An attempt to penetrate a system's security in an effort to evaluate the protections in place.

learn more… | top users | synonyms (2)

98
votes
7answers
5k views

Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in production unintentionally during a pentest?

Today I experienced a situation where a person responsible for the security of a company required a pentesting company to withdraw a clause in the contract that says that: "during the pentest there ...
75
votes
8answers
77k views

Can webcams be turned on without the indicator light?

I want to know how secure I am. I've made a series of pentests in my network and one of the things I've tried was to record webcam and microphone. Recording an end-user's microphone seems to be a ...
47
votes
13answers
6k views

What makes it illegal to use the information learned by exploiting a bug?

According to news reports, arrests have already been made in relation to the Heartbleed bug. It sounds like this person managed to gain access to the website's database by capturing the credentials ...
47
votes
4answers
4k views

I think I accidentally DoS'd a website. What should I do?

I was browsing a website, and stumbled across a sample scheme for password-protecting web pages. The owner of the website specifically had a page that invited people to attempt to hack it. I wanted ...
39
votes
5answers
4k views

New XSS cheatsheet?

There is a great list of XSS vectors avaliable here: http://ha.ckers.org/xss.html, but It hasn't changed much lately (eg. latest FF version mentioned is 2.0). Is there any other list as good as this, ...
38
votes
5answers
5k views

Do actual penetration testers actually use tools like metasploit?

I've played around with metasploit simply as a hobby but am wondering if actual pentesters and/or hackers actually use metasploit to get into systems or do they write their own post exploitation ...
37
votes
9answers
6k views

Books about Penetration Testing

What are the books you advise describing methods or steps required to make a successful penetration test? I have a base knowledge of common security checks, but it would be great if someone more ...
32
votes
5answers
16k views

Servers for penetration testing

I am learning to use Metasploit as part of one of my college lessons. As you may know there are software builds like NOWASP (Mutillidae) or Damn Vulnerable Linux that allow you to exercise on pentest ...
31
votes
5answers
3k views

How to perform a security audit for a PHP application?

I have a PHP application that I would like to have audited for security. I'm familiar with most of the general security issues, but want to make sure I didn't miss anything. What steps should I take ...
25
votes
8answers
13k views

What defines a programming language as useful for hacking?

I know that scripting languages (Perl, Ruby, Python, javascript, and even Lua!!!) are most suitable for hacking and penetration testing. My question is: What is it that makes those languages ...
22
votes
10answers
3k views

Vulnerable OS's?

Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?
22
votes
5answers
1k views

How to improve as a security expert

I'm a professional software developer with a high interest in web application security. I'd say that I probably have a better understanding of the security of web applications than the average ...
21
votes
2answers
2k views

Is it possible to write shellcode in C++?

Usually I write assembly programs and then dump their contents to get the shellcode. What I was wondering is whether I could write a C++ program instead of assembly, then dump and use that instead of ...
20
votes
7answers
3k views

What should a security audit report include?

Background I'm in charge of auditing a medium-scale web application. I have audited web applications several times before, but I've always wrote a short PDF quickly explaining what I encountered and ...
19
votes
3answers
3k views

Google hacking - why “numrange” is so dangerous?

I'm reading Google Hacking for Penetration Testers and in book it's said several times operator "numrange" is especially powerful and dangerous. However, they don't give example of using this ...
18
votes
6answers
7k views

What is the difference between a penetration test and a vulnerability assessment?

What is the difference between a penetration test and a vulnerability assessment? Why would you choose one over the other? What deliverables would you expect to receive and how would you rate the ...
18
votes
4answers
4k views

What tools are there to inspect Flash SWF files?

I am performing a penetration test against a website that uses Flash heavily. What tools can I use to examine the SWF file for vulnerabilities? From the Area51 proposal.
18
votes
0answers
596 views

Where can I find a vulnerable operating system to practice pentests on? [duplicate]

I am looking for vulnerable operating systems that are used for practicing pentests. Damn Vulnerable Linux (DVL) is not maintained anymore. Are there any other simillar OS´s to download somewhere that ...
17
votes
7answers
11k views

Comparing online security courses: eLearnSecurity vs. Offensive-Security

I'm a web programmer, using the Linux environment for 2 years.(I have experience with Web app hacks +Web app security techniques) I want to start studying security in-depth, but I have limited time ...
17
votes
1answer
4k views

How can I spoof a phone call and make it appear to come from another phone?

I'm performing a penetration test against a company. Part of my social engineering procedure is to contact the IT department and try to convince them to that I'm an employee in the company and get ...
16
votes
6answers
8k views

At what point does “hacking” become illegal?

Hypothetical situation: before I hire a web development company I want to test their ability to design secure web apps by viewing their previous client's websites. Issue: this situation raises a big ...
16
votes
8answers
2k views

What are some good website security scanning solutions?

What are some good web-based website security scanning solutions? I'm not too concerned if they are web-based solutions, or software that can be run locally. Generally, I'm looking for something we ...
16
votes
4answers
2k views

Open-source penetration-test automation

Has anyone built a metascript, or a `script of scripts' useful during a penetration-test? Do you use Metasploit RC files? A network vulnerability scanner in a special way? A command-line, custom, or ...
16
votes
1answer
5k views

Mac OS X from an IT Security Practitioners' Perspective?

What does the Mac OS X offer that it has been recently attracting users with IT security focus? There are sites that specifically focus on "hacking" with OSX, such as machacking.net. Defcon has an ...
16
votes
3answers
2k views

White-box vs. Black-box

What are the relative advantages and disadvantages of each form of testing? I.e. What is the difference between static code analysis and runtime/dynamic penetration testing? What are the pros and cons ...
15
votes
7answers
2k views

Why don't banks get hacked?

From reading a lot of info on this website I came to the conclusion that if someone with enough skill really badly wants to gain access somewhere, then there is absolutely nothing stopping them from ...
15
votes
6answers
12k views

Penetration Testing Jobs without Experience

There seems to be a late trend where firms are beginning to hire fresh graduates for security related jobs. This is counter to what I've heard from experienced security professionals (as well as the ...
15
votes
6answers
4k views

Lightweight Live Pen-test OS

Does anyone know of any lightweight OSs that are great for Pen-testing? I would love to have a very lightweight live OS that I can boot off a USB and try some pen-testing against some of my ...
15
votes
3answers
413 views

Are there any decent web app security scanners that can integrate with a build server?

I've spent a lot of time in TeamCity recently and the nightly code quality metrics coming from the dupe finder, FxCop and NDepend have been great. What I'd really like to do is find a decent web app ...
14
votes
6answers
3k views

Are some uncommon TCP ports scanned less than others?

Ignoring the top 5-10% of port numbers for common services that are the commonly targeted by port scanners (i.e. ports 22-ssh, 23-telnet, 80-http, 139-smb/cifs, 443-https, 3389-rdp, etc.), are the ...
13
votes
4answers
458 views

What are the most important security checks for new web applications?

I'm wondering what are the top priority security checks you should make befor launching a new webapp? I'm guessing brute force vulnerabilities and cross-site scripting. What are the other things you ...
13
votes
4answers
2k views

Tools to help test the security of Android applications

What are some decent frameworks to test the security of Android applications? With frameworks I mean either software based to automatically scan these applications or a guide (like OWASP has for ...
13
votes
2answers
709 views

How can I test my web application for timing attacks?

race conditions, etc. Are there automatic tools for this? What manual techniques should I use? From the Area51 proposal
12
votes
5answers
2k views

Automated tools vs. Manual reviews

What are the advantages of using automated tools, as opposed to manual review? What are the disadvantages? This applies both to external blackbox vulnerability scanning, and to static code analysis. ...
12
votes
2answers
561 views

When performing a PenTest against a WAF-protected site, what should a Pentester know to enhance the Test-Quality?

I'm running a WAF infront of a bunch of Webapps and we have the Apps regulary tested, and we want to improve our Tests by presenting some kind of livelogs to the testers. What informations, from ...
12
votes
2answers
781 views

What are legal/ethical concerns to bear in mind, when hacking websites with open invitations?

I was reading another question which mentions a site that had a page inviting people to try to hack it, and it made me wonder. Lets assume, for the sake of this rather hypothetical question, that a ...
12
votes
2answers
307 views

Should a pentest report include the tester's opinion?

In this particular case, the webserver turned out to be a shared 3rd party system and was not tested. Examples: We do express grave concern at the overall security posture of that webserver and ...
12
votes
6answers
1k views

Securely building a local pentest lab in a VM

I'd like to set up OWASP WebGoat or a similar vulnerable web app in a VM (probably VirtualBox on Linux). For convenience's sake, I'd like to get it running on one of the primary machines I use (say, a ...
11
votes
4answers
3k views

Legitimately using tools like Havij

I'm a developer, not a security guru. My primary focus is ensuring that I'm not introducing security holes through bad programming. I understand how to code to protect against the OWASP Top 10, as ...
11
votes
3answers
4k views

How much does a security audit cost? [closed]

For a PHP CMS, what should I expect to budget for a security audit, both whitebox and blackbox? The codebase is about 85,000 LOC ("Lines of Code") and I would probably use a North American company for ...
11
votes
2answers
2k views

How to test against DDoS in a controlled enviroment?

Can you suggest me methods or tools that can help in simulating a DDoS attack in a controlled enviroment (like my private lab)?
10
votes
6answers
2k views

Security review: “HTTP header user-agent has been set to (something)”

We got a security review done of our PHP code and they team advised this in their report (amongst other things): /appdir/ Details The HTTP header user-agent has been set to \" . Request GET ...
10
votes
2answers
7k views

Why does Hydra return 16 valid passwords when none are valid?

I've been playing around with Hydra and DVWA and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. I assume ...
10
votes
6answers
428 views

Are all security requirements expected to be testable?

Many approaches exist to define security requirements. To keep it simple, i would say to define a security requirement, one need to model the threat encountered when building up misuse cases for ...
10
votes
4answers
6k views

pros and cons of a bootable BackTrack instance vs installed

I've been wanting to mess around some with BackTrack to get a better understanding of some of the tools out there for penetration testing. I have a Linux box that isn't doing much right now that I was ...
10
votes
2answers
437 views

Should a penetration tester have training in ISO 27001/ITIL etc?

I recently got offered a promotion but as part of the package I've been requested to do ISO 27001, ITIL, ARPA and other kinds of training. I've previously avoided this sort of training as I felt it ...
10
votes
3answers
3k views

iOS/Android Pen-Test

This question might be vague, that is because I am not sure where to start. There are a lot of books and courses on pentest focusing on networks, systems, and OS such as windows, yet I haven't been ...
10
votes
4answers
172 views

Is external vuln scanning sufficient?

Is running an automated application vulnerability scanner sufficient to certify our application is secure? Why isn't it? From the original Area51 proposal.
10
votes
3answers
1k views

How to perform penetration testing on a Flex application?

Possible Duplicate: What tools are there to inspect Flash SWF files? I have decompiled it, verified the source. All seems fine. Appscan also is not able to find anything in this case. But I ...
9
votes
4answers
1k views

What features should I look for in a Wifi card used for wifi snooping / penetration testing?

I'm looking to purchase a wifi card to help me learn about wifi network penetration testing and other associated issues but I was wondering if there were any features of a wifi card I should look out ...