An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

1
vote
0answers
93 views

Dumping Large table using Sqlmap

I am learning/working on sqlmap and I was trying to dump a large table with 11K entries on my localhost. The command I used is: python sqlmap.py -u "http://localhost/searchre.php" --data="search=' ...
0
votes
0answers
50 views

Android client side data encoding/encryption bypass

I am working on Android application security project where Android application sends all data in encryption from client side only. I assume that there must be a file at client side which might be ...
2
votes
2answers
95 views

Use Nessus or focus on manual testing?

Nessus scans for a a lot of vulnerabilities, so should I focus on learning vulnerabilities that are not covered by Nessus, like directory traversal attacks? Should I work on only the vulnerabilities ...
0
votes
0answers
33 views

How can I do a Windows registry check with OpenVAS with out a port scan?

OpenVAS has the function to check Windows registries, but when i try to check a registry it also does a port scan. I used the scan configuration out off the manual. http://docs.greenbone.net/GSM-...
0
votes
1answer
105 views

website - infected by malware and if yes, how can I treat it? [closed]

A friend told me that the website of our association, here , got blocked by the corporate network of the company he is working for, due to malware (see picture below) I've tried a few website like ...
0
votes
1answer
85 views

What is the most valuable file you can get using a directory traversal hole [closed]

I am doing a penetration test and I found a directory traversal hole in the web application which enables me to download any readable file in the server. However, I could only download files that is ...
1
vote
2answers
81 views

Ethical hacking requirements on a banking institution

If I would be required to do an ethic hacking research by a banking institution would I use my own bank account, ask for an account to the bank or open a new account and transfer some money and do ...
0
votes
1answer
150 views

Dumping custom query via SQL injection when output is in the die() function?

On my localhost I have a PHP link like this abc.com/index.php?q=XYZ where XYZ is a base64encoded parameter that I have verified is injectable. When I try abc.com/index.php?q=XYZ' it returns You ...
0
votes
1answer
68 views

OS fingerprinting via TCP

I have searched online about this topic and the only information I got is that TCP SYN/ACK can be used to know the type of the target OS. If that is true, I don't understand how this occurs? Does TCP ...
2
votes
2answers
191 views

Bug Bounty Methodology for a Newbie

Question: Once I join a bug bounty program and start hunting for bugs on a website, how do I efficiently start looking for bugs? I am very familiar with common vulnerabilities (XSS, sql injection, ...
1
vote
0answers
25 views

Tool for HPP testing? [closed]

Is there an automated vulnerability scanner that supports HPP (HTTP Parameter Pollution)? Since all I need is to take a query string and perform basic modifications / add new parameters, I was ...
-1
votes
1answer
135 views

how to start penetration testing? [closed]

I am currently working as security analyst on few applications and am willing to jump into penetration testing in future.To start with, what kind of skill set do i need to develop like tools and ...
52
votes
9answers
4k views

How should I tell school that they are vulnerable when I wasn't given permission to check? [duplicate]

I would like to report security weaknesses to my school in UK. I had managed to find security weaknesses without any exploits or other software or hardware. I had look at similar question however ...
4
votes
3answers
85 views

Frameworks for collecting all activities in a pentest?

I work as a penetration tester for a company, and one thing we're regularly asked to do is to provide a forensic log of all of the activities we perform during the course of an assessment. I'm ...
-5
votes
1answer
121 views

Alternative of using wifi card for penetration testing [closed]

I want to learn penetration testing on kali linux platform, for that I found that the wifi card is needed. But my question is that, if I install the kali linux as main operating system or make ...
0
votes
0answers
42 views

What could be done using Set-Cookie or Cookie Manupulation

I was testing a web application where I can inject the cookie using CR/LF injection. I'm curious to know, What attacker could done only using cookie injection (Set-Cookie) by CR/LF on website like ...
2
votes
0answers
60 views

How to inject XSS using Response Splitting in the following scenario?

I have been pentesting for a company. I found a CRLF injection that could be done using %E5%98%8D%E5%98%8A instead of %0d%0a. So I'm using %E5%98%8D%E5%98%8A in redirection parameter for CR/LF. Here ...
2
votes
1answer
71 views

Deliberate Vulnerable Openstack images for penetration testing/training or research

I was just wondering if there are already deliberate vulnerable Openstack images for penetration testing/training or research. Something in line with OWASP's DVWA e.t.c....there quite a lot out there ...
4
votes
1answer
49 views

Would generic exception messasges be considered a security risk?

For example, if visiting a webpage you get the response: Error in exception handler. This has a high chance the website is using Laravel. Would this class as information disclosure? I'm guessing ...
1
vote
2answers
63 views

How can I conduct penetration testing on VirtualBox

I want to get started with penetration testing, and have read that it is better to conduct such tests using a virtual machine rather than your own computer. I also want to use the internal network ...
2
votes
2answers
201 views

Remote OS command injection - tests

ZAP scanner found Remote OS command injection. Is there any foolproof way to check if this works and is not a false positive? I have tried to make it sleep 50 seconds but it's not something I can ...
11
votes
1answer
494 views

Penetration testing methodologies

There are several methodologies for penetration testing like OSSTMM, NIST and other frameworks. What are the differences among them? Who is the intended audience and where is the intended place/sector ...
1
vote
1answer
87 views

CSRF Prvention Token Mechanism: Back button Navigation

I have a legacy web application and need to prevent it from CSRF. I tried to resolve the issue without compromising application functionality and got issues related to navigation. The main concern ...
-2
votes
1answer
89 views

Regarding Mobile Application Penetration Testing

I am new in mobile application penetration testing. Just curious to know, whether we need to perform the penetration testing on rooted devices or non rooted devices. Why and why not? I have searched ...
0
votes
0answers
34 views

Crackle does not work?

I've used to intructions for Crackle but, cannot get this kind of results like in the example. All it does is open up the wireshark like plugin and does not show any results like the picture below. ...
1
vote
1answer
55 views

Best appraoch to test inhouse firewall effectiveness

We have Fortigate 100D that has antivirus profiles enabled like SMPT, POP3 and IMAP. How one could make sure that the antivirus is working as expected ? For instance it seems that Fortigate has ...
3
votes
1answer
89 views

How can I test a domain that I don't own for unencrypted communication vulnerabilities?

I am suspecting a website of passing clear text login information and so far as I can tell the connection is unencrypted. Are there web-based tools to validate/test a website for basic security ...
4
votes
1answer
775 views

How to pentest an AngularJS based SPA (Single Page Application)

I am trying to Pentest an application which is built in AngularJS. The difficulties that I am facing: Burp Suite's "spider this host" option is not able to crawl all the urls as most of the requests ...
2
votes
1answer
202 views

Can't get into Damn Vulnerable Web App with Hydra even though correct password is supplied

I've got VMware Workstation. I'm running Metasploitable2 and Damn Vulnerable Web App. I'm trying to attack it using Hydra in kali Linux. To save time I made a very small password list and included the ...
3
votes
2answers
150 views

How can i demonstrate remote file inclusion via get methods

I have been testing my PHP web application for RFI vulnerabilities. While performing scan I was able perform RFI in my web application. Scenario: In my web application RFI works only when the user's ...
2
votes
1answer
69 views

What are the advantage of running a penetration test through Docker?

I was looking at Kali's blog post about its official Docker image, and I was wondering what the real benefits are. Why would I would run penetration testing through a docker image? Is it something ...
4
votes
2answers
293 views

How does exploit development work for penetration testers?

When doing exploit development, the process always relies on memory address from the victim's machine. As an exploit developer, you will have to setup an environment of attacker\victim machines and ...
5
votes
1answer
122 views

Anonymity while “attacking” a target [closed]

I'm very interested to the security topic, but sometimes I fail in understanding how a hacker would be successful like for example a group that recently claimed they got data from FBI. I wonder ...
3
votes
3answers
104 views

PenTesting - Configuring vulnerabilities on XP SP 1/2/3 & Server 2008

I've been creating test ranges using VMWare and an isolated network to play around with, and configuring endpoint workstations to be the receiving end of penetration tests. I've found that the "easy" ...
0
votes
1answer
204 views

Sqlmap doesn't exploit verified SQL injection

Right now I'm tinkering with the Hackxor VM (a pentesting training enviroment) and I'm trying to use sqlmap to exploit a vulnerability which I can exploit manually. The vulnerability is in the ...
1
vote
1answer
118 views

What is the best way to perform penetration tests for free with and without software? [closed]

Is there any software or hardware that will perform penetration tests without a paid subscription? i.e. Free to use like Kali-linux etc. I would like to learn how to perform penetration tests. If ...
2
votes
1answer
55 views

Getting error in Hydra

I'm trying to test someones website for them and I'm using hydra in cygwin on Windows. When I enter: hydra -L myusers.txt -P mypass.txt website.net http-get-form \ "/wp-login.php:user_login=^USER^&...
2
votes
1answer
120 views

Is my understanding of buffer overflows correct?

I am new to pentesting and wondering if my current understanding of buffer overflow exploits is correct. Assuming an operating address space of 3 addresses, an instruction space of 2 addresses, and an ...
0
votes
1answer
53 views

Event: ET SCAN Nmap NSE Heartbleed Request

Last night I got this incident on my siem tool: Event: ET SCAN Nmap NSE Heartbleed Request. Incident triggered from blacklisted IP to our open VPN server. Clicking on the signature content it ...
1
vote
0answers
68 views

Where can I find example or template security testing contracts? [closed]

I'm a lawyer interested in information security, and am collecting templates and examples of security testing agreements to compare. What are some publicly available examples, or nuggets of wisdom ...
3
votes
1answer
116 views

Penetration Testing Vocabulary

The Terms and Conditions on Amazon's AWS prohibit activities called, "White cards" and "Red team and blue team testing". What do these terms mean?
0
votes
1answer
42 views

Are There Any Measurements for Web-Application Complexity That Positively Correlates to Num. Vulnerabilities?

Web-applications have vulnerabilities. Generally, a more complex web-application has more vulnerabilities, compared with a simpler and smaller web-application. For example, white hat hackers have ...
82
votes
6answers
11k views

Script Kiddies - how do they find my server IP?

I've set up a site on Digital Ocean without a domain yet, so there is only the IP. Despite telling no-one of its existence or advertising it, I get hundreds of notices from fail2ban that various IP's ...
0
votes
0answers
103 views

Intermediate proxy intercepting my SSL data between my computer and the ISP

I did a simple scan of my linux firewall today using grc.com's shieldsup on their website (https://www.grc.com/x/ne.dll?bh0bkyd20). Previously when doing this it shows I have full stealth but today it ...
-1
votes
1answer
131 views

Are there pricing standards for Vulnerability assessment and penetration testing (VAPT) services?

Generally, to conduct vulnerability assessment and penetration testing (VAPT) for an application, we do charge some amount from the client, based on which criteria the companies charge their customers....
2
votes
1answer
87 views

Linux (!) Network Architecture for CTF-scenario [closed]

My boss recently enrolled me in an InfoSec training. I am part of the network team, but have limited experience in InfoSec. My first assignment is to draw a layout of a network that will be used ...
-1
votes
0answers
41 views

Information needed to share with Penetration Tester? [duplicate]

We are planning for a penetration testing for our network and applications. Can anyone confirm the details which should be shared to penetration testers regarding our topology / servers? Is it ...
-1
votes
2answers
115 views

What kind of information does a penetration tester require? [closed]

We are planning for a penetration testing for our network and application. What should be shared with the penetration tester? For example, should we share the topology of our network? Should we ...
4
votes
1answer
116 views

Spoofing LAN IP Address Traffic

To give as much detail as possible, I am doing a Pentest for a client that has quite a few "terminal systems" meaning that they are simply a box with a connection back to the main server. These ...