Questions tagged [information-gathering]

The early stage of an attack during which the attacker tries to collect information about the target.

Filter by
Sorted by
Tagged with
106
votes
6answers
141k views

How to find out what programming language a website is built in?

I think that it's fundamental for security testers to gather information about how a web application works and eventually what language it's written in. I know that URL extensions, HTTP headers, ...
25
votes
3answers
7k views

Computer name naming convention for security

I've been doing a security audit and found out you can easily identify host roles and running services just by their computer name (using nslookup). I would like to report this so that they use less ...
19
votes
4answers
3k views

What lessons can be learned from the latest spate of Ransomware attacks? [closed]

I'm not sure this is the right place, but figured people would find it useful if they aren't too familiar with security policies and general best practices. There is a lot of information out there, ...
17
votes
1answer
2k views

Should OS information be in DNS?

We are having an internal discussion about system naming conventions and there is a disagreement about including the type of OS a system is running in the DNS host record. One suggestion was to ...
10
votes
2answers
254 views

What is the impact of leaked recaptcha secret key?

Due to server configurations, our recaptcha secret key was publicly readable. The key has been updated to a new one, but what is the actual impact of a malicious user getting a hold of the key? ...
7
votes
4answers
2k views

implications of incomplete TCP handshake session

In network security, why do we care about knowing incomplete TCP handshake sessions? Is there a security implication behind this?
7
votes
1answer
227 views

Any advantage to rejecting a (cell phone) call vs ignoring it?

I get several calls a month from numbers that are not on my contact list. When I search these numbers on Google, it is not unusual see message boards saying that the number belongs to a known scammer ...
6
votes
1answer
4k views

Using android auto in a rental car

I've started using rental cars frequently for work and android auto has apparently become common enough that many of the cars I rent have it built in. It could be helpful to me even over the short ...
6
votes
1answer
83 views

Autofill on (untrusted) websites

Consider a website using https which presents a login form on the home page. Today I visited such a website, which I have a login and password for, and for the first time I was presented with a ...
5
votes
1answer
424 views

What is this user trying to do?

I work with a company that creates marketing software, we recently created a forum so we could talk with users who need support. I'm the main admin on this forum and a user, let's call them person1 ...
5
votes
4answers
260 views

What is the best way to explain (a non-technical person) the risk of leaking version information?

I'm wondering what the easiest way is to explain a non-technical person (read: management) why the leakage of a simple version number is considered unnecesarry/a potential risk and should be avoided. ...
5
votes
1answer
591 views

Should I avoid deploying package.json or bower.json files to production?

I know it is recommended to hide OS and server version information when serving up web pages. What about js library version info contained in package.json or bower.json files? It seems like this could ...
5
votes
2answers
3k views

“Triage an incident”

I have been trying to find a definition of triage in relation to Information Security but cannot find any online. From the different examples given online (i.e. medical world), it seems related to ...
4
votes
1answer
930 views

What information is in a gpg cleartext signature?

What information does a gpg2 signature contain? If you clearsign an empty file, the signature looks like this: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 -----BEGIN PGP SIGNATURE----- Version: ...
4
votes
1answer
155 views

Which protocol could have been likely candidates for leaking a laptop serial number

Having read this article, one line in particular caught my attention: The AFP raided the boy's family home last year and found two Apple laptops with serial numbers that matched those of the ...
4
votes
3answers
863 views

Security implications of WAF revealing internal IP addresses

What are the security implications of a web app firewall/load balancer revealing internal IPs of the web sites behind it to the outside world? A specific example is with F5 products: They use a ...
4
votes
1answer
6k views

Beyond Nmap: Investigating open TCP ports bound to unknown services

I have an uninvited guest using my private WLAN. At first I thought it was probably just a tech-savvy neighbour in need of Internet access, in which case; it wouldn't really bother me. However, I've ...
3
votes
3answers
2k views

Boundaries of Personally Identifiable Information - PCI-DSS

I am attempting to ascertain the boundaries of personally identifiable information. For example does the combination of John and Doe equate to personally identifiable information since there could ...
3
votes
3answers
235 views

Determine what a company is googling

Let's say that a fictional company, AwSemCo, discovers that a published vulnerability "CVE0day" affects their systems and they immediately start investigating it. They go to the web looking for a ...
3
votes
2answers
107 views

Business Partner Information Leaking

I just went through a penetration test, and what was wierd was we had a comment back about a potential data leak via DNS snooping (I realise this is boiler plate, and also this is an internal only DNS,...
3
votes
2answers
1k views

Can I trick a mail server into sending me an email?

Can I trick a mail server into sending me an email? I would like to do some email header analysis on the emails that are send by a mail-server in a penetration-test and possibly get to know more ...
3
votes
2answers
137 views

Data 'dust' left over other than on the HDD?

I was working on a project which contained very classified information. I am now planning on using the computer for personal work but I'm worried that replacing the HDD won't be enough. Is there any ...
3
votes
2answers
727 views

​ Organizing information during a pentest [closed]

​ Currently I'm on my way to becoming a full time pentester, which means I do a bunch of CTF challenges and try to break labs that have been set up for me. The only issue I'm currently facing is how ...
3
votes
1answer
602 views

CSF is blocking so many IP's

I have been using DigitalOcean's services for about 2 years and CSF reported port blocking alerts twice a week. After I changed my country (and also the IP address of the machine changed) I am getting ...
3
votes
1answer
120 views

How dangerous is leaking knowledge about existence of objects which the user is not allowed to access?

It is my understanding that good security design does not reveal information about data which the user is not allowed to access. This includes information about the existence of said data, i.e. if a ...
3
votes
2answers
663 views

What is the key to detecting all IoT devices in your organization? [closed]

In recent news, IoT devices are a target of hackers -- specifically botnet herders. The first step to securing your organization and its users is to detect all IoT devices that are functional on your ...
2
votes
2answers
321 views

Locate server by latency it has to other servers

I just thought about how one can locate a server he has administrative privileges on. My "best" idea till now is to ping a huge amount of servers and then measure the latency of the host to these ...
2
votes
2answers
30k views

How to find list of IP address in a network with multiple subnets?

There are many subnets connected via a router in the same network. I need to find list of all IP address available in each different subnet. I am able to get the list of IP address available in the ...
2
votes
3answers
114 views

Should public access to specific filenames and -types be denied preventively?

Is it a good idea to preventively disable (public) access to certain filetypes (by extension) and/or by filenames: in the server configuration (in case of a shared hosting server) or, as a rewrite ...
2
votes
1answer
133 views

A third party Web site wants me to validate my domain ownership using a TXT record

What are the security risks with adding TXT records for third party tools? Can they get any information back from your servers with adding that record for them? The example below is from the "have i ...
2
votes
2answers
96 views

Is using a network sniffer for host discovery a viable option?

Would a packet sniffer like tcpdump be effective for network host discovery and if so how effective is it compared to more active methods such as the infamous network mapper nmap?
2
votes
1answer
850 views

How to secure erase files and folders? [duplicate]

How to securely erase/delete files or folders in different file systems (NTFS, ext3, ext4) ? Need to delete files so it will be impossible to recover that files and no traces of metadata and traces in ...
2
votes
2answers
1k views

My WebSite is being attacked, should i be worried seeing the logs?

Recently i just checked my server and found in logs that it is being attacked. Seeing the logs i am not able to exactly figure out, if i should actually be worried.i checked the attacker domain rating ...
2
votes
0answers
55 views

How SIGINT Researchers/Operators collect, decode and monitor a vast array of wireless data? [closed]

In wireless communication, data flows at various frequencies ranging from Radio to Satellite communication. These frequency carriers are allocated for different uses based on various requirement ...
2
votes
0answers
113 views

Stack behavior on function call during a format string exploit

I have some issues trying to resolve a war game with a format string vulnerability. So here is the code of the program: #include <stdio.h> #include <string.h> #include <stdlib.h> ...
2
votes
0answers
79 views

IPv6 Spams dataset?

My master thesis is about "Managing Spam Under IPv6". I would like to use machine learning algorithm on information retrieved from mail headers in order to sort out spams from legitimate mails. To do ...
1
vote
2answers
759 views

Is it poor practice to use the last 4 digits of a social security number as an identifier?

Is it poor practice to use the last 4 digits of a social security number as an identifier? The last 4 digits of a person's social are commonly used as a means of personal identification/...
1
vote
2answers
65 views

3rd Party trackers and online privacy

I don't feel the internet is respecting our individual right to privacy. Why are 3rd party trackers allowed to siphon data from us without our permission? We should selectively be able to reveal what ...
1
vote
3answers
163 views

If my data is encrypted with a password, how does the website know me?

Perhaps I am under the wrong impression, but I thought that my password encrypted all of my sensitive data on a website. Let's take Gmail as an example. What I would hope, is that without my password, ...
1
vote
1answer
191 views

SSRF when user input is appended to hostname

Is it considered a SSRF vulnerability (or is it dangerous at all) if the backend of an application fetches a URL that is somewhat based off of user input, in a way similar to this get("https://...
1
vote
1answer
77 views

Capturing sensitive data within legal restrictions? [closed]

As a web development agency we're currently taking on a site rebuild for a recruitment agency. The current site allows applicants to register as temporary workers for the agency ( our client ) who ...
1
vote
1answer
1k views

How to fingerprint a server with Netcat?

I am trying to follow the OWASP test guide on a Kali Linux machine. As the first step in "Information Gathering" I am trying to fingerprint the server. The guide instructs me to use NetCat: $ nc www....
1
vote
1answer
89 views

Is threat intelligence an illegal practise? [closed]

When thinking about cyber security I like to be up to date with all the latest threats out there. So of course you would like to get the information first hand to see where the threats are coming from ...
1
vote
1answer
167 views

How do I get a count of unique nested URLs in an web application?

I'm scoping a web application for a pentest. The application has a number of dynamic nested URLs. I've crawled through all the URLs in the application via Burp-suite. I need to obtain a list of ...
1
vote
0answers
38 views

How to get user information from an IP address? [duplicate]

A spammer is harassing my friend and she doesn't know who. With some struggle, I found out the spammer's IP address. But I don't know how to proceed after this. She says she doesn't want to move ...
1
vote
0answers
67 views

T900 Skype Virus How to detect and how to remove [closed]

I hope that this is the correct forum to post this question. I wanted ask what is the best way to identify if a machine is infected with the virus T9000 and also, which antivirus programs are capable ...
1
vote
0answers
154 views

How often does a user type in the “last 4 digits of SSN” in the “last 4 digits of Phone”?

This may sound dumb to a Security pro, but this is about end-users and worst case interaction with a challenge-response. Background Many 2 factor authentication sites request verification of the ...
0
votes
1answer
126 views

browser can visit the url but other application can't

I did simple 'intitle:"index of" xss' search and got this page with URL 'https://repo1.maven.org/maven2/com/codesnippets4all/xss-filter/'.I can see the IP on the wireshark and the conversation of ...
0
votes
3answers
112 views

Information gathering on website [closed]

I'm pretty new to pentesting and everything about it. This question is primarily for web servers. I'd like to know for you pentesters out there, what information are you looking for when you are ...
0
votes
1answer
126 views

How sensitive is information on a system's architecture? [closed]

How much easier would it be to break into a system if you knew the following information? Processor architecture / family Operating system Libraries used Application programming language Standardised ...