An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

4
votes
3answers
80 views

Frameworks for collecting all activities in a pentest?

I work as a penetration tester for a company, and one thing we're regularly asked to do is to provide a forensic log of all of the activities we perform during the course of an assessment. I'm ...
1
vote
0answers
36 views

“Rollback process” for different penetration testing in case of something goes wrong?

In some extent, different kind of vulnerability assessment and penetration testing may impact on target system. I am looking for the solution/rollback process if something goes wrong during test. ...
0
votes
0answers
15 views

meterpreter/reverse_tcp handler other then metasploit's handler [duplicate]

Actually i am getting the error on metasploit handler "Connection reset by peer ssl_accept". On investigation, I came to know that I was running my powershell payload using powershell.exe (32 bit ...
3
votes
1answer
29 views

using netcat as a handler for windows/meterpreter/reverse_tcp payload

How we can use netcat as a handler for windows/meterpreter/reverse_tcp payload. I am getting the connection but unable to run any command.
3
votes
4answers
2k views

Problems during Pen-testing of SCADA systems

Is there a way to monitor the way the SCADA systems behave 'during pen-testing or security audit', and find out the implications of just port scans and/or monitor the state of activity while sending a ...
5
votes
1answer
259 views

How to pentest DTLS-SRTP?

I'm currently working on a penetration test about DTLS-SRTP strengths and weaknesses. But I'm stuck on an eavesdropping test using Wireshark. Yes, it's protected by SRTP, but: What's DTLS actually ...
1
vote
1answer
204 views

Different TTL for a single server

One of our client perform a qualys pentest, and find LB based on TTL value. We have only 1 server behind FW with NAT IP. Running ubuntu that has default TTL '64' qualys output Number of web ...
3
votes
2answers
66 views

Is it OK to do a security testing in parallel with a QA testing?

This may not be a very technical question per se, so please feel free to move it to the respective forum/stack. However, I would really appreciate anybody experienced or experiencing a similar ...
2
votes
2answers
90 views

Pentesting - best bang for your buck? (credentialed versus non-credentialed)

My day to day activities consist primarily of penetration testing (white/grey/black). Throughout my engagements, I try to educate my clients on the differences of testing types. E.g., credentialed ...
1
vote
2answers
152 views

Heartbleed POC: Is this sensitive information?

In order to demonstrate the Heartbleed problem, I executed a publicly available exploit against a vulnerable old NAS web-server that has since been replaced. Below is an excerpt from the subsequent ...
-1
votes
0answers
16 views

Impossible to modify Windows 10 drives from other OSs [migrated]

I'm here to describe an interesting issue I've been facing today, in order to get some hints or solutions. My goal : access and modify one of my computer's Windows (10) system hard drive in order to ...
0
votes
0answers
40 views

Deciding on payload

I am new to penetration testing and I am trying to understand how to choose a payload and why. For example I set up 2 virtual machines 1 with Kali Linux and a Windows XP SP2. On a previous experience ...
2
votes
2answers
93 views

Explaining information leak to Lead dev

Our lead dev tells me that this information leak from our website is "no vulnerability. Just an ugly error UI." It looks to me that the leaked information could be used to aid an attack. Does it ...
-1
votes
1answer
33 views

What are the most important vulnerabilities must be where professionalism [closed]

As we know that the vulnerabilities are many and varied, but what are the vulnerabilities in most locations and which need to be addressed and the focus on.
2
votes
1answer
42 views

Deliberate Vulnerable Openstack images for penetration testing/training or research

I was just wondering if there are already deliberate vulnerable Openstack images for penetration testing/training or research. Something in line with OWASP's DVWA e.t.c....there quite a lot out there ...
1
vote
0answers
50 views

Dumping Large table using Sqlmap

I am learning/working on sqlmap and I was trying to dump a large table with 11K entries on my localhost. The command I used is: python sqlmap.py -u "http://localhost/searchre.php" --data="search=' ...
7
votes
6answers
4k views

Designing a Capture The Flag target and game management system

I've attended several CTF contests and I'd like to implement a CTF system for my students. I asked Google about designing such system but it's fruitless. Any ideas?
0
votes
0answers
31 views

Android client side data encoding/encryption bypass

I am working on Android application security project where Android application sends all data in encryption from client side only. I assume that there must be a file at client side which might be ...
4
votes
1answer
274 views

SSH ciphers, MAC and key-exchange (and pen-tests thereof)

At work we've been trying to move our external-facing services away from a policy of inclusivity (where we tried to accept as many people as possible) to a more security-focused setup. The first step ...
5
votes
2answers
144 views

Stop Nmap scan and preserve XML output

Every time I run Nmap I use the -oA flag. The XML output is an important output item as I feed it into a number of parsers plus Metasploit with db_import. The --resume option can resume a scan but it ...
0
votes
1answer
135 views

Sqlmap doesn't exploit verified SQL injection

Right now I'm tinkering with the Hackxor VM (a pentesting training enviroment) and I'm trying to use sqlmap to exploit a vulnerability which I can exploit manually. The vulnerability is in the ...
2
votes
2answers
51 views

Use Nessus or focus on manual testing?

Nessus scans for a a lot of vulnerabilities, so should I focus on learning vulnerabilities that are not covered by Nessus, like directory traversal attacks? Should I work on only the vulnerabilities ...
0
votes
0answers
19 views

How can I do a Windows registry check with OpenVAS with out a port scan?

OpenVAS has the function to check Windows registries, but when i try to check a registry it also does a port scan. I used the scan configuration out off the manual. ...
2
votes
1answer
47 views

Getting error in Hydra

I'm trying to test someones website for them and I'm using hydra in cygwin on Windows. When I enter: hydra -L myusers.txt -P mypass.txt website.net http-get-form \ ...
0
votes
1answer
79 views

Dumping custom query via SQL injection when output is in the die() function?

On my localhost I have a PHP link like this abc.com/index.php?q=XYZ where XYZ is a base64encoded parameter that I have verified is injectable. When I try abc.com/index.php?q=XYZ' it returns You ...
35
votes
5answers
4k views

Open-source penetration-test automation

What order do typical open-source penetration tests operate? Which tools are run first, second, third -- and how do you control them? Does one simply use Metasploit RC files? A network vulnerability ...
8
votes
1answer
434 views

Is it possible to emulate real network printer i.e. to run some actual firmware in VM?

I've got to the section related to network printers exploitation while going through one security course. Under "network printer" I understand standalone devices with a dedicated ethernet\wireless ...
13
votes
4answers
9k views

How does BeEF work? (working understanding)

I have recently come across the BeEF- a browser exploitation tool. In most of the articles, it is said time and again that it is developed for research and pen test purposes! Has anyone worked with ...
0
votes
1answer
98 views

website - infected by malware and if yes, how can I treat it? [closed]

A friend told me that the website of our association, here , got blocked by the corporate network of the company he is working for, due to malware (see picture below) I've tried a few website like ...
1
vote
2answers
72 views

Ethical hacking requirements on a banking institution

If I would be required to do an ethic hacking research by a banking institution would I use my own bank account, ask for an account to the bank or open a new account and transfer some money and do ...
2
votes
1answer
114 views

Is my understanding of buffer overflows correct?

I am new to pentesting and wondering if my current understanding of buffer overflow exploits is correct. Assuming an operating address space of 3 addresses, an instruction space of 2 addresses, and an ...
0
votes
1answer
79 views

What is the most valuable file you can get using a directory traversal hole [closed]

I am doing a penetration test and I found a directory traversal hole in the web application which enables me to download any readable file in the server. However, I could only download files that is ...
2
votes
2answers
3k views

How to create a OSx pen testing environment

I currently use OSx Maverick, I wish to use this machine as my pen testing machine as I also prefer coding on this machine. My current pentest machine is running Kali. Can anyone give me good tips on ...
2
votes
2answers
147 views

Bug Bounty Methodology for a Newbie

Question: Once I join a bug bounty program and start hunting for bugs on a website, how do I efficiently start looking for bugs? I am very familiar with common vulnerabilities (XSS, sql injection, ...
0
votes
1answer
58 views

OS fingerprinting via TCP

I have searched online about this topic and the only information I got is that TCP SYN/ACK can be used to know the type of the target OS. If that is true, I don't understand how this occurs? Does TCP ...
1
vote
2answers
322 views

What are common security problems pen testers find? [closed]

I am doing a study in school for computer science. My research topic is pen testing, since that is what I hope to do after I graduate. While doing research I am finding things that can go wrong, but ...
1
vote
0answers
14 views

Tool for HPP testing? [closed]

Is there an automated vulnerability scanner that supports HPP (HTTP Parameter Pollution)? Since all I need is to take a query string and perform basic modifications / add new parameters, I was ...
0
votes
1answer
403 views

POST request in curl return all the source code of the page

I am trying to exploit the mutillidae web-application and I found a page vulnerable to sql injection but with a blacklist check embedded into the HTML code. I've tried to bypass this by forging a POST ...
4
votes
1answer
1k views

Syllabus for self-studying information security and Pentesting [closed]

I'm someone who's distant, industry-wise, from technology. I'm actually in the medical field. That said, I'm very interested in technology and specifically in information security. I'd like to make a ...
52
votes
9answers
4k views

How should I tell school that they are vulnerable when I wasn't given permission to check? [duplicate]

I would like to report security weaknesses to my school in UK. I had managed to find security weaknesses without any exploits or other software or hardware. I had look at similar question however ...
-1
votes
1answer
109 views

how to start penetration testing? [closed]

I am currently working as security analyst on few applications and am willing to jump into penetration testing in future.To start with, what kind of skill set do i need to develop like tools and ...
0
votes
0answers
39 views

What could be done using Set-Cookie or Cookie Manupulation

I was testing a web application where I can inject the cookie using CR/LF injection. I'm curious to know, What attacker could done only using cookie injection (Set-Cookie) by CR/LF on website like ...
-5
votes
1answer
63 views

Alternative of using wifi card for penetration testing [closed]

I want to learn penetration testing on kali linux platform, for that I found that the wifi card is needed. But my question is that, if I install the kali linux as main operating system or make ...
2
votes
0answers
38 views

How to Lead to XSS by Response Splitting in this Scenario

I have been pentesting for a company. I found a CRLF Injection that could be done using %E5%98%8D%E5%98%8A instead of %0d%0a. So I'm using %E5%98%8D%E5%98%8A in redirection parameter for CR/LF. Here ...
4
votes
1answer
46 views

Would generic exception messasges be considered a security risk?

For example, if visiting a webpage you get the response: Error in exception handler. This has a high chance the website is using Laravel. Would this class as information disclosure? I'm guessing ...
2
votes
2answers
585 views

Looking for a tutorial on meterpreter extensions

A simple custom DLL source would be sufficient. All of the links I find on Google are dead. I don't mind reading some clear source if there's a tutorial DLL floating about. I tried for ...
1
vote
2answers
51 views

How can I conduct penetration testing on VirtualBox

I want to get started with penetration testing, and have read that it is better to conduct such tests using a virtual machine rather than your own computer. I also want to use the internal network ...
0
votes
1answer
118 views

Haskell in the security industry? [closed]

I know of a tool called msf-haskell for security but are there others? Are there any security tools that are written in haskell? other than the one above How much use will haskell be in industry, ...
4
votes
2answers
4k views

Setup of Kali Linux for reverse shell connections over the internet

I am running Kali Linux as a VM on my Windows machine which is NAT'd behind my company network, if I wish to pen test a website for a client and believe that a reverse shell is possible, what is a ...
1
vote
3answers
4k views

Burp configuration to allow SSL connection

I'm trying to capture Request/Responses using Burp on Mozilla. I've configured Burp Proxy on 8080 and have set same proxy settings on Firefox however when trying the Gmail link, Firefox gives "This ...