An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

37
votes
5answers
4k views

Open-source penetration-test automation

What order do typical open-source penetration tests operate? Which tools are run first, second, third -- and how do you control them? Does one simply use Metasploit RC files? A network vulnerability ...
0
votes
0answers
37 views

Firewall source and destination IP validation

For an external firewall interface, why is it a good idea to validate that the source IP address was initiated from an internal IP, or why it originated from an external IP? If, hypothetically, the ...
2
votes
1answer
60 views

Man in the Middle attack?

in a scenario where I have a gateway to the Internet and a switch(layer 2) connected to this gateway. I have two computers in the same broadcast domain connected to the switch. all traffic to the ...
1
vote
1answer
38 views

using VLAN to mitigate ARP poisoning

hi I have been told VLANs can help mitigate ARP poisoning because they can be configured with different broadcast domains. and arp works using a simple broadcast domain. can someone explain how the ...
1
vote
1answer
58 views

Pentesting a Data Warehouse?

One client has recently implemented AWS and has a EC2 instance running. We have made one scoping call and further to that they provided me with a diagram that I have modified to avoid any issue: ...
15
votes
6answers
4k views

Automated tools vs. Manual reviews

What are the advantages of using automated tools, as opposed to manual review? What are the disadvantages? This applies both to external blackbox vulnerability scanning, and to static code analysis. ...
-1
votes
0answers
37 views

Could you reccomend me a book about Metasploit Framework? [on hold]

I am doing some pen testing and recently encountred Metasploit Framework. I would like to try it or better learn to use it, but wasnt able to find any good book. I found few but they were like 10 ...
1
vote
1answer
47 views

Unable to PSEXEC into machine with admin hash

I'm doing a penetration test at the moment, and I am trying to PSEXEC into a machine for which I have the local administrator hash. I am attempting this with metasploit and metasploits psexec module. ...
0
votes
3answers
112 views

How a professional hacker would penetrate a computer in a network?

Which kinds of vulnerabilities or security holes a hacker would use to penetrate and take over a computer in a network, like a normal PC in a default network (Wireless-LAN). I often hear that the ...
1
vote
2answers
71 views

What phases does a network penetration test consist of?

What are common phases of a network infrastructure penetration test? Staring with discovering IP's and ports? A simple vulnerability assessment, checking version information of banners from different ...
0
votes
1answer
71 views

What is the purpose of DNS-based Authentication of Named Entities (DANE) and how does it relate to DNSSEC?

What is the purpose of DNS-based Authentication of Named Entities (DANE)? And how does it relate to the Domain Name System Security Extensions (DNSSEC)? Secondly, how can I verify that DANE is ...
6
votes
1answer
292 views

How to pentest DTLS-SRTP?

I'm currently working on a penetration test about DTLS-SRTP strengths and weaknesses. But I'm stuck on an eavesdropping test using Wireshark. Yes, it's protected by SRTP, but: What's DTLS actually ...
1
vote
1answer
228 views

Different TTL for a single server

One of our client perform a qualys pentest, and find LB based on TTL value. We have only 1 server behind FW with NAT IP. Running ubuntu that has default TTL '64' qualys output Number of web ...
3
votes
2answers
136 views

Why is Kali Linux often used as a VM guest and not as the host? [closed]

I'm trying to enter the world of pentesting, and I've gone through quite a few tutorials in the past few days, and noticed that there's nearly no information regarding exploiting virtual machines ...
1
vote
2answers
90 views

What is Shikata Ga Nai

I came across this payload named "Shikata Ga Nai" (in Japanese it means nothing can be done about it). Some exe file was generated and when it is executed, a reverse shell can be obtained. But this ...
5
votes
3answers
60 views

When testing out security vulnerabilities on sites such as OWASP Projects, should we be in a secured/protected environment?

I was curious if there is any need to secure/protect ourselves when doing projects on sites like OWASP to learn about vulnerabilities or "Wargames/Challenges" such as what's posted in these links How ...
1
vote
1answer
122 views

UWP Windows 10 applications: Internals and Pentesting

I have tried looking into this topic. I started with understanding how differently a .exe Desktop app and a .appx Universal Windows app works. And this is my understanding: UWP apps will run in a ...
0
votes
1answer
46 views

Is it a good idea to preventive use a robots.txt that disallows all search engines to index query strings in order to slow down reconnaissance?

I know that robots.txt is not a security feature. But, indexed and cached information by search engines might be incredibly helpful in the reconnaissance phase of a penetration test and potentially ...
2
votes
2answers
90 views

Why does an external pentester testing my Azure website ask for IP, Gateway, DNS and VPN credentials?

I have an Azure website and a client who wants to use my site but needs to perform ethical hacking on it in order to decide if it's secure enough for them. They've asked me this to send them this: ...
4
votes
1answer
36 views

How to check for cross-domain referrer leakage?

I am learning pen testing on web applications. I found the vulnerability cross-domain referrer leakage very interesting. Can anybody please tell me how to check for this vulnerability on any web ...
2
votes
0answers
60 views

How to inject XSS using Response Splitting in the following scenario?

I have been pentesting for a company. I found a CRLF injection that could be done using %E5%98%8D%E5%98%8A instead of %0d%0a. So I'm using %E5%98%8D%E5%98%8A in redirection parameter for CR/LF. Here ...
6
votes
4answers
9k views

OSCP certification for junior pen tester position any good?

Currently finishing my degree in computer security and have a few years experience in IT support and want to get into a junior pen testing job or similar. Would the OSCP certification do me any ...
0
votes
3answers
97 views

Web application penetration testing methodology

I'm following a course where the trainer recommends to identify all the vulnerabilities affecting a web application before trying to exploit them. While I understand the need to identify all the ...
-1
votes
2answers
122 views

Are Tesla cars hacker-safe?

I was wondering, what would happen if a Tesla car was hacked into? Are future cars designed to be able to be stopped by police via remote access and commands? What if someone actually causes an ...
1
vote
1answer
14k views

Cracking a web form based logon with hydra [closed]

How do I have to use hydra on a web form? What I have done so far: I already successfully used hydra on a folder with an HTTP authentication: http://localhost/test/authtest/ with user admin and ...
3
votes
2answers
181 views

Can I trick a mail server into sending me an email?

Can I trick a mail server into sending me an email? I would like to do some email header analysis on the emails that are send by a mail-server in a penetration-test and possibly get to know more ...
5
votes
2answers
105 views

Do the skills of a software developer transfer well into working in computer security or white hat hacking? [closed]

I am conflicted. I want to become a software developer but I am also interested in the networking side of things… Is software development and network security 2 whole different beasts? If they are, ...
0
votes
2answers
86 views

Cracking WI-FI keys offline at distance?

Let's suppose I was able to get a handshake from my target's network ready to crack, but would like to crack the password far away from that network location. Would it be possible, or do I have to be ...
0
votes
0answers
44 views

How does an attacker compromise a soft switch?

Speaking of soft switches (e.g soft switch in data plane of software defined networking). I've been trying to find a good research paper or article that explains how an attacker can compromise a soft ...
-1
votes
1answer
88 views

Penetration Testing Methodologies

I have some issues regarding the concept of black, grey and white hat and my question is: Were and in what penetration testing methodology I can find the black, grey or white hat concept definition?
3
votes
3answers
413 views

Is array injection a vulnerability and what is the proper term for it?

When I'm penetration testing I sometimes notice undesirable behaviour of a PHP script when I inject a single or multidimensional array using the HTTP GET parameters. Possible availability risk This ...
1
vote
1answer
34 views

Should pypi subdirectories be accessible from web browser?

I am a security researcher and when I was fingerprinting one web application I found out that all the subdirectories of domain.com/pypi were accessible from the web browser. The main directory pypi ...
3
votes
4answers
167 views

Question on information retrieved from systems that could potentially lead to exploits

Usually it is advised, when one wants to secure an application, to "provide" as little information, or better yet, no information at all to unauthorized (possibly malicious) users. I'm thinking of ...
0
votes
1answer
204 views

Sqlmap doesn't exploit verified SQL injection

Right now I'm tinkering with the Hackxor VM (a pentesting training enviroment) and I'm trying to use sqlmap to exploit a vulnerability which I can exploit manually. The vulnerability is in the ...
2
votes
1answer
55 views

Getting error in Hydra

I'm trying to test someones website for them and I'm using hydra in cygwin on Windows. When I enter: hydra -L myusers.txt -P mypass.txt website.net http-get-form \ "/wp-login.php:user_login=^USER^&...
5
votes
3answers
93 views

Can I test my own network?

I'm currently trying to enter the field of information security and I was just wondering if there was anything barring me from testing my own network for security vulnerabilities? I only have a couple ...
5
votes
4answers
15k views

Wifi penetration testing: Why aireplay-ng de-authentication does not work?

I am trying to pentest the security of the password of my wireless network. It is a WPA2 with pre-shared-keys. My current computer is connected to the wifi router and I try to de-auth my own machine. ...
7
votes
3answers
2k views

Where can I find exploit code?

I am doing VA/PT on a sample web application. I run the Nessus scanner and I found some high severity vulnerabilities that are related to HP System Management Homepage. The CVE-numbers are: CVE-2010-...
0
votes
2answers
60 views

Security scan with or without IP whitelisting in the firewall and isn't that introducing a weak point?

In case of an automated security scan is it more desirable to get the scanner IP addresses whitelisted in order to possibly find vulnerabilities behind the firewall, or to scan in front of/against the ...
0
votes
3answers
286 views

How can I prevent myself from barcode payload attacks?

Recently I came across a tool which can inject payloads into a barcode. How can I prevent myself from this kind of attacks? Attack scenario: The attacker prints vulnerable barcode / sends ...
1
vote
1answer
625 views

No handshake recorded from airodump-ng

I've just started to attempt this by following the guide from lewiscomputerhowto. I've seen other people ask similar questions, but they all seem to be older threads. The steps I've taken are shown ...
24
votes
2answers
3k views

Is the undesirable conversion of a scientific number a vulnerability?

I noticed in several penetration tests that PHP is converting values like 1e9 to 1000000000 while the max accepted string length of this number is 3 (in the database storage and as maxlength property ...
2
votes
1answer
95 views

What is an IEX download cradle?

Does anybody know what an IEX download cradle is? Is it something that belongs only to the cyber security/pentesting realm? I am asking based on this post: http://www.xorrior.com/powershell-web-...
0
votes
1answer
27 views

Pentest scenario where ping multiple Hosts is useful?

I would like to know if there's any pentesting scenarios where ping multiple hosts is useful for the pentester. EDIT. Of course any other that know if the host is live...
2
votes
2answers
70 views

How to categorise web vulnerabilities in a report?

What is a good way to categorise the vulnerabilities in IT security reports. Assuming it's about a web-based environments like: Websites, Web applications, Web shops, Any interface using web-...
8
votes
1answer
230 views

How do you pen test a REST API?

We have a server that is running a REST API on port 443. I'd like to make sure it's secure by doing various pen tests on it. I'm used to doing offensive testing on a webpage where I can see code, and ...
3
votes
2answers
415 views

Does PT (Penetration Test) allow rooting a server?

When doing a PT, are we allowed to root servers to escalate privileges? I am planning for post exploitation and it necessary to root server for that. So it is better to stop there or go further.
-7
votes
1answer
38 views

Advice on pentesting web applications? [closed]

A year ago I started to learn some things about hacking websites but in an incorrect/unstructured way. That's why I decided to start over at zero, and that's why I'm here. What's the things that I ...
0
votes
0answers
57 views

how to start a reverse meterpreter session with powershell

I'm doing some pentesting training. Since powershell scripts more easily allow to bypass antivirus protection I wanted to start a meterpreter session with a powershell script. Here is how I generated ...
0
votes
0answers
73 views

Microsoft IP Blocked by my fail2ban

Yesterday at 3AM our Fail2ban blocked an IP, not tremendously uncommon, however it appears to relate back to a Microsoft address. This could perhaps be an Azure server being used for the abuse. My ...