An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

-4
votes
0answers
45 views

XSS filter evasion when “less than” followed by an English character is filtered [on hold]

In a recent penetration test, I encountered an XSS filter that allows <,> to pass without encoding, but blocks <a, for example. The filter allows < <_ <, <ש, but DOESN'T allow ...
-4
votes
0answers
30 views

Wifi penetration testing aireplay-ng does not send packets [on hold]

bt ~ # aireplay-ng -1 0 -a 00:19:7e:4d:79:79 -h 00:11:22:33:44:55 -e 4ae8 rausb018:27:07 Waiting for beacon frame (BSSID: 00:19:7E:4D:79:79) on channel 10 18:27:08 rausb0 is on channel 10, but the AP ...
-1
votes
2answers
82 views

Will hacking (pentesting) a live website from a VM improve or hinder my hacker anonymity?

Would a pentest initiated from a VM mounted on hard drive be more or less anonymous to IDS attack or forensically traceable? Please note: I will be browsing via tor and kproxy and have all that ...
2
votes
0answers
42 views

Help locate “snot” IPS/IDS testing tool? [closed]

It seems this great tool has been lost to internet backlog somewhere. I cannot locate it anywhere. The description of tools provided is http://www.securityfocus.com/tools/category/112 If someone on ...
1
vote
0answers
58 views

Is it possible to exploit an image field in which I can upload any file? [closed]

I'm pentesting this web application developed in ASP.NET. I've found that I can upload any file as profile photo. When I later visit the profile page the site tries to display it like this: <img ...
2
votes
1answer
50 views

Tools for finding stored XSS vulnerabilities, given DB write access?

I'm aware that there are various tools for testing for XSS vulnerabilities. However, all the ones that I'm aware of (Vega, possibly BeEF, etc.) operate purely client-side. When testing for stored XSS ...
0
votes
0answers
29 views

Unsure if I have understood Hydra syntax correctly? [migrated]

So, when I see the Hydra help file, this is what it says: Syntax: hydra [[[-l LOGIN|-L FILE] [-p PASS|-P FILE]] | [-C FILE]] [-e nsr] [-o FILE] [-t TASKS] [-M FILE [-T TASKS]] [-w TIME] [-W TIME] ...
4
votes
2answers
151 views

How do RATs access computers through routers?

I've started trying to increase my networking security at my house. One thing that worries me (because other people in the house are always downloading viruses that come along with "free" games) are ...
3
votes
1answer
78 views

HTTPonly cookies

I was tasked to perform as scan against a lab and Nessus returned an "Apache HTTP Server httpOnly Cookie Information Disclosure" vulnerability. What I would like to know is what these cookies contain ...
1
vote
1answer
44 views

enumeration and MS DCERPC

Enumeration, enumeration, and even more enumeration is the generic pentesting mantra, but enumeration is worthless if you can't read the results. I came across the Windows RPC service, where ...
3
votes
1answer
37 views

PCI DSS 3.0, 11.3 - What happens if a low risk vulnerability prevents compliance with another requirement?

As I understand the PCI DSS 3.0/3.1 penetration testing requirements, a company is compliant with 11.3 if the penetration test does not return any high risk vulnerabilities. However, what happens if ...
1
vote
0answers
57 views

Adding a binary to the firmware of a routing device [closed]

I've been playing around with a router d-link dwr-921 and found some vulnerabilities in the web interface. I still haven't managed to get shell access and now I'm thinking about modifying the firmware ...
10
votes
2answers
332 views

Custom Metasploit payload with UAC bypass

The machine I am attacking has anti-virus installed. I have managed to use Veil Framework in order to create an initial reverse shell payload that is undetected by the AV. However, UAC is enabled on ...
0
votes
1answer
96 views

Rainbow tables/hash tables versus WPA/WPA2

In Wi-Fi penetration testing, is it possible to use rainbow tables/hash tables on WPA/WPA2 networks? Is there an advantage of one over the other? Where would one get said tables or can they be ...
2
votes
1answer
102 views

What is the difference between a hash table and a rainbow table, and how are they both used?

Is there much of a difference between the two tables? Can you get one from the other? (i.e. hash -> rainbow) How do they work? Are there different variables (in reference to speed, strength, ...
1
vote
3answers
66 views

Do I need an ASV to come out when going for an SAQ?

Our company is going for a SAQ, under PCI DSS 3.1. Do we need to pay a vendor to come out and do an on site scan, or can we use something like Nessus to do the scan on our own?
0
votes
1answer
39 views

Haskell in the security industry?

I know of a tool called msf-haskell for security but are there others? Are there any security tools that are written in haskell? other than the one above How much use will haskell be in industry, ...
9
votes
9answers
507 views

Which factors should you take into account when deciding whether users should be informed of a penetration test?

Say you are conducting a penetration test of an internal network. The internal network comprises of workstations, servers and company and contractor laptops. In an ideal world, the penetration test ...
0
votes
2answers
48 views

Precauations for web application security audit

We have planned to give our web application to a third party vendor,what were the precautionary measures which we need to take care before giving our application to third party vendor? As the vendor ...
2
votes
0answers
29 views

What features should I look for when buying a external wireless card used for the purpose of pen testing/snooping [duplicate]

I'm currently planning to buy an external wireless card for the purpose of pen testing and snooping my own network in order to learn more about it and try to create more preventive measure against ...
1
vote
1answer
70 views

Sketchy traffic from port 3030?

I am running tests on a server that is ran by a close family friend, who agreed to allow me to do so in exchange for the experience I will gather (I am currently a computer science student). On ...
0
votes
0answers
86 views

sslstrip not stripping any redirected traffic

I am using the following configuration to set up sslstrip sudo echo "1" > /proc/sys/net/ipv4/ip_forward sudo iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 666 ...
2
votes
0answers
78 views

Risks to company while performing the penetration test

I just want to know what the risks would be to that company who conduct penetration test for other companies/clients. For example a company named "A" providing services for penetration test and that ...
1
vote
1answer
173 views

Metasploit SSH Error: could not settle on kex algorithm

I am running a trial of Cobalt Strike which runs over the Metasploit Framework. I am trying to perform an SSH related attack on my laptop, and I get the error in the title for all SSH related attacks. ...
0
votes
0answers
115 views

Sysinternals tool suite not working on low priv shell

Currently oscp student. I asked this on the oscp forum yesterday, but no responses so far. I am new to infosec, but have 18 years of education / work experience in IT. As far as I can tell, ...
1
vote
1answer
63 views

Penetration testing approach - Is there a better method? [closed]

Currently looking at getting some of our web sites pen tested but there are some many companies offering the same, and who are probably using the same tools (not to mention the same wordpress layouts) ...
1
vote
0answers
110 views

Error when adding new credentials to OpenVAS [closed]

Google isn't providing me with any helpful answers. I'm running Kali Linux 64bit, with OpenVas running. I am able to run scans fine, and read results in Greenbone. However when I try to create a LSC ...
0
votes
0answers
51 views

Is there any Windows/Linux host officially available on the Internet for practicing penetration testing? [duplicate]

Is there any Windows/Linux host officially available on the Internet for practicing penetration testing? I am having continuous trouble with Virtual-Box. It is horribly slow to load and giving me ...
1
vote
1answer
89 views

Is there a backdoor in the hardware of our smartphones?

I don't know for you but I always felt like Android especially is not safe. Is somebody - the government or other - able to listen to my microphone, or access my hard drive remotely ? I'm wondering ...
-2
votes
1answer
83 views

Crypto for penetration test [closed]

I'm a newbie but I want to become a penetration tester. I'm taking a course on cryptography but I'm wondering... how useful is crypto for penetration testing compared to other skills like operating ...
3
votes
1answer
137 views

How to communicate a positive feeling about ethical hacking to non technical people? [closed]

Summary: For most non technical people, who hear about computer security either in the news because of some giant breach or in the movies, there are two kind of hackers: The professional people ...
1
vote
1answer
95 views

Concerns discussing 'illegal' activities in a job interview [closed]

Before I begin, I say 'illegal' because I guess the law is somewhat sketchy around the topic and that topic is XSS research. Apparently people have been taken to court over it and UK law does have a ...
-1
votes
1answer
55 views

Does MITM attack work across Remote Systems?

I have question about if MITM works across remote systems? Often, I'm doing internal penetration test, but I'm not sure about how to do MITM attack when I am outside from that network. Does classic ...
0
votes
1answer
87 views

What is safebrowsing.google.com ?Does it impact the security testing?

I recently security tested my web application using Firefox browser and while pentesting my webapplication i noticed safebrowsing.google.com,while i diged more about it ,i could able to retreive only ...
1
vote
1answer
87 views

how to get cookies from aspx site to use it with hydra

I've been playing around with Hydra and .aspx site and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. ...
0
votes
1answer
57 views

Can I use Metasploit to demo penetration testong on Zigbee or Smart meter? [closed]

Does Metasploit have functionality to demo penetration testing on Smart Meter or Zigbee?
2
votes
1answer
56 views

Different TTL for a single server

One of our client perform a qualys pentest, and find LB based on TTL value. We have only 1 server behind FW with NAT IP. Running ubuntu that has default TTL '64' qualys output Number of web ...
1
vote
1answer
46 views

Vulnerability test for CVE-2014-2483?

I am in penetration testing on a server with Linux RHEL6/7 os. Vulnerability databases such as http://www.cvedetails.com/ mentioned the vulnerability CVE-2014-2483 for Java in Linux RHEL systems. I ...
0
votes
1answer
184 views

Burp Suite is not intercepting JSON responses [closed]

I am trying this video and this video to learn pen-testing using JSON injection. Burp Suite is able to intercept the request from the page, but not getting the JSON response. How to solve that?
1
vote
1answer
42 views

PTES: Diferences between Internet Footprint, OSINT and footprinting

I'm trying to understand what are the differences between an Internet Footprint, OSINT and footprinting. I'm reading the pentest-standard and it seems the same.
-1
votes
1answer
125 views

How to test if my server is secure? [closed]

I'm using a debian7 VPS for hosting my websites. I have only installed webmin, apache, mysql, SSH and a wordpress website. I always update my packages and wordpress version. What is the best (free) ...
0
votes
1answer
74 views

In Login page of web application, I have allowed drag and drop of any text. Is it vulnerable to XSS attack? [closed]

Will I need to add any attribute to restrict drag and drop of any file?
5
votes
1answer
301 views

Feedback for Study Plan (Kali Linux & Penetration Testing) [closed]

I started to study pentesting for two months with the book named Penetration Testing - A Hands on Introduction to Hacking by Georgia Weidmann, and now I am really hungry to learn more :) . I think I ...
2
votes
0answers
266 views

SSL traffic manipulation through ettercap MitM and iptables

I am trying to understand the relation between some tools and concepts used for MitM on a wifi network and how https transaction (over this wifi network) between an android app and the respective ...
2
votes
1answer
143 views

CRT / CHECK vs OSCP certification [closed]

Which is harder? If I see 2 pentesters, one with one and one with the other who would this information alone qualify above the other? I know it doesn't work like this and it is all down to experience ...
1
vote
2answers
180 views

What NIC for a NUC? [closed]

I have been doing external pentests using the Intel NUC (D34010WYK1). It has been a very stable machine running Kali Linux. I am at point now that I would like to do some wireless testing. Has ...
16
votes
3answers
3k views

How to convince my management of a physical security risk?

While I do not claim to be an expert in all things security based, I'd think that I have a good grounded knowledge of what is acceptable and what is not in regards to digital security. After giving ...
2
votes
5answers
436 views

Software Testing vs (Web) Penetration Testing

I would like to ask about the differences between Software Testing and Web Application Penetration Testing. I am aware of usage different tools in both disciplines Software Testing (JIRA/Selenium) ...
6
votes
1answer
163 views

Is it possible to emulate real network printer i.e. to run some actual firmware in VM?

I've got to the section related to network printers exploitation while going through one security course. Under "network printer" I understand standalone devices with a dedicated ethernet\wireless ...
1
vote
2answers
197 views

Setting up a security lab, looking for a little guidance [duplicate]

I'm new here. Over the past couple of years I've had a growing interest in the security aspects of IT/CS. Recently, I've started setting up a lab for myself based on a kali/win7 dualboot and I've ...