Hot answers tagged

89

You could write some Python code to upload an SSH server binary and then run it, this will give you full SSH access under the privileges of the Apache user. From there you can easily read the Python app's config files and connect to the database using the credentials from there, which will allow you to grab confidential data (no exploits needed here as the ...


24

Why does this happen? It's because PHP has loose typing. Take a look at this example: $x = "1e6"; echo strlen($x); // 3 echo $x * 1; // 1 000 000 On the second line, $x is assumed to be a string, and as such is obviously three characters long. On the third line, $x is interpreted as an integer, or 1 000 000 in this case. Is it a problem? This can ...


12

Strictly speaking? No, by itself it isn't a vulnerability. But it does suggest there's potentially a problem that needs further investigation. This is one of the inherent problems with pen testing. You find something ambiguous like this, and don't know if it's exploitable. To even start to find out if this is a vulnerability, you need to understand what ...


12

In a Penetration test,you can root a server if you are permitted to do. The question cannot have a generic answer. It can only be specific to a each case. The Rules of Engagement specify whether or not you can root a server. A few things are considered for this: Is the server a Production one? If yes, then certainly you should restrain from rooting it. If ...


8

REST Security and API Security are excellent topics of research. This question and the answers provide good starting points to find great tools and techniques to test these interfaces -- API Security Testing Methodologies If I were you, I'd avoid testing a REST interface or an API's security remotely, or via a black-box technique such as dynamic app ...


8

After going through the code, I'm not sure that it is supposed to exploit or attack anything. It looks like its only purpose is to encode a payload using barcodes. It would be a nice way to import code into a system using a barcode reader when all other routes may be blocked. After you locate a vulnerability in a system, you can "upload" a payload using one ...


7

This is remarkably similar to attacks like SQLi, and the remediation is the same. Wherever you allow a barcode to be scanned as input, validate it in the scanner and only allow input that matches the requirements. If you expect a field of 20 digits, only allow 20 digits and strip off anything after 20. If you expect 8 alphanumerics, limit it to that. ...


4

I think the term HTTP parameter pollution would be the best fit. This type of pollution usually submits the same parameter multiple times with different values in the same request. This results in the parameter being treated as an array of values with the parameter name as the array name as described in this article. The way the web server and programming ...


3

Generally in these types of situations, you want to spawn a child process for the shell, or migrate to another process(only possible in windows). You can check out one way of doing this in the Metasploit module for process migration in windows: https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/manage/migrate.rb A more general ...


2

In addition to the things said by Sravan, you should put in some effort to avoid doing anything to the server that's hard to reverse. Even though attackers are unlikely to stick to easily reversible actions, a company does not benefit from a prolonged downtime that stems from a poorly executed audit or test. There are already a number of horror stories out ...


2

As you are already on Security Stack Exchange page: locate a string Questions on this page and click on it on a newly opened page locate a string Votes and click on it (this will open a page with links to questions sorted from the one that received most votes to the least) click on each one and read carefully the question and answer, think about what you ...


2

Nobody can access the database or monitoring server directly ... as of now. My opinion is that one must assume a worst case scenario, where all the obscuring/protection layers are gone (whether this is because of a hack or a mistake) and the bare application together with its stack is available. On top of that you may run into issues when scanning ...


2

Being able to use arrays in $_GET in this way is in itself not a security vulnerability. The DoS vector seems negligible to me, although this may indeed be amplified by the code using it. However, the examples you provided missed the most important part of this feature (from an attackers point of view): it is not only possible to pass regular arrays in GET ...


2

There is nothing hindering you from testing within your own network. To get a rudimentary understanding of what is involved with testing, I suggest you familiarize yourself with the Penetration Testing Execution Standard, OSSTMM, and other similar pentesting frameworks. Once you begin establishing the who, what, when, where and why, it will make things ...


2

Barcodes can be to exploited because of fact that most barcodes contain not only numeric and alphanumeric characters, but also full ASCII characters (special ones included) depending on the protocol being used. Barcode scanners are essentially keyboard emulators and if they support protocols such as Code128 (which supports ASCII control characters), an ...


1

It's perfectly legal to attack a machine or network as long as you have the explicit permission of the owner. Since it's your network, you can do whatever you would like.* There are other laws you may still bump into. For example, you can't change your WiFi access points to transmit on an unlicensed frequency. If you install a virus "for testing purposes"...


1

Pinging during pentesting is only helpful for a quick determination of what is immediately reachable. Nothing more, and nothing less. It should not be used for complete discovery of what is, or isn't on a network since some hosts (even on an internal scan (ping sweep)) may not return an ICMP response. During pentesting, I rely on networking knowledge, e.g. ...


1

You should do both scns with and without a whitelisting, so Firewall+IPS/IDS will show it's part in a security game. For example if without whitelist it's perfectly OK, but if when whitelisted you have a big log of security holes found ^ it is a problem, regardless of the Fw+IPS/IDS - some day a new exploit will be not listed yet in a IDS/IPS signature list -...


1

This is highly opinionated and controversial, but I wanted to provide food-for-thought for you to make your own decision. There's OWASP, CWE, and WASC. I don't like any of them. Why shouldn't I use any of these categorization methods? OWASP Top 10 attempts to provide a most common list at a high-level view of what has happened in the last two years. But ...


1

With out actually seeing it happen and being able to check logs, my best guess is that the web server is single threaded and the nc.exe is tying up that thread. As mentioned in one of the comments the cleanest way around this would be to either launch a Reverse Shell via the Reverse shell and then close it (fast enough that no one notices) or to modify the ...


1

It depends.The application used to open the file decides what happens with it. Assuming you mean double clicking the file in the windows explorer this by default means, if it's an .exe file it will be run as a program. If it's a .jpg it's passed to the set default image viewer for .jpg files. Only if you rewrite the executable, or wrap it into an other ...


1

Whenever we submit an offer for a penetration test we are facing the same question: How complex is the application? Complexity leads to additional attack surface, which leads to a lot of tests, which might lead to a lot of findings which require a lot of documentation. This effort has to be reflected within the offering. To determine the possible complexity ...



Only top voted, non community-wiki answers of a minimum length are eligible