An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

5
votes
6answers
203 views

Is it useful to determine the name of the server software while doing a penetration test?

Getting the name of the server software through netcat or curl or any other method, is really useful? I mean, OS fingerprinting is useful in order to tailor an attack. For example with regard to OS ...
5
votes
3answers
648 views

Open source web application penetration testing community

I do web development for a living but my real passion is security. I have worked with countless open source web application/framework and I have found vulnerabilities in most of them. The main cause ...
5
votes
5answers
3k views

Affordable web application attack tools

I've been using Burp Intruder (part of Burp suite), but in the free edition of Burp Suite the Intruder functionality is Time-throttled. As a student pen tester however, I can't justify the cost of ...
5
votes
4answers
4k views

Does setting a WiFi AP to channel 14 avoid the most common detection methods used in Europe or the Americas?

The legally allowable band for WiFI in the US covers channels 1-11. Europe goes to 13, Japan to 14. I suspect that most tools use the WiFi driver of the machine and only scan for the channels it is ...
5
votes
3answers
1k views

What dangerous characters need to be filtered from user input prior to use in a DB2 SQL query?

I'm looking to fully understand how to properly filter/escape dangerous characters from user input that will be interpolated into a DB2 SQL query. The sanitization routing that I'm analyzing works ...
5
votes
1answer
1k views

How can XML Injection be exploited , need example?

So I found this explanation for a vulnerability on some cms : The XML parser at /WorkArea/Blogs/xmlrpc.aspx is vulnerable to XML external entity attacks which can be used to Scan behind ...
5
votes
2answers
223 views

What security concerns should one bear in mind when hacking open-invitation websites?

There's a couple other questions already addressing legalities, ethics, and liabilities of hacking websites with open invitations. What are legal/ethical concerns to bear in mind, when hacking ...
5
votes
2answers
347 views

What is the most appropriate way to notify/request permission from an ISP related to white-hat security testing?

In some of the posts I've read on this site such as Is hacking legal when a friend allows you to attempt to hack their system?, and Best way to test my home network from the outside, users who ...
5
votes
1answer
562 views

Pen Testing ASP.NET application with Backtrack

We have developed an ASP.NET Based Enterprise Application which is is soon to be released. Now, we are concerned about the security aspects of the application. I've been looking into Backtrack 5 and ...
5
votes
3answers
3k views

How do WPA/WPA2 cracking programs know when the PMK/PTK is correct?

I'm doing some pen-testing on my home wlan with aircrack-ng and it got me wondering how programs like these(eg. aircrack-ng, cowPatty, pyrit etc) really work. Specially, when performing a ...
5
votes
2answers
130 views

How to manage pen testing byproducts?

Often when doing a pen test you need to hammer certain parts of the site that might be visible to other users. If, for example, you suspect that a comment section is vulnerable to XSS, you might ...
5
votes
4answers
1k views

MDK3 warns about WPA2 downgrade - how do I find the key in Wireshark?

While stress testing my router using MDK3, I got the message "REALLY BIG WARNING!!! Seems like a client connected to your target AP leaks PLAINTEXT data while authenticating!!" I viewed the tool ...
5
votes
1answer
847 views

How to use NMap to portscan a SonicWall that is blocking all attemtps?

It seems that SonicWall is blocking attemtps to scan its ports. I know it has some ports open, like 443, because if I access using the browser I get a web site. But when I try to use NMap I can't see ...
5
votes
3answers
647 views

What does WEP access point show during aircrack-ng attack?

I bought an old, used WRT-54G () which strangely enough, was running DD-WRT v24-sp2. Weird what turns up at yard sales. I want to try the "aircrack-ng" WEP cracking procedure on it. The criteria ...
5
votes
1answer
256 views

Securely Store Credentials for Web Application Services in Apache

We are running a web application in python using wsgi with apache2, and must submit to a penetration test. The testers will be exploring the potential for damage if the attackers gain shell access as ...
5
votes
1answer
429 views

question for pentesters: PHP proc_open() in safe_mode

Can anybody explain to me how proc_open() is affected when PHP is running in safe_mode? As far as i have noticed, the command to execute is appended to a '/' - is there anything else and is it ...
4
votes
3answers
3k views

How do you detect load balancing?

Scenario You need to PenTest XYZ.com. You expect, because it is a high traffic site, that multiple servers are being used with a load balancer. Question Aside from pulling the MACs (which are ...
4
votes
4answers
2k views

Finding all links under a website

How can i find all directories and links under a website? Note that there is no link from home page to all other pages. For example if i have a domain like this users.company.com and each user will ...
4
votes
2answers
204 views

Builder vs. Breaker - Do developers make good pen testers & vice versa

Do developers necessarily make good penetration testers & vice versa? The reason I ask is that I find I have much more of a knack for figuring out how an existing piece of software works and can ...
4
votes
2answers
718 views

Security test lab setup [closed]

I want to setup a testing lab in my basement for penetration/vulnerability testing & offensive/defensive security skills. I believe I have all the equipment that I need, and if I'll need something ...
4
votes
3answers
836 views

Create a page to experiment with SQL injection [closed]

This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
4
votes
1answer
377 views

Why does Directory traversal attack %C0%AF work?

Introduction: I am trying to learn the basics of Directory Traversal. Question: While trying to understand the 2-Byte Unicode conversion of characters, I came across this_SANS ARTICLE that explains ...
4
votes
3answers
143 views

Is it reasonable to do a pentest (or other non-theoric security audit) over a critical infrastructure?

Almost all agree that during a pentest it is impossible to guarantee the integrity of the target (Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in ...
4
votes
3answers
272 views

Is it necessary to test all input parameters of a web application when testing its security?

We know that testing input parameters for lack of validation is one part of a black box web vulnerability assessment but, is it necessary to test ALL input parameters (parameters, cookies, HTTP ...
4
votes
1answer
132 views

Any suggestions while testing a sandboxing driver?

I am doing penetration testing of a sandboxing driver and trying to break the sandbox. It is implemented as a kernel mode driver. A sandboxed process will have : A whitelist of disk locations for ...
4
votes
2answers
945 views

How to pentest Flash file on webapp with alowscriptaccess=samedomain?

In the course of a pentest I found a Flash movie file (swf) that loads another Flash movie through loadMovie. The HTML is this: <embed width="388" height="350" ...
4
votes
1answer
2k views

Penetration Testing Silverlight Applications

What would be the process in pentesting a Silverlight application? What would be the best method to proceed in a manual test? Any specific tools use? For example an application with lot of file ...
4
votes
2answers
278 views

Vulnerability testing without the use of exploits?

I was doing some testing on a server to see if it was vulnerable to a 0-day local exploit (the exploit was for gaining root privileges using a bug in the Linux kernel). There was no real information ...
4
votes
1answer
3k views

VirtualBox Pen Test Lab Setup

So i'm trying to set up a pen test lab in virtual box on my windows 7 host. I have 3 guest OS's installed: 1.) BackTrack5 2.) Centos 5 Server/Snort (My Snortbox) 3.) Win XP (Unpatched) I have 3 ...
4
votes
1answer
451 views

How to determine which security testing method to use if resources are limited

My resources are limited, and thus i am wondering what methodology can I apply to know where black box testing is best fit, where white box testing is best fit? Or even where pen testing is better ...
4
votes
1answer
2k views

Benefits to BlackArch over Kali

Besides BlackArch having a cooler name and the whole Ubuntu vs. Arch Linux thing, what are the relative benefits of BlackArch over Kali? Are the tools broadly the same, or does one have better ...
4
votes
2answers
443 views

Executing arbitrary commands through iptables-restore input

During a pentest I found a way to add arbitrary iptables firewall rules to a server. These rules get applied by way of the iptables-restore command, and I've been wondering whether there is any way to ...
4
votes
2answers
3k views

SQL Injection - Extracting database data from the page content

I have a question I am hoping someone could help with.. I am in the process of writing an SQL Injection tool from scratch (I am aware there are already excellent tools out there such as SQL Map, but ...
4
votes
1answer
446 views

Trying to figure out Gmail login in Wireshark

In my pentesting lab I'm using ettercap for do a mitm to a XP VM. I go to gmail, accepting the false certification, and here I start to sniff with wireshark. I put some false account like ...
4
votes
3answers
538 views

Web app penetration testing

I have a static website which needs to be pentested. It has only got one form which updates some data on the server and i have pentested it with some blind PHP and SQL injection. The site is hosted on ...
4
votes
1answer
173 views

Notifying Website w/Security Hole

As a hobby, I find security holes ranging from XSS to SQLi to LFI etc in random websites I find. (I don't exploit them). I've decided to to do a little more; I want to create a volunteer group ...
4
votes
1answer
589 views

How to perform security exploits/penetration on devices like iPhone's, PSP's, and Android to run your owncode?

I was really interested in getting into performing exploits to install my own code on devices, instead of waiting for others. I figure its a great way for me to learn about security on devices like ...
4
votes
1answer
528 views

Do blackbox penetration tests make sense if a whitebox audit would be possible as well?

Lets assume I am responsible for an application in my company and I decide to hire security experts to perform a security audit. Lets assume further that my company owns the source code of the ...
4
votes
2answers
2k views

Command line Nessus/OpenVAS or NSE to find specific vulns?

Which methods do you use to quickly scan a network for certain vulnerabilities? I read in the O'Reilly book Network Security Tools that Nessus had the ability to test for one vulnerability only, but ...
4
votes
2answers
998 views

Web Crawler for ASP.NET site

Do you know any crawler/spider software, which is able to go through ASP.NET application, not ASP.NET MVC, but the one full of __doPostBack JavaScript functions on every link/button/change event? If ...
4
votes
1answer
138 views

The Economics and White Hat Nature of NSS ExploitHub

This question is about the economic model employed by NSS with their ExpoitHub exploit marketplace (site link) and whether it jives with the white hat claims of the company. The company has made news ...
4
votes
1answer
1k views

Are there any tools for automated penetration testing of Silverlight applications?

I'd like to find a tool to assist with automated penetration testing of Silverlight applications, in a similar vein to AppScan for webapps. Specifically, I'm looking for a tool that can cope with ...
4
votes
0answers
649 views

Best website to learn computer security basics? [duplicate]

Possible Duplicate: Resources to learn about security Can someone advice on which are the good sites out there to learn the basics of computer security from?
4
votes
5answers
2k views

eCPPT vs. OSCP Certification

I am a soon to be college student. I am looking to become certified in pentesting for both personal interest as well as to be able to have something that would look good to future employers. Both ...
3
votes
6answers
2k views

Decent programmer looking to learn to Hack

I'm a decent programmer, fluent in several languages. Python, Ruby, JavaScript, Haskell, and Scheme are my favorites. I'm currently adding Perl to the mix. I haven't done much "low-level" ...
3
votes
8answers
3k views

Pen Testing Practice Box?

Are there any windows based pen testing vms out there similar to Metasploitable based on ubuntu? Just starting to learn hacking and such a box would be very helpful.
3
votes
5answers
852 views

Building my own Darkspace

I have searched through the internet about creating a darknet and there is a confusion. There are two definitions, the first one is network used for private p2p (like freenet) and another one that ...
3
votes
2answers
782 views

Backtrack Footprints

I have been hired to to penetration assessment (scanning,testing and so on) ( I am new to the industry and learned through Offsec pentration training.) While training, I have been doing most of my ...
3
votes
4answers
1k views

Problems during Pen-testing of SCADA systems

Is there a way to monitor the way the SCADA systems behave 'during pen-testing or security audit', and find out the implications of just port scans and/or monitor the state of activity while sending a ...
3
votes
5answers
1k views

Building a Security Training Simulation environment

My university is keen to build a security training simulation environment/platform and it will be a good learning experience for students. I Googled around to find out how it is built, but I only ...