An attempt to penetrate a system's security in an effort to evaluate the protections in place.
1
vote
4answers
526 views
My website has been hacked, what do i do next? [closed]
So. I couldn't see any other question like this on Sec.Se so i thought i'd ask.
My public website www.foo.com has been hacked. The front page is sending it to be redirected to seoblog.fooblog.com in ...
3
votes
2answers
144 views
How to red team against firewalled architecture?
Prior Knowledge
I understand the types and differences between firewalls.
I have (what I believe to be) a relatively good mental model of a firewall.
I understand routing, iptables, signature ...
2
votes
1answer
163 views
Loki How to crack the password hash OSPF?
I have created for myself a lab of routers in GNS3 . Routing protocol between routers is OSPF.
Now,by Loki penetration testing, I found that routers are the feature authentication.
Using wireshark, I ...
0
votes
1answer
1k views
my site with joomla 1.5.14 got defaced and I'd like to know how he did it and stop it
I am supposed to manage the content of a site and it got defaced.
The site is hosted on a Linux server running Apache.
Apache version: 2.2.13
Linux version is Debian 4.0(I think I don't really have ...
1
vote
2answers
341 views
How to test my website for the rails YAML vulnerability
I am quite puzzled by how to test my rails app for the YAML vulnerability
first, I upgraded to the latest rails 3.2.11, and I tried this
It gave me not likely to be vulnerable or URIPATH must be set
...
7
votes
2answers
547 views
How should one prepare himself for a job interview for penetration testing?
So, the title basically says it all. I would really like to hear out some of the more experienced friends here with their answers for this.
Should it revolve around the ability to verbally explain ...
3
votes
4answers
311 views
Finding all links under a website
How can i find all directories and links under a website? Note that there is no link from home page to all other pages. For example if i have a domain like this users.company.com and each user will ...
6
votes
2answers
313 views
How to get info on company , company owned sites etc…?
I wanted to know how can I get info on what sites are owned by certain company.I need it for bug bounty programs. For example how can I find what sites are owned by paypal company, like what sites ...
0
votes
3answers
247 views
Penetration testing against an ignorant target - Is it legal? [closed]
I know it's a big no-no in terms of etiquette, but is it illegal in Canada to perform penetration testing against a commercial company without authorization?
prompted by: ...
1
vote
2answers
860 views
Sqlmap testing HTTP headers
I was wondering whether sqlmap is able to test HTTP headers for sql vulnerabilities. I know that if I use --level>=3 then it will automatically check for User-Agent and Referer HTTP headers, but I ...
0
votes
1answer
151 views
Rootkits, how much should I be concerned? I found a suspicious activity on my network
In the old age netstat was one of my favorite tools to check out possible malicious connection, but then I took note about the dangerous of incoming rootkits and its high complexity, being able to ...
2
votes
5answers
545 views
Building my own Darkspace
I have searched through the internet about creating a darknet and there is a confusion.
There are two definitions, the first one is network used for private p2p (like freenet) and another one that ...
0
votes
1answer
226 views
Need advice on automated virtual pentesting lab configurations
I request you to read the problem before suggesting any duplicate or down-voting, I am well aware of hundreds of questions about somewhat similar problem but this one is just to attract some good ...
2
votes
1answer
641 views
Tutorials, Exercises and Environemnts for Penetration Testing Mobile Environments
I'm looking for a list of exercises or distributions to practice penetration testing on mobile environments. There are plenty of existing things like the environments found at pentesterlab.com and ...
4
votes
1answer
95 views
Any suggestions while testing a sandboxing driver?
I am doing penetration testing of a sandboxing driver and trying to break the sandbox. It is implemented as a kernel mode driver. A sandboxed process will have :
A whitelist of disk locations for ...
1
vote
0answers
69 views
Determine deployed 802.3x encryption/authentication protocols? Or, why can't I access Eth0?
Is there any means to identify deployed 802.3x authentication protocols on a wired interface (eth0) under Windows 7 (CLI), or from wlan0 on a *NIX based system?
The scenario is as follows: I am a ...
3
votes
5answers
496 views
Building a Security Training Simulation environment
My university is keen to build a security training simulation environment/platform and it will be a good learning experience for students. I Googled around to find out how it is built, but I only ...
2
votes
1answer
229 views
Reverse shell attack and proxy interceptions.. . is there anything worng?
First I've got a few questions about Reverse shell.
REVERSE SHELL
I'm trying to understand the Reverse shell technique.
My reasoning is as follows (I'd be glad if you could point out any mistake ...
3
votes
3answers
259 views
Physical access: in-scope for penetration testing or not?
When pentesting a network, should a pentester consider physical access to devices (e.g. allow use of a USB stick)? Or is this out of scope?
2
votes
2answers
270 views
How was pentest performed in the era with no frameworks like Metasploit?
I have been interested in security lately, I have been reading mainly cookbooks on Metasploit framework, how social engineering has been employed exhaustively, I have started reading some IA-32 ...
5
votes
6answers
188 views
Is it useful to determine the name of the server software while doing a penetration test?
Getting the name of the server software through netcat or curl or any other method, is really useful?
I mean, OS fingerprinting is useful in order to tailor an attack. For example with regard to OS ...
2
votes
5answers
258 views
OS fingerprinting: can I rely on the results?
Using nmap -O www.example.com I get:
Running (JUST GUESSING): Microsoft Windows 7|2008 (90%)
So I can say the target site is running Windows.
Using xprobe2 -v www.example.com, I'm just astonished ...
2
votes
2answers
226 views
Test Android Secure Encrypted Traffic
For testing android traffic encryption I have configured a VPN client in my phone. What simple test I can perform in my home wifi network to verify that the traffic is really encrypted and secure?
4
votes
1answer
273 views
Trying to figure out Gmail login in Wireshark
In my pentesting lab I'm using ettercap for do a mitm to a XP VM.
I go to gmail, accepting the false certification, and here I start to sniff with wireshark. I put some false account like ...
3
votes
1answer
475 views
How Chrome avoids sslstrip?
I'm trying out Moxie's sslstrip tool in my pentester lab. It works in all my VM's but no in all browsers. Firefox and IE are vulnerable but Chrome seems to has a protection against.
Anyone know how ...
0
votes
1answer
217 views
How I add cookie to w3af for authenticated attacks?
Can anyone explain this in steps to me?
Lets just say I clicked to OWASP Top 10 scan profile and entered url.
Next I need to add cookies or authentication values to w3af (form based auth.).
How?
...
2
votes
1answer
180 views
What are the best Nmap Scripting Engine (NSE) service discovery scripts? [closed]
Using nmap -sV can be quite verbose can -sU can take a very long time especially with -p 0-65535. To narrow your results and enumerate interesting services the wealth of NSE scripts can be very ...
1
vote
2answers
129 views
What is the first step in auditing the security efficiency of a simple website?
I am asked to write a first technical audit about the security best practices to improve a PHP web-site security.
I am wondering from where to start? Is there a famous audit forms to analyze and ...
0
votes
1answer
95 views
How do I prevent my Rails application from attack? [closed]
My website is being nuked by new signups and new posts some of which don't even have user.id associated with.
How do I solve this? What code should I add to the user#new page and/or post#new page.
...
1
vote
2answers
191 views
I need explanation on how serious these vulnerabilities are?
I have found two vulnerabilities on my college site and I want to report them but don't know if these are "really" vulnerabilities :
RFI inside SWF file.
Example: ...
2
votes
1answer
434 views
Android Application penetration testing
Have problem intercepting HTTPS requests of android application.certificates in android are kept under /system/etc/security/cacerts/ which is different from its previos version of os in cacerts.bks ...
0
votes
2answers
167 views
can a backdoor executable be used on an occupied port?
Suppose I am doing a penetration test on a network that has a firewall that blocks all ports except 80, 110, and 443. I want to use a metasploit reverse-TCP backdoor executable written in msfpayload ...
-1
votes
1answer
238 views
where to get the latest trends about penetration testing systems? [closed]
I am an undergraduate student, who want to do a project in penetration testing automation, and i want a conference or some official source to obtain some latest researches from inorder to see what to ...
4
votes
3answers
336 views
Create a page to experiment with SQL injection [closed]
This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
-1
votes
1answer
99 views
Cloud application Vulnerability assessment
Do you think server side assessment of application is important when application is hosted on a cloud like Amazon?
Assessment on software used to host the application not the actual application, e.g. ...
2
votes
1answer
263 views
File upload vulnerability: rename solution?
I have a module in which the user can upload images.
I searched Google for different kinds of upload attacks
checking dimension of the image (still vulnerable)
checking of file extension ...
3
votes
2answers
662 views
Security analysis tools for iOS 6 [closed]
Searched over web, however could not find much info on security analysis tools for iOS6.
Can somebody point me to the security analysis (Static Code Analysis & Pen Testing) tools for iOS6?
4
votes
3answers
398 views
Web app penetration testing
I have a static website which needs to be pentested. It has only got one form which updates some data on the server and i have pentested it with some blind PHP and SQL injection.
The site is hosted on ...
2
votes
3answers
167 views
Pentesting file Upload feature
The file(resume) upload feature is accepting any sort of files. I have uploaded the PHP shell into it. How do I again access to that uploaded file? I'm bruteforcing the web directory to check for ...
8
votes
4answers
582 views
Nessus Scan Port ID mapped to Metasploit Vulnerability exploits
My Question: Is there any sort of website that maps Nessus Scan IDs to Metasploit Vulnerabilities?
My Situation: I'm learning about penetration testing and I'm beginning to get frustrated seeing a ...
0
votes
0answers
148 views
GWAPT - Training Experiences/Questions [closed]
I'm heavily considering the GWAPT certificate, I'm wondering:
http://www.giac.org/certification/web-application-penetration-tester-gwapt
Has anyone done the online version of it? What is it like? Is ...
3
votes
4answers
401 views
Definitive certification list [closed]
What are a list of useful certificates for someone who wants to work on the information security field?
I have heard of CISSP but from what I have understood it is way too advanced for someone new to ...
0
votes
0answers
269 views
How to do a penetration test on an iOS application? [closed]
I have newly started pentesting of iOS apps. I need a pointer about what are the basic checklist should I follow while carrying out iOS apps pentest.
Suggestion of tools and methodologies to carry ...
0
votes
1answer
158 views
What type of attacks can be carried on for an web application [closed]
My company has designed an web application and its going to be hosted soon, I would like to know what type of attacks can be carried on the web application to test the security of my web application
...
6
votes
4answers
431 views
Why is penetration testing important
In improving the security of an organization, it seems as though an audit of existing code, procedures, policies, infrastructure, etc. would be absolutely sufficient to reveal any security or policy ...
0
votes
0answers
70 views
Web application scanners that output reports? [closed]
I've been poking around the web looking for a web app security scanner I could introduce into by build/QA process to pick up some of the common issues in my applications. The tricky part is that I ...
2
votes
5answers
4k views
Nexus 7 (Or any other good android tablets) For pen testing
I'm considering investing in an android tablet for pen testing. Does anyone know how capable they are with pen testing? Can they compile code or forward packets? Are any applications that work on ...
7
votes
5answers
392 views
How do small businesses handle web app security?
Everything on Owasp's top 10 list, how do current small businesses (< 1000 employees) handle web application security, along with mobile security of their applications?
Do they care about info/app ...
2
votes
3answers
234 views
What things should a penetration tester know about databases?
I want to start learning about databases from pentesters perspective and I would like to know what things will be useful on the long run . Also do you know any good book to kickstart my experience at ...
2
votes
1answer
228 views
Using mysql root account to execute root commands
Suppose that I have full root access to mysql databases, but not root user shell (linux). How can I use the full root access to mysql databases to execute root commands?
