An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

2
votes
1answer
107 views

Is it there any way to detect payloads generated by veil framework

While pentesting, I used to generate a malicious payloads using the veil framework. The generated payload bypasses antivirus & infects the target system. Is there any way to detect veil payloads ...
3
votes
2answers
86 views

Presence of table “sqlmapoutput” in PostgreSQL database

I was pentesting a client's database and saw this one table "sqlmapoutput" in one of the user created schemas. It's a PostgreSQL DBMS. and he has no idea how it came there. There was no data in the ...
4
votes
1answer
280 views

Run NetCat as bat file instead of exe

I need to run a netcat on a remote lab machine. I can execute remote commands through the browser with Administrator rights (because of the application vulnerability) but I don't have access to the ...
2
votes
1answer
151 views

What is the benefit of an SSH tunnel vs a Netcat shell for remote communication?

On the (few) penetration tests that I've done so far, I've typically created a reverse shell with Netcat to run commands on the target machine. Now, it looks like a lot of people like to use an SSH ...
1
vote
0answers
180 views

is it possible Windows privilege escalation using freesshd keys? [closed]

I have unprivileged shell one system.By browsing all folder i found freeSSHD folder Directory of C:\Program Files\freeSSHd 09/26/2008 02:07 PM <DIR> . 09/26/2008 02:07 PM <...
0
votes
2answers
295 views

Virus-total offline Alternatives [duplicate]

These days I am working on FUDing my own written backdoor, RATs, etc. what is the alternative offline version of virus-total, if I don't want AV companies gaining my virus signature?
5
votes
0answers
301 views

Ethical Hacking Certification (CEH v9) From A Web Developer's Perspective [closed]

I just finished a week of training for the CEH v9 certification. I have two questions: What are some strategies I can take for studying for the CEH v9 certification coming at the test as a web ...
4
votes
1answer
98 views

How should I start security testing of python standalone application?

I'm looking for an answer specific to Windows/Linux standalone applications, for instance Dropbox has Windows Application written purely (I think so) in python, What steps should I follow? What are ...
4
votes
1answer
131 views

Legal insurance for penetration testers

I am currently finishing university and I am looking for work as a penetration tester. How important is it to have legal insurance for me in Germany and do I need to organise this privately. Of ...
1
vote
3answers
124 views

Penetration Test Over Internet [closed]

Is it bad practice and unprofessional to complete penetration tests from distant cities, without meeting your clients in person?
5
votes
4answers
257 views

Password guessing: Is it more effective to try many passwords against a few accounts or a few (very common) passwords against many accounts?

I was watching a security vid on Irongeek the other day (I immediately lost track of which specific vid, unfortunately) where the creator gave some interesting advice about doing live password ...
-3
votes
1answer
57 views

What are some good resources to learn Remote Code execution [closed]

I want to learn remote code execution from scratch. Is there any sort of book where I can learn from, or there is a preunderstanding required to learn remote code execution? I am desperate to learn ...
6
votes
1answer
369 views

SSH ciphers, MAC and key-exchange (and pen-tests thereof)

At work we've been trying to move our external-facing services away from a policy of inclusivity (where we tried to accept as many people as possible) to a more security-focused setup. The first step ...
0
votes
0answers
26 views

Different chanels for BeEF UI and Communication Server

I am working with BeEF tool and I want to access the UI interface using https (I don't want to communicate via VPN to access the control panel), while at the same time, I need to serve the http hooks ...
3
votes
2answers
211 views

Javascript injection in email address as username?

Is it possible for a valid email address (something that would work if used send to gmail, for varying definitions of valid (the email would be received not the exploit)) to contain javascript that ...
29
votes
5answers
6k views

How do attackers find the IP addresses of recently deployed servers?

About two months ago, I deployed an Ubuntu server with as main purpose serving a web app. However, I'm still developing the app and only gave the server IP to my coworker and some friends for testing. ...
-1
votes
1answer
219 views

hard time in bug bounty hunting [closed]

I have practiced oswap documentation and their vulnerability lab. I also read some books like the web app penetration hackers handbook. But I have no success in bug bounty hunting. I have read an ...
22
votes
3answers
5k views

Metasploit Meterpreter alternatives

These days I am testing various type of client hacking techniques, but in all scenarios I am using Meterpreter variations as payload. Now I can bypass Anti-Virus and Firewalls easily, but Symantec ...
4
votes
1answer
91 views

How to carry out a CSRF in a stealthful manner

I am a math grad student dabbling in network security. I was playing around with login cross site request forgery, and the whole point is to log somebody in. (I am a complete novice in HTML and ...
-3
votes
1answer
102 views

There is an actual working SSL MITM nowadays?

It's been a while since SSLstrip is deprecated and I see no more options for SSL mitm because of OSCP/HSTS and browser counter measures.. Is SSL so unbreakable to common sys admins? As the owner of ...
1
vote
1answer
66 views

Access to email without antivirus [duplicate]

I am doing a test where we want to asses whether an email with a benign virus in it, exits a network. I need a means to receive the test emails I am sending from inside the network, without any ...
5
votes
2answers
183 views

Stop Nmap scan and preserve XML output

Every time I run Nmap I use the -oA flag. The XML output is an important output item as I feed it into a number of parsers plus Metasploit with db_import. The --resume option can resume a scan but it ...
0
votes
0answers
101 views

Hydra command for cracking a webpage which uses <span> tag for failed login attempts

I'm trying to for crack a simple webform for testing hydra in Kali. When the webpage encounters a wrong username and password combination it pops up a message using the following html code:: <tr&...
0
votes
0answers
69 views

Using DVWA at Medium Security, how can I OutFile records?

Whilst carrying out SQL Injection attacks against the educational tool DVWA on security level Low, I could carry out a command like the below and both retrieve records and write them to a file. ' ...
0
votes
1answer
90 views

SEToolkit cloned website can be viewed over internet, but does not harvest credentials

I've been working with SEToolkit's website cloner/credential harvester. Everything works fine locally: The clone opens on the victim pc, victim inputs credentials, after submitting the victim is ...
0
votes
1answer
229 views

ISP has informed us that our server is launching brute force attacks on WordPress sites, how do we end this? [duplicate]

Misc Situation: -Server login is obtained by hacker, hacker places malicious brute force file in /hacked/bruteforce/ -Server password is then changed, hacker can still run script by navigating to ...
-1
votes
1answer
395 views

Netdiscover running on NAT interface not finding IP addresses on host-only network?

I am practicing penetration testing techniques using Kali Linux (most recent distro) and various vulnerable virtual machines (DVWA, Metasplotiable). My attack and targets are all running via VMPlayer....
1
vote
3answers
561 views

Windows 7 Exploits

I just found my old, Windows 7 Ultimate installer DVD, so I thought I would set it up in a pentest-lab type environment, see what's possible and have some fun with it. So are there any publicly ...
3
votes
1answer
47 views

Should we keep our penetration testing environment separate from other test infrastructure?

Given that there are N number of hosts on a given network being used for different purpose, should we place a machine for penetration testing or vulnerability scanning on same LAN or should we have ...
1
vote
0answers
215 views

Best practices to implement a secure CAPTCHA [closed]

What are the best practices to implement a secure CAPTCHA? Also I want to know: What is the best way to identify an insecure CAPTCHA?
1
vote
0answers
24 views

PenTesting as a career guidlines [duplicate]

it's my first post so bear with me. I live in England and am currently studying A-levels at specialist IT school and I am doing BTEC IT, Maths, Computer Science(learning c#) and Product design. I have ...
2
votes
2answers
618 views

what is the vulnerability if the DCE service on remote port is enumerated?

when I scan my server using nessus, one of the result is as follows: By sending a Lookup request to the portmapper (TCP 135 or epmapper PIPE) it was possible to enumerate the Distributed ...
-1
votes
1answer
41 views

Quantum Computation and its threats [duplicate]

Since Quantum Computers has potential to become super computers of next generation. will that make cryptography obsolete..?
1
vote
1answer
112 views

penetration testing career path [closed]

I’m a fourth year student in computer science and I want to work as a penetration tester. I studied this courses as a self-study: RHCSA RHCE CCNA Network+ Security+ C# The question now is: can I ...
1
vote
3answers
117 views

vulnerable webapp pentest challenge

So I have this challenge in pentesting to get a shell on a vulnerable webapp. I am an authenticated user and I know that the vulnerable app is kcfinder-2.51 which is a plugin for ckeditor_3.6.4. I am ...
3
votes
2answers
807 views

Penetrate Testing Java Web Applications

First thing first; this is something I have never done before. I have a web application written in Java (JSP and Servlet) and use MySQL as the database. Application is deployed in Amazon EC2, an ...
5
votes
1answer
202 views

Automatically enumerate missing patches on penetration test

Nessus, when running a credentialed scan can check patch levels and return vulnerabilities when a package is one that hasn't been updated to the latest, non-vulnerable version. What is a good way of ...
2
votes
2answers
140 views

PHP input directly to functions

I am able to directly input with next to no constraints a value into a nest of functions, but I am unsure how I could exploit this. I got this by injecting PHP code into the URL to display the source ...
2
votes
1answer
97 views

How Is It Possible That an App Connects to 0.0.0.142 IP Address? [closed]

I regularly review connections being established from apps in my phone to external services. Lately, I found Facebook connecting to 0.0.0.142. So I deleted Facebook for Android app. Now, I just found ...
0
votes
3answers
292 views

PHP url pen testing [closed]

hello all I am using a sandbox to start practicing security measures. I get given a URL which calls a filename using the url (/download.php?file=files/read_me.txt) ... I know its possible to get the ...
1
vote
1answer
240 views

In GoldenEye, what does 'strikes deferred' refer to?

Using GoldenEye to launch a DOS attack on a web server, the terminal output reads: 12928 GoldenEye strikes deferred. (0 Failed) What does 'strikes deferred' refer to?
7
votes
2answers
670 views

Extracting Individual Records from NTDS.DIT

I am working with an extremely large NTDS.DIT file. It is about 20gb. Originally, I was attempting to dump all of the hashes from the NTDS.DIT file. I tried using meterpreter domain hash dump, smart ...
-1
votes
1answer
202 views

Setting up a pentesting lab on my personal laptop [duplicate]

I'm getting myself a laptop for pen-testing using VMware etc. Theoretically speaking, if I were to replace the disk drive with a secondary hard drive, could I successfully set up the laptop to run off ...
2
votes
2answers
2k views

If using htmlentities or htmlspecialchars functions is enough for block XSS attack

I know this question was discussed on net various times. and people give some example how to bypass these functions through passing some code. But here one issue, All example of htmlentities/...
2
votes
1answer
186 views

Capturing (1x Only) HTTP POST Request [tcpdump]

Every now and then; I like to fire up tcpdump and just watch the network traffic as the packets flow on by. For example: user@host:~$ sudo tcpdump -Aevvv Will parse & print all local ...
2
votes
1answer
494 views

What is “Token” on lab.pentestit.ru?

I am new to the Information Security field. Recently I found a virtual lab called "Pentestit"(https://lab.pentestit.ru/). But I have a problem. After connecting via VPN, I can access target host: 192....
1
vote
0answers
26 views

Where to look for analysis on Cyber Security market in the UK? [closed]

I work for a company that provides IT solutions. Their service ranges from basic Desktop support to massive data center migration and deployment. Recently my boss approached me asking about the ...
1
vote
2answers
338 views

What are common security problems pen testers find? [closed]

I am doing a study in school for computer science. My research topic is pen testing, since that is what I hope to do after I graduate. While doing research I am finding things that can go wrong, but ...
1
vote
3answers
194 views

Does NAT really provide security? [duplicate]

I had an argument with someone on IRC about Network Address Translation. I was under the impression that NAT provided a layer of security to internal networks. I understand that's not the primary ...
2
votes
2answers
91 views

Vulnerability scanning: White list pentester or not?

If your company engages a third party pentester to do vulnerability scanning, do you whitelist the pentester so that they can thoroughly scan the machines on the internet, or do not whitelist them ...