An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

1
vote
2answers
44 views

ruby on rails pentesting web applications

I am currently testing a RoR web application, but I am honestly at a bit of a loss, I have never gone up against a RoR application before and I was wondering if there were any specific tools I could ...
0
votes
1answer
45 views

Is creating secondary account on Black-Box Pentest Forbidden? [on hold]

Okay, so here it goes. I am the Red Team Lead, and as described earlier; not far (like about a week), I posted this. At the time, I was looking for a beautiful technical title which could match down ...
3
votes
1answer
34 views

What methods can be used to prevent the browser (IE11 specifically) from storing credentials / autocomplete

Going through Pen Test and it was asked of us to disable auto complete in our CC payment fields. We tried adding autocomplete=off and also tried false on the input filed. A ny suggestions to ...
21
votes
5answers
2k views

Open-source penetration-test automation

What order do typical open-source penetration tests operate? Which tools are run first, second, third -- and how do you control them? Does one simply use Metasploit RC files? A network vulnerability ...
4
votes
1answer
40 views

Securing client-side data from users

So my problem, in its general form, is encrypting test questions such that a client-side testing application can access the questions while students cannot. The naive approach, in my opinion, is to ...
0
votes
1answer
123 views

Windows netsh pivoting

I am pentesting a windows box to which I have gained system privileges. This box has two network interfaces. I have been able to reach machines on the second interface via the below netsh command. ...
2
votes
1answer
167 views

Is the Java programming language used for penetration testing in practice ? If so, does the same apply to C#?

Is the Java programming language used for penetration testing in practice? I've wondered whether Java is used or can be used for penetration testing in the field (people write pen-testing suites ...
0
votes
0answers
30 views

Snoop-it crashes on iOS6 [closed]

I'm trying to run Snoop-it on an iPhone 5 running iOS 6.1.4 but it crashes immediately after starting: Feb 25 14:18:56 iPhone Snoop-it Config[745]: MS:Notice: Injecting: com.nesolabs.Snoop-it-Config ...
1
vote
1answer
23 views

How to know an Apache web server mod_cgi module is enabled?

I am currently working on penetration test of a web site that uses an Apache HTTP server. To test a vulnerability which is related to mod_cgi module, I need to know whether this web site uses mod_cgi ...
1
vote
1answer
45 views

Tamper with post data before it is sent

I am currently doing some pentesting for my work (not my job role but i always wanted to learn). I am trying to modify post and get data as it is sent (intercept, tamper), the web app I am trying to ...
0
votes
0answers
11 views

Websphere Message Queue pen-testing [on hold]

I am responsible for pen-testing client-server Message Queue system. I have access to MQ Websphere client and MQ Websphere server machines. I want to have a document which shows security test cases ...
-5
votes
0answers
54 views

Link to more active security sites? [closed]

I have a BS/MS in Computer Science and have worked as a developer for 15 years. Currently I have been reading a lot about computer security. Serverfault and Stackoverflow seem to be the go to place ...
12
votes
3answers
10k views

Why does Hydra return 16 valid passwords when none are valid?

I've been playing around with Hydra and DVWA and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. I assume ...
-2
votes
0answers
42 views

Technical Pentest Name on Intrusion via Enumeration? [closed]

Okay, first off, it so happens that I was given a penetration test which were rejected by my lower vulnerability researchers (basically coming from the bug bounty family). As a part of my job role, I ...
1
vote
1answer
289 views

Failed to connect to netcat reverse shell

I am doing an exercise of PentesterLab, I've got a webshell called 1.pdf, and it can be included in index.php as a PHP file. It contains code like this: %PDF-1.4 <?php echo system($_GET["cmd"]); ...
0
votes
1answer
77 views

Question about padbuster … newbie

New to this type of attack trying to understand this .net oracle padding attack, i'm using this data : padbuster ...
18
votes
6answers
13k views

Penetration Testing Jobs without Experience [closed]

There seems to be a late trend where firms are beginning to hire fresh graduates for security related jobs. This is counter to what I've heard from experienced security professionals (as well as the ...
-4
votes
3answers
107 views

Can I do hacking using Windows OS? [closed]

I have searched the web a numerous times but haven't found an explicit answer to my question. I've studied (at school and on my own) computer networks for 2 years, doing active programming for 4 years ...
2
votes
3answers
173 views

Stored Cross-Site Scripting Without Parentheses or Spaces

I'm testing a commenting application that takes a link of the form http://google.com and puts it in an href tag as so: <a rel="nofollow" href="http://google.com"> The resulting comment is ...
8
votes
1answer
875 views

How can I find my home network's vulnerabilities when opening it for VPN connections

I want to open my home network so I can connect to it via VPN to do things™ while not at home. This concerns me because I am potentially opening doors that I don't know about. What tools can I use ...
1
vote
4answers
230 views

What is the difference between active reconnaissance and scanning/enumeration

I have just started studying for CEH exam v8 and I am trying to get the core of so called hacking phases. I could not totally understand the practical difference between the first two phases. In ...
2
votes
0answers
39 views

OCSP responder penetration testing

I have to do penetration testing on an OCSP responder. Are there any frameworks for OCSP pentesting? since it does not include any web applications to test, should I only run network penetration tests ...
1
vote
2answers
67 views

intentionally vulnerable virtualbox or vmware appliances for practicing mobile pentest? [closed]

Is there any virtualbox or vmware appliances or anything like metasploitable that one can use to practice mobile pentest without the real hardware? I can find those for traditional ethernet but what ...
0
votes
1answer
94 views

WPA cracking with Crunch, JTR & Aircrack

Now I assume that everyone knows of aircrack-ng and John The Ripper with it's fantastic ability to pause and resume cracking. With that aside, I want to add Crunch into the mix, however I can't seem ...
2
votes
1answer
41 views

Best way to do security testing for a server behind nginx proxy [closed]

I'm trying to do some security testing for my server(not a web server) which is sitting behind a nginx proxy. To start with it, I've done some fuzz testing using Sulley. As expected, most of the ...
0
votes
0answers
6 views

Cannot install IDSwakeup due to LibNet [migrated]

So I did download IDSwakeup and installed libnet and hping3 from ubuntu repositories. When I try to "make" IDSwakeup I get the following error: gcc -o iwu iwu.o -lnet ; \ iwu.o: In function `main': ...
3
votes
1answer
106 views

Are there any ways to leverage NTLM V2 hashes during a penetration test?

I am on a penetration test at the moment, where LM/NTMLv1 hashes are disabled. I have captured a number of NTLMv2 hashes via NBNS spoofing, however was unable to crack them after running them through ...
1
vote
1answer
256 views

Packet-filtering firewall evasion (Scanning)

Context I'm very familiar with different applications of scanning tools (. . . and you can use -mtu to specify the size of the fragments in nmap . . .) but every piece of information I read about ...
6
votes
4answers
293 views

Circumventing a “freemail” account form filter

I'll be honest - I want to download a free PDF from a website which requires me to enter my "non freeware" email address. I do have them, but I dont want to use one as I'm afraid of landing up on a ...
3
votes
1answer
21 views

Architecture dependency issue associated with malicious payloads

My question is regarding architectural restrictions associated with backdoor/bind/reverse tcp payloads used typically to gain shell through exploitation. In a situation where the target box ...
1
vote
0answers
57 views

Designing a dictionary attack using hydra on web login page [closed]

I am trying to develop a pentest on a product for a customer that is really interested in implementing good security. Using tamper data I get this information when clicking on the "Login" button in ...
1
vote
1answer
94 views

Java org.xmlpull.v1.XmlPullParser and XML External Entity (XXE) Processing Attacks

I'm evaluating the security of an Android application and the application is using the XmlPullParser included with Android. I'm having some difficulty getting any common attacks to work, but I want ...
0
votes
1answer
79 views

penetration testing first step [closed]

I've started a course about Penetration testing and CEH on cybrary. The course begins with an introduction that quickly describes each step of pentesting. The first step is essentially to gather ...
3
votes
1answer
223 views

Security analysis of Dashlane

I've been asked by a user whether I would recommend using the Dashlane password manager. I'm aware that other password managers have had some significant security problems, including XSS and CSRF ...
0
votes
2answers
36 views

To release as Open Source for Audit or to Keep “in house”

For cryptography, it is considered good practice to release the code so others can audit it...is this also true for penetration testing software?
0
votes
1answer
501 views

Testing Basic Authentication with ncrack

I'm conducting some basic pen testing against a page protected with Basic Authentication. I've sucessfully tested with Medusa and Hydra but am struggling to get the syntax correct for ncrack. The ...
0
votes
1answer
623 views

Proxychains + nmap = segmentation fault

If I try the sV (service detection) flag in nmap run via proxychains (socks5 server) it appears to give me a segmentation fault message:- root@kali:~# proxychains nmap -n -sT -Pn X.X.X.X -p ...
3
votes
3answers
915 views

Android/iOS application security testing checklist

According to OWASP, we have a list of top ten mobile application vulnerabilities. But we are damn sure that the number of vulnerabilities on mobile apps, especially android apps are far more than ...
1
vote
3answers
1k views

Login required before SQLmap

I have a multipart form data where I am suspecting one of the multipart form fields (parameter named htmlbevt_id), to be vulnerable to SQLi. To test for the same I captured the request using Burp and ...
3
votes
1answer
101 views

Proving SQL Injection Vulnerability

I have recently come across what I believe to be a serious flaw in the security of a 3rd party computer program used within my company. Apologies for deliberately keeping details vague, but I hope you ...
1
vote
3answers
259 views

What is the first step in auditing the security efficiency of a simple website?

I am asked to write a first technical audit about the security best practices to improve a PHP web-site security. I am wondering from where to start? Is there a famous audit forms to analyze and ...
1
vote
3answers
76 views

How to organize a CTF?

In the context of an IT event, my team would organize a CTF (Capture The Flag). About the challenges (we’re working on them). I want to have some references on the types and levels of difficulty that ...
4
votes
1answer
146 views

How do I scan for GHOST remotely?

I'm talking about CVE-2015-0235. I figured there's no Metasploit package for this kind of check yet and I also understood that there's a special VM by Qualys for this test. Do you guys know of any ...
0
votes
0answers
12 views

Trying to use mdk3 with Alfa AWUS036NHA, wireshark detects frames but cannot detect network [migrated]

I'm testing out some various tools, trying to get them to work, but I cannot seem to get the MDK3 beacon flooding mode to work. I'm using an Alfa card AWUS036NHA, I believe it has the correct drivers ...
0
votes
0answers
10 views

Is pesexec only useful with administrative credentials? [migrated]

I am an apprentice penetration tester, and I am trying to read as many tutorials and practice as much as I can. Something I continually see reference to is using psexec to execute commands remotely. ...
1
vote
1answer
365 views

Hydra from Kali Linux + Tamper http post form syntax of the failure login attempt [duplicate]

I had asked this question in the general forum I think it is more adequate to place it here. ...
0
votes
0answers
51 views

How to test backend virus behavior?

I have a website that allows the user to upload files. The front-end (web tier) checks the file extension and first few bytes of the file for the magic number of an acceptable file, but then ...
2
votes
1answer
57 views

How does the Samba misconfigured '/etc/passwd' file security bypass vulnerability work?

I just found this vulnerability on http://www.securityfocus.com/bid/36363/references, which affects several samba server 3.0.xx. Can anyone explain more about this vulnerability? How this bypass ...
0
votes
0answers
31 views

hydra password penetration test syntax [duplicate]

I am trying to penetrate a password on my own website using hydra. Let's say that I know login and password and i just put both there like in sample below: hydra -l admin -p password 123.123.123.123 ...
1
vote
1answer
52 views

Use THC hydra to make dictionary attack on localhost

I have programmed a log in in my webpage and now I want to test it against a dictionary attack. I am using Apache and my website is not online so to access it I connect to localhost/website In hydra I ...