Tag Info

New answers tagged

0

Let's restructure this question and ask, which is in more demand, and the most cost effective test for a company. Companies base their decisions on risk when it comes to security. It makes less sense for them to focus their money on wireless versus web application penetration testing, because they will encounter more traffic via the web, versus people ...


-1

Web application pen-testing has more money and is will documented and company's are willing to pay top dollar for web application pen-testing, and the thing i like about wireless pen-testing is that it can be done remotely, in return given you the more clients while Wireless pen-testing you have to go to the client physically and do the pen-test. For ...


1

There is a project called OASAM that aims to define a methodology to test Android devices. You can find it here: http://oasam.org/en The guide has the following sections: OASAM-INFO: Information Gathering: Information gathering and attack surface definition. OASAM-CONF: Configuration and Deploy Management: Configuration and deploy assessment. ...


5

A good compromise between user experience and security would be to have IP-based captchas that trigger after a few failed logins from a particular IP, regardless of username. This approach isn't vulnerable to DoS attacks against a single user by bruteforcing his account until the backoff time reaches several hours/days and prevents the legitimate owner of ...


15

A relatively user-friendly way of mitigating brute-force attacks is delaying the minimum time between attempts. The first time your user enters wrong credentials, you let him wait 1 second before he can try again. The second time, you let him wait 2 seconds. The 3rd time, you make him wait 4 seconds. 4th time, 8 seconds, and so on. You also base this on the ...


2

I think you're responsibilities is to verify on on-going basis if your company is adhering to the ISO27001. So basically your third point describes what you will be doing: reviews. Basically you are an auditor, which indeed means you are NOT part of the IT department, but the audit department. This is to ensure independence and objectiveness as no-one of ...


2

You should look into CTF problems. For instance I know picoCTF has a ton of binary exploitation problems, web exploitation challenges, crypto problems, etc. It's a high school competition (which actually ended just yesterday), but anyone can create an account and access the problems. The problems will remain online indefinitely.


0

In my experience the above problem occurs when you are broadcasting the deauth packets with your attacking machine's MAC and not with your router's MAC. So to solve it you should change the attacker WiFi interface's MAC address to the same as your router's MAC. (This is so because you can't change the MAC of mon0 after it has been created.) So do this: ...


2

It's looking at channel -1, try running aircrack with the following option: --ignore-negative-one or --ig as it said in the error you posted: 13:50:47 Waiting for beacon frame (BSSID: ACCESS_POINT_MAC) on channel -1 13:50:47 Couldn't determine current channel for mon0, you should either force the operation with --ignore-negative-one or apply a ...


2

Pipes are "half duplex" connections: data only flows through them in one direction (from the left-hand program to the right-hand program). If you're using pipes to connect your shell to the network, you need two of them: one to handle input, and one to handle output. Network connections, such as are provided by the /dev/tcp pseudo-filesystem in your second ...



Top 50 recent answers are included