An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

-1
votes
0answers
17 views

Python based router pentesting framework failed to work [on hold]

I am pentesting my local network using the python-based routersploit framework. During execution it gives the error: Traceback (most recent call last): File "./rsf.py", line 11, in <module> ...
-1
votes
1answer
65 views

Penetration Testing Methodologies

I have some issues regarding the concept of black, grey and white hat and my question is: Were and in what penetration testing methodology I can find the black, grey or white hat concept definition?
3
votes
3answers
392 views

Is array injection a vulnerability and what is the proper term for it?

When I'm penetration testing I sometimes notice undesirable behaviour of a PHP script when I inject a single or multidimensional array using the HTTP GET parameters. Possible availability risk This ...
1
vote
1answer
28 views

Should pypi subdirectories be accessible from web browser?

I am a security researcher and when I was fingerprinting one web application I found out that all the subdirectories of domain.com/pypi were accessible from the web browser. The main directory pypi ...
-1
votes
0answers
10 views

How does DNS-based Authentication of Named Entities (DANE) work?

How does DNS-based Authentication of Named Entities (DANE) work? If I'm correct it depends on a valid DNSSEC configuration (Domain Name System Security Extensions)? But what does it do and how does it ...
3
votes
4answers
165 views

Question on information retrieved from systems that could potentially lead to exploits

Usually it is advised, when one wants to secure an application, to "provide" as little information, or better yet, no information at all to unauthorized (possibly malicious) users. I'm thinking of ...
0
votes
1answer
176 views

Sqlmap doesn't exploit verified SQL injection

Right now I'm tinkering with the Hackxor VM (a pentesting training enviroment) and I'm trying to use sqlmap to exploit a vulnerability which I can exploit manually. The vulnerability is in the ...
2
votes
1answer
55 views

Getting error in Hydra

I'm trying to test someones website for them and I'm using hydra in cygwin on Windows. When I enter: hydra -L myusers.txt -P mypass.txt website.net http-get-form \ "/wp-login.php:user_login=^USER^&...
5
votes
3answers
79 views

Can I test my own network?

I'm currently trying to enter the field of information security and I was just wondering if there was anything barring me from testing my own network for security vulnerabilities? I only have a couple ...
5
votes
4answers
15k views

Wifi penetration testing: Why aireplay-ng de-authentication does not work?

I am trying to pentest the security of the password of my wireless network. It is a WPA2 with pre-shared-keys. My current computer is connected to the wifi router and I try to de-auth my own machine. ...
7
votes
3answers
2k views

Where can I find exploit code?

I am doing VA/PT on a sample web application. I run the Nessus scanner and I found some high severity vulnerabilities that are related to HP System Management Homepage. The CVE-numbers are: CVE-2010-...
0
votes
2answers
48 views

Security scan with or without IP whitelisting in the firewall and isn't that introducing a weak point?

In case of an automated security scan is it more desirable to get the scanner IP addresses whitelisted in order to possibly find vulnerabilities behind the firewall, or to scan in front of/against the ...
1
vote
1answer
24 views

Unable to PSEXEC into machine with admin hash

I'm doing a penetration test at the moment, and I am trying to PSEXEC into a machine for which I have the local administrator hash. I am attempting this with metasploit and metasploits psexec module. ...
0
votes
3answers
272 views

How can I prevent myself from barcode payload attacks?

Recently I came across a tool which can inject payloads into a barcode. How can I prevent myself from this kind of attacks? Attack scenario: The attacker prints vulnerable barcode / sends ...
1
vote
1answer
358 views

No handshake recorded from airodump-ng

I've just started to attempt this by following the guide from lewiscomputerhowto. I've seen other people ask similar questions, but they all seem to be older threads. The steps I've taken are shown ...
-1
votes
0answers
48 views

MS16-032 Privilege Escalation - how to get system in the same shell? [closed]

When I used MS16-032, it opened a new CMD with admin privilege, but I want to do it remotely without showing a new window to the user. How can I use it remotely and get admin in the same shell not ...
24
votes
2answers
3k views

Is the undesirable conversion of a scientific number a vulnerability?

I noticed in several penetration tests that PHP is converting values like 1e9 to 1000000000 while the max accepted string length of this number is 3 (in the database storage and as maxlength property ...
2
votes
1answer
89 views

What is an IEX download cradle?

Does anybody know what an IEX download cradle is? Is it something that belongs only to the cyber security/pentesting realm? I am asking based on this post: http://www.xorrior.com/powershell-web-...
0
votes
1answer
26 views

Pentest scenario where ping multiple Hosts is useful?

I would like to know if there's any pentesting scenarios where ping multiple hosts is useful for the pentester. EDIT. Of course any other that know if the host is live...
2
votes
2answers
61 views

How to categorise web vulnerabilities in a report?

What is a good way to categorise the vulnerabilities in IT security reports. Assuming it's about a web-based environments like: Websites, Web applications, Web shops, Any interface using web-...
5
votes
1answer
274 views

How to pentest DTLS-SRTP?

I'm currently working on a penetration test about DTLS-SRTP strengths and weaknesses. But I'm stuck on an eavesdropping test using Wireshark. Yes, it's protected by SRTP, but: What's DTLS actually ...
1
vote
1answer
218 views

Different TTL for a single server

One of our client perform a qualys pentest, and find LB based on TTL value. We have only 1 server behind FW with NAT IP. Running ubuntu that has default TTL '64' qualys output Number of web ...
5
votes
3answers
56 views

When testing out security vulnerabilities on sites such as OWASP Projects, should we be in a secured/protected environment?

I was curious if there is any need to secure/protect ourselves when doing projects on sites like OWASP to learn about vulnerabilities or "Wargames/Challenges" such as what's posted in these links How ...
8
votes
1answer
158 views

How do you pen test a REST API?

We have a server that is running a REST API on port 443. I'd like to make sure it's secure by doing various pen tests on it. I'm used to doing offensive testing on a webpage where I can see code, and ...
3
votes
2answers
409 views

Does PT (Penetration Test) allow rooting a server?

When doing a PT, are we allowed to root servers to escalate privileges? I am planning for post exploitation and it necessary to root server for that. So it is better to stop there or go further.
-7
votes
1answer
35 views

Advice on pentesting web applications? [closed]

A year ago I started to learn some things about hacking websites but in an incorrect/unstructured way. That's why I decided to start over at zero, and that's why I'm here. What's the things that I ...
0
votes
3answers
66 views

Web application penetration testing methodology

I'm following a course where the trainer recommends to identify all the vulnerabilities affecting a web application before trying to exploit them. While I understand the need to identify all the ...
0
votes
0answers
45 views

how to start a reverse meterpreter session with powershell

I'm doing some pentesting training. Since powershell scripts more easily allow to bypass antivirus protection I wanted to start a meterpreter session with a powershell script. Here is how I generated ...
0
votes
0answers
68 views

Microsoft IP Blocked by my fail2ban

Yesterday at 3AM our Fail2ban blocked an IP, not tremendously uncommon, however it appears to relate back to a Microsoft address. This could perhaps be an Azure server being used for the abuse. My ...
0
votes
1answer
42 views

Are There Any Measurements for Web-Application Complexity That Positively Correlates to Num. Vulnerabilities?

Web-applications have vulnerabilities. Generally, a more complex web-application has more vulnerabilities, compared with a simpler and smaller web-application. For example, white hat hackers have ...
43
votes
1answer
5k views

I have the ability to run arbitrary Python code on the 'apache' user. What damage can I do?

So, due to bad programming on the part of one of my former colleagues, one of our internal web apps allows the user to upload and run an arbitrary Python file. This recently came to light via an ...
3
votes
2answers
128 views

Reverse shell hangs web server?

So I am currently playing around with DVWA, and by exploiting the local file inclusion vuln I can manage to upload the nc.exe binary on the target server and execute a reverse shell to my machine. ...
6
votes
1answer
389 views

SSH ciphers, MAC and key-exchange (and pen-tests thereof)

At work we've been trying to move our external-facing services away from a policy of inclusivity (where we tried to accept as many people as possible) to a more security-focused setup. The first step ...
-7
votes
1answer
56 views

bind(merge) exe with jpg [closed]

i have an exe file and a jpg file, i want to bind them into one executable(exe) file, in the way that when user double click on that executable: first image will shown to him then the exe file will ...
0
votes
0answers
65 views

OWASP-ZAP and DVWA Login

I need to do a pentest of the DVWA application. To do that, I chose the OWASP-ZAP tool. I followed all the steps of this tutorial. But when I try to run the "spider" the program doesn't find all the ...
2
votes
3answers
3k views

CentOS for security testing?

I am a QA Engineer, but have been tasked with creating a security testing platform. I have many years with Backtrack/Kali and my primary OS are Arch and Ubuntu. The Systems guys here gave me a CentOS ...
0
votes
0answers
41 views

Attaching orphaned/stageless session meterpreter

I have problems with meterpreter reverse_https. In my engagement, I saw this message in console; "Attaching orphaned/stageless session meterpreter" But after I lose connection, and victim connects ...
4
votes
3answers
83 views

Frameworks for collecting all activities in a pentest?

I work as a penetration tester for a company, and one thing we're regularly asked to do is to provide a forensic log of all of the activities we perform during the course of an assessment. I'm ...
1
vote
0answers
40 views

“Rollback process” for different penetration testing in case of something goes wrong? [closed]

In some extent, different kind of vulnerability assessment and penetration testing may impact on target system. I am looking for the solution/rollback process if something goes wrong during test. ...
0
votes
0answers
15 views

meterpreter/reverse_tcp handler other then metasploit's handler [duplicate]

Actually i am getting the error on metasploit handler "Connection reset by peer ssl_accept". On investigation, I came to know that I was running my powershell payload using powershell.exe (32 bit ...
3
votes
1answer
71 views

using netcat as a handler for windows/meterpreter/reverse_tcp payload

How we can use netcat as a handler for windows/meterpreter/reverse_tcp payload. I am getting the connection but unable to run any command.
3
votes
4answers
2k views

Problems during Pen-testing of SCADA systems

Is there a way to monitor the way the SCADA systems behave 'during pen-testing or security audit', and find out the implications of just port scans and/or monitor the state of activity while sending a ...
4
votes
2answers
74 views

Is it OK to do a security testing in parallel with a QA testing?

This may not be a very technical question per se, so please feel free to move it to the respective forum/stack. However, I would really appreciate anybody experienced or experiencing a similar ...
2
votes
2answers
93 views

Pentesting - best bang for your buck? (credentialed versus non-credentialed)

My day to day activities consist primarily of penetration testing (white/grey/black). Throughout my engagements, I try to educate my clients on the differences of testing types. E.g., credentialed ...
1
vote
2answers
162 views

Heartbleed POC: Is this sensitive information?

In order to demonstrate the Heartbleed problem, I executed a publicly available exploit against a vulnerable old NAS web-server that has since been replaced. Below is an excerpt from the subsequent ...
0
votes
0answers
46 views

Deciding on payload

I am new to penetration testing and I am trying to understand how to choose a payload and why. For example I set up 2 virtual machines 1 with Kali Linux and a Windows XP SP2. On a previous experience ...
2
votes
2answers
103 views

Explaining information leak to Lead dev

Our lead dev tells me that this information leak from our website is "no vulnerability. Just an ugly error UI." It looks to me that the leaked information could be used to aid an attack. Does it ...
-1
votes
1answer
35 views

What are the most important vulnerabilities must be where professionalism [closed]

As we know that the vulnerabilities are many and varied, but what are the vulnerabilities in most locations and which need to be addressed and the focus on.
2
votes
1answer
62 views

Deliberate Vulnerable Openstack images for penetration testing/training or research

I was just wondering if there are already deliberate vulnerable Openstack images for penetration testing/training or research. Something in line with OWASP's DVWA e.t.c....there quite a lot out there ...
1
vote
0answers
76 views

Dumping Large table using Sqlmap

I am learning/working on sqlmap and I was trying to dump a large table with 11K entries on my localhost. The command I used is: python sqlmap.py -u "http://localhost/searchre.php" --data="search=' ...