Questions tagged [information-gathering]
The early stage of an attack during which the attacker tries to collect information about the target.
86
questions
0
votes
0
answers
53
views
Advice on more in depth web app info gathering phase
I am a junior pentester currently working for a secure messaging app that includes a webclient. Only the subdomain is in scope and other subdomains are off-limits. Social engineering is also off ...
- 1
1
vote
0
answers
46
views
How do hackers find the ip address of router or networks they want to hack? [duplicate]
I've heard news of hackers in different countries being able to infiltrate networks in other countries. What I'm wondering is how these hackers find the ip addresses (without the use of phishing) of ...
- 13
16
votes
5
answers
7k
views
Is having the name of web server software in HTTP response header a serious problem?
How serious a security problem is it to have the name of the web server in the HTTP header (Apache, Nginx etc.)?
I am discussing this with a system administrator and he told me that deleting version ...
- 162
0
votes
1
answer
81
views
I gave my first name and alt email to someone I don't know, will that reveal who I am?
So, I wanted to get this game (to try it as it had no demo), so I went to a website, did not click on anything except the link to the Google drive folder, and then stupidly requested access to a ...
user281008
0
votes
1
answer
78
views
How do you protect your online identity from background checks?
This site is the only piece of online presence I have in my own name. I also have two gmail addresses in my own name.
If a background check is to be made on my online activities, would there be a way ...
- 111
0
votes
1
answer
64
views
Determining threat when performing OSINT
I am new to ethical hacking and I often find myself really confused when evaluating and determining the danger level of information that can be found regarding a domain when performing OSINT. I'm not ...
- 197
0
votes
1
answer
86
views
Does the device attributes section of Facebook's data policy entitle it to private files on my device?
I was reading through Facebook's data policy which also encompasses instagram, messenger, etc. It looked like the usual all encompassing breach of privacy I have come to expect from the company but ...
1
vote
1
answer
665
views
How do I find the IP address of a specific device on the local network? [closed]
I would like to learn how to find the private IP address of anyone connected to a network.
This specific network has a firewall. The only info I have on it is that it blocks ICMP requests (I'm pretty ...
- 151
0
votes
1
answer
87
views
How do mobile apps share details with each other to show customized ads
My question is more towards how this is implemented. I mean do they expose apis to each other or store data at a common place to be accessed by others. Please excuse me if it seems too naive.
- 1,325
1
vote
2
answers
478
views
How do attackers determine ROP gadgets remotely?
Being gadgets change per each system and architecture (do they?), how would an attacker be able to determine the offsets of various Return Oriented Programming gadgets, would an attacker first need to ...
- 11
0
votes
1
answer
170
views
Impact of the System Information Leak
Our application stored **e.printstacktrace()** in a log file, which is accessible to a specific user group. We need such detailed information for debugging purposes.
As per the security team, they are ...
- 449
0
votes
1
answer
1k
views
Can my ISP know these things?
I am a novice about digital things (imagine the antonym for "tech savvy").
Can my ISP know my yahoo email address? I have signed in on yahoo more than a million times. Yahoo is https.
Can ...
- 339
3
votes
4
answers
16k
views
If nmap shows all ports are filtered or closed, what would be the next logical step to take to get more information?
If nmap shows all ports are filtered or closed, what would be the next logical step to take?
Does that mean I would need to get physical access to the device? or is there any other ways to get ...
- 39
0
votes
0
answers
196
views
How does the Amass intel module correlate information?
Can someone explain to me how OWASP Amass correlates information regarding the intel module domain search?
As an example, if I run the command:
amass intel -d example.com -whois
I'll get a list of ...
13
votes
2
answers
4k
views
How do hackers search for vulnerabilities on certain ports? [closed]
Hackers usually attack open ports and services, but I want to know how they find security holes in specific ports or services.
- 163
15
votes
2
answers
6k
views
What is the impact of leaked recaptcha secret key?
Due to server configurations, our recaptcha secret key was publicly readable.
The key has been updated to a new one, but what is the actual impact of a malicious user getting a hold of the key?
...
- 273
2
votes
0
answers
109
views
How SIGINT Researchers/Operators collect, decode and monitor a vast array of wireless data? [closed]
In wireless communication, data flows at various frequencies ranging from Radio to Satellite communication. These frequency carriers are allocated for different uses based on various requirement ...
- 21
3
votes
3
answers
287
views
Determine what a company is googling
Let's say that a fictional company, AwSemCo, discovers that a published vulnerability "CVE0day" affects their systems and they immediately start investigating it. They go to the web looking for a ...
- 133
1
vote
0
answers
55
views
How to get user information from an IP address? [duplicate]
A spammer is harassing my friend and she doesn't know who. With some struggle, I found out the spammer's IP address. But I don't know how to proceed after this.
She says she doesn't want to move ...
- 11
25
votes
3
answers
11k
views
Computer name naming convention for security
I've been doing a security audit and found out you can easily identify host roles and running services just by their computer name (using nslookup).
I would like to report this so that they use less ...
- 2,904
0
votes
1
answer
300
views
How Dirbuster find the files within a directory? (Differentiating between files and directories) [closed]
I am writing the python code of DIRBUSTER tool in kali linux but I got stuck at finding files that lies within directories. So my question is how can I differentiate between Files and Directories ...
0
votes
3
answers
182
views
Information gathering on website [closed]
I'm pretty new to pentesting and everything about it. This question is primarily for web servers. I'd like to know for you pentesters out there, what information are you looking for when you are ...
- 519
3
votes
1
answer
1k
views
A third party Web site wants me to validate my domain ownership using a TXT record
What are the security risks with adding TXT records for third party tools? Can they get any information back from your servers with adding that record for them?
The example below is from the "have i ...
- 325
-5
votes
1
answer
124
views
How to access a system without sending malicious program to victim sytem [closed]
Is their is any way to access a system without sending any malicious program...
Suppose I have my pc with an internet connection and with the victim ip so can I access the victim system if tcp ports ...
2
votes
2
answers
179
views
Is using a network sniffer for host discovery a viable option?
Would a packet sniffer like tcpdump be effective for network host discovery and if so how effective is it compared to more active methods such as the infamous network mapper nmap?
- 23
0
votes
1
answer
160
views
Does it exist any gadget that catches and copies all the digital information?
When I was watching Prison Break there was a device that was catching all the digital data and copying it. Do similar info-gathering devices really exist?
The device must be within several feet of ...
- 127
1
vote
2
answers
159
views
3rd Party trackers and online privacy
I don't feel the internet is respecting our individual right to privacy. Why are 3rd party trackers allowed to siphon data from us without our permission? We should selectively be able to reveal what ...
- 167
0
votes
1
answer
459
views
Personal or computer information stored in a freshly compiled executable
I would like to know if there is any information that can identify a computer or a person that compiled a program (let's talk only about c++ on visual studio, windows , with no particular library). ...
- 3
0
votes
0
answers
568
views
Is there a security issue with fit4less requiring bank information and not simply card number?
When I set up timed payments I tend to prefer setting them up through my credit card. As this tends to be more reliable in case of over charges, etc.
For example spotify goes through my credit card. ...
- 101
0
votes
1
answer
987
views
XMAS Scan vs Inverse TCP
Whats the difference between a XMAS Tree scan and an Inverse TCP scan using the FIN, URG, and PSH flags? Are they the same thing?
XMAS Tree scans are designed to manipulate the PSH, URG and FIN flags ...
- 3
1
vote
2
answers
2k
views
Is it poor practice to use the last 4 digits of a social security number as an identifier?
Is it poor practice to use the last 4 digits of a social security number as an identifier?
The last 4 digits of a person's social are commonly used as a means of personal identification/...
- 625
-4
votes
1
answer
1k
views
information gathering on a person [closed]
How would a hacker go about gathering information on a real person with a minimum amount of details about him?
Details known:
Name
Face
- 3,794
-1
votes
1
answer
448
views
How to identify the vulnerabilities in a target computer?
I ran an exploit on the victim and used a msfvenom payload. I am on the victim's computer but I have not the root privileges. I tried to use getsystem command for getting privilege but it failed.
So ...
- 53
0
votes
2
answers
1k
views
What are the security issues of exposing default server home page in public internet?
I have seen on internet where several website companies have exposed the default home page of web server such as Tomcat, NGNIX, Apache web server. I always believe it is not the best practice to ...
- 1,029
7
votes
1
answer
8k
views
Using android auto in a rental car
I've started using rental cars frequently for work and android auto has apparently become common enough that many of the cars I rent have it built in. It could be helpful to me even over the short ...
- 30.9k
4
votes
1
answer
212
views
Which protocol could have been likely candidates for leaking a laptop serial number
Having read this article, one line in particular caught my attention:
The AFP raided the boy's family home last year and found two Apple laptops with serial numbers that matched those of the ...
- 167
2
votes
1
answer
475
views
SSRF when user input is appended to hostname
Is it considered a SSRF vulnerability (or is it dangerous at all) if the backend of an application fetches a URL that is somewhat based off of user input, in a way similar to this
get("https://...
- 45
0
votes
1
answer
199
views
How to trace who sent mail with attachment
Yesterday someone emailed me a malicious .bat script.
I have his email (he used Gmail) and of course I can't track him using mail header. So I checked the .bat file details but I only see my ...
2
votes
0
answers
251
views
Stack behavior on function call during a format string exploit
I have some issues trying to resolve a war game with a format string vulnerability.
So here is the code of the program:
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
...
- 29
0
votes
1
answer
203
views
How sensitive is information on a system's architecture? [closed]
How much easier would it be to break into a system if you knew the following information?
Processor architecture / family
Operating system
Libraries used
Application programming language
Standardised ...
- 333
3
votes
2
answers
186
views
Business Partner Information Leaking
I just went through a penetration test, and what was wierd was we had a comment back about a potential data leak via DNS snooping (I realise this is boiler plate, and also this is an internal only DNS,...
- 162
-1
votes
1
answer
135
views
Found scam site that tricks you into giving them more contact info to remove your existing public info [closed]
I found a site where they display your political registration info (which includes contact info) that was requested from the government. If you find your contact information from this site, do NOT ...
17
votes
1
answer
2k
views
Should OS information be in DNS?
We are having an internal discussion about system naming conventions and there is a disagreement about including the type of OS a system is running in the DNS host record. One suggestion was to ...
- 280
7
votes
1
answer
2k
views
What information is in a gpg cleartext signature?
What information does a gpg2 signature contain?
If you clearsign an empty file, the signature looks like this:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
-----BEGIN PGP SIGNATURE-----
Version: ...
- 647
3
votes
1
answer
1k
views
How to secure erase files and folders? [duplicate]
How to securely erase/delete files or folders in different file systems (NTFS, ext3, ext4) ? Need to delete files so it will be impossible to recover that files and no traces of metadata and traces in ...
- 31
6
votes
1
answer
269
views
Autofill on (untrusted) websites
Consider a website using https which presents a login form on the home page. Today I visited such a website, which I have a login and password for, and for the first time I was presented with a ...
- 161
0
votes
2
answers
235
views
The requirements of gathering information data without any limits? [closed]
It's a well known fact that phones, computers and other devices can be tracked and be used as a means of collecting user information if the situation permits it, for example in crime investigations. I ...
-2
votes
1
answer
734
views
How does GPG2 --verify knows who signed a file and how? [closed]
When I (clear)sign a file, the output is something like this.
$ gpg2 --clearsign test
$ cat test.asc
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
This is a test!
-----BEGIN PGP SIGNATURE-----
...
- 647
1
vote
3
answers
269
views
If my data is encrypted with a password, how does the website know me?
Perhaps I am under the wrong impression, but I thought that my password encrypted all of my sensitive data on a website. Let's take Gmail as an example. What I would hope, is that without my password, ...
- 245
0
votes
1
answer
140
views
What files yield the most useful information when an attacker leverages a memory vulnerability?
I'm trying to understand what information is left behind after an attacker exploits a vulnerable application leveraging a memory vulnerability (overflows, ROP, etc.).
I wanted to know:
What are ...
- 203