An attempt to penetrate a system's security in an effort to evaluate the protections in place.
4
votes
1answer
161 views
Notifying Website w/Security Hole
As a hobby, I find security holes ranging from XSS to SQLi to LFI etc in random websites I find. (I don't exploit them). I've decided to to do a little more; I want to create a volunteer group ...
0
votes
1answer
302 views
Which CTF Penetration Test? [duplicate]
Possible Duplicate:
What “hacking” competitions/challenges exist?
I want to test my penetration test skills.And i solved a few CTF.But it is not enough.I want to solve more ctf ...
5
votes
2answers
162 views
Security Researchers: How do you choose what services or software you are going to audit next?
Security Researchers: How do you choose what services or software you are going to audit next?
I am referring to finding vulnerabilities and developing exploits in various applications. I am ...
3
votes
5answers
271 views
Laws on Programming Security Tools
I am currently working on some POST GATHER modules for the Metasploit Framework the idea is that after a shell is spawned on the target, it will gather certain files from the target such as chat logs. ...
10
votes
4answers
2k views
Legitimately using tools like Havij
I'm a developer, not a security guru. My primary focus is ensuring that I'm not introducing security holes through bad programming. I understand how to code to protect against the OWASP Top 10, as ...
5
votes
2answers
328 views
What security measures to have before openly allowing security researchers to hack your site
As some kind of a follow-up from my previous question - which was asked from the security researcher/penetration tester point of view:
(Thanks to Rory McCune for pointing this out) There seem to be a ...
5
votes
2answers
176 views
What security concerns should one bear in mind when hacking open-invitation websites?
There's a couple other questions already addressing legalities, ethics, and liabilities of hacking websites with open invitations.
What are legal/ethical concerns to bear in mind, when hacking ...
0
votes
3answers
1k views
PING BLOCKING: How to do? How to break?
I can access each page of a site through the browser (firefox). I can also see the ip and port address in firebug, but when I open cmd->ping site ->it says "request timeout".
I also tried traceroute. ...
10
votes
2answers
492 views
What are legal/ethical concerns to bear in mind, when hacking websites with open invitations?
I was reading another question which mentions a site that had a page inviting people to try to hack it, and it made me wonder.
Lets assume, for the sake of this rather hypothetical question, that a ...
40
votes
4answers
3k views
I think I accidentally DoS'd a website. What should I do?
I was browsing a website, and stumbled across a sample scheme for password-protecting web pages. The owner of the website specifically had a page that invited people to attempt to hack it.
I wanted ...
15
votes
1answer
2k views
Mac OS X from an IT Security Practitioners' Perspective?
What does the Mac OS X offer that it has been recently attracting users with IT security focus?
There are sites that specifically focus on "hacking" with OSX, such as machacking.net. Defcon has an ...
3
votes
1answer
2k views
VirtualBox Pen Test Lab Setup
So i'm trying to set up a pen test lab in virtual box on my windows 7 host.
I have 3 guest OS's installed:
1.) BackTrack5
2.) Centos 5 Server/Snort (My Snortbox)
3.) Win XP (Unpatched)
I have 3 ...
1
vote
2answers
1k views
What is the best tool to anonymize your scans (network/ports)? [closed]
What are the best tools to anonymize my port scanners and vulnerability assessment tools (like nmap , metasploit ) ...?
I have been using Backtrack and tor network with proxychains to do this, but ...
5
votes
2answers
201 views
What fraction of vulnerabilities does black-box pentesting find?
Black-box penetration testing is one to check a web application for vulnerabilities. It can find some vulnerabilities, but not all.
What fraction of vulnerabilities does black-box pentesting find, ...
3
votes
1answer
376 views
How to perform security exploits/penetration on devices like iPhone's, PSP's, and Android to run your owncode?
I was really interested in getting into performing exploits to install my own code on devices, instead of waiting for others. I figure its a great way for me to learn about security on devices like ...
7
votes
3answers
3k views
pros and cons of a bootable BackTrack instance vs installed
I've been wanting to mess around some with BackTrack to get a better understanding of some of the tools out there for penetration testing. I have a Linux box that isn't doing much right now that I was ...
4
votes
3answers
748 views
BlackBerry handheld penetration testing
Are there any relevant resources, tools or documents about penetration testing of BlackBerry handhelds?
3
votes
2answers
593 views
Backtrack Footprints
I have been hired to to penetration assessment (scanning,testing and so on) ( I am new to the industry and learned through Offsec pentration training.)
While training, I have been doing most of my ...
3
votes
1answer
76 views
How and where to begin on the Return of Web Application Security Investment?
While there is a vast trove of vulnerabilties, threats and their corresponding countermeasures, the amount of information on Infosec Economics (Specifically for web applications) seems scarce.
What ...
3
votes
1answer
156 views
How do attackers gather remote feedback for identifying and exploiting buffer overflows?
Local buffer overflows are relatively easy to understand: throw some input at an interface and see if the process fails with a core dump or similar. However, in my mind, this kind of exploit works ...
1
vote
2answers
868 views
Expected cost and time frame for black box pen testing?
I work for a major publicly traded company and we need some external black box pen testing done on a Win32 executable. This exe is used in a large client server infrastructure and is a central piece ...
2
votes
1answer
261 views
Can fuzzing be considered a software testing technique for any vulnerability type
I'm doing a research on fuzzing and I would like to know the answer to the question in the title. The cvedetails uses the following categories for vulnerabilities:
Bypass a restriction or similar
...
2
votes
2answers
587 views
Tiger team versus red team?
What's the difference between a tiger team and a red team? Are there any other "color" teams out there (relevant to IT security)?
0
votes
1answer
373 views
Iphone App Pen Test Guidance [closed]
I'm going to be studying pentesting iPhone apps. I'm a beginner in this area, and would like some guidance on the prerequisites of pen testing an iphone app, the details of the Mac machine that I'd ...
5
votes
1answer
315 views
question for pentesters: PHP proc_open() in safe_mode
Can anybody explain to me how proc_open() is affected when PHP is running in safe_mode?
As far as i have noticed, the command to execute is appended to a '/' - is there anything else and is it ...
3
votes
3answers
129 views
What is a simplest “Crash an application” demonstration to get access to a system?
For a presentation (10-15 mins) purpose what is the simplest demonstration of "crashing an application" on a machine can be done.
4
votes
1answer
1k views
Benefits to ArchPwn over BackTrack
Besides BackTrack having a cooler name and the whole Ubuntu vs. Arch Linux thing, what are the relative benefits of ArchPwn over BackTrack?
Are the tools broadly the same, or does one have better ...
13
votes
2answers
230 views
Should a pentest report include the tester's opinion?
In this particular case, the webserver turned out to be a shared 3rd party system and was not tested.
Examples:
We do express grave concern at the overall security posture of that webserver and ...
1
vote
2answers
1k views
Intercept Connections Instead of Forwarding (using arpspoof)
I am doing ARP Spoof experimentation with arpspoof and have successfully set up a man in the middle between two machines.
We set up IP Forwarding using:
echo 1 > /proc/sys/net/ipv4/ip_forward
...
3
votes
3answers
526 views
Android Pen Testing
I have been pen testing a random android app that uses POST method to send data to a remote server using HTTPS.
I have set up a proxy and am able to intercept the traffic, however the POST method ...
2
votes
1answer
373 views
Token Based Authentication & Pass-the-hash Attacks
Do token-based authentication solutions (such as RSA SecurID) mitigate tools like incognito and/or pass-the-hash tools?
4
votes
2answers
197 views
What is the most appropriate way to notify/request permission from an ISP related to white-hat security testing?
In some of the posts I've read on this site such as Is hacking legal when a friend allows you to attempt to hack their system?, and Best way to test my home network from the outside, users who ...
5
votes
3answers
1k views
Best way to test my home network from the outside
I want to check that my router is working like it should. For example that certain ports which should be open on the LAN side and closed on the WAN side really work that way. So I would like to run a ...
3
votes
1answer
240 views
Is there a way to use multiple firewalls / antivirus for penetration testing?
I don't really know how to do either, but I was wondering if it was possible to have multiple firewalls / virus scanners installed at once, and use a 3rd party program to specify which one is running ...
4
votes
2answers
2k views
Scanning my network with NMAP
Each computer is assigned one ip address on my network, and my ISP supplies one IP for my network. If I try to scan the ip supplied by my ISP what I got is the OS running on the router, running on the ...
0
votes
1answer
2k views
Wireless Adapters for Testing with BackTrack
I would like to begin testing and working with BackTrack. I have heard that the Alfa AWUS036H wireless adapter works well with BackTrack and allows for packet injection. This adapter, however, is ...
0
votes
1answer
239 views
Business systems development (.NET, Java) vs IT Security Field, salary/future perspective
What are the career prospects for young professionals, when comparing IT Security field (penetration testing, vulnerability research) to business development on .NET and Java?
Which path should one ...
3
votes
2answers
2k views
Where can I download vulnerable Windows OS images to practice penetration testing?
My objective is to learn and practice all the vulnerabilities and their exploitation on vulnerable OS.
7
votes
1answer
225 views
How secure is the apt-get install command against man in the middle attacks
I think the title says everything,
how secure is it to use apt-get in a network with an attacker who injects his own packets and blocks the original packets (man in the middle).
3
votes
1answer
303 views
Non English password dictionaries
What is a good resource for wordlists used in auditing passwords in non english languages. I have extensive wordlists in English ranging to several GB's, but can't find similar resources for other ...
10
votes
3answers
2k views
iOS/Android Pen-Test
This question might be vague, that is because I am not sure where to start.
There are a lot of books and courses on pentest focusing on networks, systems, and OS such as windows, yet I haven't been ...
0
votes
1answer
391 views
can the value of request.getHeader(“Host”) be faked?
Suppose if there is some code like
<a href="<%=request.getHeader("Host")%>/xxx/abc.do>SignIn</a>
Can an attacker fake request.getHeader("host") to point 'SignIn' anchor to ...
6
votes
1answer
488 views
Is Request.getHeader(“host”) vulnerable?
If the following is the code snippet, what would be your suggestions?
<script type="text/javascript" src="<%=request.getHeader("Host")%>/XXX/xxx.js"></script>
Is this a clear ...
1
vote
1answer
198 views
Security testing on network
A group of student have been asked to do a bit of network security testing at college. Basically the college have just invested in some android tablets, more macs and more net books.
The IT admins ...
5
votes
3answers
1k views
Where can I find exploit code?
I am doing VA/PT on a sample web application. I run the nessus scanner and I found some high severity problems. It is related to HP System Management Homepage. The CVE numbers are:
2010-1917,
...
7
votes
4answers
297 views
How to test a physical machine?
In two weeks time, I will have to test a couple of computers that a client would like to provide to its employees. The main concern is making sure that the employees won't be able to use those ...
1
vote
2answers
512 views
how an iframe can cause xsrf?
I know how a form tag is prone to CSRF which does not use any token (or any other challenge-response mechanism) but I was wondering how an iFrame can be used to cause XSRF attack and what would be the ...
2
votes
2answers
168 views
Scan Novell NetWare backend with Windows servers and clients
Could anyone provide some insight on performing an internal vulnerability assessment regarding Novell NetWare as the backend with client workstations and servers running various versions of Windows?
...
3
votes
3answers
331 views
would preparing for CCNA add “significantly” to my knowledge as a penetration tester?
I'm a post graduate student and self taught programmer. I concentrated on Computer Networks & Operating Systems more during my undergraduate studies. I can explain usually used protocols by ...
4
votes
1answer
1k views
Penetration Testing Silverlight Applications
What would be the process in pentesting a Silverlight application? What would be the best method to proceed in a manual test? Any specific tools use? For example an application with lot of file ...
