Questions tagged [penetration-test]

An attempt to penetrate a system's security in an effort to evaluate the protections in place.

Filter by
Sorted by
Tagged with
0
votes
1answer
44 views

Difference between Web App Pentesting and Web App Security Audit

I'm having a hard time drawing the line between Web App pentesting vs a Web App Security Audit. For instance, OWASP Testing Guide could be used for both of those cases. Let's say the pentester and ...
0
votes
2answers
40 views

Nmap scanning with and without proxychains has different behaviour

I'm doing a nmap scan to my own machine to my own machine. First of all I set the port 333 to listen with this command sudo nc -lvnp 333 On the other terminal I run sudo nmap -O -sV -p 0-65535 IP ...
10
votes
3answers
908 views

Why are there different pentest phases/stages/methodologies?

Why are there different pentest phases/stages/methodologies? Which one should be used? Why don't we come out with standard one? E.g. Wikipedia / Cybrary.it Reconnaissance Scanning Gaining ...
1
vote
1answer
85 views

precautions before conducting a penetration test

What can be the harms to an organisation if they do not take appropriate precautions before conducting a penetration test and what would be the negative impacts? According to me, The key here is to ...
0
votes
1answer
50 views

Pentesting Webserver Dead End (MySQL White Listing Bypass)

I am currently pentesting a webserver running MySQL, managed to obtain its db configuration (w/ login credentials) but the hostname is in a Local Area Network. The server has white listing enabled, so ...
0
votes
0answers
60 views

Bypassing SSL pinning Using Frida issue

I am a penetration tester, and I was doing some SSL pinning bypass using Frida. I have pushed all the required files and certificates, and burp is intercepting traffic from the Android Studio ...
32
votes
6answers
15k views

As a company, how can we prevent penetration testers from compromising our system?

What tools or techniques can companies use to prevent penetration testers from behaving maliciously and exfiltrating data or compromising the system? I cannot imagine that the only protections ...
0
votes
2answers
58 views

First step into pentesting Vaadin web application framework

I have been given a project to perform penetration testing on a Vaadin Web Application. This kind of web application is new for me, so I'm just wondering what should I prepare to perform penetration ...
0
votes
1answer
49 views

Calculate Content-Length (HTTP Request Smuggling)

I am trying to understand more about HTTP Request Smuggling and I have been reading this article (https://portswigger.net/web-security/request-smuggling). Content-Length represents the length of the ...
4
votes
1answer
51 views

Exploitation of client_id in OAuth

We have a web app where the back end is composed of APIs. We use OAuth to authorize the web app's call to the APIs. We all know that in OAuth, there is always the Authorization endpoint used to get ...
0
votes
0answers
12 views

Session Hijacking with remote server [duplicate]

Session cookie can help to bypass 2FA. Suppose victim and attacker are on same network without firewall. Attacker wants to steal victims login session. So attacker sends original login page over ...
0
votes
1answer
53 views

How to pentest RMI

I have a Swing client that communicates through T3 protocol (RMI) with a Server. Now I want to capture the requests and modify them (like HTTP in Burp or OWASP ZAP). Is there any attack proxy for RMI/...
0
votes
1answer
63 views

Arp poisoning is disrupting the LAN

I'm poisoning my home network, I was able to do it 1 time. When i tried several more times to poison the wifi network or the cable network the "target" started to lose connectivity in both cases. ...
0
votes
0answers
57 views

nmap script “smb-os-discovery.nse” does not output information about the host OS?

I was following this Lynda course. https://www.linkedin.com/learning/ethical-hacking-enumeration/enumerating-smb-from-linux-episode-1 The instructor used this script to detect the OS of the target ...
0
votes
0answers
61 views

Protect Socket.IO server against DOS

I'm currently pentesting an Angular application that connects to a Socket.IO server. The authentication process is in the line of: Unauthenticated request gets redirected to SSO for login Login ...
0
votes
2answers
72 views

Can demo exploits/attacks be run on desktop applications? [closed]

Are there any applications/tools for exploiting desktop applications? (with pre-built exploits) I'd like to test my Java desktop app for security. I've looked at tools like Metasploit, but they seem ...
1
vote
1answer
164 views

Success rate of pixie dust attack

Recently I read about the pixie dust attack in which a WPS PIN is decoded with time stamp and other resources within a fraction of a second. The only drawback is that it only works on WPS enabled ...
0
votes
1answer
48 views

PostgreSQL exploit not loading in MSFConsole from ExploitDB

Just trying to get a postgreSQL exploit (32847.txt - Low Cost Function ) from exploitdb to run in msfconsole. After pulling my hair out trying to figure out why it isn't loading, here I am. I'm using ...
0
votes
1answer
119 views

How to approach Web App? [closed]

I'm doing testing on the app, if we take only login url as a starting point. How to expand my horizons? I want to make my surface wider, really kinda stuck on this one.
-1
votes
1answer
48 views

How to remove CRLF [http request header termination] character programatically?

I am trying to make the http request by removing the header termination character. I manually removed it by intercepting the request in proxies like burp and manually removing the header termination ...
0
votes
1answer
64 views

Is it possible for OWASP ZAP to pass-through some requests without intercepting them, as if there were no proxy?

I have an iOS app with certificate pinning to two different servers. I want to test this certificate pinning with a MITM attack, so I did: Set proxy at my PC, in macos wifi settings -> advanced -> ...
1
vote
1answer
116 views

Can pen-testing be done on a person's regular machine, or should it be done on a separate machine?

I am a developer and I have been looking more into security / pen-testing to make sure my application is secure. A lot of the resources I have looked at mention having a "pen-testing machine/lab/box,"...
1
vote
1answer
63 views

What is the impact of controling the content of a webview in Android?

I'm learning android application pen testing and I'm kinda lost about what can do an attacker that control the content of a webview ? I guess if there is no javascript enabled there is no impact, ...
0
votes
1answer
74 views

security for intranet applications [duplicate]

If an application is intended to work only on a machine which is NOT connected to the internet BUT stores extremely confidential information, should we implement same security policy as if it was ...
0
votes
1answer
156 views

Which web vulnerabilities should I test for when pentesting a static site?

I have a static-page website that I need to pentest. What I mean by this is that the site does not have a database, and it has no area to submit user input except for to a third party payment service ...
0
votes
0answers
53 views

Issue using John The Ripper

First things first, I'm a newbie so, bear with me... I created a word list with a combination of a possible password for a certain user using Crunch (it's the dictionary output) and need to use John ...
0
votes
1answer
53 views

Question about XSS

I'm new to penetration testing and I found a Reflected XSS vulnerability on the website I'm working on. But the thing is when I submit the form the website automatically redirect me to www.website....
0
votes
1answer
35 views

Nikto nocache option

I found an option -nocache : Disable response cache in here https://cirt.net/nikto2-docs/options.html But when I tried it, I always get this error Unknown option: nocache
0
votes
0answers
34 views

I found io.fabric.apikey in Androidmanifest.xml [duplicate]

Is there any way to use this api maliciously. If yes please give reference. If this api key is leaking anywhere on internet is it considered as sensitive?
0
votes
2answers
231 views

Find Buffer Overflows at a target you want to gain access

I want to pass my OSCP exam and I am learning with the material I got. I watched the videos and read the pdf but I have a question about buffer overflows. In the example in the videos, the guy has ...
1
vote
4answers
81 views

Adding to the query string via input

I have a form that takes multiple input fields and makes an API request via GET. The fields are not properly sanitizing input and I am able to add arbitrary parameters to the query string by ...
0
votes
0answers
103 views

Aireplay-ng works fine from command line but can't deauth from inside Fern Wifi Cracker

I have Kali Linux 2019.4 ARM-64 installed on a Raspberry Pi 3B. I have installed the Fern Wifi Cracker software. When I launch the "Wifi Attack" from inside Fern, I can see Aireplay-ng sending Deauth ...
1
vote
1answer
83 views

Security in web sockets

Scope: penetration testing of web server with critical information in it (user management). I had an argument with my college about security in web sockets and I got stuck with him in one topic, ...
0
votes
0answers
45 views

How can Lingering Object Liquidator be used on a penetration test

How can Microsoft's Lingering Object Liquidator be used as part of a penetration test? I am a junior penetration tester, and saw a discussion between more senior pentesters discussing using LOL to get ...
5
votes
3answers
371 views

What are the advantages and disadvantages of using a HackRF One compared to specific protocol sniffers?

I am performing some research on IoT test tools and came across the HackRF One which can transmit and receive from 1 MHz to 6 GHz. I therefore think that it can analyze many protocols, but I cannot ...
2
votes
2answers
335 views

Is there practical risk to having UDP ports open?

I understand that everything is potentially an attack vector, but I would like to ask a practical question about UDP ports Suppose you're pentesting some small organisation and you found a couple of ...
1
vote
0answers
88 views

Is Social Engineering out of scope unless explicitly requested? [closed]

I've seen some sample "What would you like to be pentested?" page (I can't find or remember the exact source) where Cyber, Physical and Social were asked separately (among other areas like Wifi, ...
0
votes
1answer
92 views

Penetration testing from a phone

Suppose that I use a smartphone with an external WiFi adapter to cover up my real MAC address and on top of that I use a no-log VPN. In what way could I still be identified? I have heard a lot of talk ...
1
vote
1answer
40 views

Should we do request manipulation or network packet manipulation for SDN vulnerability analysis? [closed]

I am planning to do vulnerability analysis of a Software Defined Network. Since the connection between the business apps and the controller of the SDN would be done over the application layer, I would ...
1
vote
1answer
137 views

Is an OS more vulnerable while it is being updated?

Are there any additional attack vectors that apply when an OS is being updated? For example, would the services that are being updated be unstable? An OS is generally more secure after being updated, ...
0
votes
1answer
217 views

What is next step after nmap + metasploit? [closed]

When I'm working on hack boxes, what I do (if not using Armitage) is: nmap the box to discover running services version search metasploit to find a working exploit for that version Now I'm stuck. ...
0
votes
1answer
54 views

Is RFI still a viable attack vector?

So, I know Remote File Inclusion bugs are practically dead within modern PHP applications since register_globals and allow_url_includes are disabled by default in php.ini (ever since php5x I believe?) ...
0
votes
1answer
242 views

How to prevent Directory Enumeration Attacks (DirB or Directory Buster)

I am dabbling in pen testing (OWASP Juice Shop) and I realized many web application attacks start from enumeration where the attacker uses DirB to find vulnerable Web Objects or Directories to attack ...
0
votes
1answer
163 views

OWASP ZAP submit forms

I'm trying to find SQL injection vulnerability in DVWA with OWASP ZAP. After some clicking through the page I have a small site map: I ran Active scan, Spider and AJAX spider on the GET:sqli node. As ...
0
votes
1answer
192 views

Command Injection DVWA (1.0.7 iso version) High Security level

I am practising on an older version of DVWA (1.0.7 iso image). In High Security settings, I am trying to perform command injection and this is the source code snippet I saw $target = stripslashes( $...
2
votes
0answers
89 views

Where is the line drawn for ethical hackers using stolen credentials in their paid services? [closed]

When “ethical” hackers/pen testers harvest repositories of stolen credentials to then use them in pen testing for paying clients, what ethical boundaries are broken? If a lazy hacker leaves their ...
2
votes
1answer
159 views

What do I do if I catch someone doing a physical pentest? [duplicate]

This question was primarily inspired by this (related) question, but is about the other side of the equation. I'm a security engineer at Medium Sized Company, Inc. We recently hired John for a ...
-2
votes
1answer
72 views

Can employees' personal properties be part of the scope? [closed]

Let's assume the customer (target) wants to have a full physical pentest done. (I'm a student and have 0 exp in actual Pentesting and Red Teaming Properties of topic: Cars (in the car park) ...
1
vote
0answers
134 views

SQL Injection only with OR

I am doing a practise SQL injection in a search field and I don't understand the logic of what is happening. The following behaviours is what I noticed: Entering ' OR '1' = '1 shows all the results. ...
37
votes
2answers
12k views

Should I present forged documents in a Penetration Test/Red team engagement?

A previous question of mine lead to this discussion which mentioned the subject of Document forgery. I've seen many people (in videos) forge IDs and employee badges for such engagements so that seems ...

1
2 3 4 5
25