Tagged Questions

An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

-2
votes
1answer
63 views

Should I do science of computing or systems analyst? [closed]

I want to become a federal analyst of cyber crimes and I dont't know what's the right university course for me, I would like to know what's the cons and pros of choosing one or another course and ...
0
votes
5answers
4k views

Can I use Kali Linux when I learn Backtrack well?

I'm new to security issues and I'm almost buying a course at ELearningSec(begginners course,of course), I will in a company and want to learn about offensive and defensive skills to improve the ...
15
votes
7answers
2k views

Why don't banks get hacked?

From reading a lot of info on this website I came to the conclusion that if someone with enough skill really badly wants to gain access somewhere, then there is absolutely nothing stopping them from ...
9
votes
2answers
907 views

Black-box fuzzing a TCP Port running an unknown applicaiton

I'm looking for any guidance around testing a service I've found running on a target server. I'm doing a 'black-box' pen-test and the company is one of those 'I-don't-want-to-tell-you-anything' types ...
5
votes
2answers
140 views

How to manage pen testing byproducts?

Often when doing a pen test you need to hammer certain parts of the site that might be visible to other users. If, for example, you suspect that a comment section is vulnerable to XSS, you might ...
2
votes
1answer
120 views

Helping developers find logic and authorisation flaws

Professional penetration testers are usually good at finding all sorts of vulnerabilities, including logic flaws, that are highly-specific to the site being tested. However, being a manual activity, ...
2
votes
1answer
1k views

How to use sqlmap to perform SQL injection on a clean URL?

I am learning to use sqlmap and came across an application that has Clean URLs. Clean URL example //my url.net/project/public/#questions/question/edit/id/122/answer/1, here MVC framework is used. ...
1
vote
1answer
243 views

Reflected XSS - Automatic understanding of filters

I'm currently facing this possible reflected XSS vulnerability on a webapp: URL = http://www.test.com/login/?login=[PAYLOAD] When a user clicks on this link, it displays a login page that includes ...
1
vote
3answers
351 views

Pentesting my Own Server File Upload

I recently created my own IIS server (set on version 7.5) and I was going through checks to make sure my webdav is not vulnerable. My users need to upload files to their individual accounts and can ...
1
vote
1answer
107 views

Setting expectations of a vulnerability assessment?

Is it reasonable to refuse to guarantee that you will find 100% of security issues when doing a vulnerability assessment on a website? Even with companies like Google that have teams of security ...
-1
votes
1answer
111 views

Free Alternatives in Web-Application Mapping Software [closed]

Im new to hacking, i have reached a chapter in my book "the web applications hackers handbook" where im about to start bypassing client-side and actually attacking different technologies well before ...
3
votes
1answer
2k views

Why does MYSQL's LOAD FILE only read some files and not others?

As part of an assessment I'm using mysql to poke around at a compromised hosts' filesystem. As I seemed to remember from the last time I played with it, some files can be read (eg. /etc/passwd) and ...
2
votes
2answers
2k views

Is it practically possible to spoof a WLAN access point?

I want to try something out, but I wanted to see other opinions from you guys. What I have: WLAN Access point, with WPA2, ESSID: testing. Home router, I can change the configuration and everything ...
-1
votes
3answers
2k views

Issues setting up DVWA for SQLMAP [closed]

I am starting on sqlmap, and have dvwa for practicing web app penetration. I am having the error "Could not connect to the database - please check the config file." Not sure what the problem is but ...
1
vote
3answers
155 views

Reading to Decide on a career switch [duplicate]

I have a strategy consulting and sales background, but what I read about IT and IT Security sounds fascinating as an outsider. I'm considering a career switch, but would need to know quite a bit more. ...
1
vote
3answers
492 views

How does SSL protect against network level attacks on integity?

I would like to know if there is any way to demonstrate how an attacker may attack the integrity of a website due to an unencrypted connection and how SSL will avoid this. For the aspect of ...
1
vote
0answers
3k views

Linux Hydra issue - random correct password success

I have an issue with Hydra when i use it. First let me inform that, i read multible guides, tries the excact same command lines as in guides directly supported by the Damn Vulnerable Web Application ...
4
votes
3answers
195 views

Is it reasonable to do a pentest (or other non-theoric security audit) over a critical infrastructure?

Almost all agree that during a pentest it is impossible to guarantee the integrity of the target (Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in ...
2
votes
1answer
468 views

Does Metasploit's packet sniffing run in promiscuous mode?

I'm doing an educational pen test exercise and I'm trying to sniff traffic from a compromised Windows machine. I've been using the post-exploitation sniffer and packetrecorder Meterpreter modules, ...
7
votes
2answers
504 views

How to attract hackers?

I'm contributing to an open source project and we setup a testbed for security testing. We want to start a challenge to find security flaws and my question is: how do we attract hackers to ...
3
votes
1answer
140 views

Site Executing control characters in title tag

I am currently pentesting a site for a client of mine and I found a very strange 'bug'. They have a search box on the home page which if I enter te\tst and hit search, it redirects to the search ...
-1
votes
2answers
353 views

smartphone pentest framework [closed]

I have done some searching around Google to find out if there are any penetration testing frameworks like metasploit on Backtrack for computers and its applications Can any one help me to find such ...
1
vote
1answer
375 views

WAF testing frameworks

How to test the effectiveness of a Web Application Firewall (WAF), or any other security control that is put in place to protect the web application from being attacked? Currently, what are the ...
-2
votes
1answer
598 views

ESAPI: Input and output validation [closed]

I am new to IT Security and I have been tasked with coming up with input and output validation for ESAPI. So for input validation, so far I got: Data Type Name Email ...
-7
votes
1answer
870 views

What are the vulnerabilities on port 23? [closed]

I'm working on a pen-testing project and still in the beginning but I faced a switch with only 80 & 23 ports opened. How can I use these ports to attack that switch ?
0
votes
2answers
95 views

Getting in to the security side of things

Im a current student going for my Bachelors in Network Administration and would like to get in to the security side of things. I have my Network+, Security+ as well as the A+ and a MCTS. I currently ...
100
votes
7answers
5k views

Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in production unintentionally during a pentest?

Today I experienced a situation where a person responsible for the security of a company required a pentesting company to withdraw a clause in the contract that says that: "during the pentest there ...
3
votes
1answer
1k views

Metasploit Get Shell Through NAT

Ok first of all this is legal and I have it in writing my friend and I are attacking eachother to get better and not break the law. Setup I have a VMWare image running BT5R3. It uses VMWare's NAT ...
4
votes
3answers
317 views

Is it necessary to test all input parameters of a web application when testing its security?

We know that testing input parameters for lack of validation is one part of a black box web vulnerability assessment but, is it necessary to test ALL input parameters (parameters, cookies, HTTP ...
2
votes
3answers
699 views

How to determine the size of payloads available in MetaSploit

I've noticed that there are a lot of different payloads to choose from in MetaSploit, and the choice (assuming there's enough room in the target) usually depends on what you're trying to do. However, ...
2
votes
2answers
2k views

Sqlmap and multipart/form-data forms

I'm working on some security for a website that is built in classic ASP and MS SQL 2000. I've successfully found a couple of flawed forms that allowed SQL injections through the form fields by using ...
12
votes
2answers
663 views

When performing a PenTest against a WAF-protected site, what should a Pentester know to enhance the Test-Quality?

I'm running a WAF infront of a bunch of Webapps and we have the Apps regulary tested, and we want to improve our Tests by presenting some kind of livelogs to the testers. What informations, from ...
-2
votes
2answers
81 views

Block all kind of querys from ip [closed]

I want to check my network intrusion detection system (physical intrusion like unauthorized gadgets or devices in wifi/ethernet). Until now everything is ok, but I was wondering if I block every query ...
-3
votes
1answer
144 views

How this test prove my application is vulnerable to clickjacking attacks? [duplicate]

I have downloaded the "Clickjackingtool" and done the followings steps. Step 1:- I have opened the clickjackingtool and paste the URL and click GO button(Image 1). Step 2:- I have opened the ...
2
votes
4answers
204 views

Session token is not changed on login?

I have logged into my application and I received a session token. When I navigate to another tab, the application pertains the same session token. Is it normal behavior that the session token does ...
5
votes
4answers
697 views

Regarding cross site scripting?

My application has a user management module which uses fields like username, first name, email-id, password,.. . I tried scanning these fields and filling in malicious JavaScript to test for cross ...
-1
votes
2answers
71 views

Regarding Session management

In my application first time I have given valid credentials and then login into application at that time i saved the response using burp tool.next time i have given wrong credentials and click login ...
8
votes
4answers
3k views

How does this test prove my application is vulnerable to clickjacking attacks?

I want to know more about clickjacking. I have been reading an article about clickjacking, where the HTML code to test for clickjacking vulnerability was provided. I tried the same as described in ...
2
votes
2answers
1k views

Sqlmap fails at enabling xp_cmdshell procedure

I have been browsing the web looking for some help regarding the following issue. I am currently performing an web application penetration test, and I had come accross a beautiful blind SQL Injection. ...
2
votes
1answer
422 views

Protect an application that uses internet from packet sniffing

I developed a stand alone application such a way that, application use a remote service (using SOAP/REST) which available WWW. I am using HTTPS though out the application calls. It was perfectly ...
11
votes
2answers
8k views

Why does Hydra return 16 valid passwords when none are valid?

I've been playing around with Hydra and DVWA and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. I assume ...
17
votes
1answer
4k views

How can I spoof a phone call and make it appear to come from another phone?

I'm performing a penetration test against a company. Part of my social engineering procedure is to contact the IT department and try to convince them to that I'm an employee in the company and get ...
3
votes
1answer
752 views

How to MiTM insert an iframe using burp or another tool?

So, I am trying to obtain a cookie without the secure flag enabled over HTTPS. After reading about it, I came across an answer: You visit https://secure.example.com/ which drops a cookie on your ...
6
votes
2answers
416 views

Client-side attacks with custom malware in penetration tests

I regularly perform pen-tests against web applications, operating systems, etc. Occasionally, I'm luck enough to do a 'red-teaming' exercise and get to attack at all conceivable points of a network ...
0
votes
2answers
697 views

Blackbox vs whitebox testing your own site?

When performing a security audit of one's own site is one of these methods of testing generally considered better? Would I be wasting my time by doing blackbox testing when I have access to ...
1
vote
1answer
89 views

How do I verify versions of Adobe?

I ran a vulnerability scan against a server and it is pulling back a lot of Adobe vulnerabilities. I ran a Wireshark capture on the scan but I can't seem to write up a Wireshark filter on the packets. ...
0
votes
2answers
93 views

How do I obtain user info from SET?

I am trying to create a phishing email for a project I am on. In the email I want to link to a site that will collect IP, browser, date/time of when visited. nothing malicious but to just prove that ...
5
votes
1answer
1k views

Pen Testing ASP.NET application with Backtrack

We have developed an ASP.NET Based Enterprise Application which is is soon to be released. Now, we are concerned about the security aspects of the application. I've been looking into Backtrack 5 and ...
4
votes
2answers
576 views

Executing arbitrary commands through iptables-restore input

During a pentest I found a way to add arbitrary iptables firewall rules to a server. These rules get applied by way of the iptables-restore command, and I've been wondering whether there is any way to ...
4
votes
2answers
321 views

Vulnerability testing without the use of exploits?

I was doing some testing on a server to see if it was vulnerable to a 0-day local exploit (the exploit was for gaining root privileges using a bug in the Linux kernel). There was no real information ...