Tag Info

Hot answers tagged

6

The first thing to note here is that banner grabbing is an error prone way to check for vulnerabilities in a lot of cases (as OS vendors backport security fixes without updating version numbers). Nessus as an example will try and work around that, but it's not foolproof. The best way to address checking your security with scanners is to get them to do ...


5

Why there is need of penetration testing, when I already testing and audited my code. It's the same reason why even code written by highly experienced developers should undergo peer review. You wrote the code so you might not be able to see the issues with it. It's very likely that you are too familiar with your own code to see any problems in it. There ...


3

As a penetration tester, this wording is put forth in the Statement of Work however, as a tester, I don't recommend that you have the tester just stop the test once access is gained. The purpose of a penetration test is to gain access much similar to how an attacker would gain access. By stopping the test, you could never know what else is exploitable. Let's ...


3

You are not really going to get good results, such an approach is really appropriate for a pentest but more for a Red Team/Tiger Team test where flags are set (honestly these are not appropriate if you never had a pentest because you'll get very demotivated and spend a large amount of your budget as it's quite time consuming). For a pentest you preferably ...


3

The "scope" generally does not state something like "You can't root the machines", as a client you want to know if this is possible IMHO. Once root access is acquired it's basically game over anyway. What the scope should say is the amount of servers and its server names / IP's and that it the assessment is restricted to these devices only. This to prevent ...


2

This sounds very much like security by obscurity to me. You are trying to hide the vulnerability from automated scanners. While such a measure might throw off simple scans, it does not actually address the actual problem. You would still have to keep up to date with patches to secure your server. As you have mentioned, it might create a false sense of ...


2

This is a book on BASIC pentesting of webapps : http://www.amazon.com/Web-Penetration-Testing-Kali-Linux/dp/1782163166 I think it will be enough for basic testing , mostly it explains usage of scanners. If you want proper pentesting you can hire a pentesting company , or maybe Bugcrowd.


2

As a starter owaspis always goodhttps://www.owasp.org/index.php/Main_Page you could also find some tools there. check the cheat sheet series too https://www.owasp.org/index.php/OWASP_Cheat_Sheet_Series


2

PenTests have a "scope" associated with them that you as the customer define. You define how far you want them to go and what the success criteria are.


2

Has anyone experienced this kind of test? or heard of an exploit that allows this? This is totally possible. A clever attacker can set up a site so that if you click on it even once, within seconds he can take over your computer. Even worse, you might not have to go to his site. If you click a link that leads to his site, he could feasibly "own" your ...


2

A browser that is functioning correctly would not allow for this to happen. But vulnerabilities have existed that make visiting the page to be the only interaction needed to launch malicious software. I believe CVE-2014-1776 is a recent example of such. Here is a more detailed analysis. The summary at the beginning of the article gives an overview: ...


1

Yeah, this is the price you pay for cut rate SQL hosting. It's not the end of the world, but you get what you pay for. The idea of Security Through Obscurity is usually considered a bad practice when relied upon on it's own. Rather it's a better idea to secure systems as if an attacker had full visibility of how things are setup. It's also important to ...


1

You can replay or forward an NTLMv2 response but the attacks may require scenario planning and/or tool changes. There may be advanced ways of cracking the hashes that you haven't yet thought about as well. For further information on replaying, check out -- http://www.room362.com/blog/2014/05/21/effective-ntlm-slash-smb-relaying/ ...


1

If a user can get your email server to spam emails, it could increase the likelihood that all emails from you are automatically marked as spam. In the worst case, you could end up on email blacklists and emails you send could be completely ignored. This is assuming you are running all parts of this on your own servers. If not, you might want to clarify.


1

I think the greatest threat could be Denial of service, you could send so many e-mails you could saturate your SMTP server, your mail server and your user´s personal inbox.


1

"Testing" only won't do it. Risk Assessment Frequency: Bi-annually Document information assets (systems, networks, infrastructure components, etc.) Identify threats to those assets (vulnerabilities, attack vectors, etc.) Examine and review how security controls and measures that are in place mitigate or eliminate the risk of those attacks (access ...


1

There are a number of scanners out there which aren't free. Like Nexpose or Nessus which can do way more than just scanning a webserver. But they provide this functionality as well of course. The interesting part is that these scanners can also log into your server and perform configuration reviews to a certain standard. For instance the DISA STIG is a very ...



Only top voted, non community-wiki answers of a minimum length are eligible