An attempt to penetrate a system's security in an effort to evaluate the protections in place.
-4
votes
1answer
109 views
Am I part of a botnet or hack? [closed]
(FYI: my network has been hacked before...see other thread).
I have 2 routers daisy-chained. Router #1 hosts Windows PCs and a VOIP box on subnet 172. Its LAN4 goes to WAN of Router#2, which serves ...
-2
votes
0answers
81 views
History of RAT + Strange networking recently… was I hacked again? [closed]
(FYI, my PCs were infected and remote accessed in the past by a friend/stalker, & I’ve reinstalled the network few times already. Recently added Router#2 to double-NAT).
My network has 2 routers ...
0
votes
1answer
93 views
Please recommend scanner that allows to find XSS and SQL injections vulnerabilities for Web Application [closed]
We develop Web Application:
Platform is Redhat 6.3/6.4
Presentation tier is JSF2
Persistence tier is Hibernate
Server is JBoss 4
Database is PostgreSQL 9.0.13.
We want to run scanner during our ...
4
votes
2answers
67 views
Executing arbitrary commands through iptables-restore input
During a pentest I found a way to add arbitrary iptables firewall rules to a server. These rules get applied by way of the iptables-restore command, and I've been wondering whether there is any way to ...
3
votes
2answers
123 views
Vulnerability testing without the use of exploits?
I was doing some testing on a server to see if it was vulnerable to a 0-day local exploit (the exploit was for gaining root privileges using a bug in the Linux kernel). There was no real information ...
17
votes
2answers
810 views
Is it posible to make shellcode with C++?
Usualy I write assembly programs and thens dump their contents to get the shellcode. What I was wondering instead of assembly can I write a c++ program, then dump that and then use it instead of the ...
4
votes
2answers
119 views
Security test lab setup [closed]
I want to setup a testing lab in my basement for penetration/vulnerability testing & offensive/defensive security skills. I believe I have all the equipment that I need, and if I'll need something ...
18
votes
0answers
568 views
Where can I find a vulnerable operating system to practice pentests on? [duplicate]
I am looking for vulnerable operating systems that are used for practicing pentests. Damn Vulnerable Linux (DVL) is not maintained anymore. Are there any other simillar OS´s to download somewhere that ...
-3
votes
0answers
70 views
Questions about Remote Access Trojans [closed]
I'm trying to learn penetration testing and IT security. And i have som questions about remote access trojans.
If you are trying to control a rat server from another network, you'll have to use the ...
7
votes
1answer
384 views
Penetration testing Windows Phone 8 apps w/o source
I am interested in performing a penetration test of a Windows Phone 8 application for which I do not have the source code. While I can easily validate network communication security, it is more ...
1
vote
2answers
75 views
Relationship between penetration testing and false positive results
I had read through several research papers that discussed the trend of existing automation scanners to produce false positive results. I also read through some articles that showing the manual ...
3
votes
3answers
102 views
Can Penetration Testing be considered as a part of a Vulnerability Management Program?
Can Penetration Testing be considered as a part of an exhaustive Vulnerability Management program?
P.S: I realise the difference between penetration testing and vulnerability assessment. But I want to ...
2
votes
3answers
132 views
Web application security standards/certificates
I'm currently working on Web application/service that (hopefully) will be used in a wide variety of ways. Of course I'm looking to attracting some commercial users as well, and as we all know, they ...
3
votes
1answer
85 views
Best option to fuzz a C Network Program
I have a client/server simple program in C. I want to test the server running on different machine with random inputs. I have looked at 'Bunny-the-fuzzer' but from what I can understand It wont be ...
4
votes
2answers
242 views
SQL Injection - Extracting database data from the page content
I have a question I am hoping someone could help with..
I am in the process of writing an SQL Injection tool from scratch (I am aware there are already excellent tools out there such as SQL Map, but ...
-2
votes
0answers
66 views
SQL injection to a mysql database doesnt work [closed]
I am trying to execute the following query into a post query:
searchType=defaultSearch&name=&country="; //SQL INJECTION HERE ...
-5
votes
0answers
86 views
IT Security professional or software developer.. which is a better career option? [closed]
I am a fresher out of college. I have completed my masters in computer applications. Currently i am working as a java developer in an IT services firm ( a pretty big one).
I am good at development ...
4
votes
1answer
151 views
How to use NMap to portscan a SonicWall that is blocking all attemtps?
It seems that SonicWall is blocking attemtps to scan its ports. I know it has some ports open, like 443, because if I access using the browser I get a web site. But when I try to use NMap I can't see ...
0
votes
0answers
56 views
Web Application Pen Testing career advise needed [closed]
I have 8 years Java development experience and now I am looking to change career into web app pen testing. Its purely because of interest.
Could you all please suggest where to start and how to ...
6
votes
3answers
193 views
TCP Sequence Prediction and it's prominence in modern systems/networks
I have a question regarding your experience of TCP Sequence Prediction that I am hoping someone could help with.
I am aware of how TCP Sequence Prediction works and how the connection can be hijacked ...
-4
votes
2answers
129 views
Is it illegal to test a website and report the security bugs to them? [closed]
I am doing testing on some websites and I have found some serious bugs in those sites.
I am not sure if this is legal or not.
Is it ever legal?
How can I find out if it's legal where I live?
What ...
7
votes
5answers
694 views
I have a client that is worried about DDOS attacks on their site, and they want penetration testing. Will that help?
My client wants to look into hiring a third party to perform penetration tests on the website that we're developing for them. The website is just a simple 3-month contest site where people can upload ...
7
votes
1answer
83 views
Is there a public database of mutex names that are associated with malware?
I remember seeing something like this a while back, and it'd be incredibly useful for a project I'm working on. Essentially there was a list of mutex names, with a list of malware identifiers (e.g. ...
0
votes
2answers
62 views
Relation between boolean blind SQLi and time blind SQLi?
I am part of a team which developing web app penetration testing framework, and I am taking care of SQLi detection. When I tested multiple known vulnerable local sites found Boolean Blind flaw always ...
-1
votes
2answers
193 views
Evaluating candidates for Hacker/Pen Test Positions [closed]
If I need to employ Penetration Testers, what are the procedures to follow and how to examine candidates to know their skills and qualifications.
Also, I need to know what are the ...
1
vote
1answer
132 views
Choosing the right tools [closed]
I'm totally new in the field of penetration testing, like almost no experience, only read lots of books and papers. I encountered lots of interesting tools during studying, many are famous like ...
-2
votes
1answer
107 views
Is there website for FastTrack? [closed]
i have searched about this automated penetration testing tool to get its docs and source code, i searched a lot and all i found is tutorials and this
$ svn co http://svn.thepentest.com/fasttrack/
a ...
4
votes
3answers
193 views
What dangerous characters need to be filtered from user input prior to use in a DB2 SQL query?
I'm looking to fully understand how to properly filter/escape dangerous characters from user input that will be interpolated into a DB2 SQL query.
The sanitization routing that I'm analyzing works ...
1
vote
1answer
234 views
How can I monitor a named pipe?
I have installed an application that opens a named pipe that is accessible over the network. I would like to monitor/sniff what is sent to this named pipe, any idea how I can do that?
Edit: Even ...
5
votes
3answers
293 views
Fresh Graduate Going into Penetration Testing
As a fresh graduate I'm wondering what my chances are of joining a great pen-testing group. Is there a risk that a career in pen-testing may one day not be needed? If so, how applicable will skills ...
2
votes
5answers
1k views
Testing for HTTP TRACE method
How can I test for HTTP TRACE on my web-server?
I need to train a Tester how to verify that the HTTP TRACE method is disabled.
Ideally I need a script to paste into Firebug to initiate a https ...
3
votes
5answers
428 views
Affordable web application attack tools
I've been using Burp Intruder (part of Burp suite), but in the free edition of Burp Suite the Intruder functionality is Time-throttled. As a student pen tester however, I can't justify the cost of ...
1
vote
2answers
191 views
How do I find a target on the wired network, from an attack system on Wi-Fi?
I'm trying to practice penetration testing on my home network. The target system is my desktop computer, which is connected to the network via ethernet cable. The attack system is my laptop, which is ...
4
votes
1answer
246 views
How can XML Injection be exploited , need example?
So I found this explanation for a vulnerability on some cms :
The XML parser at /WorkArea/Blogs/xmlrpc.aspx is vulnerable to XML
external entity attacks which can be used to Scan behind ...
0
votes
1answer
372 views
Penetration testing job entry exam [closed]
What type of hands on tests should I expect in a interview for a entry level penetration tester?
And what do examiners expect a candidate to accomplish (i.e. full compromise)?
The reason I ask is ...
0
votes
1answer
77 views
All I see is RPC, how do I proceed?
I finished a tiered hacking exercise, and after submitting it was told that the last tier (a machine on the network) was not possible to attack in the given exercise.
The machine was only running ...
0
votes
1answer
127 views
How to conduct a disguised LSA attack against OSPF?
I want to do disguised LSA attacks on OSPF network and be able to more analyze, so I do not know how it works in practice. This is a penetration test.
The attack is described in the address [+]. I ...
4
votes
3answers
419 views
SQL Injection How to inject Clean/Rest URLS
I have a question I'm hoping you could help me with?
Unclean url's:
http://example.com/index.php?page=foo
http://example.com/products?category=2&pid=25
...
7
votes
2answers
208 views
Should a penetration tester have training in ISO 27001/ITIL etc?
I recently got offered a promotion but as part of the package I've been requested to do ISO 27001, ITIL, ARPA and other kinds of training. I've previously avoided this sort of training as I felt it ...
0
votes
0answers
94 views
How to use Maltego in a team? [closed]
Does anyone have any experience using Maltego in a team? Not being a server/client architecture I'm wondering how to best utilize this tool when you have a pentest team of four to five people.
...
2
votes
1answer
165 views
Black box testing javascript MVC web applications
I want to test a web application that has been built using the backbone.js framework.
Currently I have used a few tools for crawling and testing without any luck. When crawling the website they can ...
3
votes
4answers
404 views
eCPPT vs. OSCP Certification
I am a soon to be college student. I am looking to become certified in pentesting for both personal interest as well as to be able to have something that would look good to future employers. Both ...
2
votes
1answer
136 views
Blacklisting during a penetration test?
So i had a debate recently where one of my colleagues believed that by launching a penetration test (one requested by our clients) from our one of our IP's we could potentially get that IP/all IP's in ...
3
votes
5answers
121 views
How to introduce delay in scanning tools that do not implement delay without touching source code?
Usually scanning tools implement a switch in order to delay requests and not flood the target. Sometimes there tools that do not implement this delay option.
Is there a way to delay packets from ...
1
vote
1answer
77 views
How can be detected connection throttling in response to portscan detection?
Imagine that I have to pentest a server that implements portscan detection based on the number of packets received to different ports in a time interval.
I don't know that the server is implementing ...
4
votes
3answers
363 views
How do you detect load balancing?
Scenario
You need to PenTest XYZ.com.
You expect, because it is a high traffic site, that multiple servers are being used with a load balancer.
Question
Aside from pulling the MACs (which are ...
0
votes
1answer
112 views
Packet-filtering firewall evasion (Scanning)
Context
I'm very familiar with different applications of scanning tools (. . . and you can use -mtu to specify the size of the fragments in nmap . . .) but every piece of information I read about ...
0
votes
1answer
80 views
A list of very specific infosec topics with very fine detail [closed]
CISSP CBK seems relatively rudimentary and extremely broad.
Does anyone know a good resource that lists (a nice, long list) topics in information security with a very, very fine granularity?
This:
- ...
1
vote
4answers
513 views
My website has been hacked, what do i do next? [closed]
So. I couldn't see any other question like this on Sec.Se so i thought i'd ask.
My public website www.foo.com has been hacked. The front page is sending it to be redirected to seoblog.fooblog.com in ...
3
votes
2answers
144 views
How to red team against firewalled architecture?
Prior Knowledge
I understand the types and differences between firewalls.
I have (what I believe to be) a relatively good mental model of a firewall.
I understand routing, iptables, signature ...
