An attempt to penetrate a system's security in an effort to evaluate the protections in place.
15
votes
6answers
3k views
What is the difference between a penetration test and a vulnerability assessment?
What is the difference between a penetration test and a vulnerability assessment?
Why would you choose one over the other?
What deliverables would you expect to receive and how would you rate the ...
28
votes
6answers
9k views
Servers for penetration testing
I am learning to use Metasploit as part of one of my college lessons. As you may know there are software builds like NOWASP (Mutillidae) or Damn Vulnerable Linux that allow you to exercise on pentest ...
13
votes
9answers
2k views
Vulnerable OS's?
Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?
30
votes
4answers
2k views
New XSS cheatsheet?
There is a great list of XSS vectors avaliable here: http://ha.ckers.org/xss.html, but It hasn't changed much lately (eg. latest FF version mentioned is 2.0).
Is there any other list as good as this, ...
21
votes
5answers
2k views
How to perform a security audit for a PHP application?
I have a PHP application that I would like to have audited for security. I'm familiar with most of the general security issues, but want to make sure I didn't miss anything.
What steps should I take ...
10
votes
4answers
2k views
Legitimately using tools like Havij
I'm a developer, not a security guru. My primary focus is ensuring that I'm not introducing security holes through bad programming. I understand how to code to protect against the OWASP Top 10, as ...
7
votes
5answers
835 views
Automated tools vs. Manual reviews
What are the advantages of using automated tools, as opposed to manual review? What are the disadvantages?
This applies both to external blackbox vulnerability scanning, and to static code analysis.
...
2
votes
8answers
1k views
Pen Testing Practice Box?
Are there any windows based pen testing vms out there similar to Metasploitable based on ubuntu?
Just starting to learn hacking and such a box would be very helpful.
18
votes
0answers
568 views
Where can I find a vulnerable operating system to practice pentests on? [duplicate]
I am looking for vulnerable operating systems that are used for practicing pentests. Damn Vulnerable Linux (DVL) is not maintained anymore. Are there any other simillar OS´s to download somewhere that ...
28
votes
8answers
4k views
Books about Penetration Testing
What are the books you advise describing methods or steps required to make a successful penetration test?
I have a base knowledge of common security checks, but it would be great if someone more ...
48
votes
7answers
35k views
Can webcams be turned on without the indicator light?
I want to know how secure I am.
I've made a series of pentests in my network and one of the things I've tried was to record webcam and microphone.
Recording an end-user's microphone seems to be a ...
5
votes
3answers
857 views
Ethical Hacking - Penetration Testing Book(s)
I am an IT student who wishes to seek a career in the field of Ethical Hacking, more specific in Penetration Testing.
Due to the nature of my course, none of my classes go deep enough into this ...
11
votes
6answers
3k views
At what point does “hacking” become illegal?
Hypothetical situation:
before I hire a web development company I want to test their ability to design secure web apps by viewing their previous client's websites.
Issue:
this situation raises a big ...
40
votes
4answers
3k views
I think I accidentally DoS'd a website. What should I do?
I was browsing a website, and stumbled across a sample scheme for password-protecting web pages. The owner of the website specifically had a page that invited people to attempt to hack it.
I wanted ...
15
votes
1answer
2k views
Mac OS X from an IT Security Practitioners' Perspective?
What does the Mac OS X offer that it has been recently attracting users with IT security focus?
There are sites that specifically focus on "hacking" with OSX, such as machacking.net. Defcon has an ...
10
votes
2answers
492 views
What are legal/ethical concerns to bear in mind, when hacking websites with open invitations?
I was reading another question which mentions a site that had a page inviting people to try to hack it, and it made me wonder.
Lets assume, for the sake of this rather hypothetical question, that a ...
9
votes
4answers
934 views
How does System Memory Dump work?
So there are so many pen-testing tools that perform a memory dump on the system. How exactly do they work - what exactly happens ?
8
votes
2answers
1k views
How to test against DDoS in a controlled enviroment?
Can you suggest me methods or tools that can help in simulating a DDoS attack in a controlled enviroment (like my private lab)?
10
votes
6answers
1k views
Security review: “HTTP header user-agent has been set to (something)”
We got a security review done of our PHP code and they team advised this in their report (amongst other things):
/appdir/
Details
The HTTP header user-agent has been set to \" .
Request
GET ...
4
votes
0answers
637 views
Best website to learn computer security basics? [duplicate]
Possible Duplicate:
Resources to learn about security
Can someone advice on which are the good sites out there to learn the basics of computer security from?
2
votes
0answers
372 views
Hack scenario when a person has a non-superuser shell [closed]
Suppose that there are following three machines in the network:
Machine A:
Microsoft Server 2003 Service Pack 2
FileZilla 0.9.29 beta ftp server (TCP 21)
Mcafee ePolicy server (81), remote desktop ...
11
votes
7answers
6k views
Comparing online security courses: eLearnSecurity vs. Offensive-Security
I'm a web programmer, using the Linux environment for 2 years.(I have experience with Web app hacks +Web app security techniques)
I want to start studying security in-depth, but I have limited time ...
10
votes
3answers
2k views
iOS/Android Pen-Test
This question might be vague, that is because I am not sure where to start.
There are a lot of books and courses on pentest focusing on networks, systems, and OS such as windows, yet I haven't been ...
11
votes
4answers
367 views
What are the most important security checks for new web applications?
I'm wondering what are the top priority security checks you should make befor launching a new webapp?
I'm guessing brute force vulnerabilities and cross-site scripting. What are the other things you ...
11
votes
9answers
1k views
What are some good website security scanning solutions?
What are some good web-based website security scanning solutions? I'm not too concerned if they are web-based solutions, or software that can be run locally.
Generally, I'm looking for something we ...
17
votes
4answers
2k views
What tools are there to inspect Flash SWF files?
I am performing a penetration test against a website that uses Flash heavily.
What tools can I use to examine the SWF file for vulnerabilities?
From the Area51 proposal.
13
votes
6answers
2k views
Lightweight Live Pen-test OS
Does anyone know of any lightweight OSs that are great for Pen-testing? I would love to have a very lightweight live OS that I can boot off a USB and try some pen-testing against some of my ...
10
votes
7answers
6k views
Penetration Testing Jobs without Experience
There seems to be a late trend where firms are beginning to hire fresh graduates for security related jobs. This is counter to what I've heard from experienced security professionals (as well as the ...
7
votes
2answers
532 views
How should one prepare himself for a job interview for penetration testing?
So, the title basically says it all. I would really like to hear out some of the more experienced friends here with their answers for this.
Should it revolve around the ability to verbally explain ...
6
votes
2answers
301 views
How to get info on company , company owned sites etc…?
I wanted to know how can I get info on what sites are owned by certain company.I need it for bug bounty programs. For example how can I find what sites are owned by paypal company, like what sites ...
10
votes
3answers
1k views
White-box vs. Black-box
What are the relative advantages and disadvantages of each form of testing?
I.e. What is the difference between static code analysis and runtime/dynamic penetration testing?
What are the pros and cons ...
4
votes
3answers
333 views
Create a page to experiment with SQL injection [closed]
This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
1
vote
2answers
299 views
Published data sets for IDS/IPS evaluation
I am looking for data sets published by researchers or freelancers which can be used for the purpose of IDS/IPS testing and evaluations. The data sets may be for portscans, DoS attacks, Remote to ...
6
votes
3answers
2k views
How much does a security audit cost?
For a PHP CMS, what should I expect to budget for a security audit, both whitebox and blackbox? The codebase is about 85,000 LOC and I would probably use a North American company for testing. I really ...
5
votes
2answers
328 views
What security measures to have before openly allowing security researchers to hack your site
As some kind of a follow-up from my previous question - which was asked from the security researcher/penetration tester point of view:
(Thanks to Rory McCune for pointing this out) There seem to be a ...
5
votes
3answers
1k views
Best way to test my home network from the outside
I want to check that my router is working like it should. For example that certain ports which should be open on the LAN side and closed on the WAN side really work that way. So I would like to run a ...
5
votes
5answers
1k views
Penetration testing by ethical Hackers/Crackers should be trusted?
My question today come from my homework question from class ethics in IT.
Our question states roughly that I'm IT guy in in big company and I am asked to hire few hackers to to find vulnerabilities ...
3
votes
1answer
76 views
How and where to begin on the Return of Web Application Security Investment?
While there is a vast trove of vulnerabilties, threats and their corresponding countermeasures, the amount of information on Infosec Economics (Specifically for web applications) seems scarce.
What ...
3
votes
1answer
303 views
Non English password dictionaries
What is a good resource for wordlists used in auditing passwords in non english languages. I have extensive wordlists in English ranging to several GB's, but can't find similar resources for other ...
2
votes
2answers
211 views
Literature about IT security from a hardware standpoint
Can you point me to any book, blog, paper, anything about IT security on the lowest possible level (hardware)?
I'm primary interested in the motherboard, CPU & GPU, however, if you know any good ...
10
votes
6answers
303 views
Are all security requirements expected to be testable?
Many approaches exist to define security requirements. To keep it simple, i would say to define a security requirement, one need to model the threat encountered when building up misuse cases for ...
6
votes
1answer
489 views
Is Request.getHeader(“host”) vulnerable?
If the following is the code snippet, what would be your suggestions?
<script type="text/javascript" src="<%=request.getHeader("Host")%>/XXX/xxx.js"></script>
Is this a clear ...
5
votes
2answers
201 views
What fraction of vulnerabilities does black-box pentesting find?
Black-box penetration testing is one to check a web application for vulnerabilities. It can find some vulnerabilities, but not all.
What fraction of vulnerabilities does black-box pentesting find, ...
4
votes
1answer
371 views
Do blackbox penetration tests make sense if a whitebox audit would be possible as well?
Lets assume I am responsible for an application in my company and I decide to hire security experts to perform a security audit. Lets assume further that my company owns the source code of the ...
4
votes
1answer
1k views
Are there any tools for automated penetration testing of Silverlight applications?
I'd like to find a tool to assist with automated penetration testing of Silverlight applications, in a similar vein to AppScan for webapps.
Specifically, I'm looking for a tool that can cope with ...
3
votes
2answers
311 views
1 PIX firewall, 2 routers, 2 switches. Please answer a couple questions about hack lab
I bought a bunch of cisco equipment for a project and I got
1 PIX firewall
2 switches
and 2 routers
This is my plan for a topology but I am new at this so I need help.
I am basing this off the ...
3
votes
3answers
333 views
would preparing for CCNA add “significantly” to my knowledge as a penetration tester?
I'm a post graduate student and self taught programmer. I concentrated on Computer Networks & Operating Systems more during my undergraduate studies. I can explain usually used protocols by ...
2
votes
5answers
545 views
Building my own Darkspace
I have searched through the internet about creating a darknet and there is a confusion.
There are two definitions, the first one is network used for private p2p (like freenet) and another one that ...
2
votes
1answer
255 views
File upload vulnerability: rename solution?
I have a module in which the user can upload images.
I searched Google for different kinds of upload attacks
checking dimension of the image (still vulnerable)
checking of file extension ...
1
vote
3answers
593 views
Is scanning a site directory considered illegal penetration testing?
Does anyone know if using Dirbuster [link] to scan for unlisted directories and their contents is (possibly) legal in say the US?
