An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

9
votes
4answers
275 views

Defending site against being abused by phishing

Say you have a web site and you are using some returnUrl URL parameter to redirect user back to page where he was after login or editing some records in user area. Is there some standard way how to ...
0
votes
0answers
14 views

Proxychains + nmap = segmentation fault

If I try the sV (service detection) flag in nmap run via proxychains (socks5 server) it appears to give me a segmentation fault message:- root@kali:~# proxychains nmap -n -sT -Pn X.X.X.X -p ...
2
votes
2answers
61 views

Penetration testing's terms of agreement template

My company is going to start to provide penetration testing services pretty soon, in fact, we are just missing the legal aspects of it. I'm wondering if is there any template which states the most ...
-1
votes
3answers
1k views

Issues setting up DVWA for SQLMAP [on hold]

I am starting on sqlmap, and have dvwa for practicing web app penetration. I am having the error "Could not connect to the database - please check the config file." Not sure what the problem is but ...
0
votes
0answers
10 views

Airmon-ng, airbase-ng and interface names [closed]

I recently found a tutorial on how to set up a rogue AP using airmon and airbase and have a couple questions regarding the interface naming conventions. We start off with my wireless interface which ...
0
votes
2answers
69 views

Is Pentesting now all about running Tools? [duplicate]

is Pentesting now just about running tools like Nessus and creating a report based on it ? and not actually exploiting anything on your own based on the Agreement ?
3
votes
1answer
71 views

Tools to make a security researchers life easier - tracking vulnerability research [closed]

I've been a developer for quite some time, and as part of my on-going learning process I've learnt how to spot and remedy broken (and insecure) code written by others. Recently, I've found myself ...
-3
votes
0answers
47 views

How are hardware anti tamper mechanism usually defeated? [closed]

What are the commons attacks used to compromise/defeats/bypass hardware anti tampering mechanisms ? With anti-tampering mechanism I mean all the mechanism deployed in: box board chips used to ...
17
votes
1answer
3k views

How can I spoof a phone call and make it appear to come from another phone?

I'm performing a penetration test against a company. Part of my social engineering procedure is to contact the IT department and try to convince them to that I'm an employee in the company and get ...
3
votes
1answer
49 views

How to intercept requests/responses from Smart Phone while surfing internet?

I have used Burp Suite Penetration testing tool in my computer to intercept requests.Assume that I am using Smart Phone. So Is it possible to intercept my smart phone requests into my computer?
0
votes
1answer
50 views

Pivoting without meterpreter [closed]

Is there any way other than Meterpreter to pivot into the network? If yes, then please guide. I already know about Meterpreter, just want to know manual methods other than this.
25
votes
8answers
12k views

What defines a programming language as useful for hacking?

I know that scripting languages (Perl, Ruby, Python, javascript, and even Lua!!!) are most suitable for hacking and penetration testing. My question is: What is it that makes those languages ...
0
votes
1answer
42 views

How do I report a vulnerability? [closed]

How would I report an international security vulnerability which could cause a lot of damage? I am asking how & where I would report this vulnerability, not now to create a simple vulnerability. ...
2
votes
3answers
41 views

is there a way to indirectly uncharge rapidly a coin cell to defeat an anti tampering mechanism?

An anti tampering mechanism of a device relay on detect tampering mechanism when the device is powered down using the energy provided internally by a coin cell. Is there a way to uncharge rapidly a ...
0
votes
1answer
44 views

OWASP Zap proxy Fuzz XSS pentest against REST API

I am looking to PEN test my application against XSS attacks. The application is a REST API... As such when you POST some JSON to /cart/add to see the result of that attack you would need to GET ...
2
votes
6answers
136 views

Hacking own computer [closed]

Ok I've worked with some penetration testing but it's all done in house where I work at on a secure network to secure servers and work stations before being deployed. But my question here is kind of ...
10
votes
3answers
1k views

How to perform penetration testing on a Flex application?

Possible Duplicate: What tools are there to inspect Flash SWF files? I have decompiled it, verified the source. All seems fine. Appscan also is not able to find anything in this case. But I ...
2
votes
1answer
77 views

Ruby resources for Penetration testing/testers and ethical hackers

I'm wondering if there is a place where I can find up-to-date information regarding ethical hacking with Ruby. I do find lot of Python information, which is OK, but I have 4 years of experience coding ...
4
votes
6answers
8k views

Using Python for security

I love using Python for the scripts I need and for work. But I really want to learn Python for network security since I will start a NS course next year. My question would be how would it be the best ...
0
votes
0answers
37 views

How to perform penetration testing of Blackberry mobile applications?

I wish to start with blackberry mobile application penetration testing. I researched on net but no "in-depth" knowledge is available. Here is a good article but not much is covered. ...
4
votes
4answers
286 views

Effectiveness of Interactive Application Security Testing

There are a number of IAST tools available on the market such as Acunetix Web Vulnerability Scanner and HP WebInspect Real-Time. How effective are these at finding vulnerabilities? Is there any ...
0
votes
2answers
41 views

Manipulating data during a MiTM

I'm trying to learn some attack methods by myself and I have hit a wall where I can't find any information. I have successfully performed an ARP MiTM between 2 systems and I am able to sniff the ...
0
votes
3answers
364 views

How do you capture ALL the traffic from an Android app?

I want to capture all the traffic from an Android app for its pen-testing. How do I do that? Here's what I've already tried: I installed the app on an emulator and started the emulator with a ...
1
vote
0answers
118 views

Failed to connect to netcat reverse shell

I am doing an exercise of PentesterLab, I've got a webshell called 1.pdf, and it can be included in index.php as a PHP file. It contains code like this: %PDF-1.4 <?php echo system($_GET["cmd"]); ...
1
vote
1answer
115 views

Auto deploy war file (backdoor/shell) to particular folder

I am in the midst of a pentest. I have managed to uploaded a war shell (backdoor) in c:\test\ which is automatically deployed in a folder, for example c:\test\tmpbrowser.war. The application which I ...
0
votes
4answers
865 views

How can I test that I have correctly disabled unnecessary HTTP methods?

I am making a web-based application and I disabled some of the HTTP methods which are not necessary for the website (specifically, OPTIONS, HEAD and TRACE). I put this in the httpd.conf of my xampp ...
2
votes
3answers
1k views

how an iframe can cause xsrf?

I know how a form tag is prone to CSRF which does not use any token (or any other challenge-response mechanism) but I was wondering how an iFrame can be used to cause XSRF attack and what would be the ...
3
votes
2answers
4k views

Where can I download vulnerable Windows OS images to practice penetration testing?

My objective is to learn and practice all the vulnerabilities and their exploitation on vulnerable OS.
0
votes
2answers
40 views

Content of a penetration testing authorization

Recently I conducted a penetration testing where I used the following text as authorization: Penetration testing authorization During a penetration testing is possible that: The ...
0
votes
1answer
3k views

Wireless Adapters for Testing with BackTrack

I would like to begin testing and working with BackTrack. I have heard that the Alfa AWUS036H wireless adapter works well with BackTrack and allows for packet injection. This adapter, however, is ...
2
votes
3answers
508 views

Verifying NLA support on Remote Desktop

What is the best way to verify if an MSRDP server has NLA enabled or not? My understand is that if enabled, it will not show a graphical screen when trying to connect, but ask for credentials first. ...
1
vote
2answers
279 views

Given an IP address can you ssh into /tmp without password?

I'm a Software Engineer, but I have no experience in security, so i'm trying to learn by doing (woot Experiential learning!). I know that the permission settings on the tmp folder are very relaxed. ...
2
votes
2answers
57 views

Root from Database to OS

One of my friends rents a VPS on which he runs around 20 websites, some of them for small businesses. He has been having some security issues and has asked me to help assess the vulnerability of his ...
0
votes
1answer
100 views

Choosing the Path in IT Security [closed]

I graduated last year from an Informatics and Security degree program. This program was taken in a Canadian college. It equipped me with the basic security knowledge in all fields; networks, systems ...
1
vote
1answer
41 views

Where do I get “Mercury” by MWR InfoSecurity? [closed]

Mercury is a really great tool for android pen-testing as well as android forensics. However, they stopped its development and now I get redirected to some product called drozer. Does anyone know ...
0
votes
0answers
26 views

Windows tokens manipulation

I am creating a demo of the infamous windows tokens manipulation. the scenario I am using is as follows: A single PC connected to the domain controller. 2 users are signed in the DC through that ...
2
votes
0answers
86 views

What are shodan's IP addresses? [duplicate]

I'm attempted to eliminate a lot of the malicious traffic on my webserver as possible. In doing so I have performed a few tests and found that when my server is not listed on shodan there are no port ...
0
votes
2answers
159 views

Is sqlmap traceable?

Is sqlmap still traceable when we use --tor --user-agent and macchanger? For example: sqlmap -u "[vulnerable_website_link]" --tor --user-agent="Mozilla/5.0 (compatible; Googlebot/2.1; ...
0
votes
1answer
135 views

SQL injection is possible but selected queries not working

I'm black-box testing an application which uses java spring framework and MySQL in the back-end. When I insert a single quote (') in a text box field, the server returns a HTTP status code 500 ...
0
votes
1answer
60 views

Server SSLv2 enabled on non-webservers

Using Nessus I'm scanning our internal network for vulnerabilities and exploits. I've found a large number of instances where SSLv2 is enabled and is as a result, being flagged as a vulnerability. I ...
0
votes
1answer
195 views

Cracking a web form based logon with hydra [closed]

How do I have to use hydra on a web form? What I have done so far: I already successfully used hydra on a folder with an HTTP authentication: http://localhost/test/authtest/ with user admin and ...
37
votes
5answers
5k views

Do actual penetration testers actually use tools like metasploit?

I've played around with metasploit simply as a hobby but am wondering if actual pentesters and/or hackers actually use metasploit to get into systems or do they write their own post exploitation ...
1
vote
3answers
204 views

What exactly does one get from a Nmap Scan?

I know nmap is a port scanner and its output shows all the open ports, the services running on those ports, the underlying OS and technology, etc. What should one take from this result in easiest ...
0
votes
3answers
90 views

Practicing pentesting locally

After watching videos and downloading just about every possible pen-testing tool out there to play around with and learn. How do you setup test beds and practice scenarios to crack? With RE people ...
0
votes
1answer
44 views

Are there any tools/methods to probe a web app from diffferent IPs?

I am currently reading "Metasploit: The Penetration Tester's Guide" and I came across the following paragraph in the book (in the 1st chapter) During intelligence gathering, you attempt to ...
0
votes
1answer
62 views

Resources for pentesting cloud based services/web-apps?

I want to know about some of the good resources for pen-testing cloud based services or web-apps (such as AWS). I googled for it but there are really few good resources out there. For example, I liked ...
32
votes
5answers
16k views

Servers for penetration testing

I am learning to use Metasploit as part of one of my college lessons. As you may know there are software builds like NOWASP (Mutillidae) or Damn Vulnerable Linux that allow you to exercise on pentest ...
1
vote
1answer
307 views

Hydra gives wrong passwords

I've been trying to use hydra (educational way) but with no success. The site method is http-post but performed by ajax (should it be a problem? I think not). After execute the command I got an output ...
73
votes
8answers
75k views

Can webcams be turned on without the indicator light?

I want to know how secure I am. I've made a series of pentests in my network and one of the things I've tried was to record webcam and microphone. Recording an end-user's microphone seems to be a ...
37
votes
9answers
6k views

Books about Penetration Testing

What are the books you advise describing methods or steps required to make a successful penetration test? I have a base knowledge of common security checks, but it would be great if someone more ...