New answers tagged

0

Well TBH I'd be inclined to question exactly what the customer is looking for if asked for that level of detail, it would seem excessive to need to know everything a pen tester did during a review (and surely a customer that paranoid would have excellent IDS in place and could derive it from that ;) ) That said if you do feel the need, as @abe-miessler says ...


2

You need to use the meterpreter handler rather than netcat. The issue is that meterpreter uses multiple stages. The reverse_tcp payload is only used to connect back to the client and load the additional shellcode needed to spawn the meterpreter. When you are using netcat this doesn't work. If you want to have a payload that runs with netcat you need to ...


1

"due to an incomplete QA on the feature, my security test cases gave false negatives" I don't really understand what you are trying to say here. Testing does not change the functionality, security, capacity or performance of the system. However the whole point of testing is to identify where the system does not deliver on any of these aspects (along ...


2

I currently work as a developer, with some responsibility for sprint planning etc. so my answer is based mostly from a 'how should testing be accounted for' approach. I'm going to talk about agile here, but the same principal applies. I can't see anything wrong in principal with testing in parallel to QA, assuming that it's understood that anything which ...


1

It depends what your goals are. If the goal is to find as many vulnerabilities and risks as possible, white box is the best approach. If the goal is "What can an attacker do given X amount of time to my application", then black box is the best approach. We perform both at our clients and the main difference on when they want what generally depends on what ...


0

Non credential IMO, we called it black box testing. It shows the client what could happen if an attacker broke network and was able to 'explore'. This I think is more valuable as how many systems are going to give credentials away without knowledge. It's a way of testing with no 'help' from the inside, as a real attacker would face.


2

It does provide a security risk, though it may not be a huge one. What that shows is actual code, which reveals: The language your backend uses (at least I hope that's your backend code - if you're doing a database query on the client side, you'd be revealing far too much information to them), and possibly some of the libraries that you're using. ...


6

Any information about the internals of a system or application helps an attacker craft a specific attack. For instance, that error message includes table names, which means it becomes far easier to craft a SQLi attack. In addition, with detailed error messages, I could try to trigger different errors to map out the function of the backend, and even find ...


1

What needs to be addressed in one place would not need to be addressed in another. That is why an organization needs to conduct a risk assessment to determine what is relevant for them. One cannot say that any one vulnerability is the most important for everyone.


2

Heartbleed exposes, as the other answer mentioned, arbitrary memory. On an unused NAS, this is most likely not sensitive information. Yet, this seems to be a certificate - maybe also, as polynomial said, (part of) the private key. Executing the exploit several times will probably yield different outputs; putting the pieces together can in fact yield ...


4

Heartbleed results in arbitrary server memory being disclosed. Sometimes this contains sensitive information. In some cases, this is the server's private key, which can be the most sensitive information on the server. In many cases, it can contain information that is intended for a different client. This is probably what you are seeing: certificates, version ...


0

After searching across the internet, it seems there are really no "ready made" vulnerable OpenStack images similar to web applications like OWASP DVWA. However, I think a starting point is to install old OpenStack releases and also install some vulnerable software on it. I have found icehouse easy install here. I will like to start working on this...any one ...


0

Here is a sample of the potential for (and against) automation in network penetration testing: Start with an overall way of organizing your information from multiple tools. Many consider Faraday, but if you don't like it, comment about your experience and I'll provide other recommendations. There is a commercial service, Dradis Pro that many consider to be ...


3

Putting aside that you are using Nessus, let me answer in terms of the use of any web application scanner as a tool. Automated scanners are great tools for a quick, repeatable test that can find the most common issues with websites. I would never develop without running automated tools. But, one always has to understand that these tools come with serious ...



Top 50 recent answers are included