An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

23
votes
10answers
4k views

Vulnerable OS's?

Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?
-4
votes
2answers
57 views

Android Penetration Testing

I need to do pen test for android mobile application. I have an android mobile and laptop connected to same wi-fi network. I need to intercept/capture the requests/traffic of the mobile in the laptop ...
21
votes
7answers
3k views

What should a security audit report include?

Background I'm in charge of auditing a medium-scale web application. I have audited web applications several times before, but I've always wrote a short PDF quickly explaining what I encountered and ...
35
votes
5answers
17k views

Servers for penetration testing

I am learning to use Metasploit as part of one of my college lessons. As you may know there are software builds like NOWASP (Mutillidae) or Damn Vulnerable Linux that allow you to exercise on pentest ...
-8
votes
1answer
79 views

I need help on how to hack into a scammer computer via IP/DNS [closed]

I really need your help in this one. Today I got scammed by a "trader" for 100$, but I managed to get his IP, reverse DNS and Hostname but I am unskilled in hacking. I need help here, I just want to ...
0
votes
0answers
35 views

Web Services Testing [closed]

I need to do security testing for RESTFUL web services. Are there any tools/checklists available? If so can someone help in sharing them as I don't much know about it. Also what are the details we ...
0
votes
0answers
37 views

Pros/Cons of internal pentest department vs external pentesters

What are the advantages and disadvantages of having an internal pentest department in a large company compared to external service providers?
-3
votes
0answers
27 views

How to test for the existence of default admin panel pages in a particular url? [closed]

I am currently testing for the existence of default admin panels of a web application on which I have the permission to test. I have a dictionary of names of default admin panels like ...
0
votes
1answer
16 views

Java org.xmlpull.v1.XmlPullParser and XML External Entity (XXE) Processing Attacks

I'm evaluating the security of an Android application and the application is using the XmlPullParser included with Android. I'm having some difficulty getting any common attacks to work, but I want ...
4
votes
5answers
9k views

Nexus 7 (Or any other good android tablets) For pen testing

I'm considering investing in an android tablet for pen testing. Does anyone know how capable they are with pen testing? Can they compile code or forward packets? Are any applications that work on ...
0
votes
1answer
31 views

How to test for zone transfer? [duplicate]

I heard that it is possible to test for zone transfer attacks on a web application using host and dig commands in Linux. How it is done?
0
votes
1answer
47 views

How to get the information from the iframe displayed (ClickJack) to the user back to the attacker?

Just for knowledge I want to know how to get the information from the i-frame displayed to the user back to the attacker? Scenario : Suppose You are an attacker and you want to grab the private ...
2
votes
1answer
176 views

Auto deploy war file (backdoor/shell) to particular folder

I am in the midst of a pentest. I have managed to uploaded a war shell (backdoor) in c:\test\ which is automatically deployed in a folder, for example c:\test\tmpbrowser.war. The application which I ...
1
vote
3answers
288 views

Login required before SQLmap

I have a multipart form data where I am suspecting one of the multipart form fields (parameter named htmlbevt_id), to be vulnerable to SQLi. To test for the same I captured the request using Burp and ...
5
votes
2answers
2k views

Benefits to BlackArch over Kali

Besides BlackArch having a cooler name and the whole Ubuntu vs. Arch Linux thing, what are the relative benefits of BlackArch over Kali? Are the tools broadly the same, or does one have better ...
4
votes
6answers
2k views

eCPPT vs. OSCP Certification

I am a soon to be college student. I am looking to become certified in pentesting for both personal interest as well as to be able to have something that would look good to future employers. Both ...
4
votes
1answer
96 views

How do I continue pentesting with access to local station?

I started learning hobbyist penetration testing a while ago, and as far as penetrating a computer I have physical access to, all is good. Mainly using Hiren bootCD, it is easy to gain access to an ...
1
vote
2answers
56 views

Burp configuration to allow SSL connection

I'm trying to capture Request/Responses using Burp on Mozilla. I've configured Burp Proxy on 8080 and have set same proxy settings on Firefox however when trying the Gmail link, Firefox gives "This ...
39
votes
5answers
4k views

New XSS cheatsheet?

There is a great list of XSS vectors avaliable here: http://ha.ckers.org/xss.html, but It hasn't changed much lately (eg. latest FF version mentioned is 2.0). Is there any other list as good as this, ...
3
votes
1answer
1k views

Is server exploitable by Shellshock with cgi-enabled only?

A server with vulnerable bash, but cgi enabled only and there are no cgi scripts in cgi-bin. Is it still exploitable ?? If there are scripts in cgi-bin and only server-admin knows about filenames of ...
2
votes
5answers
4k views

Efficient way for finding XSS vulnerabilities?

Manual (reliable) way: Put string containing characters that have special meaning in HTML into some parameter of HTTP request, look for this string in HTTP response (and possibly) in other places ...
0
votes
0answers
73 views

POST request in curl return all the source code of the page

I am trying to exploit the mutillidae web-application and I found a page vulnerable to sql injection but with a blacklist check embedded into the HTML code. I've tried to bypass this by forging a POST ...
-2
votes
2answers
41 views

Finding Directory traversal vulnerability [closed]

I want to test a web application for Directory Traversal (DT) vulnerability. I have gone through a lot of google pages but can't find a clear description. I've tried using ../.././../../etc/passwd ...
-1
votes
2answers
86 views

XSS InJavaScript

Recently i was figuring out a web application and found that the url is reflected among the source of the page which make it bit obvious for xss but the input from url which is reflected on source is ...
1
vote
0answers
32 views

Is there a way I can exploit any web application if on input it's reflecting back a HTML enitity?

I'm trying to check for SQL Injection or Authentication ByPass-Forced Browsing vulnerability in one of my web application. On a jsp page there's an input field. I inserted double quotes in it and it's ...
0
votes
1answer
44 views

What is the difference between active reconnaissance and scanning/enumeration

I have just started studying for CEH exam v8 and I am trying to get the core of so called hacking phases. I could not totally understand the practical difference between the first two phases. In ...
0
votes
0answers
57 views

Pentesting an ATM OS upgraded from Windows XP to Windows 7

How to approach penetration testing of a ATM OS that was upgraded from Windows XP to Windows 7? From what I gather, the testing flow should be as follows: Architectural Review Pentesting OS and ...
0
votes
0answers
14 views

Proper way to shutdown OpenVAS [migrated]

I currently start OpenVAS by calling openvasmd, ad, and sd manually. What is the proper way to stop these services? Killing the processes works but I don't know what might not be cleaned up by the ...
1
vote
0answers
108 views

Aircrack-ng “successfuly” cracks a .cap file, but it outputs the wrong password

This is my first post and I hope this is in the right section. I've been toying with attempting to crack my wpa password with aircrack-ng and airodump. I've successfully grabbed the 4-way handshake ...
1
vote
1answer
103 views

how can we find the CSRF vulnerability in a website?

I heard that there are no specific tools available to test and find out the CSRF vulnerability of a website. So from a security testers point of view, how to test for the CSRF vulnerability?
1
vote
1answer
129 views

How to perform penetration testing of Blackberry mobile applications?

I wish to start with blackberry mobile application penetration testing. I researched on net but no "in-depth" knowledge is available. Here is a good article but not much is covered. ...
0
votes
1answer
68 views

Smart Token Security Test [closed]

I have a question. One of my colleague gave me a Smart Token which consists of public/private key inside and asked me if I can test its security. I said it should be tested in a equipped lab for ...
0
votes
1answer
328 views

OWASP Zap proxy Fuzz XSS pentest against REST API

I am looking to PEN test my application against XSS attacks. The application is a REST API... As such when you POST some JSON to /cart/add to see the result of that attack you would need to GET ...
-1
votes
1answer
44 views

What is cookie reverse engineering? [closed]

I want to know what is this cookie reverse engineering and how to do this is simple words. Thanks in advance.
3
votes
2answers
444 views

How to simulate man in the middle attack in android emulator?

I am new to pen-testing. Yesterday i analysed one android application using dex2jar application and i saw an android application implemented https connection using empty trust manager. class miTM ...
3
votes
6answers
9k views

Using Python for security [closed]

I love using Python for the scripts I need and for work. But I really want to learn Python for network security since I will start a NS course next year. My question would be how would it be the best ...
1
vote
2answers
398 views

Looking for a tutorial on meterpreter extensions

A simple custom DLL source would be sufficient. All of the links I find on google are dead. I don't mind reading some clear source if there's a tut DLL floating about. I tried for meterpreter and ...
5
votes
4answers
600 views

What is a good browser for web application pen testing? [closed]

I am getting started in testing web applications, and I am having trouble verifying vulnerabilities. It seems all modern browsers have protections against things like XSS. When something like Burp ...
0
votes
1answer
49 views

Virtual Penetration Test Lab - Figuring Out Its Market Size

Is there any reliable data available based on which the Global Market Size of Virtual Pen Testing Labs ( or Cyber Ranges ) can be ascertained ? If NOT , is it possible to calculate it ?
16
votes
3answers
3k views

White-box vs. Black-box

What are the relative advantages and disadvantages of each form of testing? I.e. What is the difference between static code analysis and runtime/dynamic penetration testing? What are the pros and cons ...
2
votes
3answers
795 views

Replacement for DVL (Damn Vulnerable Linux)?

I've recently spotted that DVL (Damn Vulnerable Linux) has gone inactive. My first question is what happened to cause them to stop releasing it? Secondly, I have found some references to other ...
0
votes
2answers
77 views

Penetration testing preventive or detective control?

I have always wondered if penetration testing is a preventive or detective control. My view is that it is both preventive (preventive as it scans for vulnerabilities, which can be fixed to prevent ...
-1
votes
2answers
82 views

Getting Started In Information Security field [duplicate]

I want to become a pen tester/ethical hacker,what should I do in the beginning? (I'm new to information security ,i have basic knowledge in python,will it be okay if I take CEH course,Any help is ...
1
vote
2answers
98 views

Does the EICAR test work on Linux based antivirus scanners?

Does the EICAR antivirus test work on antivirus scanners for Linux? The EICAR test is described in more detail here: http://en.wikipedia.org/wiki/EICAR_test_file The reason I ask is that it requests ...
2
votes
2answers
690 views

Major differences between Kali and SecurityOnion

Curious about the major differences between Kali Linux and SecurityOnion. Do you think it would be easy or useful to replicate what has been done with SecurityOnion on Kali? Why is there such a ...
0
votes
0answers
19 views

what is path for a software developer to gain some experience in Information Security [duplicate]

What is path for a software developer to gain some experience in Information Security or to switch a day job for being a full time web developer to Security analyst or Pen tester or Ethical hacker. ...
1
vote
1answer
98 views

Is the Java programming language used for penetration testing in practice ? If so, does the same apply to C#?

Is the Java programming language used for penetration testing in practice ? I've wondered whether Java is used or can be used for penetration testing in the field (people write pentesting suites ...
9
votes
4answers
286 views

Defending site against being abused by phishing

Say you have a web site and you are using some returnUrl URL parameter to redirect user back to page where he was after login or editing some records in user area. Is there some standard way how to ...
1
vote
0answers
212 views

Proxychains + nmap = segmentation fault

If I try the sV (service detection) flag in nmap run via proxychains (socks5 server) it appears to give me a segmentation fault message:- root@kali:~# proxychains nmap -n -sT -Pn X.X.X.X -p ...
2
votes
2answers
199 views

Penetration testing's terms of agreement template

My company is going to start to provide penetration testing services pretty soon, in fact, we are just missing the legal aspects of it. I'm wondering if is there any template which states the most ...