Hot answers tagged

119

There's no way to be 100% sure if you don't have access to the server, so it's about guessing. Here are some clues: File extensions: login.php is most likely a PHP script. HTTP headers: they may leak some information about the language which is running on the server, and some additional details like the version: X-Powered-By: PHP/7.0.0 means that the page ...


35

Updated: For HTTP you can use Burp Suite's proxy (Java), or mitmproxy. tcpcatcher is a more general Java-based GUI capture and modify proxy which might be closer to your requirements, it includes content decoding and modification (manual and programmatic). It's HTTP biased, but accepts any TCP. It has SSL support, though the only drawback seems to be ...


30

Your first question is really a legal one, and you seem to be assuming two things: The attacker is a government of some sort. That government actually respects citizen privacy and requires some sort of reasonable suspicion before it can force people to give up encryption keys. Neither of those assumptions are necessarily true. For all you know, some ...


29

there's a large number of apps that can be used in web application assessments. One thing to consider is what kind of tool you're looking for. Some of them are better used alongside a manual test, where others are more designed for non-security specialist IT staff as more "black box" scanning tools. On top of that there's a huge range of scripts and point ...


24

The easiest way would be using several databases. Tools like KeePass allow you to store passwords in different files. You could for instance opt to store your passwords in seperate databases based on client or purpose.


22

The Metasploit Framework is my go-to tool for pentest automation still to this day, however, I do like what I've seen of CORE INSIGHT and Immunity Security SWARM. There are a few tools such as Loki (or the older Yersinia tool), intrace, Chiron, mana-toolkit, mitmf, bettercap, and Responder.py that must be run outside of the Metasploit framework, but so many ...


18

I have a few anecdotes I’d like to share pertaining to the “A network vulnerability scanner in a special way?” question above. Before jumping in though I’d like to note that for most scanning tools speed is the antithesis of accuracy. Speed kills. Port scanning: Tweaking nmap for balls out speed (a la –min-hostgroup, --min-parallelism, and ...


18

You're wrong in your assumptions. There are many legal jurisdictions where you can be required to produce passwords for encrypted data on suspicion, rather than proof, that the data may be relevant to a criminal investigation. If you don't provide your password, you can be jailed. But if there's no encrypted volume visible, they don't know to do it. For ...


16

Often we use field visits for information gathering and/or equipment seizing. So a lot of the papers and cheatsheats will be left back in the lab. We also have an old laptop set up that is kept on the shelf, but used entirely for field work. It is, however, not normally kept in the jump bag. My bag specifically contains: Several Network Cables ...


16

I personally am partial to Fiddler, a free download from MS. There are many other decent interactive http proxies, but that one serves me the best.


16

Because encrypted files are not compressible, the most useful place to put encryption is in a compression program; that way you can compress the content and then encrypt it. Modern tools generally use well-vetted algorithms such as AES. Avoid classic ZIP encryption because it uses a bad algorithm. 7-zip is a great tool because it's FOSS, cross-platform, and ...


15

My preferred tool bag to do a black box web app pen. test is currently: BURP Suite "is an intercepting proxy server for security testing of web applications. It operates as a man-in-the-middle between your browser and the target application" Fiddler another proxy tool "fiddler allows you to inspect all HTTP(S) traffic, set breakpoints, and "fiddle" with ...


15

There are a lot of free tools out there. You may not find a free tool with the exact same functionality as Burp, but you could use several tools to compensate for the limitations of Burp's free version. use Owasp ZAP or Webscarab for their proxy functionality. use Nikto and W3AF to scan web applications. use SQLMap to exploit SQL injections ...


14

Here are the things on my list, that I use for my clients (including some of those that you've mentioned): Coverage (according to what the org requires today, and expects to use in the future) Language Architecture (e.g. some tools are great for web apps, but not so much for rich clients or even Windows Services / daemons) Framework (e.g. support for ...


14

For Windows, you can use PowerShell, which is installed by default on Windows 7 / Server 2008 R2 and onwards. The Get-FileHash function was introduced in PowerShell v4, which comes with Windows 8.1 and Windows Server 2012 R2. For older PowerShell versions, these scripts from James Manning's blog will do the trick. Example of Get-FileHash usage: ...


13

You should use * in your URI, creating URI injection point(s). So instead of using: sqlmap.py -u "website.com/script/paramrewrited1/paramrewrited2" use: sqlmap.py -u "website.com/script/paramrewrited1*/paramrewrited2*" See sqlmap wiki for more usage options. From that page: URI injection point There are special cases when injection point is ...


13

yes there is, it's called metasploit unleashed. it is an official metasploit wiki with lots of information, it is structured kind of as a tutorial/course and it gets upgraded and updated regularily. it is probably the best place to start.


13

See SSD (Flash Memory) security when data is encrypted in place and watch the discussion links on hard drives. On older drives, it was likely possible to recover overwritten data. The density of modern drives for the past 5+ (and the plus may be 10, 15, or more) years has been so high that a single pass of random data means whatever was there before is just ...


13

For your exact use case, I personally use Lastpass. The killer features of Lastpass include the ability to compartmentalize and separate each client's passwords from each other and from my own. They also have in my opinion the best browser addon integration and the data can be stored and used offline as well. I like to increase the password PBKDF2 ...


12

I think that both projects will have their strong and weak points. At the moment I'd say that Nessus appears to have a wider range of plugins available and arguably a better user interface than the standard OpenVAS client/server implementation. In addition Nessus seems to have widened their original focus in unauthenticated vulnerability scanning to ...


12

Another one which causes more issues than you might expect is providing the backups with sufficient security. I have seen numerous instances where there was no protection of backups aside from being stored in a warehouse. This includes storing unencrypted customer account and password data! It makes it very easy for attackers - okay, they need to go back ...


12

sudo cp /usr/bin/curl /usr/bin/curl.bin sudo vim /usr/bin/curl.wrapper here is the wrapper: #!/bin/sh date >> /var/tmp/curl_ppid.log ps -f -p $PPID >> /var/tmp/curl_ppid.log exec curl.bin "$@" and then: sudo chmod 755 /usr/bin/curl.wrapper sudo touch /var/tmp/curl_ppid.log sudo chmod a+w /var/tmp/curl_ppid.log sudo ln -sf ...


12

Process Explorer, part of the SysInternals suite, is indeed a Windows only tool. It is largely intended to replace the standard Windows task manager. As such it gives very detailed information about the running processes, and all the various and sundry statistics that one should expect. One line I heard used to describe it was, "Finally, an actual top for ...


12

For guessing the programming language, you can follow the three steps approach detailed below: STEP 1 - Search evidences on the site itself Manually... Search on a site page at the bottom for phrases like: -> "Powered by XXX" -> "Proudly Powered by XXX" -> "Running on XXX" -> ... Search on the site if it will attend any conference where they ...


11

As mentioned above, there are a number of HTTP proxies that allow intercepting and modifying requests and responses. Here is a list of the ones I know about: WebScarab (disclaimer: I wrote it) Paros Burp ZAP (Z Attack Proxy - an updated version of Paros) Fiddler/Fiddler2 Achilles HTTPush Exodus (disclaimer: I wrote it, and it is really old) If you wish ...


11

http://www.cryptool.org/ - free, and have all that you need for educational purposes. I use it in different cryptography trainings. From their site: " Numerous classic and modern cryptographic algorithms (encryption and decryption, key generation, secure passwords, authentication, secure protocols, etc.) Visualization of several algorithms (Caesar, Enigma, ...


11

BackTrack USB Live is probably your best bet. BackTrack includes many well known security tools including: Update Kali linux has replaced backtrack now. It's from the same people so the tools described should still be there. Metasploit integration RFMON Injection capable wireless drivers Kismet Nmap Ophcrack Ettercap Wireshark (formerly known as ...



Only top voted, non community-wiki answers of a minimum length are eligible