An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

0
votes
2answers
3k views

Wireless Adapters for Testing with BackTrack

I would like to begin testing and working with BackTrack. I have heard that the Alfa AWUS036H wireless adapter works well with BackTrack and allows for packet injection. This adapter, however, is ...
0
votes
1answer
432 views

Business systems development (.NET, Java) vs IT Security Field, salary/future perspective

What are the career prospects for young professionals, when comparing IT Security field (penetration testing, vulnerability research) to business development on .NET and Java? Which path should one ...
4
votes
2answers
9k views

Where can I download vulnerable Windows OS images to practice penetration testing?

My objective is to learn and practice all the vulnerabilities and their exploitation on vulnerable OS.
8
votes
1answer
1k views

How secure is the apt-get install command against man in the middle attacks

I think the title says everything, how secure is it to use apt-get in a network with an attacker who injects his own packets and blocks the original packets (man in the middle).
3
votes
1answer
487 views

Non English password dictionaries

What is a good resource for wordlists used in auditing passwords in non english languages. I have extensive wordlists in English ranging to several GB's, but can't find similar resources for other ...
11
votes
3answers
4k views

iOS/Android Pen-Test

This question might be vague, that is because I am not sure where to start. There are a lot of books and courses on pentest focusing on networks, systems, and OS such as windows, yet I haven't been ...
0
votes
1answer
730 views

can the value of request.getHeader(“Host”) be faked?

Suppose if there is some code like <a href="<%=request.getHeader("Host")%>/xxx/abc.do>SignIn</a> Can an attacker fake request.getHeader("host") to point 'SignIn' anchor to ...
7
votes
1answer
1k views

Is Request.getHeader(“host”) vulnerable?

If the following is the code snippet, what would be your suggestions? <script type="text/javascript" src="<%=request.getHeader("Host")%>/XXX/xxx.js"></script> Is this a clear ...
1
vote
1answer
326 views

Security testing on network

A group of student have been asked to do a bit of network security testing at college. Basically the college have just invested in some android tablets, more macs and more net books. The IT admins ...
7
votes
3answers
2k views

Where can I find exploit code?

I am doing VA/PT on a sample web application. I run the nessus scanner and I found some high severity problems. It is related to HP System Management Homepage. The CVE numbers are: 2010-1917, ...
9
votes
4answers
409 views

How to test a physical machine?

In two weeks time, I will have to test a couple of computers that a client would like to provide to its employees. The main concern is making sure that the employees won't be able to use those ...
4
votes
3answers
3k views

how an iframe can cause xsrf?

I know how a form tag is prone to CSRF which does not use any token (or any other challenge-response mechanism) but I was wondering how an iFrame can be used to cause XSRF attack and what would be the ...
2
votes
2answers
291 views

Scan Novell NetWare backend with Windows servers and clients

Could anyone provide some insight on performing an internal vulnerability assessment regarding Novell NetWare as the backend with client workstations and servers running various versions of Windows? ...
4
votes
3answers
751 views

would preparing for CCNA add “significantly” to my knowledge as a penetration tester?

I'm a post graduate student and self taught programmer. I concentrated on Computer Networks & Operating Systems more during my undergraduate studies. I can explain usually used protocols by ...
4
votes
1answer
2k views

Penetration Testing Silverlight Applications

What would be the process in pentesting a Silverlight application? What would be the best method to proceed in a manual test? Any specific tools use? For example an application with lot of file ...
2
votes
2answers
577 views

Looking for a tutorial on meterpreter extensions

A simple custom DLL source would be sufficient. All of the links I find on Google are dead. I don't mind reading some clear source if there's a tutorial DLL floating about. I tried for ...
13
votes
6answers
2k views

Securely building a local pentest lab in a VM

I'd like to set up OWASP WebGoat or a similar vulnerable web app in a VM (probably VirtualBox on Linux). For convenience's sake, I'd like to get it running on one of the primary machines I use (say, a ...
8
votes
7answers
4k views

Decent programmer looking to learn to Hack

I'm a decent programmer, fluent in several languages. Python, Ruby, JavaScript, Haskell, and Scheme are my favorites. I'm currently adding Perl to the mix. I haven't done much "low-level" ...
1
vote
3answers
648 views

IT Security and Ethical Hacking [closed]

Hello, programmers, security professionals, hackers and everyone who is interested in information security. I am taking security courses in my university but I found there is only lab so I have to ...
5
votes
1answer
176 views

The Economics and White Hat Nature of NSS ExploitHub

This question is about the economic model employed by NSS with their ExpoitHub exploit marketplace (site link) and whether it jives with the white hat claims of the company. The company has made news ...
4
votes
1answer
824 views

Do blackbox penetration tests make sense if a whitebox audit would be possible as well?

Lets assume I am responsible for an application in my company and I decide to hire security experts to perform a security audit. Lets assume further that my company owns the source code of the ...
7
votes
7answers
4k views

Designing a Capture The Flag target and game management system

I've attended several CTF contests and I'd like to implement a CTF system for my students. I asked Google about designing such system but it's fruitless. Any ideas?
26
votes
5answers
2k views

How to improve as a security expert

I'm a professional software developer with a high interest in web application security. I'd say that I probably have a better understanding of the security of web applications than the average ...
0
votes
1answer
527 views

What are some good resources for learning how to hack my website? [closed]

Note: This is for my personal use. I'm not going to hack someone else's website. I have several websites, and I'd like to learn how to hack them so that I can secure them. Where can I find some good ...
8
votes
5answers
3k views

Penetration testing by ethical Hackers/Crackers should be trusted?

My question today come from my homework question from class ethics in IT. Our question states roughly that I'm IT guy in in big company and I am asked to hire few hackers to to find vulnerabilities ...
3
votes
2answers
385 views

Literature about IT security from a hardware standpoint

Can you point me to any book, blog, paper, anything about IT security on the lowest possible level (hardware)? I'm primary interested in the motherboard, CPU & GPU, however, if you know any good ...
3
votes
1answer
537 views

WPA vulnerabilities for pentest

As I am a network&IT enthusiast, I was asked by a friend to pentest his WPA network. I'm wondering if there is anything else I can do beside a bruteforce attack, trying the KARMA attack on ...
110
votes
9answers
127k views

Can webcams be turned on without the indicator light?

I've made a series of penetration tests in my network and one of the things I've tried was to record webcam and microphone. Recording an end-user's microphone seems to be a stealth thing, but what ...
6
votes
3answers
4k views

How do WPA/WPA2 cracking programs know when the PMK/PTK is correct?

I'm doing some pen-testing on my home wlan with aircrack-ng and it got me wondering how programs like these(eg. aircrack-ng, cowPatty, pyrit etc) really work. Specially, when performing a ...
6
votes
4answers
7k views

Does setting a WiFi AP to channel 14 avoid the most common detection methods used in Europe or the Americas?

The legally allowable band for WiFI in the US covers channels 1-11. Europe goes to 13, Japan to 14. I suspect that most tools use the WiFi driver of the machine and only scan for the channels it is ...
7
votes
1answer
152 views

What should be included in the ground rules for an attack review?

I've drafted some ground rules for a call for adversarial attack-review. I've tried to cover the following topics: Link to the policy that I want to enforce. Link to a minimal testbed and ...
18
votes
3answers
5k views

Google hacking - why “numrange” is so dangerous?

I'm reading Google Hacking for Penetration Testers and in book it's said several times operator "numrange" is especially powerful and dangerous. However, they don't give example of using this ...
5
votes
3answers
862 views

Open source web application penetration testing community

I do web development for a living but my real passion is security. I have worked with countless open source web application/framework and I have found vulnerabilities in most of them. The main cause ...
29
votes
6answers
33k views

At what point does “hacking” become illegal? (US)

Hypothetical situation: before I hire a web development company I want to test their ability to design secure web apps by viewing their previous client's websites. Issue: this situation raises a big ...
7
votes
3answers
552 views

Which resources can help me learn how to use metasploit?

I tried google search but I can't find good resources to learn how to use the metasploit framework. Where would you suggest a beginner go to learn about using metasploit?
1
vote
4answers
242 views

Learning the role of intruder legally [duplicate]

Possible Duplicate: How can you become a competent web application security expert without breaking the law? I was reading this article earlier U.S. government hankers for hackers , and ...
1
vote
1answer
140 views

WebServices Security [closed]

Do we have any good resources on WebServices Security? Any book, pdfs, articles and even the detail answers regarding the securing web services would be appreciated.
17
votes
6answers
6k views

Are some uncommon TCP ports scanned less than others?

Ignoring the top 5-10% of port numbers for common services that are the commonly targeted by port scanners (i.e. ports 22-ssh, 23-telnet, 80-http, 139-smb/cifs, 443-https, 3389-rdp, etc.), are the ...
3
votes
4answers
1k views

Comparing penetration testing suites

I've been using Backtrack for a while now. I was wondering if there is anything better, or on par with, that is worth looking into. Thoughts?
18
votes
6answers
16k views

Penetration Testing Jobs without Experience [closed]

There seems to be a late trend where firms are beginning to hire fresh graduates for security related jobs. This is counter to what I've heard from experienced security professionals (as well as the ...
5
votes
3answers
465 views

What are the security considerations for setting up a basic security testing environment?

I only have 2 spare machines and both are very old, but I really want to set up an environment so that I can start practicing security. One of these machines has a Pentium 4 processor and 512 MB RAM; ...
10
votes
4answers
2k views

Is there a typical step-by-step A-Z process for testing a Web site for possible exploits?

I'm interested less in the tools of the trade (there are many questions here already about that), and I am interested more in the process by which you would go about using those tools. So for ...
10
votes
4answers
2k views

How does System Memory Dump work?

So there are so many pen-testing tools that perform a memory dump on the system. How exactly do they work - what exactly happens ?
3
votes
3answers
136 views

Question on information retrieved from systems that could potentially lead to exploits

Usually it is advised, when one wants to secure an application, to "provide" as little information, or better yet, no information at all to unauthorized (possibly malicious) users. I'm thinking of ...
3
votes
1answer
202 views

testing for 'Dangling Cursor'

While reading the updated Top 25 exploits in the Common Weakness Enumeration I came across an exploit that I was not familiar with. It is numbered CWE-619: Dangling Database Cursor. I was wondering ...
7
votes
2answers
2k views

Initial steps of network mapping

In light of recent security breaches hitting the news, it's been all hands on deck at my work as far as security. I'm trying to pen test our network. I have a very basic question. My Question You ...
10
votes
3answers
2k views

How to perform penetration testing on a Flex application?

Possible Duplicate: What tools are there to inspect Flash SWF files? I have decompiled it, verified the source. All seems fine. Appscan also is not able to find anything in this case. But I ...
10
votes
2answers
977 views

Cross site scripting verification on a field which does not accept more than 20 characters

While performing penetration testing, I got stuck to a point. There is a text field which does not accept more than 20 characters(server side validation). I inserted following piece of code to check ...
3
votes
1answer
2k views

Are there any tools for automated penetration testing of Silverlight applications? [closed]

I'd like to find a tool to assist with automated penetration testing of Silverlight applications, in a similar vein to AppScan for webapps. Specifically, I'm looking for a tool that can cope with ...
3
votes
4answers
2k views

Problems during Pen-testing of SCADA systems

Is there a way to monitor the way the SCADA systems behave 'during pen-testing or security audit', and find out the implications of just port scans and/or monitor the state of activity while sending a ...