An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

3
votes
3answers
140 views

What is a simplest “Crash an application” demonstration to get access to a system?

For a presentation (10-15 mins) purpose what is the simplest demonstration of "crashing an application" on a machine can be done.
3
votes
3answers
547 views

would preparing for CCNA add “significantly” to my knowledge as a penetration tester?

I'm a post graduate student and self taught programmer. I concentrated on Computer Networks & Operating Systems more during my undergraduate studies. I can explain usually used protocols by ...
3
votes
1answer
426 views

WPA vulnerabilities for pentest

As I am a network&IT enthusiast, I was asked by a friend to pentest his WPA network. I'm wondering if there is anything else I can do beside a bruteforce attack, trying the KARMA attack on ...
3
votes
1answer
154 views

testing for 'Dangling Cursor'

While reading the updated Top 25 exploits in the Common Weakness Enumeration I came across an exploit that I was not familiar with. It is numbered CWE-619: Dangling Database Cursor. I was wondering ...
3
votes
1answer
25 views

Architecture dependency issue associated with malicious payloads

My question is regarding architectural restrictions associated with backdoor/bind/reverse tcp payloads used typically to gain shell through exploitation. In a situation where the target box ...
3
votes
1answer
105 views

Proving SQL Injection Vulnerability

I have recently come across what I believe to be a serious flaw in the security of a 3rd party computer program used within my company. Apologies for deliberately keeping details vague, but I hope you ...
3
votes
1answer
118 views

Are there any ways to leverage NTLM V2 hashes during a penetration test?

I am on a penetration test at the moment, where LM/NTMLv1 hashes are disabled. I have captured a number of NTLMv2 hashes via NBNS spoofing, however was unable to crack them after running them through ...
3
votes
1answer
2k views

Is server exploitable by Shellshock with cgi-enabled only?

A server with vulnerable bash, but cgi enabled only and there are no cgi scripts in cgi-bin. Is it still exploitable ?? If there are scripts in cgi-bin and only server-admin knows about filenames of ...
3
votes
3answers
4k views

Replacement for DVL (Damn Vulnerable Linux)?

I've recently spotted that DVL (Damn Vulnerable Linux) has gone inactive. My first question is what happened to cause them to stop releasing it? Secondly, I have found some references to other ...
3
votes
1answer
185 views

Tools to make a security researchers life easier - tracking vulnerability research [closed]

I've been a developer for quite some time, and as part of my on-going learning process I've learnt how to spot and remedy broken (and insecure) code written by others. Recently, I've found myself ...
3
votes
3answers
7k views

OSCP certification for junior pen tester position any good?

Currently finishing my degree in computer security and have a few years experience in IT support and want to get into a junior pen testing job or similar. Would the OSCP certification do me any ...
3
votes
2answers
479 views

1 PIX firewall, 2 routers, 2 switches. Please answer a couple questions about hack lab

I bought a bunch of cisco equipment for a project and I got 1 PIX firewall 2 switches and 2 routers This is my plan for a topology but I am new at this so I need help. I am basing this off the ...
3
votes
5answers
380 views

Laws on Programming Security Tools

I am currently working on some POST GATHER modules for the Metasploit Framework the idea is that after a shell is spawned on the target, it will gather certain files from the target such as chat logs. ...
3
votes
1answer
57 views

What methods can be used to prevent the browser (IE11 specifically) from storing credentials / autocomplete

Going through Pen Test and it was asked of us to disable auto complete in our CC payment fields. We tried adding autocomplete=off and also tried false on the input filed. A ny suggestions to ...
3
votes
1answer
139 views

SSD Self Encrypting Drives - Setup / warm boot bypass

I've seen folks deploying the SED on laptops recently. I've discovered that there is a setting in which you can do a warm boot and NOT require the bootup password to be put in again. Which makes ...
3
votes
2answers
1k views

How to simulate man in the middle attack in android emulator?

I am new to pen-testing. Yesterday i analysed one android application using dex2jar application and i saw an android application implemented https connection using empty trust manager. class miTM ...
3
votes
1answer
2k views

Setup of Kali Linux for reverse shell connections over the internet

I am running Kali Linux as a VM on my Windows machine which is NAT'd behind my company network, if I wish to pen test a website for a client and believe that a reverse shell is possible, what is a ...
3
votes
2answers
383 views

Techniques for enumerating enabled apache modules

A common issue noted by security testers is that the Apache web server is reporting a version in headers which is older than the latest available one. This usually leads to CVE listings detailing the ...
3
votes
1answer
3k views

Why does MYSQL's LOAD FILE only read some files and not others?

As part of an assessment I'm using mysql to poke around at a compromised hosts' filesystem. As I seemed to remember from the last time I played with it, some files can be read (eg. /etc/passwd) and ...
3
votes
1answer
140 views

Site Executing control characters in title tag

I am currently pentesting a site for a client of mine and I found a very strange 'bug'. They have a search box on the home page which if I enter te\tst and hit search, it redirects to the search ...
3
votes
1answer
188 views

Best option to fuzz a C Network Program [closed]

I have a client/server simple program in C. I want to test the server running on different machine with random inputs. I have looked at 'Bunny-the-fuzzer' but from what I can understand It wont be ...
3
votes
1answer
410 views

Non English password dictionaries

What is a good resource for wordlists used in auditing passwords in non english languages. I have extensive wordlists in English ranging to several GB's, but can't find similar resources for other ...
3
votes
1answer
2k views

Are there any tools for automated penetration testing of Silverlight applications? [closed]

I'd like to find a tool to assist with automated penetration testing of Silverlight applications, in a similar vein to AppScan for webapps. Specifically, I'm looking for a tool that can cope with ...
3
votes
1answer
325 views

Security analysis of Dashlane

I've been asked by a user whether I would recommend using the Dashlane password manager. I'm aware that other password managers have had some significant security problems, including XSS and CSRF ...
3
votes
1answer
162 views

How to intercept requests/responses from Smart Phone while surfing internet?

I have used Burp Suite Penetration testing tool in my computer to intercept requests.Assume that I am using Smart Phone. So Is it possible to intercept my smart phone requests into my computer?
2
votes
5answers
768 views

OS fingerprinting: can I rely on the results?

Using nmap -O www.example.com I get: Running (JUST GUESSING): Microsoft Windows 7|2008 (90%) So I can say the target site is running Windows. Using xprobe2 -v www.example.com, I'm just astonished ...
2
votes
4answers
220 views

Session token is not changed on login?

I have logged into my application and I received a session token. When I navigate to another tab, the application pertains the same session token. Is it normal behavior that the session token does ...
2
votes
3answers
1k views

How to intercept an application that bypasses local proxy

I am behind a corporate proxy and the application that i have to test will work only if it is given an exception for using proxy server(i.e it is added to the exceptions list of the sites that do not ...
2
votes
5answers
353 views

Can we predict the technology used from the URL?

As a person who is learning pentesting, I want to know if it is possible to predict the underlying technology used for the developement of the site from the URL? For example: This is the URL of the ...
2
votes
2answers
319 views

Literature about IT security from a hardware standpoint

Can you point me to any book, blog, paper, anything about IT security on the lowest possible level (hardware)? I'm primary interested in the motherboard, CPU & GPU, however, if you know any good ...
2
votes
3answers
206 views

How to test for presense of antivirus?

I want to test that when user uploads file, then it goes through up-to-date and properly configured antivirus. I think that to test for it I need some malware that is likely to be detected (it doesn't ...
2
votes
3answers
281 views

SIM card malware advice

My goal is to communicate with a sim card via binary sms and upload new firmware and/or talk to sim card api to retrieve data such as gps coordinates etc... I am not sure how to construct these binary ...
2
votes
2answers
3k views

Is it practically possible to spoof a WLAN access point?

I want to try something out, but I wanted to see other opinions from you guys. What I have: WLAN Access point, with WPA2, ESSID: testing. Home router, I can change the configuration and everything ...
2
votes
1answer
3k views

Tutorials, Exercises and Environemnts for Penetration Testing Mobile Environments

I'm looking for a list of exercises or distributions to practice penetration testing on mobile environments. There are plenty of existing things like the environments found at pentesterlab.com and ...
2
votes
2answers
309 views

I need explanation on how serious these vulnerabilities are?

I have found two vulnerabilities on my college site and I want to report them but don't know if these are "really" vulnerabilities : RFI inside SWF file. Example: ...
2
votes
2answers
127 views

Where is the Line? [closed]

A comment posted on one of my questions the other day raised a question in my head. I know that many site admins appreciate users reporting bugs and security holes, and as a user I appreciate people ...
2
votes
3answers
3k views

Regarding SQL Inject me Firefox add-on?

Using SQL Inject Me Firefox add-on,I have selected the check-boxes then click on Execute button of SQL Inject Me tool. After getting result, it has displayed following responses Server Status Code: ...
2
votes
3answers
380 views

What things should a penetration tester know about databases?

I want to start learning about databases from a penetration tester's perspective and I would like to know what things will be useful on the long run. Also do you know any good books to kickstart my ...
2
votes
1answer
528 views

Protect an application that uses internet from packet sniffing

I developed a stand alone application such a way that, application use a remote service (using SOAP/REST) which available WWW. I am using HTTPS though out the application calls. It was perfectly ...
2
votes
3answers
536 views

Pentesting file Upload feature

The file(resume) upload feature is accepting any sort of files. I have uploaded the PHP shell into it. How do I again access to that uploaded file? I'm bruteforcing the web directory to check for ...
2
votes
1answer
3k views

can an attacker find WPA2 passphrase given WPA key data and WPA MIC

Can some one with these two pieces of information get a hold of the psk key, or its a blind attack that can be done using dictionaries or/and word-lists ? If so please add some resource like a link ...
2
votes
3answers
6k views

intel wireless 5100 AGN adapter to support injection

i ran aireplay-ng -9 wlan0 and it seems that my intel PRO/Wireless 5100 AGN adapter does not support injection. i use Ubuntu 10.10 64bit (2.6.35-25-generic kernel). is it possible to make the adapter ...
2
votes
3answers
255 views

Which languages are better for attacks against websites?

Which languages are better for writing tools for attacking websites, through, say, a DDOS? High level, low level, and does it even make a difference?
2
votes
6answers
552 views

Hacking own computer [closed]

Ok I've worked with some penetration testing but it's all done in house where I work at on a secure network to secure servers and work stations before being deployed. But my question here is kind of ...
2
votes
1answer
299 views

Pentest — handling multiple reverse shells

I'm running a pentest and im expecting reverse shells from multiple shells connecting back as :- nc <my-ip> <my-port> -e /bin/bash However, I'm trying to figure out the best way to ...
2
votes
1answer
244 views

Pentesting Cleanup

I've recently discovered a backdoor shell that was created via file injection on a public facing website. After much digging, I found the creation date of this file to be around the same time ...
2
votes
1answer
1k views

How to use sqlmap to perform SQL injection on a clean URL?

I am learning to use sqlmap and came across an application that has Clean URLs. Clean URL example //my url.net/project/public/#questions/question/edit/id/122/answer/1, here MVC framework is used. ...
2
votes
2answers
500 views

Test Android Secure Encrypted Traffic

For testing android traffic encryption I have configured a VPN client in my phone. What simple test I can perform in my home wifi network to verify that the traffic is really encrypted and secure?
2
votes
1answer
1k views

File upload vulnerability: rename solution?

I have a module in which the user can upload images. I searched Google for different kinds of upload attacks checking dimension of the image (still vulnerable) checking of file extension ...
2
votes
2answers
2k views

Security analysis tools for iOS 6 [closed]

Searched over web, however could not find much info on security analysis tools for iOS6. Can somebody point me to the security analysis (Static Code Analysis & Pen Testing) tools for iOS6?