Tagged Questions
An attempt to penetrate a system's security in an effort to evaluate the protections in place.
0
votes
0answers
24 views
Looking for a Fuzzing Framework on Windows for Command line application with flags and parameters with structured input
I have a command line application that takes flags and parameters. I am searching for a ready to use Fuzzing framework with minimal installation steps to see if Fuzzing is feasible to my organization.
...
0
votes
0answers
27 views
Best website penetration testing App [on hold]
It's not possible for me to use the desktop always. So, I need to use my Android Marshmallow 6.0.
But, I didn't found any useful tool for android which will help me in penetration testing. I'm ...
2
votes
2answers
136 views
Penetration Testing List
I have been to various documents such as OSSTMM, NIST 800-115, PCI DSS pentesting document. But is there any place where I can find out baseline list for internal network penetration testing? For ...
-1
votes
3answers
104 views
PenTest & Security Homelab - 3 RPis and what to install? [closed]
As indicated above, I have inherited 3 Raspberry Pis and think currently of building my own PenTest lab.
I am running a Kali Linux VM on my Debian laptop (Lenovo x230) and looking for recommendations ...
-3
votes
0answers
51 views
What is the methodology for pentesting Windows Active Directory environment? [closed]
How can I do a penetration test for Windows Active Directory? What are the steps that I should take when playing with a domain controller?
If I have a domain account with low privilege, what are the ...
0
votes
0answers
43 views
Scanning pages using wapiti with login details
I am using Wapiti to scan my web application. All URLs in the login page gets scanned and report gets generated. But, pages that require login credentials do not get scanned. What is the command that ...
0
votes
0answers
22 views
How to establish Meterpreter sessions in spite of awful network latency? [on hold]
I live in a rural area, so the only option available for Internet access is via satellite. The latency is so bad that when I run nmap on a remote system I usually have to invoke the -T option at -T2 ...
0
votes
0answers
21 views
CORS returning two Access-Control-Allow-Origin headers?
I am doing a verification test for a CORS issue that we discovered. When specifying an origin, the application used to respond with the allow origin to any URL. However, upon retest, the application ...
3
votes
1answer
52 views
Is it a security defect to display the secure api_key in travis.yml file of source code of a web application in Github
I have been working on a code review of a project. The source code is publicly available on Github.
I came across a file "travis.yml". In that file, I am able to see the secure api_key as shown in ...
-1
votes
1answer
65 views
Malware Testing on a Virtual Box
I would like to test some malware on a virtual box but I can not seem to figure out a safe way to get the malware on the virtual machine.
I was thinking maybe I could download it while I am on the ...
3
votes
1answer
215 views
+100
Find Security Flaws in My Payment Page
I've done some extensive research about how to secure your website from card fraud.
iFrames do a pretty good job of this, however, It can still be worked around from certain exploits.
Many payment ...
9
votes
3answers
366 views
What are some instant red flags when scanning an network with nmap
When doing an Nmap scan from an external network, what open ports should be an instant red flag?
For example, if I was in the open internet and scanned www.somewebsite.com, besides port 22, what other ...
2
votes
0answers
37 views
Guideline/Standards for Valid Penetration Testing
I'm part of a team that's been asked to penetration test an application that is not GA or even at a release candidate yet. I believe that any pen test findings, positive or negative would be invalid ...
0
votes
1answer
57 views
Import Wireshark Cookies into Firefox?
I'm trying to copy session cookies (collected using Wireshark) into a different Firefox sessions. But can't seem to find a method or working add-on to manage the cookies.
Greasemonkey and ...
0
votes
0answers
26 views
Suggestion for intercepting traffic with android app [duplicate]
Are there any tools that I can use to intercept the traffic of android app? I tried Charles proxy and Burp suite but they only support HTTP/HTTPS traffic.
I have to pentest a game, basically it's ...
1
vote
1answer
37 views
How to add a cookies parameter to Dotdotpwn script [closed]
Do you know how I can add a specific cookie parameter like "access token" to dotdotpwn script?
Without this, I have that output "Web server (xxxx) didn't respond !"
1
vote
1answer
62 views
Hydra: Brute force an http form, all arguments are supplied but the login error has other string formats and is too big
I am using Hydra to brute force a login http form (Method: post), but I'm getting false positives (passwords that aren't valid)
I believe I know the reason, I just don't know how to handle it:
The ...
6
votes
1answer
419 views
Does Strict-Transport Security Header (HSTS) need to be applied to non 200 response pages (e.g. 403, 302)
I have an application that is protected by Cloudflare. The application responds with a HSTS on all of the other pages except HTTP status 403 Forbidden and 302 Moved Temporarily. It seems to be ...
2
votes
1answer
144 views
Use netcat to Pivot
So I have a shell into machine A which doesn't have ssh installed and I can't get a tty shell on (I've tried all of the tty cheat sheets, I think this is intentional)
Through machine A I can see ...
8
votes
1answer
844 views
How to report unsuccessful attacks to the source network admins? [duplicate]
I am not an information security professional as such. I am a self-taught web developer so I hope this question is not too basic.
I have set up a web store via WordPress using WooCommerce and ...
1
vote
1answer
103 views
How does Client-Side-Exploitation get the System-level-shell in Metasploit?
For example, if my client is using a vulnerable Internet Explorer which was vulnerable to the Aurora Vulnerability (I know its old and patch, but for now, let's assume) then I use Metasploit Client-...
1
vote
0answers
29 views
Is it possible to circumvent (ignore) routing table without root permissions?
The local host is configured to send all non-local traffic to a restrictive firewall VM configured in the routing table (route).
Preliminary scanning shows that other routers are available on the ...
1
vote
2answers
42 views
How to scan allowed outbound (destination) ports on the local host?
Without access to firewall rules, I want to scan allowed outbound (destination) ports on the local machine.
I would take too long to start a netcat listener for each of the destination ports on a ...
3
votes
1answer
155 views
Is it a good idea to test a live company website as part of an interview process?
I got an interview task, which is to pentest the careers section of a company's website. I'm keen to play around with any website, and permission was given but this feels like a free pentest. I ...
0
votes
0answers
18 views
Login to domain user account (previously logon) using compromised local administrator account? [duplicate]
Is it possible to use a compromised local administrator account to login to a previously logged on domain user account?
Using Mimikatz, I've dumped the MsCacheV2 hashes, but they seem to be ...
-1
votes
1answer
101 views
what would happen if port 22 and 23 are opened [duplicate]
what would happen if port 22 and 23 are opened
1
vote
0answers
123 views
Attack secure domain controller in environment with unique username/password combinations [closed]
I’ve already obtained local administrator on a domain user’s computer. Now, my target is one of the company’s domain controllers.
However, the domain controllers run no vulnerable services, and every ...
1
vote
0answers
136 views
Sniffing Tool Using Monitor Mode [closed]
As I understand it (fix me if I am wrong), there are two main ways of sniffing traffic from my wifi.
I can use ARP Spoofing, to poison a device on my network then capture all of its communication.
I ...
3
votes
1answer
134 views
Is it possible to bypass USB access restriction placed by the Active Directory? [closed]
I've been tasked with an onsite engagement to see what I can find from one of their laptops. They have a policy in place to block USB access through the Active Directory, e.g. When you try to access ...
2
votes
1answer
79 views
File upload security in webapp - overview of setup
For a webapp based around user uploaded pics, I want to check that I'm doing things sufficiently securely. Below is an outline of the current setup.
Of course only registered users can upload, but I ...
1
vote
1answer
58 views
How to filter evil Regex and filter input with regex in python? [closed]
How to filter evil Regex and filter input with regex in python?
Is there security regex library or database that can use a list of regex to filter and check vulnerable input in python?
Some regex ...
0
votes
0answers
163 views
Pen testing, Windows: Using credentials to impersonate users from SYSTEM
Following simple scenario during pen test:
I have remote code execution on a windows box and am SYSTEM (either because of the way I got onto the box or because of the persistence method I chose)
I ...
1
vote
2answers
102 views
JWT encoding using HMAC with asymmetric key as secret
I'm currently exploiting the vulnerability discussed here
https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
Where the algorithm type in JWT can be changed from ...
2
votes
1answer
97 views
Stolen laptop simulation - Pentest
One of the risks being simulated for organizations are stolen laptops.
Was wondering if anyone had a methodology/list of items to check when assessing the security of Windows laptops.
Here is my ...
1
vote
1answer
114 views
JSON web token vulnerability with HMAC and RSA
I'm currently learning about a vulnerability that takes advantage of a JSON web token which is discussed here
Though I understood the nature of the bug and how it can be abused by attackers, I couldn'...
1
vote
1answer
87 views
Is it safe to install Xampp to learn Security and Penetration testing using DVWA? [duplicate]
I have heard Xampp is not safe and has a lot of security loopholes. What steps need to be taken to close the loopholes? Is it better if I use a VM instead?
I new to Security Testing and want to learn ...
1
vote
0answers
52 views
Server improperly handling unicode characters?
So I'm pen-testing a web application. Upon submitting certain data it sends it in a POST request which contains the data in a JSON object. So while fuzzing it I was testing for improper encoding ...
1
vote
1answer
174 views
Is it legal to run penetration testing tools against google, facebook etc..? [closed]
Is it legal to run penetration testing tools against all of the sites which are offering a bug bounty according to https://www.bugcrowd.com/bug-bounty-list/, i.e. 1Password, ...Google, ..., Facebook, ....
0
votes
0answers
35 views
Nikto output: Siteseed pre 1.4.2 has major security problems
I am performing a pen test on a web application, and one of nikto's results is:
"Siteseed pre 1.4.2 has major security problems"
I need to manually check this but I'm not sure what it is. I tried ...
1
vote
1answer
74 views
Fuzzing: Quickly find the exact number of bytes
I'm currently practicing buffer overflow. And I have a question for you regarding fuzzing.
I am able to develop a python script that will try several buffer sizes to crash an application. It works ...
2
votes
1answer
148 views
Request permission to PenTest on GoDaddy servers [closed]
I have recently been asked by a customer to perform a pentest against a web application hosted on a GoDaddy server. Because the server is not physically owned by my customer I'm aware that I need to ...
1
vote
1answer
58 views
Penetration Testing of IaaS/PaaS environment - CVSS Score
How can I measure the effectiveness of a Penetration Testing carried out in a Cloud Environment (IaaS/PaaS) by a third Party Vendor ? Should I ask for a CVSS score or something else ?
Any advise will ...
2
votes
1answer
32 views
What are the methods by which an attacker can distinguish between DROP on IPtables and a Nullroute or non-allocated IP?
Let's say we have a server set up with set to:
iptables -P INPUT DROP
Without any other rules on the input chain.
Ignoring accessibility issues outside of physical server access, what are the ...
3
votes
1answer
192 views
Is window.history.back() safe to use?
I am doing a penetration test on a web application and it is using window.history.back() to go back to the previous page. Is this safe to use?
For example, if I visit google.com and then go to the ...
1
vote
2answers
96 views
Test for OWASP Using Components with Known Vulnerabilities?
I'm trying to think how I would test an application for OWASP "Using Components with Known Vulnerabilities".
If my understanding is correct, this deals a lot with out of date libraries/modules, but ...
1
vote
2answers
202 views
What is the use of EXE and DLL files on iOS device
I have a doubt regarding iOS application pentest.
I am pentesting one iOS application. The application is protected by MDM software.
Installation Process - Once I install the MDM on iPhone device ...
0
votes
2answers
235 views
Which exploit and which payload use?
I'm learning penetration testing. I've read the Metasploit Unleashed guide on offensive-security. I've learned the Metasploit Fundamentals and the use of msfconsole.
After reconnaissance and scanning ...
1
vote
3answers
85 views
nikto's results differ from other vulnerability scanners , is it more or less accurate?
I was doing some scanning on a web application, I used OWASP zap and Nessus. The risks that these two detected were medium to low, very few vulnerabilities.
Then I tried nikto, and the results were ...
0
votes
1answer
103 views
Penetration testing - full consistent overview
I need a relevant text (scientific paper, book chapter etc.) that provides a full overview (big picture) about penetration testing.
It should include as much complete, consistent and up-to-date as ...
1
vote
1answer
541 views
Nikto authentication
I am trying to complete a war game on Hell Bound Hackers.
I wish to use the nikto scanner to check some pages for vulnerabilities, however I first need to log into the Hell Bound Hackers war game, ...
