Tag Info

Hot answers tagged

128

You can have some serious fun playing with printers, photocopiers and other such devices - even UPSes. Security is usually an afterthought at best, if not totally absent. Stuff I've seen: Default credentials used everywhere, and web-based config panels storing passwords in plaintext, often within a generated config file. I've never seen anything better ...


14

Unless you've got nmap configured not to perform host discovery (-PN or -PN --send-ip on the LAN), if it is indicating that all ports are filtered, then the host is up, but the firewall on that host is dropping traffic to all the scanned ports. Note that a default nmap scan does not probe all ports. It only scans 1000 TCP ports. If you want to check for any ...


14

Testing for ECB / CBC / OFB / CTR mode is fairly straightforward. It's also straightforward to see if the mode has authenticated encryption like EAX / GCM (though it isn't straightforward to see which mode of AE). ECB: have a file with many similar blocks in the plaintext. Do you see identical blocks in the ciphertext? (Yes this is similar to Dan's ...


13

The major issue here is that your printer is accessible from outside your network. I've never seen a situation where printers need to be accessible from outside a network, and I mean ever! I suggest you get that fixed, and urgently! There's more to printers than most people realize, but the risks can be managed by keeping them updated, turning off options ...


13

yes there is, it's called metasploit unleashed. it is an official metasploit wiki with lots of information, it is structured kind of as a tutorial/course and it gets upgraded and updated regularily. it is probably the best place to start.


12

What you are asking to find out is called enumeration. Reading the SQLMap manual under the enumeration topic provides me with the following information: --dbs for databases --tables for tables --columns for columns There is also a lot of other good information in the manual, so I suggest reading over it if you have more questions about flags and ...


12

The vast majority of web applications do not allow query stacking. With PHP/MySQL application can allow for query stacking if you use the mysqli::multi_query()or mysqli_multi_query() functions. You can exploit these systems using sub-select, union-selects, blind sql injection, into outfile, or loadfile(). Sqlmap is a great tool for automating these ...


11

The question is regarding "Security through obscurity"1. Does hiding your design/implementation (e.g. what server you are running) lead to less instances of exploitation? This is a long debated subject with reasonable arguments on both sides of the fence. All security practices are a tradeoff between cost (e.g. effort, maintainability, money) and benefit ...


10

In browser extensions, the impact of a vulnerability highly depend on the context and the requested permissions. Static tools (JSHint, AMO validator) to check code exist, but none of them are 100% reliable, especially for obfuscated code. So, I'm not going to show a magic regular expression which tells you whether some code is vulnerable or not, but give a ...


10

Step one - close all the ports you do not have an explicit business need for! All open ports add potential insecurity - a closed port is a safe port. If you don't know why a port is open, I would be worried - find out what service is running on it. If there is no business need, shut it down! If you can't find out what service it is, shut it down! There ...


10

That seems to be a NetGear log entry, there are two possibilities for this: SYN Port Scan: Someone (very likely automated, by an infected machine) attempting to scan your machine. They send a SYN packet to you, then your machine responds with an ACK packet. In order to prevent a connection from being established, they send you an RST (Reset) packet. (More ...


10

Well, obviously, whatever heuristics the ISP employs are wrong in your case, since you do not have Java at all. We can imagine a few scenarios: The ISP detection is based on tracking downloads from Oracle's site: their system failed to detect any download of an update from your machine, and therefore concluded that your Java "must be old". (It would be a ...


9

There's a couple of ways you could do this, that spring to mind First up would be using search which will show exploits matching the search term, (eg, search fileformat would return modules matching that term. The other was would be to use the tab completion, so if you type: use exploit/windows/fileformat/ and then hit Tab. It'll scroll through all the ...


9

Other than the user's privacy settings, Facebook doesn't inhibit spiders. My scans show they are not even using a Web Application Firewall to block requests. The load to scrub every HTTP request of the most popular website would be massive undertaking. The problem is that your scanner isn't equipped to interact with a mostly JavaScript client communicating ...


9

This is a very complex question, and I'm not sure where you stand technically. I'll lay out some background to help you get to the point. Basic refresher A computer has a couple of important parts: a Central Processing Unit (CPU) and Random Access Memory (RAM). Essentially, a CPU reads a few bytes of memory from RAM, performs the instruction they ...


8

Free doesn't go far, but you can try running the following yourself: The community edition of netsparker: http://www.mavitunasecurity.com/communityedition/ skipfish: http://code.google.com/p/skipfish/ And if you want to dig deeper & you're willing to spend a little time learning how to wield it, you can download and fire up Burp: ...


8

I have a few anecdotes I’d like to share pertaining to the “A network vulnerability scanner in a special way?” question above. Before jumping in though I’d like to note that for most scanning tools speed is the antithesis of accuracy. Speed kills. Port scanning: Tweaking nmap for balls out speed (a la –min-hostgroup, --min-parallelism, and ...


8

Try SET from Social-Engineer.org. Whole site is a great resource.


8

In msf console, you can use the autocomplete feature (as Rory suggests) you can use the search command: search windows/fileformat -t exploit If not restrained to the console, another idea is to browse them online here http://www.metasploit.com/modules/exploit/windows/fileformat/ You can also use things like Armitage to browse exploits in a nicer way or ...


8

To avoid client-side security issues, you need to learn about the security requirements for client-side code and the common mistakes. OWASP has good resources. Make sure you read about DOM-based XSS, as that is one of the most common security mistakes. As far as security best practices, I have several suggestions: To avoid XSS, abide by the rules found ...


8

In the strictest sense the safest thing to do is to, of course, As you've no doubt found this can be difficult in a distributed environment. The specific vulnerability scanning tool you use can also add in some problems. Take Nessus for example. When building a scan profile there is an option called, "Check for PCI-DSS compliance." This makes a bunch of ...


8

There are a multitude of ways that people and applications leak information about software versions. If you can see documents that people post or share, the document format typically explicitly or implicitly identifies the version of software that produced it. People post bug reports and questions on forums asking for help with software. If you can get ...


8

Pay for another cheap VPS and install nmap, w3af, etc and any other tools there. Then you SSH in and run your tests. You could also schedule the tests to happen automatically and email the results. This is not a pre-made service, but it does accomplish what you've asked for with a handful of tiny scripts, done more cheaply and with more control than a paid ...


8

I couldn't agree more with @spinkham's answer. That is the best answer. To add to @ygjb's power tool list, on the web app side, these tools are excellent for extracting data First use the Burp Suite to identify points of opportunity - this tool can be challenging to gain proficiency in if you're new to how web apps work Powertools to help you ...


8

If / is rendered by a cgi script, that script would be called with the User-Agent in an environment variable called HTTP_USER_AGENT. bash would look at all environment variables starting with () { to find function definitions and execute the function definition. In your example the function definition would then be: HTTP_USER_AGENT() { :;} Due to the bug ...


7

SWFScan for any Nemo 440 for AS3, Flex, AIR Flare for AS2 (Flasm for disassmebly). These aren't as useful anymore There is an IDA Pro plugin for Flash disassembly written by some guy from Microsoft Also see osflash.org and flashsec.org


7

Firstly, you have what looks like PHP Shells at img/51.php and img/74.php which may have been the source(s) of your problem. These are generally uploaded by someone who has compromised a site in order to easily execute operating system commands and/or interrogate the database. If that is the case, you may be looking at an issue with an insecure version of ...



Only top voted, non community-wiki answers of a minimum length are eligible