0

I am penetration tester. I am struggling to check for UNC path injections in the web apps because of the environment that I am in. I am conducting a pentest of a web app in my company's local network. I am using a Windows 10 Host machine and a Kali VirtualBox Guest machine for testing. Port forwarding capabilities are available in VirtualBox. As per my understanding, you cannot specify port when test UNC path injections because double backslashes would automatically resolve to SMB and not anywhere else. I have a Kali machine that has a NAT network configuration and does not have an independent IP. It cannot be put into bridged mode because the company policy does not allow assigning IP to a VM. I could turn off SMB service but I do not want to do this much work for this testing this single case. My objective is to somehow forward the traffic that is coming on my windows host machine to my guest Kali VM. P.S: I am local admin on my Windows machine.

4
  • This, then, is looking more like a pure Virtualbox networking question than a security question.
    – schroeder
    Mar 31 at 21:25
  • I would test UNC paths on the Windows box ...
    – schroeder
    Mar 31 at 21:26
  • I am not sure if its a Virtualbox thing, because I have redirecting hosts 9999 to guest's 9999, it works perfectly. I have tried running virtualbox as an admin just in case port 445 requires admin privs, it did not work. I would have worked with windows if any script like responder would work on windows. I have to show an impact in the report.
    – aXXo
    Apr 1 at 12:30
  • "any script like responder" -- which responder? That might be an easier thing to solve. And have you run Linux in the native Windows virtual environment?
    – schroeder
    Apr 1 at 14:19

0

You must log in to answer this question.

Browse other questions tagged .