Questions tagged [penetration-test]
An attempt to penetrate a system's security in an effort to evaluate the protections in place.
0
votes
1answer
36 views
Should I take (Pen test) approval from AWS for Fuzz testing my Application API's hosted on AWS? [on hold]
I wanted to Fuzz Tests my API's on my own stack which are hosted on AWS environment (Have used lambdas and API gateway)
There are mostly GET APIs and only one PUT API.My requirement is to Fuzz Test ...
0
votes
0answers
27 views
shellcode JMP-CALL-POP technique ( Segmentation fault (core dumped) )
I write this shellcode for spawn a shell on the box using JMP-CALL-POP technique but i keep got this error i don't now why !!
Segmentation fault (core dumped)
my shellcode :
section .text
...
1
vote
0answers
38 views
How to exploit this buffer overflow. Where is the return address?
I'm practicing doing buffer overflows and, weirdly, I can do some but not others and it is not clear to me why. Here is the example code:
Code that I need help with::
#include <stdio.h>
int ...
1
vote
2answers
31 views
Reverse shell refusing/difficulties to establish connection
I've been trying to reverse shell between different devices, however,
I'm never able to establish a connection or get a shell prompt
.
Let's say I have a Mac OSX as victim and use a raspberry Pi ...
-2
votes
0answers
54 views
Difference between Metasploit and PowerShell Empire [closed]
What makes you guys prefer using Metasploit insted of Empire?
0
votes
0answers
35 views
setuid hiajiaking [closed]
I am doing a pentest a linux machine 32 bits , I have a limited shell and trying to escalate privileges.
one interesting that I have found is upload binary inside /usr/local/bin/ hat has SUID ...
0
votes
1answer
37 views
how can I check if crackmapexec is noisy? [closed]
I would like if someone could give me a hand with this tool called crackmapexec. I want to know in those cases of red teaming when we only have one opportunity to pwn all the comapny at the moment to ...
231
votes
12answers
22k views
Is single quote filtering nonsense?
Penetration testers found out that we allow single quotes in submitted data fields, and want us to apply rules (input validation) to not allow them in any value.
While I'm aware that single quotes ...
0
votes
1answer
63 views
Penetration Testing authorization from AWS
We have a few web applications newly hosted on AWS. Before we run an automated pentest on the our Application URL using Netsparker, we had always e-mailed Amazon and requested authorization for the ...
1
vote
0answers
71 views
127.0.0.1 - Meterpreter session 2 closed. Reason: Died
I am new at metasploit and am trying to pentest an Android 5.1 device, so I setup for a stageFright attack but am having this issue: the 'meterpreter session closed' immediately, and the ngrok ...
0
votes
1answer
32 views
Android x86 vs Android on Qemu ARM
Situation: Emulating Android devices for pen-testing
Problem: Choosing between emulating Android x86 or emulating Android on Qemu runing on ARM
Question: In terms of vulnerabilities/exploitability, ...
0
votes
0answers
18 views
Metasploit wmap_run -e freezes on auxiliary/scanner/http/brute_dirs module, returns 404
I am trying to run a wmap scan on a web app locally on my Mac. But when wmap reached File/Dir testing, more specifically the brute force module, it does not show anything for path (even though the ...
2
votes
0answers
17 views
Burp Suite - Mark Issues as “Validated”
After performing a audit (formerly active and passive scan) of a web app with Burp suite I manually verify and validate the issues it identifies to rule out false positives, see what is possible with ...
0
votes
1answer
85 views
The Girl in the Spider's Web: SCSI hack?
In the movie, the main character is shown tapping into a network of surveillance cameras.
She uses a SCSI connector which allows her to send the camera footage to a remote computer.
I know it's a ...
0
votes
1answer
24 views
XMAS Scan vs Inverse TCP
Whats the difference between a XMAS Tree scan and an Inverse TCP scan using the FIN, URG, and PSH flags? Are they the same thing?
XMAS Tree scans are designed to manipulate the PSH, URG and FIN flags ...
1
vote
2answers
48 views
How do i extract data from response and use it in url for next request in Burp Intruder?
The URL is https://www.example.com/send?session=abcabcabc.
When the above URL is requested, a response comes with <a> tag which contains a new URL with a different session value like https://...
0
votes
2answers
59 views
AWS serverless architecture compliance with PCI DSS 11.3 penetration testing segmentation
I am wondering how to comply with PCI DSS requirements (11.3) to test segmentation controls using penetration testing in AWS serverless architecture.
We are using components such as AWS Lambda, AWS ...
0
votes
2answers
43 views
Australia's Legal Do's and Don'ts of Hacking [closed]
Just wondering what methods used in Pen-testing (Denial of service, dropping a shell, phishing, etc.) would land you in legal trouble in Australia?
5
votes
2answers
333 views
How do I monitor what a penetration tester is doing?
Suppose I have a penetration tester working in my data center. She is testing my systems and is probably finding some issues, allowing her to gain root access to a machine that is inside a subnet deep ...
1
vote
1answer
126 views
How to (temporarily) disable McAfee Endpoint Security on an enterprise workstation?
I need to temporarily disable McAfee Endpoint Security on an enterprise workstation after having obtained local administrative privileges. The McAfee Endpoint Security settings are protected by a ...
2
votes
1answer
158 views
Do security consultants routinely demonstrate hacking into attendees' PCs within minutes?
From this Quora answer:
Years ago when I was in China I was getting updated on cyber security
from one of our partnerships.
We were going over everything from basic hacks a 9 year old could ...
2
votes
0answers
53 views
How to identify the communication protocol used in a wireless device?
I really hope that this is the right place to ask.
I need to analyze a baby monitor for any security or privacy weaknesses.
The spec sheet of the baby monitor says, that it uses the ISM 2400~2483.5 ...
-1
votes
1answer
53 views
msfvenom produces different op codes when format is given with 'c' instead of 'python'
I still do not understand the msfvenom format ( -f ) parameter regarding the resulting op codes. I do not understand why a payload consists of different op codes when the format ( -f ) is different, ...
0
votes
2answers
62 views
PHP Code Injection vulnerability exists even after recommended hardening
Using Burp to intercept traffic and inject code we have identified
remote code execution vulnerability in a website. After entering data
in input fields on the form and clicking submit the traffic ...
1
vote
0answers
15 views
Does application security assessments done using SaaS solutions (WhiteHat Sentinal and Fortify on Demand) count as penetration tests?
SaaS security solutions such as "WhiteHat Sentinal" and "Fortify on Demand"
are getting popular now a days. Methodologies of both describe them involving manual verification. Does this qualify the ...
1
vote
0answers
128 views
Custom payload SQLMap from OWASP Zap vulnerability report
I ran OWASP Zap over my site.
In the vulnerability report I read that there is an SQL injection problem:
Advanced SQL Injection- MySQL > 5.0.11 stacked queries (SELECT - comment)
(see img for ...
1
vote
1answer
80 views
Getting scanned on AWS Elastic BeanStalk
As soon as I upload/deploy an application to AWS Elastic BeanStalk, it gets scanned for common admin pages even though it’s not linked to by any external website and I have not shared the DNS name ...
0
votes
1answer
83 views
What information should I provide to third party pen testers - (black box penetration)
I am going to hire a third party security company for Penetration testing in our company network. I have already selected a pen testing and black box testing company to do them, but they have ...
0
votes
1answer
92 views
Why it best to do security testing on a copy on a Virtual Machine rather than on than the live server? [closed]
Why is it better for a security tester to take a copy of a server e.g. eBay server and test it on a virtual machine rather than on than the real eBay server?
E.g. doing security testing on the live ...
1
vote
1answer
247 views
Reverse PHP shell disconnecting when netcat listener
Whilst performing a penetration test on a testing box, I came across a vulnerability regarding LotusCMS: https://www.exploit-db.com/exploits/18565
Rather than rely on Metasploit or Meterpreter to ...
-4
votes
1answer
184 views
How does testing on a Virtual Machine prevent the security tester from breaching the misuse act? [closed]
Why is it better for a security tester to test a virtual copy of a server e.g. eBay server and test it on a virtual machine rather than on the real eBay server?
E.g. Doing security on the real server ...
1
vote
1answer
100 views
SQL injection with an auto-incrementing parameter
I'm currently performing an API Pentest and I suspect an SQLi in one of the API calls. It updates a certain item of the web-service and requires an increase of the version number for each request.
...
0
votes
1answer
171 views
What all test cases/vulnerabilities we need to try in REST API Pen testing?
I am learning API pen testing and looking for resources which will give clear list of test cases we need to check while performing a Pen testing on REST API.
I have gone through the OWASP resources ...
0
votes
1answer
47 views
Testing Package Leakage at the Router [closed]
I'm home learning a course/certificate for pen-testing and security analysis. I came into a part in the process of pen-testing Perimeter Devices, specifically at testing the Router.
At this point I'm ...
0
votes
2answers
97 views
XSS alert not working with concatenated string
I've noticed that the following Stored XSS does not execute, whereas in the JS console it works:
<img src=0 onerror=alert(document.domain+": "+Date.now())>
This doesn't prompt an alert box. ...
2
votes
0answers
48 views
Pentest website available through per app VPN
I am trying to intercept web traffic with burp from mobile devices (Android and iPhone) that are enrolled in an MDM solution (MobileIron). There is one specific website I want to proxy, that is ...
0
votes
2answers
72 views
How can pentest reports contribute to structural solutions for vulnerabilities?
When you do a pentest what is your recommendation to the client on how to handle/interpret the report?
What I frequently see is that identified issues - especially issues related to self developed ...
0
votes
2answers
81 views
Web App or Web Services testing?
I am trying to clear up a doubt on security testing.
If the web app (GUI, functional UIs, user roles, et all), makes use of rest web services to take actions, I believe both the web app AND the web ...
1
vote
2answers
145 views
A computer on the public network I was using was penetrated at a codejam. Am I at risk?
I was at a code jam today for 12 hours. At the end of the day as I was leaving, one of the programmers claimed his computer was hit with a reverse shell attack. He was voicing this as I was ...
0
votes
2answers
377 views
I couldn't deauth any devices using aireplay-ng command in kali linux
I am using Kali linux. I've updated all tools and services by apt-get update and apt-get upgrade.
I was using aircrack-ng for pentesting my wlan network.
I wanted to deauth any device connected to my ...
2
votes
1answer
83 views
Can't log in dvwa with a simple python program, even though login credentials are good
import requests
target_url = "http://127.0.0.1/dvwa/login.php"
data_dict = {"csrfmiddlewaretoken": "bbbfeed6e1aea50f14a51a331054022c", "username": "admin", "password": "password", "Login": "Submit"}
...
0
votes
0answers
60 views
Pentesting web application with WebRTC video chat feature
I'm pentesting a web-application that uses peer-to-peer WebRTC for video chatting. I haven't come across this yet, so I'm a tad lost as of how to tackle this.
How can I verify the WebRTC ...
1
vote
0answers
44 views
What might an attacker do with email address as login name?
This might have been asked before, but I've looked for a few hours and can't find much.
I would also like some opinions on what an attacker might do if he enters an email address on a site and it ...
2
votes
2answers
61 views
What exactly does a default port scan look like? I am trying to run a default port scan without setting off the ids on my test network
What is the best option to use for a default port scan of a server on my test network without setting off the ids using nmap. -f is not a switch i am wanting to use.
-1
votes
3answers
77 views
Introduction Ethical Hacking [closed]
0 knowledge on ANYTHING, square 1 basically. Where can someone start and lead into the general direction to start off a career in this profession.
-1
votes
2answers
87 views
How can i access any useful information in a wordpress site?
While penetration testing for a university assignment, I found an exploit that might be the one the teacher has been hinting for, found here:
https://www.exploit-db.com/exploits/45439/
I used it and ...
2
votes
1answer
57 views
How do you test buffer overflows in the lab?
I'm doing a lot of learning about buffer overflows, and BROP. My problem is how can I test against real software in the lab? I can find a lot of CVE's that contain sever bugs that are open to a buffer ...
2
votes
0answers
99 views
OWASP Testing Guide Equivalent for Desktop Applications [closed]
I was wondering if any of you know of a guide similar to the OWASP Testing Guide but meant specifically for desktop applications?
I had no luck searching the Internet.
I am looking for something ...
2
votes
2answers
118 views
Kerberos unconstrained delegation for user
I've noticed that there is an option to set "Trust this user for delegation to any service" that can be set for service users. I've read a lot about unconstrained delegation with regards to computers ...
1
vote
2answers
172 views
POST Method Anti-CSRF Help With Burp Suite
I am testing a web application and encountering anti-CSRF tokens within forms which is hampering fuzzing attempts using Burp Suite intruder. An anti-CSRF token appears as csrf-token within a HTML meta ...
