0
votes
1answer
47 views

How to get the information from the iframe displayed (ClickJack) to the user back to the attacker?

Just for knowledge I want to know how to get the information from the i-frame displayed to the user back to the attacker? Scenario : Suppose You are an attacker and you want to grab the private ...
1
vote
2answers
56 views

Burp configuration to allow SSL connection

I'm trying to capture Request/Responses using Burp on Mozilla. I've configured Burp Proxy on 8080 and have set same proxy settings on Firefox however when trying the Gmail link, Firefox gives "This ...
-1
votes
2answers
85 views

XSS InJavaScript

Recently i was figuring out a web application and found that the url is reflected among the source of the page which make it bit obvious for xss but the input from url which is reflected on source is ...
0
votes
0answers
73 views

POST request in curl return all the source code of the page

I am trying to exploit the mutillidae web-application and I found a page vulnerable to sql injection but with a blacklist check embedded into the HTML code. I've tried to bypass this by forging a POST ...
5
votes
4answers
599 views

What is a good browser for web application pen testing? [closed]

I am getting started in testing web applications, and I am having trouble verifying vulnerabilities. It seems all modern browsers have protections against things like XSS. When something like Burp ...
0
votes
1answer
316 views

SQL injection is possible but selected queries not working

I'm black-box testing an application which uses java spring framework and MySQL in the back-end. When I insert a single quote (') in a text box field, the server returns a HTTP status code 500 ...
0
votes
3answers
2k views

How do you capture ALL the traffic from an Android app?

I want to capture all the traffic from an Android app for its pen-testing. How do I do that? Here's what I've already tried: I installed the app on an emulator and started the emulator with a ...
0
votes
0answers
64 views

HTTPS site not being captured by BURP

I am testing a website, basically mapping the site using burpsuite. But there is one link(https) that I can not process while the proxy on firefox is enabled. It asks me for certificates and when I ...
0
votes
1answer
130 views

Some queries regarding SQL injection

[I'm not really sure if I should be posting this on SO or here. I think my questions might be answered if I have had a good experience with MySQL. But, I don't. So probably, most of you will ...
0
votes
1answer
177 views

BurpSuite: Anonymity

Are the attacks being performed using burpsuite detectable? If yes, how should we stay anonymous/secure while conducting web application reconnaissance?
1
vote
0answers
169 views

Failed to connect to netcat reverse shell

I am doing an exercise of PentesterLab, I've got a webshell called 1.pdf, and it can be included in index.php as a PHP file. It contains code like this: %PDF-1.4 <?php echo system($_GET["cmd"]); ...
4
votes
4answers
412 views

Effectiveness of Interactive Application Security Testing

There are a number of IAST tools available on the market such as Acunetix Web Vulnerability Scanner and HP WebInspect Real-Time. How effective are these at finding vulnerabilities? Is there any ...
0
votes
1answer
119 views

Fuzzdb detected as Trojans [closed]

I recently downloaded fuzzdb from http://code.google.com/p/fuzzdb/ and my antivirus kept on detecting some of the files as Trojans. I need to know if these files are safe?
1
vote
1answer
696 views

File upload vulnerability

I am trying to pentest a webapp challenge. Is the following control code vulnerable to file upload? I would like to upload a php shell... I am able to upload shell.php.jpg file but I receive the ...
1
vote
1answer
822 views

Trying to reproduce a file upload compromise on Joomla

After telling my workmates and boss that we had a very critical lack of security controls, finally we got compromised! They had a Joomla 1.5 which was exploited using a file upload vulnerability. WSO ...
0
votes
0answers
25 views

Deliberately-Vulnerable webapp for security education [duplicate]

A year or so ago I was playing around with an apache webapp I found that was designed for web exploitation practice. It was simple to use, I just downloaded the file, unzipped it, and placed it in the ...
1
vote
1answer
421 views

Hydra gives wrong passwords

I've been trying to use hydra (educational way) but with no success. The site method is http-post but performed by ajax (should it be a problem? I think not). After execute the command I got an output ...
2
votes
2answers
408 views

API Security Testing Methodologies

I have been encountering more and more clients needing their API (usually REST) endpoints tested for vulnerabilities and wanted to reach out to see if anyone has some recommendations beyond what I ...
-6
votes
1answer
197 views

How can I succesfully pentest site with two factor authentication? [closed]

I want to use a commercial, automated tool but it cannot login successfully because the website requires a two factor authentication process using SMS. For testing, the SMS message is sent to another ...
0
votes
3answers
209 views

How to retrieve the admin's password of a webapp?

I'm doing a pentesting example on a web app and I have dumped all the database. I have a table with the users in plaintext and the passwords hashed. I have to find the admin's password (I know that ...
0
votes
1answer
965 views

Hydra gives wrong answers

Problem: Hydra keeps giving me incorrect passwords every time. I'm using brute-force via Hydra to guess the correct password on a certain website. First of all I used BurpSuite to intercept the page ...
0
votes
4answers
1k views

How can I test that I have correctly disabled unnecessary HTTP methods?

I am making a web-based application and I disabled some of the HTTP methods which are not necessary for the website (specifically, OPTIONS, HEAD and TRACE). I put this in the httpd.conf of my xampp ...
5
votes
2answers
140 views

How to manage pen testing byproducts?

Often when doing a pen test you need to hammer certain parts of the site that might be visible to other users. If, for example, you suspect that a comment section is vulnerable to XSS, you might ...
2
votes
1answer
118 views

Helping developers find logic and authorisation flaws

Professional penetration testers are usually good at finding all sorts of vulnerabilities, including logic flaws, that are highly-specific to the site being tested. However, being a manual activity, ...
2
votes
1answer
1k views

How to use sqlmap to perform SQL injection on a clean URL?

I am learning to use sqlmap and came across an application that has Clean URLs. Clean URL example //my url.net/project/public/#questions/question/edit/id/122/answer/1, here MVC framework is used. ...
1
vote
1answer
235 views

Reflected XSS - Automatic understanding of filters

I'm currently facing this possible reflected XSS vulnerability on a webapp: URL = http://www.test.com/login/?login=[PAYLOAD] When a user clicks on this link, it displays a login page that includes ...
1
vote
1answer
104 views

Setting expectations of a vulnerability assessment?

Is it reasonable to refuse to guarantee that you will find 100% of security issues when doing a vulnerability assessment on a website? Even with companies like Google that have teams of security ...
-1
votes
1answer
110 views

Free Alternatives in Web-Application Mapping Software [closed]

Im new to hacking, i have reached a chapter in my book "the web applications hackers handbook" where im about to start bypassing client-side and actually attacking different technologies well before ...
-2
votes
1answer
550 views

ESAPI: Input and output validation [closed]

I am new to IT Security and I have been tasked with coming up with input and output validation for ESAPI. So for input validation, so far I got: Data Type Name Email ...
4
votes
3answers
311 views

Is it necessary to test all input parameters of a web application when testing its security?

We know that testing input parameters for lack of validation is one part of a black box web vulnerability assessment but, is it necessary to test ALL input parameters (parameters, cookies, HTTP ...
10
votes
2answers
8k views

Why does Hydra return 16 valid passwords when none are valid?

I've been playing around with Hydra and DVWA and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. I assume ...
0
votes
2answers
657 views

Blackbox vs whitebox testing your own site?

When performing a security audit of one's own site is one of these methods of testing generally considered better? Would I be wasting my time by doing blackbox testing when I have access to ...
3
votes
3answers
369 views

Web application security standards/certificates

I'm currently working on Web application/service that (hopefully) will be used in a wide variety of ways. Of course I'm looking to attracting some commercial users as well, and as we all know, they ...
4
votes
2answers
4k views

SQL Injection - Extracting database data from the page content

I have a question I am hoping someone could help with.. I am in the process of writing an SQL Injection tool from scratch (I am aware there are already excellent tools out there such as SQL Map, but ...
-3
votes
2answers
489 views

Is it illegal to test a website and report the security bugs to them? [closed]

I am doing testing on some websites and I have found some serious bugs in those sites. I am not sure if this is legal or not. Is it ever legal? How can I find out if it's legal where I live? What ...
5
votes
3answers
2k views

What dangerous characters need to be filtered from user input prior to use in a DB2 SQL query?

I'm looking to fully understand how to properly filter/escape dangerous characters from user input that will be interpolated into a DB2 SQL query. The sanitization routing that I'm analyzing works ...
7
votes
3answers
2k views

SQL Injection How to inject Clean/Rest URLS

I have a question I'm hoping you could help me with? Unclean url's: http://example.com/index.php?page=foo http://example.com/products?category=2&pid=25 ...
2
votes
1answer
458 views

Black box testing javascript MVC web applications

I want to test a web application that has been built using the backbone.js framework. Currently I have used a few tools for crawling and testing without any luck. When crawling the website they can ...
0
votes
1answer
733 views

How I add cookie to w3af for authenticated attacks?

Can anyone explain this in steps to me? Lets just say I clicked to OWASP Top 10 scan profile and entered url. Next I need to add cookies or authentication values to w3af (form based auth.). How? ...
4
votes
3answers
1k views

Create a page to experiment with SQL injection [closed]

This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
4
votes
3answers
612 views

Web app penetration testing

I have a static website which needs to be pentested. It has only got one form which updates some data on the server and i have pentested it with some blind PHP and SQL injection. The site is hosted on ...
2
votes
3answers
482 views

Pentesting file Upload feature

The file(resume) upload feature is accepting any sort of files. I have uploaded the PHP shell into it. How do I again access to that uploaded file? I'm bruteforcing the web directory to check for ...
0
votes
1answer
251 views

What type of attacks can be carried on for an web application [closed]

My company has designed an web application and its going to be hosted soon, I would like to know what type of attacks can be carried on the web application to test the security of my web application ...
7
votes
5answers
519 views

How do small businesses handle web app security?

Everything on Owasp's top 10 list, how do current small businesses (< 1000 employees) handle web application security, along with mobile security of their applications? Do they care about info/app ...
2
votes
5answers
4k views

Efficient way for finding XSS vulnerabilities?

Manual (reliable) way: Put string containing characters that have special meaning in HTML into some parameter of HTTP request, look for this string in HTTP response (and possibly) in other places ...
2
votes
1answer
93 views

What is this hardened computer called? [closed]

After undergoing a security audit, it was suggested that a hardened computer be placed in the DMZ to run firewall software. What is this hardened computer called?
4
votes
2answers
1k views

How to pentest Flash file on webapp with alowscriptaccess=samedomain?

In the course of a pentest I found a Flash movie file (swf) that loads another Flash movie through loadMovie. The HTML is this: <embed width="388" height="350" ...
2
votes
1answer
628 views

Web application penetration testing resources? [duplicate]

Possible Duplicate: Best resources to learn web security attacks? I'm very interested in web application penetration testing. I went over every good Youtube video on that subject and most ...
-4
votes
4answers
334 views

Should companies use Crowd Source Audit Platform for Manual Penetration Test?

As a CIO, CISO, CTO or Sys Admin, would you use a crowd sourced platform for penetration tests in order to improve your security issues? LE: So most of you guys downgrade, and said it's wrong to have ...
5
votes
1answer
315 views

Securely Store Credentials for Web Application Services in Apache

We are running a web application in python using wsgi with apache2, and must submit to a penetration test. The testers will be exploring the potential for damage if the attackers gain shell access as ...