New answers tagged

0

The basic idea is simple as you've mentioned, MITM works in ARP spoofing scenario as follows: To perform MITM between A and B: Trick A to think you're B Trick B to think you're A Enable packets forwarding That's it! so regardless of your environment, whether it's a switch or hub or even a proxy server, the principle is same. So, the answer to your ...


1

When you configure a VLAN on a local network it's as if you have differents locals networks between your hosts. So if you sniff the traffic on a particular VLAN you will see only the hosts which are conected on this VLAN and not the others hosts of your network. On the switch which manage VLAN you will have a ARP table per VLAN. Moreover, you can use the ...


1

The methodology you are looking at is not designed for penetration testing. From the same url at that website: The aim of system test is to test all of the following areas. Scheduling software Day-to-day operational procedures Backup recovery strategy Management and scheduling tools Overnight processing Query performance ...and.. There are a number of ...


0

In a recent post, I read that Radware found that attacks that last only an hour or less are on the rise – and more than half of the three biggest attacks fell into that category. The implications of these findings are clear. It’s likely that very soon, even long attack campaigns will be based on short bursts of traffic – bursts which are difficult, if not ...


0

The most common vector for hacking user computers are probably Trojan horse programs, followed by malicious code on web pages. Although social engineering and using vulnerabilities to hack in through user routers are methods of attack, these require more work on the part of an attacker and are probably a lesser threat unless you are someone that the attacker ...


2

Attackers employ a variety of techniques to compromise networks, however I would argue that in many (if not most cases) social engineering is involved. Spear Phishing has an overwhelming success ratio when executed properly and skilled social engineers are always going to be something to be feared. Spear Phishing typically also relies in a weakness in the ...


3

This is an extremely broad question. When you're learning about security and penetration-testing, you're supposed to learn all these techniques. There are loads of techniques each with it's own purpose, situation,... To give a small answer on your question, Social engineering is often used, and so are backdoors. Lastly I had to write a PoC (Proof of concept)...


3

When I engage in penetration testing, my goals go above beyond finding open ports, to finding "information" that could be used to gain access, or negatively impact the company. If you solely focus on ports (services), or CVE information, you will likely miss common indicators, and information that an attacker will not miss. Usually my penetration tests, ...


1

As a developer of Kali, I can attest that this answer is very wrong. Kali is not insecure by default, and has the same security standards as Debian in a default installation. Kali is a Linux distribution aimed at Penetration Testing - as opposed to casual browsing or day-to-day computer activities - which is why some people prefer running it as a virtual ...


6

Shikata Ga Nai is an encoder included in the Metasploit framework for the x86 architecture. From the available source code: This encoder implements a polymorphic XOR additive feedback encoder. The decoder stub is generated based on dynamic instruction substitution and dynamic block ordering. Registers are also selected dynamically. An academic paper ...


6

Shikata Ga Nai isn't a payload, but an encoder. The payload is the reverse shell. Metasploit offers several encoders, Shikata Ga Nai being one of them. An encoder attempts to overcome detection by AV, network intrusion detection, and keep characters that can cause a crash of the victim out of the payload, like null bytes.


3

DANE allows you (as a domain owner) to specify the possible CA's that are allowed to generate a certificate for your domain. This prevents rogue Ca's to issue a certificate (it will be invalidated by a client that uses DANE to validate the certificate). From Wikipedia: DANE enables the administrator of a domain name to certify the keys used in that ...


1

In addition to the book references left in my comment, I think you can set the following as your high-level steps. OSINT (includes recon on the company, DNS records recon, etc) IP Scans Banner checking for vulnerabilities Web application scans & testing (Burp, Nikto, etc) Social engineering of employees Privilege escalation (if required because ...


2

1) "Are there any other internals which I've missed and worth noting." I'm not sure if I've understood you correctly, especially at the "worth nothing" part but there is a big change on the sandboxing mechanism. According to a review at The Register, Microsoft removes a part of the sandboxing for the applications which have been downloaded from the ...


3

No, this adds no real security value. Depending on the approach of your attacker, the first thing he might do is fingerprint the server and libs and do a crawl of the whole site himself (that's what I would do if the point is to find a vulnerability in the code). Crawling a site like this is extremely trivial (and easily automated), so the gain is ...


3

If the server is publicly accessible then you don't need to worry about VPN connection info. Security assessments are often performed on sites before they are exposed to the internet and the site is only accessible on a private network so they will ask for you to provide these details if that is the case. The DNS name that the application will have will ...


0

This is not how business works. A customer shouldn't assess your security, you must give them the confidence that your site is secure. For example, paying some security firm to perform a vulnerability assessment of your site. After that assessment, if your site is really secure, you will have a report you can show to your customers showing that your site is ...


12

In typical pentesting, Kali is just another tool, it's insecure by default, and is never recommended to be run as your primary OS without some serious baseline hardening. It's typically launched (as a virtual machine) when needed and "paused" or "stopped" when not. This helps keep your host (and files) protected. Additionally, Kali is known to have bugs ...


2

Your browser will add the HTTP Referer header (which, in a sense, indicates the "originating" URL) to most resource requests originating from a web page (exceptions include loading HTTP content from an HTTPS website, and refreshes). Thus, the simplest way to automate testing is to crawl/spider/monkey your web application and log all requests to other ...


2

Unfortunately in UK, most companies want you to have the local ones, CREST and CHECK, and of course SANS. OSCP doesn't sell as much as them and ISC or EC-Council. My advice for you would be to first start with CEH, then GPEN and with a more experience, you can go for OSCP. To be honest, OSCP is not an entry-level into the world of PT, I would first suggest ...


2

Have you been reading the news. Remote accesses are totally possibly especially as the IoT paradigm comes to surface. As for who to blame for accidents caused by "smart cars", there are already feathers being ruffled. Lawmakers are grappling over this new reality as to who is to be held accountable in case of an accident where there is no human driver ...


6

I was wondering, what would happen if a Tesla car was hacked into? Nothing good I can promise you that. Are future cars designed to be able to be stopped by police via remote access and commands? Not that we know of. What if someone actually causes an accident using this method? Who will be to blame? How can one prove the accident wouldn't be ...


4

You cannot force an arbitrary email server to send an email to you. But it might be possible in specific setups. The easiest case is if the servers allows relaying because then you can simply address the mail to you. If you have login credentials you might try to authorize against the server and send a mail to you, because most servers allow authorized ...


0

If you're just looking for header info you can try the SMTP server test on wormly.com. It tries to use the target mail server as a relay for a message. It will probably fail if relaying is disabled, but there may be some information disclosure that may help. Additional sources and methods for gathering information regarding email servers are: Passive ...


5

As a developer of 15 years who has moved into a pen-test role, I can say that yes there are many transferable skills, some of which will put you at and advantage to testers who came from a pure security background. Firstly and foremostly you understand the developer mindset, this means that you probably understand why a developer chose a particular ...


0

Deauthenticate the wifi clients with aireplay-ng (from aircrack-ng suite) or wifite. Make sure your rx quality is as good as possible. Use two adapters, and sniff with one using airodump-ng (fix the ivs_only var in airodump-ng.c and recompile) --output-format=csv,pcap or kismet. Inject with the other one. Depending on the type, you may need airmon-ng to set ...


2

I'm a developer and I do network security as side business. I have a long time since I started developing so after learning the basics about security I wanted to learn more. After several years now, I keep learning about network security. Ideally, developers need to know as much as possible about security, but they don't really need to enter in too much ...


2

You can be anywhere you like. Once you have the handshake you can crack the password anywhere you like. The handshake is as if you have a "hashed" password and you want to crack it. One method of doing this is using aircrack-ng which tries to crack the handshake using a dictionary attack (This is a passive attack on your captured packets). You can view the ...


5

When referring to black, grey and white hat the following is the definition: White - A hacker who is hacking for profit with permission in order to test a system (This is called a penetration tester). Grey - A hacker who works as a penetration tester but also as a illegal hacker. Black - A hacker hacking illegally for any reason which can include all ...


0

That is Intentional behavior in their Web Application, The reason is PyPI is the official Third party Software Repository of the Python. It is just like catalog of all Open source Python Packages. The .htaccess Options -Indexes is not the problem here, as these are Open Source Packages and it's public faced so, anyone can go the Site and Download manually, ...


0

You could be sneaky and serve different content to "approved" and "unapproved" clients. See http://serverfault.com/questions/336586/apache-client-ip-based-documentroot Unapproved ip's could be served a honeytrap, or just a mockup "How is this for our new frontpage?" with lorem ipsum and placeholde.it images. Armoured doors and big padlocks might scare ...


1

What would be the proper term for such a vulnerability? "Array injection"? In what vulnerability category does this belong (for example in the OWASP Top > 10 or CWE list)? This is called "parameter tampering" and has been called as such by PHP developers, OWASP, and falls under different CWE numbers with the parent being CWE-371, e.g. when the ...



Top 50 recent answers are included