An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

0
votes
0answers
3 views

Link to more active security sites?

I have a BS/MS in Computer Science and have worked as a developer for 15 years. Currently I have been reading a lot about computer security. Serverfault and Stackoverflow seem to be the go to place ...
12
votes
3answers
10k views

Why does Hydra return 16 valid passwords when none are valid?

I've been playing around with Hydra and DVWA and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. I assume ...
17
votes
5answers
2k views

Open-source penetration-test automation [on hold]

What order do typical open-source penetration tests operate? Which tools are run first, second, third -- and how do you control them? Does one simply use Metasploit RC files? A network vulnerability ...
0
votes
0answers
24 views

Snoop-it crashes on iOS6 [on hold]

I'm trying to run Snoop-it on an iPhone 5 running iOS 6.1.4 but it crashes immediately after starting: Feb 25 14:18:56 Sogetis-iPhone Snoop-it Config[745]: MS:Notice: Injecting: ...
-2
votes
0answers
32 views

Technical Pentest Name on Intrusion via Enumeration? [on hold]

Okay, first off, it so happens that I was given a penetration test which were rejected by my lower vulnerability researchers (basically coming from the bug bounty family). As a part of my job role, I ...
1
vote
1answer
282 views

Failed to connect to netcat reverse shell

I am doing an exercise of PentesterLab, I've got a webshell called 1.pdf, and it can be included in index.php as a PHP file. It contains code like this: %PDF-1.4 <?php echo system($_GET["cmd"]); ...
0
votes
1answer
77 views

Question about padbuster … newbie

New to this type of attack trying to understand this .net oracle padding attack, i'm using this data : padbuster ...
0
votes
0answers
15 views

theHarvester not exporting report [on hold]

./theHarvester.py -d targetdomain -l 1000 -b all -f output I am using theHarvester python application to gather data on a site for pentesting purposes. Which works well. Accept I am unable to save ...
18
votes
6answers
13k views

Penetration Testing Jobs without Experience [on hold]

There seems to be a late trend where firms are beginning to hire fresh graduates for security related jobs. This is counter to what I've heard from experienced security professionals (as well as the ...
-4
votes
3answers
98 views

Can I do hacking using Windows OS? [closed]

I have searched the web a numerous times but haven't found an explicit answer to my question. I've studied (at school and on my own) computer networks for 2 years, doing active programming for 4 years ...
2
votes
3answers
170 views

Stored Cross-Site Scripting Without Parentheses or Spaces

I'm testing a commenting application that takes a link of the form http://google.com and puts it in an href tag as so: <a rel="nofollow" href="http://google.com"> The resulting comment is ...
8
votes
1answer
866 views

How can I find my home network's vulnerabilities when opening it for VPN connections

I want to open my home network so I can connect to it via VPN to do things™ while not at home. This concerns me because I am potentially opening doors that I don't know about. What tools can I use ...
0
votes
0answers
9 views

Application Security Domain and Working with MNC's? [closed]

I am new into this community and I hope you all had been on your upwell health. Regarding my portfolio, I am a web application security analyst with little to 4 years experience on the application ...
1
vote
4answers
216 views

What is the difference between active reconnaissance and scanning/enumeration

I have just started studying for CEH exam v8 and I am trying to get the core of so called hacking phases. I could not totally understand the practical difference between the first two phases. In ...
2
votes
0answers
36 views

OCSP responder penetration testing

I have to do penetration testing on an OCSP responder. Are there any frameworks for OCSP pentesting? since it does not include any web applications to test, should I only run network penetration tests ...
1
vote
2answers
60 views

intentionally vulnerable virtualbox or vmware appliances for practicing mobile pentest? [closed]

Is there any virtualbox or vmware appliances or anything like metasploitable that one can use to practice mobile pentest without the real hardware? I can find those for traditional ethernet but what ...
0
votes
1answer
81 views

WPA cracking with Crunch, JTR & Aircrack

Now I assume that everyone knows of aircrack-ng and John The Ripper with it's fantastic ability to pause and resume cracking. With that aside, I want to add Crunch into the mix, however I can't seem ...
2
votes
1answer
36 views

Best way to do security testing for a server behind nginx proxy [closed]

I'm trying to do some security testing for my server(not a web server) which is sitting behind a nginx proxy. To start with it, I've done some fuzz testing using Sulley. As expected, most of the ...
0
votes
0answers
6 views

Cannot install IDSwakeup due to LibNet [migrated]

So I did download IDSwakeup and installed libnet and hping3 from ubuntu repositories. When I try to "make" IDSwakeup I get the following error: gcc -o iwu iwu.o -lnet ; \ iwu.o: In function `main': ...
3
votes
1answer
106 views

Are there any ways to leverage NTLM V2 hashes during a penetration test?

I am on a penetration test at the moment, where LM/NTMLv1 hashes are disabled. I have captured a number of NTLMv2 hashes via NBNS spoofing, however was unable to crack them after running them through ...
1
vote
1answer
254 views

Packet-filtering firewall evasion (Scanning)

Context I'm very familiar with different applications of scanning tools (. . . and you can use -mtu to specify the size of the fragments in nmap . . .) but every piece of information I read about ...
6
votes
4answers
293 views

Circumventing a “freemail” account form filter

I'll be honest - I want to download a free PDF from a website which requires me to enter my "non freeware" email address. I do have them, but I dont want to use one as I'm afraid of landing up on a ...
3
votes
1answer
20 views

Architecture dependency issue associated with malicious payloads

My question is regarding architectural restrictions associated with backdoor/bind/reverse tcp payloads used typically to gain shell through exploitation. In a situation where the target box ...
1
vote
0answers
52 views

Designing a dictionary attack using hydra on web login page [closed]

I am trying to develop a pentest on a product for a customer that is really interested in implementing good security. Using tamper data I get this information when clicking on the "Login" button in ...
1
vote
1answer
93 views

Java org.xmlpull.v1.XmlPullParser and XML External Entity (XXE) Processing Attacks

I'm evaluating the security of an Android application and the application is using the XmlPullParser included with Android. I'm having some difficulty getting any common attacks to work, but I want ...
0
votes
1answer
76 views

penetration testing first step [closed]

I've started a course about Penetration testing and CEH on cybrary. The course begins with an introduction that quickly describes each step of pentesting. The first step is essentially to gather ...
3
votes
1answer
216 views

Security analysis of Dashlane

I've been asked by a user whether I would recommend using the Dashlane password manager. I'm aware that other password managers have had some significant security problems, including XSS and CSRF ...
0
votes
2answers
36 views

To release as Open Source for Audit or to Keep “in house”

For cryptography, it is considered good practice to release the code so others can audit it...is this also true for penetration testing software?
0
votes
1answer
486 views

Testing Basic Authentication with ncrack

I'm conducting some basic pen testing against a page protected with Basic Authentication. I've sucessfully tested with Medusa and Hydra but am struggling to get the syntax correct for ncrack. The ...
0
votes
1answer
609 views

Proxychains + nmap = segmentation fault

If I try the sV (service detection) flag in nmap run via proxychains (socks5 server) it appears to give me a segmentation fault message:- root@kali:~# proxychains nmap -n -sT -Pn X.X.X.X -p ...
3
votes
3answers
847 views

Android/iOS application security testing checklist

According to OWASP, we have a list of top ten mobile application vulnerabilities. But we are damn sure that the number of vulnerabilities on mobile apps, especially android apps are far more than ...
1
vote
3answers
1k views

Login required before SQLmap

I have a multipart form data where I am suspecting one of the multipart form fields (parameter named htmlbevt_id), to be vulnerable to SQLi. To test for the same I captured the request using Burp and ...
3
votes
1answer
100 views

Proving SQL Injection Vulnerability

I have recently come across what I believe to be a serious flaw in the security of a 3rd party computer program used within my company. Apologies for deliberately keeping details vague, but I hope you ...
1
vote
3answers
259 views

What is the first step in auditing the security efficiency of a simple website?

I am asked to write a first technical audit about the security best practices to improve a PHP web-site security. I am wondering from where to start? Is there a famous audit forms to analyze and ...
1
vote
3answers
73 views

How to organize a CTF?

In the context of an IT event, my team would organize a CTF (Capture The Flag). About the challenges (we’re working on them). I want to have some references on the types and levels of difficulty that ...
0
votes
1answer
103 views

Windows netsh pivoting

I am pentesting a windows box to which I have gained system privileges. This box has two network interfaces. I have been able to reach machines on the second interface via the below netsh command. ...
4
votes
1answer
141 views

How do I scan for GHOST remotely?

I'm talking about CVE-2015-0235. I figured there's no Metasploit package for this kind of check yet and I also understood that there's a special VM by Qualys for this test. Do you guys know of any ...
0
votes
0answers
12 views

Trying to use mdk3 with Alfa AWUS036NHA, wireshark detects frames but cannot detect network [migrated]

I'm testing out some various tools, trying to get them to work, but I cannot seem to get the MDK3 beacon flooding mode to work. I'm using an Alfa card AWUS036NHA, I believe it has the correct drivers ...
0
votes
0answers
10 views

Is pesexec only useful with administrative credentials? [migrated]

I am an apprentice penetration tester, and I am trying to read as many tutorials and practice as much as I can. Something I continually see reference to is using psexec to execute commands remotely. ...
-1
votes
0answers
24 views

What keeps ports 32003 and 25419 open on my Ubuntu 14? [migrated]

I did a netstat on udp ports and found a service on port 32003 and one at 25419. What are they , how can I kill them at startup if they have no use? http://i.imgur.com/fo7atla.png
1
vote
1answer
308 views

Hydra from Kali Linux + Tamper http post form syntax of the failure login attempt [duplicate]

I had asked this question in the general forum I think it is more adequate to place it here. ...
0
votes
0answers
51 views

How to test backend virus behavior?

I have a website that allows the user to upload files. The front-end (web tier) checks the file extension and first few bytes of the file for the magic number of an acceptable file, but then ...
2
votes
1answer
55 views

How does the Samba misconfigured '/etc/passwd' file security bypass vulnerability work?

I just found this vulnerability on http://www.securityfocus.com/bid/36363/references, which affects several samba server 3.0.xx. Can anyone explain more about this vulnerability? How this bypass ...
0
votes
0answers
31 views

hydra password penetration test syntax [duplicate]

I am trying to penetrate a password on my own website using hydra. Let's say that I know login and password and i just put both there like in sample below: hydra -l admin -p password 123.123.123.123 ...
1
vote
1answer
49 views

Use THC hydra to make dictionary attack on localhost

I have programmed a log in in my webpage and now I want to test it against a dictionary attack. I am using Apache and my website is not online so to access it I connect to localhost/website In hydra I ...
5
votes
5answers
3k views

eCPPT vs. OSCP Certification

I am a soon to be college student. I am looking to become certified in pentesting for both personal interest as well as to be able to have something that would look good to future employers. Both ...
1
vote
2answers
58 views

Is a REST webservice without any authentication or authorization unsecure?

There is a REST-based webservice that has no authentication or authorization whatsoever - anyone that knows an URL of a particular method of this webservice can use it. However, the URLs of methods ...
1
vote
1answer
226 views

Aircrack-ng “successfuly” cracks a .cap file, but it outputs the wrong password

This is my first post and I hope this is in the right section. I've been toying with attempting to crack my wpa password with aircrack-ng and airodump. I've successfully grabbed the 4-way handshake ...
1
vote
1answer
43 views

Other than synchronizer token, is there any way of protection against CSRF using http headers?

Recently I came across some websites using HTTP Header namely X-XSRF-Token and a cookie with similar name. Is it a better mitigation than using random token based security for CSRF?
1
vote
3answers
4k views

How do you capture ALL the traffic from an Android app?

I want to capture all the traffic from an Android app for its pen-testing. How do I do that? Here's what I've already tried: I installed the app on an emulator and started the emulator with a ...