An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

14
votes
3answers
14k views

Why does Hydra return 16 valid passwords when none are valid?

I've been playing around with Hydra and DVWA and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. I assume ...
21
votes
6answers
11k views

What is the difference between a penetration test and a vulnerability assessment?

What is the difference between a penetration test and a vulnerability assessment? Why would you choose one over the other? What deliverables would you expect to receive and how would you rate the ...
18
votes
6answers
15k views

Penetration Testing Jobs without Experience [closed]

There seems to be a late trend where firms are beginning to hire fresh graduates for security related jobs. This is counter to what I've heard from experienced security professionals (as well as the ...
38
votes
5answers
23k views

Servers for penetration testing

I am learning to use Metasploit as part of one of my college lessons. As you may know there are software builds like NOWASP (Mutillidae) or Damn Vulnerable Linux that allow you to exercise on pentest ...
25
votes
10answers
5k views

Vulnerable OS's?

Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?
93
votes
8answers
107k views

Can webcams be turned on without the indicator light?

I've made a series of penetration tests in my network and one of the things I've tried was to record webcam and microphone. Recording an end-user's microphone seems to be a stealth thing, but what ...
42
votes
5answers
6k views

New XSS cheatsheet? [closed]

There is a great list of XSS vectors avaliable here: http://ha.ckers.org/xss.html, but It hasn't changed much lately (eg. latest FF version mentioned is 2.0). Is there any other list as good as this, ...
22
votes
6answers
21k views

At what point does “hacking” become illegal? (US)

Hypothetical situation: before I hire a web development company I want to test their ability to design secure web apps by viewing their previous client's websites. Issue: this situation raises a big ...
18
votes
1answer
8k views

How can I spoof a phone call and make it appear to come from another phone?

I'm performing a penetration test against a company. Part of my social engineering procedure is to contact the IT department and try to convince them to that I'm an employee in the company and get ...
32
votes
5answers
6k views

How to perform a security audit for a PHP application?

I have a PHP application that I would like to have audited for security. I'm familiar with most of the general security issues, but want to make sure I didn't miss anything. What steps should I take ...
3
votes
9answers
5k views

Pen Testing Practice Box?

Are there any windows based pen testing vms out there similar to Metasploitable based on ubuntu? Just starting to learn hacking and such a box would be very helpful.
12
votes
4answers
4k views

Legitimately using tools like Havij

I'm a developer, not a security guru. My primary focus is ensuring that I'm not introducing security holes through bad programming. I understand how to code to protect against the OWASP Top 10, as ...
22
votes
1answer
8k views

Mac OS X from an IT Security Practitioners' Perspective? [closed]

What does the Mac OS X offer that it has been recently attracting users with IT security focus? There are sites that specifically focus on "hacking" with OSX, such as machacking.net. Defcon has an ...
14
votes
2answers
1k views

What are legal/ethical concerns to bear in mind, when hacking websites with open invitations?

I was reading another question which mentions a site that had a page inviting people to try to hack it, and it made me wonder. Lets assume, for the sake of this rather hypothetical question, that a ...
14
votes
5answers
3k views

Automated tools vs. Manual reviews

What are the advantages of using automated tools, as opposed to manual review? What are the disadvantages? This applies both to external blackbox vulnerability scanning, and to static code analysis. ...
12
votes
6answers
1k views

Securely building a local pentest lab in a VM

I'd like to set up OWASP WebGoat or a similar vulnerable web app in a VM (probably VirtualBox on Linux). For convenience's sake, I'd like to get it running on one of the primary machines I use (say, a ...
18
votes
0answers
606 views

Where can I find a vulnerable operating system to practice pentests on? [duplicate]

I am looking for vulnerable operating systems that are used for practicing pentests. Damn Vulnerable Linux (DVL) is not maintained anymore. Are there any other simillar OS´s to download somewhere that ...
-1
votes
2answers
161 views

XSS InJavaScript

Recently i was figuring out a web application and found that the url is reflected among the source of the page which make it bit obvious for xss but the input from url which is reflected on source is ...
8
votes
3answers
7k views

Ethical Hacking - Penetration Testing Book(s) [closed]

I am an IT student who wishes to seek a career in the field of Ethical Hacking, more specific in Penetration Testing. Due to the nature of my course, none of my classes go deep enough into this ...
11
votes
3answers
4k views

iOS/Android Pen-Test

This question might be vague, that is because I am not sure where to start. There are a lot of books and courses on pentest focusing on networks, systems, and OS such as windows, yet I haven't been ...
9
votes
2answers
3k views

How can I find websites owned by a particular company?

I wanted to know how can I get info on what sites are owned by a certain company. I need it for bug bounty programs. For example, how can I find what sites are owned by PayPal, like what sites have ...
17
votes
3answers
4k views

White-box vs. Black-box

What are the relative advantages and disadvantages of each form of testing? I.e. What is the difference between static code analysis and runtime/dynamic penetration testing? What are the pros and cons ...
53
votes
4answers
6k views

I think I accidentally DoS'd a website. What should I do?

I was browsing a website, and stumbled across a sample scheme for password-protecting web pages. The owner of the website specifically had a page that invited people to attempt to hack it. I wanted ...
5
votes
3answers
7k views

How do you detect load balancing?

Scenario You need to PenTest XYZ.com. You expect, because it is a high traffic site, that multiple servers are being used with a load balancer. Question Aside from pulling the MACs (which are ...
21
votes
2answers
3k views

Is it possible to write shellcode in C++?

Usually I write assembly programs and then dump their contents to get the shellcode. What I was wondering is whether I could write a C++ program instead of assembly, then dump and use that instead of ...
10
votes
4answers
3k views

What features should I look for in a Wifi card used for wifi snooping / penetration testing?

I'm looking to purchase a wifi card to help me learn about wifi network penetration testing and other associated issues but I was wondering if there were any features of a wifi card I should look out ...
11
votes
2answers
2k views

How to test against DDoS in a controlled enviroment?

Can you suggest me methods or tools that can help in simulating a DDoS attack in a controlled enviroment (like my private lab)?
6
votes
2answers
373 views

What fraction of vulnerabilities does black-box pentesting find?

Black-box penetration testing is one to check a web application for vulnerabilities. It can find some vulnerabilities, but not all. What fraction of vulnerabilities does black-box pentesting find, ...
9
votes
2answers
5k views

How to prepare for a career in Pen-Testing

I am currently a sophmore in Penn State's SRA:ICS program (Cyber Security) and IST:Dev program. My goal is that when I graduate I can become a Pen-Tester. I'm looking for advice on how to learn how to ...
9
votes
4answers
2k views

How does System Memory Dump work?

So there are so many pen-testing tools that perform a memory dump on the system. How exactly do they work - what exactly happens ?
8
votes
4answers
6k views

How does this test prove my application is vulnerable to clickjacking attacks?

I want to know more about clickjacking. I have been reading an article about clickjacking, where the HTML code to test for clickjacking vulnerability was provided. I tried the same as described in ...
1
vote
2answers
7k views

Sqlmap testing HTTP headers

I was wondering whether sqlmap is able to test HTTP headers for sql vulnerabilities. I know that if I use --level>=3 then it will automatically check for User-Agent and Referer HTTP headers, but I ...
10
votes
6answers
3k views

Security review: “HTTP header user-agent has been set to (something)”

We got a security review done of our PHP code and they team advised this in their report (amongst other things): /appdir/ Details The HTTP header user-agent has been set to \" . Request GET ...
4
votes
1answer
757 views

Do blackbox penetration tests make sense if a whitebox audit would be possible as well?

Lets assume I am responsible for an application in my company and I decide to hire security experts to perform a security audit. Lets assume further that my company owns the source code of the ...
4
votes
0answers
659 views

Best website to learn computer security basics? [duplicate]

Possible Duplicate: Resources to learn about security Can someone advice on which are the good sites out there to learn the basics of computer security from?
2
votes
0answers
1k views

Hack scenario when a person has a non-superuser shell [closed]

Suppose that there are following three machines in the network: Machine A: Microsoft Server 2003 Service Pack 2 FileZilla 0.9.29 beta ftp server (TCP 21) Mcafee ePolicy server (81), remote desktop ...
0
votes
1answer
254 views

Looking for [intentionally made] vulnerable applications suitable for practicing different penetration techniques (NOT a web apps, user side ones)

I'm looking for different kinds of applications which is intentionnaly (or not) made vulnerable and so are suitable for practicing different penetration techniques, like SQL injections, buffer ...
106
votes
8answers
6k views

Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in production unintentionally during a pentest?

Today I experienced a situation where a person responsible for the security of a company required a pentesting company to withdraw a clause in the contract that says that: "during the pentest there ...
7
votes
6answers
4k views

Decent programmer looking to learn to Hack

I'm a decent programmer, fluent in several languages. Python, Ruby, JavaScript, Haskell, and Scheme are my favorites. I'm currently adding Perl to the mix. I haven't done much "low-level" ...
30
votes
5answers
3k views

Open-source penetration-test automation

What order do typical open-source penetration tests operate? Which tools are run first, second, third -- and how do you control them? Does one simply use Metasploit RC files? A network vulnerability ...
25
votes
8answers
26k views

What defines a programming language as useful for hacking?

I know that scripting languages (Perl, Ruby, Python, javascript, and even Lua!!!) are most suitable for hacking and penetration testing. My question is: What is it that makes those languages ...
21
votes
7answers
4k views

What should a security audit report include?

Background I'm in charge of auditing a medium-scale web application. I have audited web applications several times before, but I've always wrote a short PDF quickly explaining what I encountered and ...
19
votes
7answers
15k views

Comparing online security courses: eLearnSecurity vs. Offensive-Security [closed]

I'm a web programmer, using the Linux environment for 2 years.(I have experience with Web app hacks +Web app security techniques) I want to start studying security in-depth, but I have limited time ...
20
votes
7answers
4k views

What are some good website security scanning solutions?

What are some good web-based website security scanning solutions? I'm not too concerned if they are web-based solutions, or software that can be run locally. Generally, I'm looking for something we ...
6
votes
5answers
2k views

What are good resources to do hands-on practice on network penetration testing?

Can anyone provide a good list of resources to learn network penetration testing? I am specifically looking for those having hands on exercises (kind of virtual labs/ISOs) which are free. I know ...
15
votes
6answers
5k views

Lightweight Live Pen-test OS [closed]

Does anyone know of any lightweight OSs that are great for Pen-testing? I would love to have a very lightweight live OS that I can boot off a USB and try some pen-testing against some of my ...
15
votes
5answers
612 views

What are the most important security checks for new web applications?

I'm wondering what are the top priority security checks you should make befor launching a new webapp? I'm guessing brute force vulnerabilities and cross-site scripting. What are the other things you ...
5
votes
3answers
7k views

Replacement for DVL (Damn Vulnerable Linux)?

I've recently spotted that DVL (Damn Vulnerable Linux) has gone inactive. My first question is what happened to cause them to stop releasing it? Secondly, I have found some references to other ...
19
votes
4answers
5k views

What tools are there to inspect Flash SWF files?

I am performing a penetration test against a website that uses Flash heavily. What tools can I use to examine the SWF file for vulnerabilities? From the Area51 proposal.
11
votes
2answers
451 views

Custom Metasploit payload with UAC bypass

The machine I am attacking has anti-virus installed. I have managed to use Veil Framework in order to create an initial reverse shell payload that is undetected by the AV. However, UAC is enabled on ...