Tag Info

Hot answers tagged

3

For demonstration purposes, I personally would just create a few virtual machines, and demonstrate what you can do to them locally. As mentioned, placing a vulnerable machine on the internet is just a bad idea. If you can hack into it, so can others... and as my firewall logs indicate, there's always someone poking around...


2

Any bug tracking software is the standard for this tool. Vulnerabilities you find are simply 'bugs'. Assign severity, track the vendor's response and follow-up, and detail the issues all within the tool. Github, bugzilla, Jira, etc. Choose the tool that matches your needs and workflow.


1

You can write penetration testing tools in Java or C#. Armitage is evidence of this. And you can search for vulnerabilities in Java code but not vulnerabilities like buffer overflows or format strings. I don't know the name of these vulnerability types but let's say that if a condition is wrong and with given input it grants you some privileges. Also Java ...


1

Because there's both civil and criminal risk associated with performing a penetration test, this feels like one of the areas where you should not go cheap, and should in fact obtain legal advice from a lawyer. If you attack systems that are not in scope, you might technically be violating the CFAA or other locally applicable laws, and if you (inadvertently) ...


1

SANS has a pretty nice white paper on the subject here. GIAC also has white paper geared towards managment of pen test which covers some of it here. I would keep in mind that you may need to have both general and specific legal agreements depending on the scope and offerings you provide. Your focus should be on the laws pertaining to doing an engagement, ...


1

I'm not sure there is an answer to this question. Each pentester has his/her way of doing things, and your statement which reduces the entire industry to a printer plugged to Nessus should probably be substantiated a little better.


1

In my conception, what you described can be called vulnerability assessment, which consists of finding out possible points of penetration in the system. It is greatly enhanced by automated tools due to the volume of tests it can process in no time. It should be noticed, though, that vulnerability assessments are not perfect and, usually, require manual ...


1

Well, you can always forward ports like this: netsh interface portproxy add v4tov4 listenport=XXXX listenaddress=Y.Y.Y.Y connectport=ZZZZ connectaddress=T.T.T.T Alternately, socat is a very powerful command-line tool which will enable you to forward ports and a lot more. Here is a sample usage: socat -d -d tcp4-listen:XXXX,reuseaddr,fork,tcpwrap=socat ...


1

Yes, you can use a router along the way to redirect traffic from your smart phone to Burp suite on your computer. For example, you can use IPTables REDIRECT target to send it to a local port if you're running an access point on your Burp system to set up a transparent proxy. You can configure a local access point, or connect a router via ethernet and let it ...


1

You need to privately contact the person who manages the software in which you found a vulnerability. Tell them about the vulnerability you found, including how you think it can be exploited and what you think it can do. Give them some time (often in the range of a few months) to verify your claims and provide a solution. Once they have fixed the issue and ...


1

No, not in the general case. You could somehow drill in to the device and disconnect the battery, but if doing so triggers the anti-tampering technology, then you have to think of a different way in. There is no environmental factor which will discharge a battery without a load in any reasonable amount of time. Given a few years, perhaps. But a few hours? ...


1

In order to rapidly discharge a battery the energy has to go somewhere. You would have to either physically contact the coin cell and cause a drain, or somehow cause the electronics to do it for you. Whether the electronics would have the capability to cause that drain is another question. Most devices are designed to conserve the power of their backup ...



Only top voted, non community-wiki answers of a minimum length are eligible