3
votes
1answer
256 views

Setup of Kali Linux for reverse shell connections over the internet

I am running Kali Linux as a VM on my Windows machine which is NAT'd behind my company network, if I wish to pen test a website for a client and believe that a reverse shell is possible, what is a ...
2
votes
5answers
637 views

Nmap reporting almost every port as open

I have noticed during some assesments when doing a TCP port scan, Nmap will report almost every port as open for a machine. Using for example nmap -sS -PN -T4 target -p0-65535, over 20,000 ports will ...
0
votes
2answers
267 views

can a backdoor executable be used on an occupied port?

Suppose I am doing a penetration test on a network that has a firewall that blocks all ports except 80, 110, and 443. I want to use a metasploit reverse-TCP backdoor executable written in msfpayload ...
0
votes
1answer
832 views

Telnet local privilege escalation exploits possible even when telnet is running under a normal user account?

http://www.exploit-db.com/exploits/8055/ says: The telnet protocol allows to pass environment variables inside the telnet traffic and assign them to the other side of the tcp connection. The ...
3
votes
2answers
584 views

Tools/methods helping to determine application/protocol serving specific port

I do blackbox testing of the server and figured out that there is a bunch of listening ports. I need to determine what services/protocols those ports are used for. What I've tried so far is to use ...