Tag Info

New answers tagged

0

Remove all unnecessary information from the URL (e.g. http://, the name of the site, etc.). If you have several options (e.g. five sites), use their index. Calculate a hash of what remains using a server-side secret salt and prepend it (or a part of it - the shorter it is, the greater the danger of a successful collision attack) to returnUrl Upon receiving ...


1

Because there's both civil and criminal risk associated with performing a penetration test, this feels like one of the areas where you should not go cheap, and should in fact obtain legal advice from a lawyer. If you attack systems that are not in scope, you might technically be violating the CFAA or other locally applicable laws, and if you (inadvertently) ...


1

SANS has a pretty nice white paper on the subject here. GIAC also has white paper geared towards managment of pen test which covers some of it here. I would keep in mind that you may need to have both general and specific legal agreements depending on the scope and offerings you provide. Your focus should be on the laws pertaining to doing an engagement, ...


1

I'm not sure there is an answer to this question. Each pentester has his/her way of doing things, and your statement which reduces the entire industry to a printer plugged to Nessus should probably be substantiated a little better.


1

In my conception, what you described can be called vulnerability assessment, which consists of finding out possible points of penetration in the system. It is greatly enhanced by automated tools due to the volume of tests it can process in no time. It should be noticed, though, that vulnerability assessments are not perfect and, usually, require manual ...


2

Any bug tracking software is the standard for this tool. Vulnerabilities you find are simply 'bugs'. Assign severity, track the vendor's response and follow-up, and detail the issues all within the tool. Github, bugzilla, Jira, etc. Choose the tool that matches your needs and workflow.


1

Well, you can always forward ports like this: netsh interface portproxy add v4tov4 listenport=XXXX listenaddress=Y.Y.Y.Y connectport=ZZZZ connectaddress=T.T.T.T Alternately, socat is a very powerful command-line tool which will enable you to forward ports and a lot more. Here is a sample usage: socat -d -d tcp4-listen:XXXX,reuseaddr,fork,tcpwrap=socat ...


1

Yes, you can use a router along the way to redirect traffic from your smart phone to Burp suite on your computer. For example, you can use IPTables REDIRECT target to send it to a local port if you're running an access point on your Burp system to set up a transparent proxy. You can configure a local access point, or connect a router via ethernet and let it ...


1

You need to privately contact the person who manages the software in which you found a vulnerability. Tell them about the vulnerability you found, including how you think it can be exploited and what you think it can do. Give them some time (often in the range of a few months) to verify your claims and provide a solution. Once they have fixed the issue and ...


0

Extreme cold will not discharge the battery, but may drop its voltage enough to make the electronics inoperant. With lithium batteries, cold enough is really really cold, so maybe you'll have to use dry ice (take safety precautions). This is well known so some anti tampering mechanics actually test for temperature and trigger some last ditch safety measure ...


0

Is your application returning HTML when you GET /cart ? If it is then you could try using the ZAP persistent XSS scanner - that should inject XSS attacks via the POST and then check all of the URLs where the payload is displayed. If the GET doesnt return html then it all depends how that data gets used. FYI we have a ZAP Users group which is probably more ...


1

No, not in the general case. You could somehow drill in to the device and disconnect the battery, but if doing so triggers the anti-tampering technology, then you have to think of a different way in. There is no environmental factor which will discharge a battery without a load in any reasonable amount of time. Given a few years, perhaps. But a few hours? ...


1

In order to rapidly discharge a battery the energy has to go somewhere. You would have to either physically contact the coin cell and cause a drain, or somehow cause the electronics to do it for you. Whether the electronics would have the capability to cause that drain is another question. Most devices are designed to conserve the power of their backup ...


0

Did you actually buy your cable modem (and your girlfriend's), or did it come with your Internet package? If the latter, it is not "personally owned equipment". Neither, under any circumstance, are the intermediate infrastructure devices through which you will connect from across the Internet - some of which may not even be controlled by Bright House. Laws ...


0

I am not a lawyer, but most hacking laws actually come down to being trespassing laws. If you are using a computer system, you are only allowed to use it in the way that the owner intended. Since you are the owner of both systems, you are using it the way the owner intended, since you intended it as a demonstration of penetration testing. If this wasn't ...


3

For demonstration purposes, I personally would just create a few virtual machines, and demonstrate what you can do to them locally. As mentioned, placing a vulnerable machine on the internet is just a bad idea. If you can hack into it, so can others... and as my firewall logs indicate, there's always someone poking around...


0

IANAL and all that but from a legal standpoint hacking you own machine should be fine, even if it was illegal, your unlikely to press charges against yourself. The one word of caution though is to watch out for collateral damage, if you have done pen-testing before your probably already aware of this. There are some things you might not think of, for ...


0

Bringing up the lawyer point mentioned by @m3r1n I had in the past been hired to check out a machine for an individual who was concerned about being hacked by her ex., to look for spyware or other misconduct. This was prelude to a lawsuit. He did not as it turned out, but if he had, and she was unaware or otherwise not understanding of what he was doing, he ...


0

Disclaimer: I am not a lawyer, nor do I know anything about being a lawyer. Although I do understand what is required to perform a pentest against a clients systems. As you are attacking your own device, you are likely not breaking any laws. As you have express permissions from your girlfriend (I would hope so), to perform this task it will likely be safe ...


0

Besides the obvious resources: http://www.tssci-security.com/archives/2010/03/18/pentesting-flex/ http://deblaze-tool.appspot.com there are also many important concepts to keep in mind while testing: AMF must be dealt with Flash files may be involved, so decompiling, statically analyzing them, and reviewing their code is paramount -- including ...


0

You can also use a tool like Burpsuite, similar to CharlesProxy but offers plugin support. There's a neat plugin for AMF testing, called Blazer which offers fuzzing capabilities with customizable attack vectors. The code for Blazer can be found on GitHub - Code for Blazer.


0

Specifically using Ettercap, you want to implement filters. You can write your own filters to identify specific types of traffic and replace it with your own data. Here is a SANS reading room paper that goes into a lot of detail about Ettercap, or you can just Google for "ettercap filters" and read up on it more.


0

Connect your Android device and your penetration testing platform to a LAN. Conduct an ARP spoof/poison attack against the Android device using ettercap (or your favorite arp spoofing tool). This will cause all packets to and from the Android device to first pass through your penetration testing platform. ettercap -T -w dump -M ARP /xx.xx.xx.xx/ // output: ...


0

If the CSRF vulnerable application allows itself to be embedded in an Iframe, then yes. How does it help the attacker? Iframes can be made invisible by setting size to zero. So as against the normal csrf where victim might get an idea of something suspicious, in case of invisible iframe, he won't see anything. The attacker will submit the form on victim's ...


2

The right answer is: get a lawyer and make it airtight. When it comes to legal documents it's the same as with crypto: Don't roll your own! Generally these things are 10-pagers offloading the (financial) liability to the client if things go wrong. Currently you just make the CEO accept the risks but you do not offload the liability back to them. Every ...


-2

you should edit the "loss of services" line to "temporary loss of services" alas, in my view the rest of the text is clearly explained and there's no grammatical mistakes. great work!


0

Even rdesktop's changelog indicates that it can support CredSSP + Kerberos authentication (NLA), but if your windows server forces to use NLA, then you still will get error message: Failed to connect, CredSSP required by server..


1

/tmp will be one of the first folders an attacker will try to write files to after finding a security hole in your server configuration or (web) application. A good way to harden your server can be to offload /tmp to a dedicated partition and mount it as non-executeable. Though this only will work if you are not runnign any (bad) software that needs to ...


8

No, you can't. You can't ssh to folders, only to accounts. You might be able to mount the /tmp folder on another machine without a password if the server is running NFS or Samba and has fairly relaxed permissions.



Top 50 recent answers are included