Tag Info

New answers tagged

3

As a penetration tester, this wording is put forth in the Statement of Work however, as a tester, I don't recommend that you have the tester just stop the test once access is gained. The purpose of a penetration test is to gain access much similar to how an attacker would gain access. By stopping the test, you could never know what else is exploitable. Let's ...


3

You are not really going to get good results, such an approach is really appropriate for a pentest but more for a Red Team/Tiger Team test where flags are set (honestly these are not appropriate if you never had a pentest because you'll get very demotivated and spend a large amount of your budget as it's quite time consuming). For a pentest you preferably ...


3

The "scope" generally does not state something like "You can't root the machines", as a client you want to know if this is possible IMHO. Once root access is acquired it's basically game over anyway. What the scope should say is the amount of servers and its server names / IP's and that it the assessment is restricted to these devices only. This to prevent ...


2

PenTests have a "scope" associated with them that you as the customer define. You define how far you want them to go and what the success criteria are.


5

Why there is need of penetration testing, when I already testing and audited my code. It's the same reason why even code written by highly experienced developers should undergo peer review. You wrote the code so you might not be able to see the issues with it. It's very likely that you are too familiar with your own code to see any problems in it. There ...


2

This is a book on BASIC pentesting of webapps : http://www.amazon.com/Web-Penetration-Testing-Kali-Linux/dp/1782163166 I think it will be enough for basic testing , mostly it explains usage of scanners. If you want proper pentesting you can hire a pentesting company , or maybe Bugcrowd.


2

As a starter owaspis always goodhttps://www.owasp.org/index.php/Main_Page you could also find some tools there. check the cheat sheet series too https://www.owasp.org/index.php/OWASP_Cheat_Sheet_Series


0

Anything that stores your password on an online server outside of your control is to be considered insecure; there is no valid reason for your entire password collection to leave your home network. The software your online password manger service (doesn't only apply to Dashlane) uses is most likely closed source, you know nothing about their security ...


0

If you have an email destination that spawns another email destination, there's a chance that will turn into a feedback loop. At it's most efficient, the smtp might deliver your mail to your local destination before it receives a resend, i.e. you lose disk space. If it doesn't, you lose cpu cycles, and diskspace.


1

If a user can get your email server to spam emails, it could increase the likelihood that all emails from you are automatically marked as spam. In the worst case, you could end up on email blacklists and emails you send could be completely ignored. This is assuming you are running all parts of this on your own servers. If not, you might want to clarify.


1

I think the greatest threat could be Denial of service, you could send so many e-mails you could saturate your SMTP server, your mail server and your user´s personal inbox.


0

Downloading and executing software by just visiting a site with no user-interaction is usually called a drive-by download. Common exploits are through the notorious buggy Java or Flash plugins or through browser bugs like MS14-064. There don't even need to be the malware installed on the computer, instead a RAT (Remote Access Toolkit) can be fully run from ...


0

There isn't going to be a 'database' for this because it is possible to modify the default search parameters or create one's own. At best, a search engine query will likely turn up other people looking to understand the same log entries. On the other hand, if you want to know what free Web App Scanners find by default, you could always simply run those ...


0

In all of your examples, those URIs can (or, well, should) generally be reached by every penetration testing tool. Most tools such as web application security scanners (and often even web application security proxies) implement a crawler (sometimes called a spider). Crawlers perform link extraction. Link extraction can be benchmarked using a tool such as ...


0

May also want to have a look on comprehensive list of Pentesting or Hackers OS provides penetration testers, Security researchers a comprehensive collection of security related tools includes many well known security tools. You can check a detail list here to choose from:- http://securityurls.com/resources/hackers-os/


2

Has anyone experienced this kind of test? or heard of an exploit that allows this? This is totally possible. A clever attacker can set up a site so that if you click on it even once, within seconds he can take over your computer. Even worse, you might not have to go to his site. If you click a link that leads to his site, he could feasibly "own" your ...


2

A browser that is functioning correctly would not allow for this to happen. But vulnerabilities have existed that make visiting the page to be the only interaction needed to launch malicious software. I believe CVE-2014-1776 is a recent example of such. Here is a more detailed analysis. The summary at the beginning of the article gives an overview: ...


0

There are a few resources I'd like to point you towards in order to fully comprehend the tradtional and non-traditional approaches to penetration testing resourcing. Two books, one: "CISO's Guide to Penetration Testing: A Framework to Plan, Manage, and Maximize Benefits", and the other, "Effective Penetration Testing" by Kevin Pescatello and Matthew Larsen. ...


0

The most-effective use of a security professional who has penetration-testing skills is to host cyber exercises. Some are referring to this as purple teaming or adversary simulation. Each approach will be unique to an organization or set of organizations -- and have their own advantages and disadvantages. Rafael Mudge recently spoke at the SANS Pen Test ...


0

Have you tried netcat for windows? You will still need to change the parameters, but at least you have a smaller syntax. It also allows you to RDP if port 3389 is locally open (therefore making your work easier) and to execute port scans. Combining with psexec might give you better options to further your control.


0

Regardless of the platform, a basic mobile penetration test should cover the OWASP Top 10 for mobile.


0

Echo Mirage (and the older EvilServer from the Microsoft Press book, "Hunting Security Bugs") are a tad outdated. You may consider Canape from Contexis instead, or if you want something really simple -- try EvilFOCA. Additionally, I often use a DNS blackholing concept to create proxying scenarios. A newish tool, FakeDNS, can supply some power to this ...


1

You can replay or forward an NTLMv2 response but the attacks may require scenario planning and/or tool changes. There may be advanced ways of cracking the hashes that you haven't yet thought about as well. For further information on replaying, check out -- http://www.room362.com/blog/2014/05/21/effective-ntlm-slash-smb-relaying/ ...


5

The first thing to note here is that banner grabbing is an error prone way to check for vulnerabilities in a lot of cases (as OS vendors backport security fixes without updating version numbers). Nessus as an example will try and work around that, but it's not foolproof. The best way to address checking your security with scanners is to get them to do ...


2

This sounds very much like security by obscurity to me. You are trying to hide the vulnerability from automated scanners. While such a measure might throw off simple scans, it does not actually address the actual problem. You would still have to keep up to date with patches to secure your server. As you have mentioned, it might create a false sense of ...


1

"Testing" only won't do it. Risk Assessment Frequency: Bi-annually Document information assets (systems, networks, infrastructure components, etc.) Identify threats to those assets (vulnerabilities, attack vectors, etc.) Examine and review how security controls and measures that are in place mitigate or eliminate the risk of those attacks (access ...


1

There are a number of scanners out there which aren't free. Like Nexpose or Nessus which can do way more than just scanning a webserver. But they provide this functionality as well of course. The interesting part is that these scanners can also log into your server and perform configuration reviews to a certain standard. For instance the DISA STIG is a very ...


-1

Acunetix Web Vulnerability Scanner would be what I would have used pending the chance comes up again. Alternatively you can look into zanti 2.0 for android based scanning. I've personally used both with a greate degree of success. With Zanti just ensure you set intrusive mode to off. I do not want to violate rules and link to another site but a quick search ...


2

There is a project called OASAM that aims to define a methodology to test Android devices. You can find it here: http://oasam.org/en The guide has the following sections: OASAM-INFO: Information Gathering: Information gathering and attack surface definition. OASAM-CONF: Configuration and Deploy Management: Configuration and deploy assessment. ...



Top 50 recent answers are included