Tag Info

Hot answers tagged

11

The Metasploit Framework is my go-to tool for pentest automation still to this day, however, I do like what I've seen of CORE INSIGHT and Immunity Security SWARM. There are a few tools such as Loki (or the older Yersinia tool), intrace, Chiron, mana-toolkit, mitmf, and Responder.py that must be run outside of the Metasploit framework, but so many things can ...


4

Both cases are serious vulnerabilities, and the security approach is wrong. First of all, the form itself shouldn't escape anything. You might want to check the input, but you do not manipulate it. Escaping is done in a specific context like a database query, not globally. No, it's not secure to simply prepend a backslash to single quotes in the ...


4

The problem is that there are a whole load of ways to get XSS in such a case: <style src="http://ha.ckers.org/xss.css"/> <a onclick=alert(1) style="position:absolute; display:block; z-index: 9999; top:0; left:0; width:10000px; height: 10000px"></a> <div onmouseover='alert(1)'/> <svg src=x onerror='eval("...")' /> Just to name ...


4

The $where operator in MongoDB is a feature which is best avoided. Its performance is abysmal, and not just because it doesn't benefit from indexes. Almost every common use-case can be solved much more efficiently with a common find-query or aggregation, especially one as trivial as this. But this is security stackexchange, not stackoverflow, so let's focus ...


3

Can anyone give me an example like what input may cause the issues For your concrete piece of code this should work: '; while(1);var foo='bar '; is used to escape the string and the statement, then follows the actual attack while(1); (DOS attack), and then the still standing ' is transformed to valid syntax via var foo='bar. Up to version 2.4 of ...


3

ok so on any security assessment you must have a terms of engagement (which should largely spell out what is and is not in-scope of the review). Assuming you're doing what would traditionally be thought of as "red-team" style assessments, then on those generally "any action an attacker might take" is valid for the assessment. However there are many ...


3

There's a number of areas that you can focus on with rails apps, depending on the level of access you have. Some initial ideas If you have source code access (and I would highly recommend it), you can use Brakeman to find some issues. Even if you can't get source code access, you may be able to request the output of the 'rake routes' command which should ...


3

You're so very close to the name of the Firefox/Iceweasel plugin you need with your question title! Tamperdata: https://addons.mozilla.org/en-us/firefox/addon/tamper-data/ You could also use one of the Web proxies shipped with Kali, OWASP-ZAP or Burp Suite. You may want to gloss over the manuals for these, but in general you start them up, aim your ...


3

I am not aware of any problems with the use of proxychains-ng and Nmap, but to be sure that Nmap is not trying to do any raw socket or packet capture operations that are incompatible with proxychains-ng, you should use the --unprivileged option. Additionally, since version 6.40, Nmap has supported proxies natively with the --proxies option, which covers the ...


3

OWASP offers some solid advice on their site: https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet You'll be safer and better off using a well-respected resource than inventing your own solution through trial and error. However, learning how an attacker works through experimentation like you're doing, is one of the best ways of learning ...


2

It sounds off that a service provider will not give you details of the product/service you are purchasing. That is like a contractor not telling you what wood he is using to build a house. I would remind your service provider that "security by obscurity" will not help a remote attacker from figuring our or just launching attacks against all versions of SSH. ...


2

Whichever tools you are used to using on Kali, find OS X versions for them, install and use. For appsec, Some tools like Burp Suite are platform independent as Burp runs on JAVA which i primarily use and the commercial version is reasonably priced too, OWASP ZAP, w3af, BeEf framework, Nikto etc are all available for download too. If u are referring to ...


2

OSCP is the flagship course offered by Offensive Security, and it is considered entry-level by their standards. However, it is definitely not an entry-level course. I suggest you read the dozen or so blogs available from people who have passed the exam to get a good idea of what the course entails. It is geared towards those who are capable of self-learning, ...


2

The short answer here is that you should answer honestly :) (it likely won't end well if you start making stuff up in interviews..) That said there are many reasons why someone might want to be an Pen. tester, some options would be Interested in technology and really want to get to understand the way things work. Interested in understanding security, how ...


1

RCP and RAP applications are typically built using the Eclipse E4 Tool package. There may be test cases unique to the target underlying operating system -- Eclipse runs on OS X, Linux, Windows, and a few other OSes. First, get the Delta Pack -- http://download.eclipse.org/eclipse/downloads/drops4/R-4.4.2-201502041700/#DeltaPack The Delta Pack contains all ...


1

Web browsers evolve constantly. It is possible (although very rare according to my experience) that you manage to create a blacklist that blocks every meaningful XSS attack today, but tomorrow a new browser feature may introduce new possibilities for the attacker. You can check out http://html5sec.org/#html5 to see how many weird just got introduced ...


1

windows is a close source OS so, your work is hard. you need learn basically about windows Architecture and you need learn Assembly with c/c++ language for attack. specially Assembly. also about this sentence : i used book about nmap, Metasploit, exploit writing etc..., but they contained too much information about too many OS's this tools ...


1

It can be done using netcat nc www.myhost.com 80 TRACE /mypage.html HTTP/1.1 Host: www.myhost.com An example of output is HTTP/1.1 405 Method Not Allowed Server: Apache-Coyote/1.1 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1 Set-Cookie: JSESSIONID=rfyji7QBFFld7HwMGLVM+F8s.undefined; Path=/ Content-Type: ...


1

It is true that most major browsers now ignore the autocomplete value if set in the web application. However, IE11 only ignores this setting on password fields, it should still honour the autocomplete setting on CC fields. As Xander suggested, it could be worth checking the input type for your CC payment field.


1

No, you cannot secure data completely if the user has total control of the system and its hardware (and possibly a lot of money; attacking hardware can get quite expensive). If this is just to prevent cheating, hardcoding the encryption key in an obfuscated manner (so that strings doesn't find it) should be enough though (any student breaking that probably ...


1

The first place to look is the server header. Depending on the server configuration it may report all enabled modules. Alternately you can use a specially formulated request which will provide a less reliable detection. The AddHandler directive allows a script to answer with a non 501 response to incorrect HTTP verbs. I'm using this technique in my Apache ...



Only top voted, non community-wiki answers of a minimum length are eligible