Tag Info

Hot answers tagged

27

Please keep in mind the Holy Trinity of Information Security: C(onfidentiality), I(ntegrity), and A(vailability). So when we talk about configuration hardening you need to consider the technology you're working with, the information being protected, how the information is used within the organization, and the threats. Based on those answers, and possibly ...


15

To be very honest, I feel that most of the books out there on Metasploit are outdated, as it gets updated very often. To learn more about the two, I would first download Metasploitable. This is an old configuration of Ubuntu with security holes for learning purposes. The Metasploit and Backtrack FAQs are good places to start. Learn what each tool does, ...


14

When in NAT mode the network subsystem of the hypervisor operates by modifying the packets as they leave the host. Assuming TCP/IP over ethernet, the components definitely changed are: source address source MAC usually the TTL often the source port Sometimes other TCP flags will get modified as well such as DF, Window size, etc. In a well behaved ...


14

I have been using Backtrack for 2 years and I have heard no news of any spyware or 'phoning home'. Also, have you seen the photos of the NSA using Backtrack? Metasploit and w3af actively work with the curators of Backtrack, which shows some level of confidence in the distribution. Also, with the number of people running packet sniffers attached to ...


11

The split into one or several partitions is not really a problem of security but of reliability. The idea is that if one of your partitions is crashed, then you lose the contents of that partition, but the other partitions are fine. Also, if you fill up that partition, then other partitions are unaffected. Each partition can have its own filesystem, and not ...


10

Pen testing is a delicate and potentially fraught undertaking, and not the sort of thing to teach yourself on-the-job. Beyond just leaving footprints, I'd also be worried about accidentally leaving destruction behind, or accidentally overstepping the limits of your target set. Rather than being afraid of your peers, you ask them to assist on your first ...


9

Quick side-note: BT5 is no longer the latest - you should look into Kali Linux. There is no "best" OS for testing. You should always choose the tool that's most appropriate for the job. A few thoughts: The OSes designed for penetration testing are usually laden with tools, which is nice and convenient, but tend not to be designed for long-term ...


8

Kali linux is a distribution designed for penetration testing and computer forensics, both which involve password cracking. So you are right in thinking that word lists are involved in password cracking, however it's not brute force. Brute force attacks try every combination of characters in order to find a password, while word lists are used in dictionary ...


7

Linked are some videos which can give you a running head start: "Web Application Pen Testing Tutorials" however, firing off a tool or two at an application is not a reliable mechanism to ensure security. Since you stated: "we have developed an ASP.NET Based Enterprise Application", your best best is to work using say Agile or other SDLC based TEST CASES and ...


7

In short, you don't need SOFTWARE, you need KNOWLEDGE. Seek that first, then the tools can help.


6

Congratulations JMK, both of us are exactly in the same boat! You may want to check few questions i have asked on this site about using Metasploit. In addition to the excellent answers by @Terry-chia and others, I wish to add that one excellent reference which I found for Metasploit is Metasploit unleashed by Offensivesecurity.com. These guys also offer ...


6

What you are thinking of doing is incredible similar to an existing attack known as the karma attack, made popular by the super fun Wifi Pineapple. The basic principle behind the attack is for the attacker to setup an AP that responds to the wireless probe packets clients send out when attempting to connect to a previously trusted AP. By responding to each ...


4

I would say the biggest difference is that ArchPwn is not as actively developed. (EDIT: see BlackArch, this project was reborn!). A lot happens in a year in the realm of security. In fact in the last year a tool for cracking WPA-PSK called Pyrit was released and can be found on BackTrack. Now the counter argument is that both Archlinux and Ubuntu have ...


4

Depending on the engagement, leaving footprints and log traces might be important. If the admins are reviewing their logs, they might need to know that an anomaly came from a non-malicious source or be able to determine later that an event was caused by your actions. But, it depends on the engagement. One of the steps of a pentest is the Cleanup, which ...


4

Metasploitable was recently upgraded - here's the link. This newer version is more stable and includes several updates afaik. So that you don't nuke something permanently, I'd recommend first playing with Backtrack on a USB key as live install. Here's a good how-to link from the BT5 wiki.


3

The book Metasploit: The Penetration Testers Guide was quite good (http://www.amazon.com/Metasploit-The-Penetration-Testers-Guide/dp/159327288X). It was written by people very close to the project (the creator of SET, the creator of BackTrack, to name two) and the forward was written by HD Moore, the creator of Metasploit. It is certainly not out of date, as ...


3

In terms of finding the corresponding exploits for Nessus output, there's a couple of good techniques. Firstly, Nessus puts a flag in each report item for "exploitable" which indicates that there is exploit code available. Once you've got that you can use the CVE number which will likely be listed in the finding (or the MS number for Microsoft vulns) as ...


3

The first place to look would be the BackTrack wiki: http://www.backtrack-linux.org/wiki/index.php/Wireless_Drivers There is also a strong community who will provide guidance on the Backtrack forums.


3

If attackers use anonymity tools such as Tor, it's exceedingly difficult to trace them back to the person performing the attack, especially after the fact. Think of Tor like a big encrypted mesh, where connections are routed through a random path of multiple nodes. At no point does any one node know both the source IP and target IP. Attacks against such ...


3

You have pretty much hit the nail on the head, which is why for most organised crime online the key is to follow the money, which is much more traceable. Depending on paranoia level an attacker could route through multiple proxies, use TOR or other anonymising tools and generally obfuscate to whatever degree they want, and whilst some ISPs will cooperate, ...


3

What you're looking for with cracking WPA-PSKs is handshakes (clients joining the network), so the exact amount of time that you'll need to wait depends on how busy the network is. As a tip you can run airocrack-ng on the cap files whilst you're capturing traffic and see if there are any handshakes listed for the network that you're interested in. Also ...


3

If your switch supports port mirroring, I would definitely go that route. Port mirroring will essentially duplicate all traffic coming through the switch, and send it to a single port. You would then want to connect a machine to this port and run whichever packet capturing tool (such as Wireshark) for analysis. I wouldn't want to go with the ARP poisoning ...


3

If never seen this done without a script, so here is a baseline script for you to accomplish this: checkht="lsof -c httpd | awk '{print $1}' | uniq | grep h" if [ -n "$checkht" ]; then echo "webserver is running let me shut down uptables rules blocking HTTP" iptables -vnL --line-numbers |awk '/tcp dpt:80/{print "iptables -D INPUT "$1}' | sh else ...


3

Since it's actually saying "ERROR" from the resource script, my guess is that something borked in SET actually. Edit the /root/.set/meta_config file and change the line that says use ERROR to use exploit/multi/handler. Then in your msf> prompt type resource /root/.set/meta_config to reload the resource file. Thats a temporary fix, you should file a "New ...


2

I realize I am new to the site but I have dabbled in Security Research and Pentesting. As many have posted, "Metasploit: The Penetration Tester's Guide" would probably be your best bet for learning Metasploit. However, "The Basics of Hacking and Penetration Testing" by Syngress and "Gray Hat Hacking: The Ethical Hacker's Handbook" by McGraw-Hill are good ...


2

As @Awhitehatter said, brute force is the only way to crack WPA2. It is based on the initial handshake and after that the key can be computed offline. The time necessary to crack WPA2 depends on the complexity of the key and your computational power. There are tools which can help you in cracking a relative weak key (common word(s)) by using so called ...


2

WEP and WPA are different, so I will assume you are asking about WEP. (Ask a separate question if you want to know about WPA.) Wireshark should be able to decrypt WEP traffic if you have the cryptographic WEP key. For instance, here are instructions for decrypting WEP and WPA traffic. So all that is needed is a way to find the WEP key. There are several ...


2

From the comments, you state that you cannot email at all. What you need is another piece to the puzzle: a forwarder. You need to tunnel your SMTP traffic through your local FW to a forwarder that will relay it to port 25 to the target. All this is assuming that the target is receiving SMTP (port 25) and is not also using webmail ....


2

Whether or not you can send email with TOR depends on the exit policy of whatever exit node you end up using. Almost invariably outgoing TCP 25 is blocked by tor exit nodes because of spammers. More importantly, most email providers are using the Sender Policy Framework which can be used to detect forged email. Welcome to 2012 where most stupid hacks ...


2

I'd look at this a different way than the other responders so far: if you are looking at a bunch of exploits, then all the threats are possible and sandboxing the system where you do that as much as possible seems like a useful precaution. Xen is one easy way to do that. It can use disk images on another file system, but if you know you are going to use it ...



Only top voted, non community-wiki answers of a minimum length are eligible