An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

2
votes
2answers
210 views

Scan Novell NetWare backend with Windows servers and clients

Could anyone provide some insight on performing an internal vulnerability assessment regarding Novell NetWare as the backend with client workstations and servers running various versions of Windows? ...
3
votes
3answers
453 views

would preparing for CCNA add “significantly” to my knowledge as a penetration tester?

I'm a post graduate student and self taught programmer. I concentrated on Computer Networks & Operating Systems more during my undergraduate studies. I can explain usually used protocols by ...
4
votes
1answer
2k views

Penetration Testing Silverlight Applications

What would be the process in pentesting a Silverlight application? What would be the best method to proceed in a manual test? Any specific tools use? For example an application with lot of file ...
1
vote
2answers
366 views

Looking for a tutorial on meterpreter extensions

A simple custom DLL source would be sufficient. All of the links I find on google are dead. I don't mind reading some clear source if there's a tut DLL floating about. I tried for meterpreter and ...
12
votes
6answers
995 views

Securely building a local pentest lab in a VM

I'd like to set up OWASP WebGoat or a similar vulnerable web app in a VM (probably VirtualBox on Linux). For convenience's sake, I'd like to get it running on one of the primary machines I use (say, a ...
3
votes
6answers
2k views

Decent programmer looking to learn to Hack

I'm a decent programmer, fluent in several languages. Python, Ruby, JavaScript, Haskell, and Scheme are my favorites. I'm currently adding Perl to the mix. I haven't done much "low-level" ...
1
vote
3answers
492 views

IT Security and Ethical Hacking [closed]

Hello, programmers, security professionals, hackers and everyone who is interested in information security. I am taking security courses in my university but I found there is only lab so I have to ...
4
votes
1answer
138 views

The Economics and White Hat Nature of NSS ExploitHub

This question is about the economic model employed by NSS with their ExpoitHub exploit marketplace (site link) and whether it jives with the white hat claims of the company. The company has made news ...
4
votes
1answer
529 views

Do blackbox penetration tests make sense if a whitebox audit would be possible as well?

Lets assume I am responsible for an application in my company and I decide to hire security experts to perform a security audit. Lets assume further that my company owns the source code of the ...
6
votes
7answers
2k views

Designing a Capture The Flag target and game management system

I've attended several CTF contests and I'd like to implement a CTF system for my students. I asked Google about designing such system but it's fruitless. Any ideas?
21
votes
5answers
1k views

How to improve as a security expert

I'm a professional software developer with a high interest in web application security. I'd say that I probably have a better understanding of the security of web applications than the average ...
0
votes
1answer
368 views

What are some good resources for learning how to hack my website? [closed]

Note: This is for my personal use. I'm not going to hack someone else's website. I have several websites, and I'd like to learn how to hack them so that I can secure them. Where can I find some good ...
6
votes
5answers
2k views

Penetration testing by ethical Hackers/Crackers should be trusted?

My question today come from my homework question from class ethics in IT. Our question states roughly that I'm IT guy in in big company and I am asked to hire few hackers to to find vulnerabilities ...
2
votes
2answers
278 views

Literature about IT security from a hardware standpoint

Can you point me to any book, blog, paper, anything about IT security on the lowest possible level (hardware)? I'm primary interested in the motherboard, CPU & GPU, however, if you know any good ...
3
votes
1answer
396 views

WPA vulnerabilities for pentest

As I am a network&IT enthusiast, I was asked by a friend to pentest his WPA network. I'm wondering if there is anything else I can do beside a bruteforce attack, trying the KARMA attack on ...
67
votes
9answers
68k views

Can webcams be turned on without the indicator light?

I want to know how secure I am. I've made a series of pentests in my network and one of the things I've tried was to record webcam and microphone. Recording an end-user's microphone seems to be a ...
5
votes
3answers
3k views

How do WPA/WPA2 cracking programs know when the PMK/PTK is correct?

I'm doing some pen-testing on my home wlan with aircrack-ng and it got me wondering how programs like these(eg. aircrack-ng, cowPatty, pyrit etc) really work. Specially, when performing a ...
5
votes
4answers
4k views

Does setting a WiFi AP to channel 14 avoid the most common detection methods used in Europe or the Americas?

The legally allowable band for WiFI in the US covers channels 1-11. Europe goes to 13, Japan to 14. I suspect that most tools use the WiFi driver of the machine and only scan for the channels it is ...
7
votes
1answer
117 views

What should be included in the ground rules for an attack review?

I've drafted some ground rules for a call for adversarial attack-review. I've tried to cover the following topics: Link to the policy that I want to enforce. Link to a minimal testbed and ...
19
votes
3answers
3k views

Google hacking - why “numrange” is so dangerous?

I'm reading Google Hacking for Penetration Testers and in book it's said several times operator "numrange" is especially powerful and dangerous. However, they don't give example of using this ...
5
votes
3answers
648 views

Open source web application penetration testing community

I do web development for a living but my real passion is security. I have worked with countless open source web application/framework and I have found vulnerabilities in most of them. The main cause ...
16
votes
6answers
6k views

At what point does “hacking” become illegal?

Hypothetical situation: before I hire a web development company I want to test their ability to design secure web apps by viewing their previous client's websites. Issue: this situation raises a big ...
7
votes
3answers
433 views

Which resources can help me learn how to use metasploit?

I tried google search but I can't find good resources to learn how to use the metasploit framework. Where would you suggest a beginner go to learn about using metasploit?
1
vote
4answers
211 views

Learning the role of intruder legally [duplicate]

Possible Duplicate: How can you become a competent web application security expert without breaking the law? I was reading this article earlier U.S. government hankers for hackers , and ...
1
vote
1answer
123 views

WebServices Security [closed]

Do we have any good resources on WebServices Security? Any book, pdfs, articles and even the detail answers regarding the securing web services would be appreciated.
14
votes
6answers
3k views

Are some uncommon TCP ports scanned less than others?

Ignoring the top 5-10% of port numbers for common services that are the commonly targeted by port scanners (i.e. ports 22-ssh, 23-telnet, 80-http, 139-smb/cifs, 443-https, 3389-rdp, etc.), are the ...
3
votes
4answers
1k views

Comparing penetration testing suites

I've been using Backtrack for a while now. I was wondering if there is anything better, or on par with, that is worth looking into. Thoughts?
14
votes
7answers
10k views

Penetration Testing Jobs without Experience

There seems to be a late trend where firms are beginning to hire fresh graduates for security related jobs. This is counter to what I've heard from experienced security professionals (as well as the ...
5
votes
3answers
381 views

What are the security considerations for setting up a basic security testing environment?

I only have 2 spare machines and both are very old, but I really want to set up an environment so that I can start practicing security. One of these machines has a Pentium 4 processor and 512 MB RAM; ...
9
votes
4answers
823 views

Is there a typical step-by-step A-Z process for testing a Web site for possible exploits?

I'm interested less in the tools of the trade (there are many questions here already about that), and I am interested more in the process by which you would go about using those tools. So for ...
8
votes
4answers
1k views

How does System Memory Dump work?

So there are so many pen-testing tools that perform a memory dump on the system. How exactly do they work - what exactly happens ?
3
votes
3answers
101 views

Question on information retrieved from systems that could potentially lead to exploits

Usually it is advised, when one wants to secure an application, to "provide" as little information, or better yet, no information at all to unauthorized (possibly malicious) users. I'm thinking of ...
3
votes
1answer
135 views

testing for 'Dangling Cursor'

While reading the updated Top 25 exploits in the Common Weakness Enumeration I came across an exploit that I was not familiar with. It is numbered CWE-619: Dangling Database Cursor. I was wondering ...
6
votes
2answers
2k views

Initial steps of network mapping

In light of recent security breaches hitting the news, it's been all hands on deck at my work as far as security. I'm trying to pen test our network. I have a very basic question. My Question You ...
8
votes
1answer
972 views

How to perform penetration testing on a Flex application?

Possible Duplicate: What tools are there to inspect Flash SWF files? I have decompiled it, verified the source. All seems fine. Appscan also is not able to find anything in this case. But I ...
9
votes
2answers
669 views

Cross site scripting verification on a field which does not accept more than 20 characters

While performing penetration testing, I got stuck to a point. There is a text field which does not accept more than 20 characters(server side validation). I inserted following piece of code to check ...
4
votes
1answer
1k views

Are there any tools for automated penetration testing of Silverlight applications?

I'd like to find a tool to assist with automated penetration testing of Silverlight applications, in a similar vein to AppScan for webapps. Specifically, I'm looking for a tool that can cope with ...
3
votes
4answers
1k views

Problems during Pen-testing of SCADA systems

Is there a way to monitor the way the SCADA systems behave 'during pen-testing or security audit', and find out the implications of just port scans and/or monitor the state of activity while sending a ...
10
votes
6answers
397 views

Are all security requirements expected to be testable?

Many approaches exist to define security requirements. To keep it simple, i would say to define a security requirement, one need to model the threat encountered when building up misuse cases for ...
4
votes
2answers
2k views

Command line Nessus/OpenVAS or NSE to find specific vulns?

Which methods do you use to quickly scan a network for certain vulnerabilities? I read in the O'Reilly book Network Security Tools that Nessus had the ability to test for one vulnerability only, but ...
15
votes
6answers
3k views

Lightweight Live Pen-test OS

Does anyone know of any lightweight OSs that are great for Pen-testing? I would love to have a very lightweight live OS that I can boot off a USB and try some pen-testing against some of my ...
17
votes
6answers
6k views

What is the difference between a penetration test and a vulnerability assessment?

What is the difference between a penetration test and a vulnerability assessment? Why would you choose one over the other? What deliverables would you expect to receive and how would you rate the ...
17
votes
7answers
9k views

Comparing online security courses: eLearnSecurity vs. Offensive-Security

I'm a web programmer, using the Linux environment for 2 years.(I have experience with Web app hacks +Web app security techniques) I want to start studying security in-depth, but I have limited time ...
2
votes
3answers
4k views

intel wireless 5100 AGN adapter to support injection

i ran aireplay-ng -9 wlan0 and it seems that my intel PRO/Wireless 5100 AGN adapter does not support injection. i use Ubuntu 10.10 64bit (2.6.35-25-generic kernel). is it possible to make the adapter ...
34
votes
8answers
5k views

Books about Penetration Testing

What are the books you advise describing methods or steps required to make a successful penetration test? I have a base knowledge of common security checks, but it would be great if someone more ...
31
votes
6answers
14k views

Servers for penetration testing

I am learning to use Metasploit as part of one of my college lessons. As you may know there are software builds like NOWASP (Mutillidae) or Damn Vulnerable Linux that allow you to exercise on pentest ...
6
votes
4answers
257 views

Circumventing a “freemail” account form filter

I'll be honest - I want to download a free PDF from a website which requires me to enter my "non freeware" email address. I do have them, but I dont want to use one as I'm afraid of landing up on a ...
10
votes
6answers
2k views

Security review: “HTTP header user-agent has been set to (something)”

We got a security review done of our PHP code and they team advised this in their report (amongst other things): /appdir/ Details The HTTP header user-agent has been set to \" . Request GET ...
15
votes
3answers
378 views

Are there any decent web app security scanners that can integrate with a build server?

I've spent a lot of time in TeamCity recently and the nightly code quality metrics coming from the dupe finder, FxCop and NDepend have been great. What I'd really like to do is find a decent web app ...
8
votes
4answers
384 views

Is it practical and worthwhile to alternate penetration test vendors?

Is it considered a best practice to alternate the vendor used to perform penetration tests? For example if it is your policy to conduct a third-party penetration test semi-annually you would have ...