An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

2
votes
1answer
109 views

How to simulate man in the middle attack in android emulator?

I am new to pen-testing. Yesterday i analysed one android application using dex2jar application and i saw an android application implemented https connection using empty trust manager. class miTM ...
2
votes
1answer
139 views

Auto deploy war file (backdoor/shell) to particular folder

I am in the midst of a pentest. I have managed to uploaded a war shell (backdoor) in c:\test\ which is automatically deployed in a folder, for example c:\test\tmpbrowser.war. The application which I ...
1
vote
1answer
608 views

Trying to reproduce a file upload compromise on Joomla

After telling my workmates and boss that we had a very critical lack of security controls, finally we got compromised! They had a Joomla 1.5 which was exploited using a file upload vulnerability. WSO ...
0
votes
1answer
49 views

Smart Token Security Test

I have a question. One of my colleague gave me a Smart Token which consists of public/private key inside and asked me if I can test its security. I said it should be tested in a equipped lab for ...
0
votes
1answer
120 views

OWASP Zap proxy Fuzz XSS pentest against REST API

I am looking to PEN test my application against XSS attacks. The application is a REST API... As such when you POST some JSON to /cart/add to see the result of that attack you would need to GET ...
-1
votes
1answer
51 views

Looking for a meterpreter script repository

I've read a couple entry-level metasploit books. Both of them praised the metasploit open framework. Additionally I have done some Google research but have not found meterpreter scripts for simple ...
2
votes
0answers
204 views

How do I convert from this weird John/Asleap format to lc (for HashCat)?

I'm trying to setup a system for pen-testing. I'm using the FreeRadius-WPE patch to collect Challenges/Requests from people who connect to my spoofed AP instead of the actual network. Here is the ...
2
votes
0answers
125 views

Determine deployed 802.3x encryption/authentication protocols? Or, why can't I access Eth0?

Is there any means to identify deployed 802.3x authentication protocols on a wired interface (eth0) under Windows 7 (CLI), or from wlan0 on a *NIX based system? The scenario is as follows: I am a ...
1
vote
0answers
43 views

How do I continue pentesting with access to local station?

I started learning hobbyist penetration testing a while ago, and as far as penetrating a computer I have physical access to, all is good. Mainly using Hiren bootCD, it is easy to gain access to an ...
1
vote
0answers
78 views

Proxychains + nmap = segmentation fault

If I try the sV (service detection) flag in nmap run via proxychains (socks5 server) it appears to give me a segmentation fault message:- root@kali:~# proxychains nmap -n -sT -Pn X.X.X.X -p ...
1
vote
0answers
38 views

Ncat output problem

I am using ncat for creating reverse connections and through that i open a cmd. my problem is that for commands that there is a lot of out put such as dir in a folder with a large number of files, ...
1
vote
0answers
136 views

Failed to connect to netcat reverse shell

I am doing an exercise of PentesterLab, I've got a webshell called 1.pdf, and it can be included in index.php as a PHP file. It contains code like this: %PDF-1.4 <?php echo system($_GET["cmd"]); ...
1
vote
0answers
301 views

The overlapping fragment attack using Scapy

How to use Scapy to overwrite a part of the TCP header information of the first fragment, which contained data that was allowed to pass through the firewall, with malicious data in subsequent ...
1
vote
0answers
2k views

Linux Hydra issue - random correct password success

I have an issue with Hydra when i use it. First let me inform that, i read multible guides, tries the excact same command lines as in guides directly supported by the Damn Vulnerable Web Application ...
0
votes
0answers
60 views

How to perform penetration testing of Blackberry mobile applications?

I wish to start with blackberry mobile application penetration testing. I researched on net but no "in-depth" knowledge is available. Here is a good article but not much is covered. ...
0
votes
0answers
57 views

HTTPS site not being captured by BURP

I am testing a website, basically mapping the site using burpsuite. But there is one link(https) that I can not process while the proxy on firefox is enabled. It asks me for certificates and when I ...
0
votes
0answers
87 views

Since when Access-Control-Allow-Credentials is required?

About several years ago I found a website during a pentest which had the Access-Control-Allow-Origin header set to "*". I made a POC to get the response of a webpage from an untrusted domain. The goal ...
0
votes
0answers
138 views

Testing Basic Authentication with ncrack

I'm conducting some basic pen testing against a page protected with Basic Authentication. I've sucessfully tested with Medusa and Hydra but am struggling to get the syntax correct for ncrack. the ...
0
votes
0answers
32 views

Changing the string format of Burp generated certificates

The certificate verification in a piece of software I'm poking uses UTF-8 encoded strings to verify the certificate's host name. Certificates generated by Burp suite, however, use the custom type ...
0
votes
0answers
27 views

Windows tokens manipulation

I am creating a demo of the infamous windows tokens manipulation. the scenario I am using is as follows: A single PC connected to the domain controller. 2 users are signed in the DC through that ...