An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

1
vote
1answer
74 views

Are there any tools/methods to probe a web app from diffferent IPs?

I am currently reading "Metasploit: The Penetration Tester's Guide" and I came across the following paragraph in the book (in the 1st chapter) During intelligence gathering, you attempt to ...
0
votes
1answer
259 views

Resources for pentesting cloud based services/web-apps?

I want to know about some of the good resources for pen-testing cloud based services or web-apps (such as AWS). I googled for it but there are really few good resources out there. For example, I liked ...
1
vote
3answers
298 views

What exactly does one get from a Nmap Scan?

I know nmap is a port scanner and its output shows all the open ports, the services running on those ports, the underlying OS and technology, etc. What should one take from this result in easiest ...
0
votes
2answers
47 views

Manipulating data during a MiTM

I'm trying to learn some attack methods by myself and I have hit a wall where I can't find any information. I have successfully performed an ARP MiTM between 2 systems and I am able to sniff the ...
1
vote
1answer
290 views

Penetration testing real-life practice

I see a lot of similar question but my is different. I had done a lot of challenges like Kioptrix and De-ice. But I'm not sure that this is real life pen testing. I mean this is so simple only nmap ...
3
votes
1answer
515 views

Syllabus for self-studying information security and Pentesting [closed]

I'm someone who's distant, industry-wise, from technology. I'm actually in the medical field. That said, I'm very interested in technology and specifically in information security. I'd like to make a ...
0
votes
0answers
98 views

HTTPS site not being captured by BURP

I am testing a website, basically mapping the site using burpsuite. But there is one link(https) that I can not process while the proxy on firefox is enabled. It asks me for certificates and when I ...
0
votes
0answers
253 views

Since when Access-Control-Allow-Credentials is required?

About several years ago I found a website during a pentest which had the Access-Control-Allow-Origin header set to "*". I made a POC to get the response of a webpage from an untrusted domain. The goal ...
0
votes
1answer
164 views

Some queries regarding SQL injection

[I'm not really sure if I should be posting this on SO or here. I think my questions might be answered if I have had a good experience with MySQL. But, I don't. So probably, most of you will ...
0
votes
1answer
416 views

Testing Basic Authentication with ncrack

I'm conducting some basic pen testing against a page protected with Basic Authentication. I've sucessfully tested with Medusa and Hydra but am struggling to get the syntax correct for ncrack. The ...
0
votes
0answers
51 views

Changing the string format of Burp generated certificates

The certificate verification in a piece of software I'm poking uses UTF-8 encoded strings to verify the certificate's host name. Certificates generated by Burp suite, however, use the custom type ...
0
votes
0answers
32 views

Windows tokens manipulation

I am creating a demo of the infamous windows tokens manipulation. the scenario I am using is as follows: A single PC connected to the domain controller. 2 users are signed in the DC through that ...
1
vote
0answers
63 views

Ncat output problem

I am using ncat for creating reverse connections and through that i open a cmd. my problem is that for commands that there is a lot of out put such as dir in a folder with a large number of files, ...
-1
votes
1answer
75 views

Looking for a meterpreter script repository [on hold]

I've read a couple entry-level metasploit books. Both of them praised the metasploit open framework. Additionally I have done some Google research but have not found meterpreter scripts for simple ...
0
votes
1answer
214 views

BurpSuite: Anonymity

Are the attacks being performed using burpsuite detectable? If yes, how should we stay anonymous/secure while conducting web application reconnaissance?
0
votes
1answer
163 views

“No hack no fee” pen-testing agreements [closed]

A common theme in security engineering is that perfect security is impossible (or at least highly unlikely). Consider Johnston's Infinity Maxim: There are an unlimited number of security ...
51
votes
13answers
7k views

What makes it illegal to use the information learned by exploiting a bug?

According to news reports, arrests have already been made in relation to the Heartbleed bug. It sounds like this person managed to gain access to the website's database by capturing the credentials ...
1
vote
1answer
137 views

Ethicality of websites that test other sites for Heartbleed [closed]

I realize that this may be more of an opinion type question, but I see a lot of questions on ethics in this forum so I hope mine fits in. I was reading a BBC article about Heartbleed, and in the ...
0
votes
1answer
207 views

Auto deploy war file (backdoor/shell) to particular folder [closed]

I am in the midst of a pentest. I have managed to uploaded a war shell (backdoor) in c:\test\ which is automatically deployed in a folder, for example c:\test\tmpbrowser.war. The application which I ...
1
vote
1answer
231 views

Failed to connect to netcat reverse shell

I am doing an exercise of PentesterLab, I've got a webshell called 1.pdf, and it can be included in index.php as a PHP file. It contains code like this: %PDF-1.4 <?php echo system($_GET["cmd"]); ...
-1
votes
2answers
118 views

Identify an attacker's web vulnerability scanner by IP request rate [closed]

When conducting a penetration test, I run into difficulties because the defense system can identify an attack due to the high rate of requests, and then block the IP address Is there a way to avoid ...
-3
votes
2answers
260 views

Learn penetration testing in home environment without a lot of money [closed]

I saw this post How to learn penetration testing at home? and I decide to ask about my self. I want to get into cyber security. So the post I send is about web security, I'm not interested in it. I ...
4
votes
4answers
568 views

Effectiveness of Interactive Application Security Testing

There are a number of IAST tools available on the market such as Acunetix Web Vulnerability Scanner and HP WebInspect Real-Time. How effective are these at finding vulnerabilities? Is there any ...
0
votes
2answers
524 views

Is sqlmap traceable?

Is sqlmap still traceable when we use --tor --user-agent and macchanger? For example: sqlmap -u "[vulnerable_website_link]" --tor --user-agent="Mozilla/5.0 (compatible; Googlebot/2.1; ...
9
votes
4answers
2k views

What features should I look for in a Wifi card used for wifi snooping / penetration testing?

I'm looking to purchase a wifi card to help me learn about wifi network penetration testing and other associated issues but I was wondering if there were any features of a wifi card I should look out ...
0
votes
4answers
258 views

Someone knows about online labs? [closed]

I'm looking for an online training lab for pentesting/hacking and security. I've found one at hacking-lab but it's seems troublesome to work with and it has some issues on VPN server authentication. ...
0
votes
2answers
606 views

How can I Bypass ip block mechanism?

I want to pentest a specific web application with automatic tool like Burp Suite and IBM Security AppScan. However, the website uses a prevention mechanism for attack. When I started automatic tool, ...
0
votes
1answer
134 views

Fuzzdb detected as Trojans [closed]

I recently downloaded fuzzdb from http://code.google.com/p/fuzzdb/ and my antivirus kept on detecting some of the files as Trojans. I need to know if these files are safe?
0
votes
1answer
320 views

Are there any free, premade penetration testing labs? [duplicate]

I've already assembled a lab consisting of Kali, Metasploitable, and a Windows XP machine, but are they're any premade lab solutions available that offer up a bit more complexity or even predesignated ...
3
votes
1answer
2k views

Setup of Kali Linux for reverse shell connections over the internet

I am running Kali Linux as a VM on my Windows machine which is NAT'd behind my company network, if I wish to pen test a website for a client and believe that a reverse shell is possible, what is a ...
0
votes
3answers
69 views

Is there a way to program to discover sites transmitting user/pass in plaintext (Not using SSL) for penetration testing? [closed]

I have a CSV/Excel file which in which I want to test out the links which do not have SSL but ask for Username / Password. Is there a program which determines if each site on a list encrypts its login ...
1
vote
2answers
442 views

Internal / external Penetration testing a webserver - PCI

the PCI DSS document states: 11.3.2 Perform internal penetration testing at least annually and after any significant infrastructure or application upgrade or modification (such as an operating ...
2
votes
3answers
428 views

Is STARTTLS a security-vulnerability?

After reading about STARTTLS and SSL and performing a scan/pentest at our server I have the next question regarding security: Is this STARTTLS warning below a security-vulnerability? And if so why? ...
1
vote
1answer
849 views

File upload vulnerability

I am trying to pentest a webapp challenge. Is the following control code vulnerable to file upload? I would like to upload a php shell... I am able to upload shell.php.jpg file but I receive the ...
0
votes
1answer
88 views

Impersonating Law Enforcement

Obviously impersonating a law enforcement officer on an engagement is illegal but badguys don't care about the law. If a company wanted to allow impersonating LE and have it in clear writing in the ...
0
votes
0answers
86 views

How to start career as Penetration Tester? [duplicate]

I'm currently studying BTEC Diploma in IT LVL3, and so far have basic command of C#, C++, and am going to learn Java basics soon, as we start a new class unit. I also plan on going to the university. ...
0
votes
1answer
128 views

Automatic exploit searches

How to automatically search and download exploits which matches for example with kernel release ? Is there for example a public REST web service which provide data in XML or JSON format to a client ...
3
votes
2answers
327 views

Techniques for enumerating enabled apache modules

A common issue noted by security testers is that the Apache web server is reporting a version in headers which is older than the latest available one. This usually leads to CVE listings detailing the ...
0
votes
1answer
79 views

Security standard for web-based Tele-Radiology software

I am preparing a test plan for the security penetration testing of a software solution that manages patient information (HIPAA compliance) and allow the user to access to it from the web. Does anyone ...
1
vote
0answers
563 views

The overlapping fragment attack using Scapy

How to use Scapy to overwrite a part of the TCP header information of the first fragment, which contained data that was allowed to pass through the firewall, with malicious data in subsequent ...
1
vote
1answer
1k views

Trying to reproduce a file upload compromise on Joomla

After telling my workmates and boss that we had a very critical lack of security controls, finally we got compromised! They had a Joomla 1.5 which was exploited using a file upload vulnerability. WSO ...
0
votes
0answers
25 views

Deliberately-Vulnerable webapp for security education [duplicate]

A year or so ago I was playing around with an apache webapp I found that was designed for web exploitation practice. It was simple to use, I just downloaded the file, unzipped it, and placed it in the ...
1
vote
1answer
584 views

Hydra gives wrong passwords

I've been trying to use hydra (educational way) but with no success. The site method is http-post but performed by ajax (should it be a problem? I think not). After execute the command I got an output ...
1
vote
1answer
203 views

Problems with l0phtcrack

I recently wrote a website for my company and have been asked to Pen test it as well as the server. Have run SQL map and no vulnerabilities there, however I want to check if my hash and things are ...
2
votes
2answers
1k views

Major differences between Kali and SecurityOnion

Curious about the major differences between Kali Linux and SecurityOnion. Do you think it would be easy or useful to replicate what has been done with SecurityOnion on Kali? Why is there such a ...
2
votes
2answers
124 views

Where is the Line? [closed]

A comment posted on one of my questions the other day raised a question in my head. I know that many site admins appreciate users reporting bugs and security holes, and as a user I appreciate people ...
2
votes
2answers
657 views

API Security Testing Methodologies

I have been encountering more and more clients needing their API (usually REST) endpoints tested for vulnerabilities and wanted to reach out to see if anyone has some recommendations beyond what I ...
2
votes
2answers
743 views

CentOS for security testing?

I am a QA Engineer, but have been tasked with creating a security testing platform. I have many years with Backtrack/Kali and my primary OS are Arch and Ubuntu. The Systems guys here gave me a CentOS ...
-2
votes
1answer
387 views

Injected Images

I want to learn all about that. How can we inject code into an image? Is the code must be php? Or is javascript or HTML works too? How I find documentation about this article? I'm a newbie about ...
8
votes
2answers
389 views

Are userid and password needed in order to pentest a website?

We are a company that has many web applications developed in ASP.NET. Our Internet service provider (Telefonica) wants to test our web sites looking for vulnerabilities. For that, they are asking us ...