An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

1
vote
1answer
65 views

Access to email without antivirus [duplicate]

I am doing a test where we want to asses whether an email with a benign virus in it, exits a network. I need a means to receive the test emails I am sending from inside the network, without any ...
5
votes
2answers
145 views

Stop Nmap scan and preserve XML output

Every time I run Nmap I use the -oA flag. The XML output is an important output item as I feed it into a number of parsers plus Metasploit with db_import. The --resume option can resume a scan but it ...
0
votes
0answers
96 views

Hydra command for cracking a webpage which uses <span> tag for failed login attempts

I'm trying to for crack a simple webform for testing hydra in Kali. When the webpage encounters a wrong username and password combination it pops up a message using the following html code:: ...
0
votes
0answers
65 views

Using DVWA at Medium Security, how can I OutFile records?

Whilst carrying out SQL Injection attacks against the educational tool DVWA on security level Low, I could carry out a command like the below and both retrieve records and write them to a file. ' ...
0
votes
1answer
81 views

SEToolkit cloned website can be viewed over internet, but does not harvest credentials

I've been working with SEToolkit's website cloner/credential harvester. Everything works fine locally: The clone opens on the victim pc, victim inputs credentials, after submitting the victim is ...
0
votes
1answer
220 views

ISP has informed us that our server is launching brute force attacks on WordPress sites, how do we end this? [duplicate]

Misc Situation: -Server login is obtained by hacker, hacker places malicious brute force file in /hacked/bruteforce/ -Server password is then changed, hacker can still run script by navigating to ...
-1
votes
1answer
338 views

Netdiscover running on NAT interface not finding IP addresses on host-only network?

I am practicing penetration testing techniques using Kali Linux (most recent distro) and various vulnerable virtual machines (DVWA, Metasplotiable). My attack and targets are all running via ...
1
vote
3answers
484 views

Windows 7 Exploits

I just found my old, Windows 7 Ultimate installer DVD, so I thought I would set it up in a pentest-lab type environment, see what's possible and have some fun with it. So are there any publicly ...
3
votes
1answer
46 views

Should we keep our penetration testing environment separate from other test infrastructure?

Given that there are N number of hosts on a given network being used for different purpose, should we place a machine for penetration testing or vulnerability scanning on same LAN or should we have ...
1
vote
0answers
181 views

Best practices to implement a secure CAPTCHA [closed]

What are the best practices to implement a secure CAPTCHA? Also I want to know: What is the best way to identify an insecure CAPTCHA?
1
vote
0answers
21 views

PenTesting as a career guidlines [duplicate]

it's my first post so bear with me. I live in England and am currently studying A-levels at specialist IT school and I am doing BTEC IT, Maths, Computer Science(learning c#) and Product design. I have ...
2
votes
2answers
352 views

what is the vulnerability if the DCE service on remote port is enumerated?

when I scan my server using nessus, one of the result is as follows: By sending a Lookup request to the portmapper (TCP 135 or epmapper PIPE) it was possible to enumerate the Distributed ...
-1
votes
1answer
39 views

Quantum Computation and its threats [duplicate]

Since Quantum Computers has potential to become super computers of next generation. will that make cryptography obsolete..?
1
vote
1answer
98 views

penetration testing career path [closed]

I’m a fourth year student in computer science and I want to work as a penetration tester. I studied this courses as a self-study: RHCSA RHCE CCNA Network+ Security+ C# The question now is: can I ...
1
vote
3answers
116 views

vulnerable webapp pentest challenge

So I have this challenge in pentesting to get a shell on a vulnerable webapp. I am an authenticated user and I know that the vulnerable app is kcfinder-2.51 which is a plugin for ckeditor_3.6.4. I am ...
3
votes
2answers
675 views

Penetrate Testing Java Web Applications

First thing first; this is something I have never done before. I have a web application written in Java (JSP and Servlet) and use MySQL as the database. Application is deployed in Amazon EC2, an ...
5
votes
1answer
179 views

Automatically enumerate missing patches on penetration test

Nessus, when running a credentialed scan can check patch levels and return vulnerabilities when a package is one that hasn't been updated to the latest, non-vulnerable version. What is a good way of ...
2
votes
2answers
136 views

PHP input directly to functions

I am able to directly input with next to no constraints a value into a nest of functions, but I am unsure how I could exploit this. I got this by injecting PHP code into the URL to display the source ...
2
votes
1answer
97 views

How Is It Possible That an App Connects to 0.0.0.142 IP Address? [closed]

I regularly review connections being established from apps in my phone to external services. Lately, I found Facebook connecting to 0.0.0.142. So I deleted Facebook for Android app. Now, I just found ...
0
votes
3answers
272 views

PHP url pen testing [closed]

hello all I am using a sandbox to start practicing security measures. I get given a URL which calls a filename using the url (/download.php?file=files/read_me.txt) ... I know its possible to get the ...
1
vote
1answer
218 views

In GoldenEye, what does 'strikes deferred' refer to?

Using GoldenEye to launch a DOS attack on a web server, the terminal output reads: 12928 GoldenEye strikes deferred. (0 Failed) What does 'strikes deferred' refer to?
7
votes
2answers
498 views

Extracting Individual Records from NTDS.DIT

I am working with an extremely large NTDS.DIT file. It is about 20gb. Originally, I was attempting to dump all of the hashes from the NTDS.DIT file. I tried using meterpreter domain hash dump, smart ...
-1
votes
1answer
197 views

Setting up a pentesting lab on my personal laptop [duplicate]

I'm getting myself a laptop for pen-testing using VMware etc. Theoretically speaking, if I were to replace the disk drive with a secondary hard drive, could I successfully set up the laptop to run off ...
2
votes
2answers
1k views

If using htmlentities or htmlspecialchars functions is enough for block XSS attack

I know this question was discussed on net various times. and people give some example how to bypass these functions through passing some code. But here one issue, All example of ...
2
votes
1answer
161 views

Capturing (1x Only) HTTP POST Request [tcpdump]

Every now and then; I like to fire up tcpdump and just watch the network traffic as the packets flow on by. For example: user@host:~$ sudo tcpdump -Aevvv Will parse & print all local ...
2
votes
1answer
458 views

What is “Token” on lab.pentestit.ru?

I am new to the Information Security field. Recently I found a virtual lab called "Pentestit"(https://lab.pentestit.ru/). But I have a problem. After connecting via VPN, I can access target host: ...
1
vote
0answers
26 views

Where to look for analysis on Cyber Security market in the UK? [closed]

I work for a company that provides IT solutions. Their service ranges from basic Desktop support to massive data center migration and deployment. Recently my boss approached me asking about the ...
1
vote
2answers
322 views

What are common security problems pen testers find? [closed]

I am doing a study in school for computer science. My research topic is pen testing, since that is what I hope to do after I graduate. While doing research I am finding things that can go wrong, but ...
1
vote
3answers
189 views

Does NAT really provide security? [duplicate]

I had an argument with someone on IRC about Network Address Translation. I was under the impression that NAT provided a layer of security to internal networks. I understand that's not the primary ...
2
votes
2answers
85 views

Vulnerability scanning: White list pentester or not?

If your company engages a third party pentester to do vulnerability scanning, do you whitelist the pentester so that they can thoroughly scan the machines on the internet, or do not whitelist them ...
1
vote
1answer
326 views

SQLMAP : Unable to dump any data

I am working on a black box web application pentesting project for a client and while testing found an error-based SQL injection. I went on to exploit it using SQLMAP, I retrieved the Database names, ...
2
votes
1answer
581 views

Trying to create a reverse bind shell from Windows to Linux

I’m trying to create an encrypted reverse bind shell from my Windows machine to my Linux machine. Being totally new to penetration testing, I’m having a little bit of trouble. First, on my Linux ...
0
votes
1answer
91 views

Penetration testing HTTP client code

I am working on HTTP client code that makes REST api calls to a server and processes responses. The client talks to server via SSL, but the SSL session is terminated at a Web Application Firewall.The ...
0
votes
3answers
183 views

What would be a hackers first steps? [closed]

I currently have access to a server and I am the "hacker" (not really just a demo for class). I have ssh'ed into her machine. What is the first thing I should care about when she logs in? Apparently ...
6
votes
6answers
780 views

Penetration test limitations with a virtual machine

What are the limitations when performing a penetration test with a virtual machine instead of a physical one?
3
votes
1answer
815 views

iOS application pentest without jailbreak

Is it possible to run a security assessment on an iOS application using a non-jailbroken device? My device was recently restored (recovered - no SHSH blobs) to iOS 8.4.1 (as Apple doesn't like ...
-2
votes
2answers
257 views

Use of Nmap ssl/http md5 and SHA1 hashes

I have below stated result on of the system by map: 443/tcp open ssl/http Apache httpd 2.0.52 ((CentOS)) | http-methods: GET HEAD POST OPTIONS TRACE | Potentially risky methods: TRACE |_See ...
1
vote
1answer
57 views

Are there any pen testing tools/methods for wpa2 networks that don't require using an adapter that supports monitor mode? [closed]

I really enjoy reading and researching about networking and pentesting. Recently I heard from a friend that there are ways that can be used to get into wireless networks without needing an adapter ...
1
vote
2answers
222 views

What impact are you expecting Windows 10 Forced Updates to have on your Penetration Testing?

Unpatched Windows machines (even machines that are just a couple of updates behind) can greatly increase the chances of a successful penetration test (assuming your success criteria is gaining access ...
-1
votes
1answer
244 views

How to detect a Dionaea Honeypot, is it possible or not?

There is a question like this but the answers aren't sufficient to me. I am interested in a honeypot project and I use the dionaea honeypot. This project is really cool, but there is a problem. How ...
2
votes
2answers
349 views

How to Estimate time taken for Web Application Security Testing?

I would like to do some kind of estimation for time taken to test a website/ web application for security vulnerabilities. I will be testing websites against OWASP Top 10 Based on my understanding, ...
1
vote
1answer
58 views

Is using a website copier considered active reconnaissance in penetration testing?

New to PT and would like to test recon skills. First, is this considered passive or active recon? Second, would I be jumping into a legal gray area if I used a tool like this on a buiness' website? ...
3
votes
2answers
198 views

How would you test a new, individual SSL certificate (i.e., not a wildcard) is working properly?

I am running a web server in AWS and recently purchased an SSL cert to encrypt traffic, let's say for example.com. Since example.com is running in production, how would I actually test the cert is ...
6
votes
3answers
393 views

Do ISP Detect and Block Pen Testing Tools?

I one of the earliest books I read on security - The Basics of Hacking and Penetration Testing (978-0124116443); the author emphasized that you cannot use these Penetration Test Tools over the ...
2
votes
2answers
287 views

Will hacking (pentesting) a live website from a VM improve or hinder my hacker anonymity?

Would a pentest initiated from a VM mounted on hard drive be more or less anonymous to IDS attack or forensically traceable? Please note: I will be browsing via tor and kproxy and have all that ...
3
votes
0answers
172 views

Help locate “snot” IPS/IDS testing tool? [closed]

It seems this great tool has been lost to internet backlog somewhere. I cannot locate it anywhere. The description of tools provided is http://www.securityfocus.com/tools/category/112 If someone on ...
2
votes
0answers
148 views

Is it possible to exploit an image field in which I can upload any file? [closed]

I'm pentesting this web application developed in ASP.NET. I've found that I can upload any file as profile photo. When I later visit the profile page the site tries to display it like this: <img ...
1
vote
0answers
171 views

Tools for finding stored XSS vulnerabilities, given DB write access? [closed]

I'm aware that there are various tools for testing for XSS vulnerabilities. However, all the ones that I'm aware of (Vega, possibly BeEF, etc.) operate purely client-side. When testing for stored XSS ...
5
votes
3answers
946 views

How do RATs access computers through routers?

I've started trying to increase my networking security at my house. One thing that worries me (because other people in the house are always downloading viruses that come along with "free" games) are ...
4
votes
1answer
1k views

HTTPonly cookies

I was tasked to perform as scan against a lab and Nessus returned an "Apache HTTP Server httpOnly Cookie Information Disclosure" vulnerability. What I would like to know is what these cookies contain ...