An attempt to penetrate a system's security in an effort to evaluate the protections in place.
4
votes
1answer
283 views
How can XML Injection be exploited , need example?
So I found this explanation for a vulnerability on some cms :
The XML parser at /WorkArea/Blogs/xmlrpc.aspx is vulnerable to XML
external entity attacks which can be used to Scan behind ...
4
votes
2answers
212 views
What is the most appropriate way to notify/request permission from an ISP related to white-hat security testing?
In some of the posts I've read on this site such as Is hacking legal when a friend allows you to attempt to hack their system?, and Best way to test my home network from the outside, users who ...
4
votes
3answers
517 views
SQL Injection How to inject Clean/Rest URLS
I have a question I'm hoping you could help me with?
Unclean url's:
http://example.com/index.php?page=foo
http://example.com/products?category=2&pid=25
...
4
votes
1answer
100 views
Any suggestions while testing a sandboxing driver?
I am doing penetration testing of a sandboxing driver and trying to break the sandbox. It is implemented as a kernel mode driver. A sandboxed process will have :
A whitelist of disk locations for ...
4
votes
1answer
1k views
Penetration Testing Silverlight Applications
What would be the process in pentesting a Silverlight application? What would be the best method to proceed in a manual test? Any specific tools use? For example an application with lot of file ...
4
votes
1answer
1k views
Benefits to ArchPwn over BackTrack
Besides BackTrack having a cooler name and the whole Ubuntu vs. Arch Linux thing, what are the relative benefits of ArchPwn over BackTrack?
Are the tools broadly the same, or does one have better ...
4
votes
2answers
92 views
Executing arbitrary commands through iptables-restore input
During a pentest I found a way to add arbitrary iptables firewall rules to a server. These rules get applied by way of the iptables-restore command, and I've been wondering whether there is any way to ...
4
votes
2answers
357 views
SQL Injection - Extracting database data from the page content
I have a question I am hoping someone could help with..
I am in the process of writing an SQL Injection tool from scratch (I am aware there are already excellent tools out there such as SQL Map, but ...
4
votes
1answer
204 views
How to use NMap to portscan a SonicWall that is blocking all attemtps?
It seems that SonicWall is blocking attemtps to scan its ports. I know it has some ports open, like 443, because if I access using the browser I get a web site. But when I try to use NMap I can't see ...
4
votes
1answer
282 views
Trying to figure out Gmail login in Wireshark
In my pentesting lab I'm using ettercap for do a mitm to a XP VM.
I go to gmail, accepting the false certification, and here I start to sniff with wireshark. I put some false account like ...
4
votes
3answers
411 views
Web app penetration testing
I have a static website which needs to be pentested. It has only got one form which updates some data on the server and i have pentested it with some blind PHP and SQL injection.
The site is hosted on ...
4
votes
2answers
531 views
How to pentest Flash file on webapp with alowscriptaccess=samedomain?
In the course of a pentest I found a Flash movie file (swf) that loads another Flash movie through loadMovie. The HTML is this:
<embed width="388" height="350" ...
4
votes
1answer
161 views
Notifying Website w/Security Hole
As a hobby, I find security holes ranging from XSS to SQLi to LFI etc in random websites I find. (I don't exploit them). I've decided to to do a little more; I want to create a volunteer group ...
4
votes
1answer
117 views
testing for 'Dangling Cursor'
While reading the updated Top 25 exploits in the Common Weakness Enumeration I came across an exploit that I was not familiar with. It is numbered CWE-619: Dangling Database Cursor.
I was wondering ...
4
votes
1answer
174 views
Securely Store Credentials for Web Application Services in Apache
We are running a web application in python using wsgi with apache2, and must submit to a penetration test. The testers will be exploring the potential for damage if the attackers gain shell access as ...
4
votes
1answer
386 views
Do blackbox penetration tests make sense if a whitebox audit would be possible as well?
Lets assume I am responsible for an application in my company and I decide to hire security experts to perform a security audit. Lets assume further that my company owns the source code of the ...
4
votes
2answers
1k views
Command line Nessus/OpenVAS or NSE to find specific vulns?
Which methods do you use to quickly scan a network for certain vulnerabilities?
I read in the O'Reilly book Network Security Tools that Nessus had the ability to test for one vulnerability only, but ...
4
votes
1answer
129 views
The Economics and White Hat Nature of NSS ExploitHub
This question is about the economic model employed by NSS with their ExpoitHub exploit marketplace (site link) and whether it jives with the white hat claims of the company. The company has made news ...
4
votes
1answer
1k views
Are there any tools for automated penetration testing of Silverlight applications?
I'd like to find a tool to assist with automated penetration testing of Silverlight applications, in a similar vein to AppScan for webapps.
Specifically, I'm looking for a tool that can cope with ...
4
votes
0answers
638 views
Best website to learn computer security basics? [duplicate]
Possible Duplicate:
Resources to learn about security
Can someone advice on which are the good sites out there to learn the basics of computer security from?
3
votes
5answers
2k views
Testing for HTTP TRACE method
How can I test for HTTP TRACE on my web-server?
I need to train a Tester how to verify that the HTTP TRACE method is disabled.
Ideally I need a script to paste into Firebug to initiate a https ...
3
votes
2answers
609 views
Backtrack Footprints
I have been hired to to penetration assessment (scanning,testing and so on) ( I am new to the industry and learned through Offsec pentration training.)
While training, I have been doing most of my ...
3
votes
4answers
465 views
Finding all links under a website
How can i find all directories and links under a website? Note that there is no link from home page to all other pages. For example if i have a domain like this users.company.com and each user will ...
3
votes
5answers
572 views
Building a Security Training Simulation environment
My university is keen to build a security training simulation environment/platform and it will be a good learning experience for students. I Googled around to find out how it is built, but I only ...
3
votes
4answers
945 views
Problems during Pen-testing of SCADA systems
Is there a way to monitor the way the SCADA systems behave 'during pen-testing or security audit', and find out the implications of just port scans and/or monitor the state of activity while sending a ...
3
votes
5answers
3k views
Using Python for security
I love using Python for the scripts I need and for work. But I really want to learn Python for network security since I will start a NS course next year.
My question would be how would it be the best ...
3
votes
3answers
93 views
Question on information retrieved from systems that could potentially lead to exploits
Usually it is advised, when one wants to secure an application, to "provide" as little information, or better yet, no information at all to unauthorized (possibly malicious) users. I'm thinking of ...
3
votes
5answers
1k views
How can I execute a XSS with these conditions?
I am trying to learn penetration testing and I have downloaded a vulnerable application called "Bodgeit Store". I have finished almost all the challenges except one which is to execute a Cross-Site ...
3
votes
4answers
470 views
Definitive certification list [closed]
What are a list of useful certificates for someone who wants to work on the information security field?
I have heard of CISSP but from what I have understood it is way too advanced for someone new to ...
3
votes
5answers
525 views
Affordable web application attack tools
I've been using Burp Intruder (part of Burp suite), but in the free edition of Burp Suite the Intruder functionality is Time-throttled. As a student pen tester however, I can't justify the cost of ...
3
votes
2answers
2k views
Could Nmap scan switches/routers
Nmap can scan and sometimes successfully detect the running OS in the remote host. However, can nmap scan routers and switches? Most of them use an embedded system.
3
votes
3answers
151 views
Web application security standards/certificates
I'm currently working on Web application/service that (hopefully) will be used in a wide variety of ways. Of course I'm looking to attracting some commercial users as well, and as we all know, they ...
3
votes
5answers
126 views
How to introduce delay in scanning tools that do not implement delay without touching source code?
Usually scanning tools implement a switch in order to delay requests and not flood the target. Sometimes there tools that do not implement this delay option.
Is there a way to delay packets from ...
3
votes
2answers
151 views
How to red team against firewalled architecture?
Prior Knowledge
I understand the types and differences between firewalls.
I have (what I believe to be) a relatively good mental model of a firewall.
I understand routing, iptables, signature ...
3
votes
3answers
273 views
Physical access: in-scope for penetration testing or not?
When pentesting a network, should a pentester consider physical access to devices (e.g. allow use of a USB stick)? Or is this out of scope?
3
votes
2answers
2k views
Where can I download vulnerable Windows OS images to practice penetration testing?
My objective is to learn and practice all the vulnerabilities and their exploitation on vulnerable OS.
3
votes
2answers
157 views
Vulnerability testing without the use of exploits?
I was doing some testing on a server to see if it was vulnerable to a 0-day local exploit (the exploit was for gaining root privileges using a bug in the Linux kernel). There was no real information ...
3
votes
3answers
534 views
Android Pen Testing
I have been pen testing a random android app that uses POST method to send data to a remote server using HTTPS.
I have set up a proxy and am able to intercept the traffic, however the POST method ...
3
votes
1answer
246 views
Is there a way to use multiple firewalls / antivirus for penetration testing?
I don't really know how to do either, but I was wondering if it was possible to have multiple firewalls / virus scanners installed at once, and use a 3rd party program to specify which one is running ...
3
votes
1answer
544 views
How Chrome avoids sslstrip?
I'm trying out Moxie's sslstrip tool in my pentester lab. It works in all my VM's but no in all browsers. Firefox and IE are vulnerable but Chrome seems to has a protection against.
Anyone know how ...
3
votes
1answer
181 views
tcp seq number prediction
While testing a system, nmap told me that the tcp seq number prediction is really low, (trivial joke). There is only one system in the whole range that gives me that answer. Some papers, e.g. a ...
3
votes
1answer
292 views
How to determine which security testing method to use if resources are limited
My resources are limited, and thus i am wondering what methodology can I apply to know where black box testing is best fit, where white box testing is best fit? Or even where pen testing is better ...
3
votes
1answer
2k views
VirtualBox Pen Test Lab Setup
So i'm trying to set up a pen test lab in virtual box on my windows 7 host.
I have 3 guest OS's installed:
1.) BackTrack5
2.) Centos 5 Server/Snort (My Snortbox)
3.) Win XP (Unpatched)
I have 3 ...
3
votes
3answers
111 views
Can Penetration Testing be considered as a part of a Vulnerability Management Program?
Can Penetration Testing be considered as a part of an exhaustive Vulnerability Management program?
P.S: I realise the difference between penetration testing and vulnerability assessment. But I want to ...
3
votes
2answers
738 views
Security analysis tools for iOS 6 [closed]
Searched over web, however could not find much info on security analysis tools for iOS6.
Can somebody point me to the security analysis (Static Code Analysis & Pen Testing) tools for iOS6?
3
votes
1answer
76 views
How and where to begin on the Return of Web Application Security Investment?
While there is a vast trove of vulnerabilties, threats and their corresponding countermeasures, the amount of information on Infosec Economics (Specifically for web applications) seems scarce.
What ...
3
votes
1answer
160 views
How do attackers gather remote feedback for identifying and exploiting buffer overflows?
Local buffer overflows are relatively easy to understand: throw some input at an interface and see if the process fails with a core dump or similar. However, in my mind, this kind of exploit works ...
3
votes
3answers
130 views
What is a simplest “Crash an application” demonstration to get access to a system?
For a presentation (10-15 mins) purpose what is the simplest demonstration of "crashing an application" on a machine can be done.
3
votes
3answers
344 views
would preparing for CCNA add “significantly” to my knowledge as a penetration tester?
I'm a post graduate student and self taught programmer. I concentrated on Computer Networks & Operating Systems more during my undergraduate studies. I can explain usually used protocols by ...
3
votes
1answer
362 views
WPA vulnerabilities for pentest
As I am a network&IT enthusiast, I was asked by a friend to pentest his WPA network.
I'm wondering if there is anything else I can do beside a bruteforce attack, trying the KARMA attack on ...
