An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

1
vote
2answers
78 views

What is Shikata Ga Nai

I came across this payload named "Shikata Ga Nai" (in Japanese it means nothing can be done about it). Some exe file was generated and when it is executed, a reverse shell can be obtained. But this ...
1
vote
2answers
67 views

What phases does a network penetration test consist of?

What are common phases of a network infrastructure penetration test? Staring with discovering IP's and ports? A simple vulnerability assessment, checking version information of banners from different ...
0
votes
1answer
44 views

Is it a good idea to preventive use a robots.txt that disallows all search engines to index query strings in order to slow down reconnaissance?

I know that robots.txt is not a security feature. But, indexed and cached information by search engines might be incredibly helpful in the reconnaissance phase of a penetration test and potentially ...
2
votes
2answers
88 views

Why does an external pentester testing my Azure website ask for IP, Gateway, DNS and VPN credentials?

I have an Azure website and a client who wants to use my site but needs to perform ethical hacking on it in order to decide if it's secure enough for them. They've asked me this to send them this: ...
3
votes
2answers
128 views

Why is Kali Linux often used as a VM guest and not as the host? [closed]

I'm trying to enter the world of pentesting, and I've gone through quite a few tutorials in the past few days, and noticed that there's nearly no information regarding exploiting virtual machines ...
4
votes
1answer
34 views

How to check for cross-domain referrer leakage?

I am learning pen testing on web applications. I found the vulnerability cross-domain referrer leakage very interesting. Can anybody please tell me how to check for this vulnerability on any web ...
1
vote
1answer
105 views

UWP Windows 10 applications: Internals and Pentesting

I have tried looking into this topic. I started with understanding how differently a .exe Desktop app and a .appx Universal Windows app works. And this is my understanding: UWP apps will run in a ...
-1
votes
2answers
120 views

Are Tesla cars hacker-safe?

I was wondering, what would happen if a Tesla car was hacked into? Are future cars designed to be able to be stopped by police via remote access and commands? What if someone actually causes an ...
3
votes
2answers
175 views

Can I trick a mail server into sending me an email?

Can I trick a mail server into sending me an email? I would like to do some email header analysis on the emails that are send by a mail-server in a penetration-test and possibly get to know more ...
5
votes
2answers
102 views

Do the skills of a software developer transfer well into working in computer security or white hat hacking? [closed]

I am conflicted. I want to become a software developer but I am also interested in the networking side of things… Is software development and network security 2 whole different beasts? If they are, ...
0
votes
2answers
84 views

Cracking WI-FI keys offline at distance?

Let's suppose I was able to get a handshake from my target's network ready to crack, but would like to crack the password far away from that network location. Would it be possible, or do I have to be ...
0
votes
0answers
43 views

How does an attacker compromise a soft switch?

Speaking of soft switches (e.g soft switch in data plane of software defined networking). I've been trying to find a good research paper or article that explains how an attacker can compromise a soft ...
-1
votes
1answer
87 views

Penetration Testing Methodologies

I have some issues regarding the concept of black, grey and white hat and my question is: Were and in what penetration testing methodology I can find the black, grey or white hat concept definition?
0
votes
1answer
70 views

What is the purpose of DNS-based Authentication of Named Entities (DANE) and how does it relate to DNSSEC?

What is the purpose of DNS-based Authentication of Named Entities (DANE)? And how does it relate to the Domain Name System Security Extensions (DNSSEC)? Secondly, how can I verify that DANE is ...
1
vote
1answer
34 views

Should pypi subdirectories be accessible from web browser?

I am a security researcher and when I was fingerprinting one web application I found out that all the subdirectories of domain.com/pypi were accessible from the web browser. The main directory pypi ...
5
votes
3answers
91 views

Can I test my own network?

I'm currently trying to enter the field of information security and I was just wondering if there was anything barring me from testing my own network for security vulnerabilities? I only have a couple ...
1
vote
1answer
34 views

Unable to PSEXEC into machine with admin hash

I'm doing a penetration test at the moment, and I am trying to PSEXEC into a machine for which I have the local administrator hash. I am attempting this with metasploit and metasploits psexec module. ...
0
votes
3answers
284 views

How can I prevent myself from barcode payload attacks?

Recently I came across a tool which can inject payloads into a barcode. How can I prevent myself from this kind of attacks? Attack scenario: The attacker prints vulnerable barcode / sends ...
3
votes
3answers
412 views

Is array injection a vulnerability and what is the proper term for it?

When I'm penetration testing I sometimes notice undesirable behaviour of a PHP script when I inject a single or multidimensional array using the HTTP GET parameters. Possible availability risk This ...
0
votes
1answer
27 views

Pentest scenario where ping multiple Hosts is useful?

I would like to know if there's any pentesting scenarios where ping multiple hosts is useful for the pentester. EDIT. Of course any other that know if the host is live...
0
votes
2answers
57 views

Security scan with or without IP whitelisting in the firewall and isn't that introducing a weak point?

In case of an automated security scan is it more desirable to get the scanner IP addresses whitelisted in order to possibly find vulnerabilities behind the firewall, or to scan in front of/against the ...
24
votes
2answers
3k views

Is the undesirable conversion of a scientific number a vulnerability?

I noticed in several penetration tests that PHP is converting values like 1e9 to 1000000000 while the max accepted string length of this number is 3 (in the database storage and as maxlength property ...
2
votes
2answers
69 views

How to categorise web vulnerabilities in a report?

What is a good way to categorise the vulnerabilities in IT security reports. Assuming it's about a web-based environments like: Websites, Web applications, Web shops, Any interface using web-...
8
votes
1answer
214 views

How do you pen test a REST API?

We have a server that is running a REST API on port 443. I'd like to make sure it's secure by doing various pen tests on it. I'm used to doing offensive testing on a webpage where I can see code, and ...
3
votes
2answers
414 views

Does PT (Penetration Test) allow rooting a server?

When doing a PT, are we allowed to root servers to escalate privileges? I am planning for post exploitation and it necessary to root server for that. So it is better to stop there or go further.
-7
votes
1answer
37 views

Advice on pentesting web applications? [closed]

A year ago I started to learn some things about hacking websites but in an incorrect/unstructured way. That's why I decided to start over at zero, and that's why I'm here. What's the things that I ...
0
votes
3answers
96 views

Web application penetration testing methodology

I'm following a course where the trainer recommends to identify all the vulnerabilities affecting a web application before trying to exploit them. While I understand the need to identify all the ...
5
votes
3answers
59 views

When testing out security vulnerabilities on sites such as OWASP Projects, should we be in a secured/protected environment?

I was curious if there is any need to secure/protect ourselves when doing projects on sites like OWASP to learn about vulnerabilities or "Wargames/Challenges" such as what's posted in these links How ...
0
votes
0answers
55 views

how to start a reverse meterpreter session with powershell

I'm doing some pentesting training. Since powershell scripts more easily allow to bypass antivirus protection I wanted to start a meterpreter session with a powershell script. Here is how I generated ...
0
votes
0answers
72 views

Microsoft IP Blocked by my fail2ban

Yesterday at 3AM our Fail2ban blocked an IP, not tremendously uncommon, however it appears to relate back to a Microsoft address. This could perhaps be an Azure server being used for the abuse. My ...
43
votes
1answer
5k views

I have the ability to run arbitrary Python code on the 'apache' user. What damage can I do?

So, due to bad programming on the part of one of my former colleagues, one of our internal web apps allows the user to upload and run an arbitrary Python file. This recently came to light via an ...
3
votes
2answers
134 views

Reverse shell hangs web server?

So I am currently playing around with DVWA, and by exploiting the local file inclusion vuln I can manage to upload the nc.exe binary on the target server and execute a reverse shell to my machine. ...
-7
votes
1answer
66 views

bind(merge) exe with jpg [closed]

i have an exe file and a jpg file, i want to bind them into one executable(exe) file, in the way that when user double click on that executable: first image will shown to him then the exe file will ...
0
votes
0answers
74 views

OWASP-ZAP and DVWA Login

I need to do a pentest of the DVWA application. To do that, I chose the OWASP-ZAP tool. I followed all the steps of this tutorial. But when I try to run the "spider" the program doesn't find all the ...
0
votes
0answers
45 views

Attaching orphaned/stageless session meterpreter

I have problems with meterpreter reverse_https. In my engagement, I saw this message in console; "Attaching orphaned/stageless session meterpreter" But after I lose connection, and victim connects ...
1
vote
0answers
41 views

“Rollback process” for different penetration testing in case of something goes wrong? [closed]

In some extent, different kind of vulnerability assessment and penetration testing may impact on target system. I am looking for the solution/rollback process if something goes wrong during test. ...
0
votes
0answers
15 views

meterpreter/reverse_tcp handler other then metasploit's handler [duplicate]

Actually i am getting the error on metasploit handler "Connection reset by peer ssl_accept". On investigation, I came to know that I was running my powershell payload using powershell.exe (32 bit ...
3
votes
1answer
86 views

using netcat as a handler for windows/meterpreter/reverse_tcp payload

How we can use netcat as a handler for windows/meterpreter/reverse_tcp payload. I am getting the connection but unable to run any command.
4
votes
2answers
77 views

Is it OK to do a security testing in parallel with a QA testing?

This may not be a very technical question per se, so please feel free to move it to the respective forum/stack. However, I would really appreciate anybody experienced or experiencing a similar ...
2
votes
2answers
95 views

Pentesting - best bang for your buck? (credentialed versus non-credentialed)

My day to day activities consist primarily of penetration testing (white/grey/black). Throughout my engagements, I try to educate my clients on the differences of testing types. E.g., credentialed ...
0
votes
0answers
46 views

Deciding on payload

I am new to penetration testing and I am trying to understand how to choose a payload and why. For example I set up 2 virtual machines 1 with Kali Linux and a Windows XP SP2. On a previous experience ...
2
votes
2answers
105 views

Explaining information leak to Lead dev

Our lead dev tells me that this information leak from our website is "no vulnerability. Just an ugly error UI." It looks to me that the leaked information could be used to aid an attack. Does it ...
-1
votes
1answer
36 views

What are the most important vulnerabilities must be where professionalism [closed]

As we know that the vulnerabilities are many and varied, but what are the vulnerabilities in most locations and which need to be addressed and the focus on.
1
vote
2answers
162 views

Heartbleed POC: Is this sensitive information?

In order to demonstrate the Heartbleed problem, I executed a publicly available exploit against a vulnerable old NAS web-server that has since been replaced. Below is an excerpt from the subsequent ...
1
vote
0answers
92 views

Dumping Large table using Sqlmap

I am learning/working on sqlmap and I was trying to dump a large table with 11K entries on my localhost. The command I used is: python sqlmap.py -u "http://localhost/searchre.php" --data="search=' ...
0
votes
0answers
47 views

Android client side data encoding/encryption bypass

I am working on Android application security project where Android application sends all data in encryption from client side only. I assume that there must be a file at client side which might be ...
2
votes
2answers
91 views

Use Nessus or focus on manual testing?

Nessus scans for a a lot of vulnerabilities, so should I focus on learning vulnerabilities that are not covered by Nessus, like directory traversal attacks? Should I work on only the vulnerabilities ...
0
votes
0answers
31 views

How can I do a Windows registry check with OpenVAS with out a port scan?

OpenVAS has the function to check Windows registries, but when i try to check a registry it also does a port scan. I used the scan configuration out off the manual. http://docs.greenbone.net/GSM-...
0
votes
1answer
104 views

website - infected by malware and if yes, how can I treat it? [closed]

A friend told me that the website of our association, here , got blocked by the corporate network of the company he is working for, due to malware (see picture below) I've tried a few website like ...
0
votes
1answer
84 views

What is the most valuable file you can get using a directory traversal hole [closed]

I am doing a penetration test and I found a directory traversal hole in the web application which enables me to download any readable file in the server. However, I could only download files that is ...