Hot answers tagged

77

If there is a teacher or counselor you can trust completely, that you know will keep your name secret even if the school administration starts making threats about firing people, I'd go to them first and talk to them in private. They don't need to understand computers or security (and you don't need to go into detail about the issue), they just need to be ...


55

Another thought struck me as I re-read your question (emphasis mine): How should I tell school that they are vulnerable when I wasn't given permission to check? Could you get permission? Once you have permission, you could "discover" the issue (without telling anyone you'd found it before) and report it without worrying about being blamed for hacking ...


7

How should you tell them? You shouldn't. Let's look at the potential consequences here. Since you were poking around on their network without permission (something which is almost certainly in violation of your student agreement and whatever consent you clicked through in order to gain access to their IT system) the very best outcome you can expect is that ...


4

"Ma'am, I'd just like to let you know that if you slide a strip of metal in the deadbolt of the door to your garage, you can open it with little effort." Just don't disclose. Many of us security folk have found vulnerabilities in our universities' computer systems, but there is nothing to be gained by disclosing it. Let someone else find it and disclose it, ...


3

Putting aside that you are using Nessus, let me answer in terms of the use of any web application scanner as a tool. Automated scanners are great tools for a quick, repeatable test that can find the most common issues with websites. I would never develop without running automated tools. But, one always has to understand that these tools come with serious ...


3

You need to figure out if the parameter is being parsed as an integer or a string (most probably as string). If the query is balanced and successful, It won't die(). try .. 1' order by 1-- - or .. 1 order by 1-- - If the first one returns an error, that means the parameter is being parsed as an integer so you don't need a quote (') to perform the ...


2

Should Exceptions be shown to the user? No. Displaying exception messages is bad practice. Exceptions should be used to debug the code, they should not be used to display something to the user. If you use the same mechanism - exceptions - for both tasks, it will be very difficult to separate between them. Eventually, you will either show an exception ...


2

Use the Socratic method. Expose the vulnerability to whoever is in charge of security as a series of questions. If they, for security reasons (or whatever), can't or don't want to answer your questions, propose hypothetical situations and ask about them.


2

You should check this github repo: https://github.com/jhaddix/tbhm Welcome! This repo is a conglomeration of tips, tricks, tools, and data analysis to use while doing web application security assessments, and more specifically towards bug hunting in bug bounties. Make sure to also check the video :)


2

OS detection goes a lot further, using all kind of data of the IP and TCP headers fields. If you're into reading, "Silence on the Wire" by Michal Zalewski addresses a lot on this topic.


2

I've taken a look at the website and I couldn't find any evidence that it has been hacked - however, this does not necessarily mean that the site is clean. Norton claims that your site is a Web Attack: Mass Injection Website and has therefore put the site on a blacklist. This blacklist seems to be used by other services (like sucuri and maybe the company ...


1

As far as I understood, the question is whether you would use your own, "real" account, a freshly created account or a test account provided by the bank. From my experience, any company wants to limit the potential impact when doing penetration tests. Therefore, they probably won't be happy if you start attacking their production systems. Just imagine what ...


1

There are many things you can do with that. Check the web application source code for settings configurations like databases, then check for a way to connect with the db. Keep looking at the source code and you might find more vulnerabilities (rce,sqli) or misconfigurations that can lead you to database dump, or some old backups, passwords disclosures, ...


1

I follow the OWASP top ten as a guide line. First, I usually check all input fields and urls for SQL injection. Then, I'll brute force directories using burp suite. Check XSS, etc etc etc.


1

Burp Suite lets you save/restore the state of your current pen test. For me this typically means a log of all HTTP requests made. In addition to this you can save all HTTP requests that you sent for further examination/exploitation. It sounds like you want to track more than just the HTTP level of your attack, but I'm not sure that there is a single tool ...


1

You could write a script (in bash or python) to replay your commands and act as a local proxy for your commands execution. This way, you could split the results of the log into each commands. This script should not be too long to write for the gain you will get. That would be my solution :)


1

Assuming you mean web-application penetration testing (you have not clarified), you can start by taking a look at OWASP (Open Web Application Security Project). They have many useful guidelines such as the OWASP ASVS and OWASP CVSS. These will guide you through basic testing methodologies and threat assessment techniques. From there, you can use this ...


1

Can you reveal the vunerability in a permissible way? You found a the issue in a way that is apparently not allowed. Can you present the issue in a way that you do have permission? If so, trying that might be a good idea. It may not even be the original vulnerability, but a bug that, when being investigated or fixed, reveals the vulnerability. For example, ...


1

First of all, if you don't want to perform wireless attacks (sniffing, cracking, impersonating an AP,...) you don't need a Wi-Fi card, any kind of NIC will be enough. For wireless attacks, you clearly need a wireless NIC. This can either be internal, i.e. built-in, or external, i.e. a USB adapter or a PCI Wi-Fi card. Note that if you already have a built-in ...



Only top voted, non community-wiki answers of a minimum length are eligible