1
vote
0answers
51 views

Failed to connect to netcat reverse shell

I am doing an exercise of PentesterLab, I've got a webshell called 1.pdf, and it can be included in index.php as a PHP file. It contains code like this: %PDF-1.4 <?php echo system($_GET["cmd"]); ...
3
votes
4answers
97 views

Effectiveness of Interactive Application Security Testing

There are a number of IAST tools available on the market such as Acunetix Web Vulnerability Scanner and HP WebInspect Real-Time. How effective are these at finding vulnerabilities? Is there any ...
-1
votes
0answers
27 views

Error selecting Public Page from database. Contact System Administrator

I am pentesting a website: http://www.membermanager.net/summerchallengeride/index.php?ID=3719' I a having this error: Error selecting Public Page from database. Contact System Administrator. After ...
0
votes
1answer
76 views

Fuzzdb detected as Trojans [closed]

I recently downloaded fuzzdb from http://code.google.com/p/fuzzdb/ and my antivirus kept on detecting some of the files as Trojans. I need to know if these files are safe?
1
vote
1answer
188 views

File upload vulnerability

I am trying to pentest a webapp challenge. Is the following control code vulnerable to file upload? I would like to upload a php shell... I am able to upload shell.php.jpg file but I receive the ...
1
vote
1answer
215 views

Trying to reproduce a file upload compromise on Joomla

After telling my workmates and boss that we had a very critical lack of security controls, finally we got compromised! They had a Joomla 1.5 which was exploited using a file upload vulnerability. WSO ...
0
votes
0answers
23 views

Deliberately-Vulnerable webapp for security education [duplicate]

A year or so ago I was playing around with an apache webapp I found that was designed for web exploitation practice. It was simple to use, I just downloaded the file, unzipped it, and placed it in the ...
1
vote
0answers
114 views

Hydra gives wrong passwords

I've been trying to use hydra (educational way) but with no success. The site method is http-post but performed by ajax (should it be a problem? I think not). After execute the command I got an output ...
2
votes
2answers
146 views

API Security Testing Methodologies

I have been encountering more and more clients needing their API (usually REST) endpoints tested for vulnerabilities and wanted to reach out to see if anyone has some recommendations beyond what I ...
-6
votes
1answer
101 views

How can I succesfully pentest site with two factor authentication? [closed]

I want to use a commercial, automated tool but it cannot login successfully because the website requires a two factor authentication process using SMS. For testing, the SMS message is sent to another ...
0
votes
3answers
198 views

How to retrieve the admin's password of a webapp?

I'm doing a pentesting example on a web app and I have dumped all the database. I have a table with the users in plaintext and the passwords hashed. I have to find the admin's password (I know that ...
0
votes
1answer
465 views

Hydra gives wrong answers

Problem: Hydra keeps giving me incorrect passwords every time. I'm using brute-force via Hydra to guess the correct password on a certain website. First of all I used BurpSuite to intercept the page ...
0
votes
4answers
372 views

Disabled Unnecessary HTTP Methods

I'am doing a web based application and what I did is to disable some of the hTTP methods are not necessary for the website specifically: OPTIONS, HEAD and TRACE. I put this on the httpd.conf of my ...
5
votes
2answers
130 views

How to manage pen testing byproducts?

Often when doing a pen test you need to hammer certain parts of the site that might be visible to other users. If, for example, you suspect that a comment section is vulnerable to XSS, you might ...
2
votes
1answer
111 views

Helping developers find logic and authorisation flaws

Professional penetration testers are usually good at finding all sorts of vulnerabilities, including logic flaws, that are highly-specific to the site being tested. However, being a manual activity, ...
2
votes
1answer
815 views

How to use sqlmap to perform SQL injection on a clean URL?

I am learning to use sqlmap and came across an application that has Clean URLs. Clean URL example //my url.net/project/public/#questions/question/edit/id/122/answer/1, here MVC framework is used. ...
2
votes
1answer
171 views

Reflected XSS - Automatic understanding of filters

I'm currently facing this possible reflected XSS vulnerability on a webapp: URL = http://www.test.com/login/?login=[PAYLOAD] When a user clicks on this link, it displays a login page that includes ...
1
vote
1answer
98 views

Setting expectations of a vulnerability assessment?

Is it reasonable to refuse to guarantee that you will find 100% of security issues when doing a vulnerability assessment on a website? Even with companies like Google that have teams of security ...
-1
votes
1answer
98 views

Free Alternatives in Web-Application Mapping Software [closed]

Im new to hacking, i have reached a chapter in my book "the web applications hackers handbook" where im about to start bypassing client-side and actually attacking different technologies well before ...
-2
votes
1answer
282 views

ESAPI: Input and output validation [closed]

I am new to IT Security and I have been tasked with coming up with input and output validation for ESAPI. So for input validation, so far I got: Data Type Name Email ...
4
votes
3answers
272 views

Is it necessary to test all input parameters of a web application when testing its security?

We know that testing input parameters for lack of validation is one part of a black box web vulnerability assessment but, is it necessary to test ALL input parameters (parameters, cookies, HTTP ...
9
votes
2answers
5k views

Why does Hydra return 16 valid passwords when none are valid?

I've been playing around with Hydra and DVWA and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. I assume ...
0
votes
2answers
510 views

Blackbox vs whitebox testing your own site?

When performing a security audit of one's own site is one of these methods of testing generally considered better? Would I be wasting my time by doing blackbox testing when I have access to ...
3
votes
3answers
293 views

Web application security standards/certificates

I'm currently working on Web application/service that (hopefully) will be used in a wide variety of ways. Of course I'm looking to attracting some commercial users as well, and as we all know, they ...
4
votes
2answers
3k views

SQL Injection - Extracting database data from the page content

I have a question I am hoping someone could help with.. I am in the process of writing an SQL Injection tool from scratch (I am aware there are already excellent tools out there such as SQL Map, but ...
-4
votes
2answers
304 views

Is it illegal to test a website and report the security bugs to them? [closed]

I am doing testing on some websites and I have found some serious bugs in those sites. I am not sure if this is legal or not. Is it ever legal? How can I find out if it's legal where I live? What ...
5
votes
3answers
1k views

What dangerous characters need to be filtered from user input prior to use in a DB2 SQL query?

I'm looking to fully understand how to properly filter/escape dangerous characters from user input that will be interpolated into a DB2 SQL query. The sanitization routing that I'm analyzing works ...
7
votes
3answers
1k views

SQL Injection How to inject Clean/Rest URLS

I have a question I'm hoping you could help me with? Unclean url's: http://example.com/index.php?page=foo http://example.com/products?category=2&pid=25 ...
2
votes
1answer
369 views

Black box testing javascript MVC web applications

I want to test a web application that has been built using the backbone.js framework. Currently I have used a few tools for crawling and testing without any luck. When crawling the website they can ...
0
votes
1answer
548 views

How I add cookie to w3af for authenticated attacks?

Can anyone explain this in steps to me? Lets just say I clicked to OWASP Top 10 scan profile and entered url. Next I need to add cookies or authentication values to w3af (form based auth.). How? ...
4
votes
3answers
833 views

Create a page to experiment with SQL injection [closed]

This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
4
votes
3answers
538 views

Web app penetration testing

I have a static website which needs to be pentested. It has only got one form which updates some data on the server and i have pentested it with some blind PHP and SQL injection. The site is hosted on ...
2
votes
3answers
359 views

Pentesting file Upload feature

The file(resume) upload feature is accepting any sort of files. I have uploaded the PHP shell into it. How do I again access to that uploaded file? I'm bruteforcing the web directory to check for ...
0
votes
1answer
209 views

What type of attacks can be carried on for an web application [closed]

My company has designed an web application and its going to be hosted soon, I would like to know what type of attacks can be carried on the web application to test the security of my web application ...
7
votes
5answers
480 views

How do small businesses handle web app security?

Everything on Owasp's top 10 list, how do current small businesses (< 1000 employees) handle web application security, along with mobile security of their applications? Do they care about info/app ...
2
votes
5answers
3k views

Efficient way for finding XSS vulnerabilities?

Manual (reliable) way: Put string containing characters that have special meaning in HTML into some parameter of HTTP request, look for this string in HTTP response (and possibly) in other places ...
2
votes
1answer
89 views

What is this hardened computer called? [closed]

After undergoing a security audit, it was suggested that a hardened computer be placed in the DMZ to run firewall software. What is this hardened computer called?
4
votes
2answers
943 views

How to pentest Flash file on webapp with alowscriptaccess=samedomain?

In the course of a pentest I found a Flash movie file (swf) that loads another Flash movie through loadMovie. The HTML is this: <embed width="388" height="350" ...
2
votes
1answer
521 views

Web application penetration testing resources? [duplicate]

Possible Duplicate: Best resources to learn web security attacks? I'm very interested in web application penetration testing. I went over every good Youtube video on that subject and most ...
-4
votes
4answers
307 views

Should companies use Crowd Source Audit Platform for Manual Penetration Test?

As a CIO, CISO, CTO or Sys Admin, would you use a crowd sourced platform for penetration tests in order to improve your security issues? LE: So most of you guys downgrade, and said it's wrong to have ...
5
votes
1answer
256 views

Securely Store Credentials for Web Application Services in Apache

We are running a web application in python using wsgi with apache2, and must submit to a penetration test. The testers will be exploring the potential for damage if the attackers gain shell access as ...
2
votes
1answer
627 views

Example of attack trees in the web application security analysis

Here I am again asking for some informations about attack trees usage in web application analysis. For my master thesis I decided to study the usage of this formalism in order to reppresent attacks ...
3
votes
5answers
2k views

How can I execute a XSS with these conditions?

I am trying to learn penetration testing and I have downloaded a vulnerable application called "Bodgeit Store". I have finished almost all the challenges except one which is to execute a Cross-Site ...
6
votes
2answers
276 views

What fraction of vulnerabilities does black-box pentesting find?

Black-box penetration testing is one to check a web application for vulnerabilities. It can find some vulnerabilities, but not all. What fraction of vulnerabilities does black-box pentesting find, ...
5
votes
1answer
428 views

question for pentesters: PHP proc_open() in safe_mode

Can anybody explain to me how proc_open() is affected when PHP is running in safe_mode? As far as i have noticed, the command to execute is appended to a '/' - is there anything else and is it ...
3
votes
3answers
616 views

Android Pen Testing

I have been pen testing a random android app that uses POST method to send data to a remote server using HTTPS. I have set up a proxy and am able to intercept the traffic, however the POST method ...
6
votes
3answers
1k views

Where can I find exploit code?

I am doing VA/PT on a sample web application. I run the nessus scanner and I found some high severity problems. It is related to HP System Management Homepage. The CVE numbers are: 2010-1917, ...
1
vote
2answers
983 views

how an iframe can cause xsrf?

I know how a form tag is prone to CSRF which does not use any token (or any other challenge-response mechanism) but I was wondering how an iFrame can be used to cause XSRF attack and what would be the ...
12
votes
6answers
992 views

Securely building a local pentest lab in a VM

I'd like to set up OWASP WebGoat or a similar vulnerable web app in a VM (probably VirtualBox on Linux). For convenience's sake, I'd like to get it running on one of the primary machines I use (say, a ...
21
votes
5answers
1k views

How to improve as a security expert

I'm a professional software developer with a high interest in web application security. I'd say that I probably have a better understanding of the security of web applications than the average ...