An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

0
votes
0answers
14 views

which browser render \ to /?

I wanted to confirm one issue. What are the browser which render \ to /. So i mean if the application is filtrating / and " then is it possible to trigger XSS? For example: <script> var a = ...
2
votes
5answers
132 views

Software Testing vs (Web) Penetration Testing

I would like to ask about the differences between Software Testing and Web Application Penetration Testing. I am aware of usage different tools in both disciplines Software Testing (JIRA/Selenium) ...
14
votes
2answers
2k views

How to convince my management of a physical security risk?

While I do not claim to be an expert in all things security based, I'd think that I have a good grounded knowledge of what is acceptable and what is not in regards to digital security. After giving ...
24
votes
5answers
2k views

Open-source penetration-test automation

What order do typical open-source penetration tests operate? Which tools are run first, second, third -- and how do you control them? Does one simply use Metasploit RC files? A network vulnerability ...
7
votes
1answer
58 views

Is it possible to emulate real network printer i.e. to run some actual firmware in VM?

I've got to the section related to network printers exploitation while going through one security course. Under "network printer" I understand standalone devices with a dedicated ethernet\wireless ...
0
votes
2answers
53 views

Setting up a security lab, looking for a little guidance [duplicate]

I'm new here. Over the past couple of years I've had a growing interest in the security aspects of IT/CS. Recently, I've started setting up a lab for myself based on a kali/win7 dualboot and I've ...
0
votes
0answers
28 views

sqlmap cannot find injection vulnerability

I create a page called register.php which will take 4 parameters user, pass, email, comments. And the pass is vulnerable to sql injeciton. I have tested the vulnerability manually by filling test', ...
1
vote
1answer
74 views

How to pen-test RAP applications

Has any of the readers here got experience with pen-testing RAP (Remote Application Platform) applications? I am particularly interested in testing on input validation. A cursory research at google ...
0
votes
1answer
110 views

Question about padbuster … newbie

New to this type of attack trying to understand this .net oracle padding attack, i'm using this data : padbuster ...
1
vote
2answers
331 views

XSS when some keywords are prevented on the server side

When I scan website with burp suite pro, I encountered a XSS. This XSS is <a b=c> When Burp suite test other payloads that contain keywords like script, alert, onerror, this parameters ...
1
vote
3answers
114 views

Trouble understand login vulnerabilities

I'm testing my own web page with the following vulnerabilities. #1: Form escapes ' to \' So if a user tries to enter the following information: username: 'or'1=1 password: m username will ...
-2
votes
0answers
17 views

How to concatenate 2 function in php [migrated]

I have an application with the following code: <?php if(isset($_GET['function'])){ $_GET['function'](); } ?> So if i entered this url: http://localhost/?function=phpinfo I ...
0
votes
0answers
34 views

What can I do with a SSH certificate? [migrated]

Doing an information security project at the moment. After gaining access to ftp drive, there was a file simply called 'hackme' inside. It contains what looks like to me a SSH certificate, but not ...
4
votes
4answers
4k views

Wifi penetration testing: Why aireplay-ng de-authentication does not work?

I am trying to pentest the security of the password of my wireless network. It is a WPA2 with pre-shared-keys. My current computer is connected to the wifi router and I try to de-auth my own machine. ...
0
votes
1answer
191 views

WPA cracking with Crunch, JTR & Aircrack

Now I assume that everyone knows of aircrack-ng and John The Ripper with it's fantastic ability to pause and resume cracking. With that aside, I want to add Crunch into the mix, however I can't seem ...
1
vote
2answers
26 views

Determining a version of SSH from penetration testing?

I am a software developer -- but not a security specialist. A (legitimate) company that does security scans sent my company a notice that we are running an older version of SSH on our hosting server. ...
1
vote
1answer
42 views

How to create a OSx pen testing environment

I currently use OSx Maverick, I wish to use this machine as my pen testing machine as I also prefer coding on this machine. My current pentest machine is running Kali. Can anyone give me good tips on ...
19
votes
7answers
3k views

What are some good website security scanning solutions?

What are some good web-based website security scanning solutions? I'm not too concerned if they are web-based solutions, or software that can be run locally. Generally, I'm looking for something we ...
14
votes
2answers
1k views

What are legal/ethical concerns to bear in mind, when hacking websites with open invitations?

I was reading another question which mentions a site that had a page inviting people to try to hack it, and it made me wonder. Lets assume, for the sake of this rather hypothetical question, that a ...
1
vote
0answers
36 views

Wireless Testing - monitor mode issues

I am currently learning about Wireless testing and have stumbled across a couple of little issues. The system setup I am working on is as outlined below: Kali Linux - 64-Bit (GNOME v3.4.2) Virtual ...
6
votes
6answers
3k views

eCPPT vs. OSCP Certification

I am a soon to be college student. I am looking to become certified in pentesting for both personal interest as well as to be able to have something that would look good to future employers. Both ...
3
votes
1answer
351 views

Security analysis of Dashlane

I've been asked by a user whether I would recommend using the Dashlane password manager. I'm aware that other password managers have had some significant security problems, including XSS and CSRF ...
1
vote
3answers
1k views

Determining false positives when scanning for live hosts with Nmap

When doing a vulnerability assessment on a large network, it seems general practice to determine which hosts on the network are live. This can be done in various ways. From what I have read it is ...
2
votes
1answer
77 views

Resources to learn about Windows systems exploitation [closed]

I'm a beginner in penetration testing, and I'm struggling with finding decent material to learn. I used book about nmap, Metasploit, exploit writing etc..., but they contained too much information ...
19
votes
6answers
15k views

At what point does “hacking” become illegal? (US)

Hypothetical situation: before I hire a web development company I want to test their ability to design secure web apps by viewing their previous client's websites. Issue: this situation raises a big ...
1
vote
1answer
36 views

proxychains-ng with nmap issues

Can anyone tell me if proxychains-ng has limitations to work with nmap? I found that it does not work well when using -sV option in nmap. (stop at "Initiating NSE at ..." and never finish the scan) ...
0
votes
0answers
33 views

Questions to confirm a good standpoint on web app security?

What should be the questions asked to assess a company on web app security? Our company is in process of partnering with another company in order to outsource web app security work to them. For us ...
0
votes
0answers
50 views

Virtual Pentesting Lab on popular Enterprise level UTM and SIEM

I’m planning to add a new Penetration Testing Segment to my personal “Pen Lab”. It’ll be centered around Vulnerability Assessments /Penetration Testing on market leading Next-Gen Enterprise ...
0
votes
1answer
558 views

Testing Basic Authentication with ncrack

I'm conducting some basic pen testing against a page protected with Basic Authentication. I've sucessfully tested with Medusa and Hydra but am struggling to get the syntax correct for ncrack. The ...
-1
votes
2answers
85 views

Question about job interview - Penetration Tester [closed]

I am little scared about following question: why do you want to be a penetration tester? Can anyone help me with an example of ethical answer?
0
votes
0answers
20 views

OAuth2 Authorization and Resource Server security check

I'm about to launch a web api using OAuth2 for authentication (authorization code, implicit and client credentials flows). The protocol is implemented using the DotNetOpenAuth v4.3 library. Although a ...
1
vote
3answers
1k views

Login required before SQLmap

I have a multipart form data where I am suspecting one of the multipart form fields (parameter named htmlbevt_id), to be vulnerable to SQLi. To test for the same I captured the request using Burp and ...
4
votes
2answers
656 views

Ruby resources for Penetration testing/testers and ethical hackers [closed]

I'm wondering if there is a place where I can find up-to-date information regarding ethical hacking with Ruby. I do find lot of Python information, which is OK, but I have 4 years of experience coding ...
4
votes
2answers
88 views

MongoDB Nosql injection in python code

Here is the code snippet for accessing to MongoDB. client = MongoClient() db = client.test_database collection = db.test # Get data from fields condition = form.getvalue('name') if condition: ...
12
votes
6answers
34k views

Testing for HTTP TRACE method

How can I test for HTTP TRACE on my web-server? I need to train a Tester how to verify that the HTTP TRACE method is disabled. Ideally I need a script to paste into Firebug to initiate a https ...
1
vote
2answers
80 views

ruby on rails pentesting web applications

I am currently testing a RoR web application, but I am honestly at a bit of a loss, I have never gone up against a RoR application before and I was wondering if there were any specific tools I could ...
0
votes
1answer
59 views

Is creating secondary account on Black-Box Pentest Forbidden? [closed]

Okay, so here it goes. I am the Red Team Lead, and as described earlier; not far (like about a week), I posted this. At the time, I was looking for a beautiful technical title which could match down ...
3
votes
1answer
61 views

What methods can be used to prevent the browser (IE11 specifically) from storing credentials / autocomplete

Going through Pen Test and it was asked of us to disable auto complete in our CC payment fields. We tried adding autocomplete=off and also tried false on the input filed. A ny suggestions to ...
4
votes
1answer
47 views

Securing client-side data from users

So my problem, in its general form, is encrypting test questions such that a client-side testing application can access the questions while students cannot. The naive approach, in my opinion, is to ...
0
votes
1answer
144 views

Windows netsh pivoting

I am pentesting a windows box to which I have gained system privileges. This box has two network interfaces. I have been able to reach machines on the second interface via the below netsh command. ...
2
votes
1answer
188 views

Is the Java programming language used for penetration testing in practice ? If so, does the same apply to C#?

Is the Java programming language used for penetration testing in practice? I've wondered whether Java is used or can be used for penetration testing in the field (people write pen-testing suites ...
1
vote
1answer
46 views

How to know an Apache web server mod_cgi module is enabled?

I am currently working on penetration test of a web site that uses an Apache HTTP server. To test a vulnerability which is related to mod_cgi module, I need to know whether this web site uses mod_cgi ...
1
vote
1answer
54 views

Tamper with post data before it is sent

I am currently doing some pentesting for my work (not my job role but i always wanted to learn). I am trying to modify post and get data as it is sent (intercept, tamper), the web app I am trying to ...
12
votes
3answers
11k views

Why does Hydra return 16 valid passwords when none are valid?

I've been playing around with Hydra and DVWA and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. I assume ...
1
vote
1answer
316 views

Failed to connect to netcat reverse shell

I am doing an exercise of PentesterLab, I've got a webshell called 1.pdf, and it can be included in index.php as a PHP file. It contains code like this: %PDF-1.4 <?php echo system($_GET["cmd"]); ...
18
votes
6answers
13k views

Penetration Testing Jobs without Experience [closed]

There seems to be a late trend where firms are beginning to hire fresh graduates for security related jobs. This is counter to what I've heard from experienced security professionals (as well as the ...
-4
votes
3answers
131 views

Can I do hacking using Windows OS? [closed]

I have searched the web a numerous times but haven't found an explicit answer to my question. I've studied (at school and on my own) computer networks for 2 years, doing active programming for 4 years ...
2
votes
3answers
236 views

Stored Cross-Site Scripting Without Parentheses or Spaces

I'm testing a commenting application that takes a link of the form http://google.com and puts it in an href tag as so: <a rel="nofollow" href="http://google.com"> The resulting comment is ...
8
votes
1answer
924 views

How can I find my home network's vulnerabilities when opening it for VPN connections

I want to open my home network so I can connect to it via VPN to do things™ while not at home. This concerns me because I am potentially opening doors that I don't know about. What tools can I use ...
1
vote
4answers
304 views

What is the difference between active reconnaissance and scanning/enumeration

I have just started studying for CEH exam v8 and I am trying to get the core of so called hacking phases. I could not totally understand the practical difference between the first two phases. In ...