An attempt to penetrate a system's security in an effort to evaluate the protections in place.
48
votes
7answers
35k views
Can webcams be turned on without the indicator light?
I want to know how secure I am.
I've made a series of pentests in my network and one of the things I've tried was to record webcam and microphone.
Recording an end-user's microphone seems to be a ...
40
votes
4answers
3k views
I think I accidentally DoS'd a website. What should I do?
I was browsing a website, and stumbled across a sample scheme for password-protecting web pages. The owner of the website specifically had a page that invited people to attempt to hack it.
I wanted ...
30
votes
4answers
2k views
New XSS cheatsheet?
There is a great list of XSS vectors avaliable here: http://ha.ckers.org/xss.html, but It hasn't changed much lately (eg. latest FF version mentioned is 2.0).
Is there any other list as good as this, ...
28
votes
6answers
9k views
Servers for penetration testing
I am learning to use Metasploit as part of one of my college lessons. As you may know there are software builds like NOWASP (Mutillidae) or Damn Vulnerable Linux that allow you to exercise on pentest ...
28
votes
8answers
4k views
Books about Penetration Testing
What are the books you advise describing methods or steps required to make a successful penetration test?
I have a base knowledge of common security checks, but it would be great if someone more ...
21
votes
5answers
2k views
How to perform a security audit for a PHP application?
I have a PHP application that I would like to have audited for security. I'm familiar with most of the general security issues, but want to make sure I didn't miss anything.
What steps should I take ...
19
votes
6answers
4k views
What defines a programming language as useful for hacking?
I know that scripting languages (Perl, Ruby, Python, javascript, and even Lua!!!) are most suitable for hacking and penetration testing.
My question is: What is it that makes those languages ...
19
votes
5answers
716 views
How to improve as a security expert
I'm a professional software developer with a high interest in web application security. I'd say that I probably have a better understanding of the security of web applications than the average ...
18
votes
0answers
568 views
Where can I find a vulnerable operating system to practice pentests on? [duplicate]
I am looking for vulnerable operating systems that are used for practicing pentests. Damn Vulnerable Linux (DVL) is not maintained anymore. Are there any other simillar OS´s to download somewhere that ...
17
votes
2answers
766 views
Is it posible to make shellcode with C++?
Usualy I write assembly programs and thens dump their contents to get the shellcode. What I was wondering instead of assembly can I write a c++ program, then dump that and then use it instead of the ...
17
votes
4answers
2k views
What tools are there to inspect Flash SWF files?
I am performing a penetration test against a website that uses Flash heavily.
What tools can I use to examine the SWF file for vulnerabilities?
From the Area51 proposal.
17
votes
3answers
2k views
Google hacking - why “numrange” is so dangerous?
I'm reading Google Hacking for Penetration Testers and in book it's said several times operator "numrange" is especially powerful and dangerous. However, they don't give example of using this ...
15
votes
6answers
3k views
What is the difference between a penetration test and a vulnerability assessment?
What is the difference between a penetration test and a vulnerability assessment?
Why would you choose one over the other?
What deliverables would you expect to receive and how would you rate the ...
15
votes
1answer
2k views
Mac OS X from an IT Security Practitioners' Perspective?
What does the Mac OS X offer that it has been recently attracting users with IT security focus?
There are sites that specifically focus on "hacking" with OSX, such as machacking.net. Defcon has an ...
15
votes
4answers
1k views
Open-source penetration-test automation
Has anyone built a metascript, or a `script of scripts' useful during a penetration-test?
Do you use Metasploit RC files? A network vulnerability scanner in a special way? A command-line, custom, or ...
13
votes
9answers
2k views
Vulnerable OS's?
Which vulnerable OS's like for example DVL would you recommend for someone to use for the purpose of pentest/exploitation learning?
13
votes
6answers
2k views
Lightweight Live Pen-test OS
Does anyone know of any lightweight OSs that are great for Pen-testing? I would love to have a very lightweight live OS that I can boot off a USB and try some pen-testing against some of my ...
13
votes
2answers
230 views
Should a pentest report include the tester's opinion?
In this particular case, the webserver turned out to be a shared 3rd party system and was not tested.
Examples:
We do express grave concern at the overall security posture of that webserver and ...
12
votes
6answers
1k views
Are some uncommon TCP ports scanned less than others?
Ignoring the top 5-10% of port numbers for common services that are the commonly targeted by port scanners (i.e. ports 22-ssh, 23-telnet, 80-http, 139-smb/cifs, 443-https, 3389-rdp, etc.), are the ...
12
votes
2answers
494 views
How can I test my web application for timing attacks?
race conditions, etc.
Are there automatic tools for this? What manual techniques should I use?
From the Area51 proposal
12
votes
6answers
791 views
Securely building a local pentest lab in a VM
I'd like to set up OWASP WebGoat or a similar vulnerable web app in a VM (probably VirtualBox on Linux). For convenience's sake, I'd like to get it running on one of the primary machines I use (say, a ...
12
votes
3answers
293 views
Are there any decent web app security scanners that can integrate with a build server?
I've spent a lot of time in TeamCity recently and the nightly code quality metrics coming from the dupe finder, FxCop and NDepend have been great.
What I'd really like to do is find a decent web app ...
11
votes
6answers
3k views
At what point does “hacking” become illegal?
Hypothetical situation:
before I hire a web development company I want to test their ability to design secure web apps by viewing their previous client's websites.
Issue:
this situation raises a big ...
11
votes
9answers
1k views
What are some good website security scanning solutions?
What are some good web-based website security scanning solutions? I'm not too concerned if they are web-based solutions, or software that can be run locally.
Generally, I'm looking for something we ...
11
votes
7answers
6k views
Comparing online security courses: eLearnSecurity vs. Offensive-Security
I'm a web programmer, using the Linux environment for 2 years.(I have experience with Web app hacks +Web app security techniques)
I want to start studying security in-depth, but I have limited time ...
11
votes
4answers
367 views
What are the most important security checks for new web applications?
I'm wondering what are the top priority security checks you should make befor launching a new webapp?
I'm guessing brute force vulnerabilities and cross-site scripting. What are the other things you ...
10
votes
4answers
2k views
Legitimately using tools like Havij
I'm a developer, not a security guru. My primary focus is ensuring that I'm not introducing security holes through bad programming. I understand how to code to protect against the OWASP Top 10, as ...
10
votes
6answers
1k views
Security review: “HTTP header user-agent has been set to (something)”
We got a security review done of our PHP code and they team advised this in their report (amongst other things):
/appdir/
Details
The HTTP header user-agent has been set to \" .
Request
GET ...
10
votes
7answers
6k views
Penetration Testing Jobs without Experience
There seems to be a late trend where firms are beginning to hire fresh graduates for security related jobs. This is counter to what I've heard from experienced security professionals (as well as the ...
10
votes
6answers
303 views
Are all security requirements expected to be testable?
Many approaches exist to define security requirements. To keep it simple, i would say to define a security requirement, one need to model the threat encountered when building up misuse cases for ...
10
votes
3answers
538 views
Tools to help test the security of Android applications
What are some decent frameworks to test the security of Android applications?
With frameworks I mean either software based to automatically scan these applications or a guide (like OWASP has for ...
10
votes
2answers
493 views
What are legal/ethical concerns to bear in mind, when hacking websites with open invitations?
I was reading another question which mentions a site that had a page inviting people to try to hack it, and it made me wonder.
Lets assume, for the sake of this rather hypothetical question, that a ...
10
votes
3answers
2k views
iOS/Android Pen-Test
This question might be vague, that is because I am not sure where to start.
There are a lot of books and courses on pentest focusing on networks, systems, and OS such as windows, yet I haven't been ...
10
votes
3answers
1k views
White-box vs. Black-box
What are the relative advantages and disadvantages of each form of testing?
I.e. What is the difference between static code analysis and runtime/dynamic penetration testing?
What are the pros and cons ...
9
votes
4answers
937 views
How does System Memory Dump work?
So there are so many pen-testing tools that perform a memory dump on the system. How exactly do they work - what exactly happens ?
9
votes
4answers
512 views
Is there a typical step-by-step A-Z process for testing a Web site for possible exploits?
I'm interested less in the tools of the trade (there are many questions here already about that), and I am interested more in the process by which you would go about using those tools. So for ...
9
votes
2answers
482 views
Cross site scripting verification on a field which does not accept more than 20 characters
While performing penetration testing, I got stuck to a point. There is a text field which does not accept more than 20 characters(server side validation). I inserted following piece of code to check ...
8
votes
4answers
303 views
Is it practical and worthwhile to alternate penetration test vendors?
Is it considered a best practice to alternate the vendor used to perform penetration tests? For example if it is your policy to conduct a third-party penetration test semi-annually you would have ...
8
votes
2answers
1k views
How to test against DDoS in a controlled enviroment?
Can you suggest me methods or tools that can help in simulating a DDoS attack in a controlled enviroment (like my private lab)?
8
votes
4answers
574 views
Nessus Scan Port ID mapped to Metasploit Vulnerability exploits
My Question: Is there any sort of website that maps Nessus Scan IDs to Metasploit Vulnerabilities?
My Situation: I'm learning about penetration testing and I'm beginning to get frustrated seeing a ...
8
votes
1answer
730 views
How to perform penetration testing on a Flex application?
Possible Duplicate:
What tools are there to inspect Flash SWF files?
I have decompiled it, verified the source. All seems fine. Appscan also is not able to find anything in this case. But I ...
7
votes
5answers
691 views
I have a client that is worried about DDOS attacks on their site, and they want penetration testing. Will that help?
My client wants to look into hiring a third party to perform penetration tests on the website that we're developing for them. The website is just a simple 3-month contest site where people can upload ...
7
votes
5answers
391 views
How do small businesses handle web app security?
Everything on Owasp's top 10 list, how do current small businesses (< 1000 employees) handle web application security, along with mobile security of their applications?
Do they care about info/app ...
7
votes
4answers
297 views
How to test a physical machine?
In two weeks time, I will have to test a couple of computers that a client would like to provide to its employees. The main concern is making sure that the employees won't be able to use those ...
7
votes
3answers
393 views
Which resources can help me learn how to use metasploit?
I tried google search but I can't find good resources to learn how to use the metasploit framework.
Where would you suggest a beginner go to learn about using metasploit?
7
votes
5answers
837 views
Automated tools vs. Manual reviews
What are the advantages of using automated tools, as opposed to manual review? What are the disadvantages?
This applies both to external blackbox vulnerability scanning, and to static code analysis.
...
7
votes
3answers
3k views
pros and cons of a bootable BackTrack instance vs installed
I've been wanting to mess around some with BackTrack to get a better understanding of some of the tools out there for penetration testing. I have a Linux box that isn't doing much right now that I was ...
7
votes
2answers
205 views
Should a penetration tester have training in ISO 27001/ITIL etc?
I recently got offered a promotion but as part of the package I've been requested to do ISO 27001, ITIL, ARPA and other kinds of training. I've previously avoided this sort of training as I felt it ...
7
votes
3answers
753 views
How does BeEF work? (working understanding)
I have recently come across the BeEF- a browser exploitation tool. In most of the articles, it is said time and again that it is developed for research and pen test purposes! Has anyone worked with ...
7
votes
2answers
539 views
How should one prepare himself for a job interview for penetration testing?
So, the title basically says it all. I would really like to hear out some of the more experienced friends here with their answers for this.
Should it revolve around the ability to verbally explain ...
