An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

8
votes
2answers
3k views

How should one prepare himself for a job interview for penetration testing?

So, the title basically says it all. I would really like to hear out some of the more experienced friends here with their answers for this. Should it revolve around the ability to verbally explain ...
4
votes
4answers
2k views

Finding all links under a website

How can i find all directories and links under a website? Note that there is no link from home page to all other pages. For example if i have a domain like this users.company.com and each user will ...
8
votes
2answers
1k views

How can I find websites owned by a particular company?

I wanted to know how can I get info on what sites are owned by a certain company. I need it for bug bounty programs. For example, how can I find what sites are owned by PayPal, like what sites have ...
20
votes
7answers
3k views

What should a security audit report include?

Background I'm in charge of auditing a medium-scale web application. I have audited web applications several times before, but I've always wrote a short PDF quickly explaining what I encountered and ...
0
votes
3answers
438 views

Penetration testing against an ignorant target - Is it legal? [closed]

I know it's a big no-no in terms of etiquette, but is it illegal in Canada to perform penetration testing against a commercial company without authorization? prompted by: ...
1
vote
2answers
4k views

Sqlmap testing HTTP headers

I was wondering whether sqlmap is able to test HTTP headers for sql vulnerabilities. I know that if I use --level>=3 then it will automatically check for User-Agent and Referer HTTP headers, but I ...
3
votes
5answers
976 views

Building my own Darkspace

I have searched through the internet about creating a darknet and there is a confusion. There are two definitions, the first one is network used for private p2p (like freenet) and another one that ...
0
votes
1answer
340 views

Need advice on automated virtual pentesting lab configurations

I request you to read the problem before suggesting any duplicate or down-voting, I am well aware of hundreds of questions about somewhat similar problem but this one is just to attract some good ...
2
votes
1answer
3k views

Tutorials, Exercises and Environemnts for Penetration Testing Mobile Environments

I'm looking for a list of exercises or distributions to practice penetration testing on mobile environments. There are plenty of existing things like the environments found at pentesterlab.com and ...
4
votes
1answer
133 views

Any suggestions while testing a sandboxing driver?

I am doing penetration testing of a sandboxing driver and trying to break the sandbox. It is implemented as a kernel mode driver. A sandboxed process will have : A whitelist of disk locations for ...
2
votes
0answers
123 views

Determine deployed 802.3x encryption/authentication protocols? Or, why can't I access Eth0?

Is there any means to identify deployed 802.3x authentication protocols on a wired interface (eth0) under Windows 7 (CLI), or from wlan0 on a *NIX based system? The scenario is as follows: I am a ...
3
votes
5answers
2k views

Building a Security Training Simulation environment

My university is keen to build a security training simulation environment/platform and it will be a good learning experience for students. I Googled around to find out how it is built, but I only ...
2
votes
1answer
557 views

Reverse shell attack and proxy interceptions.. . is there anything worng?

First I've got a few questions about Reverse shell. REVERSE SHELL I'm trying to understand the Reverse shell technique. My reasoning is as follows (I'd be glad if you could point out any mistake ...
3
votes
3answers
450 views

Physical access: in-scope for penetration testing or not?

When pentesting a network, should a pentester consider physical access to devices (e.g. allow use of a USB stick)? Or is this out of scope?
3
votes
2answers
472 views

How was pentest performed in the era with no frameworks like Metasploit?

I have been interested in security lately, I have been reading mainly cookbooks on Metasploit framework, how social engineering has been employed exhaustively, I have started reading some IA-32 ...
5
votes
6answers
204 views

Is it useful to determine the name of the server software while doing a penetration test?

Getting the name of the server software through netcat or curl or any other method, is really useful? I mean, OS fingerprinting is useful in order to tailor an attack. For example with regard to OS ...
2
votes
5answers
589 views

OS fingerprinting: can I rely on the results?

Using nmap -O www.example.com I get: Running (JUST GUESSING): Microsoft Windows 7|2008 (90%) So I can say the target site is running Windows. Using xprobe2 -v www.example.com, I'm just astonished ...
2
votes
2answers
379 views

Test Android Secure Encrypted Traffic

For testing android traffic encryption I have configured a VPN client in my phone. What simple test I can perform in my home wifi network to verify that the traffic is really encrypted and secure?
4
votes
1answer
473 views

Trying to figure out Gmail login in Wireshark

In my pentesting lab I'm using ettercap for do a mitm to a XP VM. I go to gmail, accepting the false certification, and here I start to sniff with wireshark. I put some false account like ...
3
votes
1answer
2k views

How Chrome avoids sslstrip?

I'm trying out Moxie's sslstrip tool in my pentester lab. It works in all my VM's but no in all browsers. Firefox and IE are vulnerable but Chrome seems to has a protection against. Anyone know how ...
0
votes
1answer
659 views

How I add cookie to w3af for authenticated attacks?

Can anyone explain this in steps to me? Lets just say I clicked to OWASP Top 10 scan profile and entered url. Next I need to add cookies or authentication values to w3af (form based auth.). How? ...
1
vote
1answer
478 views

What are the best Nmap Scripting Engine (NSE) service discovery scripts? [closed]

Using nmap -sV can be quite verbose can -sU can take a very long time especially with -p 0-65535. To narrow your results and enumerate interesting services the wealth of NSE scripts can be very ...
1
vote
2answers
228 views

What is the first step in auditing the security efficiency of a simple website?

I am asked to write a first technical audit about the security best practices to improve a PHP web-site security. I am wondering from where to start? Is there a famous audit forms to analyze and ...
0
votes
1answer
137 views

How do I prevent my Rails application from attack? [closed]

My website is being nuked by new signups and new posts some of which don't even have user.id associated with. How do I solve this? What code should I add to the user#new page and/or post#new page. ...
1
vote
2answers
272 views

I need explanation on how serious these vulnerabilities are?

I have found two vulnerabilities on my college site and I want to report them but don't know if these are "really" vulnerabilities : RFI inside SWF file. Example: ...
2
votes
1answer
525 views

Android Application penetration testing

Have problem intercepting HTTPS requests of android application.certificates in android are kept under /system/etc/security/cacerts/ which is different from its previos version of os in cacerts.bks ...
0
votes
2answers
296 views

can a backdoor executable be used on an occupied port?

Suppose I am doing a penetration test on a network that has a firewall that blocks all ports except 80, 110, and 443. I want to use a metasploit reverse-TCP backdoor executable written in msfpayload ...
-1
votes
1answer
498 views

where to get the latest trends about penetration testing systems? [closed]

I am an undergraduate student, who want to do a project in penetration testing automation, and i want a conference or some official source to obtain some latest researches from inorder to see what to ...
4
votes
3answers
997 views

Create a page to experiment with SQL injection [closed]

This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
0
votes
1answer
184 views

Cloud application Vulnerability assessment

Do you think server side assessment of application is important when application is hosted on a cloud like Amazon? Assessment on software used to host the application not the actual application, e.g. ...
2
votes
1answer
774 views

File upload vulnerability: rename solution?

I have a module in which the user can upload images. I searched Google for different kinds of upload attacks checking dimension of the image (still vulnerable) checking of file extension ...
3
votes
2answers
1k views

Security analysis tools for iOS 6 [closed]

Searched over web, however could not find much info on security analysis tools for iOS6. Can somebody point me to the security analysis (Static Code Analysis & Pen Testing) tools for iOS6?
4
votes
3answers
578 views

Web app penetration testing

I have a static website which needs to be pentested. It has only got one form which updates some data on the server and i have pentested it with some blind PHP and SQL injection. The site is hosted on ...
2
votes
3answers
428 views

Pentesting file Upload feature

The file(resume) upload feature is accepting any sort of files. I have uploaded the PHP shell into it. How do I again access to that uploaded file? I'm bruteforcing the web directory to check for ...
9
votes
4answers
1k views

Nessus Scan Port ID mapped to Metasploit Vulnerability exploits

My Question: Is there any sort of website that maps Nessus Scan IDs to Metasploit Vulnerabilities? My Situation: I'm learning about penetration testing and I'm beginning to get frustrated seeing a ...
4
votes
4answers
2k views

Definitive certification list [closed]

What are a list of useful certificates for someone who wants to work on the information security field? I have heard of CISSP but from what I have understood it is way too advanced for someone new to ...
0
votes
1answer
237 views

What type of attacks can be carried on for an web application [closed]

My company has designed an web application and its going to be hosted soon, I would like to know what type of attacks can be carried on the web application to test the security of my web application ...
6
votes
4answers
1k views

Why is penetration testing important

In improving the security of an organization, it seems as though an audit of existing code, procedures, policies, infrastructure, etc. would be absolutely sufficient to reveal any security or policy ...
3
votes
5answers
8k views

Nexus 7 (Or any other good android tablets) For pen testing

I'm considering investing in an android tablet for pen testing. Does anyone know how capable they are with pen testing? Can they compile code or forward packets? Are any applications that work on ...
7
votes
5answers
504 views

How do small businesses handle web app security?

Everything on Owasp's top 10 list, how do current small businesses (< 1000 employees) handle web application security, along with mobile security of their applications? Do they care about info/app ...
2
votes
3answers
323 views

What things should a penetration tester know about databases?

I want to start learning about databases from a penetration tester's perspective and I would like to know what things will be useful on the long run. Also do you know any good books to kickstart my ...
2
votes
1answer
442 views

Using mysql root account to execute root commands

Suppose that I have full root access to mysql databases, but not root user shell (linux). How can I use the full root access to mysql databases to execute root commands?
7
votes
3answers
3k views

How does BeEF work? (working understanding)

I have recently come across the BeEF- a browser exploitation tool. In most of the articles, it is said time and again that it is developed for research and pen test purposes! Has anyone worked with ...
0
votes
1answer
2k views

Is OSX or Mac hardware used in the InfoSec world? What resources are available? [duplicate]

Possible Duplicate: Mac OS X from an IT Security Practitioners' Perspective? I'm new to the OSX world (formerly Windows background) and am interested in understanding what is or isn't ...
0
votes
1answer
898 views

Telnet local privilege escalation exploits possible even when telnet is running under a normal user account?

http://www.exploit-db.com/exploits/8055/ says: The telnet protocol allows to pass environment variables inside the telnet traffic and assign them to the other side of the tcp connection. The ...
0
votes
1answer
400 views

How have DNS recursion attacks happened?

There are a few resources describing how to carry out DNS recursion attacks. Is there any good explanation to help me understand how these attacks work and if systems on my network are still ...
25
votes
8answers
12k views

What defines a programming language as useful for hacking?

I know that scripting languages (Perl, Ruby, Python, javascript, and even Lua!!!) are most suitable for hacking and penetration testing. My question is: What is it that makes those languages ...
2
votes
0answers
610 views

Hack scenario when a person has a non-superuser shell [closed]

Suppose that there are following three machines in the network: Machine A: Microsoft Server 2003 Service Pack 2 FileZilla 0.9.29 beta ftp server (TCP 21) Mcafee ePolicy server (81), remote desktop ...
1
vote
1answer
2k views

can an attacker find WPA2 passphrase given WPA key data and WPA MIC

Can some one with these two pieces of information get a hold of the psk key, or its a blind attack that can be done using dictionaries or/and word-lists ? If so please add some resource like a link ...
2
votes
5answers
4k views

Efficient way for finding XSS vulnerabilities?

Manual (reliable) way: Put string containing characters that have special meaning in HTML into some parameter of HTTP request, look for this string in HTTP response (and possibly) in other places ...