An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

-1
votes
0answers
5 views

Router hangs when running Nessus [on hold]

I'm Zumri from Sri Lanka. And I am new to InfoSec. I have a main problem in doing external VAs. Following is my problem. I tried to run a Nessus scan for my own website through my home router (ZTE ...
0
votes
3answers
37 views

creating a testing environment

This question has been asked over and over again across the web, but many answers are either ridiculous or the same. I have tried using OWASPs VM which has a range of purposely built holes in web ...
-3
votes
0answers
24 views

How to perform penetration testing on android app? [duplicate]

I have an Apk file. I need to perform penetration testing on that app. Which are the tools required and how to perform? Please help me out here. It's very critical to me. I have already performed pen ...
0
votes
1answer
61 views

What does the below SQL injection indicate?

What is the meaning of this command in SQL ? php?que_id =-1/**/UNION/**/ ALL/**/SELECT What does /**/? indicate here?
36
votes
4answers
4k views

What person should I write a penetration test report as?

When you're writing a report, what person do you write it as? First person singular: I discovered a vulnerability in HP Power Manager... First person plural: We discovered a vulnerability in HP ...
0
votes
1answer
32 views

No handshake recorded from airodump-ng

I've just started to attempt this by following the guide from lewiscomputerhowto. I've seen other people ask similar questions, but they all seem to be older threads. The steps I've taken are shown ...
-1
votes
1answer
35 views

Eavesdropping and sniffing attacks [closed]

Assume we have two routers connected by a link. Speaking of eavesdropping and sniffing attacks, does it technically appear at link itself or at the routers? If at the routers, does it imply that these ...
1
vote
1answer
29 views

SSH “on keyboard interactive devices” brute force vulnerability

I was researching the OpenSSH brute force vulnerability "onkeyborad-interactive devices", however I am not sure how this command really works ssh -lusername -oKbdInteractiveDevices=`perl -e 'print ...
4
votes
7answers
141 views

Any non alert() based non malicious XSS payloads?

I have been trying to find non malicious, non alert based, single command reflective XSS payloads, and have so far seen none. Anybody know of any good ones for pentesting purposes? What I mean by ...
0
votes
1answer
31 views

How to get an internal network address range during a footprinting stage?

As new to pen testing, I am a bit stuck at finding out a local network address range from external network to perform a pen testing. I will give you a fake scenario with fake IP addresses as below. ...
5
votes
2answers
72 views

Path Disclosure without ability to read files

So I am a pentester, and I have discovered "feature" on a server that allows me to, essentially, blindly traverse a web server's files (without executing or reading them). The problem is that I ...
0
votes
2answers
97 views

Penetration Testing Criteria [closed]

I'm a beginner-level penetration tester, I've noticed that after the pentesting, you just report the vulnerabilities you've found and the possible exploit points that you've discovered. Using the ...
1
vote
2answers
71 views

Understanding the behaviour of existing eavesdropping techniques

I am studying the behaviour of existing eavesdropping techniques (part of my research). I have a question through the following scenario: Suppose Bob lives in New York and wants to listen (i.e. ...
0
votes
0answers
3 views

How does Empire Powershell interact with PowerShell? [migrated]

The creators of Empire PowerShell state the following: "Empire implements the ability to run PowerShell agents without needing powershell.exe" https://github.com/PowerShellEmpire/Empire How ...
7
votes
1answer
2k views

Burpsuite accidental defacement, should I be concerned?

I was spidering a website with Burpsuite and the automated Form Submission caused me to unknowingly deface the main page with "555-555-0199@example.com". It took me a decent amount of time to notice ...
1
vote
1answer
59 views

PCI Penetration Testing - Does the whole infrastructure need to be retested on significant change?

The PCI SCC states the following in their penetration testing guidance: Per PCI DSS Requirements 11.3.1 and 11.3.2, penetration testing must be performed at least annually and after any ...
4
votes
1answer
89 views

Pentesting Web Server for Remote File Inclusion

For educational purposes, I am in the process of pentesting a web server of mine(running on Windows) where there is a Remote File Inclusion vulnerability. I can already get simple things like command ...
1
vote
0answers
8 views

How to create a burp shortcut on your windows desktop [migrated]

I have been trying to figure out how to get a windows shortcut for burp. If anyone else can figure out a different way instead of java -jar -Xmx768m "C:\tools\burpsuite_free_v1.6.32.jar"
0
votes
1answer
60 views

What is the difference between Wireshark and Ettercap for man in the middle attacks!

I know of the two programs, one is Wireshark (a packet sniffing program) and the other is Ettercap (a man in the middle attack program). I tried doing a MITM attack before, legally on my own home ...
-1
votes
1answer
43 views

what are some of the common routers people use for penetration testing? [closed]

So, I was looking for a router to penetration test on because the one I have is very difficult. What are some of the well-known routers that are supposed to work for beginners to penetration test on?
1
vote
1answer
50 views

Removing remnants of a Metasploit exploit

Is it possible to remove a Metasploit payload/meterpreter from a compromised system? My question is mainly based on antiforensics (Leaving aside Memory forensics which is probably unavoidable but more ...
1
vote
1answer
48 views

What is an IEX download cradle?

Does anybody know what an IEX download cradle is? Is it something that belongs only to the cyber security/pentesting realm? I am asking based on this post: ...
2
votes
1answer
52 views

Is it there any way to detect payloads generated by veil framework

While pentesting, I used to generate a malicious payloads using the veil framework. The generated payload bypasses antivirus & infects the target system. Is there any way to detect veil payloads ...
3
votes
2answers
34 views

Presence of table “sqlmapoutput” in PostgreSQL database

I was pentesting a client's database and saw this one table "sqlmapoutput" in one of the user created schemas. It's a PostgreSQL DBMS. and he has no idea how it came there. There was no data in the ...
4
votes
1answer
87 views

Run NetCat as bat file instead of exe

I need to run a netcat on a remote lab machine. I can execute remote commands through the browser with Administrator rights (because of the application vulnerability) but I don't have access to the ...
2
votes
1answer
51 views

What is the benefit of an SSH tunnel vs a Netcat shell for remote communication?

On the (few) penetration tests that I've done so far, I've typically created a reverse shell with Netcat to run commands on the target machine. Now, it looks like a lot of people like to use an SSH ...
1
vote
0answers
73 views

is it possible Windows privilege escalation using freesshd keys? [closed]

I have unprivileged shell one system.By browsing all folder i found freeSSHD folder Directory of C:\Program Files\freeSSHd 09/26/2008 02:07 PM <DIR> . 09/26/2008 02:07 PM ...
1
vote
2answers
98 views

Virus-total offline Alternatives [duplicate]

These days I am working on FUDing my own written backdoor, RATs, etc. what is the alternative offline version of virus-total, if I don't want AV companies gaining my virus signature?
5
votes
0answers
189 views

Ethical Hacking Certification (CEH v9) From A Web Developer's Perspective [closed]

I just finished a week of training for the CEH v9 certification. I have two questions: What are some strategies I can take for studying for the CEH v9 certification coming at the test as a web ...
4
votes
1answer
53 views

How should I start security testing of python standalone application?

I'm looking for an answer specific to Windows/Linux standalone applications, for instance Dropbox has Windows Application written purely (I think so) in python, What steps should I follow? What are ...
4
votes
1answer
116 views

Legal insurance for penetration testers

I am currently finishing university and I am looking for work as a penetration tester. How important is it to have legal insurance for me in Germany and do I need to organise this privately. Of ...
1
vote
3answers
117 views

Penetration Test Over Internet [closed]

Is it bad practice and unprofessional to complete penetration tests from distant cities, without meeting your clients in person?
5
votes
4answers
232 views

Password guessing: Is it more effective to try many passwords against a few accounts or a few (very common) passwords against many accounts?

I was watching a security vid on Irongeek the other day (I immediately lost track of which specific vid, unfortunately) where the creator gave some interesting advice about doing live password ...
1
vote
0answers
52 views

Exploit Development Road-map [closed]

this days i am trying some exploit development practices, i already learned assembly, c, python, immunity debugger, corelan articles, pentester academy exploit development, now i can bypass DEP, ASLR, ...
-3
votes
1answer
43 views

What are some good resources to learn Remote Code execution [closed]

I want to learn remote code execution from scratch. Is there any sort of book where I can learn from, or there is a preunderstanding required to learn remote code execution? I am desperate to learn ...
2
votes
1answer
82 views

SSH ciphers, MAC and key-exchange (and pen-tests thereof)

At work we've been trying to move our external-facing services away from a policy of inclusivity (where we tried to accept as many people as possible) to a more security-focused setup. The first step ...
0
votes
0answers
22 views

Different chanels for BeEF UI and Communication Server

I am working with BeEF tool and I want to access the UI interface using https (I don't want to communicate via VPN to access the control panel), while at the same time, I need to serve the http hooks ...
3
votes
2answers
112 views

Javascript injection in email address as username?

Is it possible for a valid email address (something that would work if used send to gmail, for varying definitions of valid (the email would be received not the exploit)) to contain javascript that ...
28
votes
5answers
5k views

How do attackers find the IP addresses of recently deployed servers?

About two months ago, I deployed an Ubuntu server with as main purpose serving a web app. However, I'm still developing the app and only gave the server IP to my coworker and some friends for testing. ...
-1
votes
1answer
107 views

hard time in bug bounty hunting [closed]

I have practiced oswap documentation and their vulnerability lab. I also read some books like the web app penetration hackers handbook. But I have no success in bug bounty hunting. I have read an ...
22
votes
3answers
3k views

Metasploit Meterpreter alternatives

These days I am testing various type of client hacking techniques, but in all scenarios I am using Meterpreter variations as payload. Now I can bypass Anti-Virus and Firewalls easily, but Symantec ...
4
votes
1answer
77 views

How to carry out a CSRF in a stealthful manner

I am a math grad student dabbling in network security. I was playing around with login cross site request forgery, and the whole point is to log somebody in. (I am a complete novice in HTML and ...
-3
votes
1answer
74 views

There is an actual working SSL MITM nowadays?

It's been a while since SSLstrip is deprecated and I see no more options for SSL mitm because of OSCP/HSTS and browser counter measures.. Is SSL so unbreakable to common sys admins? As the owner of ...
1
vote
1answer
61 views

Access to email without antivirus [duplicate]

I am doing a test where we want to asses whether an email with a benign virus in it, exits a network. I need a means to receive the test emails I am sending from inside the network, without any ...
4
votes
2answers
71 views

Stop Nmap scan and preserve XML output

Every time I run Nmap I use the -oA flag. The XML output is an important output item as I feed it into a number of parsers plus Metasploit with db_import. The --resume option can resume a scan but it ...
0
votes
0answers
70 views

Hydra command for cracking a webpage which uses <span> tag for failed login attempts

I'm trying to for crack a simple webform for testing hydra in Kali. When the webpage encounters a wrong username and password combination it pops up a message using the following html code:: ...
0
votes
0answers
43 views

Using DVWA at Medium Security, how can I OutFile records?

Whilst carrying out SQL Injection attacks against the educational tool DVWA on security level Low, I could carry out a command like the below and both retrieve records and write them to a file. ' ...
0
votes
1answer
38 views

SEToolkit cloned website can be viewed over internet, but does not harvest credentials

I've been working with SEToolkit's website cloner/credential harvester. Everything works fine locally: The clone opens on the victim pc, victim inputs credentials, after submitting the victim is ...
-1
votes
1answer
132 views

ISP has informed us that our server is launching brute force attacks on WordPress sites, how do we end this? [duplicate]

Misc Situation: -Server login is obtained by hacker, hacker places malicious brute force file in /hacked/bruteforce/ -Server password is then changed, hacker can still run script by navigating to ...
-1
votes
1answer
155 views

Netdiscover running on NAT interface not finding IP addresses on host-only network?

I am practicing penetration testing techniques using Kali Linux (most recent distro) and various vulnerable virtual machines (DVWA, Metasplotiable). My attack and targets are all running via ...