An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

1
vote
0answers
26 views

Where to look for analysis on Cyber Security market in the UK? [closed]

I work for a company that provides IT solutions. Their service ranges from basic Desktop support to massive data center migration and deployment. Recently my boss approached me asking about the ...
1
vote
2answers
337 views

What are common security problems pen testers find? [closed]

I am doing a study in school for computer science. My research topic is pen testing, since that is what I hope to do after I graduate. While doing research I am finding things that can go wrong, but ...
1
vote
3answers
194 views

Does NAT really provide security? [duplicate]

I had an argument with someone on IRC about Network Address Translation. I was under the impression that NAT provided a layer of security to internal networks. I understand that's not the primary ...
2
votes
2answers
91 views

Vulnerability scanning: White list pentester or not?

If your company engages a third party pentester to do vulnerability scanning, do you whitelist the pentester so that they can thoroughly scan the machines on the internet, or do not whitelist them ...
1
vote
1answer
363 views

SQLMAP : Unable to dump any data

I am working on a black box web application pentesting project for a client and while testing found an error-based SQL injection. I went on to exploit it using SQLMAP, I retrieved the Database names, ...
2
votes
1answer
682 views

Trying to create a reverse bind shell from Windows to Linux

I’m trying to create an encrypted reverse bind shell from my Windows machine to my Linux machine. Being totally new to penetration testing, I’m having a little bit of trouble. First, on my Linux (...
0
votes
1answer
93 views

Penetration testing HTTP client code

I am working on HTTP client code that makes REST api calls to a server and processes responses. The client talks to server via SSL, but the SSL session is terminated at a Web Application Firewall.The ...
0
votes
3answers
184 views

What would be a hackers first steps? [closed]

I currently have access to a server and I am the "hacker" (not really just a demo for class). I have ssh'ed into her machine. What is the first thing I should care about when she logs in? Apparently ...
6
votes
6answers
810 views

Penetration test limitations with a virtual machine

What are the limitations when performing a penetration test with a virtual machine instead of a physical one?
4
votes
1answer
930 views

iOS application pentest without jailbreak

Is it possible to run a security assessment on an iOS application using a non-jailbroken device? My device was recently restored (recovered - no SHSH blobs) to iOS 8.4.1 (as Apple doesn't like ...
-2
votes
2answers
284 views

Use of Nmap ssl/http md5 and SHA1 hashes

I have below stated result on of the system by map: 443/tcp open ssl/http Apache httpd 2.0.52 ((CentOS)) | http-methods: GET HEAD POST OPTIONS TRACE | Potentially risky methods: TRACE |_See ...
1
vote
1answer
58 views

Are there any pen testing tools/methods for wpa2 networks that don't require using an adapter that supports monitor mode? [closed]

I really enjoy reading and researching about networking and pentesting. Recently I heard from a friend that there are ways that can be used to get into wireless networks without needing an adapter ...
1
vote
2answers
227 views

What impact are you expecting Windows 10 Forced Updates to have on your Penetration Testing?

Unpatched Windows machines (even machines that are just a couple of updates behind) can greatly increase the chances of a successful penetration test (assuming your success criteria is gaining access ...
-1
votes
1answer
269 views

How to detect a Dionaea Honeypot, is it possible or not?

There is a question like this but the answers aren't sufficient to me. I am interested in a honeypot project and I use the dionaea honeypot. This project is really cool, but there is a problem. How ...
2
votes
2answers
374 views

How to Estimate time taken for Web Application Security Testing?

I would like to do some kind of estimation for time taken to test a website/ web application for security vulnerabilities. I will be testing websites against OWASP Top 10 Based on my understanding, ...
1
vote
1answer
58 views

Is using a website copier considered active reconnaissance in penetration testing?

New to PT and would like to test recon skills. First, is this considered passive or active recon? Second, would I be jumping into a legal gray area if I used a tool like this on a buiness' website? ...
3
votes
2answers
214 views

How would you test a new, individual SSL certificate (i.e., not a wildcard) is working properly?

I am running a web server in AWS and recently purchased an SSL cert to encrypt traffic, let's say for example.com. Since example.com is running in production, how would I actually test the cert is ...
6
votes
3answers
418 views

Do ISP Detect and Block Pen Testing Tools?

I one of the earliest books I read on security - The Basics of Hacking and Penetration Testing (978-0124116443); the author emphasized that you cannot use these Penetration Test Tools over the ...
2
votes
2answers
297 views

Will hacking (pentesting) a live website from a VM improve or hinder my hacker anonymity?

Would a pentest initiated from a VM mounted on hard drive be more or less anonymous to IDS attack or forensically traceable? Please note: I will be browsing via tor and kproxy and have all that ...
3
votes
0answers
178 views

Help locate “snot” IPS/IDS testing tool? [closed]

It seems this great tool has been lost to internet backlog somewhere. I cannot locate it anywhere. The description of tools provided is http://www.securityfocus.com/tools/category/112 If someone on ...
2
votes
0answers
158 views

Is it possible to exploit an image field in which I can upload any file? [closed]

I'm pentesting this web application developed in ASP.NET. I've found that I can upload any file as profile photo. When I later visit the profile page the site tries to display it like this: <img ...
1
vote
0answers
174 views

Tools for finding stored XSS vulnerabilities, given DB write access? [closed]

I'm aware that there are various tools for testing for XSS vulnerabilities. However, all the ones that I'm aware of (Vega, possibly BeEF, etc.) operate purely client-side. When testing for stored XSS ...
5
votes
3answers
1k views

How do RATs access computers through routers?

I've started trying to increase my networking security at my house. One thing that worries me (because other people in the house are always downloading viruses that come along with "free" games) are ...
4
votes
1answer
1k views

HTTPonly cookies

I was tasked to perform as scan against a lab and Nessus returned an "Apache HTTP Server httpOnly Cookie Information Disclosure" vulnerability. What I would like to know is what these cookies contain ...
3
votes
2answers
829 views

enumeration and MS DCERPC

Enumeration, enumeration, and even more enumeration is the generic pentesting mantra, but enumeration is worthless if you can't read the results. I came across the Windows RPC service, where ...
3
votes
1answer
88 views

PCI DSS 3.0: 11.3 - What happens if a low risk vulnerability prevents compliance with another requirement?

As I understand the PCI DSS 3.0/3.1 penetration testing requirements, a company is compliant with 11.3 if the penetration test does not return any high risk vulnerabilities. However, what happens if ...
1
vote
0answers
266 views

Adding a binary to the firmware of a routing device [closed]

I've been playing around with a router d-link dwr-921 and found some vulnerabilities in the web interface. I still haven't managed to get shell access and now I'm thinking about modifying the firmware ...
11
votes
2answers
2k views

Custom Metasploit payload with UAC bypass

The machine I am attacking has anti-virus installed. I have managed to use Veil Framework in order to create an initial reverse shell payload that is undetected by the AV. However, UAC is enabled on ...
5
votes
1answer
271 views

How to pentest DTLS-SRTP?

I'm currently working on a penetration test about DTLS-SRTP strengths and weaknesses. But I'm stuck on an eavesdropping test using Wireshark. Yes, it's protected by SRTP, but: What's DTLS actually ...
4
votes
1answer
4k views

Rainbow tables/hash tables versus WPA/WPA2

In Wi-Fi penetration testing, is it possible to use rainbow tables/hash tables on WPA/WPA2 networks? Is there an advantage of one over the other? ...
3
votes
1answer
441 views

What is the difference between a hash table and a rainbow table, and how are they both used?

Is there much of a difference between the two tables? Can you get one from the other? (i.e. hash -> rainbow) How do they work? Are there different variables (in reference to speed, strength, resources,...
1
vote
3answers
196 views

Do I need an ASV to come out when going for an SAQ?

Our company is going for a SAQ, under PCI DSS 3.1. Do we need to pay a vendor to come out and do an on site scan, or can we use something like Nessus to do the scan on our own?
0
votes
1answer
124 views

Haskell in the security industry? [closed]

I know of a tool called msf-haskell for security but are there others? Are there any security tools that are written in haskell? other than the one above How much use will haskell be in industry, ...
9
votes
9answers
605 views

Which factors should you take into account when deciding whether users should be informed of a penetration test?

Say you are conducting a penetration test of an internal network. The internal network comprises of workstations, servers and company and contractor laptops. In an ideal world, the penetration test ...
1
vote
2answers
276 views

Precauations for web application security audit

We have planned to give our web application to a third party vendor,what were the precautionary measures which we need to take care before giving our application to third party vendor? As the vendor ...
2
votes
0answers
31 views

What features should I look for when buying a external wireless card used for the purpose of pen testing/snooping [duplicate]

I'm currently planning to buy an external wireless card for the purpose of pen testing and snooping my own network in order to learn more about it and try to create more preventive measure against ...
1
vote
1answer
255 views

Sketchy traffic from port 3030?

I am running tests on a server that is ran by a close family friend, who agreed to allow me to do so in exchange for the experience I will gather (I am currently a computer science student). On ...
0
votes
0answers
177 views

sslstrip not stripping any redirected traffic

I am using the following configuration to set up sslstrip sudo echo "1" > /proc/sys/net/ipv4/ip_forward sudo iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 666 ...
4
votes
2answers
163 views

Risks to company while performing the penetration test

I would like to know what the risks a penetration testing company faces while performing tests for clients. For example: A penetration testing company named "A" providing services for a client called ...
1
vote
1answer
1k views

Metasploit SSH Error: could not settle on kex algorithm

I am running a trial of Cobalt Strike which runs over the Metasploit Framework. I am trying to perform an SSH related attack on my laptop, and I get the error in the title for all SSH related attacks. ...
0
votes
0answers
403 views

Sysinternals tool suite not working on low priv shell

Currently oscp student. I asked this on the oscp forum yesterday, but no responses so far. I am new to infosec, but have 18 years of education / work experience in IT. As far as I can tell, ...
1
vote
1answer
91 views

Penetration testing approach - Is there a better method? [closed]

Currently looking at getting some of our web sites pen tested but there are some many companies offering the same, and who are probably using the same tools (not to mention the same wordpress layouts) ...
1
vote
0answers
964 views

Error when adding new credentials to OpenVAS [closed]

Google isn't providing me with any helpful answers. I'm running Kali Linux 64bit, with OpenVas running. I am able to run scans fine, and read results in Greenbone. However when I try to create a LSC ...
0
votes
0answers
54 views

Is there any Windows/Linux host officially available on the Internet for practicing penetration testing? [duplicate]

Is there any Windows/Linux host officially available on the Internet for practicing penetration testing? I am having continuous trouble with Virtual-Box. It is horribly slow to load and giving me ...
1
vote
1answer
223 views

Is there a backdoor in the hardware of our smartphones?

I don't know for you but I always felt like Android especially is not safe. Is somebody - the government or other - able to listen to my microphone, or access my hard drive remotely ? I'm wondering ...
6
votes
1answer
207 views

How to communicate a positive feeling about ethical hacking to non technical people? [closed]

Summary: For most non technical people, who hear about computer security either in the news because of some giant breach or in the movies, there are two kind of hackers: The professional people ...
2
votes
1answer
125 views

Concerns discussing 'illegal' activities in a job interview [closed]

Before I begin, I say 'illegal' because I guess the law is somewhat sketchy around the topic and that topic is XSS research. Apparently people have been taken to court over it and UK law does have a ...
0
votes
1answer
491 views

Does MITM attack work across Remote Systems?

I have question about if MITM works across remote systems? Often, I'm doing internal penetration test, but I'm not sure about how to do MITM attack when I am outside from that network. Does classic ...
0
votes
1answer
445 views

What is safebrowsing.google.com ?Does it impact the security testing?

I recently security tested my web application using Firefox browser and while pentesting my webapplication i noticed safebrowsing.google.com,while i diged more about it ,i could able to retreive only ...
1
vote
1answer
955 views

how to get cookies from aspx site to use it with hydra

I've been playing around with Hydra and .aspx site and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. ...