Tag Info

New answers tagged

0

Is the instructor using a virtual environment also? If not, you may need to deviate from the exact steps he's using. Just an initial thought. Your output looks fine though. I have a feeling you need to kill the network processes, that airmon-ng displayed, but I'd try other options first. Stop monitor modes if any, change interface channel, then enter ...


0

So deploying metasploit would be one option as you've mentioned however if you want a more Powershell route could look at using nishang which provides modules like powerpreter to help with pivoting on a network once you've compromised a single host.


3

A very common and highly-modernized attack is running AntiDetect on FraudFox. Criminally-minded adversaries discuss using these tools on leakforums, among other dark corners of the Internet. Obligatory video here -- https://www.youtube.com/watch?v=ZQN7CyCXh90 FraudFox is a guest VM used to hide digital fingerprints. More information here -- ...


3

Usually the main purpose of a VM is to prevent accidental leaks that may compromise someone's anonymity (by preventing the VM from communicating via anything but Tor), however in your case I assume you have consent from the website's owner to do the pentest so even if you do leak some data that may identify you, it's not a big deal. As far as anonymity to ...


0

Indeed, if a nefarious person succeeds to store an XSS within your database through one of your website's inputs that can be the most dangerous aspect of an XSS as far as I know since it can be transformed to something like Samy worm which is just an XSS worm. The best way to evaluate that still remains manually, however as your database entries grow by ...


0

The best/most accurate way to test for things like this is in a white-box security assessment approach, by checking the version of Java installed on the system. So on a redhat system something like rpm -qa would provide the version installed, then check the changelogs for the package which should list what CVE's have been addressed. To automate that, ...


1

Only in the early days of hacking did RATs require the lack of firewall in order for the controller to connect. Take the famous example of SubSeven -- the RAT would install, and join an IRC channel advertising a port and IP address. If the victim was behind a firewall, the machine could not be manipulated -- the hacker would just get a connection timeout. ...


4

The communication between computer goes both ways, so there can be two cases: The RAT is a server: this is the case for many well-known and legit remote access tools, like remote desktop, VNC etc... In this case, you need to allow port forwarding on your router to be able to access the computer. The RAT is a client: the tool will try to connect to a ...


1

Setting the TECHNIQUE option to PSH for Powershell appeared to solve my AV evasion problem. Anti-virus does not detect malicious Powershell code nearly as well (if at all) as executable code. Thanks to @Michael for his answer, although exploit/windows/local/ask appeared to overwrite the manually uploaded payload with whatever was set in FILENAME during my ...


2

The cookies could contain anything, and the vulnerability isn't as much about what they contains, as it's about the fact that they can be accessed. The "Apache HTTP Server httpOnly Cookie Information Disclosure" vulnerability is, in combination with for example a XSS attack, a way to get access to the contents of cookies carrying the httpOnly-flag. An ...


2

Yes, you are responsible for addressing any gaps that you are aware of. It does not matter how you became aware you had a 1.3.8 violation; you're responsible for remediating it. The fact that it doesn't meet the threshold for remediation under 11.3 is not relevant.


0

I'm assuming that You know how RPC works. Metasploit allows enumeration of DCE-RPC services(DCOM objects) using methods listed by you and other than that is hidden. Endpoint mapper provides you the list DCOM objects or services registered with Endpoint Mapper. Why Endpoint Mapper is because of it supports dynamic bindiings to the services. The list of ...


8

Ran into the same issue when reproducing. UPDATE: When using the windows/local/ask exploit, it seems you do not need to set a payload with it. In the windows/local/ask exploit you can set a reference to the undetectabletrojan.exe, which will then be executed with elevated privileges through UAC. However, as pointed out by @SilverlightFox, the ask exploit ...



Top 50 recent answers are included