An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

0
votes
0answers
20 views

Are There Any Measurements for Web-Application Complexity That Positively Correlates to Num. Vulnerabilities?

Web-applications have vulnerabilities. Generally, a more complex web-application has more vulnerabilities, compared with a simpler and smaller web-application. For example, white hat hackers have ...
35
votes
4answers
5k views

Script Kiddies - how do they find my server IP?

I've set up a site on Digital Ocean without a domain yet, so there is only the IP. Despite telling no-one of its existence or advertising it, I get hundreds of notices from fail2ban that various IP's ...
0
votes
0answers
51 views

Intermediate proxy intercepting my SSL data between my computer and the ISP

I did a simple scan of my linux firewall today using grc.com's shieldsup on their website (https://www.grc.com/x/ne.dll?bh0bkyd20). Previously when doing this it shows I have full stealth but today it ...
-1
votes
1answer
30 views

Are there pricing standards for Vulnerability assessment and penetration testing (VAPT) services?

Generally, to conduct vulnerability assessment and penetration testing (VAPT) for an application, we do charge some amount from the client, based on which criteria the companies charge their ...
2
votes
1answer
47 views

Linux (!) Network Architecture for CTF-scenario [on hold]

My boss recently enrolled me in an InfoSec training. I am part of the network team, but have limited experience in InfoSec. My first assignment is to draw a layout of a network that will be used ...
-2
votes
0answers
36 views

Can you get past a regex or whitelisting? [on hold]

If there is the following code: function return_some_info($db, $id){ if (! preg_match("/^\d{5}$/",$id)) { header("Location: safepage.php"); exit; } // Further Code } ...
-1
votes
0answers
40 views

Information needed to share with Penetration Tester? [duplicate]

We are planning for a penetration testing for our network and applications. Can anyone confirm the details which should be shared to penetration testers regarding our topology / servers? Is it ...
-1
votes
2answers
97 views

What kind of information does a penetration tester require? [on hold]

We are planning for a penetration testing for our network and application. What should be shared with the penetration tester? For example, should we share the topology of our network? Should we ...
4
votes
1answer
59 views

Spoofing LAN IP Address Traffic

To give as much detail as possible, I am doing a Pentest for a client that has quite a few "terminal systems" meaning that they are simply a box with a connection back to the main server. These ...
-2
votes
0answers
18 views

Router hangs when running Nessus [closed]

I tried to run a Nessus scan for my own website through my home router (ZTE ZXV10 W300). However, the router always hangs when I run Nessus. Internet also doesn't work on that time. Once, I pause the ...
0
votes
3answers
44 views

creating a testing environment

This question has been asked over and over again across the web, but many answers are either ridiculous or the same. I have tried using OWASPs VM which has a range of purposely built holes in web ...
-3
votes
0answers
25 views

How to perform penetration testing on android app? [duplicate]

I have an Apk file. I need to perform penetration testing on that app. Which are the tools required and how to perform? Please help me out here. It's very critical to me. I have already performed pen ...
0
votes
1answer
68 views

What does the below SQL injection indicate?

What is the meaning of this command in SQL ? php?que_id =-1/**/UNION/**/ ALL/**/SELECT What does /**/? indicate here?
36
votes
4answers
4k views

What person should I write a penetration test report as?

When you're writing a report, what person do you write it as? First person singular: I discovered a vulnerability in HP Power Manager... First person plural: We discovered a vulnerability in HP ...
0
votes
1answer
41 views

No handshake recorded from airodump-ng

I've just started to attempt this by following the guide from lewiscomputerhowto. I've seen other people ask similar questions, but they all seem to be older threads. The steps I've taken are shown ...
-1
votes
1answer
37 views

Eavesdropping and sniffing attacks [closed]

Assume we have two routers connected by a link. Speaking of eavesdropping and sniffing attacks, does it technically appear at link itself or at the routers? If at the routers, does it imply that these ...
1
vote
1answer
30 views

SSH “on keyboard interactive devices” brute force vulnerability

I was researching the OpenSSH brute force vulnerability "onkeyborad-interactive devices", however I am not sure how this command really works ssh -lusername -oKbdInteractiveDevices=`perl -e 'print ...
4
votes
7answers
145 views

Any non alert() based non malicious XSS payloads?

I have been trying to find non malicious, non alert based, single command reflective XSS payloads, and have so far seen none. Anybody know of any good ones for pentesting purposes? What I mean by ...
0
votes
1answer
32 views

How to get an internal network address range during a footprinting stage?

As new to pen testing, I am a bit stuck at finding out a local network address range from external network to perform a pen testing. I will give you a fake scenario with fake IP addresses as below. ...
5
votes
2answers
73 views

Path Disclosure without ability to read files

So I am a pentester, and I have discovered "feature" on a server that allows me to, essentially, blindly traverse a web server's files (without executing or reading them). The problem is that I ...
0
votes
2answers
97 views

Penetration Testing Criteria [closed]

I'm a beginner-level penetration tester, I've noticed that after the pentesting, you just report the vulnerabilities you've found and the possible exploit points that you've discovered. Using the ...
1
vote
2answers
72 views

Understanding the behaviour of existing eavesdropping techniques

I am studying the behaviour of existing eavesdropping techniques (part of my research). I have a question through the following scenario: Suppose Bob lives in New York and wants to listen (i.e. ...
0
votes
0answers
3 views

How does Empire Powershell interact with PowerShell? [migrated]

The creators of Empire PowerShell state the following: "Empire implements the ability to run PowerShell agents without needing powershell.exe" https://github.com/PowerShellEmpire/Empire How ...
7
votes
1answer
2k views

Burpsuite accidental defacement, should I be concerned?

I was spidering a website with Burpsuite and the automated Form Submission caused me to unknowingly deface the main page with "555-555-0199@example.com". It took me a decent amount of time to notice ...
1
vote
1answer
62 views

PCI Penetration Testing - Does the whole infrastructure need to be retested on significant change?

The PCI SCC states the following in their penetration testing guidance: Per PCI DSS Requirements 11.3.1 and 11.3.2, penetration testing must be performed at least annually and after any ...
4
votes
1answer
91 views

Pentesting Web Server for Remote File Inclusion

For educational purposes, I am in the process of pentesting a web server of mine(running on Windows) where there is a Remote File Inclusion vulnerability. I can already get simple things like command ...
0
votes
1answer
62 views

What is the difference between Wireshark and Ettercap for man in the middle attacks!

I know of the two programs, one is Wireshark (a packet sniffing program) and the other is Ettercap (a man in the middle attack program). I tried doing a MITM attack before, legally on my own home ...
-1
votes
1answer
43 views

what are some of the common routers people use for penetration testing? [closed]

So, I was looking for a router to penetration test on because the one I have is very difficult. What are some of the well-known routers that are supposed to work for beginners to penetration test on?
1
vote
1answer
52 views

Removing remnants of a Metasploit exploit

Is it possible to remove a Metasploit payload/meterpreter from a compromised system? My question is mainly based on antiforensics (Leaving aside Memory forensics which is probably unavoidable but more ...
1
vote
1answer
53 views

What is an IEX download cradle?

Does anybody know what an IEX download cradle is? Is it something that belongs only to the cyber security/pentesting realm? I am asking based on this post: ...
2
votes
1answer
54 views

Is it there any way to detect payloads generated by veil framework

While pentesting, I used to generate a malicious payloads using the veil framework. The generated payload bypasses antivirus & infects the target system. Is there any way to detect veil payloads ...
3
votes
2answers
38 views

Presence of table “sqlmapoutput” in PostgreSQL database

I was pentesting a client's database and saw this one table "sqlmapoutput" in one of the user created schemas. It's a PostgreSQL DBMS. and he has no idea how it came there. There was no data in the ...
4
votes
1answer
93 views

Run NetCat as bat file instead of exe

I need to run a netcat on a remote lab machine. I can execute remote commands through the browser with Administrator rights (because of the application vulnerability) but I don't have access to the ...
2
votes
1answer
52 views

What is the benefit of an SSH tunnel vs a Netcat shell for remote communication?

On the (few) penetration tests that I've done so far, I've typically created a reverse shell with Netcat to run commands on the target machine. Now, it looks like a lot of people like to use an SSH ...
1
vote
0answers
75 views

is it possible Windows privilege escalation using freesshd keys? [closed]

I have unprivileged shell one system.By browsing all folder i found freeSSHD folder Directory of C:\Program Files\freeSSHd 09/26/2008 02:07 PM <DIR> . 09/26/2008 02:07 PM ...
1
vote
2answers
103 views

Virus-total offline Alternatives [duplicate]

These days I am working on FUDing my own written backdoor, RATs, etc. what is the alternative offline version of virus-total, if I don't want AV companies gaining my virus signature?
5
votes
0answers
203 views

Ethical Hacking Certification (CEH v9) From A Web Developer's Perspective [closed]

I just finished a week of training for the CEH v9 certification. I have two questions: What are some strategies I can take for studying for the CEH v9 certification coming at the test as a web ...
4
votes
1answer
56 views

How should I start security testing of python standalone application?

I'm looking for an answer specific to Windows/Linux standalone applications, for instance Dropbox has Windows Application written purely (I think so) in python, What steps should I follow? What are ...
4
votes
1answer
116 views

Legal insurance for penetration testers

I am currently finishing university and I am looking for work as a penetration tester. How important is it to have legal insurance for me in Germany and do I need to organise this privately. Of ...
1
vote
3answers
117 views

Penetration Test Over Internet [closed]

Is it bad practice and unprofessional to complete penetration tests from distant cities, without meeting your clients in person?
5
votes
4answers
234 views

Password guessing: Is it more effective to try many passwords against a few accounts or a few (very common) passwords against many accounts?

I was watching a security vid on Irongeek the other day (I immediately lost track of which specific vid, unfortunately) where the creator gave some interesting advice about doing live password ...
1
vote
0answers
52 views

Exploit Development Road-map [closed]

this days i am trying some exploit development practices, i already learned assembly, c, python, immunity debugger, corelan articles, pentester academy exploit development, now i can bypass DEP, ASLR, ...
-3
votes
1answer
44 views

What are some good resources to learn Remote Code execution [closed]

I want to learn remote code execution from scratch. Is there any sort of book where I can learn from, or there is a preunderstanding required to learn remote code execution? I am desperate to learn ...
2
votes
1answer
89 views

SSH ciphers, MAC and key-exchange (and pen-tests thereof)

At work we've been trying to move our external-facing services away from a policy of inclusivity (where we tried to accept as many people as possible) to a more security-focused setup. The first step ...
0
votes
0answers
24 views

Different chanels for BeEF UI and Communication Server

I am working with BeEF tool and I want to access the UI interface using https (I don't want to communicate via VPN to access the control panel), while at the same time, I need to serve the http hooks ...
3
votes
2answers
117 views

Javascript injection in email address as username?

Is it possible for a valid email address (something that would work if used send to gmail, for varying definitions of valid (the email would be received not the exploit)) to contain javascript that ...
28
votes
5answers
5k views

How do attackers find the IP addresses of recently deployed servers?

About two months ago, I deployed an Ubuntu server with as main purpose serving a web app. However, I'm still developing the app and only gave the server IP to my coworker and some friends for testing. ...
-1
votes
1answer
109 views

hard time in bug bounty hunting [closed]

I have practiced oswap documentation and their vulnerability lab. I also read some books like the web app penetration hackers handbook. But I have no success in bug bounty hunting. I have read an ...
22
votes
3answers
3k views

Metasploit Meterpreter alternatives

These days I am testing various type of client hacking techniques, but in all scenarios I am using Meterpreter variations as payload. Now I can bypass Anti-Virus and Firewalls easily, but Symantec ...
4
votes
1answer
77 views

How to carry out a CSRF in a stealthful manner

I am a math grad student dabbling in network security. I was playing around with login cross site request forgery, and the whole point is to log somebody in. (I am a complete novice in HTML and ...