Hot answers tagged penetration-test
12
There are many VoIP services that provide ID-spoofing functionality
Jumblo: Create an account and add some credit to it (10 Euros minimum excluding VAT), then install their Android app, login, the go to Settings and choose "Add Caller ID" then add the number. (Requires SMS verification) *
Skype: You can create an online number (15 Euros minimum) then add ...
11
Same problem happened to me when I was playing with DVWA. The reason is that you're trying to brute-force YOUR_SERVER/dvwa/vulnerabilities/brute/index.php which needs authentication. Try to visit that page in your browser and you'll be prompted to enter a username and a password (different form from the one you're trying to brute-force)
So while you're ...
7
Linked are some videos which can give you a running head start: "Web Application Pen Testing Tutorials" however, firing off a tool or two at an application is not a reliable mechanism to ensure security. Since you stated: "we have developed an ASP.NET Based Enterprise Application", your best best is to work using say Agile or other SDLC based TEST CASES and ...
5
You don't need a self spreading malware in order to test the end user machines. For example, if you decide to target the end user machines browsers, applications (MS Office, PDFs, Java, Flash) or physical security of the machines, what you need is a custom exploit and a payload. The payload need not to be self spreading. You just need a type of payload that ...
1
You can do this using the Proxy tool (tab) of Burp. Just be sure that you added the host (msn.com in this case) to the Scope and check the "Intercept server responses..." check box on the Options tab (under Proxy).
This way all the server responses will be displayed on the Intercept tab where you can place arbitrary content in them.
You can also use the ...
1
It's EVERYWHERE... like a virus.
Adobe uses Apple's Bonjour service also known as mDNSResponder.exe to communicate with the mother ship. More about Bonjour here. Adobe transfers things like licensing, usage, and error data. They also run a service called armsvc.exe which is the Adobe Acrobat Update Service that also calls home to check for updates ...
1
gowenfawr gave a concise answer however, I will go a step further here. Depending on what e-mail client the user has, you could force them to visit a site like it or not. It involves embedding a JPG or GIF, a server, and mod_security.
In the instance described above, you could embed say "logo.jpg" into your signature. IF the user has an email that allows ...
1
The simplest method is to put a user-custom token in each copy of the phishing email. For example, a Groupon mailing in my inbox has the following link - I've inserted a bunch of newlines between the individual fields of the URL-encoded string. You can see that there is a "user" field with a 64-byte hexadecimal string - that's the unique identifier that ...
Only top voted, non community-wiki answers of a minimum length are eligible
