An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

0
votes
0answers
9 views

Intermediate proxy intercepting my SSL data between my computer and the ISP

I did a simple penetration test of my linux firewall today using grc.com's shieldsup on their website (https://www.grc.com/x/ne.dll?bh0bkyd20). Previously when doing this it shows I have full stealth ...
-1
votes
1answer
20 views

Are there pricing standards for Vulnerability assessment and penetration testing (VAPT) services?

Generally, to conduct vulnerability assessment and penetration testing (VAPT) for an application, we do charge some amount from the client, based on which criteria the companies charge their ...
2
votes
1answer
31 views

Network Architecture for CTF-scenario

My boss recently enrolled me in an InfoSec training. I am part of the network team, but have limited experience in InfoSec. My first assignment is to draw a layout of a network that will be used ...
2
votes
3answers
430 views

Wireless Testing - monitor mode issues

I am currently learning about Wireless testing and have stumbled across a couple of little issues. The system setup I am working on is as outlined below: Kali Linux - 64-Bit (GNOME v3.4.2) Virtual ...
-1
votes
2answers
95 views

What kind of information does a penetration tester require? [on hold]

We are planning for a penetration testing for our network and application. What should be shared with the penetration tester? For example, should we share the topology of our network? Should we ...
-1
votes
0answers
40 views

Information needed to share with Penetration Tester? [duplicate]

We are planning for a penetration testing for our network and applications. Can anyone confirm the details which should be shared to penetration testers regarding our topology / servers? Is it ...
-2
votes
0answers
36 views

Can you get past a regex or whitelisting? [on hold]

If there is the following code: function return_some_info($db, $id){ if (! preg_match("/^\d{5}$/",$id)) { header("Location: safepage.php"); exit; } // Further Code } ...
4
votes
1answer
58 views

Spoofing LAN IP Address Traffic

To give as much detail as possible, I am doing a Pentest for a client that has quite a few "terminal systems" meaning that they are simply a box with a connection back to the main server. These ...
-2
votes
0answers
18 views

Router hangs when running Nessus [on hold]

I tried to run a Nessus scan for my own website through my home router (ZTE ZXV10 W300). However, the router always hangs when I run Nessus. Internet also doesn't work on that time. Once, I pause the ...
0
votes
3answers
44 views

creating a testing environment

This question has been asked over and over again across the web, but many answers are either ridiculous or the same. I have tried using OWASPs VM which has a range of purposely built holes in web ...
-3
votes
0answers
25 views

How to perform penetration testing on android app? [duplicate]

I have an Apk file. I need to perform penetration testing on that app. Which are the tools required and how to perform? Please help me out here. It's very critical to me. I have already performed pen ...
2
votes
1answer
89 views

SSH ciphers, MAC and key-exchange (and pen-tests thereof)

At work we've been trying to move our external-facing services away from a policy of inclusivity (where we tried to accept as many people as possible) to a more security-focused setup. The first step ...
0
votes
1answer
67 views

What does the below SQL injection indicate?

What is the meaning of this command in SQL ? php?que_id =-1/**/UNION/**/ ALL/**/SELECT What does /**/? indicate here?
15
votes
5answers
3k views

Tools to help test the security of Android applications [closed]

What are some decent frameworks to test the security of Android applications? With frameworks I mean either software based to automatically scan these applications or a guide (like OWASP has for ...
57
votes
6answers
12k views

Do actual penetration testers actually use tools like metasploit?

I've played around with metasploit simply as a hobby but am wondering if actual pentesters and/or hackers actually use metasploit to get into systems or do they write their own post exploitation ...
22
votes
3answers
3k views

Metasploit Meterpreter alternatives

These days I am testing various type of client hacking techniques, but in all scenarios I am using Meterpreter variations as payload. Now I can bypass Anti-Virus and Firewalls easily, but Symantec ...
6
votes
1answer
262 views

Should veil framework produce packed and obfuscated binaries which bypass virustotal?

I have been working with the veil framework to test an internal IDS system I have in place. I have used a public malware sample which produces an 8/53 hit score on Virustotal and run it through the ...
0
votes
2answers
1k views

WPA cracking with Crunch, JTR & Aircrack

Now I assume that everyone knows of aircrack-ng and John The Ripper with it's fantastic ability to pause and resume cracking. With that aside, I want to add Crunch into the mix, however I can't seem ...
25
votes
6answers
29k views

At what point does “hacking” become illegal? (US)

Hypothetical situation: before I hire a web development company I want to test their ability to design secure web apps by viewing their previous client's websites. Issue: this situation raises a big ...
2
votes
1answer
2k views

Rainbow tables/hash tables versus WPA/WPA2

In Wi-Fi penetration testing, is it possible to use rainbow tables/hash tables on WPA/WPA2 networks? Is there an advantage of one over the other? Where would one get said tables or can they be ...
36
votes
4answers
4k views

What person should I write a penetration test report as?

When you're writing a report, what person do you write it as? First person singular: I discovered a vulnerability in HP Power Manager... First person plural: We discovered a vulnerability in HP ...
22
votes
7answers
4k views

What should a security audit report include?

Background I'm in charge of auditing a medium-scale web application. I have audited web applications several times before, but I've always written a short PDF quickly explaining what I encountered ...
4
votes
7answers
144 views

Any non alert() based non malicious XSS payloads?

I have been trying to find non malicious, non alert based, single command reflective XSS payloads, and have so far seen none. Anybody know of any good ones for pentesting purposes? What I mean by ...
0
votes
1answer
38 views

No handshake recorded from airodump-ng

I've just started to attempt this by following the guide from lewiscomputerhowto. I've seen other people ask similar questions, but they all seem to be older threads. The steps I've taken are shown ...
-1
votes
1answer
37 views

Eavesdropping and sniffing attacks [closed]

Assume we have two routers connected by a link. Speaking of eavesdropping and sniffing attacks, does it technically appear at link itself or at the routers? If at the routers, does it imply that these ...
1
vote
1answer
30 views

SSH “on keyboard interactive devices” brute force vulnerability

I was researching the OpenSSH brute force vulnerability "onkeyborad-interactive devices", however I am not sure how this command really works ssh -lusername -oKbdInteractiveDevices=`perl -e 'print ...
5
votes
2answers
73 views

Path Disclosure without ability to read files

So I am a pentester, and I have discovered "feature" on a server that allows me to, essentially, blindly traverse a web server's files (without executing or reading them). The problem is that I ...
0
votes
1answer
31 views

How to get an internal network address range during a footprinting stage?

As new to pen testing, I am a bit stuck at finding out a local network address range from external network to perform a pen testing. I will give you a fake scenario with fake IP addresses as below. ...
0
votes
2answers
97 views

Penetration Testing Criteria [closed]

I'm a beginner-level penetration tester, I've noticed that after the pentesting, you just report the vulnerabilities you've found and the possible exploit points that you've discovered. Using the ...
1
vote
2answers
72 views

Understanding the behaviour of existing eavesdropping techniques

I am studying the behaviour of existing eavesdropping techniques (part of my research). I have a question through the following scenario: Suppose Bob lives in New York and wants to listen (i.e. ...
0
votes
0answers
3 views

How does Empire Powershell interact with PowerShell? [migrated]

The creators of Empire PowerShell state the following: "Empire implements the ability to run PowerShell agents without needing powershell.exe" https://github.com/PowerShellEmpire/Empire How ...
2
votes
1answer
138 views

Tools for finding stored XSS vulnerabilities, given DB write access?

I'm aware that there are various tools for testing for XSS vulnerabilities. However, all the ones that I'm aware of (Vega, possibly BeEF, etc.) operate purely client-side. When testing for stored XSS ...
7
votes
1answer
2k views

Burpsuite accidental defacement, should I be concerned?

I was spidering a website with Burpsuite and the automated Form Submission caused me to unknowingly deface the main page with "555-555-0199@example.com". It took me a decent amount of time to notice ...
4
votes
3answers
597 views

How do RATs access computers through routers?

I've started trying to increase my networking security at my house. One thing that worries me (because other people in the house are always downloading viruses that come along with "free" games) are ...
1
vote
1answer
62 views

PCI Penetration Testing - Does the whole infrastructure need to be retested on significant change?

The PCI SCC states the following in their penetration testing guidance: Per PCI DSS Requirements 11.3.1 and 11.3.2, penetration testing must be performed at least annually and after any ...
-5
votes
3answers
2k views

Can I do hacking using Windows OS? [closed]

I have searched the web a numerous times but haven't found an explicit answer to my question. I've studied (at school and on my own) computer networks for 2 years, doing active programming for 4 years ...
13
votes
5answers
8k views

pros and cons of a bootable BackTrack instance vs installed

I've been wanting to mess around some with BackTrack to get a better understanding of some of the tools out there for penetration testing. I have a Linux box that isn't doing much right now that I was ...
0
votes
1answer
274 views

POST request in curl return all the source code of the page

I am trying to exploit the mutillidae web-application and I found a page vulnerable to sql injection but with a blacklist check embedded into the HTML code. I've tried to bypass this by forging a POST ...
4
votes
1answer
91 views

Pentesting Web Server for Remote File Inclusion

For educational purposes, I am in the process of pentesting a web server of mine(running on Windows) where there is a Remote File Inclusion vulnerability. I can already get simple things like command ...
0
votes
1answer
61 views

What is the difference between Wireshark and Ettercap for man in the middle attacks!

I know of the two programs, one is Wireshark (a packet sniffing program) and the other is Ettercap (a man in the middle attack program). I tried doing a MITM attack before, legally on my own home ...
1
vote
0answers
8 views

How to create a burp shortcut on your windows desktop [migrated]

I have been trying to figure out how to get a windows shortcut for burp. If anyone else can figure out a different way instead of java -jar -Xmx768m "C:\tools\burpsuite_free_v1.6.32.jar"
7
votes
5answers
2k views

Penetration testing by ethical Hackers/Crackers should be trusted?

My question today come from my homework question from class ethics in IT. Our question states roughly that I'm IT guy in in big company and I am asked to hire few hackers to to find vulnerabilities ...
-1
votes
1answer
43 views

what are some of the common routers people use for penetration testing? [closed]

So, I was looking for a router to penetration test on because the one I have is very difficult. What are some of the well-known routers that are supposed to work for beginners to penetration test on?
1
vote
1answer
52 views

Removing remnants of a Metasploit exploit

Is it possible to remove a Metasploit payload/meterpreter from a compromised system? My question is mainly based on antiforensics (Leaving aside Memory forensics which is probably unavoidable but more ...
1
vote
1answer
53 views

What is an IEX download cradle?

Does anybody know what an IEX download cradle is? Is it something that belongs only to the cyber security/pentesting realm? I am asking based on this post: ...
1
vote
2answers
252 views

What are common security problems pen testers find? [closed]

I am doing a study in school for computer science. My research topic is pen testing, since that is what I hope to do after I graduate. While doing research I am finding things that can go wrong, but ...
4
votes
1answer
1k views

Are there any ways to leverage NTLM V2 hashes during a penetration test?

I am on a penetration test at the moment, where LM/NTMLv1 hashes are disabled. I have captured a number of NTLMv2 hashes via NBNS spoofing, however was unable to crack them after running them through ...
4
votes
1answer
93 views

Run NetCat as bat file instead of exe

I need to run a netcat on a remote lab machine. I can execute remote commands through the browser with Administrator rights (because of the application vulnerability) but I don't have access to the ...
2
votes
1answer
54 views

Is it there any way to detect payloads generated by veil framework

While pentesting, I used to generate a malicious payloads using the veil framework. The generated payload bypasses antivirus & infects the target system. Is there any way to detect veil payloads ...
2
votes
1answer
1k views

The overlapping fragment attack using Scapy

How to use Scapy to overwrite a part of the TCP header information of the first fragment, which contained data that was allowed to pass through the firewall, with malicious data in subsequent ...