An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

2
votes
1answer
949 views

Example of attack trees in the web application security analysis

Here I am again asking for some informations about attack trees usage in web application analysis. For my master thesis I decided to study the usage of this formalism in order to reppresent attacks ...
2
votes
3answers
218 views

How to test for presense of antivirus?

I want to test that when user uploads file, then it goes through up-to-date and properly configured antivirus. I think that to test for it I need some malware that is likely to be detected (it doesn't ...
5
votes
3answers
2k views

Published data sets for IDS/IPS evaluation

I am looking for data sets published by researchers or freelancers which can be used for the purpose of IDS/IPS testing and evaluations. The data sets may be for portscans, DoS attacks, Remote to ...
4
votes
1answer
697 views

How to determine which security testing method to use if resources are limited

My resources are limited, and thus i am wondering what methodology can I apply to know where black box testing is best fit, where white box testing is best fit? Or even where pen testing is better ...
1
vote
3answers
3k views

Is scanning a site directory considered illegal penetration testing?

Does anyone know if using Dirbuster [link] to scan for unlisted directories and their contents is (possibly) legal in say the US?
8
votes
1answer
2k views

How to Perform Vulnerability Assessment for WCF services

Does anyone know how to perform penetration testing/vulnerability assessment for Microsoft WCF services I couldn't find a tools till now , any tools available and guides are welcome
4
votes
5answers
6k views

How can I execute a XSS with these conditions?

I am trying to learn penetration testing and I have downloaded a vulnerable application called "Bodgeit Store". I have finished almost all the challenges except one which is to execute a Cross-Site ...
6
votes
3answers
9k views

OSCP certification for junior pen tester position any good?

Currently finishing my degree in computer security and have a few years experience in IT support and want to get into a junior pen testing job or similar. Would the OSCP certification do me any ...
0
votes
2answers
757 views

is it possible to test out remote host by using nmap?

I was trying to test out my friend's computer (with agreement) by using nmap remotely. But the result I got seems kinda awkward to me. It only showed 1900 as tcpwrapper and all other ports were no ...
6
votes
3answers
3k views

Disadvantages of metasploit Framework for windows

Are there any explicit disadvantages in comparison to running it on a UNIX machine these days?
-2
votes
3answers
158 views

Is cracking really important systems possible?

We always hear about "hacking" (or cracking) banks, websites or the like. Nothing really "important" like centrals, or even satellites (like TV channels). Those we only see in movies - but are they ...
1
vote
2answers
981 views

Certified Ethical Hacking courses [closed]

I want to take a CEH exam, I'd like to know what tutorials and books are recomended for this kind of study. I also would like to know if there are certifications that are better-recognized, so that I ...
4
votes
2answers
11k views

Could Nmap scan switches/routers

Nmap can scan and sometimes successfully detect the running OS in the remote host. However, can nmap scan routers and switches? Most of them use an embedded system.
1
vote
1answer
454 views

Metasploit Closing Connections?

Whenever I attempt to use an exploit (that I know will work) from Metasploit in Windows on a machine on my LAN, I always get the error Exploit exception: An established connection was aborted by ...
2
votes
1answer
6k views

In Metasploit, how to use a custom exe as payload?

Question was once on a mailing list but wasn't answered. I want to use a custom exe as a payload in metasploit. For example when I use exploit/multi/browser/java_atomicreferencearray and want to ...
3
votes
2answers
608 views

1 PIX firewall, 2 routers, 2 switches. Please answer a couple questions about hack lab

I bought a bunch of cisco equipment for a project and I got 1 PIX firewall 2 switches and 2 routers This is my plan for a topology but I am new at this so I need help. I am basing this off the ...
5
votes
1answer
194 views

Notifying Website w/Security Hole

As a hobby, I find security holes ranging from XSS to SQLi to LFI etc in random websites I find. (I don't exploit them). I've decided to to do a little more; I want to create a volunteer group ...
0
votes
1answer
1k views

Which CTF Penetration Test? [duplicate]

Possible Duplicate: What “hacking” competitions/challenges exist? I want to test my penetration test skills.And i solved a few CTF.But it is not enough.I want to solve more ctf ...
6
votes
2answers
218 views

Security Researchers: How do you choose what services or software you are going to audit next?

Security Researchers: How do you choose what services or software you are going to audit next? I am referring to finding vulnerabilities and developing exploits in various applications. I am ...
3
votes
5answers
471 views

Laws on Programming Security Tools

I am currently working on some POST GATHER modules for the Metasploit Framework the idea is that after a shell is spawned on the target, it will gather certain files from the target such as chat logs. ...
12
votes
4answers
5k views

Legitimately using tools like Havij

I'm a developer, not a security guru. My primary focus is ensuring that I'm not introducing security holes through bad programming. I understand how to code to protect against the OWASP Top 10, as ...
6
votes
2answers
685 views

What security measures to have before openly allowing security researchers to hack your site

As some kind of a follow-up from my previous question - which was asked from the security researcher/penetration tester point of view: (Thanks to Rory McCune for pointing this out) There seem to be a ...
5
votes
2answers
325 views

What security concerns should one bear in mind when hacking open-invitation websites?

There's a couple other questions already addressing legalities, ethics, and liabilities of hacking websites with open invitations. What are legal/ethical concerns to bear in mind, when hacking ...
1
vote
3answers
11k views

PING BLOCKING: How to do? How to break?

I can access each page of a site through the browser (firefox). I can also see the ip and port address in firebug, but when I open cmd->ping site ->it says "request timeout". I also tried traceroute. ...
15
votes
2answers
2k views

What are legal/ethical concerns to bear in mind, when hacking websites with open invitations?

I was reading another question which mentions a site that had a page inviting people to try to hack it, and it made me wonder. Lets assume, for the sake of this rather hypothetical question, that a ...
57
votes
4answers
7k views

I think I accidentally DoS'd a website. What should I do?

I was browsing a website, and stumbled across a sample scheme for password-protecting web pages. The owner of the website specifically had a page that invited people to attempt to hack it. I wanted ...
23
votes
1answer
9k views

Mac OS X from an IT Security Practitioners' Perspective? [closed]

What does the Mac OS X offer that it has been recently attracting users with IT security focus? There are sites that specifically focus on "hacking" with OSX, such as machacking.net. Defcon has an ...
5
votes
1answer
6k views

VirtualBox Pen Test Lab Setup

So i'm trying to set up a pen test lab in virtual box on my windows 7 host. I have 3 guest OS's installed: 1.) BackTrack5 2.) Centos 5 Server/Snort (My Snortbox) 3.) Win XP (Unpatched) I have 3 ...
1
vote
2answers
5k views

What is the best tool to anonymize your scans (network/ports)? [closed]

What are the best tools to anonymize my port scanners and vulnerability assessment tools (like nmap , metasploit ) ...? I have been using Backtrack and tor network with proxychains to do this, but ...
6
votes
2answers
407 views

What fraction of vulnerabilities does black-box pentesting find?

Black-box penetration testing is one to check a web application for vulnerabilities. It can find some vulnerabilities, but not all. What fraction of vulnerabilities does black-box pentesting find, ...
4
votes
1answer
765 views

How to perform security exploits/penetration on devices like iPhone's, PSP's, and Android to run your owncode?

I was really interested in getting into performing exploits to install my own code on devices, instead of waiting for others. I figure its a great way for me to learn about security on devices like ...
14
votes
5answers
8k views

pros and cons of a bootable BackTrack instance vs installed

I've been wanting to mess around some with BackTrack to get a better understanding of some of the tools out there for penetration testing. I have a Linux box that isn't doing much right now that I was ...
7
votes
3answers
2k views

BlackBerry handheld penetration testing

Are there any relevant resources, tools or documents about penetration testing of BlackBerry handhelds?
3
votes
2answers
1k views

Backtrack Footprints

I have been hired to to penetration assessment (scanning,testing and so on) ( I am new to the industry and learned through Offsec pentration training.) While training, I have been doing most of my ...
3
votes
1answer
151 views

How and where to begin on the Return of Web Application Security Investment?

While there is a vast trove of vulnerabilties, threats and their corresponding countermeasures, the amount of information on Infosec Economics (Specifically for web applications) seems scarce. What ...
5
votes
1answer
305 views

How do attackers gather remote feedback for identifying and exploiting buffer overflows?

Local buffer overflows are relatively easy to understand: throw some input at an interface and see if the process fails with a core dump or similar. However, in my mind, this kind of exploit works ...
2
votes
1answer
2k views

Expected cost and time frame for black box pen testing?

I work for a major publicly traded company and we need some external black box pen testing done on a Win32 executable. This exe is used in a large client server infrastructure and is a central piece ...
3
votes
1answer
831 views

Can fuzzing be considered a software testing technique for any vulnerability type

I'm doing a research on fuzzing and I would like to know the answer to the question in the title. The cvedetails uses the following categories for vulnerabilities: Bypass a restriction or similar ...
5
votes
2answers
4k views

Tiger team versus red team?

What's the difference between a tiger team and a red team? Are there any other "color" teams out there (relevant to IT security)?
5
votes
1answer
683 views

question for pentesters: PHP proc_open() in safe_mode

Can anybody explain to me how proc_open() is affected when PHP is running in safe_mode? As far as i have noticed, the command to execute is appended to a '/' - is there anything else and is it ...
3
votes
3answers
145 views

What is a simplest “Crash an application” demonstration to get access to a system?

For a presentation (10-15 mins) purpose what is the simplest demonstration of "crashing an application" on a machine can be done.
9
votes
2answers
9k views

Benefits to Arch Linux over Kali Linux

What are the relative benefits of BlackArch or other Arch-based distro over Kali? Are the tools broadly the same, or does one have better functionality in a particular area? Are there any other ...
12
votes
2answers
361 views

Should a pentest report include the tester's opinion?

In this particular case, the webserver turned out to be a shared 3rd party system and was not tested. Examples: We do express grave concern at the overall security posture of that webserver and ...
1
vote
2answers
4k views

Intercept Connections Instead of Forwarding (using arpspoof)

I am doing ARP Spoof experimentation with arpspoof and have successfully set up a man in the middle between two machines. We set up IP Forwarding using: echo 1 > /proc/sys/net/ipv4/ip_forward ...
3
votes
3answers
762 views

Android Pen Testing

I have been pen testing a random android app that uses POST method to send data to a remote server using HTTPS. I have set up a proxy and am able to intercept the traffic, however the POST method ...
2
votes
1answer
755 views

Token Based Authentication & Pass-the-hash Attacks

Do token-based authentication solutions (such as RSA SecurID) mitigate tools like incognito and/or pass-the-hash tools?
6
votes
2answers
794 views

What is the most appropriate way to notify/request permission from an ISP related to white-hat security testing?

In some of the posts I've read on this site such as Is hacking legal when a friend allows you to attempt to hack their system?, and Best way to test my home network from the outside, users who ...
10
votes
3answers
9k views

Best way to test my home network from the outside

I want to check that my router is working like it should. For example that certain ports which should be open on the LAN side and closed on the WAN side really work that way. So I would like to run a ...
3
votes
1answer
304 views

Is there a way to use multiple firewalls / antivirus for penetration testing?

I don't really know how to do either, but I was wondering if it was possible to have multiple firewalls / virus scanners installed at once, and use a 3rd party program to specify which one is running ...
6
votes
2answers
5k views

Scanning my network with NMAP

Each computer is assigned one ip address on my network, and my ISP supplies one IP for my network. If I try to scan the ip supplied by my ISP what I got is the OS running on the router, running on the ...