed]
Does anyone have any experience using Maltego in a team? Not being a server/client architecture I'm wondering how to best utilize this tool when you have a pentest team of four to five people.
...
2
votes
1answer
175 views
Black box testing javascript MVC web applications
I want to test a web application that has been built using the backbone.js framework.
Currently I have used a few tools for crawling and testing without any luck. When crawling the website they can ...
