An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

-1
votes
2answers
109 views

What kind of information does a penetration tester require? [closed]

We are planning for a penetration testing for our network and application. What should be shared with the penetration tester? For example, should we share the topology of our network? Should we ...
111
votes
8answers
6k views

Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in production unintentionally during a pentest?

Today I experienced a situation where a person responsible for the security of a company required a pentesting company to withdraw a clause in the contract that says that: "during the pentest there ...
35
votes
5answers
4k views

Open-source penetration-test automation

What order do typical open-source penetration tests operate? Which tools are run first, second, third -- and how do you control them? Does one simply use Metasploit RC files? A network vulnerability ...
22
votes
3answers
4k views

Metasploit Meterpreter alternatives

These days I am testing various type of client hacking techniques, but in all scenarios I am using Meterpreter variations as payload. Now I can bypass Anti-Virus and Firewalls easily, but Symantec ...
28
votes
8answers
33k views

What defines a programming language as useful for hacking?

I know that scripting languages (Perl, Ruby, Python, javascript, and even Lua!!!) are most suitable for hacking and penetration testing. My question is: What is it that makes those languages ...
26
votes
5answers
2k views

How to improve as a security expert

I'm a professional software developer with a high interest in web application security. I'd say that I probably have a better understanding of the security of web applications than the average ...
23
votes
7answers
4k views

What should a security audit report include?

Background I'm in charge of auditing a medium-scale web application. I have audited web applications several times before, but I've always written a short PDF quickly explaining what I encountered ...
22
votes
7answers
7k views

What are some good website security scanning solutions?

What are some good web-based website security scanning solutions? I'm not too concerned if they are web-based solutions, or software that can be run locally. Generally, I'm looking for something we ...
19
votes
7answers
18k views

Comparing online security courses: eLearnSecurity vs. Offensive-Security [closed]

I'm a web programmer, using the Linux environment for 2 years.(I have experience with Web app hacks +Web app security techniques) I want to start studying security in-depth, but I have limited time ...
15
votes
6answers
5k views

Lightweight Live Pen-test OS [closed]

Does anyone know of any lightweight OSs that are great for Pen-testing? I would love to have a very lightweight live OS that I can boot off a USB and try some pen-testing against some of my ...
15
votes
5answers
657 views

What are the most important security checks for new web applications?

I'm wondering what are the top priority security checks you should make befor launching a new webapp? I'm guessing brute force vulnerabilities and cross-site scripting. What are the other things you ...
20
votes
6answers
59k views

Testing for HTTP TRACE method

How can I test for HTTP TRACE on my web-server? I need to train a Tester how to verify that the HTTP TRACE method is disabled. Ideally I need a script to paste into Firebug to initiate a https ...
18
votes
4answers
6k views

What tools are there to inspect Flash SWF files?

I am performing a penetration test against a website that uses Flash heavily. What tools can I use to examine the SWF file for vulnerabilities? From the Area51 proposal.
17
votes
7answers
2k views

Why don't banks get hacked?

From reading a lot of info on this website I came to the conclusion that if someone with enough skill really badly wants to gain access somewhere, then there is absolutely nothing stopping them from ...
5
votes
3answers
2k views

Published data sets for IDS/IPS evaluation

I am looking for data sets published by researchers or freelancers which can be used for the purpose of IDS/IPS testing and evaluations. The data sets may be for portscans, DoS attacks, Remote to ...
4
votes
3answers
2k views

Create a page to experiment with SQL injection [closed]

This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
6
votes
1answer
5k views

Security analysis of Dashlane

I've been asked by a user whether I would recommend using the Dashlane password manager. I'm aware that other password managers have had some significant security problems, including XSS and CSRF ...
4
votes
1answer
593 views

Feedback for Study Plan (Kali Linux & Penetration Testing) [closed]

I started to study pentesting for two months with the book named Penetration Testing - A Hands on Introduction to Hacking by Georgia Weidmann, and now I am really hungry to learn more :) . I think I ...
8
votes
2answers
5k views

How should one prepare himself for a job interview for penetration testing?

So, the title basically says it all. I would really like to hear out some of the more experienced friends here with their answers for this. Should it revolve around the ability to verbally explain ...
7
votes
3answers
4k views

SQL Injection How to inject Clean/Rest URLS

I have a question I'm hoping you could help me with? Unclean url's: http://example.com/index.php?page=foo http://example.com/products?category=2&pid=25 ...
5
votes
1answer
437 views

How do I continue pentesting with access to local station?

I started learning hobbyist penetration testing a while ago, and as far as penetrating a computer I have physical access to, all is good. Mainly using Hiren bootCD, it is easy to gain access to an ...
3
votes
2answers
1k views

Penetration testing's terms of agreement template [closed]

My company is going to start to provide penetration testing services pretty soon, in fact, we are just missing the legal aspects of it. I'm wondering if is there any template which states the most ...
3
votes
5answers
4k views

Building a Security Training Simulation environment

My university is keen to build a security training simulation environment/platform and it will be a good learning experience for students. I Googled around to find out how it is built, but I only ...
2
votes
3answers
816 views

SIM card malware advice

My goal is to communicate with a sim card via binary sms and upload new firmware and/or talk to sim card api to retrieve data such as gps coordinates etc... I am not sure how to construct these binary ...
10
votes
3answers
9k views

Best way to test my home network from the outside

I want to check that my router is working like it should. For example that certain ports which should be open on the LAN side and closed on the WAN side really work that way. So I would like to run a ...
4
votes
4answers
1k views

Effectiveness of Interactive Application Security Testing

There are a number of IAST tools available on the market such as Acunetix Web Vulnerability Scanner and HP WebInspect Real-Time. How effective are these at finding vulnerabilities? Is there any ...
4
votes
5answers
12k views

Nexus 7 (Or any other good android tablets) For pen testing

I'm considering investing in an android tablet for pen testing. Does anyone know how capable they are with pen testing? Can they compile code or forward packets? Are any applications that work on ...
3
votes
1answer
12k views

Force a specific SSL cipher

Is there a tool or browser addon that will allow you to connect to a HTTPS website using a specific SSL cipher, and view the output? This would be useful when doing a vulnerability analysis and ...
14
votes
3answers
7k views

How much does a security audit cost? [closed]

For a PHP CMS, what should I expect to budget for a security audit, both whitebox and blackbox? The codebase is about 85,000 LOC ("Lines of Code") and I would probably use a North American company for ...
8
votes
5answers
3k views

Penetration testing by ethical Hackers/Crackers should be trusted?

My question today come from my homework question from class ethics in IT. Our question states roughly that I'm IT guy in in big company and I am asked to hire few hackers to to find vulnerabilities ...
6
votes
2answers
692 views

What security measures to have before openly allowing security researchers to hack your site

As some kind of a follow-up from my previous question - which was asked from the security researcher/penetration tester point of view: (Thanks to Rory McCune for pointing this out) There seem to be a ...
6
votes
2answers
5k views

Scanning my network with NMAP

Each computer is assigned one ip address on my network, and my ISP supplies one IP for my network. If I try to scan the ip supplied by my ISP what I got is the OS running on the router, running on the ...
4
votes
4answers
763 views

External Penetration test by third party

I am planning to engage a vendor to do pen test on my external systems. I know that pen test has a set of systematic steps .. just would like to gather some industry experience. Normally, at which ...
3
votes
5answers
2k views

Building my own Darkspace

I have searched through the internet about creating a darknet and there is a confusion. There are two definitions, the first one is network used for private p2p (like freenet) and another one that ...
2
votes
2answers
1k views

If using htmlentities or htmlspecialchars functions is enough for block XSS attack

I know this question was discussed on net various times. and people give some example how to bypass these functions through passing some code. But here one issue, All example of ...
1
vote
2answers
2k views

Proxychains + nmap = segmentation fault

If I try the sV (service detection) flag in nmap run via proxychains (socks5 server) it appears to give me a segmentation fault message:- root@kali:~# proxychains nmap -n -sT -Pn X.X.X.X -p ...
0
votes
4answers
2k views

How can I test that I have correctly disabled unnecessary HTTP methods?

I am making a web-based application and I disabled some of the HTTP methods which are not necessary for the website (specifically, OPTIONS, HEAD and TRACE). I put this in the httpd.conf of my xampp ...
7
votes
3answers
4k views

TCP Sequence Prediction and it's prominence in modern systems/networks

I have a question regarding your experience of TCP Sequence Prediction that I am hoping someone could help with. I am aware of how TCP Sequence Prediction works and how the connection can be hijacked ...
7
votes
7answers
6k views

eCPPT vs. OSCP Certification

I am a soon to be college student. I am looking to become certified in pentesting for both personal interest as well as to be able to have something that would look good to future employers. Both ...
5
votes
1answer
179 views

Automatically enumerate missing patches on penetration test

Nessus, when running a credentialed scan can check patch levels and return vulnerabilities when a package is one that hasn't been updated to the latest, non-vulnerable version. What is a good way of ...
5
votes
2answers
2k views

MongoDB Nosql injection in python code

Here is the code snippet for accessing to MongoDB. client = MongoClient() db = client.test_database collection = db.test # Get data from fields condition = form.getvalue('name') if condition: ...
4
votes
2answers
4k views

Setup of Kali Linux for reverse shell connections over the internet

I am running Kali Linux as a VM on my Windows machine which is NAT'd behind my company network, if I wish to pen test a website for a client and believe that a reverse shell is possible, what is a ...
3
votes
2answers
707 views

enumeration and MS DCERPC

Enumeration, enumeration, and even more enumeration is the generic pentesting mantra, but enumeration is worthless if you can't read the results. I came across the Windows RPC service, where ...
3
votes
1answer
152 views

How and where to begin on the Return of Web Application Security Investment?

While there is a vast trove of vulnerabilties, threats and their corresponding countermeasures, the amount of information on Infosec Economics (Specifically for web applications) seems scarce. What ...
3
votes
2answers
386 views

Literature about IT security from a hardware standpoint

Can you point me to any book, blog, paper, anything about IT security on the lowest possible level (hardware)? I'm primary interested in the motherboard, CPU & GPU, however, if you know any good ...
2
votes
1answer
2k views

Is server exploitable by Shellshock with cgi-enabled only?

A server with vulnerable bash, but cgi enabled only and there are no cgi scripts in cgi-bin. Is it still exploitable ?? If there are scripts in cgi-bin and only server-admin knows about filenames of ...
2
votes
1answer
955 views

Example of attack trees in the web application security analysis

Here I am again asking for some informations about attack trees usage in web application analysis. For my master thesis I decided to study the usage of this formalism in order to reppresent attacks ...
2
votes
1answer
2k views

Expected cost and time frame for black box pen testing?

I work for a major publicly traded company and we need some external black box pen testing done on a Win32 executable. This exe is used in a large client server infrastructure and is a central piece ...
1
vote
1answer
199 views

No handshake recorded from airodump-ng

I've just started to attempt this by following the guide from lewiscomputerhowto. I've seen other people ask similar questions, but they all seem to be older threads. The steps I've taken are shown ...
1
vote
2answers
5k views

What is the best tool to anonymize your scans (network/ports)? [closed]

What are the best tools to anonymize my port scanners and vulnerability assessment tools (like nmap , metasploit ) ...? I have been using Backtrack and tor network with proxychains to do this, but ...