An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

-1
votes
2answers
152 views

How to get the information from the iframe displayed (ClickJack) to the user back to the attacker?

Just for knowledge I want to know how to get the information from the i-frame displayed to the user back to the attacker? Scenario : Suppose You are an attacker and you want to grab the private ...
2
votes
1answer
85 views

SSH ciphers, MAC and key-exchange (and pen-tests thereof)

At work we've been trying to move our external-facing services away from a policy of inclusivity (where we tried to accept as many people as possible) to a more security-focused setup. The first step ...
2
votes
1answer
138 views

Tools for finding stored XSS vulnerabilities, given DB write access?

I'm aware that there are various tools for testing for XSS vulnerabilities. However, all the ones that I'm aware of (Vega, possibly BeEF, etc.) operate purely client-side. When testing for stored XSS ...
2
votes
1answer
2k views

Rainbow tables/hash tables versus WPA/WPA2

In Wi-Fi penetration testing, is it possible to use rainbow tables/hash tables on WPA/WPA2 networks? Is there an advantage of one over the other? Where would one get said tables or can they be ...
1
vote
1answer
3k views

Trying to reproduce a file upload compromise on Joomla

After telling my workmates and boss that we had a very critical lack of security controls, finally we got compromised! They had a Joomla 1.5 which was exploited using a file upload vulnerability. WSO ...
0
votes
1answer
65 views

Information Gathering - Passive

I have several subnet to assess for a VA but the assessing will start next week. What could I do with the subnet that the client has already provided to me, without break anything or be intrusive ...
0
votes
1answer
272 views

POST request in curl return all the source code of the page

I am trying to exploit the mutillidae web-application and I found a page vulnerable to sql injection but with a blacklist check embedded into the HTML code. I've tried to bypass this by forging a POST ...
3
votes
0answers
896 views

How to root a virtual device in android-sdk?

I was amused to see no one have ever asked such a question here before. After a little research in google I found only a few links to root a device in avd. Somewhere I also read that the sdk is ...
2
votes
0answers
98 views

OCSP responder penetration testing

I have to do penetration testing on an OCSP responder. Are there any frameworks for OCSP pentesting? since it does not include any web applications to test, should I only run network penetration tests ...
2
votes
0answers
236 views

XSSER get and post

I am using xsser for XSS vulnerability testing and I have a doubt about the parameters when it's a POST method. I have tried against DVWA (which uses get) with success like this: xsser -u ...
2
votes
0answers
514 views

How do I convert from this weird John/Asleap format to lc (for HashCat)?

I'm trying to setup a system for pen-testing. I'm using the FreeRadius-WPE patch to collect Challenges/Requests from people who connect to my spoofed AP instead of the actual network. Here is the ...
2
votes
0answers
332 views

Session IDs number repeated under mac

I have run a penetration test on a web server. To generate session IDs with this Bash script : #! /bin/bash NUMBEROFSESSIONS=3000 for i in $(seq 1 ${NUMBEROFSESSIONS}) do curl -s -c cookie 'URL' ...
2
votes
0answers
5k views

Linux Hydra issue - random correct password success

I have an issue with Hydra when I use it. I have tried the same command lines given in guides directly supported by the Damn Vulnerable Web Application (DVWA) v1.8. Ok so.. here is my attempt ...
1
vote
0answers
205 views

Virtual Pentesting Lab on popular Enterprise level UTM and SIEM

I’m planning to add a new Penetration Testing Segment to my personal “Pen Lab”. It’ll be centered around Vulnerability Assessments /Penetration Testing on market leading Next-Gen Enterprise ...
1
vote
0answers
64 views

Is there a way I can exploit any web application if on input it's reflecting back a HTML enitity?

I'm trying to check for SQL Injection or Authentication ByPass-Forced Browsing vulnerability in one of my web application. On a jsp page there's an input field. I inserted double quotes in it and it's ...
1
vote
0answers
322 views

Since when Access-Control-Allow-Credentials is required?

About several years ago I found a website during a pentest which had the Access-Control-Allow-Origin header set to "*". I made a POC to get the response of a webpage from an untrusted domain. The goal ...
1
vote
0answers
121 views

Ncat output problem

I am using ncat for creating reverse connections and through that i open a cmd. my problem is that for commands that there is a lot of out put such as dir in a folder with a large number of files, ...
0
votes
0answers
22 views

Different chanels for BeEF UI and Communication Server

I am working with BeEF tool and I want to access the UI interface using https (I don't want to communicate via VPN to access the control panel), while at the same time, I need to serve the http hooks ...
0
votes
0answers
70 views

Hydra command for cracking a webpage which uses <span> tag for failed login attempts

I'm trying to for crack a simple webform for testing hydra in Kali. When the webpage encounters a wrong username and password combination it pops up a message using the following html code:: ...
0
votes
0answers
44 views

Using DVWA at Medium Security, how can I OutFile records?

Whilst carrying out SQL Injection attacks against the educational tool DVWA on security level Low, I could carry out a command like the below and both retrieve records and write them to a file. ' ...
0
votes
0answers
150 views

sslstrip not stripping any redirected traffic

I am using the following configuration to set up sslstrip sudo echo "1" > /proc/sys/net/ipv4/ip_forward sudo iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 666 ...
0
votes
0answers
305 views

Sysinternals tool suite not working on low priv shell

Currently oscp student. I asked this on the oscp forum yesterday, but no responses so far. I am new to infosec, but have 18 years of education / work experience in IT. As far as I can tell, ...
0
votes
0answers
207 views

sqlmap cannot find injection vulnerability

I create a page called register.php which will take 4 parameters user, pass, email, comments. And the pass is vulnerable to sql injeciton. I have tested the vulnerability manually by filling test', ...
0
votes
0answers
61 views

Questions to confirm a good standpoint on web app security?

What should be the questions asked to assess a company on web app security? Our company is in process of partnering with another company in order to outsource web app security work to them. For us ...
0
votes
0answers
127 views

How to test backend virus behavior?

I have a website that allows the user to upload files. The front-end (web tier) checks the file extension and first few bytes of the file for the magic number of an acceptable file, but then ...
0
votes
0answers
165 views

Cryptographic Testing

Given an algorithm (say, AES), how to create/generate test vectors? I have tried using the NIST test vectors for AES and found it to be working fine with a package of "chilkat". Suppose, for a ...
0
votes
0answers
307 views

Pentesting an ATM OS upgraded from Windows XP to Windows 7

How to approach penetration testing of a ATM OS that was upgraded from Windows XP to Windows 7? From what I gather, the testing flow should be as follows: Architectural Review Pentesting OS and ...
0
votes
0answers
38 views

Windows tokens manipulation

I am creating a demo of the infamous windows tokens manipulation. the scenario I am using is as follows: A single PC connected to the domain controller. 2 users are signed in the DC through that ...