An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

-4
votes
1answer
51 views

Understanding Buffer Overflows

Buffer overflows. I've been hearing & reading about them for quite some time now but I've never really understood them properly. So.. Buffer overflows... What are they and how do they work? ...
4
votes
1answer
64 views

iOS application pentest without jailbreak

Is it possible to run a security assessment on an iOS application using a non-jailbroken device? My device was recently restored (recovered - no SHSH blobs) to iOS 8.4.1 (as Apple doesn't like ...
-2
votes
2answers
53 views

Use of Nmap ssl/http md5 and SHA1 hashes

I have below stated result on of the system by map: 443/tcp open ssl/http Apache httpd 2.0.52 ((CentOS)) | http-methods: GET HEAD POST OPTIONS TRACE | Potentially risky methods: TRACE |_See ...
0
votes
1answer
38 views

Are there any pen testing tools/methods for wpa2 networks that don't require using an adapter that supports monitor mode? [closed]

I really enjoy reading and researching about networking and pentesting. Recently I heard from a friend that there are ways that can be used to get into wireless networks without needing an adapter ...
0
votes
2answers
67 views

What impact are you expecting Windows 10 Forced Updates to have on your Penetration Testing?

Unpatched Windows machines (even machines that are just a couple of updates behind) can greatly increase the chances of a successful penetration test (assuming your success criteria is gaining access ...
0
votes
1answer
62 views

How to detect a Dionaea Honeypot, is it possible or not?

There is a question like this but the answers aren't sufficient to me. I am interested in a honeypot project and I use the dionaea honeypot. This project is really cool, but there is a problem. How ...
2
votes
2answers
66 views

How to Estimate time taken for Web Application Security Testing?

I would like to do some kind of estimation for time taken to test a website/ web application for security vulnerabilities. I will be testing websites against OWASP Top 10 Based on my understanding, ...
1
vote
1answer
31 views

Is using a website copier considered active reconnaissance in penetration testing?

New to PT and would like to test recon skills. First, is this considered passive or active recon? Second, would I be jumping into a legal gray area if I used a tool like this on a buiness' website? ...
-5
votes
0answers
30 views

generating wordlist + a random digit

Can the Crunch software be used to read word list from a text file and append a random digit at the end of each word?
2
votes
2answers
70 views

How would you test a new, individual SSL certificate (i.e., not a wildcard) is working properly?

I am running a web server in AWS and recently purchased an SSL cert to encrypt traffic, let's say for example.com. Since example.com is running in production, how would I actually test the cert is ...
6
votes
3answers
176 views

Do ISP Detect and Block Pen Testing Tools?

I one of the earliest books I read on security - The Basics of Hacking and Penetration Testing (978-0124116443); the author emphasized that you cannot use these Penetration Test Tools over the ...
1
vote
2answers
184 views

Will hacking (pentesting) a live website from a VM improve or hinder my hacker anonymity?

Would a pentest initiated from a VM mounted on hard drive be more or less anonymous to IDS attack or forensically traceable? Please note: I will be browsing via tor and kproxy and have all that ...
2
votes
0answers
56 views

Help locate “snot” IPS/IDS testing tool? [closed]

It seems this great tool has been lost to internet backlog somewhere. I cannot locate it anywhere. The description of tools provided is http://www.securityfocus.com/tools/category/112 If someone on ...
1
vote
0answers
70 views

Is it possible to exploit an image field in which I can upload any file? [closed]

I'm pentesting this web application developed in ASP.NET. I've found that I can upload any file as profile photo. When I later visit the profile page the site tries to display it like this: <img ...
2
votes
1answer
68 views

Tools for finding stored XSS vulnerabilities, given DB write access?

I'm aware that there are various tools for testing for XSS vulnerabilities. However, all the ones that I'm aware of (Vega, possibly BeEF, etc.) operate purely client-side. When testing for stored XSS ...
4
votes
3answers
252 views

How do RATs access computers through routers?

I've started trying to increase my networking security at my house. One thing that worries me (because other people in the house are always downloading viruses that come along with "free" games) are ...
3
votes
1answer
151 views

HTTPonly cookies

I was tasked to perform as scan against a lab and Nessus returned an "Apache HTTP Server httpOnly Cookie Information Disclosure" vulnerability. What I would like to know is what these cookies contain ...
2
votes
2answers
101 views

enumeration and MS DCERPC

Enumeration, enumeration, and even more enumeration is the generic pentesting mantra, but enumeration is worthless if you can't read the results. I came across the Windows RPC service, where ...
3
votes
1answer
52 views

PCI DSS 3.0, 11.3 - What happens if a low risk vulnerability prevents compliance with another requirement?

As I understand the PCI DSS 3.0/3.1 penetration testing requirements, a company is compliant with 11.3 if the penetration test does not return any high risk vulnerabilities. However, what happens if ...
1
vote
0answers
75 views

Adding a binary to the firmware of a routing device [closed]

I've been playing around with a router d-link dwr-921 and found some vulnerabilities in the web interface. I still haven't managed to get shell access and now I'm thinking about modifying the firmware ...
11
votes
2answers
468 views

Custom Metasploit payload with UAC bypass

The machine I am attacking has anti-virus installed. I have managed to use Veil Framework in order to create an initial reverse shell payload that is undetected by the AV. However, UAC is enabled on ...
1
vote
1answer
236 views

Rainbow tables/hash tables versus WPA/WPA2

In Wi-Fi penetration testing, is it possible to use rainbow tables/hash tables on WPA/WPA2 networks? Is there an advantage of one over the other? Where would one get said tables or can they be ...
2
votes
1answer
118 views

What is the difference between a hash table and a rainbow table, and how are they both used?

Is there much of a difference between the two tables? Can you get one from the other? (i.e. hash -> rainbow) How do they work? Are there different variables (in reference to speed, strength, ...
1
vote
3answers
81 views

Do I need an ASV to come out when going for an SAQ?

Our company is going for a SAQ, under PCI DSS 3.1. Do we need to pay a vendor to come out and do an on site scan, or can we use something like Nessus to do the scan on our own?
0
votes
1answer
44 views

Haskell in the security industry?

I know of a tool called msf-haskell for security but are there others? Are there any security tools that are written in haskell? other than the one above How much use will haskell be in industry, ...
9
votes
9answers
522 views

Which factors should you take into account when deciding whether users should be informed of a penetration test?

Say you are conducting a penetration test of an internal network. The internal network comprises of workstations, servers and company and contractor laptops. In an ideal world, the penetration test ...
0
votes
2answers
74 views

Precauations for web application security audit

We have planned to give our web application to a third party vendor,what were the precautionary measures which we need to take care before giving our application to third party vendor? As the vendor ...
2
votes
0answers
29 views

What features should I look for when buying a external wireless card used for the purpose of pen testing/snooping [duplicate]

I'm currently planning to buy an external wireless card for the purpose of pen testing and snooping my own network in order to learn more about it and try to create more preventive measure against ...
1
vote
1answer
90 views

Sketchy traffic from port 3030?

I am running tests on a server that is ran by a close family friend, who agreed to allow me to do so in exchange for the experience I will gather (I am currently a computer science student). On ...
0
votes
0answers
109 views

sslstrip not stripping any redirected traffic

I am using the following configuration to set up sslstrip sudo echo "1" > /proc/sys/net/ipv4/ip_forward sudo iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 666 ...
4
votes
2answers
107 views

Risks to company while performing the penetration test

I would like to know what the risks a penetration testing company faces while performing tests for clients. For example: A penetration testing company named "A" providing services for a client called ...
1
vote
1answer
262 views

Metasploit SSH Error: could not settle on kex algorithm

I am running a trial of Cobalt Strike which runs over the Metasploit Framework. I am trying to perform an SSH related attack on my laptop, and I get the error in the title for all SSH related attacks. ...
0
votes
0answers
161 views

Sysinternals tool suite not working on low priv shell

Currently oscp student. I asked this on the oscp forum yesterday, but no responses so far. I am new to infosec, but have 18 years of education / work experience in IT. As far as I can tell, ...
1
vote
1answer
66 views

Penetration testing approach - Is there a better method? [closed]

Currently looking at getting some of our web sites pen tested but there are some many companies offering the same, and who are probably using the same tools (not to mention the same wordpress layouts) ...
1
vote
0answers
193 views

Error when adding new credentials to OpenVAS [closed]

Google isn't providing me with any helpful answers. I'm running Kali Linux 64bit, with OpenVas running. I am able to run scans fine, and read results in Greenbone. However when I try to create a LSC ...
0
votes
0answers
51 views

Is there any Windows/Linux host officially available on the Internet for practicing penetration testing? [duplicate]

Is there any Windows/Linux host officially available on the Internet for practicing penetration testing? I am having continuous trouble with Virtual-Box. It is horribly slow to load and giving me ...
1
vote
1answer
105 views

Is there a backdoor in the hardware of our smartphones?

I don't know for you but I always felt like Android especially is not safe. Is somebody - the government or other - able to listen to my microphone, or access my hard drive remotely ? I'm wondering ...
-2
votes
1answer
101 views

Crypto for penetration test [closed]

I'm a newbie but I want to become a penetration tester. I'm taking a course on cryptography but I'm wondering... how useful is crypto for penetration testing compared to other skills like operating ...
3
votes
1answer
147 views

How to communicate a positive feeling about ethical hacking to non technical people? [closed]

Summary: For most non technical people, who hear about computer security either in the news because of some giant breach or in the movies, there are two kind of hackers: The professional people ...
1
vote
1answer
96 views

Concerns discussing 'illegal' activities in a job interview [closed]

Before I begin, I say 'illegal' because I guess the law is somewhat sketchy around the topic and that topic is XSS research. Apparently people have been taken to court over it and UK law does have a ...
-1
votes
1answer
71 views

Does MITM attack work across Remote Systems?

I have question about if MITM works across remote systems? Often, I'm doing internal penetration test, but I'm not sure about how to do MITM attack when I am outside from that network. Does classic ...
0
votes
1answer
112 views

What is safebrowsing.google.com ?Does it impact the security testing?

I recently security tested my web application using Firefox browser and while pentesting my webapplication i noticed safebrowsing.google.com,while i diged more about it ,i could able to retreive only ...
1
vote
1answer
124 views

how to get cookies from aspx site to use it with hydra

I've been playing around with Hydra and .aspx site and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. ...
0
votes
1answer
64 views

Can I use Metasploit to demo penetration testong on Zigbee or Smart meter? [closed]

Does Metasploit have functionality to demo penetration testing on Smart Meter or Zigbee?
2
votes
1answer
68 views

Different TTL for a single server

One of our client perform a qualys pentest, and find LB based on TTL value. We have only 1 server behind FW with NAT IP. Running ubuntu that has default TTL '64' qualys output Number of web ...
2
votes
1answer
57 views

Vulnerability test for CVE-2014-2483?

I am in penetration testing on a server with Linux RHEL6/7 os. Vulnerability databases such as http://www.cvedetails.com/ mentioned the vulnerability CVE-2014-2483 for Java in Linux RHEL systems. I ...
0
votes
1answer
275 views

Burp Suite is not intercepting JSON responses [closed]

I am trying this video and this video to learn pen-testing using JSON injection. Burp Suite is able to intercept the request from the page, but not getting the JSON response. How to solve that?
1
vote
1answer
48 views

PTES: Diferences between Internet Footprint, OSINT and footprinting

I'm trying to understand what are the differences between an Internet Footprint, OSINT and footprinting. I'm reading the pentest-standard and it seems the same.
-1
votes
1answer
136 views

How to test if my server is secure? [closed]

I'm using a debian7 VPS for hosting my websites. I have only installed webmin, apache, mysql, SSH and a wordpress website. I always update my packages and wordpress version. What is the best (free) ...
0
votes
1answer
79 views

In Login page of web application, I have allowed drag and drop of any text. Is it vulnerable to XSS attack? [closed]

Will I need to add any attribute to restrict drag and drop of any file?