An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

2
votes
1answer
1k views

Reverse shell attack and proxy interceptions.. . is there anything worng?

First I've got a few questions about Reverse shell. REVERSE SHELL I'm trying to understand the Reverse shell technique. My reasoning is as follows (I'd be glad if you could point out any mistake ...
2
votes
5answers
1k views

OS fingerprinting: can I rely on the results?

Using nmap -O www.example.com I get: Running (JUST GUESSING): Microsoft Windows 7|2008 (90%) So I can say the target site is running Windows. Using xprobe2 -v www.example.com, I'm just astonished ...
3
votes
2answers
691 views

How was pentest performed in the era with no frameworks like Metasploit?

I have been interested in security lately, I have been reading mainly cookbooks on Metasploit framework, how social engineering has been employed exhaustively, I have started reading some IA-32 ...
0
votes
1answer
1k views

How I add cookie to w3af for authenticated attacks?

Can anyone explain this in steps to me? Lets just say I clicked to OWASP Top 10 scan profile and entered url. Next I need to add cookies or authentication values to w3af (form based auth.). How? ...
2
votes
2answers
711 views

Test Android Secure Encrypted Traffic

For testing android traffic encryption I have configured a VPN client in my phone. What simple test I can perform in my home wifi network to verify that the traffic is really encrypted and secure?
4
votes
1answer
719 views

Trying to figure out Gmail login in Wireshark

In my pentesting lab I'm using ettercap for do a mitm to a XP VM. I go to gmail, accepting the false certification, and here I start to sniff with wireshark. I put some false account like ...
3
votes
1answer
3k views

How Chrome avoids sslstrip?

I'm trying out Moxie's sslstrip tool in my pentester lab. It works in all my VM's but no in all browsers. Firefox and IE are vulnerable but Chrome seems to has a protection against. Anyone know how ...
6
votes
3answers
1k views

Why is tunneling so important in pen testing?

I am curious why tunneling is so important in pen testing. If one has control of one machine in a network, then using that machine, one can run nmap and web apps and try to find out vulnerabilities.. ...
2
votes
1answer
1k views

What are the best Nmap Scripting Engine (NSE) service discovery scripts? [closed]

Using nmap -sV can be quite verbose can -sU can take a very long time especially with -p 0-65535. To narrow your results and enumerate interesting services the wealth of NSE scripts can be very ...
0
votes
1answer
168 views

How do I prevent my Rails application from attack? [closed]

My website is being nuked by new signups and new posts some of which don't even have user.id associated with. How do I solve this? What code should I add to the user#new page and/or post#new page. ...
2
votes
2answers
352 views

I need explanation on how serious these vulnerabilities are?

I have found two vulnerabilities on my college site and I want to report them but don't know if these are "really" vulnerabilities : RFI inside SWF file. Example: ...
2
votes
1answer
676 views

Android Application penetration testing

Have problem intercepting HTTPS requests of android application.certificates in android are kept under /system/etc/security/cacerts/ which is different from its previos version of os in cacerts.bks ...
0
votes
2answers
394 views

can a backdoor executable be used on an occupied port?

Suppose I am doing a penetration test on a network that has a firewall that blocks all ports except 80, 110, and 443. I want to use a metasploit reverse-TCP backdoor executable written in msfpayload ...
-1
votes
1answer
931 views

where to get the latest trends about penetration testing systems? [closed]

I am an undergraduate student, who want to do a project in penetration testing automation, and i want a conference or some official source to obtain some latest researches from inorder to see what to ...
1
vote
1answer
206 views

Need help with searching a file in mutillidae webserver

My school has setup a webserver with mutillidae installed for us to train our hacking skills. Our goal is to find a text file. After some hacking done, I'm currently able to use remote desktop ...
0
votes
1answer
354 views

Cloud application Vulnerability assessment

Do you think server side assessment of application is important when application is hosted on a cloud like Amazon? Assessment on software used to host the application not the actual application, e.g. ...
6
votes
3answers
3k views

Disadvantages of metasploit Framework for windows

Are there any explicit disadvantages in comparison to running it on a UNIX machine these days?
5
votes
3answers
832 views

Web app penetration testing

I have a static website which needs to be pentested. It has only got one form which updates some data on the server and i have pentested it with some blind PHP and SQL injection. The site is hosted on ...
2
votes
2answers
2k views

Security analysis tools for iOS 6 [closed]

Searched over web, however could not find much info on security analysis tools for iOS6. Can somebody point me to the security analysis (Static Code Analysis & Pen Testing) tools for iOS6?
2
votes
3answers
740 views

Pentesting file Upload feature

The file(resume) upload feature is accepting any sort of files. I have uploaded the PHP shell into it. How do I again access to that uploaded file? I'm bruteforcing the web directory to check for ...
6
votes
2answers
2k views

How to pentest Flash file on webapp with alowscriptaccess=samedomain?

In the course of a pentest I found a Flash movie file (swf) that loads another Flash movie through loadMovie. The HTML is this: <embed width="388" height="350" ...
4
votes
4answers
3k views

Definitive certification list [closed]

What are a list of useful certificates for someone who wants to work on the information security field? I have heard of CISSP but from what I have understood it is way too advanced for someone new to ...
0
votes
1answer
396 views

What type of attacks can be carried on for an web application [closed]

My company has designed an web application and its going to be hosted soon, I would like to know what type of attacks can be carried on the web application to test the security of my web application ...
5
votes
4answers
2k views

Why is penetration testing important

In improving the security of an organization, it seems as though an audit of existing code, procedures, policies, infrastructure, etc. would be absolutely sufficient to reveal any security or policy ...
0
votes
1answer
2k views

Telnet local privilege escalation exploits possible even when telnet is running under a normal user account?

http://www.exploit-db.com/exploits/8055/ says: The telnet protocol allows to pass environment variables inside the telnet traffic and assign them to the other side of the tcp connection. The ...
5
votes
4answers
3k views

MDK3 warns about WPA2 downgrade - how do I find the key in Wireshark?

While stress testing my router using MDK3, I got the message "REALLY BIG WARNING!!! Seems like a client connected to your target AP leaks PLAINTEXT data while authenticating!!" I viewed the tool ...
2
votes
0answers
1k views

Hack scenario when a person has a non-superuser shell [closed]

Suppose that there are following three machines in the network: Machine A: Microsoft Server 2003 Service Pack 2 FileZilla 0.9.29 beta ftp server (TCP 21) Mcafee ePolicy server (81), remote desktop ...
2
votes
1answer
772 views

Using mysql root account to execute root commands

Suppose that I have full root access to mysql databases, but not root user shell (linux). How can I use the full root access to mysql databases to execute root commands?
3
votes
3answers
761 views

Android Pen Testing

I have been pen testing a random android app that uses POST method to send data to a remote server using HTTPS. I have set up a proxy and am able to intercept the traffic, however the POST method ...
0
votes
1answer
2k views

Is OSX or Mac hardware used in the InfoSec world? What resources are available? [duplicate]

Possible Duplicate: Mac OS X from an IT Security Practitioners' Perspective? I'm new to the OSX world (formerly Windows background) and am interested in understanding what is or isn't ...
0
votes
1answer
567 views

How have DNS recursion attacks happened?

There are a few resources describing how to carry out DNS recursion attacks. Is there any good explanation to help me understand how these attacks work and if systems on my network are still ...
2
votes
1answer
4k views

can an attacker find WPA2 passphrase given WPA key data and WPA MIC

Can some one with these two pieces of information get a hold of the psk key, or its a blind attack that can be done using dictionaries or/and word-lists ? If so please add some resource like a link ...
6
votes
1answer
2k views

Is there any recommended Java library for penetration testing?

Does anyone have any recommendations for a good Java library which can be used for penetration testing? I once read about a library which I think was called 'Attack lib' but I can't find it anymore. ...
1
vote
0answers
326 views

Is there any more attacking points for this server? [closed]

Here is my situation: I already compromised the webserver. I want to attack the database server which has a IP of 192.168.100.2 which is a network that cannot be reach from outside. Through pivoting, ...
-5
votes
4answers
422 views

Should companies use Crowd Source Audit Platform for Manual Penetration Test?

As a CIO, CISO, CTO or Sys Admin, would you use a crowd sourced platform for penetration tests in order to improve your security issues? LE: So most of you guys downgrade, and said it's wrong to have ...
7
votes
1answer
1k views

Is Request.getHeader(“host”) vulnerable?

If the following is the code snippet, what would be your suggestions? <script type="text/javascript" src="<%=request.getHeader("Host")%>/XXX/xxx.js"></script> Is this a clear ...
9
votes
3answers
631 views

Building list of vulnerabilities that should be verified during pentest

I am currently studying how to do server pentesting and need some advice/protip related to methology/best practices. People often mention that it is a good idea to gather intelligence and enumerate ...
9
votes
3answers
9k views

Ethical Hacking - Penetration Testing Book(s) [closed]

I am an IT student who wishes to seek a career in the field of Ethical Hacking, more specific in Penetration Testing. Due to the nature of my course, none of my classes go deep enough into this ...
5
votes
3answers
1k views

What does WEP access point show during aircrack-ng attack?

I bought an old, used WRT-54G () which strangely enough, was running DD-WRT v24-sp2. Weird what turns up at yard sales. I want to try the "aircrack-ng" WEP cracking procedure on it. The criteria ...
3
votes
2answers
2k views

Tools/methods helping to determine application/protocol serving specific port

I do blackbox testing of the server and figured out that there is a bunch of listening ports. I need to determine what services/protocols those ports are used for. What I've tried so far is to use ...
7
votes
3answers
2k views

BlackBerry handheld penetration testing

Are there any relevant resources, tools or documents about penetration testing of BlackBerry handhelds?
7
votes
3answers
674 views

How useful or beneficial is participating in CTF contests for my security career?

Yes, there are already some great questions and answers about CTF contests on StackExhange Security. But before I go down the rabbit hole of comparing all the CTFs out there, trying to find a team to ...
1
vote
2answers
5k views

What is the best tool to anonymize your scans (network/ports)? [closed]

What are the best tools to anonymize my port scanners and vulnerability assessment tools (like nmap , metasploit ) ...? I have been using Backtrack and tor network with proxychains to do this, but ...
2
votes
1answer
5k views

Are SQL injection scans considered illegal? [closed]

I know that this thread mentions that Essentially, if you are seen to be someone who knows what you are doing, then even typing in a single-quote to a web form has been enough to be arrested ...
4
votes
1answer
309 views

tcp seq number prediction

While testing a system, nmap told me that the tcp seq number prediction is really low, (trivial joke). There is only one system in the whole range that gives me that answer. Some papers, e.g. a ...
1
vote
2answers
976 views

Certified Ethical Hacking courses [closed]

I want to take a CEH exam, I'd like to know what tutorials and books are recomended for this kind of study. I also would like to know if there are certifications that are better-recognized, so that I ...
3
votes
1answer
304 views

Is there a way to use multiple firewalls / antivirus for penetration testing?

I don't really know how to do either, but I was wondering if it was possible to have multiple firewalls / virus scanners installed at once, and use a 3rd party program to specify which one is running ...
2
votes
1answer
1k views

Web application penetration testing resources? [duplicate]

Possible Duplicate: Best resources to learn web security attacks? I'm very interested in web application penetration testing. I went over every good Youtube video on that subject and most ...
6
votes
3answers
9k views

OSCP certification for junior pen tester position any good?

Currently finishing my degree in computer security and have a few years experience in IT support and want to get into a junior pen testing job or similar. Would the OSCP certification do me any ...
2
votes
3answers
2k views

How to intercept an application that bypasses local proxy

I am behind a corporate proxy and the application that i have to test will work only if it is given an exception for using proxy server(i.e it is added to the exceptions list of the sites that do not ...