Tag Info

Hot answers tagged

55

The fundamental question here is authorization, not access. If you break into your neighbor's house, clearly you are in violation of the law. But if he lets you in, then you are not. So what if you have a key? If he gave you the key along with permission to enter (to feed his dog while he's away), then you have authorization to enter. No trespass there. ...


21

First, this question has to be answered in a country-specific context, because each country has its own laws and regulation regarding computer crimes, intrusions, data manipulation etc. One important thing to consider also is that the persons who will judge those cases are not technical aware people. They usually have no clear idea of what a database is, ...


17

What I'm confused about is where is the line between illegal hacking and just using information which is publicly visible? The question is whether this information is considered public, even if it's publicly visible. In this particular case it's 100% clear that this is not the case. Even when a server admin leaves this bug unpatched, it doesn't mean ...


9

If you want to penetest a wifi. The wifi card would need to support monitor mode. However vmware uses it's own usb drivers so you might want to install kali to your hard drive or run it off a cd/usb. If you want to pick up weak signal's you need a card with high watt's and a good antenna www.alfa.com.tw has some high power wifi cards at a reasonable price.


7

From a purely technical viewpoint one could say that any data which can be accessed in some way is public, because technology doesn't make a difference between features and bugs. But laws are rarely that technical. Legislation about what's illegal hacking and what isn't vary a lot around the world. I am not a lawyer, but as far as I know, many legislations ...


6

There are plenty of wireless cards to choose from in this area. The best in my opinion is the trusty old alfa AWUS036H with the rtl8187 chip-set. This card has been my favorite for a long time and is still going strong after years of persistent use. The alfa is also 'plug and play' for pretty much all Linux distros and has good drivers for windows with only ...


5

In the case of Heartbleed, one should remember that a company/sysadmin has taken the pro-active steps to protect data. They have used OpenSSL to secure a web portal. The fact that there was a bug in it that went undiscovered was not the fault of the company. They have attempted to protect data. Any court/jury, using common sense, would find for the company, ...


4

The particular site linked in that BBC article is not launching attacks. It simply is checking the HTTP headers of the website you enter and decides if the site is vulnerable or not based on if it can identify the version of open SSL it is using, the date of the certificate and a database of known vulnerable sites. It does this because this is all public ...


3

With Information Security, analogies to physical-world security are often made. For instance, A building is secured with a door that's locked, around that, a fence with a gate and security guard, and so on. Breaching a building's security layer(s) would be a criminal offense in most (all?) legislations. I'd bet that's mostly called breaking and entering. I ...


3

Consider checking the Aircrack wiki if in doubt. It's also a good idea to Google + kali/backtrack to see if anyone has had any problems with a card you are considering. Be sure to check the date though. Someone saying it didn't work in 2005 is not helpful. Also look for one with a removable antenna. They usually come with 2-3 inch ones, but if you can ...


2

fuzzdb contains a collection of web backdoor programs which if they were present on a live server would be a good indication that it had been compromised. This is likely why the A-V tool is reacting to those files. It is a common issue with penetration testing tools that A-V software regards them as malicious. However just downloading them is not going to ...


2

And the name of the offence suggests, for "unauthorized use of a computer" it is significant whether permission was given. It is presumed that permission is given for example to visit a website using a browser. You needn't have it in writing. It is not presumed that permission is given to use an unintentional feature such as the heartbleed flaw. So yes, it ...


2

If you have the motivation and perseverance you don't need any expensive course at all. The only thing courses will give you which you cannot gain any other way is certificates. Now if your wanting to get into a corporate business of some kind these will be vital to you securing a role most of the time. My perception is experience and understanding are much ...


2

Unauthorized use of a computer's best analog in real world terms is trespassing. Despite the fact that a web server is publicly connected to the Internet, technically, it is private property. Someone owns that server and the software and data on it. They should have a Terms of Use for the site which indicates what is allowed usage of their server. If you ...


2

This is simply not a viable business option for security testing companies, as you can never know in advance what you will face during a pentest engagement. Furthermore, those services are purchased by customers to evaluate the security level of a target application / infrastructure / device / whatever, the actual compromise of the target is only the ...


1

As I understand it, there are three elements of the crime. You obtained "unauthorized" information. You obtained this information using "navigation" procedures that are intrusive. You were not authorized intrude into private areas, or breach a barrier, etc., and you do so and see something, that would be a crime. So if the unauthorized information was ...


1

The dividing line is not a line. It is fuzzy and decided not purely by logic but by persuasion. Persuasion of a jury by a prosecutor. What is legal vs illegal is not decided by those of us who work with tech. It is first decided by a few experts and then blessed by the government as a law and then interpreted by judges lawyers and a few 'lucky' people on ...


1

you (and others are invited too) could try and start webhacking here @ fump.8ack.org, which is a service that has some intentionally vulnerable apps available Damn Vulnerable WebApp Exploit-KB Multillidae SQLOL WackoPicko


1

are there any general techniques which can be used on a black-box security test to identify/enumerate enabled modules on a running Apache server? tl;dr: you cannot detect all installed/enabled modules, and you need to analyze headers manually, if you dont want to X-MISS something we use a custom tool to investigate all server-headers; this tool, ...


1

There are a few different kind of labs available. There are ones you can construct yourself in VM's such as Vulnhub and they have a lot of links to good resources there. Another site i can recommend with good resources is Pentesterlab, i tend to steer clear of the online sites such as hackme so can't give much as to online but hope these help.


1

Your IP is blacklisted for a reason, not just because you use Burp or Appscan. A possibility is that they have a mechanism to detect: Too many connections to the site An offending User-Agent Too many malicious HTTP requests Try to discover first how or why it classifies you as malicious and try to circumvent then the protection. Web sites does not ...


1

Use a proxy. Either a webbased one like hidemyass or ixquick. Or a http/socks based proxy. You can find free ones listed all over the place, including hidemyass. If you need to run applications that do not provide built in proxy settings then use a wrapper such as proxychains.



Only top voted, non community-wiki answers of a minimum length are eligible