New answers tagged

2

When referring to black, grey and white hat the following is the definition: White - A hacker who is hacking for profit with permission in order to test a system (This is called a penetration tester). Grey - A hacker who works as a penetration tester but also as a illegal hacker. Black - A hacker hacking illegally for any reason which can include all ...


0

That is Intentional behavior in their Web Application, The reason is PyPI is the official Third party Software Repository of the Python. It is just like catalog of all Open source Python Packages. The .htaccess Options -Indexes is not the problem here, as these are Open Source Packages and it's public faced so, anyone can go the Site and Download manually, ...


0

You could be sneaky and serve different content to "approved" and "unapproved" clients. See http://serverfault.com/questions/336586/apache-client-ip-based-documentroot Unapproved ip's could be served a honeytrap, or just a mockup "How is this for our new frontpage?" with lorem ipsum and placeholde.it images. Armoured doors and big padlocks might scare ...


1

What would be the proper term for such a vulnerability? "Array injection"? In what vulnerability category does this belong (for example in the OWASP Top > 10 or CWE list)? This is called "parameter tampering" and has been called as such by PHP developers, OWASP, and falls under different CWE numbers with the parent being CWE-371, e.g. when the ...


0

I was just wondering if there was anything barring me from testing my own network for security vulnerabilities? Yes. Some ISPs may have terms that prohibit certain activities which appear to be attacks. To thwart this issue, you could use your own equipment to attack. So, instead of having your firewall be plugged into your "modem" (e.g., cable modem, ...


1

It's perfectly legal to attack a machine or network as long as you have the explicit permission of the owner. Since it's your network, you can do whatever you would like.* There are other laws you may still bump into. For example, you can't change your WiFi access points to transmit on an unlicensed frequency. If you install a virus "for testing purposes"...


2

There is nothing hindering you from testing within your own network. To get a rudimentary understanding of what is involved with testing, I suggest you familiarize yourself with the Penetration Testing Execution Standard, OSSTMM, and other similar pentesting frameworks. Once you begin establishing the who, what, when, where and why, it will make things ...


2

Being able to use arrays in $_GET in this way is in itself not a security vulnerability. The DoS vector seems negligible to me, although this may indeed be amplified by the code using it. However, the examples you provided missed the most important part of this feature (from an attackers point of view): it is not only possible to pass regular arrays in GET ...


0

What type of payload are you using, powershell, Python, etc? and what type of connection is being made, reverse shell or bind shell? Often times I run into errors when I use a reverse shell payload from an NAT virtual machine. For what you are describing the powershell payload sounds best: Set payload Windows/meterpreter/bind_tcp If the correct ports are ...


2

Barcodes can be to exploited because of fact that most barcodes contain not only numeric and alphanumeric characters, but also full ASCII characters (special ones included) depending on the protocol being used. Barcode scanners are essentially keyboard emulators and if they support protocols such as Code128 (which supports ASCII control characters), an ...


8

After going through the code, I'm not sure that it is supposed to exploit or attack anything. It looks like its only purpose is to encode a payload using barcodes. It would be a nice way to import code into a system using a barcode reader when all other routes may be blocked. After you locate a vulnerability in a system, you can "upload" a payload using one ...


7

This is remarkably similar to attacks like SQLi, and the remediation is the same. Wherever you allow a barcode to be scanned as input, validate it in the scanner and only allow input that matches the requirements. If you expect a field of 20 digits, only allow 20 digits and strip off anything after 20. If you expect 8 alphanumerics, limit it to that. ...


5

I think the term HTTP parameter pollution would be the best fit. This type of pollution usually submits the same parameter multiple times with different values in the same request. This results in the parameter being treated as an array of values with the parameter name as the array name as described in this article. The way the web server and programming ...


1

Pinging during pentesting is only helpful for a quick determination of what is immediately reachable. Nothing more, and nothing less. It should not be used for complete discovery of what is, or isn't on a network since some hosts (even on an internal scan (ping sweep)) may not return an ICMP response. During pentesting, I rely on networking knowledge, e.g. ...


1

You should do both scns with and without a whitelisting, so Firewall+IPS/IDS will show it's part in a security game. For example if without whitelist it's perfectly OK, but if when whitelisted you have a big log of security holes found ^ it is a problem, regardless of the Fw+IPS/IDS - some day a new exploit will be not listed yet in a IDS/IPS signature list -...


2

Nobody can access the database or monitoring server directly ... as of now. My opinion is that one must assume a worst case scenario, where all the obscuring/protection layers are gone (whether this is because of a hack or a mistake) and the bare application together with its stack is available. On top of that you may run into issues when scanning ...


12

Strictly speaking? No, by itself it isn't a vulnerability. But it does suggest there's potentially a problem that needs further investigation. This is one of the inherent problems with pen testing. You find something ambiguous like this, and don't know if it's exploitable. To even start to find out if this is a vulnerability, you need to understand what ...


24

Why does this happen? It's because PHP has loose typing. Take a look at this example: $x = "1e6"; echo strlen($x); // 3 echo $x * 1; // 1 000 000 On the second line, $x is assumed to be a string, and as such is obviously three characters long. On the third line, $x is interpreted as an integer, or 1 000 000 in this case. Is it a problem? This can ...


0

There are hundreds of web-apps based vulnerabilities and can be categorized into these: Input Validation (XSS, SQL Injection) Authentication (weak password, user enumeration) Authorization (privilege escalation, insecure direction object reference) Session Management (session fixation, absent logout button) Disclosure of Information (Detailed error ...


1

This is highly opinionated and controversial, but I wanted to provide food-for-thought for you to make your own decision. There's OWASP, CWE, and WASC. I don't like any of them. Why shouldn't I use any of these categorization methods? OWASP Top 10 attempts to provide a most common list at a high-level view of what has happened in the last two years. But ...


0

Although the projects on OWASP wargames list are fairly well-vetted and reliable, you're not wrong to be cautious. Using protection like Sandboxie (for Windows), or firejail, BitBox, Cuckoo when running something of unknown provenance is a good idea.


8

REST Security and API Security are excellent topics of research. This question and the answers provide good starting points to find great tools and techniques to test these interfaces -- API Security Testing Methodologies If I were you, I'd avoid testing a REST interface or an API's security remotely, or via a black-box technique such as dynamic app ...


2

In addition to the things said by Sravan, you should put in some effort to avoid doing anything to the server that's hard to reverse. Even though attackers are unlikely to stick to easily reversible actions, a company does not benefit from a prolonged downtime that stems from a poorly executed audit or test. There are already a number of horror stories out ...


12

In a Penetration test,you can root a server if you are permitted to do. The question cannot have a generic answer. It can only be specific to a each case. The Rules of Engagement specify whether or not you can root a server. A few things are considered for this: Is the server a Production one? If yes, then certainly you should restrain from rooting it. If ...


2

As you are already on Security Stack Exchange page: locate a string Questions on this page and click on it on a newly opened page locate a string Votes and click on it (this will open a page with links to questions sorted from the one that received most votes to the least) click on each one and read carefully the question and answer, think about what you ...


0

There's a chance that the result of exploiting a vulnerability early in the test could change the application. Either crashing it or just breaking certain functionality. Thus making the need to scan for additional vulnerabilities moot. Another reason for thoroughly identifying vulnerabilities is to give the person performing the test a full understanding of ...


0

If you keep looking you may find an easier to exploit vulnerability or one that gives you more privilege. Of course, if you first find an easy to exploit remote code execution vulnerability there's really no need to look for more.


0

That sounds more like a course in how to hack someone else's site than to test yours. Following the suggested logic allows the perpetrator to better plan a quick attack that will let them gain control of the machine before anyone has time to notice the attempts. That provides no benefit for someone who is only testing their own system's security.


0

When in doubt, setup some security. Hackers are always looking for the next big exploit. And there are millions of them in the world working all hours of the night on many, many different systems.


0

It seems like you answered your own question. It would be very prudent of you to take steps to protect yourself from threats. You can never be too careful.


1

Whenever we submit an offer for a penetration test we are facing the same question: How complex is the application? Complexity leads to additional attack surface, which leads to a lot of tests, which might lead to a lot of findings which require a lot of documentation. This effort has to be reflected within the offering. To determine the possible complexity ...


89

You could write some Python code to upload an SSH server binary and then run it, this will give you full SSH access under the privileges of the Apache user. From there you can easily read the Python app's config files and connect to the database using the credentials from there, which will allow you to grab confidential data (no exploits needed here as the ...


1

With out actually seeing it happen and being able to check logs, my best guess is that the web server is single threaded and the nc.exe is tying up that thread. As mentioned in one of the comments the cleanest way around this would be to either launch a Reverse Shell via the Reverse shell and then close it (fast enough that no one notices) or to modify the ...


3

Generally in these types of situations, you want to spawn a child process for the shell, or migrate to another process(only possible in windows). You can check out one way of doing this in the Metasploit module for process migration in windows: https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/manage/migrate.rb A more general ...



Top 50 recent answers are included