Hot answers tagged

12

In typical pentesting, Kali is just another tool, it's insecure by default, and is never recommended to be run as your primary OS without some serious baseline hardening. It's typically launched (as a virtual machine) when needed and "paused" or "stopped" when not. This helps keep your host (and files) protected. Additionally, Kali is known to have bugs ...


6

Shikata Ga Nai is an encoder included in the Metasploit framework for the x86 architecture. From the available source code: This encoder implements a polymorphic XOR additive feedback encoder. The decoder stub is generated based on dynamic instruction substitution and dynamic block ordering. Registers are also selected dynamically. An academic paper ...


6

Shikata Ga Nai isn't a payload, but an encoder. The payload is the reverse shell. Metasploit offers several encoders, Shikata Ga Nai being one of them. An encoder attempts to overcome detection by AV, network intrusion detection, and keep characters that can cause a crash of the victim out of the payload, like null bytes.


6

I was wondering, what would happen if a Tesla car was hacked into? Nothing good I can promise you that. Are future cars designed to be able to be stopped by police via remote access and commands? Not that we know of. What if someone actually causes an accident using this method? Who will be to blame? How can one prove the accident wouldn't be ...


5

As a developer of 15 years who has moved into a pen-test role, I can say that yes there are many transferable skills, some of which will put you at and advantage to testers who came from a pure security background. Firstly and foremostly you understand the developer mindset, this means that you probably understand why a developer chose a particular ...


5

When referring to black, grey and white hat the following is the definition: White - A hacker who is hacking for profit with permission in order to test a system (This is called a penetration tester). Grey - A hacker who works as a penetration tester but also as a illegal hacker. Black - A hacker hacking illegally for any reason which can include all ...


4

You cannot force an arbitrary email server to send an email to you. But it might be possible in specific setups. The easiest case is if the servers allows relaying because then you can simply address the mail to you. If you have login credentials you might try to authorize against the server and send a mail to you, because most servers allow authorized ...


3

When I engage in penetration testing, my goals go above beyond finding open ports, to finding "information" that could be used to gain access, or negatively impact the company. If you solely focus on ports (services), or CVE information, you will likely miss common indicators, and information that an attacker will not miss. Usually my penetration tests, ...


3

No, this adds no real security value. Depending on the approach of your attacker, the first thing he might do is fingerprint the server and libs and do a crawl of the whole site himself (that's what I would do if the point is to find a vulnerability in the code). Crawling a site like this is extremely trivial (and easily automated), so the gain is ...


3

If the server is publicly accessible then you don't need to worry about VPN connection info. Security assessments are often performed on sites before they are exposed to the internet and the site is only accessible on a private network so they will ask for you to provide these details if that is the case. The DNS name that the application will have will ...


3

DANE allows you (as a domain owner) to specify the possible CA's that are allowed to generate a certificate for your domain. This prevents rogue Ca's to issue a certificate (it will be invalidated by a client that uses DANE to validate the certificate). From Wikipedia: DANE enables the administrator of a domain name to certify the keys used in that ...


2

Being able to use arrays in $_GET in this way is in itself not a security vulnerability. The DoS vector seems negligible to me, although this may indeed be amplified by the code using it. However, the examples you provided missed the most important part of this feature (from an attackers point of view): it is not only possible to pass regular arrays in GET ...


2

Unfortunately in UK, most companies want you to have the local ones, CREST and CHECK, and of course SANS. OSCP doesn't sell as much as them and ISC or EC-Council. My advice for you would be to first start with CEH, then GPEN and with a more experience, you can go for OSCP. To be honest, OSCP is not an entry-level into the world of PT, I would first suggest ...


2

There is nothing hindering you from testing within your own network. To get a rudimentary understanding of what is involved with testing, I suggest you familiarize yourself with the Penetration Testing Execution Standard, OSSTMM, and other similar pentesting frameworks. Once you begin establishing the who, what, when, where and why, it will make things ...


2

I'm a developer and I do network security as side business. I have a long time since I started developing so after learning the basics about security I wanted to learn more. After several years now, I keep learning about network security. Ideally, developers need to know as much as possible about security, but they don't really need to enter in too much ...


2

You can be anywhere you like. Once you have the handshake you can crack the password anywhere you like. The handshake is as if you have a "hashed" password and you want to crack it. One method of doing this is using aircrack-ng which tries to crack the handshake using a dictionary attack (This is a passive attack on your captured packets). You can view the ...


2

Your browser will add the HTTP Referer header (which, in a sense, indicates the "originating" URL) to most resource requests originating from a web page (exceptions include loading HTTP content from an HTTPS website, and refreshes). Thus, the simplest way to automate testing is to crawl/spider/monkey your web application and log all requests to other ...


2

1) "Are there any other internals which I've missed and worth noting." I'm not sure if I've understood you correctly, especially at the "worth nothing" part but there is a big change on the sandboxing mechanism. According to a review at The Register, Microsoft removes a part of the sandboxing for the applications which have been downloaded from the ...


2

Have you been reading the news. Remote accesses are totally possibly especially as the IoT paradigm comes to surface. As for who to blame for accidents caused by "smart cars", there are already feathers being ruffled. Lawmakers are grappling over this new reality as to who is to be held accountable in case of an accident where there is no human driver ...


1

Attackers employ a variety of techniques to compromise networks, however I would argue that in many (if not most cases) social engineering is involved. Spear Phishing has an overwhelming success ratio when executed properly and skilled social engineers are always going to be something to be feared. Spear Phishing typically also relies in a weakness in the ...


1

This is an extremely broad question. When you're learning about security and penetration-testing, you're supposed to learn all these techniques. There are loads of techniques each with it's own purpose, situation,... To give a small answer on your question, Social engineering is often used, and so are backdoors. Lastly I had to write a PoC (Proof of concept)...


1

In addition to the book references left in my comment, I think you can set the following as your high-level steps. OSINT (includes recon on the company, DNS records recon, etc) IP Scans Banner checking for vulnerabilities Web application scans & testing (Burp, Nikto, etc) Social engineering of employees Privilege escalation (if required because ...


1

As a developer of Kali, I can attest that this answer is very wrong. Kali is not insecure by default, and has the same security standards as Debian in a default installation. Kali is a Linux distribution aimed at Penetration Testing - as opposed to casual browsing or day-to-day computer activities - which is why some people prefer running it as a virtual ...


1

It's perfectly legal to attack a machine or network as long as you have the explicit permission of the owner. Since it's your network, you can do whatever you would like.* There are other laws you may still bump into. For example, you can't change your WiFi access points to transmit on an unlicensed frequency. If you install a virus "for testing purposes"...


1

What would be the proper term for such a vulnerability? "Array injection"? In what vulnerability category does this belong (for example in the OWASP Top > 10 or CWE list)? This is called "parameter tampering" and has been called as such by PHP developers, OWASP, and falls under different CWE numbers with the parent being CWE-371, e.g. when the ...



Only top voted, non community-wiki answers of a minimum length are eligible