An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

0
votes
0answers
42 views

What could be done using Set-Cookie or Cookie Manupulation

I was testing a web application where I can inject the cookie using CR/LF injection. I'm curious to know, What attacker could done only using cookie injection (Set-Cookie) by CR/LF on website like ...
2
votes
0answers
43 views

How to Lead to XSS by Response Splitting in this Scenario

I have been pentesting for a company. I found a CRLF Injection that could be done using %E5%98%8D%E5%98%8A instead of %0d%0a. So I'm using %E5%98%8D%E5%98%8A in redirection parameter for CR/LF. Here ...
2
votes
1answer
55 views

Deliberate Vulnerable Openstack images for penetration testing/training or research

I was just wondering if there are already deliberate vulnerable Openstack images for penetration testing/training or research. Something in line with OWASP's DVWA e.t.c....there quite a lot out there ...
4
votes
1answer
49 views

Would generic exception messasges be considered a security risk?

For example, if visiting a webpage you get the response: Error in exception handler. This has a high chance the website is using Laravel. Would this class as information disclosure? I'm guessing ...
1
vote
2answers
56 views

How can I conduct penetration testing on VirtualBox

I want to get started with penetration testing, and have read that it is better to conduct such tests using a virtual machine rather than your own computer. I also want to use the internal network ...
2
votes
2answers
134 views

Remote OS command injection - tests

ZAP scanner found Remote OS command injection. Is there any foolproof way to check if this works and is not a false positive? I have tried to make it sleep 50 seconds but it's not something I can ...
10
votes
1answer
469 views

Penetration testing methodologies

There are several methodologies for penetration testing like OSSTMM, NIST and other frameworks. What are the differences among them? Who is the intended audience and where is the intended place/sector ...
1
vote
1answer
73 views

CSRF Prvention Token Mechanism: Back button Navigation

I have a legacy web application and need to prevent it from CSRF. I tried to resolve the issue without compromising application functionality and got issues related to navigation. The main concern ...
-2
votes
1answer
82 views

Regarding Mobile Application Penetration Testing

I am new in mobile application penetration testing. Just curious to know, whether we need to perform the penetration testing on rooted devices or non rooted devices. Why and why not? I have searched ...
0
votes
0answers
26 views

Crackle does not work?

I've used to intructions for Crackle but, cannot get this kind of results like in the example. All it does is open up the wireshark like plugin and does not show any results like the picture below. ...
1
vote
1answer
51 views

Best appraoch to test inhouse firewall effectiveness

We have Fortigate 100D that has antivirus profiles enabled like SMPT, POP3 and IMAP. How one could make sure that the antivirus is working as expected ? For instance it seems that Fortigate has ...
2
votes
1answer
83 views

How can I test a domain that I don't own for unencrypted communication vulnerabilities?

I am suspecting a website of passing clear text login information and so far as I can tell the connection is unencrypted. Are there web-based tools to validate/test a website for basic security ...
4
votes
1answer
586 views

How to pentest an AngularJS based SPA (Single Page Application)

I am trying to Pentest an application which is built in AngularJS. The difficulties that I am facing: Burp Suite's "spider this host" option is not able to crawl all the urls as most of the requests ...
2
votes
1answer
163 views

Can't get into Damn Vulnerable Web App with Hydra even though correct password is supplied

I've got VMware Workstation. I'm running Metasploitable2 and Damn Vulnerable Web App. I'm trying to attack it using Hydra in kali Linux. To save time I made a very small password list and included the ...
3
votes
2answers
136 views

How can i demonstrate remote file inclusion via get methods

I have been testing my PHP web application for RFI vulnerabilities. While performing scan I was able perform RFI in my web application. Scenario: In my web application RFI works only when the user's ...
2
votes
1answer
65 views

What are the advantage of running a penetration test through Docker?

I was looking at Kali's blog post about its official Docker image, and I was wondering what the real benefits are. Why would I would run penetration testing through a docker image? Is it something ...
4
votes
2answers
274 views

How does exploit development work for penetration testers?

When doing exploit development, the process always relies on memory address from the victim's machine. As an exploit developer, you will have to setup an environment of attacker\victim machines and ...
5
votes
1answer
121 views

Anonymity while “attacking” a target [closed]

I'm very interested to the security topic, but sometimes I fail in understanding how a hacker would be successful like for example a group that recently claimed they got data from FBI. I wonder ...
3
votes
3answers
91 views

PenTesting - Configuring vulnerabilities on XP SP 1/2/3 & Server 2008

I've been creating test ranges using VMWare and an isolated network to play around with, and configuring endpoint workstations to be the receiving end of penetration tests. I've found that the "easy" ...
0
votes
1answer
163 views

Sqlmap doesn't exploit verified SQL injection

Right now I'm tinkering with the Hackxor VM (a pentesting training enviroment) and I'm trying to use sqlmap to exploit a vulnerability which I can exploit manually. The vulnerability is in the ...
1
vote
1answer
110 views

What is the best way to perform penetration tests for free with and without software? [closed]

Is there any software or hardware that will perform penetration tests without a paid subscription? i.e. Free to use like Kali-linux etc. I would like to learn how to perform penetration tests. If ...
2
votes
1answer
52 views

Getting error in Hydra

I'm trying to test someones website for them and I'm using hydra in cygwin on Windows. When I enter: hydra -L myusers.txt -P mypass.txt website.net http-get-form \ "/wp-login.php:user_login=^USER^&...
2
votes
1answer
117 views

Is my understanding of buffer overflows correct?

I am new to pentesting and wondering if my current understanding of buffer overflow exploits is correct. Assuming an operating address space of 3 addresses, an instruction space of 2 addresses, and an ...
0
votes
1answer
52 views

Event: ET SCAN Nmap NSE Heartbleed Request

Last night I got this incident on my siem tool: Event: ET SCAN Nmap NSE Heartbleed Request. Incident triggered from blacklisted IP to our open VPN server. Clicking on the signature content it ...
1
vote
0answers
61 views

Where can I find example or template security testing contracts? [closed]

I'm a lawyer interested in information security, and am collecting templates and examples of security testing agreements to compare. What are some publicly available examples, or nuggets of wisdom ...
3
votes
1answer
113 views

Penetration Testing Vocabulary

The Terms and Conditions on Amazon's AWS prohibit activities called, "White cards" and "Red team and blue team testing". What do these terms mean?
0
votes
1answer
42 views

Are There Any Measurements for Web-Application Complexity That Positively Correlates to Num. Vulnerabilities?

Web-applications have vulnerabilities. Generally, a more complex web-application has more vulnerabilities, compared with a simpler and smaller web-application. For example, white hat hackers have ...
82
votes
6answers
11k views

Script Kiddies - how do they find my server IP?

I've set up a site on Digital Ocean without a domain yet, so there is only the IP. Despite telling no-one of its existence or advertising it, I get hundreds of notices from fail2ban that various IP's ...
0
votes
0answers
94 views

Intermediate proxy intercepting my SSL data between my computer and the ISP

I did a simple scan of my linux firewall today using grc.com's shieldsup on their website (https://www.grc.com/x/ne.dll?bh0bkyd20). Previously when doing this it shows I have full stealth but today it ...
-1
votes
1answer
109 views

Are there pricing standards for Vulnerability assessment and penetration testing (VAPT) services?

Generally, to conduct vulnerability assessment and penetration testing (VAPT) for an application, we do charge some amount from the client, based on which criteria the companies charge their customers....
2
votes
1answer
81 views

Linux (!) Network Architecture for CTF-scenario [closed]

My boss recently enrolled me in an InfoSec training. I am part of the network team, but have limited experience in InfoSec. My first assignment is to draw a layout of a network that will be used ...
-1
votes
0answers
41 views

Information needed to share with Penetration Tester? [duplicate]

We are planning for a penetration testing for our network and applications. Can anyone confirm the details which should be shared to penetration testers regarding our topology / servers? Is it ...
-1
votes
2answers
113 views

What kind of information does a penetration tester require? [closed]

We are planning for a penetration testing for our network and application. What should be shared with the penetration tester? For example, should we share the topology of our network? Should we ...
4
votes
1answer
109 views

Spoofing LAN IP Address Traffic

To give as much detail as possible, I am doing a Pentest for a client that has quite a few "terminal systems" meaning that they are simply a box with a connection back to the main server. These ...
0
votes
3answers
48 views

creating a testing environment

This question has been asked over and over again across the web, but many answers are either ridiculous or the same. I have tried using OWASPs VM which has a range of purposely built holes in web ...
0
votes
1answer
80 views

What does the below SQL injection indicate?

What is the meaning of this command in SQL ? php?que_id =-1/**/UNION/**/ ALL/**/SELECT What does /**/? indicate here?
37
votes
4answers
4k views

What person should I write a penetration test report as?

When you're writing a report, what person do you write it as? First person singular: I discovered a vulnerability in HP Power Manager... First person plural: We discovered a vulnerability in HP ...
1
vote
1answer
310 views

No handshake recorded from airodump-ng

I've just started to attempt this by following the guide from lewiscomputerhowto. I've seen other people ask similar questions, but they all seem to be older threads. The steps I've taken are shown ...
-1
votes
1answer
56 views

Eavesdropping and sniffing attacks [closed]

Assume we have two routers connected by a link. Speaking of eavesdropping and sniffing attacks, does it technically appear at link itself or at the routers? If at the routers, does it imply that these ...
1
vote
1answer
107 views

SSH “on keyboard interactive devices” brute force vulnerability

I was researching the OpenSSH brute force vulnerability "onkeyborad-interactive devices", however I am not sure how this command really works ssh -lusername -oKbdInteractiveDevices=`perl -e 'print "...
4
votes
7answers
197 views

Any non alert() based non malicious XSS payloads?

I have been trying to find non malicious, non alert based, single command reflective XSS payloads, and have so far seen none. Anybody know of any good ones for pentesting purposes? What I mean by ...
0
votes
1answer
76 views

How to get an internal network address range during a footprinting stage?

As new to pen testing, I am a bit stuck at finding out a local network address range from external network to perform a pen testing. I will give you a fake scenario with fake IP addresses as below. ...
5
votes
2answers
115 views

Path Disclosure without ability to read files

So I am a pentester, and I have discovered "feature" on a server that allows me to, essentially, blindly traverse a web server's files (without executing or reading them). The problem is that I ...
0
votes
2answers
103 views

Penetration Testing Criteria [closed]

I'm a beginner-level penetration tester, I've noticed that after the pentesting, you just report the vulnerabilities you've found and the possible exploit points that you've discovered. Using the ...
1
vote
2answers
89 views

Understanding the behaviour of existing eavesdropping techniques

I am studying the behaviour of existing eavesdropping techniques (part of my research). I have a question through the following scenario: Suppose Bob lives in New York and wants to listen (i.e. ...
8
votes
1answer
2k views

Burpsuite accidental defacement, should I be concerned?

I was spidering a website with Burpsuite and the automated Form Submission caused me to unknowingly deface the main page with "555-555-0199@example.com". It took me a decent amount of time to notice ...
1
vote
1answer
82 views

PCI Penetration Testing - Does the whole infrastructure need to be retested on significant change?

The PCI SCC states the following in their penetration testing guidance: Per PCI DSS Requirements 11.3.1 and 11.3.2, penetration testing must be performed at least annually and after any ...
4
votes
1answer
256 views

Pentesting Web Server for Remote File Inclusion

For educational purposes, I am in the process of pentesting a web server of mine(running on Windows) where there is a Remote File Inclusion vulnerability. I can already get simple things like command ...
0
votes
1answer
125 views

What is the difference between Wireshark and Ettercap for man in the middle attacks!

I know of the two programs, one is Wireshark (a packet sniffing program) and the other is Ettercap (a man in the middle attack program). I tried doing a MITM attack before, legally on my own home ...