Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [penetration-test]

An attempt to penetrate a system's security in an effort to evaluate the protections in place.

1
vote
0answers
27 views

Getting scanned on AWS Elastic BeanStalk

As soon as I upload/deploy an application to AWS Elastic BeanStalk, it gets scanned for common admin pages even though it’s not linked to by any external website and I have not shared the DNS name ...
0
votes
1answer
64 views

What information should I provide to third party pen testers - (black box penetration)

I am going to hire a third party security company for Penetration testing in our company network. I have already selected a pen testing and black box testing company to do them, but they have ...
0
votes
0answers
41 views

Tools for reading captured data from an RFID device to recover the key?

I have a challenge where you have to recover the key for an rfid. Where the data is already captured and stored in a file. But I am not able to figure it out how to read the data. The data is in the ...
0
votes
1answer
45 views

SqlDateTime overflow.. Will this cause any issues ? is any kind of hacking or bypassing age restriction is possible in this case? [on hold]

We have a website with age restriction. If a user want to register in our website, user must be 18 years old.As i know there is validation at client and server side ? When i tried to register in our ...
0
votes
1answer
83 views

Why it best to do security testing on a copy on a Virtual Machine rather than on than the live server? [closed]

Why is it better for a security tester to take a copy of a server e.g. eBay server and test it on a virtual machine rather than on than the real eBay server? E.g. doing security testing on the live ...
1
vote
1answer
49 views

Reverse PHP shell disconnecting when netcat listener

Whilst performing a penetration test on a testing box, I came across a vulnerability regarding LotusCMS: https://www.exploit-db.com/exploits/18565 Rather than rely on Metasploit or Meterpreter to ...
0
votes
0answers
30 views

Is there any way to detect, whether a USB host actually loaded the driver for the USB device I connected?

Let's assume I have a device which is a blackbox for me. This could be an IoT device I'd like to examine in a pen test. Let's further assume the device has a USB port. One thing I'd like to know is: ...
-4
votes
1answer
139 views

How does testing on a Virtual Machine prevent the security tester from breaching the misuse act? [closed]

Why is it better for a security tester to test a virtual copy of a server e.g. eBay server and test it on a virtual machine rather than on the real eBay server? E.g. Doing security on the real server ...
1
vote
1answer
80 views

SQL injection with an auto-incrementing parameter

I'm currently performing an API Pentest and I suspect an SQLi in one of the API calls. It updates a certain item of the web-service and requires an increase of the version number for each request. ...
0
votes
1answer
75 views

What all test cases/vulnerabilities we need to try in REST API Pen testing?

I am learning API pen testing and looking for resources which will give clear list of test cases we need to check while performing a Pen testing on REST API. I have gone through the OWASP resources ...
0
votes
0answers
71 views

Injecting a payload into an exe file

How do you inject a payload (for example windows/x64/meterpreter/reverse_tcp) into an exe file? Basically, when the target opens the exe file, it looks normal and operates as such but in the ...
0
votes
1answer
43 views

Testing Package Leakage at the Router [closed]

I'm home learning a course/certificate for pen-testing and security analysis. I came into a part in the process of pen-testing Perimeter Devices, specifically at testing the Router. At this point I'm ...
0
votes
0answers
40 views

Target network for packet injection

I want to start practicing with wifi hacking but live on my college's campus and don't want to get in trouble. I have a router set up to test on but I want to make sure I'm only injecting on my ...
0
votes
2answers
73 views

XSS alert not working with concatenated string

I've noticed that the following Stored XSS does not execute, whereas in the JS console it works: <img src=0 onerror=alert(document.domain+": "+Date.now())> This doesn't prompt an alert box. ...
2
votes
0answers
36 views

Pentest website available through per app VPN

I am trying to intercept web traffic with burp from mobile devices (Android and iPhone) that are enrolled in an MDM solution (MobileIron). There is one specific website I want to proxy, that is ...
0
votes
2answers
69 views

How can pentest reports contribute to structural solutions for vulnerabilities?

When you do a pentest what is your recommendation to the client on how to handle/interpret the report? What I frequently see is that identified issues - especially issues related to self developed ...
0
votes
2answers
72 views

Web App or Web Services testing?

I am trying to clear up a doubt on security testing. If the web app (GUI, functional UIs, user roles, et all), makes use of rest web services to take actions, I believe both the web app AND the web ...
1
vote
2answers
136 views

A computer on the public network I was using was penetrated at a codejam. Am I at risk?

I was at a code jam today for 12 hours. At the end of the day as I was leaving, one of the programmers claimed his computer was hit with a reverse shell attack. He was voicing this as I was ...
0
votes
2answers
72 views

I couldn't deauth any devices using aireplay-ng command in kali linux

I am using Kali linux. I've updated all tools and services by apt-get update and apt-get upgrade. I was using aircrack-ng for pentesting my wlan network. I wanted to deauth any device connected to my ...
2
votes
1answer
49 views

Can't log in dvwa with a simple python program, even though login credentials are good

import requests target_url = "http://127.0.0.1/dvwa/login.php" data_dict = {"csrfmiddlewaretoken": "bbbfeed6e1aea50f14a51a331054022c", "username": "admin", "password": "password", "Login": "Submit"} ...
0
votes
0answers
43 views

Pentesting web application with WebRTC video chat feature

I'm pentesting a web-application that uses peer-to-peer WebRTC for video chatting. I haven't come across this yet, so I'm a tad lost as of how to tackle this. How can I verify the WebRTC ...
1
vote
0answers
39 views

What might an attacker do with email address as login name?

This might have been asked before, but I've looked for a few hours and can't find much. I would also like some opinions on what an attacker might do if he enters an email address on a site and it ...
2
votes
2answers
53 views

What exactly does a default port scan look like? I am trying to run a default port scan without setting off the ids on my test network

What is the best option to use for a default port scan of a server on my test network without setting off the ids using nmap. -f is not a switch i am wanting to use.
-1
votes
3answers
70 views

Introduction Ethical Hacking [closed]

0 knowledge on ANYTHING, square 1 basically. Where can someone start and lead into the general direction to start off a career in this profession.
-1
votes
2answers
79 views

How can i access any useful information in a wordpress site?

While penetration testing for a university assignment, I found an exploit that might be the one the teacher has been hinting for, found here: https://www.exploit-db.com/exploits/45439/ I used it and ...
2
votes
1answer
49 views

How do you test buffer overflows in the lab?

I'm doing a lot of learning about buffer overflows, and BROP. My problem is how can I test against real software in the lab? I can find a lot of CVE's that contain sever bugs that are open to a buffer ...
2
votes
0answers
62 views

OWASP Testing Guide Equivalent for Desktop Applications [closed]

I was wondering if any of you know of a guide similar to the OWASP Testing Guide but meant specifically for desktop applications? I had no luck searching the Internet. I am looking for something ...
1
vote
1answer
57 views

Kerberos unconstrained delegation for user

I've noticed that there is an option to set "Trust this user for delegation to any service" that can be set for service users. I've read a lot about unconstrained delegation with regards to computers ...
1
vote
2answers
104 views

POST Method Anti-CSRF Help With Burp Suite

I am testing a web application and encountering anti-CSRF tokens within forms which is hampering fuzzing attempts using Burp Suite intruder. An anti-CSRF token appears as csrf-token within a HTML meta ...
0
votes
0answers
34 views

Cross Origin Resource Sharing null vs wildcard?

I am testing an application that uses widget. These widgets are placed in the customer websites to use as some sort of tracking clicks device and returns some data too, therefore it is necessary to ...
1
vote
0answers
59 views

How to run Metasploit WMAP on site that requires SNI

Apologies if this an obvious question, documentation seems to be a bit thin on the ground. I'm attempting to scan (with permission) a site that redirects to its https version, and requires SNI to ...
0
votes
0answers
43 views

How to run command as privileged Windows service account against Active Directory domain controller?

I've compromised a Windows machine that leaks the password of a privileged service account ("Domain Admin") in memory (legal penetration test). Since the account is a service account, it cannot be ...
0
votes
0answers
47 views

Local Group Administrator Account shared across network?

I am a bit confused on the local group administrator account role. I managed to obtain domain administrator on a recent pentest but looking back at my results I am somewhat confused the actual ...
-2
votes
1answer
46 views

Penetration testing or Malware analysis? [closed]

My M.Sc research is about developing IDS for IOT. I'm confused about which field should learn more about; penetration testing or malware analysis. I have some knowledge about each one but for IDS, ...
0
votes
0answers
56 views

Wifi Pineapple - How would Karma or PineAP silently log probes from individual clients, *without* broadcasting beacons?

With the intention of silently gathering information about a client's environment, how would one utilize Karma and PineAP to log probes but not broadcast / reply with beacon packets? In the test lab, ...
0
votes
2answers
91 views

What tests can be performed on mobile apps to determine if they are secure?

My company is looking to work with a potential client's backend provider in order to make an app for them. To do this, we need to use their API. We've spoken to this company and they are worried about ...
1
vote
2answers
126 views

Database Pentest methodology or list? [closed]

I am looking for a practical database pentest methodology (database level test). I checked the Internet but there is no much info. Where I should start and on which areas (step by step) should I focus ...
0
votes
3answers
231 views

Pen testing - How to use credentials without remote desktop?

I'm a junior penetration tester, working in a place that does not give much guidance and I kind of just had to dive in. I'm pretty good, in that I can normally still obtain domain admin on networks I ...
0
votes
1answer
76 views

How is my employer accessing my router when employer's laptop is wirelessly connected to my home network

I have a modem bridged to a modern router running open source software and heavily secured. I have all connections to the router through a personal vpn from a dedicated provider. During work from home ...
0
votes
2answers
37 views

/cron path found when testing site

I am testing a site and using dirb tool built into kali and it picked up /cron with a 200 response. I went to that page and it is blank. Can someone tell me why that was picked up and there is nothing ...
0
votes
0answers
19 views

wifi hacking: evil twins WPA2-PSK phishing [duplicate]

I have created a Rouge access point using dnsmasq and hostapd with WPA2 configuration with the same SSID as my wifi network. It works fine and clients can connect to my Rouge AP. The question is: Is ...
0
votes
0answers
47 views

Planning a large time-bound pentest

I have let's say 15000 IP of my x.com client. I need to perform network pentest in 7 days only. The client has provided ranges of IPs and not specific IPs. It is a large company and it has third ...
0
votes
0answers
30 views

Unspecified form action - HTTP parameter pollution

Security scanner OWASP ZAP for form without specified action returns information that this results in vulnerability named HTTP parameter pollution. I've read about testing for this vulnerability ...
-3
votes
2answers
186 views

How to be a better ethical hacker? [closed]

I've been trying to learn ethical hacking for more than that two years thus far, I did a lot of practice on things like DVWA, hackthissite.org, metasploitable and some more similar apps and sites. Yet ...
0
votes
0answers
35 views

Mimikatz /rc4 argument for pass-the-ticket?

I'm studying how pass-the-ticket works using Mimikatz, i.e., forged Silver and Golden Kerberos tickets. The command usually takes the form (Golden tickets): kerberos::golden /sid:SID /domain:DOMAIN /...
1
vote
1answer
53 views

CSRF Testing. Validation Error 422. Locale Required

So I'm testing this site for coursework and I think it might be vulnerable CSRF however when I try to make a post request I get a validation error which says "locale" is required despite me specifying ...
3
votes
5answers
277 views

Cloud provider for Penetration Testing

I wish to set up a Kali Linux box on a cloud provider in order to perform same day penetration tests. The issue I am having is finding a cloud provider such as AWS, Azure etc. for this. For AWS they ...
2
votes
2answers
346 views

Penetration Testing List

I have been to various documents such as OSSTMM, NIST 800-115, PCI DSS pentesting document. But is there any place where I can find out baseline list for internal network penetration testing? For ...
0
votes
0answers
141 views

CORS returning two Access-Control-Allow-Origin headers?

I am doing a verification test for a CORS issue that we discovered. When specifying an origin, the application used to respond with the allow origin to any URL. However, upon retest, the application ...
3
votes
1answer
63 views

Is it a security defect to display the secure api_key in travis.yml file of source code of a web application in Github

I have been working on a code review of a project. The source code is publicly available on Github. I came across a file "travis.yml". In that file, I am able to see the secure api_key as shown in ...