An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

3
votes
1answer
673 views

Metasploit Get Shell Through NAT

Ok first of all this is legal and I have it in writing my friend and I are attacking eachother to get better and not break the law. Setup I have a VMWare image running BT5R3. It uses VMWare's NAT ...
4
votes
3answers
272 views

Is it necessary to test all input parameters of a web application when testing its security?

We know that testing input parameters for lack of validation is one part of a black box web vulnerability assessment but, is it necessary to test ALL input parameters (parameters, cookies, HTTP ...
2
votes
3answers
336 views

How to determine the size of payloads available in MetaSploit

I've noticed that there are a lot of different payloads to choose from in MetaSploit, and the choice (assuming there's enough room in the target) usually depends on what you're trying to do. However, ...
2
votes
2answers
1k views

Sqlmap and multipart/form-data forms

I'm working on some security for a website that is built in classic ASP and MS SQL 2000. I've successfully found a couple of flawed forms that allowed SQL injections through the form fields by using ...
12
votes
2answers
436 views

When performing a PenTest against a WAF-protected site, what should a Pentester know to enhance the Test-Quality?

I'm running a WAF infront of a bunch of Webapps and we have the Apps regulary tested, and we want to improve our Tests by presenting some kind of livelogs to the testers. What informations, from ...
-2
votes
2answers
77 views

Block all kind of querys from ip [closed]

I want to check my network intrusion detection system (physical intrusion like unauthorized gadgets or devices in wifi/ethernet). Until now everything is ok, but I was wondering if I block every query ...
-3
votes
1answer
99 views

How this test prove my application is vulnerable to clickjacking attacks? [duplicate]

I have downloaded the "Clickjackingtool" and done the followings steps. Step 1:- I have opened the clickjackingtool and paste the URL and click GO button(Image 1). Step 2:- I have opened the ...
2
votes
4answers
172 views

Session token is not changed on login?

I have logged into my application and I received a session token. When I navigate to another tab, the application pertains the same session token. Is it normal behavior that the session token does ...
5
votes
4answers
553 views

Regarding cross site scripting?

My application has a user management module which uses fields like username, first name, email-id, password,.. . I tried scanning these fields and filling in malicious JavaScript to test for cross ...
-1
votes
2answers
65 views

Regarding Session management

In my application first time I have given valid credentials and then login into application at that time i saved the response using burp tool.next time i have given wrong credentials and click login ...
7
votes
4answers
1k views

How does this test prove my application is vulnerable to clickjacking attacks?

I want to know more about clickjacking. I have been reading an article about clickjacking, where the HTML code to test for clickjacking vulnerability was provided. I tried the same as described in ...
2
votes
2answers
678 views

Sqlmap fails at enabling xp_cmdshell procedure

I have been browsing the web looking for some help regarding the following issue. I am currently performing an web application penetration test, and I had come accross a beautiful blind SQL Injection. ...
2
votes
1answer
274 views

Protect an application that uses internet from packet sniffing

I developed a stand alone application such a way that, application use a remote service (using SOAP/REST) which available WWW. I am using HTTPS though out the application calls. It was perfectly ...
9
votes
2answers
5k views

Why does Hydra return 16 valid passwords when none are valid?

I've been playing around with Hydra and DVWA and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. I assume ...
17
votes
2answers
2k views

How can I spoof a phone call and make it appear to come from another phone?

I'm performing a penetration test against a company. Part of my social engineering procedure is to contact the IT department and try to convince them to that I'm an employee in the company and get ...
3
votes
1answer
475 views

How to MiTM insert an iframe using burp or another tool?

So, I am trying to obtain a cookie without the secure flag enabled over HTTPS. After reading about it, I came across an answer: You visit https://secure.example.com/ which drops a cookie on your ...
6
votes
2answers
289 views

Client-side attacks with custom malware in penetration tests

I regularly perform pen-tests against web applications, operating systems, etc. Occasionally, I'm luck enough to do a 'red-teaming' exercise and get to attack at all conceivable points of a network ...
0
votes
2answers
512 views

Blackbox vs whitebox testing your own site?

When performing a security audit of one's own site is one of these methods of testing generally considered better? Would I be wasting my time by doing blackbox testing when I have access to ...
1
vote
1answer
78 views

How do I verify versions of Adobe?

I ran a vulnerability scan against a server and it is pulling back a lot of Adobe vulnerabilities. I ran a Wireshark capture on the scan but I can't seem to write up a Wireshark filter on the packets. ...
0
votes
2answers
86 views

How do I obtain user info from SET?

I am trying to create a phishing email for a project I am on. In the email I want to link to a site that will collect IP, browser, date/time of when visited. nothing malicious but to just prove that ...
5
votes
1answer
563 views

Pen Testing ASP.NET application with Backtrack

We have developed an ASP.NET Based Enterprise Application which is is soon to be released. Now, we are concerned about the security aspects of the application. I've been looking into Backtrack 5 and ...
4
votes
2answers
444 views

Executing arbitrary commands through iptables-restore input

During a pentest I found a way to add arbitrary iptables firewall rules to a server. These rules get applied by way of the iptables-restore command, and I've been wondering whether there is any way to ...
4
votes
2answers
278 views

Vulnerability testing without the use of exploits?

I was doing some testing on a server to see if it was vulnerable to a 0-day local exploit (the exploit was for gaining root privileges using a bug in the Linux kernel). There was no real information ...
21
votes
2answers
2k views

Is it possible to write shellcode in C++?

Usually I write assembly programs and then dump their contents to get the shellcode. What I was wondering is whether I could write a C++ program instead of assembly, then dump and use that instead of ...
4
votes
2answers
720 views

Security test lab setup [closed]

I want to setup a testing lab in my basement for penetration/vulnerability testing & offensive/defensive security skills. I believe I have all the equipment that I need, and if I'll need something ...
18
votes
0answers
589 views

Where can I find a vulnerable operating system to practice pentests on? [duplicate]

I am looking for vulnerable operating systems that are used for practicing pentests. Damn Vulnerable Linux (DVL) is not maintained anymore. Are there any other simillar OS´s to download somewhere that ...
7
votes
1answer
2k views

Penetration testing Windows Phone 8 apps w/o source

I am interested in performing a penetration test of a Windows Phone 8 application for which I do not have the source code. While I can easily validate network communication security, it is more ...
1
vote
2answers
223 views

Relationship between penetration testing and false positive results

I had read through several research papers that discussed the trend of existing automation scanners to produce false positive results. I also read through some articles that showing the manual ...
3
votes
3answers
209 views

Can Penetration Testing be considered as a part of a Vulnerability Management Program?

Can Penetration Testing be considered as a part of an exhaustive Vulnerability Management program? P.S: I realise the difference between penetration testing and vulnerability assessment. But I want to ...
3
votes
3answers
296 views

Web application security standards/certificates

I'm currently working on Web application/service that (hopefully) will be used in a wide variety of ways. Of course I'm looking to attracting some commercial users as well, and as we all know, they ...
3
votes
1answer
151 views

Best option to fuzz a C Network Program [closed]

I have a client/server simple program in C. I want to test the server running on different machine with random inputs. I have looked at 'Bunny-the-fuzzer' but from what I can understand It wont be ...
4
votes
2answers
3k views

SQL Injection - Extracting database data from the page content

I have a question I am hoping someone could help with.. I am in the process of writing an SQL Injection tool from scratch (I am aware there are already excellent tools out there such as SQL Map, but ...
5
votes
1answer
852 views

How to use NMap to portscan a SonicWall that is blocking all attemtps?

It seems that SonicWall is blocking attemtps to scan its ports. I know it has some ports open, like 443, because if I access using the browser I get a web site. But when I try to use NMap I can't see ...
6
votes
3answers
778 views

TCP Sequence Prediction and it's prominence in modern systems/networks

I have a question regarding your experience of TCP Sequence Prediction that I am hoping someone could help with. I am aware of how TCP Sequence Prediction works and how the connection can be hijacked ...
-3
votes
2answers
347 views

Is it illegal to test a website and report the security bugs to them? [closed]

I am doing testing on some websites and I have found some serious bugs in those sites. I am not sure if this is legal or not. Is it ever legal? How can I find out if it's legal where I live? What ...
6
votes
5answers
1k views

I have a client that is worried about DDOS attacks on their site, and they want penetration testing. Will that help?

My client wants to look into hiring a third party to perform penetration tests on the website that we're developing for them. The website is just a simple 3-month contest site where people can upload ...
8
votes
1answer
203 views

Is there a public database of mutex names that are associated with malware?

I remember seeing something like this a while back, and it'd be incredibly useful for a project I'm working on. Essentially there was a list of mutex names, with a list of malware identifiers (e.g. ...
0
votes
2answers
111 views

Relation between boolean blind SQLi and time blind SQLi?

I am part of a team which developing web app penetration testing framework, and I am taking care of SQLi detection. When I tested multiple known vulnerable local sites found Boolean Blind flaw always ...
-2
votes
2answers
395 views

Evaluating candidates for Hacker/Pen Test Positions [closed]

If I need to employ Penetration Testers, what are the procedures to follow and how to examine candidates to know their skills and qualifications. Also, I need to know what are the ...
1
vote
1answer
161 views

Choosing the right tools [closed]

I'm totally new in the field of penetration testing, like almost no experience, only read lots of books and papers. I encountered lots of interesting tools during studying, many are famous like ...
5
votes
3answers
1k views

What dangerous characters need to be filtered from user input prior to use in a DB2 SQL query?

I'm looking to fully understand how to properly filter/escape dangerous characters from user input that will be interpolated into a DB2 SQL query. The sanitization routing that I'm analyzing works ...
1
vote
1answer
1k views

How can I monitor a named pipe?

I have installed an application that opens a named pipe that is accessible over the network. I would like to monitor/sniff what is sent to this named pipe, any idea how I can do that? Edit: Even ...
6
votes
3answers
865 views

Fresh Graduate Going into Penetration Testing

As a fresh graduate I'm wondering what my chances are of joining a great pen-testing group. Is there a risk that a career in pen-testing may one day not be needed? If so, how applicable will skills ...
6
votes
5answers
15k views

Testing for HTTP TRACE method

How can I test for HTTP TRACE on my web-server? I need to train a Tester how to verify that the HTTP TRACE method is disabled. Ideally I need a script to paste into Firebug to initiate a https ...
5
votes
5answers
3k views

Affordable web application attack tools

I've been using Burp Intruder (part of Burp suite), but in the free edition of Burp Suite the Intruder functionality is Time-throttled. As a student pen tester however, I can't justify the cost of ...
1
vote
2answers
591 views

How do I find a target on the wired network, from an attack system on Wi-Fi?

I'm trying to practice penetration testing on my home network. The target system is my desktop computer, which is connected to the network via ethernet cable. The attack system is my laptop, which is ...
5
votes
1answer
1k views

How can XML Injection be exploited , need example?

So I found this explanation for a vulnerability on some cms : The XML parser at /WorkArea/Blogs/xmlrpc.aspx is vulnerable to XML external entity attacks which can be used to Scan behind ...
0
votes
1answer
611 views

Penetration testing job entry exam [closed]

What type of hands on tests should I expect in a interview for a entry level penetration tester? And what do examiners expect a candidate to accomplish (i.e. full compromise)? The reason I ask is ...
0
votes
1answer
118 views

All I see is RPC, how do I proceed?

I finished a tiered hacking exercise, and after submitting it was told that the last tier (a machine on the network) was not possible to attack in the given exercise. The machine was only running ...
0
votes
1answer
422 views

How to conduct a disguised LSA attack against OSPF?

I want to do disguised LSA attacks on OSPF network and be able to more analyze, so I do not know how it works in practice. This is a penetration test. The attack is described in the address [+]. I ...