Questions tagged [penetration-test]
An attempt to penetrate a system's security in an effort to evaluate the protections in place.
0
votes
0answers
28 views
Which penetration test tools can be used in the agile and CI environment? [on hold]
since I have different projects, with different development environments, it is of course important for me which penetration tools I use.
The projects:
Project 1 is a pure web project which is only ...
0
votes
0answers
55 views
How do hacking groups get a license anonymously for threat emulation software like Cobalt Strike?
I've seen that a lot of hacking groups replicate techniques and attacks from red teams using software like Cobalt Strike and Powershell frameworks for offensive security and red teaming like Nishang ...
0
votes
0answers
28 views
How to intercept packets of system apps in Android?
I am unable to capture packets of native android email app in burp suite but able to capture packets of chrome browser.
I have configured the proxy of my machine with burp port(8080) on the test ...
0
votes
0answers
33 views
I have access to router , now what? [on hold]
like the title said I get access to the router, I want to pivot to windows 10 machine and there is no port open? ii tried to use DNS to redirect to my site but the target can't download any file, I ...
0
votes
1answer
32 views
Is there a technical security standard for internet facing test environments?
We have a number of test environments that are permanently internet facing to accommodate external and automated testers with dynamic IP addresses. While we regularly check the servers for security ...
0
votes
0answers
31 views
Cracking signing and HOTP blackboxes
If there are these blackboxes, both are using algorithms which are considered secure yet:
Blackbox will sign any message, no limit for messages to be signed.
Blackbox will generate 8‐digit HOTP code ...
4
votes
1answer
70 views
API pentesting for mobile and web. What's the difference?
So, I have to pentest an API that is both used by a web app and two mobile apps (Android and iOS, obviously). My question is: do I have to test three times (i.e., for each app) or just once (since it'...
0
votes
1answer
67 views
XSS: Character showing in DOM
I have created an html page that redirects user to a test site that has an XSS vulnerability. I am able to successfully execute javascript via the vulnerability. However, I have found that some of the ...
1
vote
1answer
103 views
Enterprise Standard for Linux server Penetration Testing
Is there any enterprise or global standard like "OWASP" which can be followed while doing penetration testing on Linux servers?
I want to know if there are any most common/important vulnerabilities ...
0
votes
0answers
46 views
How do i pivot over WAN
How would i be able to pivot into a internal network over the internet (WAN)?
For example: I have a vps with metasploit installed and have a listener running and got a few meterpreter sessions, how ...
0
votes
0answers
34 views
Finding hidden parameters manually for XSS
I am researching about XSS and Google helped me a lot about learning like how to bypass XSS filters, POST and GET based XSS .
I am really curious to know how to find hidden parameters manually for ...
0
votes
3answers
69 views
Setting up OWASP ZAP Authentication against 2 page forms authenication
My website is using Microsoft account authentication(live Id). Microsoft authentication is set up in 2 different pages. The 1st page you enter the username, and the next page the password. How do I ...
13
votes
1answer
955 views
Is XSS in canonical link possible?
During regular pentesting of my site I discovered that I can close double quotes in a canonical link tag and enter an onerror attribute with a simple javascript alert(1).
It is visible in source ...
2
votes
1answer
223 views
How to verify Diffie Hellman uses a “Safe” prime
I'm the developer for a web application that was recently pen tested. One of the vulnerabilities reported from the pen test is that our server uses an unsafe Diffie-Hellman prime in our key exchange. ...
-2
votes
2answers
131 views
how does DNS cache snooping work?
I've seen there are programs for pentesting, such as FOCA, that provide tools for DNS snooping. The part I don't understand is how can we know the DNS server an organization is using.
Also, from what ...
1
vote
0answers
34 views
Can an attacker spoof content provider, backup manager or wallpaper manager in Android?
We need a backup of SMSes, apps, device settings, wallpapers and contacts of the device through our designed app.
So, is it possible for an attacker to spoof, tamper, impersonate source data (SMSes, ...
0
votes
0answers
32 views
Is Metasploit payload stored locally or residing in memory temporarily on a victim's device?
A simple question on where the payload is when being exploited. Tried some testing on metasploit and got a message saying the payload's been uploaded successfully under /tmp in a linux target machine ...
6
votes
1answer
176 views
How can I find a web application's document root using a path traversal vulnerability?
I am performing a penetration testing on an application hosted on an Ubuntu environment.
So using a path traversal vulnerability, I can download any file.
The API web application runs as root (...
0
votes
1answer
52 views
Vulnerabilities for Red Team assessment [closed]
I'm working on my dissertation for my bachelor's degree. I'm trying to create a framework which would make it possible to launch an entire virtual infrastructure, this would then be used to simulate a ...
0
votes
0answers
26 views
how to substitute DisconnectHandlers of Joomla?
I am having problems with the exploit
**Joomla! 1.0 < 3.4.5 - Object Injection 'x-forwarded-for' Header Remote Code Execution
CVE : CVE-2015-8562 , CVE-2015-8566**
It doesn't work on Joomla ...
1
vote
2answers
105 views
jsp malicious file upload is possible, but no exploit scenario, should I report it?
I was pen testing a java web application, I could upload a malicious JSP file which was generated using METASPLOIT, however, I could not put the JSP file in the server directory so that it can be ...
0
votes
0answers
55 views
Error based SQL Injection Oracle
I have this valid GET request:
GET /restrict/menuApc.do?ID_ASSISTITO=ciao&MVPG=ApcAssistitiRicerca&s_TIPO_ASSISTITO=&s_ASSISTITO=giovanni&s_TIPO_SOGGETTO= HTTP/1.1
Host: test:8080
...
-4
votes
2answers
102 views
Just getting my masters in cyber security but still looking for a job [closed]
I completed the masters degree program from Perdue online last April '18. I see there is a great need in this field. I have been looking for a job daily but still haven't been able to find anything. ...
-1
votes
1answer
206 views
Pentesting SFTP Servers
I'm working in a enterprise environment where we are sending sensitive data back and forth to another company via SFTP servers on each end. These are accessible over the internet however IP white ...
1
vote
0answers
42 views
nmap - No Ports Open [closed]
I bought a Tonbux Smart WiFi Plug WL-SC01 and I'm doing some hack tests on it for educational purposes. I used nmap to check for both UDP and TCP ports but both return that there are no open ports at ...
1
vote
1answer
140 views
website hacked by someone proxying over a tor router
I'm curious to get an opinion on following: If someone decides to exploit some sort of vulnerability in a web application of mine or performs something of malicious intent, would this individual be ...
0
votes
1answer
52 views
Should I take (Pen test) approval from AWS for Fuzz testing my Application API's hosted on AWS? [closed]
I wanted to Fuzz Tests my API's on my own stack which are hosted on AWS environment (Have used lambdas and API gateway)
There are mostly GET APIs and only one PUT API.My requirement is to Fuzz Test ...
0
votes
1answer
61 views
shellcode JMP-CALL-POP technique ( Segmentation fault (core dumped) )
I write this shellcode for spawn a shell on the box using JMP-CALL-POP technique but i keep got this error i don't now why !!
Segmentation fault (core dumped)
my shellcode :
section .text
...
1
vote
0answers
57 views
How to exploit this buffer overflow. Where is the return address?
I'm practicing doing buffer overflows and, weirdly, I can do some but not others and it is not clear to me why. Here is the example code:
Code that I need help with::
#include <stdio.h>
int ...
1
vote
2answers
98 views
Reverse shell refusing/difficulties to establish connection
I've been trying to reverse shell between different devices, however,
I'm never able to establish a connection or get a shell prompt
.
Let's say I have a Mac OSX as victim and use a raspberry Pi ...
233
votes
12answers
23k views
Is single quote filtering nonsense?
Penetration testers found out that we allow single quotes in submitted data fields, and want us to apply rules (input validation) to not allow them in any value.
While I'm aware that single quotes ...
1
vote
2answers
180 views
Penetration Testing authorization from AWS
We have a few web applications newly hosted on AWS. Before we run an automated pentest on the our Application URL using Netsparker, we had always e-mailed Amazon and requested authorization for the ...
1
vote
0answers
187 views
127.0.0.1 - Meterpreter session 2 closed. Reason: Died
I am new at metasploit and am trying to pentest an Android 5.1 device, so I setup for a stageFright attack but am having this issue: the 'meterpreter session closed' immediately, and the ngrok ...
0
votes
1answer
168 views
Android x86 vs Android on Qemu ARM
Situation: Emulating Android devices for pen-testing
Problem: Choosing between emulating Android x86 or emulating Android on Qemu runing on ARM
Question: In terms of vulnerabilities/exploitability, ...
0
votes
0answers
51 views
Metasploit wmap_run -e freezes on auxiliary/scanner/http/brute_dirs module, returns 404
I am trying to run a wmap scan on a web app locally on my Mac. But when wmap reached File/Dir testing, more specifically the brute force module, it does not show anything for path (even though the ...
2
votes
0answers
19 views
Burp Suite - Mark Issues as “Validated”
After performing a audit (formerly active and passive scan) of a web app with Burp suite I manually verify and validate the issues it identifies to rule out false positives, see what is possible with ...
0
votes
1answer
93 views
The Girl in the Spider's Web: SCSI hack?
In the movie, the main character is shown tapping into a network of surveillance cameras.
She uses a SCSI connector which allows her to send the camera footage to a remote computer.
I know it's a ...
0
votes
1answer
56 views
XMAS Scan vs Inverse TCP
Whats the difference between a XMAS Tree scan and an Inverse TCP scan using the FIN, URG, and PSH flags? Are they the same thing?
XMAS Tree scans are designed to manipulate the PSH, URG and FIN flags ...
1
vote
2answers
75 views
How do i extract data from response and use it in url for next request in Burp Intruder?
The URL is https://www.example.com/send?session=abcabcabc.
When the above URL is requested, a response comes with <a> tag which contains a new URL with a different session value like https://...
0
votes
2answers
105 views
AWS serverless architecture compliance with PCI DSS 11.3 penetration testing segmentation
I am wondering how to comply with PCI DSS requirements (11.3) to test segmentation controls using penetration testing in AWS serverless architecture.
We are using components such as AWS Lambda, AWS ...
0
votes
2answers
57 views
Australia's Legal Do's and Don'ts of Hacking [closed]
Just wondering what methods used in Pen-testing (Denial of service, dropping a shell, phishing, etc.) would land you in legal trouble in Australia?
5
votes
2answers
345 views
How do I monitor what a penetration tester is doing?
Suppose I have a penetration tester working in my data center. She is testing my systems and is probably finding some issues, allowing her to gain root access to a machine that is inside a subnet deep ...
1
vote
1answer
420 views
How to (temporarily) disable McAfee Endpoint Security on an enterprise workstation?
I need to temporarily disable McAfee Endpoint Security on an enterprise workstation after having obtained local administrative privileges. The McAfee Endpoint Security settings are protected by a ...
3
votes
1answer
166 views
Do security consultants routinely demonstrate hacking into attendees' PCs within minutes?
From this Quora answer:
Years ago when I was in China I was getting updated on cyber security
from one of our partnerships.
We were going over everything from basic hacks a 9 year old could ...
2
votes
0answers
57 views
How to identify the communication protocol used in a wireless device?
I really hope that this is the right place to ask.
I need to analyze a baby monitor for any security or privacy weaknesses.
The spec sheet of the baby monitor says, that it uses the ISM 2400~2483.5 ...
-1
votes
1answer
61 views
msfvenom produces different op codes when format is given with 'c' instead of 'python'
I still do not understand the msfvenom format ( -f ) parameter regarding the resulting op codes. I do not understand why a payload consists of different op codes when the format ( -f ) is different, ...
0
votes
2answers
79 views
PHP Code Injection vulnerability exists even after recommended hardening
Using Burp to intercept traffic and inject code we have identified
remote code execution vulnerability in a website. After entering data
in input fields on the form and clicking submit the traffic ...
1
vote
0answers
16 views
Does application security assessments done using SaaS solutions (WhiteHat Sentinal and Fortify on Demand) count as penetration tests?
SaaS security solutions such as "WhiteHat Sentinal" and "Fortify on Demand"
are getting popular now a days. Methodologies of both describe them involving manual verification. Does this qualify the ...
1
vote
1answer
127 views
Getting scanned on AWS Elastic BeanStalk
As soon as I upload/deploy an application to AWS Elastic BeanStalk, it gets scanned for common admin pages even though it’s not linked to by any external website and I have not shared the DNS name ...
1
vote
1answer
92 views
What information should I provide to third party pen testers - (black box penetration)
I am going to hire a third party security company for Penetration testing in our company network. I have already selected a pen testing and black box testing company to do them, but they have ...
